[Spice-commits] 1011 commits - .gitmodules HACKING MAINTAINERS Makefile Makefile.objs QMP/qmp-events.txt VERSION arch_init.c async.c audio/audio_int.h block-migration.c block.c block/Makefile.objs block/backup.c block/commit.c block/cow.c block/curl.c block/gluster.c block/iscsi.c block/mirror.c block/qcow.c block/qcow2-cluster.c block/qcow2-refcount.c block/qcow2-snapshot.c block/qcow2.c block/qcow2.h block/qed.c block/raw-posix.c block/raw-win32.c block/raw.c block/rbd.c block/sheepdog.c block/ssh.c block/stream.c block/vdi.c block/vhdx.h block/vmdk.c block/vpc.c block/vvfat.c blockdev.c bsd-user/elfload.c bsd-user/main.c bsd-user/qemu.h configure cpu-exec.c cpus.c cputlb.c default-configs/alpha-softmmu.mak default-configs/i386-softmmu.mak default-configs/mips-softmmu.mak default-configs/mips64-softmmu.mak default-configs/mips64el-softmmu.mak default-configs/mipsel-softmmu.mak default-configs/ppc-softmmu.mak default-configs/ppc64-softmmu.mak default-configs/ppcemb-softmmu.mak defa ult-configs/sh4-softmmu.mak default-configs/sh4eb-softmmu.mak default-configs/sparc64-softmmu.mak default-configs/x86_64-softmmu.mak device_tree.c disas.c dma-helpers.c docs/atomics.txt docs/qapi-code-gen.txt docs/rdma.txt dump.c exec.c fsdev/qemu-fsdev.c gdbstub.c hmp-commands.hx hmp.c hmp.h hw/9pfs hw/acpi hw/alpha hw/arm hw/audio hw/block hw/char hw/core hw/cpu hw/cris hw/display hw/dma hw/gpio hw/i2c hw/i386 hw/ide hw/input hw/intc hw/isa hw/lm32 hw/m68k hw/microblaze hw/mips hw/misc hw/moxie hw/net hw/nvram hw/openrisc hw/pci hw/pci-bridge hw/pci-host hw/ppc hw/s390x hw/scsi hw/sd hw/sh4 hw/sparc hw/sparc64 hw/ssi hw/timer hw/tpm hw/unicore32 hw/usb hw/virtio hw/watchdog hw/xen hw/xtensa include/block include/exec include/hw include/migration include/monitor include/net include/qapi include/qemu include/qemu-common.h include/qom include/sysemu include/ui ioport.c kvm-all.c kvm-stub.c ldscripts/alpha.ld ldscripts/arm.ld ldscripts/hppa.ld ldscripts/i386.ld ldscripts/ia64. ld ldscripts/m68k.ld ldscripts/mips.ld ldscripts/ppc.ld ldscripts/ppc64.ld ldscripts/s390.ld ldscripts/sparc.ld ldscripts/sparc64.ld ldscripts/x86_64.ld libcacard/vcard_emul_nss.c linux-user/alpha linux-user/arm linux-user/cpu-uname.c linux-user/cris linux-user/elfload.c linux-user/i386 linux-user/ioctls.h linux-user/linuxload.c linux-user/m68k linux-user/main.c linux-user/microblaze linux-user/mips linux-user/mips64 linux-user/mmap.c linux-user/openrisc linux-user/ppc linux-user/qemu.h linux-user/s390x linux-user/sh4 linux-user/signal.c linux-user/socket.h linux-user/sparc linux-user/sparc64 linux-user/syscall.c linux-user/syscall_defs.h linux-user/unicore32 linux-user/x86_64 memory.c memory_mapping.c migration-rdma.c migration.c monitor.c net/eth.c net/net.c pc-bios/README pc-bios/acpi-dsdt.aml pc-bios/bios.bin pc-bios/multiboot.bin pc-bios/optionrom pc-bios/palcode-clipper pc-bios/q35-acpi-dsdt.aml pc-bios/qemu-nsis.bmp pc-bios/qemu-nsis.ico pc-bios/s390-ccw pc-bios/s390- ccw.img po/Makefile qapi-schema-test.json qapi-schema.json qapi/qapi-visit-core.c qapi/qmp-input-visitor.c qdev-monitor.c qemu-char.c qemu-coroutine-io.c qemu-coroutine-lock.c qemu-doc.texi qemu-img.c qemu-options.hx qemu-seccomp.c qemu.nsi qemu.sasl qga/service-win32.c qmp-commands.hx qobject/qdict.c qobject/qjson.c qom/cpu.c qom/object.c qtest.c roms/qemu-palcode savevm.c scripts/cleanup-trace-events.pl scripts/qapi-commands.py scripts/qapi-types.py scripts/qapi-visit.py scripts/qapi.py slirp/mbuf.h slirp/tcp_subr.c stubs/Makefile.objs stubs/cpus.c stubs/gdbstub.c stubs/vm-stop.c target-alpha/Makefile.objs target-alpha/cpu-qom.h target-alpha/cpu.c target-alpha/cpu.h target-alpha/gdbstub.c target-alpha/helper.c target-alpha/helper.h target-alpha/machine.c target-alpha/mem_helper.c target-alpha/sys_helper.c target-alpha/translate.c target-arm/Makefile.objs target-arm/arm-semi.c target-arm/cpu-qom.h target-arm/cpu.c target-arm/cpu.h target-arm/gdbstub.c target-arm/helper.c ta rget-arm/kvm-stub.c target-arm/kvm.c target-arm/kvm_arm.h target-arm/machine.c target-arm/translate.c target-cris/Makefile.objs target-cris/cpu-qom.h target-cris/cpu.c target-cris/cpu.h target-cris/gdbstub.c target-cris/helper.c target-cris/translate.c target-i386/Makefile.objs target-i386/arch_dump.c target-i386/cpu-qom.h target-i386/cpu.c target-i386/cpu.h target-i386/gdbstub.c target-i386/helper.c target-i386/kvm.c target-i386/machine.c target-i386/misc_helper.c target-i386/seg_helper.c target-i386/smm_helper.c target-i386/translate.c target-lm32/Makefile.objs target-lm32/cpu-qom.h target-lm32/cpu.c target-lm32/cpu.h target-lm32/gdbstub.c target-lm32/helper.c target-lm32/op_helper.c target-lm32/translate.c target-m68k/Makefile.objs target-m68k/cpu-qom.h target-m68k/cpu.c target-m68k/cpu.h target-m68k/gdbstub.c target-m68k/helper.c target-m68k/m68k-semi.c target-m68k/translate.c target-microblaze/Makefile.objs target-microblaze/cpu-qom.h target-microblaze/cpu.c target-micr oblaze/cpu.h target-microblaze/gdbstub.c target-microblaze/helper.c target-microblaze/op_helper.c target-microblaze/translate.c target-mips/Makefile.objs target-mips/cpu-qom.h target-mips/cpu.c target-mips/cpu.h target-mips/dsp_helper.c target-mips/gdbstub.c target-mips/helper.c target-mips/op_helper.c target-mips/translate.c target-moxie/cpu.c target-moxie/cpu.h target-moxie/helper.c target-moxie/translate.c target-openrisc/Makefile.objs target-openrisc/cpu.c target-openrisc/cpu.h target-openrisc/gdbstub.c target-openrisc/machine.c target-openrisc/mmu.c target-openrisc/translate.c target-ppc/Makefile.objs target-ppc/cpu-models.c target-ppc/cpu-models.h target-ppc/cpu-qom.h target-ppc/cpu.h target-ppc/excp_helper.c target-ppc/gdbstub.c target-ppc/kvm-stub.c target-ppc/kvm.c target-ppc/kvm_ppc.h target-ppc/machine.c target-ppc/mmu-hash32.c target-ppc/mmu-hash64.c target-ppc/mmu_helper.c target-ppc/translate.c target-ppc/translate_init.c target-s390x/Makefile.objs target-s390x /cpu-qom.h target-s390x/cpu.c target-s390x/cpu.h target-s390x/gdbstub.c target-s390x/helper.c target-s390x/kvm.c target-s390x/translate.c target-sh4/Makefile.objs target-sh4/cpu-qom.h target-sh4/cpu.c target-sh4/cpu.h target-sh4/gdbstub.c target-sh4/helper.c target-sh4/translate.c target-sparc/Makefile.objs target-sparc/cpu-qom.h target-sparc/cpu.c target-sparc/cpu.h target-sparc/gdbstub.c target-sparc/int32_helper.c target-sparc/int64_helper.c target-sparc/ldst_helper.c target-sparc/mmu_helper.c target-sparc/translate.c target-unicore32/cpu-qom.h target-unicore32/cpu.c target-unicore32/cpu.h target-unicore32/softmmu.c target-unicore32/translate.c target-xtensa/Makefile.objs target-xtensa/cpu-qom.h target-xtensa/cpu.c target-xtensa/cpu.h target-xtensa/gdbstub.c target-xtensa/helper.c target-xtensa/op_helper.c target-xtensa/translate.c target-xtensa/xtensa-semi.c tcg/aarch64 tcg/arm tcg/hppa tcg/i386 tcg/ia64 tcg/mips tcg/ppc tcg/ppc64 tcg/sparc tcg/tcg-op.h tcg/tcg-opc.h tcg /tcg.c tcg/tcg.h tcg/tci tests/Makefile tests/boot-order-test.c tests/endianness-test.c tests/fdc-test.c tests/fw_cfg-test.c tests/hd-geo-test.c tests/ide-test.c tests/libqos tests/libqtest.c tests/libqtest.h tests/qapi-schema tests/qemu-iotests tests/tcg tests/test-bitops.c tests/test-int128.c tests/test-qmp-input-visitor.c tests/test-qmp-output-visitor.c tests/test-thread-pool.c tests/test-visitor-serialization.c tpm.c trace-events translate-all.c ui/console.c ui/gtk.c ui/spice-core.c ui/vnc.c user-exec.c util/acl.c util/aes.c util/notify.c util/qemu-error.c util/qemu-option.c util/qemu-sockets.c vl.c xen-all.c xen-stub.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Tue Jul 30 01:37:59 PDT 2013


 .gitmodules                                    |    2 
 HACKING                                        |   19 
 MAINTAINERS                                    |   56 
 Makefile                                       |   60 
 Makefile.objs                                  |    1 
 QMP/qmp-events.txt                             |   17 
 VERSION                                        |    2 
 arch_init.c                                    |  172 +
 async.c                                        |   33 
 audio/audio_int.h                              |   31 
 block-migration.c                              |   32 
 block.c                                        |  108 
 block/Makefile.objs                            |    1 
 block/backup.c                                 |  386 ++
 block/commit.c                                 |    2 
 block/cow.c                                    |    1 
 block/curl.c                                   |   24 
 block/gluster.c                                |   72 
 block/iscsi.c                                  |  104 
 block/mirror.c                                 |    2 
 block/qcow.c                                   |    1 
 block/qcow2-cluster.c                          |   41 
 block/qcow2-refcount.c                         |  136 -
 block/qcow2-snapshot.c                         |    6 
 block/qcow2.c                                  |   33 
 block/qcow2.h                                  |   34 
 block/qed.c                                    |    1 
 block/raw-posix.c                              |   11 
 block/raw-win32.c                              |    7 
 block/raw.c                                    |   14 
 block/rbd.c                                    |    1 
 block/sheepdog.c                               |   33 
 block/ssh.c                                    |   16 
 block/stream.c                                 |    2 
 block/vdi.c                                    |    1 
 block/vhdx.h                                   |    2 
 block/vmdk.c                                   |  101 
 block/vpc.c                                    |   25 
 block/vvfat.c                                  |   25 
 blockdev.c                                     |  566 ++--
 bsd-user/elfload.c                             |    6 
 bsd-user/main.c                                |   17 
 bsd-user/qemu.h                                |    2 
 configure                                      |  174 -
 cpu-exec.c                                     |   31 
 cpus.c                                         |  290 +-
 cputlb.c                                       |   30 
 default-configs/alpha-softmmu.mak              |    1 
 default-configs/i386-softmmu.mak               |    3 
 default-configs/mips-softmmu.mak               |    2 
 default-configs/mips64-softmmu.mak             |    2 
 default-configs/mips64el-softmmu.mak           |    2 
 default-configs/mipsel-softmmu.mak             |    2 
 default-configs/ppc-softmmu.mak                |    2 
 default-configs/ppc64-softmmu.mak              |   10 
 default-configs/ppcemb-softmmu.mak             |    2 
 default-configs/sh4-softmmu.mak                |    9 
 default-configs/sh4eb-softmmu.mak              |    9 
 default-configs/sparc64-softmmu.mak            |    1 
 default-configs/x86_64-softmmu.mak             |    3 
 device_tree.c                                  |   56 
 disas.c                                        |    4 
 dma-helpers.c                                  |    6 
 docs/atomics.txt                               |  352 ++
 docs/qapi-code-gen.txt                         |  109 
 docs/rdma.txt                                  |  424 +++
 dump.c                                         |   16 
 exec.c                                         |  624 ++--
 fsdev/qemu-fsdev.c                             |    2 
 gdbstub.c                                      | 1633 +-----------
 hmp-commands.hx                                |   24 
 hmp.c                                          |  128 
 hmp.h                                          |    1 
 hw/9pfs/virtio-9p-device.c                     |   27 
 hw/9pfs/virtio-9p-proxy.c                      |    2 
 hw/acpi/core.c                                 |    9 
 hw/acpi/ich9.c                                 |   10 
 hw/acpi/piix4.c                                |   84 
 hw/alpha/alpha_sys.h                           |    2 
 hw/alpha/dp264.c                               |    6 
 hw/alpha/pci.c                                 |   44 
 hw/alpha/typhoon.c                             |  101 
 hw/arm/armv7m.c                                |   26 
 hw/arm/boot.c                                  |   85 
 hw/arm/exynos4210.c                            |   12 
 hw/arm/exynos4_boards.c                        |    4 
 hw/arm/highbank.c                              |   87 
 hw/arm/integratorcp.c                          |   91 
 hw/arm/kzm.c                                   |    6 
 hw/arm/mainstone.c                             |    2 
 hw/arm/musicpal.c                              |  182 -
 hw/arm/omap1.c                                 |   52 
 hw/arm/omap2.c                                 |   16 
 hw/arm/omap_sx1.c                              |   14 
 hw/arm/palm.c                                  |   10 
 hw/arm/pxa2xx.c                                |  116 
 hw/arm/pxa2xx_gpio.c                           |   37 
 hw/arm/pxa2xx_pic.c                            |   20 
 hw/arm/realview.c                              |   16 
 hw/arm/spitz.c                                 |   45 
 hw/arm/stellaris.c                             |   83 
 hw/arm/strongarm.c                             |  154 -
 hw/arm/tosa.c                                  |    2 
 hw/arm/versatilepb.c                           |   44 
 hw/arm/vexpress.c                              |  159 +
 hw/arm/xilinx_zynq.c                           |    6 
 hw/audio/ac97.c                                |    7 
 hw/audio/adlib.c                               |   21 
 hw/audio/cs4231.c                              |   18 
 hw/audio/cs4231a.c                             |    4 
 hw/audio/es1370.c                              |    3 
 hw/audio/gus.c                                 |    1 
 hw/audio/hda-codec.c                           |    3 
 hw/audio/intel-hda.c                           |    5 
 hw/audio/marvell_88w8618.c                     |   16 
 hw/audio/milkymist-ac97.c                      |   15 
 hw/audio/pcspk.c                               |    3 
 hw/audio/pl041.c                               |   48 
 hw/audio/sb16.c                                |    1 
 hw/block/dataplane/virtio-blk.c                |   19 
 hw/block/fdc.c                                 |  142 -
 hw/block/m25p80.c                              |   12 
 hw/block/nand.c                                |   81 
 hw/block/nvme.c                                |    4 
 hw/block/onenand.c                             |   40 
 hw/block/pc_sysfw.c                            |    7 
 hw/block/pflash_cfi01.c                        |   40 
 hw/block/pflash_cfi02.c                        |   44 
 hw/block/virtio-blk.c                          |   33 
 hw/block/xen_disk.c                            |   14 
 hw/char/cadence_uart.c                         |   20 
 hw/char/debugcon.c                             |    3 
 hw/char/escc.c                                 |   49 
 hw/char/etraxfs_ser.c                          |   40 
 hw/char/exynos4210_uart.c                      |   30 
 hw/char/grlib_apbuart.c                        |   15 
 hw/char/imx_serial.c                           |   20 
 hw/char/ipack.c                                |    1 
 hw/char/ipoctal232.c                           |    1 
 hw/char/lm32_juart.c                           |   21 
 hw/char/lm32_uart.c                            |   15 
 hw/char/mcf_uart.c                             |    2 
 hw/char/milkymist-uart.c                       |   17 
 hw/char/omap_uart.c                            |    2 
 hw/char/parallel.c                             |    3 
 hw/char/pl011.c                                |  112 
 hw/char/serial-isa.c                           |    3 
 hw/char/serial-pci.c                           |   10 
 hw/char/serial.c                               |    4 
 hw/char/sh_serial.c                            |    6 
 hw/char/spapr_vty.c                            |   16 
 hw/char/tpci200.c                              |   13 
 hw/char/virtio-serial-bus.c                    |    2 
 hw/char/xilinx_uartlite.c                      |   34 
 hw/core/empty_slot.c                           |   16 
 hw/core/loader.c                               |   85 
 hw/core/qdev-properties.c                      |   68 
 hw/cpu/a15mpcore.c                             |   22 
 hw/cpu/a9mpcore.c                              |   17 
 hw/cpu/arm11mpcore.c                           |   48 
 hw/cpu/icc_bus.c                               |   10 
 hw/cris/axis_dev88.c                           |    8 
 hw/display/cirrus_vga.c                        |   30 
 hw/display/exynos4210_fimd.c                   |   26 
 hw/display/framebuffer.c                       |   12 
 hw/display/g364fb.c                            |   30 
 hw/display/jazz_led.c                          |   14 
 hw/display/milkymist-tmu2.c                    |   15 
 hw/display/milkymist-vgafb.c                   |   19 
 hw/display/omap_dss.c                          |   10 
 hw/display/omap_lcdc.c                         |    2 
 hw/display/pl110.c                             |  140 -
 hw/display/pxa2xx_lcd.c                        |    2 
 hw/display/qxl-render.c                        |    2 
 hw/display/qxl.c                               |   29 
 hw/display/sm501.c                             |    8 
 hw/display/tc6393xb.c                          |    4 
 hw/display/tcx.c                               |   30 
 hw/display/vga-isa-mm.c                        |    8 
 hw/display/vga-isa.c                           |    7 
 hw/display/vga-pci.c                           |   14 
 hw/display/vga.c                               |   23 
 hw/display/vga_int.h                           |    8 
 hw/display/vmware_vga.c                        |   51 
 hw/dma/etraxfs_dma.c                           |    2 
 hw/dma/i82374.c                                |   18 
 hw/dma/i8257.c                                 |    4 
 hw/dma/omap_dma.c                              |   15 
 hw/dma/pl080.c                                 |   93 
 hw/dma/pl330.c                                 |    3 
 hw/dma/puv3_dma.c                              |   14 
 hw/dma/pxa2xx_dma.c                            |   22 
 hw/dma/rc4030.c                                |    4 
 hw/dma/sparc32_dma.c                           |   26 
 hw/dma/sun4m_iommu.c                           |   14 
 hw/dma/xilinx_axidma.c                         |    2 
 hw/gpio/omap_gpio.c                            |   68 
 hw/gpio/pl061.c                                |  112 
 hw/gpio/puv3_gpio.c                            |   14 
 hw/gpio/zaurus.c                               |   21 
 hw/i2c/bitbang_i2c.c                           |   27 
 hw/i2c/core.c                                  |    1 
 hw/i2c/exynos4210_i2c.c                        |   18 
 hw/i2c/omap_i2c.c                              |   40 
 hw/i2c/pm_smbus.c                              |   28 
 hw/i2c/versatile_i2c.c                         |   22 
 hw/i386/kvm/apic.c                             |    4 
 hw/i386/kvm/clock.c                            |   94 
 hw/i386/kvm/i8254.c                            |    2 
 hw/i386/kvm/i8259.c                            |    4 
 hw/i386/kvm/ioapic.c                           |    7 
 hw/i386/kvm/pci-assign.c                       |   38 
 hw/i386/kvmvapic.c                             |  120 
 hw/i386/multiboot.c                            |    2 
 hw/i386/pc.c                                   |  130 -
 hw/i386/pc_piix.c                              |   77 
 hw/i386/pc_q35.c                               |   25 
 hw/ide/ahci.c                                  |   59 
 hw/ide/ahci.h                                  |   10 
 hw/ide/cmd646.c                                |   79 
 hw/ide/core.c                                  | 1251 +++++----
 hw/ide/ich.c                                   |   33 
 hw/ide/internal.h                              |    1 
 hw/ide/isa.c                                   |    1 
 hw/ide/macio.c                                 |  248 +
 hw/ide/mmio.c                                  |    4 
 hw/ide/pci.c                                   |   30 
 hw/ide/pci.h                                   |    8 
 hw/ide/piix.c                                  |   41 
 hw/ide/qdev.c                                  |    1 
 hw/ide/via.c                                   |   27 
 hw/input/milkymist-softusb.c                   |   20 
 hw/input/pckbd.c                               |    8 
 hw/input/pl050.c                               |   84 
 hw/input/pxa2xx_keypad.c                       |    2 
 hw/intc/Makefile.objs                          |    6 
 hw/intc/apic.c                                 |    2 
 hw/intc/arm_gic.c                              |   18 
 hw/intc/arm_gic_common.c                       |    2 
 hw/intc/arm_gic_kvm.c                          |    6 
 hw/intc/armv7m_nvic.c                          |   18 
 hw/intc/etraxfs_pic.c                          |   25 
 hw/intc/exynos4210_combiner.c                  |   25 
 hw/intc/exynos4210_gic.c                       |   53 
 hw/intc/gic_internal.h                         |    5 
 hw/intc/grlib_irqmp.c                          |   35 
 hw/intc/heathrow_pic.c                         |    2 
 hw/intc/i8259.c                                |    6 
 hw/intc/imx_avic.c                             |   30 
 hw/intc/ioapic.c                               |    5 
 hw/intc/ioapic_common.c                        |   12 
 hw/intc/lm32_pic.c                             |   27 
 hw/intc/omap_intc.c                            |   61 
 hw/intc/openpic.c                              |  102 
 hw/intc/openpic_kvm.c                          |  264 ++
 hw/intc/pl190.c                                |   80 
 hw/intc/puv3_intc.c                            |   25 
 hw/intc/realview_gic.c                         |   23 
 hw/intc/sh_intc.c                              |   11 
 hw/intc/slavio_intctl.c                        |   40 
 hw/intc/xics.c                                 |  708 +++++
 hw/intc/xilinx_intc.c                          |   22 
 hw/isa/Makefile.objs                           |    1 
 hw/isa/apm.c                                   |    2 
 hw/isa/i82378.c                                |    7 
 hw/isa/isa-bus.c                               |   10 
 hw/isa/isa_mmio.c                              |   81 
 hw/isa/lpc_ich9.c                              |   16 
 hw/isa/pc87312.c                               |    2 
 hw/isa/vt82c686.c                              |   45 
 hw/lm32/lm32.h                                 |    5 
 hw/lm32/lm32_boards.c                          |    4 
 hw/lm32/milkymist.c                            |    2 
 hw/m68k/an5206.c                               |    4 
 hw/m68k/dummy_m68k.c                           |    2 
 hw/m68k/mcf5206.c                              |    2 
 hw/m68k/mcf5208.c                              |    8 
 hw/m68k/mcf_intc.c                             |    2 
 hw/microblaze/boot.c                           |   27 
 hw/microblaze/petalogix_ml605_mmu.c            |    4 
 hw/microblaze/petalogix_s3adsp1800_mmu.c       |    4 
 hw/mips/gt64xxx_pci.c                          |    5 
 hw/mips/mips_fulong2e.c                        |   21 
 hw/mips/mips_jazz.c                            |   26 
 hw/mips/mips_malta.c                           |  259 +
 hw/mips/mips_mipssim.c                         |   14 
 hw/mips/mips_r4k.c                             |   14 
 hw/misc/a9scu.c                                |    3 
 hw/misc/applesmc.c                             |   51 
 hw/misc/arm_l2x0.c                             |   39 
 hw/misc/arm_sysctl.c                           |   23 
 hw/misc/debugexit.c                            |    3 
 hw/misc/eccmemctl.c                            |   21 
 hw/misc/exynos4210_pmu.c                       |   18 
 hw/misc/imx_ccm.c                              |   21 
 hw/misc/ivshmem.c                              |   68 
 hw/misc/lm32_sys.c                             |   15 
 hw/misc/macio/cuda.c                           |    2 
 hw/misc/macio/mac_dbdma.c                      |  195 -
 hw/misc/macio/macio.c                          |  175 +
 hw/misc/milkymist-hpdmc.c                      |   15 
 hw/misc/milkymist-pfpu.c                       |   15 
 hw/misc/mst_fpga.c                             |   68 
 hw/misc/omap_gpmc.c                            |    8 
 hw/misc/omap_l4.c                              |    2 
 hw/misc/omap_sdrc.c                            |    2 
 hw/misc/omap_tap.c                             |    2 
 hw/misc/pc-testdev.c                           |   37 
 hw/misc/pci-testdev.c                          |   29 
 hw/misc/puv3_pm.c                              |   14 
 hw/misc/pvpanic.c                              |   33 
 hw/misc/pxa2xx_pcmcia.c                        |    6 
 hw/misc/sga.c                                  |    1 
 hw/misc/slavio_misc.c                          |   63 
 hw/misc/vfio.c                                 |  804 +++---
 hw/misc/vmport.c                               |   32 
 hw/misc/zynq_slcr.c                            |   17 
 hw/moxie/moxiesim.c                            |    4 
 hw/net/cadence_gem.c                           |   29 
 hw/net/dp8393x.c                               |    2 
 hw/net/e1000.c                                 |   78 
 hw/net/eepro100.c                              |   15 
 hw/net/etraxfs_eth.c                           |   55 
 hw/net/lan9118.c                               |   29 
 hw/net/lance.c                                 |   28 
 hw/net/mcf_fec.c                               |    2 
 hw/net/milkymist-minimac2.c                    |   33 
 hw/net/mipsnet.c                               |   24 
 hw/net/ne2000-isa.c                            |    3 
 hw/net/ne2000.c                                |    7 
 hw/net/ne2000.h                                |    2 
 hw/net/opencores_eth.c                         |   29 
 hw/net/pcnet-pci.c                             |   28 
 hw/net/rtl8139.c                               |  121 
 hw/net/smc91c111.c                             |   32 
 hw/net/spapr_llan.c                            |   50 
 hw/net/stellaris_enet.c                        |   42 
 hw/net/virtio-net.c                            |  134 -
 hw/net/vmxnet3.c                               |   23 
 hw/net/vmxnet_tx_pkt.c                         |    2 
 hw/net/xgmac.c                                 |   49 
 hw/net/xilinx_axienet.c                        |    2 
 hw/net/xilinx_ethlite.c                        |   24 
 hw/nvram/ds1225y.c                             |   15 
 hw/nvram/fw_cfg.c                              |   48 
 hw/nvram/mac_nvram.c                           |    4 
 hw/nvram/spapr_nvram.c                         |    4 
 hw/openrisc/openrisc_sim.c                     |    8 
 hw/pci-bridge/dec.c                            |    8 
 hw/pci-bridge/i82801b11.c                      |   14 
 hw/pci-bridge/ioh3420.c                        |   36 
 hw/pci-bridge/pci_bridge_dev.c                 |   29 
 hw/pci-bridge/xio3130_downstream.c             |   36 
 hw/pci-bridge/xio3130_upstream.c               |   27 
 hw/pci-host/apb.c                              |  120 
 hw/pci-host/bonito.c                           |   35 
 hw/pci-host/grackle.c                          |    8 
 hw/pci-host/pam.c                              |   16 
 hw/pci-host/piix.c                             |  225 +
 hw/pci-host/ppce500.c                          |   13 
 hw/pci-host/prep.c                             |    9 
 hw/pci-host/q35.c                              |  167 -
 hw/pci-host/uninorth.c                         |   24 
 hw/pci-host/versatile.c                        |   16 
 hw/pci/Makefile.objs                           |    2 
 hw/pci/msix.c                                  |    6 
 hw/pci/pci-hotplug-old.c                       |  337 ++
 hw/pci/pci-hotplug.c                           |  292 --
 hw/pci/pci.c                                   |  147 -
 hw/pci/pci_bridge.c                            |   54 
 hw/pci/pci_host.c                              |    1 
 hw/pci/pcie.c                                  |    2 
 hw/pci/pcie_aer.c                              |    9 
 hw/pci/pcie_host.c                             |    3 
 hw/pci/pcie_port.c                             |   52 
 hw/pci/shpc.c                                  |    4 
 hw/ppc/Makefile.objs                           |    2 
 hw/ppc/e500.c                                  |  135 -
 hw/ppc/mac.h                                   |    3 
 hw/ppc/mac_newworld.c                          |   42 
 hw/ppc/mac_oldworld.c                          |   37 
 hw/ppc/mpc8544_guts.c                          |   37 
 hw/ppc/ppc.c                                   |   12 
 hw/ppc/ppc405_boards.c                         |   18 
 hw/ppc/ppc405_uc.c                             |   12 
 hw/ppc/ppc440_bamboo.c                         |    7 
 hw/ppc/ppc4xx_devs.c                           |    4 
 hw/ppc/ppc4xx_pci.c                            |    8 
 hw/ppc/ppc_booke.c                             |   24 
 hw/ppc/ppce500_spin.c                          |   20 
 hw/ppc/prep.c                                  |   47 
 hw/ppc/spapr.c                                 |  429 ++-
 hw/ppc/spapr_events.c                          |    2 
 hw/ppc/spapr_hcall.c                           |   20 
 hw/ppc/spapr_iommu.c                           |  146 -
 hw/ppc/spapr_pci.c                             |  133 -
 hw/ppc/spapr_rtas.c                            |   23 
 hw/ppc/spapr_vio.c                             |   38 
 hw/ppc/virtex_ml507.c                          |    2 
 hw/ppc/xics.c                                  |  583 ----
 hw/s390x/css.c                                 |    2 
 hw/s390x/css.h                                 |    1 
 hw/s390x/ipl.c                                 |   22 
 hw/s390x/s390-virtio-bus.c                     |    4 
 hw/s390x/s390-virtio-ccw.c                     |    2 
 hw/s390x/s390-virtio.c                         |    6 
 hw/s390x/virtio-ccw.c                          |  208 +
 hw/s390x/virtio-ccw.h                          |    8 
 hw/scsi/esp-pci.c                              |   45 
 hw/scsi/esp.c                                  |   47 
 hw/scsi/lsi53c895a.c                           |   89 
 hw/scsi/megasas.c                              |   78 
 hw/scsi/scsi-bus.c                             |   35 
 hw/scsi/spapr_vscsi.c                          |  344 +-
 hw/scsi/vhost-scsi.c                           |    1 
 hw/scsi/virtio-scsi.c                          |   20 
 hw/scsi/vmw_pvscsi.c                           |    7 
 hw/sd/milkymist-memcard.c                      |   18 
 hw/sd/omap_mmc.c                               |    8 
 hw/sd/pl181.c                                  |   81 
 hw/sd/pxa2xx_mmci.c                            |    4 
 hw/sd/sdhci.c                                  |    4 
 hw/sd/ssi-sd.c                                 |    2 
 hw/sh4/r2d.c                                   |    9 
 hw/sh4/sh7750.c                                |   16 
 hw/sh4/sh_pci.c                                |   48 
 hw/sh4/shix.c                                  |    6 
 hw/sparc/leon3.c                               |    4 
 hw/sparc/sun4m.c                               |   72 
 hw/sparc64/sun4u.c                             |   41 
 hw/ssi/omap_spi.c                              |    2 
 hw/ssi/pl022.c                                 |   93 
 hw/ssi/xilinx_spi.c                            |   30 
 hw/ssi/xilinx_spips.c                          |    5 
 hw/timer/Makefile.objs                         |    2 
 hw/timer/arm_mptimer.c                         |   31 
 hw/timer/arm_timer.c                           |   54 
 hw/timer/cadence_ttc.c                         |   16 
 hw/timer/etraxfs_timer.c                       |   38 
 hw/timer/exynos4210_mct.c                      |   17 
 hw/timer/exynos4210_pwm.c                      |   16 
 hw/timer/exynos4210_rtc.c                      |   17 
 hw/timer/grlib_gptimer.c                       |   16 
 hw/timer/hpet.c                                |   51 
 hw/timer/i8254.c                               |    3 
 hw/timer/imx_epit.c                            |    4 
 hw/timer/imx_gpt.c                             |  558 ++--
 hw/timer/lm32_timer.c                          |   15 
 hw/timer/m48t59.c                              |   24 
 hw/timer/mc146818rtc.c                         |    2 
 hw/timer/milkymist-sysctl.c                    |   16 
 hw/timer/omap_gptimer.c                        |    2 
 hw/timer/omap_synctimer.c                      |    2 
 hw/timer/pl031.c                               |   46 
 hw/timer/puv3_ost.c                            |   14 
 hw/timer/pxa2xx_timer.c                        |   44 
 hw/timer/sh_timer.c                            |    6 
 hw/timer/slavio_timer.c                        |   15 
 hw/timer/tusb6010.c                            |   30 
 hw/timer/xilinx_timer.c                        |   13 
 hw/tpm/tpm_tis.c                               |    3 
 hw/unicore32/puv3.c                            |    2 
 hw/usb/bus.c                                   |    1 
 hw/usb/ccid-card-emulated.c                    |    1 
 hw/usb/ccid-card-passthru.c                    |    3 
 hw/usb/desc.c                                  |    6 
 hw/usb/dev-audio.c                             |    1 
 hw/usb/dev-bluetooth.c                         |    1 
 hw/usb/dev-hid.c                               |    6 
 hw/usb/dev-hub.c                               |    1 
 hw/usb/dev-network.c                           |    1 
 hw/usb/dev-serial.c                            |    2 
 hw/usb/dev-smartcard-reader.c                  |    3 
 hw/usb/dev-storage.c                           |   16 
 hw/usb/dev-uas.c                               |    1 
 hw/usb/dev-wacom.c                             |    1 
 hw/usb/hcd-ehci-pci.c                          |   25 
 hw/usb/hcd-ehci-sysbus.c                       |  130 -
 hw/usb/hcd-ehci.c                              |   72 
 hw/usb/hcd-ehci.h                              |   28 
 hw/usb/hcd-ohci.c                              |   56 
 hw/usb/hcd-uhci.c                              |    5 
 hw/usb/hcd-xhci.c                              |  117 
 hw/usb/host-libusb.c                           |    6 
 hw/usb/host-linux.c                            |    1 
 hw/usb/redirect.c                              |    1 
 hw/virtio/Makefile.objs                        |    1 
 hw/virtio/dataplane/hostmem.c                  |    7 
 hw/virtio/dataplane/vring.c                    |    8 
 hw/virtio/vhost.c                              |   11 
 hw/virtio/virtio-balloon.c                     |    6 
 hw/virtio/virtio-mmio.c                        |  422 +++
 hw/virtio/virtio-pci.c                         |   12 
 hw/virtio/virtio-rng.c                         |    1 
 hw/virtio/virtio.c                             |   40 
 hw/watchdog/watchdog.c                         |    1 
 hw/watchdog/wdt_i6300esb.c                     |    4 
 hw/watchdog/wdt_ib700.c                        |   13 
 hw/xen/Makefile.objs                           |    2 
 hw/xen/xen_apic.c                              |    4 
 hw/xen/xen_platform.c                          |   47 
 hw/xen/xen_pt.c                                |   12 
 hw/xen/xen_pt_msi.c                            |    3 
 hw/xen/xen_pvdevice.c                          |  131 +
 hw/xtensa/xtensa_lx60.c                        |   20 
 hw/xtensa/xtensa_sim.c                         |   14 
 include/block/aio.h                            |    7 
 include/block/block.h                          |    8 
 include/block/block_int.h                      |   44 
 include/block/coroutine.h                      |   15 
 include/exec/cpu-all.h                         |   39 
 include/exec/cpu-common.h                      |   10 
 include/exec/cpu-defs.h                        |    8 
 include/exec/exec-all.h                        |   14 
 include/exec/gdbstub.h                         |   55 
 include/exec/hwaddr.h                          |    4 
 include/exec/ioport.h                          |   30 
 include/exec/iorange.h                         |   31 
 include/exec/memory-internal.h                 |    2 
 include/exec/memory.h                          |  158 -
 include/exec/poison.h                          |    1 
 include/exec/softmmu-semi.h                    |   18 
 include/hw/arm/arm.h                           |    4 
 include/hw/char/escc.h                         |    1 
 include/hw/char/lm32_juart.h                   |   13 
 include/hw/hw.h                                |    1 
 include/hw/i386/ioapic.h                       |    1 
 include/hw/i386/pc.h                           |   51 
 include/hw/isa/isa.h                           |    3 
 include/hw/lm32/lm32_juart.h                   |   11 
 include/hw/loader.h                            |   13 
 include/hw/mips/mips.h                         |    3 
 include/hw/pci-host/pam.h                      |    4 
 include/hw/pci-host/q35.h                      |   14 
 include/hw/pci-host/spapr.h                    |    6 
 include/hw/pci/pci.h                           |   19 
 include/hw/pci/pci_bridge.h                    |    1 
 include/hw/pci/pci_bus.h                       |    7 
 include/hw/pci/pci_host.h                      |   12 
 include/hw/pci/pci_ids.h                       |    7 
 include/hw/pci/pcie_port.h                     |   14 
 include/hw/ppc/mac_dbdma.h                     |  124 
 include/hw/ppc/openpic.h                       |   14 
 include/hw/ppc/ppc.h                           |    3 
 include/hw/ppc/ppc_e500.h                      |    6 
 include/hw/ppc/spapr.h                         |   47 
 include/hw/ppc/spapr_vio.h                     |    5 
 include/hw/ppc/xics.h                          |   74 
 include/hw/qdev-core.h                         |   30 
 include/hw/qdev-properties.h                   |    3 
 include/hw/scsi/scsi.h                         |    4 
 include/hw/sysbus.h                            |   21 
 include/hw/timer/m48t59.h                      |    3 
 include/hw/usb.h                               |    1 
 include/hw/virtio/dataplane/hostmem.h          |    1 
 include/hw/virtio/dataplane/vring.h            |    2 
 include/hw/virtio/virtio-blk.h                 |    1 
 include/hw/virtio/virtio-bus.h                 |    6 
 include/hw/virtio/virtio-net.h                 |    1 
 include/hw/virtio/virtio.h                     |    4 
 include/migration/migration.h                  |   37 
 include/migration/qemu-file.h                  |   32 
 include/migration/vmstate.h                    |    2 
 include/monitor/monitor.h                      |    1 
 include/net/net.h                              |    3 
 include/qapi/qmp/qdict.h                       |    1 
 include/qapi/qmp/qobject.h                     |    1 
 include/qapi/visitor-impl.h                    |    6 
 include/qapi/visitor.h                         |    6 
 include/qemu-common.h                          |   11 
 include/qemu/atomic.h                          |  198 +
 include/qemu/bitops.h                          |   50 
 include/qemu/compiler.h                        |    3 
 include/qemu/error-report.h                    |    2 
 include/qemu/int128.h                          |   25 
 include/qemu/log.h                             |   26 
 include/qemu/notify.h                          |   29 
 include/qemu/option.h                          |    3 
 include/qemu/range.h                           |   16 
 include/qemu/typedefs.h                        |    1 
 include/qom/cpu.h                              |  208 +
 include/sysemu/char.h                          |    2 
 include/sysemu/device_tree.h                   |   59 
 include/sysemu/dma.h                           |    4 
 include/sysemu/kvm.h                           |   34 
 include/sysemu/sysemu.h                        |    6 
 include/ui/console.h                           |    2 
 ioport.c                                       |  383 --
 kvm-all.c                                      |  134 -
 kvm-stub.c                                     |   20 
 ldscripts/alpha.ld                             |  127 
 ldscripts/arm.ld                               |  153 -
 ldscripts/hppa.ld                              |  211 -
 ldscripts/i386.ld                              |  153 -
 ldscripts/ia64.ld                              |  209 -
 ldscripts/m68k.ld                              |  175 -
 ldscripts/mips.ld                              |  222 -
 ldscripts/ppc.ld                               |  237 -
 ldscripts/ppc64.ld                             |  230 -
 ldscripts/s390.ld                              |  201 -
 ldscripts/sparc.ld                             |  150 -
 ldscripts/sparc64.ld                           |  138 -
 ldscripts/x86_64.ld                            |  180 -
 libcacard/vcard_emul_nss.c                     |   22 
 linux-user/alpha/target_cpu.h                  |   36 
 linux-user/arm/syscall.h                       |    2 
 linux-user/arm/target_cpu.h                    |   35 
 linux-user/cpu-uname.c                         |   10 
 linux-user/cris/syscall.h                      |    2 
 linux-user/cris/target_cpu.h                   |   36 
 linux-user/elfload.c                           |   21 
 linux-user/i386/syscall.h                      |    2 
 linux-user/i386/target_cpu.h                   |   48 
 linux-user/ioctls.h                            |    6 
 linux-user/linuxload.c                         |    3 
 linux-user/m68k/target_cpu.h                   |   38 
 linux-user/main.c                              |  187 -
 linux-user/microblaze/syscall.h                |    2 
 linux-user/microblaze/target_cpu.h             |   35 
 linux-user/mips/syscall.h                      |    2 
 linux-user/mips/target_cpu.h                   |   36 
 linux-user/mips64/syscall.h                    |    2 
 linux-user/mips64/target_cpu.h                 |    1 
 linux-user/mmap.c                              |   15 
 linux-user/openrisc/target_cpu.h               |   38 
 linux-user/ppc/syscall.h                       |    2 
 linux-user/ppc/target_cpu.h                    |   41 
 linux-user/qemu.h                              |   21 
 linux-user/s390x/syscall.h                     |    2 
 linux-user/s390x/target_cpu.h                  |   39 
 linux-user/sh4/target_cpu.h                    |   35 
 linux-user/signal.c                            |   57 
 linux-user/socket.h                            |  381 +-
 linux-user/sparc/syscall.h                     |    7 
 linux-user/sparc/target_cpu.h                  |   44 
 linux-user/sparc64/syscall.h                   |    7 
 linux-user/sparc64/target_cpu.h                |    1 
 linux-user/syscall.c                           |  353 +-
 linux-user/syscall_defs.h                      |   54 
 linux-user/unicore32/target_cpu.h              |   27 
 linux-user/x86_64/target_cpu.h                 |    1 
 memory.c                                       |  413 +--
 memory_mapping.c                               |   16 
 migration-rdma.c                               | 3249 +++++++++++++++++++++++++
 migration.c                                    |  107 
 monitor.c                                      |   37 
 net/eth.c                                      |    2 
 net/net.c                                      |   48 
 pc-bios/README                                 |    2 
 pc-bios/acpi-dsdt.aml                          |binary
 pc-bios/bios.bin                               |binary
 pc-bios/multiboot.bin                          |binary
 pc-bios/optionrom/multiboot.S                  |   75 
 pc-bios/palcode-clipper                        |binary
 pc-bios/q35-acpi-dsdt.aml                      |binary
 pc-bios/qemu-nsis.bmp                          |binary
 pc-bios/qemu-nsis.ico                          |binary
 pc-bios/s390-ccw.img                           |binary
 pc-bios/s390-ccw/cio.h                         |   20 
 pc-bios/s390-ccw/main.c                        |    7 
 pc-bios/s390-ccw/s390-ccw.h                    |    1 
 pc-bios/s390-ccw/virtio.c                      |   18 
 po/Makefile                                    |   33 
 qapi-schema-test.json                          |   53 
 qapi-schema.json                               |  217 +
 qapi/qapi-visit-core.c                         |   36 
 qapi/qmp-input-visitor.c                       |   47 
 qdev-monitor.c                                 |   52 
 qemu-char.c                                    |  145 -
 qemu-coroutine-io.c                            |   23 
 qemu-coroutine-lock.c                          |   20 
 qemu-doc.texi                                  |    2 
 qemu-img.c                                     |    6 
 qemu-options.hx                                |   43 
 qemu-seccomp.c                                 |   22 
 qemu.nsi                                       |  250 +
 qemu.sasl                                      |    2 
 qga/service-win32.c                            |  105 
 qmp-commands.hx                                |  121 
 qobject/qdict.c                                |   51 
 qobject/qjson.c                                |    2 
 qom/cpu.c                                      |   58 
 qom/object.c                                   |   11 
 qtest.c                                        |    7 
 roms/qemu-palcode                              |    2 
 savevm.c                                       |  115 
 scripts/cleanup-trace-events.pl                |   51 
 scripts/qapi-commands.py                       |   17 
 scripts/qapi-types.py                          |   65 
 scripts/qapi-visit.py                          |  183 +
 scripts/qapi.py                                |  270 +-
 slirp/mbuf.h                                   |   51 
 slirp/tcp_subr.c                               |   12 
 stubs/Makefile.objs                            |    1 
 stubs/cpus.c                                   |    5 
 stubs/gdbstub.c                                |    5 
 stubs/vm-stop.c                                |    2 
 target-alpha/Makefile.objs                     |    1 
 target-alpha/cpu-qom.h                         |   11 
 target-alpha/cpu.c                             |   22 
 target-alpha/cpu.h                             |   27 
 target-alpha/gdbstub.c                         |   93 
 target-alpha/helper.c                          |   11 
 target-alpha/helper.h                          |    3 
 target-alpha/machine.c                         |   28 
 target-alpha/mem_helper.c                      |   10 
 target-alpha/sys_helper.c                      |    7 
 target-alpha/translate.c                       |   42 
 target-arm/Makefile.objs                       |    2 
 target-arm/arm-semi.c                          |   13 
 target-arm/cpu-qom.h                           |   34 
 target-arm/cpu.c                               |   39 
 target-arm/cpu.h                               |  109 
 target-arm/gdbstub.c                           |  102 
 target-arm/helper.c                            |  391 ++-
 target-arm/kvm-stub.c                          |   23 
 target-arm/kvm.c                               |  294 +-
 target-arm/kvm_arm.h                           |   33 
 target-arm/machine.c                           |  134 -
 target-arm/translate.c                         |  155 +
 target-cris/Makefile.objs                      |    1 
 target-cris/cpu-qom.h                          |   11 
 target-cris/cpu.c                              |   31 
 target-cris/cpu.h                              |   18 
 target-cris/gdbstub.c                          |  130 +
 target-cris/helper.c                           |   11 
 target-cris/translate.c                        |   24 
 target-i386/Makefile.objs                      |    1 
 target-i386/arch_dump.c                        |   17 
 target-i386/cpu-qom.h                          |   17 
 target-i386/cpu.c                              |   50 
 target-i386/cpu.h                              |   16 
 target-i386/gdbstub.c                          |  231 +
 target-i386/helper.c                           |   38 
 target-i386/kvm.c                              |   63 
 target-i386/machine.c                          |   36 
 target-i386/misc_helper.c                      |    2 
 target-i386/seg_helper.c                       |   20 
 target-i386/smm_helper.c                       |   10 
 target-i386/translate.c                        |   14 
 target-lm32/Makefile.objs                      |    1 
 target-lm32/cpu-qom.h                          |    7 
 target-lm32/cpu.c                              |   28 
 target-lm32/cpu.h                              |   19 
 target-lm32/gdbstub.c                          |   92 
 target-lm32/helper.c                           |   10 
 target-lm32/op_helper.c                        |    2 
 target-lm32/translate.c                        |   23 
 target-m68k/Makefile.objs                      |    1 
 target-m68k/cpu-qom.h                          |    7 
 target-m68k/cpu.c                              |   26 
 target-m68k/cpu.h                              |   14 
 target-m68k/gdbstub.c                          |   75 
 target-m68k/helper.c                           |    5 
 target-m68k/m68k-semi.c                        |    5 
 target-m68k/translate.c                        |   22 
 target-microblaze/Makefile.objs                |    1 
 target-microblaze/cpu-qom.h                    |    7 
 target-microblaze/cpu.c                        |   28 
 target-microblaze/cpu.h                        |   24 
 target-microblaze/gdbstub.c                    |   56 
 target-microblaze/helper.c                     |   20 
 target-microblaze/op_helper.c                  |   17 
 target-microblaze/translate.c                  |   27 
 target-mips/Makefile.objs                      |    1 
 target-mips/cpu-qom.h                          |    7 
 target-mips/cpu.c                              |   45 
 target-mips/cpu.h                              |   25 
 target-mips/dsp_helper.c                       |   22 
 target-mips/gdbstub.c                          |  155 +
 target-mips/helper.c                           |    9 
 target-mips/op_helper.c                        |   39 
 target-mips/translate.c                        |   88 
 target-moxie/cpu.c                             |   29 
 target-moxie/cpu.h                             |   10 
 target-moxie/helper.c                          |   15 
 target-moxie/translate.c                       |   13 
 target-openrisc/Makefile.objs                  |    1 
 target-openrisc/cpu.c                          |   32 
 target-openrisc/cpu.h                          |   24 
 target-openrisc/gdbstub.c                      |   83 
 target-openrisc/machine.c                      |   27 
 target-openrisc/mmu.c                          |    5 
 target-openrisc/translate.c                    |   21 
 target-ppc/Makefile.objs                       |    2 
 target-ppc/cpu-models.c                        |   15 
 target-ppc/cpu-models.h                        |    8 
 target-ppc/cpu-qom.h                           |   13 
 target-ppc/cpu.h                               |   37 
 target-ppc/excp_helper.c                       |    9 
 target-ppc/gdbstub.c                           |  131 +
 target-ppc/kvm-stub.c                          |   18 
 target-ppc/kvm.c                               |  134 -
 target-ppc/kvm_ppc.h                           |   22 
 target-ppc/machine.c                           |  531 +++-
 target-ppc/mmu-hash32.c                        |    4 
 target-ppc/mmu-hash64.c                        |    6 
 target-ppc/mmu_helper.c                        |  114 
 target-ppc/translate.c                         |   32 
 target-ppc/translate_init.c                    |  324 +-
 target-s390x/Makefile.objs                     |    1 
 target-s390x/cpu-qom.h                         |    7 
 target-s390x/cpu.c                             |   26 
 target-s390x/cpu.h                             |   40 
 target-s390x/gdbstub.c                         |   88 
 target-s390x/helper.c                          |    5 
 target-s390x/kvm.c                             |   74 
 target-s390x/translate.c                       |   20 
 target-sh4/Makefile.objs                       |    1 
 target-sh4/cpu-qom.h                           |    7 
 target-sh4/cpu.c                               |   35 
 target-sh4/cpu.h                               |   20 
 target-sh4/gdbstub.c                           |  146 +
 target-sh4/helper.c                            |    7 
 target-sh4/translate.c                         |   24 
 target-sparc/Makefile.objs                     |    1 
 target-sparc/cpu-qom.h                         |    7 
 target-sparc/cpu.c                             |   48 
 target-sparc/cpu.h                             |   28 
 target-sparc/gdbstub.c                         |  208 +
 target-sparc/int32_helper.c                    |    2 
 target-sparc/int64_helper.c                    |    2 
 target-sparc/ldst_helper.c                     |   27 
 target-sparc/mmu_helper.c                      |   23 
 target-sparc/translate.c                       |   13 
 target-unicore32/cpu-qom.h                     |    5 
 target-unicore32/cpu.c                         |   15 
 target-unicore32/cpu.h                         |   18 
 target-unicore32/softmmu.c                     |    7 
 target-unicore32/translate.c                   |   22 
 target-xtensa/Makefile.objs                    |    1 
 target-xtensa/cpu-qom.h                        |   10 
 target-xtensa/cpu.c                            |   44 
 target-xtensa/cpu.h                            |    5 
 target-xtensa/gdbstub.c                        |  109 
 target-xtensa/helper.c                         |   47 
 target-xtensa/op_helper.c                      |    4 
 target-xtensa/translate.c                      |   23 
 target-xtensa/xtensa-semi.c                    |   14 
 tcg/aarch64/tcg-target.c                       |  256 +
 tcg/aarch64/tcg-target.h                       |    2 
 tcg/arm/tcg-target.c                           |  178 -
 tcg/arm/tcg-target.h                           |   15 
 tcg/hppa/tcg-target.c                          |   35 
 tcg/hppa/tcg-target.h                          |    1 
 tcg/i386/tcg-target.c                          |   45 
 tcg/ia64/tcg-target.h                          |    2 
 tcg/mips/tcg-target.h                          |    1 
 tcg/ppc/tcg-target.c                           |   14 
 tcg/ppc/tcg-target.h                           |    1 
 tcg/ppc64/tcg-target.c                         |   26 
 tcg/ppc64/tcg-target.h                         |    2 
 tcg/sparc/tcg-target.c                         |   35 
 tcg/sparc/tcg-target.h                         |    2 
 tcg/tcg-op.h                                   |   32 
 tcg/tcg-opc.h                                  |   36 
 tcg/tcg.c                                      |   26 
 tcg/tcg.h                                      |    6 
 tcg/tci/tcg-target.h                           |    6 
 tests/Makefile                                 |   59 
 tests/boot-order-test.c                        |  209 +
 tests/endianness-test.c                        |  316 ++
 tests/fdc-test.c                               |    2 
 tests/fw_cfg-test.c                            |    2 
 tests/hd-geo-test.c                            |    8 
 tests/ide-test.c                               |    2 
 tests/libqos/fw_cfg-pc.c                       |   40 
 tests/libqos/fw_cfg-pc.h                       |   20 
 tests/libqos/fw_cfg.c                          |   55 
 tests/libqos/fw_cfg.h                          |    9 
 tests/libqos/malloc-pc.c                       |    2 
 tests/libqtest.c                               |    4 
 tests/libqtest.h                               |   12 
 tests/qapi-schema/comments.exit                |    1 
 tests/qapi-schema/comments.json                |    4 
 tests/qapi-schema/comments.out                 |    3 
 tests/qapi-schema/empty.exit                   |    1 
 tests/qapi-schema/empty.out                    |    3 
 tests/qapi-schema/funny-char.err               |    1 
 tests/qapi-schema/funny-char.exit              |    1 
 tests/qapi-schema/funny-char.json              |    2 
 tests/qapi-schema/indented-expr.exit           |    1 
 tests/qapi-schema/indented-expr.json           |    2 
 tests/qapi-schema/indented-expr.out            |    3 
 tests/qapi-schema/missing-colon.err            |    1 
 tests/qapi-schema/missing-colon.exit           |    1 
 tests/qapi-schema/missing-colon.json           |    2 
 tests/qapi-schema/missing-comma-list.err       |    1 
 tests/qapi-schema/missing-comma-list.exit      |    1 
 tests/qapi-schema/missing-comma-list.json      |    2 
 tests/qapi-schema/missing-comma-object.err     |    1 
 tests/qapi-schema/missing-comma-object.exit    |    1 
 tests/qapi-schema/missing-comma-object.json    |    2 
 tests/qapi-schema/non-objects.err              |    1 
 tests/qapi-schema/non-objects.exit             |    1 
 tests/qapi-schema/non-objects.json             |    2 
 tests/qapi-schema/qapi-schema-test.exit        |    1 
 tests/qapi-schema/qapi-schema-test.json        |   53 
 tests/qapi-schema/qapi-schema-test.out         |   19 
 tests/qapi-schema/quoted-structural-chars.err  |    1 
 tests/qapi-schema/quoted-structural-chars.exit |    1 
 tests/qapi-schema/quoted-structural-chars.json |    1 
 tests/qapi-schema/test-qapi.py                 |   27 
 tests/qapi-schema/trailing-comma-list.err      |    1 
 tests/qapi-schema/trailing-comma-list.exit     |    1 
 tests/qapi-schema/trailing-comma-list.json     |    2 
 tests/qapi-schema/trailing-comma-object.err    |    1 
 tests/qapi-schema/trailing-comma-object.exit   |    1 
 tests/qapi-schema/trailing-comma-object.json   |    2 
 tests/qapi-schema/unclosed-list.err            |    1 
 tests/qapi-schema/unclosed-list.exit           |    1 
 tests/qapi-schema/unclosed-list.json           |    1 
 tests/qapi-schema/unclosed-object.err          |    1 
 tests/qapi-schema/unclosed-object.exit         |    1 
 tests/qapi-schema/unclosed-object.json         |    1 
 tests/qapi-schema/unclosed-string.err          |    1 
 tests/qapi-schema/unclosed-string.exit         |    1 
 tests/qapi-schema/unclosed-string.json         |    2 
 tests/qemu-iotests/041                         |   14 
 tests/qemu-iotests/051                         |   26 
 tests/qemu-iotests/051.out                     |  153 -
 tests/qemu-iotests/055                         |  294 ++
 tests/qemu-iotests/055.out                     |    5 
 tests/qemu-iotests/056                         |   94 
 tests/qemu-iotests/056.out                     |    5 
 tests/qemu-iotests/common.filter               |    2 
 tests/qemu-iotests/group                       |    4 
 tests/qemu-iotests/iotests.py                  |   20 
 tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c        |   64 
 tests/tcg/mips/mips32-dsp/dpsq_sa_l_w.c        |    4 
 tests/tcg/mips/mips32-dsp/mulq_rs_ph.c         |   19 
 tests/tcg/mips/mips32-dsp/precrq_rs_ph_w.c     |   24 
 tests/test-bitops.c                            |   75 
 tests/test-int128.c                            |  212 +
 tests/test-qmp-input-visitor.c                 |    2 
 tests/test-qmp-output-visitor.c                |    4 
 tests/test-thread-pool.c                       |    8 
 tests/test-visitor-serialization.c             |    8 
 tpm.c                                          |    4 
 trace-events                                   |  193 -
 translate-all.c                                |   42 
 ui/console.c                                   |   10 
 ui/gtk.c                                       |  102 
 ui/spice-core.c                                |   15 
 ui/vnc.c                                       |   15 
 user-exec.c                                    |   21 
 util/acl.c                                     |    4 
 util/aes.c                                     |    5 
 util/notify.c                                  |   30 
 util/qemu-error.c                              |   10 
 util/qemu-option.c                             |   40 
 util/qemu-sockets.c                            |    9 
 vl.c                                           |  202 -
 xen-all.c                                      |   22 
 xen-stub.c                                     |    5 
 955 files changed, 30749 insertions(+), 15610 deletions(-)

New commits:
commit dbe49aea76a7805f05b33d548b2e543b51fa8bb1
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 20:30:29 2013 -0500

    Update version for 1.6.0-rc0
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/VERSION b/VERSION
index 88eb60e..81fd881 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.5.50
+1.5.90
commit d2509b667caf482b6f827ff2645cbeb9b39ce29e
Author: Paul Moore <pmoore at redhat.com>
Date:   Thu Jul 18 09:57:03 2013 -0400

    seccomp: add arch_prctl() to the syscall whitelist
    
    It appears that even a very simple /etc/qemu-ifup configuration can
    require the arch_prctl() syscall, see the example below:
    
    	#!/bin/sh
    	/sbin/ifconfig $1 0.0.0.0 up
    	/usr/sbin/brctl addif <switch> $1
    
    Signed-off-by: Paul Moore <pmoore at redhat.com>
    Reviewed-by: Eduardo Otubo <otubo at linux.vnet.ibm.com>
    Message-id: 20130718135703.8247.19213.stgit at localhost
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 1d2f51c..37d38f8 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -217,7 +217,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(waitid), 241 },
     { SCMP_SYS(io_cancel), 241 },
     { SCMP_SYS(io_setup), 241 },
-    { SCMP_SYS(io_destroy), 241 }
+    { SCMP_SYS(io_destroy), 241 },
+    { SCMP_SYS(arch_prctl), 240 }
 };
 
 int seccomp_start(void)
commit 94113bd8a1d9acd05a879bc309cc659ace09e287
Author: Paul Moore <pmoore at redhat.com>
Date:   Mon Jul 15 15:32:01 2013 -0400

    seccomp: add additional asynchronous I/O syscalls
    
    A previous commit, "seccomp: add the asynchronous I/O syscalls to the
    whitelist", added several asynchronous I/O syscalls but left out the
    io_submit() and io_cancel() syscalls.  This patch corrects this by
    adding the two missing asynchronous I/O syscalls.
    
    Signed-off-by: Paul Moore <pmoore at redhat.com>
    Reviewed-by: Eduardo Otubo <otubo at linux.vnet.ibm.com>
    Message-id: 20130715193201.943.4913.stgit at localhost
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 3298de8..1d2f51c 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -30,6 +30,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(sendto), 250 },
     { SCMP_SYS(socketcall), 250 },
     { SCMP_SYS(read), 249 },
+    { SCMP_SYS(io_submit), 249 },
     { SCMP_SYS(brk), 248 },
     { SCMP_SYS(clone), 247 },
     { SCMP_SYS(mmap), 247 },
@@ -214,6 +215,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(recvmmsg), 241 },
     { SCMP_SYS(prlimit64), 241 },
     { SCMP_SYS(waitid), 241 },
+    { SCMP_SYS(io_cancel), 241 },
     { SCMP_SYS(io_setup), 241 },
     { SCMP_SYS(io_destroy), 241 }
 };
commit 95c1eb19eab9d57035e05a02f7184b63c1da9775
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 11:31:49 2013 +0100

    linux-user: Return success from m68k set_thread_area syscall
    
    The m68k set_thread_area syscall implementation failed to set the
    return value. Correctly set it zero, since this syscall will always
    succeed.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375093909-13653-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 3f6db4b..f986548 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8523,6 +8523,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
       {
           TaskState *ts = ((CPUArchState *)cpu_env)->opaque;
           ts->tp_value = arg1;
+          ret = 0;
           break;
       }
 #else
commit 978fae9f1ac47e22890a1bd9ebf5fa46fe8b6ef7
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 12:00:32 2013 +0100

    linux-user/signal.c: Avoid using uninitialized data in ARM sigreturn
    
    Rephrase code used in ARM sigreturn functions to avoid using
    uninitialized variables. This fixes one genuine problem ('frame'
    would not be initialized if we took the error-exit path because
    our stackpointer was misaligned) and one which is clang being
    alarmist (frame_addr wouldn't be initialized, though this is
    harmless since unlock_user_struct ignores its second argument
    in these cases; however since we don't generally make use of
    this not-really-documented effect it's better avoided).
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375095632-13735-3-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/linux-user/signal.c b/linux-user/signal.c
index d63777d..23d65da 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -1552,7 +1552,7 @@ restore_sigcontext(CPUARMState *env, struct target_sigcontext *sc)
 static long do_sigreturn_v1(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct sigframe_v1 *frame;
+        struct sigframe_v1 *frame = NULL;
 	target_sigset_t set;
         sigset_t host_set;
         int i;
@@ -1562,10 +1562,11 @@ static long do_sigreturn_v1(CPUARMState *env)
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1693,17 +1694,18 @@ static int do_sigframe_return_v2(CPUARMState *env, target_ulong frame_addr,
 static long do_sigreturn_v2(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct sigframe_v2 *frame;
+        struct sigframe_v2 *frame = NULL;
 
 	/*
 	 * Since we stacked the signal on a 64-bit boundary,
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1731,7 +1733,7 @@ long do_sigreturn(CPUARMState *env)
 static long do_rt_sigreturn_v1(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct rt_sigframe_v1 *frame;
+        struct rt_sigframe_v1 *frame = NULL;
         sigset_t host_set;
 
 	/*
@@ -1739,10 +1741,11 @@ static long do_rt_sigreturn_v1(CPUARMState *env)
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1772,17 +1775,18 @@ badframe:
 static long do_rt_sigreturn_v2(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct rt_sigframe_v2 *frame;
+        struct rt_sigframe_v2 *frame = NULL;
 
 	/*
 	 * Since we stacked the signal on a 64-bit boundary,
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
commit b04636f8665a9492143529340eab4450d492d2ee
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 12:00:31 2013 +0100

    linux-user/signal.c: PPC: Silence clang uninitialized-use warning
    
    Silence a clang warning in a PPC signal return function:
    
    /home/petmay01/linaro/qemu-from-laptop/qemu/linux-user/signal.c:4611:9: error: variable 'sr_addr' is used
          uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
        if (!lock_user_struct(VERIFY_READ, sc, sc_addr, 1))
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    /home/petmay01/linaro/qemu-from-laptop/qemu/linux-user/signal.c:4636:28: note: uninitialized use occurs here
        unlock_user_struct(sr, sr_addr, 1);
                               ^~~~~~~
    /home/petmay01/linaro/qemu-from-laptop/qemu/linux-user/qemu.h:442:27: note: expanded from macro 'unlock_user_struct'
        unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
                              ^
    
    This happens when we unlock a user struct which we never
    attempted to lock. Strictly, clang is actually wrong here -- it
    hasn't been able to spot that unlock_user_struct() doesn't use
    its second argument if the first is NULL. However it doesn't
    seem too unreasonable to demand that we pass in initialized
    values to it.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375095632-13735-2-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/linux-user/signal.c b/linux-user/signal.c
index a5e8906..d63777d 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -4603,7 +4603,7 @@ long do_sigreturn(CPUPPCState *env)
 {
     struct target_sigcontext *sc = NULL;
     struct target_mcontext *sr = NULL;
-    target_ulong sr_addr, sc_addr;
+    target_ulong sr_addr = 0, sc_addr;
     sigset_t blocked;
     target_sigset_t set;
 
commit f6bda9cb99345158722f2e70634dda6b4d53ea67
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:39 2013 +0100

    spapr: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-5-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 46f7d5f..4ff0411 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -38,9 +38,9 @@
 /*#define DEBUG*/
 
 #ifdef DEBUG
-#define dprintf(fmt...) do { fprintf(stderr, fmt); } while (0)
+#define DPRINTF(fmt...) do { fprintf(stderr, fmt); } while (0)
 #else
-#define dprintf(fmt...)
+#define DPRINTF(fmt...)
 #endif
 
 /*
@@ -105,7 +105,7 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
     uint64_t handle;
     uint8_t control;
 
-    dprintf("spapr_vlan_receive() [%s] rx_bufs=%d\n", sdev->qdev.id,
+    DPRINTF("spapr_vlan_receive() [%s] rx_bufs=%d\n", sdev->qdev.id,
             dev->rx_bufs);
 
     if (!dev->isopen) {
@@ -123,7 +123,7 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
         }
 
         bd = vio_ldq(sdev, dev->buf_list + buf_ptr);
-        dprintf("use_buf_ptr=%d bd=0x%016llx\n",
+        DPRINTF("use_buf_ptr=%d bd=0x%016llx\n",
                 buf_ptr, (unsigned long long)bd);
     } while ((!(bd & VLAN_BD_VALID) || (VLAN_BD_LEN(bd) < (size + 8)))
              && (buf_ptr != dev->use_buf_ptr));
@@ -138,14 +138,14 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
     dev->use_buf_ptr = buf_ptr;
     vio_stq(sdev, dev->buf_list + dev->use_buf_ptr, 0);
 
-    dprintf("Found buffer: ptr=%d num=%d\n", dev->use_buf_ptr, dev->rx_bufs);
+    DPRINTF("Found buffer: ptr=%d num=%d\n", dev->use_buf_ptr, dev->rx_bufs);
 
     /* Transfer the packet data */
     if (spapr_vio_dma_write(sdev, VLAN_BD_ADDR(bd) + 8, buf, size) < 0) {
         return -1;
     }
 
-    dprintf("spapr_vlan_receive: DMA write completed\n");
+    DPRINTF("spapr_vlan_receive: DMA write completed\n");
 
     /* Update the receive queue */
     control = VLAN_RXQC_TOGGLE | VLAN_RXQC_VALID;
@@ -159,7 +159,7 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
     vio_sth(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr + 2, 8);
     vio_stb(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr, control);
 
-    dprintf("wrote rxq entry (ptr=0x%llx): 0x%016llx 0x%016llx\n",
+    DPRINTF("wrote rxq entry (ptr=0x%llx): 0x%016llx 0x%016llx\n",
             (unsigned long long)dev->rxq_ptr,
             (unsigned long long)vio_ldq(sdev, VLAN_BD_ADDR(rxq_bd) +
                                         dev->rxq_ptr),
@@ -374,7 +374,7 @@ static target_ulong h_add_logical_lan_buffer(PowerPCCPU *cpu,
     VIOsPAPRVLANDevice *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
     vlan_bd_t bd;
 
-    dprintf("H_ADD_LOGICAL_LAN_BUFFER(0x" TARGET_FMT_lx
+    DPRINTF("H_ADD_LOGICAL_LAN_BUFFER(0x" TARGET_FMT_lx
             ", 0x" TARGET_FMT_lx ")\n", reg, buf);
 
     if (!sdev) {
@@ -405,7 +405,7 @@ static target_ulong h_add_logical_lan_buffer(PowerPCCPU *cpu,
 
     dev->rx_bufs++;
 
-    dprintf("h_add_logical_lan_buffer():  Added buf  ptr=%d  rx_bufs=%d"
+    DPRINTF("h_add_logical_lan_buffer():  Added buf  ptr=%d  rx_bufs=%d"
             " bd=0x%016llx\n", dev->add_buf_ptr, dev->rx_bufs,
             (unsigned long long)buf);
 
@@ -425,14 +425,14 @@ static target_ulong h_send_logical_lan(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     int i, nbufs;
     int ret;
 
-    dprintf("H_SEND_LOGICAL_LAN(0x" TARGET_FMT_lx ", <bufs>, 0x"
+    DPRINTF("H_SEND_LOGICAL_LAN(0x" TARGET_FMT_lx ", <bufs>, 0x"
             TARGET_FMT_lx ")\n", reg, continue_token);
 
     if (!sdev) {
         return H_PARAMETER;
     }
 
-    dprintf("rxbufs = %d\n", dev->rx_bufs);
+    DPRINTF("rxbufs = %d\n", dev->rx_bufs);
 
     if (!dev->isopen) {
         return H_DROPPED;
@@ -444,7 +444,7 @@ static target_ulong h_send_logical_lan(PowerPCCPU *cpu, sPAPREnvironment *spapr,
 
     total_len = 0;
     for (i = 0; i < 6; i++) {
-        dprintf("   buf desc: 0x" TARGET_FMT_lx "\n", bufs[i]);
+        DPRINTF("   buf desc: 0x" TARGET_FMT_lx "\n", bufs[i]);
         if (!(bufs[i] & VLAN_BD_VALID)) {
             break;
         }
@@ -452,7 +452,7 @@ static target_ulong h_send_logical_lan(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     }
 
     nbufs = i;
-    dprintf("h_send_logical_lan() %d buffers, total length 0x%x\n",
+    DPRINTF("h_send_logical_lan() %d buffers, total length 0x%x\n",
             nbufs, total_len);
 
     if (total_len == 0) {
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index c3f85bf..a6a0a51 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -39,10 +39,10 @@
 /* #define DEBUG_SPAPR */
 
 #ifdef DEBUG_SPAPR
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -201,7 +201,7 @@ static target_ulong h_reg_crq(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     dev->crq.qsize = queue_len;
     dev->crq.qnext = 0;
 
-    dprintf("CRQ for dev 0x" TARGET_FMT_lx " registered at 0x"
+    DPRINTF("CRQ for dev 0x" TARGET_FMT_lx " registered at 0x"
             TARGET_FMT_lx "/0x" TARGET_FMT_lx "\n",
             reg, queue_addr, queue_len);
     return H_SUCCESS;
@@ -213,7 +213,7 @@ static target_ulong free_crq(VIOsPAPRDevice *dev)
     dev->crq.qsize = 0;
     dev->crq.qnext = 0;
 
-    dprintf("CRQ for dev 0x%" PRIx32 " freed\n", dev->reg);
+    DPRINTF("CRQ for dev 0x%" PRIx32 " freed\n", dev->reg);
 
     return H_SUCCESS;
 }
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 3f4c53f..e9090e5 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -45,10 +45,10 @@
 /*#define DEBUG_VSCSI*/
 
 #ifdef DEBUG_VSCSI
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -218,7 +218,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     int total_len = sizeof(iu->srp.rsp);
     uint8_t sol_not = iu->srp.cmd.sol_not;
 
-    dprintf("VSCSI: Sending resp status: 0x%x, "
+    DPRINTF("VSCSI: Sending resp status: 0x%x, "
             "res_in: %d, res_out: %d\n", status, res_in, res_out);
 
     memset(iu, 0, sizeof(struct srp_rsp));
@@ -279,13 +279,13 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
 
     switch (req->dma_fmt) {
     case SRP_NO_DATA_DESC: {
-        dprintf("VSCSI: no data descriptor\n");
+        DPRINTF("VSCSI: no data descriptor\n");
         return 0;
     }
     case SRP_DATA_DESC_DIRECT: {
         memcpy(ret, cmd->add_data + req->cdb_offset, sizeof(*ret));
         assert(req->cur_desc_num == 0);
-        dprintf("VSCSI: direct segment\n");
+        DPRINTF("VSCSI: direct segment\n");
         break;
     }
     case SRP_DATA_DESC_INDIRECT: {
@@ -293,7 +293,7 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
                                        (cmd->add_data + req->cdb_offset);
         if (n < req->local_desc) {
             *ret = tmp->desc_list[n];
-            dprintf("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
+            DPRINTF("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
                     req->qtag, n, req->local_desc);
 
         } else if (n < req->total_desc) {
@@ -302,21 +302,21 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
             unsigned desc_offset = n * sizeof(struct srp_direct_buf);
 
             if (desc_offset >= tbl_desc.len) {
-                dprintf("VSCSI:   #%d is ouf of range (%d bytes)\n",
+                DPRINTF("VSCSI:   #%d is ouf of range (%d bytes)\n",
                         n, desc_offset);
                 return -1;
             }
             rc = spapr_vio_dma_read(&s->vdev, tbl_desc.va + desc_offset,
                                     ret, sizeof(struct srp_direct_buf));
             if (rc) {
-                dprintf("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
+                DPRINTF("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
                         rc);
                 return -1;
             }
-            dprintf("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
+            DPRINTF("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
                     req->qtag, n, req->total_desc, tbl_desc.va, tbl_desc.len);
         } else {
-            dprintf("VSCSI:   Out of descriptors !\n");
+            DPRINTF("VSCSI:   Out of descriptors !\n");
             return 0;
         }
         break;
@@ -328,14 +328,14 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
 
     *ret = vscsi_swap_desc(*ret);
     if (buf_offset > ret->len) {
-        dprintf("   offset=%x is out of a descriptor #%d boundary=%x\n",
+        DPRINTF("   offset=%x is out of a descriptor #%d boundary=%x\n",
                 buf_offset, req->cur_desc_num, ret->len);
         return -1;
     }
     ret->va += buf_offset;
     ret->len -= buf_offset;
 
-    dprintf("   cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
+    DPRINTF("   cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
             req->cur_desc_num, req->cur_desc_offset, ret->va, ret->len);
 
     return ret->len ? 1 : 0;
@@ -379,7 +379,7 @@ static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
     int rc = 0;
     uint32_t llen, total = 0;
 
-    dprintf("VSCSI: indirect segment 0x%x bytes\n", len);
+    DPRINTF("VSCSI: indirect segment 0x%x bytes\n", len);
 
     /* While we have data ... */
     while (len) {
@@ -398,10 +398,10 @@ static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
             rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
         }
         if (rc) {
-            dprintf("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
+            DPRINTF("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
             break;
         }
-        dprintf("VSCSI:     data: %02x %02x %02x %02x...\n",
+        DPRINTF("VSCSI:     data: %02x %02x %02x %02x...\n",
                 buf[0], buf[1], buf[2], buf[3]);
 
         len -= llen;
@@ -428,7 +428,7 @@ static int vscsi_srp_transfer_data(VSCSIState *s, vscsi_req *req,
 
     switch (req->dma_fmt) {
     case SRP_NO_DATA_DESC:
-        dprintf("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len);
+        DPRINTF("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len);
         break;
     case SRP_DATA_DESC_DIRECT:
         err = vscsi_srp_direct_data(s, req, buf, len);
@@ -508,7 +508,7 @@ static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t len)
     uint8_t *buf;
     int rc = 0;
 
-    dprintf("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
+    DPRINTF("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
             sreq->tag, len, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
@@ -538,7 +538,7 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     vscsi_req *req = sreq->hba_private;
     int32_t res_in = 0, res_out = 0;
 
-    dprintf("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
+    DPRINTF("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
             sreq->tag, status, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
@@ -548,16 +548,16 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     if (status == CHECK_CONDITION) {
         req->senselen = scsi_req_get_sense(req->sreq, req->sense,
                                            sizeof(req->sense));
-        dprintf("VSCSI: Sense data, %d bytes:\n", req->senselen);
-        dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
+        DPRINTF("VSCSI: Sense data, %d bytes:\n", req->senselen);
+        DPRINTF("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[0], req->sense[1], req->sense[2], req->sense[3],
                 req->sense[4], req->sense[5], req->sense[6], req->sense[7]);
-        dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
+        DPRINTF("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[8], req->sense[9], req->sense[10], req->sense[11],
                 req->sense[12], req->sense[13], req->sense[14], req->sense[15]);
     }
 
-    dprintf("VSCSI: Command complete err=%d\n", status);
+    DPRINTF("VSCSI: Command complete err=%d\n", status);
     if (status == 0) {
         /* We handle overflows, not underflows for normal commands,
          * but hopefully nobody cares
@@ -611,7 +611,7 @@ static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 
     vmstate_save_state(f, &vmstate_spapr_vscsi_req, req);
 
-    dprintf("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
+    DPRINTF("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
             req->qtag, req->cur_desc_num, req->cur_desc_offset);
 }
 
@@ -636,7 +636,7 @@ static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 
     req->sreq = scsi_req_ref(sreq);
 
-    dprintf("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
+    DPRINTF("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
             req->qtag, req->cur_desc_num, req->cur_desc_offset);
 
     return req;
@@ -648,7 +648,7 @@ static void vscsi_process_login(VSCSIState *s, vscsi_req *req)
     struct srp_login_rsp *rsp = &iu->srp.login_rsp;
     uint64_t tag = iu->srp.rsp.tag;
 
-    dprintf("VSCSI: Got login, sendin response !\n");
+    DPRINTF("VSCSI: Got login, sendin response !\n");
 
     /* TODO handle case that requested size is wrong and
      * buffer format is wrong
@@ -714,7 +714,8 @@ static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req)
 
     sdev = vscsi_device_find(&s->bus, be64_to_cpu(srp->cmd.lun), &lun);
     if (!sdev) {
-        dprintf("VSCSI: Command for lun %08" PRIx64 " with no drive\n", be64_to_cpu(srp->cmd.lun));
+        DPRINTF("VSCSI: Command for lun %08" PRIx64 " with no drive\n",
+                be64_to_cpu(srp->cmd.lun));
         if (srp->cmd.cdb[0] == INQUIRY) {
             vscsi_inquiry_no_target(s, req);
         } else {
@@ -726,7 +727,7 @@ static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req)
     req->sreq = scsi_req_new(sdev, req->qtag, lun, srp->cmd.cdb, req);
     n = scsi_req_enqueue(req->sreq);
 
-    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
+    DPRINTF("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
             req->qtag, srp->cmd.cdb[0], lun, n);
 
     if (n) {
@@ -939,7 +940,7 @@ static int vscsi_do_crq(struct VIOsPAPRDevice *dev, uint8_t *crq_data)
     crq.s.IU_length = be16_to_cpu(crq.s.IU_length);
     crq.s.IU_data_ptr = be64_to_cpu(crq.s.IU_data_ptr);
 
-    dprintf("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]);
+    DPRINTF("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]);
 
     switch (crq.s.valid) {
     case 0xc0: /* Init command/response */
diff --git a/roms/seabios b/roms/seabios
index c02c219..d4f7d90 160000
--- a/roms/seabios
+++ b/roms/seabios
@@ -1 +1 @@
-Subproject commit c02c219cd79299a0a153ecf862f0e301a057f2cb
+Subproject commit d4f7d90f47462b4e8836899adc5060fbde5253e9
commit da56ff91982f25c03c997309f3d5ed6aab1e0100
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:38 2013 +0100

    target-ppc/kvm.c: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-4-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 27e2aaf..30a870e 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -40,10 +40,10 @@
 //#define DEBUG_KVM
 
 #ifdef DEBUG_KVM
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -550,7 +550,7 @@ static int kvm_put_fp(CPUState *cs)
         reg.addr = (uintptr_t)&fpscr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set FPSCR to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set FPSCR to KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -564,7 +564,7 @@ static int kvm_put_fp(CPUState *cs)
 
             ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to set %s%d to KVM: %s\n", vsx ? "VSR" : "FPR",
+                DPRINTF("Unable to set %s%d to KVM: %s\n", vsx ? "VSR" : "FPR",
                         i, strerror(errno));
                 return ret;
             }
@@ -576,7 +576,7 @@ static int kvm_put_fp(CPUState *cs)
         reg.addr = (uintptr_t)&env->vscr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VSCR to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VSCR to KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -585,7 +585,7 @@ static int kvm_put_fp(CPUState *cs)
             reg.addr = (uintptr_t)&env->avr[i];
             ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to set VR%d to KVM: %s\n", i, strerror(errno));
+                DPRINTF("Unable to set VR%d to KVM: %s\n", i, strerror(errno));
                 return ret;
             }
         }
@@ -610,7 +610,7 @@ static int kvm_get_fp(CPUState *cs)
         reg.addr = (uintptr_t)&fpscr;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to get FPSCR from KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to get FPSCR from KVM: %s\n", strerror(errno));
             return ret;
         } else {
             env->fpscr = fpscr;
@@ -624,7 +624,7 @@ static int kvm_get_fp(CPUState *cs)
 
             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to get %s%d from KVM: %s\n",
+                DPRINTF("Unable to get %s%d from KVM: %s\n",
                         vsx ? "VSR" : "FPR", i, strerror(errno));
                 return ret;
             } else {
@@ -641,7 +641,7 @@ static int kvm_get_fp(CPUState *cs)
         reg.addr = (uintptr_t)&env->vscr;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to get VSCR from KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to get VSCR from KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -650,7 +650,7 @@ static int kvm_get_fp(CPUState *cs)
             reg.addr = (uintptr_t)&env->avr[i];
             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to get VR%d from KVM: %s\n",
+                DPRINTF("Unable to get VR%d from KVM: %s\n",
                         i, strerror(errno));
                 return ret;
             }
@@ -672,7 +672,7 @@ static int kvm_get_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->vpa_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get VPA address from KVM: %s\n", strerror(errno));
+        DPRINTF("Unable to get VPA address from KVM: %s\n", strerror(errno));
         return ret;
     }
 
@@ -682,7 +682,7 @@ static int kvm_get_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->slb_shadow_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get SLB shadow state from KVM: %s\n",
+        DPRINTF("Unable to get SLB shadow state from KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -692,7 +692,7 @@ static int kvm_get_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->dtl_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get dispatch trace log state from KVM: %s\n",
+        DPRINTF("Unable to get dispatch trace log state from KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -718,7 +718,7 @@ static int kvm_put_vpa(CPUState *cs)
         reg.addr = (uintptr_t)&env->vpa_addr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VPA address to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VPA address to KVM: %s\n", strerror(errno));
             return ret;
         }
     }
@@ -729,7 +729,7 @@ static int kvm_put_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->slb_shadow_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to set SLB shadow state to KVM: %s\n", strerror(errno));
+        DPRINTF("Unable to set SLB shadow state to KVM: %s\n", strerror(errno));
         return ret;
     }
 
@@ -738,7 +738,7 @@ static int kvm_put_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->dtl_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to set dispatch trace log state to KVM: %s\n",
+        DPRINTF("Unable to set dispatch trace log state to KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -748,7 +748,7 @@ static int kvm_put_vpa(CPUState *cs)
         reg.addr = (uintptr_t)&env->vpa_addr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VPA address to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VPA address to KVM: %s\n", strerror(errno));
             return ret;
         }
     }
@@ -866,7 +866,7 @@ int kvm_arch_put_registers(CPUState *cs, int level)
 #ifdef TARGET_PPC64
         if (cap_papr) {
             if (kvm_put_vpa(cs) < 0) {
-                dprintf("Warning: Unable to set VPA information to KVM\n");
+                DPRINTF("Warning: Unable to set VPA information to KVM\n");
             }
         }
 #endif /* TARGET_PPC64 */
@@ -1075,7 +1075,7 @@ int kvm_arch_get_registers(CPUState *cs)
 #ifdef TARGET_PPC64
         if (cap_papr) {
             if (kvm_get_vpa(cs) < 0) {
-                dprintf("Warning: Unable to get VPA information from KVM\n");
+                DPRINTF("Warning: Unable to get VPA information from KVM\n");
             }
         }
 #endif
@@ -1129,7 +1129,7 @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
          */
         irq = KVM_INTERRUPT_SET;
 
-        dprintf("injected interrupt %d\n", irq);
+        DPRINTF("injected interrupt %d\n", irq);
         r = kvm_vcpu_ioctl(cs, KVM_INTERRUPT, &irq);
         if (r < 0) {
             printf("cpu %d fail inject %x\n", cs->cpu_index, irq);
@@ -1193,20 +1193,20 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
     switch (run->exit_reason) {
     case KVM_EXIT_DCR:
         if (run->dcr.is_write) {
-            dprintf("handle dcr write\n");
+            DPRINTF("handle dcr write\n");
             ret = kvmppc_handle_dcr_write(env, run->dcr.dcrn, run->dcr.data);
         } else {
-            dprintf("handle dcr read\n");
+            DPRINTF("handle dcr read\n");
             ret = kvmppc_handle_dcr_read(env, run->dcr.dcrn, &run->dcr.data);
         }
         break;
     case KVM_EXIT_HLT:
-        dprintf("handle halt\n");
+        DPRINTF("handle halt\n");
         ret = kvmppc_handle_halt(cpu);
         break;
 #if defined(TARGET_PPC64)
     case KVM_EXIT_PAPR_HCALL:
-        dprintf("handle PAPR hypercall\n");
+        DPRINTF("handle PAPR hypercall\n");
         run->papr_hcall.ret = spapr_hypercall(cpu,
                                               run->papr_hcall.nr,
                                               run->papr_hcall.args);
@@ -1214,12 +1214,12 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
         break;
 #endif
     case KVM_EXIT_EPR:
-        dprintf("handle epr\n");
+        DPRINTF("handle epr\n");
         run->epr.epr = ldl_phys(env->mpic_iack);
         ret = 0;
         break;
     case KVM_EXIT_WATCHDOG:
-        dprintf("handle watchdog expiry\n");
+        DPRINTF("handle watchdog expiry\n");
         watchdog_perform_action();
         ret = 0;
         break;
commit e67137c6c5823ad9488b766c79f0963f6ba70f12
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:37 2013 +0100

    s390x: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-3-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index 207eb82..f0aa941 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -38,10 +38,10 @@
 /* #define DEBUG_S390 */
 
 #ifdef DEBUG_S390
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
diff --git a/hw/s390x/s390-virtio.c b/hw/s390x/s390-virtio.c
index edbde00..439d732 100644
--- a/hw/s390x/s390-virtio.c
+++ b/hw/s390x/s390-virtio.c
@@ -41,10 +41,10 @@
 //#define DEBUG_S390
 
 #ifdef DEBUG_S390
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 85f0112..ab0e2b5 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -40,10 +40,10 @@
 /* #define DEBUG_KVM */
 
 #ifdef DEBUG_KVM
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -581,7 +581,7 @@ static int handle_priv(S390CPU *cpu, struct kvm_run *run,
     uint16_t ipbh0 = (run->s390_sieic.ipb & 0xffff0000) >> 16;
     uint8_t ipb = run->s390_sieic.ipb & 0xff;
 
-    dprintf("KVM: PRIV: %d\n", ipa1);
+    DPRINTF("KVM: PRIV: %d\n", ipa1);
     switch (ipa1) {
         case PRIV_SCLP_CALL:
             r = kvm_sclp_service_call(cpu, run, ipbh0);
@@ -594,7 +594,7 @@ static int handle_priv(S390CPU *cpu, struct kvm_run *run,
                     r = 0;
                 }
             } else {
-                dprintf("KVM: unknown PRIV: 0x%x\n", ipa1);
+                DPRINTF("KVM: unknown PRIV: 0x%x\n", ipa1);
                 r = -1;
             }
             break;
@@ -627,7 +627,7 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *run, int ipb_code)
             sleep(10);
             break;
         default:
-            dprintf("KVM: unknown DIAG: 0x%x\n", ipb_code);
+            DPRINTF("KVM: unknown DIAG: 0x%x\n", ipb_code);
             r = -1;
             break;
     }
@@ -640,7 +640,7 @@ static int s390_cpu_restart(S390CPU *cpu)
     kvm_s390_interrupt(cpu, KVM_S390_RESTART, 0);
     s390_add_running_cpu(cpu);
     qemu_cpu_kick(CPU(cpu));
-    dprintf("DONE: SIGP cpu restart: %p\n", &cpu->env);
+    DPRINTF("DONE: SIGP cpu restart: %p\n", &cpu->env);
     return 0;
 }
 
@@ -668,7 +668,7 @@ static int s390_cpu_initial_reset(S390CPU *cpu)
         env->regs[i] = 0;
     }
 
-    dprintf("DONE: SIGP initial reset: %p\n", env);
+    DPRINTF("DONE: SIGP initial reset: %p\n", env);
     return 0;
 }
 
@@ -737,7 +737,8 @@ static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
     int ipb_code = (run->s390_sieic.ipb & 0x0fff0000) >> 16;
     int r = -1;
 
-    dprintf("handle_instruction 0x%x 0x%x\n", run->s390_sieic.ipa, run->s390_sieic.ipb);
+    DPRINTF("handle_instruction 0x%x 0x%x\n",
+            run->s390_sieic.ipa, run->s390_sieic.ipb);
     switch (ipa0) {
     case IPA0_B2:
     case IPA0_B9:
@@ -771,7 +772,7 @@ static int handle_intercept(S390CPU *cpu)
     int icpt_code = run->s390_sieic.icptcode;
     int r = 0;
 
-    dprintf("intercept: 0x%x (at 0x%lx)\n", icpt_code,
+    DPRINTF("intercept: 0x%x (at 0x%lx)\n", icpt_code,
             (long)cs->kvm_run->psw_addr);
     switch (icpt_code) {
         case ICPT_INSTRUCTION:
commit 2440a2c3dfcb9bc463be8ff5a97382e4d2aad750
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:36 2013 +0100

    block/sheepdog: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-2-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block/sheepdog.c b/block/sheepdog.c
index 6a41ad9..a506137 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -242,14 +242,14 @@ static inline bool is_snapshot(struct SheepdogInode *inode)
     return !!inode->snap_ctime;
 }
 
-#undef dprintf
+#undef DPRINTF
 #ifdef DEBUG_SDOG
-#define dprintf(fmt, args...)                                       \
+#define DPRINTF(fmt, args...)                                       \
     do {                                                            \
         fprintf(stdout, "%s %d: " fmt, __func__, __LINE__, ##args); \
     } while (0)
 #else
-#define dprintf(fmt, args...)
+#define DPRINTF(fmt, args...)
 #endif
 
 typedef struct SheepdogAIOCB SheepdogAIOCB;
@@ -729,7 +729,7 @@ static void coroutine_fn aio_read_response(void *opaque)
         break;
     case AIOCB_FLUSH_CACHE:
         if (rsp.result == SD_RES_INVALID_PARMS) {
-            dprintf("disable cache since the server doesn't support it\n");
+            DPRINTF("disable cache since the server doesn't support it\n");
             s->cache_flags = SD_FLAG_CMD_DIRECT;
             rsp.result = SD_RES_SUCCESS;
         }
@@ -1229,7 +1229,7 @@ static int coroutine_fn resend_aioreq(BDRVSheepdogState *s, AIOReq *aio_req)
          * the same object */
         QLIST_FOREACH(areq, &s->inflight_aio_head, aio_siblings) {
             if (areq != aio_req && areq->oid == aio_req->oid) {
-                dprintf("simultaneous CoW to %" PRIx64 "\n", aio_req->oid);
+                DPRINTF("simultaneous CoW to %" PRIx64 "\n", aio_req->oid);
                 QLIST_REMOVE(aio_req, aio_siblings);
                 QLIST_INSERT_HEAD(&s->pending_aio_head, aio_req, aio_siblings);
                 return SD_RES_SUCCESS;
@@ -1319,7 +1319,7 @@ static int sd_open(BlockDriverState *bs, QDict *options, int flags)
     s->discard_supported = true;
 
     if (snapid || tag[0] != '\0') {
-        dprintf("%" PRIx32 " snapshot inode was open.\n", vid);
+        DPRINTF("%" PRIx32 " snapshot inode was open.\n", vid);
         s->is_snapshot = true;
     }
 
@@ -1554,7 +1554,7 @@ static void sd_close(BlockDriverState *bs)
     unsigned int wlen, rlen = 0;
     int fd, ret;
 
-    dprintf("%s\n", s->name);
+    DPRINTF("%s\n", s->name);
 
     fd = connect_to_sdog(s);
     if (fd < 0) {
@@ -1714,7 +1714,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
     char *buf;
     bool deleted;
 
-    dprintf("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);
 
     buf = g_malloc(SD_INODE_SIZE);
 
@@ -1730,7 +1730,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
         goto out;
     }
 
-    dprintf("%" PRIx32 " is created.\n", vid);
+    DPRINTF("%" PRIx32 " is created.\n", vid);
 
     fd = connect_to_sdog(s);
     if (fd < 0) {
@@ -1751,7 +1751,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
 
     s->is_snapshot = false;
     ret = 0;
-    dprintf("%" PRIx32 " was newly created.\n", s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " was newly created.\n", s->inode.vdi_id);
 
 out:
     g_free(buf);
@@ -1841,11 +1841,11 @@ static int coroutine_fn sd_co_rw_vector(void *p)
         }
 
         if (create) {
-            dprintf("update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld\n",
+            DPRINTF("update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld\n",
                     inode->vdi_id, oid,
                     vid_to_data_oid(inode->data_vdi_id[idx], idx), idx);
             oid = vid_to_data_oid(inode->vdi_id, idx);
-            dprintf("new oid %" PRIx64 "\n", oid);
+            DPRINTF("new oid %" PRIx64 "\n", oid);
         }
 
         aio_req = alloc_aio_req(s, acb, oid, len, offset, flags, old_oid, done);
@@ -1978,7 +1978,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
     SheepdogInode *inode;
     unsigned int datalen;
 
-    dprintf("sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " "
+    DPRINTF("sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " "
             "is_snapshot %d\n", sn_info->name, sn_info->id_str,
             s->name, sn_info->vm_state_size, s->is_snapshot);
 
@@ -1989,7 +1989,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
         return -EINVAL;
     }
 
-    dprintf("%s %s\n", sn_info->name, sn_info->id_str);
+    DPRINTF("%s %s\n", sn_info->name, sn_info->id_str);
 
     s->inode.vm_state_size = sn_info->vm_state_size;
     s->inode.vm_clock_nsec = sn_info->vm_clock_nsec;
@@ -2033,7 +2033,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
     }
 
     memcpy(&s->inode, inode, datalen);
-    dprintf("s->inode: name %s snap_id %x oid %x\n",
+    DPRINTF("s->inode: name %s snap_id %x oid %x\n",
             s->inode.name, s->inode.snap_id, s->inode.vdi_id);
 
 cleanup:
commit 398489018183d613306ab022653552247d93919f
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:57 2013 +0200

    pc: limit 64 bit hole to 2G by default
    
    It turns out that some 32 bit windows guests crash
    if 64 bit PCI hole size is >2G.
    Limit it to 2G for piix and q35 by default.
    User may override default 64-bit PCI hole size by
    using "pci-hole64-size" property.
    
    Examples:
    -global i440FX-pcihost.pci-hole64-size=4G
    
    -global q35-pcihost.pci-hole64-size=4G
    
    Reported-by: Igor Mammedov <imammedo at redhat.com>,
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-8-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index b0b98a8..a2b9d88 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -55,6 +55,7 @@
 #include "hw/acpi/acpi.h"
 #include "hw/cpu/icc_bus.h"
 #include "hw/boards.h"
+#include "hw/pci/pci_host.h"
 
 /* debug PC/ISA interrupts */
 //#define DEBUG_IRQ
@@ -1003,15 +1004,27 @@ typedef struct PcRomPciInfo {
 static void pc_fw_cfg_guest_info(PcGuestInfo *guest_info)
 {
     PcRomPciInfo *info;
+    Object *pci_info;
+    bool ambiguous = false;
+
     if (!guest_info->has_pci_info || !guest_info->fw_cfg) {
         return;
     }
+    pci_info = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
+    g_assert(!ambiguous);
+    if (!pci_info) {
+        return;
+    }
 
     info = g_malloc(sizeof *info);
-    info->w32_min = cpu_to_le64(guest_info->pci_info.w32.begin);
-    info->w32_max = cpu_to_le64(guest_info->pci_info.w32.end);
-    info->w64_min = cpu_to_le64(guest_info->pci_info.w64.begin);
-    info->w64_max = cpu_to_le64(guest_info->pci_info.w64.end);
+    info->w32_min = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE_START, NULL));
+    info->w32_max = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE_END, NULL));
+    info->w64_min = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE64_START, NULL));
+    info->w64_max = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE64_END, NULL));
     /* Pass PCI hole info to guest via a side channel.
      * Required so guest PCI enumeration does the right thing. */
     fw_cfg_add_file(guest_info->fw_cfg, "etc/pci-info", info, sizeof *info);
@@ -1037,29 +1050,28 @@ PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
     PcGuestInfoState *guest_info_state = g_malloc0(sizeof *guest_info_state);
     PcGuestInfo *guest_info = &guest_info_state->info;
 
-    guest_info->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
-    if (sizeof(hwaddr) == 4) {
-        guest_info->pci_info.w64.begin = 0;
-        guest_info->pci_info.w64.end = 0;
-    } else {
-        /*
-         * BIOS does not set MTRR entries for the 64 bit window, so no need to
-         * align address to power of two.  Align address at 1G, this makes sure
-         * it can be exactly covered with a PAT entry even when using huge
-         * pages.
-         */
-        guest_info->pci_info.w64.begin =
-            ROUND_UP((0x1ULL << 32) + above_4g_mem_size, 0x1ULL << 30);
-        guest_info->pci_info.w64.end = guest_info->pci_info.w64.begin +
-            (0x1ULL << 62);
-        assert(guest_info->pci_info.w64.begin <= guest_info->pci_info.w64.end);
-    }
-
     guest_info_state->machine_done.notify = pc_guest_info_machine_done;
     qemu_add_machine_init_done_notifier(&guest_info_state->machine_done);
     return guest_info;
 }
 
+void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,
+                        uint64_t pci_hole64_size)
+{
+    if ((sizeof(hwaddr) == 4) || (!pci_hole64_size)) {
+        return;
+    }
+    /*
+     * BIOS does not set MTRR entries for the 64 bit window, so no need to
+     * align address to power of two.  Align address at 1G, this makes sure
+     * it can be exactly covered with a PAT entry even when using huge
+     * pages.
+     */
+    pci_info->w64.begin = ROUND_UP(pci_hole64_start, 0x1ULL << 30);
+    pci_info->w64.end = pci_info->w64.begin + pci_hole64_size;
+    assert(pci_info->w64.begin <= pci_info->w64.end);
+}
+
 void pc_acpi_init(const char *default_dsdt)
 {
     char *filename;
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index b58c255..ab25458 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -129,15 +129,6 @@ static void pc_init1(MemoryRegion *system_memory,
     guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size);
     guest_info->has_pci_info = has_pci_info;
 
-    /* Set PCI window size the way seabios has always done it. */
-    /* Power of 2 so bios can cover it with a single MTRR */
-    if (ram_size <= 0x80000000)
-        guest_info->pci_info.w32.begin = 0x80000000;
-    else if (ram_size <= 0xc0000000)
-        guest_info->pci_info.w32.begin = 0xc0000000;
-    else
-        guest_info->pci_info.w32.begin = 0xe0000000;
-
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
         fw_cfg = pc_memory_init(system_memory,
@@ -160,10 +151,7 @@ static void pc_init1(MemoryRegion *system_memory,
                               system_memory, system_io, ram_size,
                               below_4g_mem_size,
                               0x100000000ULL - below_4g_mem_size,
-                              0x100000000ULL + above_4g_mem_size,
-                              (sizeof(hwaddr) == 4
-                               ? 0
-                               : ((uint64_t)1 << 62)),
+                              above_4g_mem_size,
                               pci_memory, ram_memory);
     } else {
         pci_bus = NULL;
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 3f539ec..dc1718f 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -32,6 +32,8 @@
 #include "hw/xen/xen.h"
 #include "hw/pci-host/pam.h"
 #include "sysemu/sysemu.h"
+#include "hw/i386/ioapic.h"
+#include "qapi/visitor.h"
 
 /*
  * I440FX chipset data sheet.
@@ -44,6 +46,8 @@
 
 typedef struct I440FXState {
     PCIHostState parent_obj;
+    PcPciInfo pci_info;
+    uint64_t pci_hole64_size;
 } I440FXState;
 
 #define PIIX_NUM_PIC_IRQS       16      /* i8259 * 2 */
@@ -207,14 +211,71 @@ static const VMStateDescription vmstate_i440fx = {
     }
 };
 
+static void i440fx_pcihost_get_pci_hole_start(Object *obj, Visitor *v,
+                                              void *opaque, const char *name,
+                                              Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+    uint32_t value = s->pci_info.w32.begin;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole_end(Object *obj, Visitor *v,
+                                            void *opaque, const char *name,
+                                            Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+    uint32_t value = s->pci_info.w32.end;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole64_start(Object *obj, Visitor *v,
+                                                void *opaque, const char *name,
+                                                Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+
+    visit_type_uint64(v, &s->pci_info.w64.begin, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole64_end(Object *obj, Visitor *v,
+                                              void *opaque, const char *name,
+                                              Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+
+    visit_type_uint64(v, &s->pci_info.w64.end, name, errp);
+}
+
 static void i440fx_pcihost_initfn(Object *obj)
 {
     PCIHostState *s = PCI_HOST_BRIDGE(obj);
+    I440FXState *d = I440FX_PCI_HOST_BRIDGE(obj);
 
     memory_region_init_io(&s->conf_mem, obj, &pci_host_conf_le_ops, s,
                           "pci-conf-idx", 4);
     memory_region_init_io(&s->data_mem, obj, &pci_host_data_le_ops, s,
                           "pci-conf-data", 4);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "int",
+                        i440fx_pcihost_get_pci_hole_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, "int",
+                        i440fx_pcihost_get_pci_hole_end,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, "int",
+                        i440fx_pcihost_get_pci_hole64_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, "int",
+                        i440fx_pcihost_get_pci_hole64_end,
+                        NULL, NULL, NULL, NULL);
+
+    d->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
 }
 
 static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
@@ -247,8 +308,7 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
                     ram_addr_t ram_size,
                     hwaddr pci_hole_start,
                     hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
+                    ram_addr_t above_4g_mem_size,
                     MemoryRegion *pci_address_space,
                     MemoryRegion *ram_memory)
 {
@@ -259,6 +319,7 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
     PIIX3State *piix3;
     PCII440FXState *f;
     unsigned i;
+    I440FXState *i440fx;
 
     dev = qdev_create(NULL, TYPE_I440FX_PCI_HOST_BRIDGE);
     s = PCI_HOST_BRIDGE(dev);
@@ -274,14 +335,31 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
     f->system_memory = address_space_mem;
     f->pci_address_space = pci_address_space;
     f->ram_memory = ram_memory;
+
+    i440fx = I440FX_PCI_HOST_BRIDGE(dev);
+    /* Set PCI window size the way seabios has always done it. */
+    /* Power of 2 so bios can cover it with a single MTRR */
+    if (ram_size <= 0x80000000) {
+        i440fx->pci_info.w32.begin = 0x80000000;
+    } else if (ram_size <= 0xc0000000) {
+        i440fx->pci_info.w32.begin = 0xc0000000;
+    } else {
+        i440fx->pci_info.w32.begin = 0xe0000000;
+    }
+
     memory_region_init_alias(&f->pci_hole, OBJECT(d), "pci-hole", f->pci_address_space,
                              pci_hole_start, pci_hole_size);
     memory_region_add_subregion(f->system_memory, pci_hole_start, &f->pci_hole);
+
+    pc_init_pci64_hole(&i440fx->pci_info, 0x100000000ULL + above_4g_mem_size,
+                       i440fx->pci_hole64_size);
     memory_region_init_alias(&f->pci_hole_64bit, OBJECT(d), "pci-hole64",
                              f->pci_address_space,
-                             pci_hole64_start, pci_hole64_size);
-    if (pci_hole64_size) {
-        memory_region_add_subregion(f->system_memory, pci_hole64_start,
+                             i440fx->pci_info.w64.begin,
+                             i440fx->pci_hole64_size);
+    if (i440fx->pci_hole64_size) {
+        memory_region_add_subregion(f->system_memory,
+                                    i440fx->pci_info.w64.begin,
                                     &f->pci_hole_64bit);
     }
     memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
@@ -629,6 +707,12 @@ static const char *i440fx_pcihost_root_bus_path(PCIHostState *host_bridge,
     return "0000";
 }
 
+static Property i440fx_props[] = {
+    DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, I440FXState,
+                     pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -638,6 +722,7 @@ static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
     dc->realize = i440fx_pcihost_realize;
     dc->fw_name = "pci";
     dc->no_user = 1;
+    dc->props = i440fx_props;
 }
 
 static const TypeInfo i440fx_pcihost_info = {
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 69234de..12314d8 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -29,6 +29,7 @@
  */
 #include "hw/hw.h"
 #include "hw/pci-host/q35.h"
+#include "qapi/visitor.h"
 
 /****************************************************************************
  * Q35 host
@@ -64,9 +65,49 @@ static const char *q35_host_root_bus_path(PCIHostState *host_bridge,
     return "0000";
 }
 
+static void q35_host_get_pci_hole_start(Object *obj, Visitor *v,
+                                        void *opaque, const char *name,
+                                        Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+    uint32_t value = s->mch.pci_info.w32.begin;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void q35_host_get_pci_hole_end(Object *obj, Visitor *v,
+                                      void *opaque, const char *name,
+                                      Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+    uint32_t value = s->mch.pci_info.w32.end;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void q35_host_get_pci_hole64_start(Object *obj, Visitor *v,
+                                          void *opaque, const char *name,
+                                          Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+
+    visit_type_uint64(v, &s->mch.pci_info.w64.begin, name, errp);
+}
+
+static void q35_host_get_pci_hole64_end(Object *obj, Visitor *v,
+                                        void *opaque, const char *name,
+                                        Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+
+    visit_type_uint64(v, &s->mch.pci_info.w64.end, name, errp);
+}
+
 static Property mch_props[] = {
     DEFINE_PROP_UINT64("MCFG", Q35PCIHost, parent_obj.base_addr,
                         MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT),
+    DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, Q35PCIHost,
+                     mch.pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -96,6 +137,31 @@ static void q35_host_initfn(Object *obj)
     object_property_add_child(OBJECT(s), "mch", OBJECT(&s->mch), NULL);
     qdev_prop_set_uint32(DEVICE(&s->mch), "addr", PCI_DEVFN(0, 0));
     qdev_prop_set_bit(DEVICE(&s->mch), "multifunction", false);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "int",
+                        q35_host_get_pci_hole_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, "int",
+                        q35_host_get_pci_hole_end,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, "int",
+                        q35_host_get_pci_hole64_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, "int",
+                        q35_host_get_pci_hole64_end,
+                        NULL, NULL, NULL, NULL);
+
+    /* Leave enough space for the biggest MCFG BAR */
+    /* TODO: this matches current bios behaviour, but
+     * it's not a power of two, which means an MTRR
+     * can't cover it exactly.
+     */
+    s->mch.pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
+        MCH_HOST_BRIDGE_PCIEXBAR_MAX;
+    s->mch.pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
 }
 
 static const TypeInfo q35_host_info = {
@@ -253,17 +319,8 @@ static void mch_reset(DeviceState *qdev)
 static int mch_init(PCIDevice *d)
 {
     int i;
-    hwaddr pci_hole64_size;
     MCHPCIState *mch = MCH_PCI_DEVICE(d);
 
-    /* Leave enough space for the biggest MCFG BAR */
-    /* TODO: this matches current bios behaviour, but
-     * it's not a power of two, which means an MTRR
-     * can't cover it exactly.
-     */
-    mch->guest_info->pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
-        MCH_HOST_BRIDGE_PCIEXBAR_MAX;
-
     /* setup pci memory regions */
     memory_region_init_alias(&mch->pci_hole, OBJECT(mch), "pci-hole",
                              mch->pci_address_space,
@@ -271,15 +328,16 @@ static int mch_init(PCIDevice *d)
                              0x100000000ULL - mch->below_4g_mem_size);
     memory_region_add_subregion(mch->system_memory, mch->below_4g_mem_size,
                                 &mch->pci_hole);
-    pci_hole64_size = (sizeof(hwaddr) == 4 ? 0 :
-                       ((uint64_t)1 << 62));
+
+    pc_init_pci64_hole(&mch->pci_info, 0x100000000ULL + mch->above_4g_mem_size,
+                       mch->pci_hole64_size);
     memory_region_init_alias(&mch->pci_hole_64bit, OBJECT(mch), "pci-hole64",
                              mch->pci_address_space,
-                             0x100000000ULL + mch->above_4g_mem_size,
-                             pci_hole64_size);
-    if (pci_hole64_size) {
+                             mch->pci_info.w64.begin,
+                             mch->pci_hole64_size);
+    if (mch->pci_hole64_size) {
         memory_region_add_subregion(mch->system_memory,
-                                    0x100000000ULL + mch->above_4g_mem_size,
+                                    mch->pci_info.w64.begin,
                                     &mch->pci_hole_64bit);
     }
     /* smram */
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 09c2dd4..3a0c4e3 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -18,7 +18,6 @@ typedef struct PcPciInfo {
 } PcPciInfo;
 
 struct PcGuestInfo {
-    PcPciInfo pci_info;
     bool has_pci_info;
     FWCfgState *fw_cfg;
 };
@@ -101,6 +100,16 @@ void pc_acpi_init(const char *default_dsdt);
 PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
                                 ram_addr_t above_4g_mem_size);
 
+#define PCI_HOST_PROP_PCI_HOLE_START   "pci-hole-start"
+#define PCI_HOST_PROP_PCI_HOLE_END     "pci-hole-end"
+#define PCI_HOST_PROP_PCI_HOLE64_START "pci-hole64-start"
+#define PCI_HOST_PROP_PCI_HOLE64_END   "pci-hole64-end"
+#define PCI_HOST_PROP_PCI_HOLE64_SIZE  "pci-hole64-size"
+#define DEFAULT_PCI_HOLE64_SIZE (1ULL << 31)
+
+void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,
+                        uint64_t pci_hole64_size);
+
 FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            const char *kernel_filename,
                            const char *kernel_cmdline,
@@ -150,8 +159,7 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn,
                     ram_addr_t ram_size,
                     hwaddr pci_hole_start,
                     hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
+                    ram_addr_t above_4g_mem_size,
                     MemoryRegion *pci_memory,
                     MemoryRegion *ram_memory);
 
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 3cb631e..6eb7ab6 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -55,9 +55,11 @@ typedef struct MCHPCIState {
     MemoryRegion smram_region;
     MemoryRegion pci_hole;
     MemoryRegion pci_hole_64bit;
+    PcPciInfo pci_info;
     uint8_t smm_enabled;
     ram_addr_t below_4g_mem_size;
     ram_addr_t above_4g_mem_size;
+    uint64_t pci_hole64_size;
     PcGuestInfo *guest_info;
 } MCHPCIState;
 
commit e8cd45c78f53501e75bd455140da63d1b7ed3685
Author: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
Date:   Mon Jul 29 16:47:56 2013 +0200

    qdev: Add SIZE type to qdev properties
    
    This patch adds a 'SIZE' type property to qdev.
    
    Signed-off-by: Ian Molton <ian.molton at collabora.co.uk>
    Signed-off-by: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-7-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index 6e1ed1e..8d43a8d 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -1135,3 +1135,58 @@ void qdev_prop_set_globals(DeviceState *dev, Error **errp)
         class = object_class_get_parent(class);
     } while (class);
 }
+
+/* --- 64bit unsigned int 'size' type --- */
+
+static void get_size(Object *obj, Visitor *v, void *opaque,
+                     const char *name, Error **errp)
+{
+    DeviceState *dev = DEVICE(obj);
+    Property *prop = opaque;
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+
+    visit_type_size(v, ptr, name, errp);
+}
+
+static void set_size(Object *obj, Visitor *v, void *opaque,
+                     const char *name, Error **errp)
+{
+    DeviceState *dev = DEVICE(obj);
+    Property *prop = opaque;
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+
+    visit_type_size(v, ptr, name, errp);
+}
+
+static int parse_size(DeviceState *dev, Property *prop, const char *str)
+{
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+    Error *errp = NULL;
+
+    if (str != NULL) {
+        parse_option_size(prop->name, str, ptr, &errp);
+    }
+    assert_no_error(errp);
+    return 0;
+}
+
+static int print_size(DeviceState *dev, Property *prop, char *dest, size_t len)
+{
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+    char suffixes[] = {'T', 'G', 'M', 'K', 'B'};
+    int i = 0;
+    uint64_t div;
+
+    for (div = (long int)1 << 40; !(*ptr / div) ; div >>= 10) {
+        i++;
+    }
+    return snprintf(dest, len, "%0.03f%c", (double)*ptr/div, suffixes[i]);
+}
+
+PropertyInfo qdev_prop_size = {
+    .name  = "size",
+    .parse = parse_size,
+    .print = print_size,
+    .get = get_size,
+    .set = set_size,
+};
diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
index 39448b7..692f82e 100644
--- a/include/hw/qdev-properties.h
+++ b/include/hw/qdev-properties.h
@@ -15,6 +15,7 @@ extern PropertyInfo qdev_prop_uint64;
 extern PropertyInfo qdev_prop_hex8;
 extern PropertyInfo qdev_prop_hex32;
 extern PropertyInfo qdev_prop_hex64;
+extern PropertyInfo qdev_prop_size;
 extern PropertyInfo qdev_prop_string;
 extern PropertyInfo qdev_prop_chr;
 extern PropertyInfo qdev_prop_ptr;
@@ -116,6 +117,8 @@ extern PropertyInfo qdev_prop_arraylen;
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_hex32, uint32_t)
 #define DEFINE_PROP_HEX64(_n, _s, _f, _d)                       \
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_hex64, uint64_t)
+#define DEFINE_PROP_SIZE(_n, _s, _f, _d)                       \
+    DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_size, uint64_t)
 #define DEFINE_PROP_PCI_DEVFN(_n, _s, _f, _d)                   \
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_pci_devfn, int32_t)
 
diff --git a/include/qemu/option.h b/include/qemu/option.h
index 13f5e72..7a58e47 100644
--- a/include/qemu/option.h
+++ b/include/qemu/option.h
@@ -73,6 +73,8 @@ QEMUOptionParameter *append_option_parameters(QEMUOptionParameter *dest,
     QEMUOptionParameter *list);
 QEMUOptionParameter *parse_option_parameters(const char *param,
     QEMUOptionParameter *list, QEMUOptionParameter *dest);
+void parse_option_size(const char *name, const char *value,
+                       uint64_t *ret, Error **errp);
 void free_option_parameters(QEMUOptionParameter *list);
 void print_option_parameters(QEMUOptionParameter *list);
 void print_option_help(QEMUOptionParameter *list);
diff --git a/util/qemu-option.c b/util/qemu-option.c
index 5d686c8..7a1552a 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -173,8 +173,8 @@ static void parse_option_number(const char *name, const char *value,
     }
 }
 
-static void parse_option_size(const char *name, const char *value,
-                              uint64_t *ret, Error **errp)
+void parse_option_size(const char *name, const char *value,
+                       uint64_t *ret, Error **errp)
 {
     char *postfix;
     double sizef;
commit b887796217b7f5b754657e85760693e4ced63356
Author: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
Date:   Mon Jul 29 16:47:55 2013 +0200

    qapi: make visit_type_size fallback to type_int
    
    Currently visit_type_size checks if the visitor's type_size function pointer is
    NULL. If not, it calls it, otherwise it calls v->type_uint64(). But neither of
    these pointers are ever set. Fallback to calling v->type_int() in this third
    (default) case.
    
    Signed-off-by: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-6-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c
index d6a4012..6451a21 100644
--- a/qapi/qapi-visit-core.c
+++ b/qapi/qapi-visit-core.c
@@ -263,8 +263,17 @@ void visit_type_int64(Visitor *v, int64_t *obj, const char *name, Error **errp)
 
 void visit_type_size(Visitor *v, uint64_t *obj, const char *name, Error **errp)
 {
+    int64_t value;
     if (!error_is_set(errp)) {
-        (v->type_size ? v->type_size : v->type_uint64)(v, obj, name, errp);
+        if (v->type_size) {
+            v->type_size(v, obj, name, errp);
+        } else if (v->type_uint64) {
+            v->type_uint64(v, obj, name, errp);
+        } else {
+            value = *obj;
+            v->type_int(v, &value, name, errp);
+            *obj = value;
+        }
     }
 }
 
commit c52dc697259ac826d905db57e298c50306a8c600
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:54 2013 +0200

    pc: add Q35 to QOM composition tree under /machine
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-5-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 0b1d2e3..2f35d12 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -131,6 +131,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     /* create pci host bus */
     q35_host = Q35_HOST_DEVICE(qdev_create(NULL, TYPE_Q35_HOST_DEVICE));
 
+    object_property_add_child(qdev_get_machine(), "q35", OBJECT(q35_host), NULL);
     q35_host->mch.ram_memory = ram_memory;
     q35_host->mch.pci_address_space = pci_memory;
     q35_host->mch.system_memory = get_system_memory();
commit 44fc8c5e743b84c1d29f603e4014125dcf152d26
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:53 2013 +0200

    pc: replace i440fx_common_init() with i440fx_init()
    
    It isn't used anywhere else.
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-4-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 39e9c55..3f539ec 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -239,19 +239,18 @@ static int i440fx_initfn(PCIDevice *dev)
     return 0;
 }
 
-static PCIBus *i440fx_common_init(const char *device_name,
-                                  PCII440FXState **pi440fx_state,
-                                  int *piix3_devfn,
-                                  ISABus **isa_bus, qemu_irq *pic,
-                                  MemoryRegion *address_space_mem,
-                                  MemoryRegion *address_space_io,
-                                  ram_addr_t ram_size,
-                                  hwaddr pci_hole_start,
-                                  hwaddr pci_hole_size,
-                                  hwaddr pci_hole64_start,
-                                  hwaddr pci_hole64_size,
-                                  MemoryRegion *pci_address_space,
-                                  MemoryRegion *ram_memory)
+PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
+                    int *piix3_devfn,
+                    ISABus **isa_bus, qemu_irq *pic,
+                    MemoryRegion *address_space_mem,
+                    MemoryRegion *address_space_io,
+                    ram_addr_t ram_size,
+                    hwaddr pci_hole_start,
+                    hwaddr pci_hole_size,
+                    hwaddr pci_hole64_start,
+                    hwaddr pci_hole64_size,
+                    MemoryRegion *pci_address_space,
+                    MemoryRegion *ram_memory)
 {
     DeviceState *dev;
     PCIBus *b;
@@ -269,7 +268,7 @@ static PCIBus *i440fx_common_init(const char *device_name,
     object_property_add_child(qdev_get_machine(), "i440fx", OBJECT(dev), NULL);
     qdev_init_nofail(dev);
 
-    d = pci_create_simple(b, 0, device_name);
+    d = pci_create_simple(b, 0, TYPE_I440FX_PCI_DEVICE);
     *pi440fx_state = I440FX_PCI_DEVICE(d);
     f = *pi440fx_state;
     f->system_memory = address_space_mem;
@@ -330,29 +329,6 @@ static PCIBus *i440fx_common_init(const char *device_name,
     return b;
 }
 
-PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn,
-                    ISABus **isa_bus, qemu_irq *pic,
-                    MemoryRegion *address_space_mem,
-                    MemoryRegion *address_space_io,
-                    ram_addr_t ram_size,
-                    hwaddr pci_hole_start,
-                    hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
-                    MemoryRegion *pci_memory, MemoryRegion *ram_memory)
-
-{
-    PCIBus *b;
-
-    b = i440fx_common_init(TYPE_I440FX_PCI_DEVICE, pi440fx_state,
-                           piix3_devfn, isa_bus, pic,
-                           address_space_mem, address_space_io, ram_size,
-                           pci_hole_start, pci_hole_size,
-                           pci_hole64_start, pci_hole64_size,
-                           pci_memory, ram_memory);
-    return b;
-}
-
 /* PIIX3 PCI to ISA bridge */
 static void piix3_set_irq_pic(PIIX3State *piix3, int pic_irq)
 {
commit 1d0d4aa412eef7d98e53c313c79c359f2f65376e
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:52 2013 +0200

    pc: add I440FX QOM cast macro
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-3-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 3908860..39e9c55 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -38,6 +38,10 @@
  * http://download.intel.com/design/chipsets/datashts/29054901.pdf
  */
 
+#define TYPE_I440FX_PCI_HOST_BRIDGE "i440FX-pcihost"
+#define I440FX_PCI_HOST_BRIDGE(obj) \
+    OBJECT_CHECK(I440FXState, (obj), TYPE_I440FX_PCI_HOST_BRIDGE)
+
 typedef struct I440FXState {
     PCIHostState parent_obj;
 } I440FXState;
@@ -257,7 +261,7 @@ static PCIBus *i440fx_common_init(const char *device_name,
     PCII440FXState *f;
     unsigned i;
 
-    dev = qdev_create(NULL, "i440FX-pcihost");
+    dev = qdev_create(NULL, TYPE_I440FX_PCI_HOST_BRIDGE);
     s = PCI_HOST_BRIDGE(dev);
     b = pci_bus_new(dev, NULL, pci_address_space,
                     address_space_io, 0, TYPE_PCI_BUS);
@@ -661,7 +665,7 @@ static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo i440fx_pcihost_info = {
-    .name          = "i440FX-pcihost",
+    .name          = TYPE_I440FX_PCI_HOST_BRIDGE,
     .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(I440FXState),
     .instance_init = i440fx_pcihost_initfn,
commit f5338ee30d91693f5805208e58df80f0551c3896
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon Jul 29 16:47:51 2013 +0200

    pc: move IO_APIC_DEFAULT_ADDRESS to include/hw/i386/ioapic.h
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-2-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 2a87563..b0b98a8 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -75,8 +75,6 @@
 #define FW_CFG_E820_TABLE (FW_CFG_ARCH_LOCAL + 3)
 #define FW_CFG_HPET (FW_CFG_ARCH_LOCAL + 4)
 
-#define IO_APIC_DEFAULT_ADDRESS 0xfec00000
-
 #define E820_NR_ENTRIES		16
 
 struct e820_entry {
diff --git a/include/hw/i386/ioapic.h b/include/hw/i386/ioapic.h
index 86e63da..6245388 100644
--- a/include/hw/i386/ioapic.h
+++ b/include/hw/i386/ioapic.h
@@ -21,6 +21,7 @@
 #define HW_IOAPIC_H
 
 #define IOAPIC_NUM_PINS 24
+#define IO_APIC_DEFAULT_ADDRESS 0xfec00000
 
 void ioapic_eoi_broadcast(int vector);
 
commit 6a4992d0bdeb38a57314d731d9846063b2057e6c
Merge: eddbf0a b67964d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 14:39:49 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-devices-for-anthony' into staging
    
    QOM device refactorings
    
    * Replace all uses of FROM_SYSBUS() macro with QOM cast macros
      i) "QOM cast cleanup for X"
         Indicates a mechanical 1:1 between TYPE_* and *State.
      ii) "QOM'ify X and Y"
          Indicates abstract types may have been inserted or similar changes
          to type hierarchy.
      ii) Renames
          Coding Style fixes such as CamelCase have been applied in some cases.
    * Fix for sparc floppy - cf. ii) above
    * Change PCI type hierarchy to provide PCI_BRIDGE() casts
    * In doing so, prepare for adopting QOM realize
    
    # gpg: Signature made Mon 29 Jul 2013 02:15:22 PM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Andreas Färber (171) and others
    # Via Andreas Färber
    * afaerber/tags/qom-devices-for-anthony: (173 commits)
      sysbus: QOM parent field cleanup for SysBusDevice
      spapr_pci: QOM cast cleanup
      ioapic: QOM cast cleanup
      kvm/ioapic: QOM cast cleanup
      kvmvapic: QOM cast cleanup
      mipsnet: QOM cast cleanup
      opencores_eth: QOM cast cleanup
      exynos4210_i2c: QOM cast cleanup
      sysbus: Remove unused sysbus_new() prototype
      sysbus: Drop FROM_SYSBUS()
      xilinx_timer: QOM cast cleanup
      tusb6010: QOM cast cleanup
      slavio_timer: QOM cast cleanup
      pxa2xx_timer: QOM'ify pxa25x-timer and pxa27x-timer
      puv3_ost: QOM cast cleanup
      pl031: QOM cast cleanup
      pl031: Rename pl031_state to PL031State
      milkymist-sysctl: QOM cast cleanup
      m48t59: QOM cast cleanup for M48t59SysBusState
      lm32_timer: QOM cast cleanup
      ...

commit b67964d70219a864ec427e727754a205475c7d6c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:40:42 2013 +0200

    sysbus: QOM parent field cleanup for SysBusDevice
    
    Rename the parent field and hide it from gtk-doc.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index f1d1c5e..bb50a87 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -42,7 +42,10 @@ typedef struct SysBusDeviceClass {
 } SysBusDeviceClass;
 
 struct SysBusDevice {
-    DeviceState qdev;
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+
     int num_irq;
     qemu_irq irqs[QDEV_MAX_IRQ];
     qemu_irq *irqp[QDEV_MAX_IRQ];
commit 38fb090a80bc8884ff1874b827ccc9a160102f9d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:39:37 2013 +0200

    spapr_pci: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 3156fdd..1ca35a0 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -479,6 +479,7 @@ static AddressSpace *spapr_pci_dma_iommu(PCIBus *bus, void *opaque, int devfn)
 
 static int spapr_phb_init(SysBusDevice *s)
 {
+    DeviceState *dev = DEVICE(s);
     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
     PCIHostState *phb = PCI_HOST_BRIDGE(s);
     const char *busname;
@@ -596,14 +597,14 @@ static int spapr_phb_init(SysBusDevice *s)
      * since it's unique by construction, and makes the guest visible
      * BUID clear.
      */
-    if (s->qdev.id) {
+    if (dev->id) {
         busname = NULL;
     } else if (sphb->index == 0) {
         busname = "pci";
     } else {
         busname = sphb->dtbusname;
     }
-    bus = pci_register_bus(DEVICE(s), busname,
+    bus = pci_register_bus(dev, busname,
                            pci_spapr_set_irq, pci_spapr_map_irq, sphb,
                            &sphb->memspace, &sphb->iospace,
                            PCI_DEVFN(0, 0), PCI_NUM_PINS, TYPE_PCI_BUS);
@@ -611,7 +612,7 @@ static int spapr_phb_init(SysBusDevice *s)
 
     sphb->dma_window_start = 0;
     sphb->dma_window_size = 0x40000000;
-    sphb->tcet = spapr_tce_new_table(DEVICE(sphb), sphb->dma_liobn,
+    sphb->tcet = spapr_tce_new_table(dev, sphb->dma_liobn,
                                      sphb->dma_window_size);
     if (!sphb->tcet) {
         fprintf(stderr, "Unable to create TCE table for %s\n", sphb->dtbusname);
commit f54d31575d115377ba2931abc0ff41d4a0abc5a2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:31:42 2013 +0200

    ioapic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index 5d064fe..d866e00 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -230,7 +230,7 @@ static void ioapic_init(IOAPICCommonState *s, int instance_no)
     memory_region_init_io(&s->io_memory, OBJECT(s), &ioapic_io_ops, s,
                           "ioapic", 0x1000);
 
-    qdev_init_gpio_in(&s->busdev.qdev, ioapic_set_irq, IOAPIC_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(s), ioapic_set_irq, IOAPIC_NUM_PINS);
 
     ioapics[instance_no] = s;
 }
commit b311963126a18d7f4c5390c4c094a5f015f0fca6
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:30:47 2013 +0200

    kvm/ioapic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/kvm/ioapic.c b/hw/i386/kvm/ioapic.c
index 688cb5c..f11a540 100644
--- a/hw/i386/kvm/ioapic.c
+++ b/hw/i386/kvm/ioapic.c
@@ -112,7 +112,7 @@ static void kvm_ioapic_put(IOAPICCommonState *s)
 
 static void kvm_ioapic_reset(DeviceState *dev)
 {
-    IOAPICCommonState *s = DO_UPCAST(IOAPICCommonState, busdev.qdev, dev);
+    IOAPICCommonState *s = IOAPIC_COMMON(dev);
 
     ioapic_reset_common(dev);
     kvm_ioapic_put(s);
@@ -131,7 +131,7 @@ static void kvm_ioapic_init(IOAPICCommonState *s, int instance_no)
 {
     memory_region_init_reservation(&s->io_memory, NULL, "kvm-ioapic", 0x1000);
 
-    qdev_init_gpio_in(&s->busdev.qdev, kvm_ioapic_set_irq, IOAPIC_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(s), kvm_ioapic_set_irq, IOAPIC_NUM_PINS);
 }
 
 static Property kvm_ioapic_properties[] = {
commit 253eacc2fb1f592af9de64c5a9a2157fbf8ccb0d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:27:41 2013 +0200

    kvmvapic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index a4506bc..15beb80 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -456,7 +456,7 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
 void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
                              TPRAccess access)
 {
-    VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
+    VAPICROMState *s = VAPIC(dev);
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
@@ -508,7 +508,7 @@ static void vapic_enable_tpr_reporting(bool enable)
 
 static void vapic_reset(DeviceState *dev)
 {
-    VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
+    VAPICROMState *s = VAPIC(dev);
 
     if (s->state == VAPIC_ACTIVE) {
         s->state = VAPIC_STANDBY;
commit a4dbb8bdebd9b013df06cbc27d641de659e92ab2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:59:07 2013 +0200

    mipsnet: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 61578ed..e421b86 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -19,8 +19,11 @@
 
 #define MAX_ETH_FRAME_SIZE	1514
 
+#define TYPE_MIPS_NET "mipsnet"
+#define MIPS_NET(obj) OBJECT_CHECK(MIPSnetState, (obj), TYPE_MIPS_NET)
+
 typedef struct MIPSnetState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
 
     uint32_t busy;
     uint32_t rx_count;
@@ -231,17 +234,18 @@ static const MemoryRegionOps mipsnet_ioport_ops = {
     .impl.max_access_size = 4,
 };
 
-static int mipsnet_sysbus_init(SysBusDevice *dev)
+static int mipsnet_sysbus_init(SysBusDevice *sbd)
 {
-    MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev, dev);
+    DeviceState *dev = DEVICE(sbd);
+    MIPSnetState *s = MIPS_NET(dev);
 
     memory_region_init_io(&s->io, OBJECT(dev), &mipsnet_ioport_ops, s,
                           "mipsnet-io", 36);
-    sysbus_init_mmio(dev, &s->io);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->io);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->nic = qemu_new_nic(&net_mipsnet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     return 0;
@@ -249,7 +253,7 @@ static int mipsnet_sysbus_init(SysBusDevice *dev)
 
 static void mipsnet_sysbus_reset(DeviceState *dev)
 {
-    MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev.qdev, dev);
+    MIPSnetState *s = MIPS_NET(dev);
     mipsnet_reset(s);
 }
 
@@ -272,7 +276,7 @@ static void mipsnet_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mipsnet_info = {
-    .name          = "mipsnet",
+    .name          = TYPE_MIPS_NET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MIPSnetState),
     .class_init    = mipsnet_class_init,
commit 4632cf2d5f77e702afda1e98df86ad7b0721ef70
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:56:28 2013 +0200

    opencores_eth: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index 513f345..4118d54 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -267,8 +267,12 @@ typedef struct desc {
 
 #define DEFAULT_PHY 1
 
+#define TYPE_OPEN_ETH "open_eth"
+#define OPEN_ETH(obj) OBJECT_CHECK(OpenEthState, (obj), TYPE_OPEN_ETH)
+
 typedef struct OpenEthState {
-    SysBusDevice dev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     MemoryRegion reg_io;
@@ -677,28 +681,30 @@ static const MemoryRegionOps open_eth_desc_ops = {
     .write = open_eth_desc_write,
 };
 
-static int sysbus_open_eth_init(SysBusDevice *dev)
+static int sysbus_open_eth_init(SysBusDevice *sbd)
 {
-    OpenEthState *s = DO_UPCAST(OpenEthState, dev, dev);
+    DeviceState *dev = DEVICE(sbd);
+    OpenEthState *s = OPEN_ETH(dev);
 
     memory_region_init_io(&s->reg_io, OBJECT(dev), &open_eth_reg_ops, s,
             "open_eth.regs", 0x54);
-    sysbus_init_mmio(dev, &s->reg_io);
+    sysbus_init_mmio(sbd, &s->reg_io);
 
     memory_region_init_io(&s->desc_io, OBJECT(dev), &open_eth_desc_ops, s,
             "open_eth.desc", 0x400);
-    sysbus_init_mmio(dev, &s->desc_io);
+    sysbus_init_mmio(sbd, &s->desc_io);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->nic = qemu_new_nic(&net_open_eth_info, &s->conf,
-                          object_get_typename(OBJECT(s)), s->dev.qdev.id, s);
+                          object_get_typename(OBJECT(s)), dev->id, s);
     return 0;
 }
 
 static void qdev_open_eth_reset(DeviceState *dev)
 {
-    OpenEthState *d = DO_UPCAST(OpenEthState, dev.qdev, dev);
+    OpenEthState *d = OPEN_ETH(dev);
+
     open_eth_reset(d);
 }
 
@@ -720,7 +726,7 @@ static void open_eth_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo open_eth_info = {
-    .name          = "open_eth",
+    .name          = TYPE_OPEN_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OpenEthState),
     .class_init    = open_eth_class_init,
commit 436033290065be765363ad73f9437821e0c35084
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:50:02 2013 +0200

    exynos4210_i2c: QOM cast cleanup
    
    Fix one ->qdev access and rename parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/exynos4210_i2c.c b/hw/i2c/exynos4210_i2c.c
index 42f5e89..ce5f849 100644
--- a/hw/i2c/exynos4210_i2c.c
+++ b/hw/i2c/exynos4210_i2c.c
@@ -80,7 +80,8 @@ static const char *exynos4_i2c_get_regname(unsigned offset)
 #endif
 
 typedef struct Exynos4210I2CState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     i2c_bus *bus;
     qemu_irq irq;
@@ -297,15 +298,16 @@ static void exynos4210_i2c_reset(DeviceState *d)
     s->scl_free = true;
 }
 
-static int exynos4210_i2c_realize(SysBusDevice *dev)
+static int exynos4210_i2c_realize(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
     Exynos4210I2CState *s = EXYNOS4_I2C(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_i2c_ops, s,
                           TYPE_EXYNOS4_I2C, EXYNOS4_I2C_MEM_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->bus = i2c_init_bus(&dev->qdev, "i2c");
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->bus = i2c_init_bus(dev, "i2c");
     return 0;
 }
 
commit 339104fe3430d19bd1932077bae839cdcc9f7cd2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:45:51 2013 +0200

    sysbus: Remove unused sysbus_new() prototype
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index fbfc066..f1d1c5e 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -55,7 +55,6 @@ struct SysBusDevice {
     pio_addr_t pio[QDEV_MAX_PIO];
 };
 
-void *sysbus_new(void);
 void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory);
 MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n);
 void sysbus_init_irq(SysBusDevice *dev, qemu_irq *p);
commit f3d74d32e7285af2c7a289c02b948f8feccd95e1
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:39:20 2013 +0200

    sysbus: Drop FROM_SYSBUS()
    
    As a replacement, use your own macro based on OBJECT_CHECK().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 8c17165..fbfc066 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -55,9 +55,6 @@ struct SysBusDevice {
     pio_addr_t pio[QDEV_MAX_PIO];
 };
 
-/* Macros to compensate for lack of type inheritance in C.  */
-#define FROM_SYSBUS(type, dev) DO_UPCAST(type, busdev, dev)
-
 void *sysbus_new(void);
 void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory);
 MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n);
commit 760d1d00b8148887003b0632da82dabab57d71f5
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:32:47 2013 +0200

    xilinx_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index ee53834..5f2c902 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -57,9 +57,14 @@ struct xlx_timer
     uint32_t regs[R_MAX];
 };
 
+#define TYPE_XILINX_TIMER "xlnx.xps-timer"
+#define XILINX_TIMER(obj) \
+    OBJECT_CHECK(struct timerblock, (obj), TYPE_XILINX_TIMER)
+
 struct timerblock
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     uint8_t one_timer_only;
@@ -200,7 +205,7 @@ static void timer_hit(void *opaque)
 
 static int xilinx_timer_init(SysBusDevice *dev)
 {
-    struct timerblock *t = FROM_SYSBUS(typeof (*t), dev);
+    struct timerblock *t = XILINX_TIMER(dev);
     unsigned int i;
 
     /* All timers share a single irq line.  */
@@ -241,7 +246,7 @@ static void xilinx_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_timer_info = {
-    .name          = "xlnx.xps-timer",
+    .name          = TYPE_XILINX_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct timerblock),
     .class_init    = xilinx_timer_class_init,
commit 453be7a6fc21c5794e335d937c63bc9d49b1fe1a
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:30:21 2013 +0200

    tusb6010: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/tusb6010.c b/hw/timer/tusb6010.c
index 47b6809..c48ecf8 100644
--- a/hw/timer/tusb6010.c
+++ b/hw/timer/tusb6010.c
@@ -26,8 +26,12 @@
 #include "hw/devices.h"
 #include "hw/sysbus.h"
 
+#define TYPE_TUSB6010 "tusb6010"
+#define TUSB(obj) OBJECT_CHECK(TUSBState, (obj), TYPE_TUSB6010)
+
 typedef struct TUSBState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem[2];
     qemu_irq irq;
     MUSBState *musb;
@@ -740,7 +744,7 @@ static void tusb6010_irq(void *opaque, int source, int level)
 
 static void tusb6010_reset(DeviceState *dev)
 {
-    TUSBState *s = FROM_SYSBUS(TUSBState, SYS_BUS_DEVICE(dev));
+    TUSBState *s = TUSB(dev);
     int i;
 
     s->test_reset = TUSB_PROD_TEST_RESET_VAL;
@@ -774,18 +778,20 @@ static void tusb6010_reset(DeviceState *dev)
     musb_reset(s->musb);
 }
 
-static int tusb6010_init(SysBusDevice *dev)
+static int tusb6010_init(SysBusDevice *sbd)
 {
-    TUSBState *s = FROM_SYSBUS(TUSBState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    TUSBState *s = TUSB(dev);
+
     s->otg_timer = qemu_new_timer_ns(vm_clock, tusb_otg_tick, s);
     s->pwr_timer = qemu_new_timer_ns(vm_clock, tusb_power_tick, s);
     memory_region_init_io(&s->iomem[1], OBJECT(s), &tusb_async_ops, s,
                           "tusb-async", UINT32_MAX);
-    sysbus_init_mmio(dev, &s->iomem[0]);
-    sysbus_init_mmio(dev, &s->iomem[1]);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&dev->qdev, tusb6010_irq, musb_irq_max + 1);
-    s->musb = musb_init(&dev->qdev, 1);
+    sysbus_init_mmio(sbd, &s->iomem[0]);
+    sysbus_init_mmio(sbd, &s->iomem[1]);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, tusb6010_irq, musb_irq_max + 1);
+    s->musb = musb_init(dev, 1);
     return 0;
 }
 
@@ -799,7 +805,7 @@ static void tusb6010_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo tusb6010_info = {
-    .name          = "tusb6010",
+    .name          = TYPE_TUSB6010,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(TUSBState),
     .class_init    = tusb6010_class_init,
commit c275471eb1beb0461cfbbb5d96b9d3bcff451c77
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:24:22 2013 +0200

    slavio_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index 7f844d7..33e8f6c 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -54,8 +54,13 @@ typedef struct CPUTimerState {
     uint64_t limit;
 } CPUTimerState;
 
+#define TYPE_SLAVIO_TIMER "slavio_timer"
+#define SLAVIO_TIMER(obj) \
+    OBJECT_CHECK(SLAVIO_TIMERState, (obj), TYPE_SLAVIO_TIMER)
+
 typedef struct SLAVIO_TIMERState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t num_cpus;
     uint32_t cputimer_mode;
     CPUTimerState cputimer[MAX_CPUS + 1];
@@ -354,7 +359,7 @@ static const VMStateDescription vmstate_slavio_timer = {
 
 static void slavio_timer_reset(DeviceState *d)
 {
-    SLAVIO_TIMERState *s = container_of(d, SLAVIO_TIMERState, busdev.qdev);
+    SLAVIO_TIMERState *s = SLAVIO_TIMER(d);
     unsigned int i;
     CPUTimerState *curr_timer;
 
@@ -375,7 +380,7 @@ static void slavio_timer_reset(DeviceState *d)
 
 static int slavio_timer_init1(SysBusDevice *dev)
 {
-    SLAVIO_TIMERState *s = FROM_SYSBUS(SLAVIO_TIMERState, dev);
+    SLAVIO_TIMERState *s = SLAVIO_TIMER(dev);
     QEMUBH *bh;
     unsigned int i;
     TimerContext *tc;
@@ -421,7 +426,7 @@ static void slavio_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo slavio_timer_info = {
-    .name          = "slavio_timer",
+    .name          = TYPE_SLAVIO_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLAVIO_TIMERState),
     .class_init    = slavio_timer_class_init,
commit feea4361b3d29cc7e7374db33df9ab18348cf230
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:20:20 2013 +0200

    pxa2xx_timer: QOM'ify pxa25x-timer and pxa27x-timer
    
    Introduce type constant for new abstract base type, use QOM casts and
    let both non-abstract types inherit from the new base type.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index 4d28719..cdabccd 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -60,6 +60,10 @@ static int pxa2xx_timer4_freq[8] = {
     [5 ... 7] = 0,
 };
 
+#define TYPE_PXA2XX_TIMER "pxa2xx-timer"
+#define PXA2XX_TIMER(obj) \
+    OBJECT_CHECK(PXA2xxTimerInfo, (obj), TYPE_PXA2XX_TIMER)
+
 typedef struct PXA2xxTimerInfo PXA2xxTimerInfo;
 
 typedef struct {
@@ -80,7 +84,8 @@ typedef struct {
 } PXA2xxTimer4;
 
 struct PXA2xxTimerInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t flags;
 
@@ -429,10 +434,9 @@ static int pxa25x_timer_post_load(void *opaque, int version_id)
 
 static int pxa2xx_timer_init(SysBusDevice *dev)
 {
+    PXA2xxTimerInfo *s = PXA2XX_TIMER(dev);
     int i;
-    PXA2xxTimerInfo *s;
 
-    s = FROM_SYSBUS(PXA2xxTimerInfo, dev);
     s->irq_enabled = 0;
     s->oldclock = 0;
     s->clock = 0;
@@ -527,24 +531,21 @@ static const VMStateDescription vmstate_pxa2xx_timer_regs = {
 static Property pxa25x_timer_dev_properties[] = {
     DEFINE_PROP_UINT32("freq", PXA2xxTimerInfo, freq, PXA25X_FREQ),
     DEFINE_PROP_BIT("tm4", PXA2xxTimerInfo, flags,
-    PXA2XX_TIMER_HAVE_TM4, false),
+                    PXA2XX_TIMER_HAVE_TM4, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 
 static void pxa25x_timer_dev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pxa2xx_timer_init;
     dc->desc = "PXA25x timer";
-    dc->vmsd = &vmstate_pxa2xx_timer_regs;
     dc->props = pxa25x_timer_dev_properties;
 }
 
 static const TypeInfo pxa25x_timer_dev_info = {
     .name          = "pxa25x-timer",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_PXA2XX_TIMER,
     .instance_size = sizeof(PXA2xxTimerInfo),
     .class_init    = pxa25x_timer_dev_class_init,
 };
@@ -552,30 +553,45 @@ static const TypeInfo pxa25x_timer_dev_info = {
 static Property pxa27x_timer_dev_properties[] = {
     DEFINE_PROP_UINT32("freq", PXA2xxTimerInfo, freq, PXA27X_FREQ),
     DEFINE_PROP_BIT("tm4", PXA2xxTimerInfo, flags,
-    PXA2XX_TIMER_HAVE_TM4, true),
+                    PXA2XX_TIMER_HAVE_TM4, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
 static void pxa27x_timer_dev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pxa2xx_timer_init;
     dc->desc = "PXA27x timer";
-    dc->vmsd = &vmstate_pxa2xx_timer_regs;
     dc->props = pxa27x_timer_dev_properties;
 }
 
 static const TypeInfo pxa27x_timer_dev_info = {
     .name          = "pxa27x-timer",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_PXA2XX_TIMER,
     .instance_size = sizeof(PXA2xxTimerInfo),
     .class_init    = pxa27x_timer_dev_class_init,
 };
 
+static void pxa2xx_timer_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(oc);
+
+    sdc->init = pxa2xx_timer_init;
+    dc->vmsd = &vmstate_pxa2xx_timer_regs;
+}
+
+static const TypeInfo pxa2xx_timer_type_info = {
+    .name          = TYPE_PXA2XX_TIMER,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(PXA2xxTimerInfo),
+    .abstract      = true,
+    .class_init    = pxa2xx_timer_class_init,
+};
+
 static void pxa2xx_timer_register_types(void)
 {
+    type_register_static(&pxa2xx_timer_type_info);
     type_register_static(&pxa25x_timer_dev_info);
     type_register_static(&pxa27x_timer_dev_info);
 }
commit 9c9610b825bdf73d3323dfb5aa0cb789f2c665e8
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:12:40 2013 +0200

    puv3_ost: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
index 63f2c9f..4bd2b76 100644
--- a/hw/timer/puv3_ost.c
+++ b/hw/timer/puv3_ost.c
@@ -14,9 +14,13 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
+#define TYPE_PUV3_OST "puv3_ost"
+#define PUV3_OST(obj) OBJECT_CHECK(PUV3OSTState, (obj), TYPE_PUV3_OST)
+
 /* puv3 ostimer implementation. */
-typedef struct {
-    SysBusDevice busdev;
+typedef struct PUV3OSTState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QEMUBH *bh;
     qemu_irq irq;
@@ -109,7 +113,7 @@ static void puv3_ost_tick(void *opaque)
 
 static int puv3_ost_init(SysBusDevice *dev)
 {
-    PUV3OSTState *s = FROM_SYSBUS(PUV3OSTState, dev);
+    PUV3OSTState *s = PUV3_OST(dev);
 
     s->reg_OIER = 0;
     s->reg_OSSR = 0;
@@ -137,7 +141,7 @@ static void puv3_ost_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_ost_info = {
-    .name = "puv3_ost",
+    .name = TYPE_PUV3_OST,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3OSTState),
     .class_init = puv3_ost_class_init,
commit d3b800495ec886d45a0be7aa6eb4e1de7533968f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:10:14 2013 +0200

    pl031: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index e705a69..d5e2f3e 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -33,8 +33,12 @@ do { printf("pl031: " fmt , ## __VA_ARGS__); } while (0)
 #define RTC_MIS     0x18    /* Masked interrupt status register */
 #define RTC_ICR     0x1c    /* Interrupt clear register */
 
+#define TYPE_PL031 "pl031"
+#define PL031(obj) OBJECT_CHECK(PL031State, (obj), TYPE_PL031)
+
 typedef struct PL031State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QEMUTimer *timer;
     qemu_irq irq;
@@ -189,7 +193,7 @@ static const MemoryRegionOps pl031_ops = {
 
 static int pl031_init(SysBusDevice *dev)
 {
-    PL031State *s = FROM_SYSBUS(PL031State, dev);
+    PL031State *s = PL031(dev);
     struct tm tm;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl031_ops, s, "pl031", 0x1000);
@@ -251,7 +255,7 @@ static void pl031_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl031_info = {
-    .name          = "pl031",
+    .name          = TYPE_PL031,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL031State),
     .class_init    = pl031_class_init,
commit b91f0dfd12dbd117235409980e77523fba5f8978
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:07:44 2013 +0200

    pl031: Rename pl031_state to PL031State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index 3ce6ed8..e705a69 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -33,7 +33,7 @@ do { printf("pl031: " fmt , ## __VA_ARGS__); } while (0)
 #define RTC_MIS     0x18    /* Masked interrupt status register */
 #define RTC_ICR     0x1c    /* Interrupt clear register */
 
-typedef struct {
+typedef struct PL031State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     QEMUTimer *timer;
@@ -51,34 +51,34 @@ typedef struct {
     uint32_t cr;
     uint32_t im;
     uint32_t is;
-} pl031_state;
+} PL031State;
 
 static const unsigned char pl031_id[] = {
     0x31, 0x10, 0x14, 0x00,         /* Device ID        */
     0x0d, 0xf0, 0x05, 0xb1          /* Cell ID      */
 };
 
-static void pl031_update(pl031_state *s)
+static void pl031_update(PL031State *s)
 {
     qemu_set_irq(s->irq, s->is & s->im);
 }
 
 static void pl031_interrupt(void * opaque)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
     s->is = 1;
     DPRINTF("Alarm raised\n");
     pl031_update(s);
 }
 
-static uint32_t pl031_get_count(pl031_state *s)
+static uint32_t pl031_get_count(PL031State *s)
 {
     int64_t now = qemu_get_clock_ns(rtc_clock);
     return s->tick_offset + now / get_ticks_per_sec();
 }
 
-static void pl031_set_alarm(pl031_state *s)
+static void pl031_set_alarm(PL031State *s)
 {
     uint32_t ticks;
 
@@ -98,7 +98,7 @@ static void pl031_set_alarm(pl031_state *s)
 static uint64_t pl031_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
     if (offset >= 0xfe0  &&  offset < 0x1000)
         return pl031_id[(offset - 0xfe0) >> 2];
@@ -136,7 +136,7 @@ static uint64_t pl031_read(void *opaque, hwaddr offset,
 static void pl031_write(void * opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
 
     switch (offset) {
@@ -189,7 +189,7 @@ static const MemoryRegionOps pl031_ops = {
 
 static int pl031_init(SysBusDevice *dev)
 {
-    pl031_state *s = FROM_SYSBUS(pl031_state, dev);
+    PL031State *s = FROM_SYSBUS(PL031State, dev);
     struct tm tm;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl031_ops, s, "pl031", 0x1000);
@@ -205,7 +205,7 @@ static int pl031_init(SysBusDevice *dev)
 
 static void pl031_pre_save(void *opaque)
 {
-    pl031_state *s = opaque;
+    PL031State *s = opaque;
 
     /* tick_offset is base_time - rtc_clock base time.  Instead, we want to
      * store the base time relative to the vm_clock for backwards-compatibility.  */
@@ -215,7 +215,7 @@ static void pl031_pre_save(void *opaque)
 
 static int pl031_post_load(void *opaque, int version_id)
 {
-    pl031_state *s = opaque;
+    PL031State *s = opaque;
 
     int64_t delta = qemu_get_clock_ns(rtc_clock) - qemu_get_clock_ns(vm_clock);
     s->tick_offset = s->tick_offset_vmstate - delta / get_ticks_per_sec();
@@ -230,12 +230,12 @@ static const VMStateDescription vmstate_pl031 = {
     .pre_save = pl031_pre_save,
     .post_load = pl031_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(tick_offset_vmstate, pl031_state),
-        VMSTATE_UINT32(mr, pl031_state),
-        VMSTATE_UINT32(lr, pl031_state),
-        VMSTATE_UINT32(cr, pl031_state),
-        VMSTATE_UINT32(im, pl031_state),
-        VMSTATE_UINT32(is, pl031_state),
+        VMSTATE_UINT32(tick_offset_vmstate, PL031State),
+        VMSTATE_UINT32(mr, PL031State),
+        VMSTATE_UINT32(lr, PL031State),
+        VMSTATE_UINT32(cr, PL031State),
+        VMSTATE_UINT32(im, PL031State),
+        VMSTATE_UINT32(is, PL031State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -253,7 +253,7 @@ static void pl031_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl031_info = {
     .name          = "pl031",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl031_state),
+    .instance_size = sizeof(PL031State),
     .class_init    = pl031_class_init,
 };
 
commit b564b137b92c5356ffe3c308defa9d0d324272d9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:06:42 2013 +0200

    milkymist-sysctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
index 5009394..94246e5 100644
--- a/hw/timer/milkymist-sysctl.c
+++ b/hw/timer/milkymist-sysctl.c
@@ -57,8 +57,13 @@ enum {
     R_MAX
 };
 
+#define TYPE_MILKYMIST_SYSCTL "milkymist-sysctl"
+#define MILKYMIST_SYSCTL(obj) \
+    OBJECT_CHECK(MilkymistSysctlState, (obj), TYPE_MILKYMIST_SYSCTL)
+
 struct MilkymistSysctlState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     QEMUBH *bh0;
@@ -246,8 +251,7 @@ static void timer1_hit(void *opaque)
 
 static void milkymist_sysctl_reset(DeviceState *d)
 {
-    MilkymistSysctlState *s =
-            container_of(d, MilkymistSysctlState, busdev.qdev);
+    MilkymistSysctlState *s = MILKYMIST_SYSCTL(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -267,7 +271,7 @@ static void milkymist_sysctl_reset(DeviceState *d)
 
 static int milkymist_sysctl_init(SysBusDevice *dev)
 {
-    MilkymistSysctlState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistSysctlState *s = MILKYMIST_SYSCTL(dev);
 
     sysbus_init_irq(dev, &s->gpio_irq);
     sysbus_init_irq(dev, &s->timer0_irq);
@@ -324,7 +328,7 @@ static void milkymist_sysctl_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_sysctl_info = {
-    .name          = "milkymist-sysctl",
+    .name          = TYPE_MILKYMIST_SYSCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistSysctlState),
     .class_init    = milkymist_sysctl_class_init,
commit 29d1ffc3d8ccbc72dfe1e136a69235901d328d86
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:01:49 2013 +0200

    m48t59: QOM cast cleanup for M48t59SysBusState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c
index be3490b..0cc9e5b 100644
--- a/hw/timer/m48t59.c
+++ b/hw/timer/m48t59.c
@@ -83,8 +83,12 @@ typedef struct M48t59ISAState {
     MemoryRegion io;
 } M48t59ISAState;
 
+#define SYSBUS_M48T59(obj) \
+    OBJECT_CHECK(M48t59SysBusState, (obj), TYPE_SYSBUS_M48T59)
+
 typedef struct M48t59SysBusState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     M48t59State state;
     MemoryRegion io;
 } M48t59SysBusState;
@@ -621,7 +625,7 @@ static void m48t59_reset_isa(DeviceState *d)
 
 static void m48t59_reset_sysbus(DeviceState *d)
 {
-    M48t59SysBusState *sys = container_of(d, M48t59SysBusState, busdev.qdev);
+    M48t59SysBusState *sys = SYSBUS_M48T59(d);
     M48t59State *NVRAM = &sys->state;
 
     m48t59_reset_common(NVRAM);
@@ -646,13 +650,13 @@ M48t59State *m48t59_init(qemu_irq IRQ, hwaddr mem_base,
     M48t59SysBusState *d;
     M48t59State *state;
 
-    dev = qdev_create(NULL, "m48t59");
+    dev = qdev_create(NULL, TYPE_SYSBUS_M48T59);
     qdev_prop_set_uint32(dev, "model", model);
     qdev_prop_set_uint32(dev, "size", size);
     qdev_prop_set_uint32(dev, "io_base", io_base);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
-    d = FROM_SYSBUS(M48t59SysBusState, s);
+    d = SYSBUS_M48T59(dev);
     state = &d->state;
     sysbus_connect_irq(s, 0, IRQ);
     memory_region_init_io(&d->io, OBJECT(d), &m48t59_io_ops, state,
@@ -716,7 +720,7 @@ static void m48t59_isa_realize(DeviceState *dev, Error **errp)
 
 static int m48t59_init1(SysBusDevice *dev)
 {
-    M48t59SysBusState *d = FROM_SYSBUS(M48t59SysBusState, dev);
+    M48t59SysBusState *d = SYSBUS_M48T59(dev);
     M48t59State *s = &d->state;
     Error *err = NULL;
 
@@ -776,7 +780,7 @@ static void m48t59_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo m48t59_info = {
-    .name          = "m48t59",
+    .name          = TYPE_SYSBUS_M48T59,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(M48t59SysBusState),
     .class_init    = m48t59_class_init,
diff --git a/include/hw/timer/m48t59.h b/include/hw/timer/m48t59.h
index 59337fa..8217522 100644
--- a/include/hw/timer/m48t59.h
+++ b/include/hw/timer/m48t59.h
@@ -21,6 +21,9 @@ int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
                           uint32_t initrd_image, uint32_t initrd_size,
                           uint32_t NVRAM_image,
                           int width, int height, int depth);
+
+#define TYPE_SYSBUS_M48T59 "m48t59"
+
 typedef struct M48t59State M48t59State;
 
 void m48t59_write (void *private, uint32_t addr, uint32_t val);
commit fe54d857056b3cf143fe5aebcf56b7c638d62bc0
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:54:54 2013 +0200

    lm32_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
index 016dade..986e6a1 100644
--- a/hw/timer/lm32_timer.c
+++ b/hw/timer/lm32_timer.c
@@ -50,8 +50,12 @@ enum {
     CR_STOP  = (1 << 3),
 };
 
+#define TYPE_LM32_TIMER "lm32-timer"
+#define LM32_TIMER(obj) OBJECT_CHECK(LM32TimerState, (obj), TYPE_LM32_TIMER)
+
 struct LM32TimerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     QEMUBH *bh;
@@ -161,7 +165,7 @@ static void timer_hit(void *opaque)
 
 static void timer_reset(DeviceState *d)
 {
-    LM32TimerState *s = container_of(d, LM32TimerState, busdev.qdev);
+    LM32TimerState *s = LM32_TIMER(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -172,7 +176,7 @@ static void timer_reset(DeviceState *d)
 
 static int lm32_timer_init(SysBusDevice *dev)
 {
-    LM32TimerState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32TimerState *s = LM32_TIMER(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -217,7 +221,7 @@ static void lm32_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_timer_info = {
-    .name          = "lm32-timer",
+    .name          = TYPE_LM32_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32TimerState),
     .class_init    = lm32_timer_class_init,
commit 541ab55ff1bdc558473f0dea40deae568551bb85
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:52:32 2013 +0200

    grlib_gptimer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index 37ba47d..7c1055a 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -50,6 +50,10 @@
 #define COUNTER_RELOAD_OFFSET 0x04
 #define TIMER_BASE            0x10
 
+#define TYPE_GRLIB_GPTIMER "grlib,gptimer"
+#define GRLIB_GPTIMER(obj) \
+    OBJECT_CHECK(GPTimerUnit, (obj), TYPE_GRLIB_GPTIMER)
+
 typedef struct GPTimer     GPTimer;
 typedef struct GPTimerUnit GPTimerUnit;
 
@@ -68,7 +72,8 @@ struct GPTimer {
 };
 
 struct GPTimerUnit {
-    SysBusDevice  busdev;
+    SysBusDevice  parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t nr_timers;         /* Number of timers available */
@@ -314,7 +319,7 @@ static const MemoryRegionOps grlib_gptimer_ops = {
 
 static void grlib_gptimer_reset(DeviceState *d)
 {
-    GPTimerUnit *unit = container_of(d, GPTimerUnit, busdev.qdev);
+    GPTimerUnit *unit = GRLIB_GPTIMER(d);
     int          i    = 0;
 
     assert(unit != NULL);
@@ -343,7 +348,7 @@ static void grlib_gptimer_reset(DeviceState *d)
 
 static int grlib_gptimer_init(SysBusDevice *dev)
 {
-    GPTimerUnit  *unit = FROM_SYSBUS(typeof(*unit), dev);
+    GPTimerUnit  *unit = GRLIB_GPTIMER(dev);
     unsigned int  i;
 
     assert(unit->nr_timers > 0);
@@ -391,7 +396,7 @@ static void grlib_gptimer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo grlib_gptimer_info = {
-    .name          = "grlib,gptimer",
+    .name          = TYPE_GRLIB_GPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GPTimerUnit),
     .class_init    = grlib_gptimer_class_init,
commit 3ddacf27057678f483bbed78db2f10419acb6501
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:49:12 2013 +0200

    exynos4210_rtc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index 7fca071..3f2c8c5 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -79,8 +79,13 @@
 
 #define     RTC_BASE_FREQ       32768
 
+#define TYPE_EXYNOS4210_RTC "exynos4210.rtc"
+#define EXYNOS4210_RTC(obj) \
+    OBJECT_CHECK(Exynos4210RTCState, (obj), TYPE_EXYNOS4210_RTC)
+
 typedef struct Exynos4210RTCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     /* registers */
@@ -507,7 +512,7 @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
  */
 static void exynos4210_rtc_reset(DeviceState *d)
 {
-    Exynos4210RTCState *s = (Exynos4210RTCState *)d;
+    Exynos4210RTCState *s = EXYNOS4210_RTC(d);
 
     qemu_get_timedate(&s->current_tm, 0);
 
@@ -544,7 +549,7 @@ static const MemoryRegionOps exynos4210_rtc_ops = {
  */
 static int exynos4210_rtc_init(SysBusDevice *dev)
 {
-    Exynos4210RTCState *s = FROM_SYSBUS(Exynos4210RTCState, dev);
+    Exynos4210RTCState *s = EXYNOS4210_RTC(dev);
     QEMUBH *bh;
 
     bh = qemu_bh_new(exynos4210_rtc_tick, s);
@@ -577,7 +582,7 @@ static void exynos4210_rtc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_rtc_info = {
-    .name          = "exynos4210.rtc",
+    .name          = TYPE_EXYNOS4210_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210RTCState),
     .class_init    = exynos4210_rtc_class_init,
commit 25fce9ad7f7b77d610504e70b03e29630d66dfa9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:45:47 2013 +0200

    exynos4210_pwm: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index 8fa0bb2..a52f0f6 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -97,9 +97,13 @@ typedef struct {
 
 } Exynos4210PWM;
 
+#define TYPE_EXYNOS4210_PWM "exynos4210.pwm"
+#define EXYNOS4210_PWM(obj) \
+    OBJECT_CHECK(Exynos4210PWMState, (obj), TYPE_EXYNOS4210_PWM)
 
 typedef struct Exynos4210PWMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t    reg_tcfg[2];
@@ -352,7 +356,7 @@ static void exynos4210_pwm_write(void *opaque, hwaddr offset,
  */
 static void exynos4210_pwm_reset(DeviceState *d)
 {
-    Exynos4210PWMState *s = (Exynos4210PWMState *)d;
+    Exynos4210PWMState *s = EXYNOS4210_PWM(d);
     int i;
     s->reg_tcfg[0] = 0x0101;
     s->reg_tcfg[1] = 0x0;
@@ -378,7 +382,7 @@ static const MemoryRegionOps exynos4210_pwm_ops = {
  */
 static int exynos4210_pwm_init(SysBusDevice *dev)
 {
-    Exynos4210PWMState *s = FROM_SYSBUS(Exynos4210PWMState, dev);
+    Exynos4210PWMState *s = EXYNOS4210_PWM(dev);
     int i;
     QEMUBH *bh;
 
@@ -408,7 +412,7 @@ static void exynos4210_pwm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_pwm_info = {
-    .name          = "exynos4210.pwm",
+    .name          = TYPE_EXYNOS4210_PWM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210PWMState),
     .class_init    = exynos4210_pwm_class_init,
commit 81e1010d0fbfaa5992cffa88e1797af36cc438ef
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:41:50 2013 +0200

    exynos4210_mct: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index 28ebe5d..a8009a4 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -240,8 +240,13 @@ typedef struct {
 
 } Exynos4210MCTLT;
 
+#define TYPE_EXYNOS4210_MCT "exynos4210.mct"
+#define EXYNOS4210_MCT(obj) \
+    OBJECT_CHECK(Exynos4210MCTState, (obj), TYPE_EXYNOS4210_MCT)
+
 typedef struct Exynos4210MCTState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     /* Registers */
@@ -955,7 +960,7 @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
 /* set defaul_timer values for all fields */
 static void exynos4210_mct_reset(DeviceState *d)
 {
-    Exynos4210MCTState *s = (Exynos4210MCTState *)d;
+    Exynos4210MCTState *s = EXYNOS4210_MCT(d);
     uint32_t i;
 
     s->reg_mct_cfg = 0;
@@ -1424,7 +1429,7 @@ static const MemoryRegionOps exynos4210_mct_ops = {
 static int exynos4210_mct_init(SysBusDevice *dev)
 {
     int i;
-    Exynos4210MCTState *s = FROM_SYSBUS(Exynos4210MCTState, dev);
+    Exynos4210MCTState *s = EXYNOS4210_MCT(dev);
     QEMUBH *bh[2];
 
     /* Global timer */
@@ -1467,7 +1472,7 @@ static void exynos4210_mct_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_mct_info = {
-    .name          = "exynos4210.mct",
+    .name          = TYPE_EXYNOS4210_MCT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210MCTState),
     .class_init    = exynos4210_mct_class_init,
commit 5880ce52eb5560763b378dde83b2144fe41024eb
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:34:22 2013 +0200

    etraxfs_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index 7e9807d..a38d9e4 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -42,8 +42,13 @@
 #define R_INTR        0x50
 #define R_MASKED_INTR 0x54
 
+#define TYPE_ETRAX_FS_TIMER "etraxfs,timer"
+#define ETRAX_TIMER(obj) \
+    OBJECT_CHECK(ETRAXTimerState, (obj), TYPE_ETRAX_FS_TIMER)
+
 typedef struct ETRAXTimerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     qemu_irq nmi;
@@ -311,7 +316,7 @@ static void etraxfs_timer_reset(void *opaque)
 
 static int etraxfs_timer_init(SysBusDevice *dev)
 {
-    ETRAXTimerState *t = FROM_SYSBUS(typeof (*t), dev);
+    ETRAXTimerState *t = ETRAX_TIMER(dev);
 
     t->bh_t0 = qemu_bh_new(timer0_hit, t);
     t->bh_t1 = qemu_bh_new(timer1_hit, t);
@@ -338,7 +343,7 @@ static void etraxfs_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_timer_info = {
-    .name          = "etraxfs,timer",
+    .name          = TYPE_ETRAX_FS_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ETRAXTimerState),
     .class_init    = etraxfs_timer_class_init,
commit 3c9a8a8c8e7b045e9f1b23ff98d54d7df9a10229
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:30:31 2013 +0200

    etraxfs_timer: Rename etrax_timer to ETRAXTimerState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index 6dd1072..7e9807d 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -42,7 +42,7 @@
 #define R_INTR        0x50
 #define R_MASKED_INTR 0x54
 
-struct etrax_timer {
+typedef struct ETRAXTimerState {
     SysBusDevice busdev;
     MemoryRegion mmio;
     qemu_irq irq;
@@ -72,12 +72,12 @@ struct etrax_timer {
     uint32_t rw_ack_intr;
     uint32_t r_intr;
     uint32_t r_masked_intr;
-};
+} ETRAXTimerState;
 
 static uint64_t
 timer_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     uint32_t r = 0;
 
     switch (addr) {
@@ -103,7 +103,7 @@ timer_read(void *opaque, hwaddr addr, unsigned int size)
     return r;
 }
 
-static void update_ctrl(struct etrax_timer *t, int tnum)
+static void update_ctrl(ETRAXTimerState *t, int tnum)
 {
     unsigned int op;
     unsigned int freq;
@@ -167,7 +167,7 @@ static void update_ctrl(struct etrax_timer *t, int tnum)
     }
 }
 
-static void timer_update_irq(struct etrax_timer *t)
+static void timer_update_irq(ETRAXTimerState *t)
 {
     t->r_intr &= ~(t->rw_ack_intr);
     t->r_masked_intr = t->r_intr & t->rw_intr_mask;
@@ -178,21 +178,21 @@ static void timer_update_irq(struct etrax_timer *t)
 
 static void timer0_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     t->r_intr |= 1;
     timer_update_irq(t);
 }
 
 static void timer1_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     t->r_intr |= 2;
     timer_update_irq(t);
 }
 
 static void watchdog_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     if (t->wd_hits == 0) {
         /* real hw gives a single tick before reseting but we are
            a bit friendlier to compensate for our slower execution.  */
@@ -206,7 +206,7 @@ static void watchdog_hit(void *opaque)
     t->wd_hits++;
 }
 
-static inline void timer_watchdog_update(struct etrax_timer *t, uint32_t value)
+static inline void timer_watchdog_update(ETRAXTimerState *t, uint32_t value)
 {
     unsigned int wd_en = t->rw_wd_ctrl & (1 << 8);
     unsigned int wd_key = t->rw_wd_ctrl >> 9;
@@ -245,7 +245,7 @@ static void
 timer_write(void *opaque, hwaddr addr,
             uint64_t val64, unsigned int size)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     uint32_t value = val64;
 
     switch (addr)
@@ -298,7 +298,7 @@ static const MemoryRegionOps timer_ops = {
 
 static void etraxfs_timer_reset(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
 
     ptimer_stop(t->ptimer_t0);
     ptimer_stop(t->ptimer_t1);
@@ -311,7 +311,7 @@ static void etraxfs_timer_reset(void *opaque)
 
 static int etraxfs_timer_init(SysBusDevice *dev)
 {
-    struct etrax_timer *t = FROM_SYSBUS(typeof (*t), dev);
+    ETRAXTimerState *t = FROM_SYSBUS(typeof (*t), dev);
 
     t->bh_t0 = qemu_bh_new(timer0_hit, t);
     t->bh_t1 = qemu_bh_new(timer1_hit, t);
@@ -340,7 +340,7 @@ static void etraxfs_timer_class_init(ObjectClass *klass, void *data)
 static const TypeInfo etraxfs_timer_info = {
     .name          = "etraxfs,timer",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof (struct etrax_timer),
+    .instance_size = sizeof(ETRAXTimerState),
     .class_init    = etraxfs_timer_class_init,
 };
 
commit 831aab9b0bb3953161cdbe07a5e475723874321f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:28:31 2013 +0200

    cadence_ttc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index a861049..888f9ce 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -64,8 +64,13 @@ typedef struct {
     qemu_irq irq;
 } CadenceTimerState;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_CADENCE_TTC "cadence_ttc"
+#define CADENCE_TTC(obj) \
+    OBJECT_CHECK(CadenceTTCState, (obj), TYPE_CADENCE_TTC)
+
+typedef struct CadenceTTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CadenceTimerState timer[3];
 } CadenceTTCState;
@@ -401,7 +406,7 @@ static void cadence_timer_init(uint32_t freq, CadenceTimerState *s)
 
 static int cadence_ttc_init(SysBusDevice *dev)
 {
-    CadenceTTCState *s = FROM_SYSBUS(CadenceTTCState, dev);
+    CadenceTTCState *s = CADENCE_TTC(dev);
     int i;
 
     for (i = 0; i < 3; ++i) {
@@ -476,7 +481,7 @@ static void cadence_ttc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo cadence_ttc_info = {
-    .name  = "cadence_ttc",
+    .name  = TYPE_CADENCE_TTC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(CadenceTTCState),
     .class_init = cadence_ttc_class_init,
commit e2051b42430b014ab6bdcfeabdd869b28282c3a2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:20:25 2013 +0200

    arm_timer: QOM cast cleanup for icp_pit_state
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 8d95743..acfea59 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -298,8 +298,13 @@ static int sp804_init(SysBusDevice *sbd)
 
 /* Integrator/CP timer module.  */
 
+#define TYPE_INTEGRATOR_PIT "integrator_pit"
+#define INTEGRATOR_PIT(obj) \
+    OBJECT_CHECK(icp_pit_state, (obj), TYPE_INTEGRATOR_PIT)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     arm_timer_state *timer[3];
 } icp_pit_state;
@@ -341,7 +346,7 @@ static const MemoryRegionOps icp_pit_ops = {
 
 static int icp_pit_init(SysBusDevice *dev)
 {
-    icp_pit_state *s = FROM_SYSBUS(icp_pit_state, dev);
+    icp_pit_state *s = INTEGRATOR_PIT(dev);
 
     /* Timer 0 runs at the system clock speed (40MHz).  */
     s->timer[0] = arm_timer_init(40000000);
@@ -369,7 +374,7 @@ static void icp_pit_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo icp_pit_info = {
-    .name          = "integrator_pit",
+    .name          = TYPE_INTEGRATOR_PIT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(icp_pit_state),
     .class_init    = icp_pit_class_init,
commit 0c88dea5ebf248017ab3bf1fab8ee5e24f1b144d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:17:41 2013 +0200

    arm_timer: QOM cast cleanup for SP804State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 25e8890..8d95743 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -179,8 +179,12 @@ static arm_timer_state *arm_timer_init(uint32_t freq)
  * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0271d/index.html
 */
 
+#define TYPE_SP804 "sp804"
+#define SP804(obj) OBJECT_CHECK(SP804State, (obj), TYPE_SP804)
+
 typedef struct SP804State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     arm_timer_state *timer[2];
     uint32_t freq0, freq1;
@@ -273,21 +277,22 @@ static const VMStateDescription vmstate_sp804 = {
     }
 };
 
-static int sp804_init(SysBusDevice *dev)
+static int sp804_init(SysBusDevice *sbd)
 {
-    SP804State *s = FROM_SYSBUS(SP804State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SP804State *s = SP804(dev);
     qemu_irq *qi;
 
     qi = qemu_allocate_irqs(sp804_set_irq, s, 2);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->timer[0] = arm_timer_init(s->freq0);
     s->timer[1] = arm_timer_init(s->freq1);
     s->timer[0]->irq = qi[0];
     s->timer[1]->irq = qi[1];
     memory_region_init_io(&s->iomem, OBJECT(s), &sp804_ops, s,
                           "sp804", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    vmstate_register(&dev->qdev, -1, &vmstate_sp804, s);
+    sysbus_init_mmio(sbd, &s->iomem);
+    vmstate_register(dev, -1, &vmstate_sp804, s);
     return 0;
 }
 
@@ -386,7 +391,7 @@ static void sp804_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sp804_info = {
-    .name          = "sp804",
+    .name          = TYPE_SP804,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SP804State),
     .class_init    = sp804_class_init,
commit 1024d7f0137da3683c90b1fd77ec0e47c864d897
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:15:46 2013 +0200

    arm_timer: Rename sp804_state to SP804State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 798a8da..25e8890 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -179,14 +179,14 @@ static arm_timer_state *arm_timer_init(uint32_t freq)
  * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0271d/index.html
 */
 
-typedef struct {
+typedef struct SP804State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     arm_timer_state *timer[2];
     uint32_t freq0, freq1;
     int level[2];
     qemu_irq irq;
-} sp804_state;
+} SP804State;
 
 static const uint8_t sp804_ids[] = {
     /* Timer ID */
@@ -198,7 +198,7 @@ static const uint8_t sp804_ids[] = {
 /* Merge the IRQs from the two component devices.  */
 static void sp804_set_irq(void *opaque, int irq, int level)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     s->level[irq] = level;
     qemu_set_irq(s->irq, s->level[0] || s->level[1]);
@@ -207,7 +207,7 @@ static void sp804_set_irq(void *opaque, int irq, int level)
 static uint64_t sp804_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     if (offset < 0x20) {
         return arm_timer_read(s->timer[0], offset);
@@ -239,7 +239,7 @@ static uint64_t sp804_read(void *opaque, hwaddr offset,
 static void sp804_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     if (offset < 0x20) {
         arm_timer_write(s->timer[0], offset, value);
@@ -268,14 +268,14 @@ static const VMStateDescription vmstate_sp804 = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_INT32_ARRAY(level, sp804_state, 2),
+        VMSTATE_INT32_ARRAY(level, SP804State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static int sp804_init(SysBusDevice *dev)
 {
-    sp804_state *s = FROM_SYSBUS(sp804_state, dev);
+    SP804State *s = FROM_SYSBUS(SP804State, dev);
     qemu_irq *qi;
 
     qi = qemu_allocate_irqs(sp804_set_irq, s, 2);
@@ -371,8 +371,8 @@ static const TypeInfo icp_pit_info = {
 };
 
 static Property sp804_properties[] = {
-    DEFINE_PROP_UINT32("freq0", sp804_state, freq0, 1000000),
-    DEFINE_PROP_UINT32("freq1", sp804_state, freq1, 1000000),
+    DEFINE_PROP_UINT32("freq0", SP804State, freq0, 1000000),
+    DEFINE_PROP_UINT32("freq1", SP804State, freq1, 1000000),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -388,7 +388,7 @@ static void sp804_class_init(ObjectClass *klass, void *data)
 static const TypeInfo sp804_info = {
     .name          = "sp804",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(sp804_state),
+    .instance_size = sizeof(SP804State),
     .class_init    = sp804_class_init,
 };
 
commit 3efc10e17d41779bbdaf27a304c8e39f744e530f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:07:22 2013 +0200

    xilinx_spi: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index 7a9fd81..d44caae 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -73,8 +73,12 @@
 
 #define FIFO_CAPACITY 256
 
+#define TYPE_XILINX_SPI "xlnx.xps-spi"
+#define XILINX_SPI(obj) OBJECT_CHECK(XilinxSPI, (obj), TYPE_XILINX_SPI)
+
 typedef struct XilinxSPI {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
 
     qemu_irq irq;
@@ -109,7 +113,7 @@ static void rxfifo_reset(XilinxSPI *s)
 
 static void xlx_spi_update_cs(XilinxSPI *s)
 {
-   int i;
+    int i;
 
     for (i = 0; i < s->num_cs; ++i) {
         qemu_set_irq(s->cs_lines[i], !(~s->regs[R_SPISSR] & 1 << i));
@@ -154,7 +158,7 @@ static void xlx_spi_do_reset(XilinxSPI *s)
 
 static void xlx_spi_reset(DeviceState *d)
 {
-    xlx_spi_do_reset(DO_UPCAST(XilinxSPI, busdev.qdev, d));
+    xlx_spi_do_reset(XILINX_SPI(d));
 }
 
 static inline int spi_master_enabled(XilinxSPI *s)
@@ -314,25 +318,26 @@ static const MemoryRegionOps spi_ops = {
     }
 };
 
-static int xilinx_spi_init(SysBusDevice *dev)
+static int xilinx_spi_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    XilinxSPI *s = XILINX_SPI(dev);
     int i;
-    XilinxSPI *s = FROM_SYSBUS(typeof(*s), dev);
 
     DB_PRINT("\n");
 
-    s->spi = ssi_create_bus(&dev->qdev, "spi");
+    s->spi = ssi_create_bus(dev, "spi");
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->cs_lines = g_new(qemu_irq, s->num_cs);
-    ssi_auto_connect_slaves(DEVICE(s), s->cs_lines, s->spi);
+    ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
     for (i = 0; i < s->num_cs; ++i) {
-        sysbus_init_irq(dev, &s->cs_lines[i]);
+        sysbus_init_irq(sbd, &s->cs_lines[i]);
     }
 
     memory_region_init_io(&s->mmio, OBJECT(s), &spi_ops, s,
                           "xilinx-spi", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     s->irqline = -1;
 
@@ -372,7 +377,7 @@ static void xilinx_spi_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_spi_info = {
-    .name           = "xlnx.xps-spi",
+    .name           = TYPE_XILINX_SPI,
     .parent         = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(XilinxSPI),
     .class_init     = xilinx_spi_class_init,
commit 3d29bceec1357702b2ce0909c6eb8107b806159e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:03:29 2013 +0200

    pl022: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index d33534e..fd479ef 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -39,8 +39,12 @@ do { fprintf(stderr, "pl022: error: " fmt , ## __VA_ARGS__);} while (0)
 #define PL022_INT_RX  0x04
 #define PL022_INT_TX  0x08
 
+#define TYPE_PL022 "pl022"
+#define PL022(obj) OBJECT_CHECK(PL022State, (obj), TYPE_PL022)
+
 typedef struct PL022State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t cr0;
     uint32_t cr1;
@@ -273,16 +277,17 @@ static const VMStateDescription vmstate_pl022 = {
     }
 };
 
-static int pl022_init(SysBusDevice *dev)
+static int pl022_init(SysBusDevice *sbd)
 {
-    PL022State *s = FROM_SYSBUS(PL022State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL022State *s = PL022(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl022_ops, s, "pl022", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->ssi = ssi_create_bus(&dev->qdev, "ssi");
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->ssi = ssi_create_bus(dev, "ssi");
     pl022_reset(s);
-    vmstate_register(&dev->qdev, -1, &vmstate_pl022, s);
+    vmstate_register(dev, -1, &vmstate_pl022, s);
     return 0;
 }
 
@@ -294,7 +299,7 @@ static void pl022_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl022_info = {
-    .name          = "pl022",
+    .name          = TYPE_PL022,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL022State),
     .class_init    = pl022_class_init,
commit ce556e0baffce0624a64bdbe9b077d59cc5f6349
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:00:25 2013 +0200

    pl022: Rename pl022_state to PL022State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index 711a0c1..d33534e 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -39,7 +39,7 @@ do { fprintf(stderr, "pl022: error: " fmt , ## __VA_ARGS__);} while (0)
 #define PL022_INT_RX  0x04
 #define PL022_INT_TX  0x08
 
-typedef struct {
+typedef struct PL022State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t cr0;
@@ -58,12 +58,12 @@ typedef struct {
     uint16_t rx_fifo[8];
     qemu_irq irq;
     SSIBus *ssi;
-} pl022_state;
+} PL022State;
 
 static const unsigned char pl022_id[8] =
   { 0x22, 0x10, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl022_update(pl022_state *s)
+static void pl022_update(PL022State *s)
 {
     s->sr = 0;
     if (s->tx_fifo_len == 0)
@@ -85,7 +85,7 @@ static void pl022_update(pl022_state *s)
     qemu_set_irq(s->irq, (s->is & s->im) != 0);
 }
 
-static void pl022_xfer(pl022_state *s)
+static void pl022_xfer(PL022State *s)
 {
     int i;
     int o;
@@ -133,7 +133,7 @@ static void pl022_xfer(pl022_state *s)
 static uint64_t pl022_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl022_state *s = (pl022_state *)opaque;
+    PL022State *s = (PL022State *)opaque;
     int val;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -177,7 +177,7 @@ static uint64_t pl022_read(void *opaque, hwaddr offset,
 static void pl022_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl022_state *s = (pl022_state *)opaque;
+    PL022State *s = (PL022State *)opaque;
 
     switch (offset) {
     case 0x00: /* CR0 */
@@ -221,7 +221,7 @@ static void pl022_write(void *opaque, hwaddr offset,
     }
 }
 
-static void pl022_reset(pl022_state *s)
+static void pl022_reset(PL022State *s)
 {
     s->rx_fifo_len = 0;
     s->tx_fifo_len = 0;
@@ -242,40 +242,40 @@ static const VMStateDescription vmstate_pl022 = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_UINT32(cr0, pl022_state),
-        VMSTATE_UINT32(cr1, pl022_state),
-        VMSTATE_UINT32(bitmask, pl022_state),
-        VMSTATE_UINT32(sr, pl022_state),
-        VMSTATE_UINT32(cpsr, pl022_state),
-        VMSTATE_UINT32(is, pl022_state),
-        VMSTATE_UINT32(im, pl022_state),
-        VMSTATE_INT32(tx_fifo_head, pl022_state),
-        VMSTATE_INT32(rx_fifo_head, pl022_state),
-        VMSTATE_INT32(tx_fifo_len, pl022_state),
-        VMSTATE_INT32(rx_fifo_len, pl022_state),
-        VMSTATE_UINT16(tx_fifo[0], pl022_state),
-        VMSTATE_UINT16(rx_fifo[0], pl022_state),
-        VMSTATE_UINT16(tx_fifo[1], pl022_state),
-        VMSTATE_UINT16(rx_fifo[1], pl022_state),
-        VMSTATE_UINT16(tx_fifo[2], pl022_state),
-        VMSTATE_UINT16(rx_fifo[2], pl022_state),
-        VMSTATE_UINT16(tx_fifo[3], pl022_state),
-        VMSTATE_UINT16(rx_fifo[3], pl022_state),
-        VMSTATE_UINT16(tx_fifo[4], pl022_state),
-        VMSTATE_UINT16(rx_fifo[4], pl022_state),
-        VMSTATE_UINT16(tx_fifo[5], pl022_state),
-        VMSTATE_UINT16(rx_fifo[5], pl022_state),
-        VMSTATE_UINT16(tx_fifo[6], pl022_state),
-        VMSTATE_UINT16(rx_fifo[6], pl022_state),
-        VMSTATE_UINT16(tx_fifo[7], pl022_state),
-        VMSTATE_UINT16(rx_fifo[7], pl022_state),
+        VMSTATE_UINT32(cr0, PL022State),
+        VMSTATE_UINT32(cr1, PL022State),
+        VMSTATE_UINT32(bitmask, PL022State),
+        VMSTATE_UINT32(sr, PL022State),
+        VMSTATE_UINT32(cpsr, PL022State),
+        VMSTATE_UINT32(is, PL022State),
+        VMSTATE_UINT32(im, PL022State),
+        VMSTATE_INT32(tx_fifo_head, PL022State),
+        VMSTATE_INT32(rx_fifo_head, PL022State),
+        VMSTATE_INT32(tx_fifo_len, PL022State),
+        VMSTATE_INT32(rx_fifo_len, PL022State),
+        VMSTATE_UINT16(tx_fifo[0], PL022State),
+        VMSTATE_UINT16(rx_fifo[0], PL022State),
+        VMSTATE_UINT16(tx_fifo[1], PL022State),
+        VMSTATE_UINT16(rx_fifo[1], PL022State),
+        VMSTATE_UINT16(tx_fifo[2], PL022State),
+        VMSTATE_UINT16(rx_fifo[2], PL022State),
+        VMSTATE_UINT16(tx_fifo[3], PL022State),
+        VMSTATE_UINT16(rx_fifo[3], PL022State),
+        VMSTATE_UINT16(tx_fifo[4], PL022State),
+        VMSTATE_UINT16(rx_fifo[4], PL022State),
+        VMSTATE_UINT16(tx_fifo[5], PL022State),
+        VMSTATE_UINT16(rx_fifo[5], PL022State),
+        VMSTATE_UINT16(tx_fifo[6], PL022State),
+        VMSTATE_UINT16(rx_fifo[6], PL022State),
+        VMSTATE_UINT16(tx_fifo[7], PL022State),
+        VMSTATE_UINT16(rx_fifo[7], PL022State),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static int pl022_init(SysBusDevice *dev)
 {
-    pl022_state *s = FROM_SYSBUS(pl022_state, dev);
+    PL022State *s = FROM_SYSBUS(PL022State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl022_ops, s, "pl022", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -296,7 +296,7 @@ static void pl022_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl022_info = {
     .name          = "pl022",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl022_state),
+    .instance_size = sizeof(PL022State),
     .class_init    = pl022_class_init,
 };
 
commit 88c034d5b2c406e1859c9a3746229868a20fed41
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:50:51 2013 +0200

    sun4u: QOM cast cleanup for RamDevice
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 9568028..a7214a3 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -714,9 +714,12 @@ static const TypeInfo prom_info = {
 };
 
 
-typedef struct RamDevice
-{
-    SysBusDevice busdev;
+#define TYPE_SUN4U_MEMORY "memory"
+#define SUN4U_RAM(obj) OBJECT_CHECK(RamDevice, (obj), TYPE_SUN4U_MEMORY)
+
+typedef struct RamDevice {
+    SysBusDevice parent_obj;
+
     MemoryRegion ram;
     uint64_t size;
 } RamDevice;
@@ -724,7 +727,7 @@ typedef struct RamDevice
 /* System RAM */
 static int ram_init1(SysBusDevice *dev)
 {
-    RamDevice *d = FROM_SYSBUS(RamDevice, dev);
+    RamDevice *d = SUN4U_RAM(dev);
 
     memory_region_init_ram(&d->ram, OBJECT(d), "sun4u.ram", d->size);
     vmstate_register_ram_global(&d->ram);
@@ -739,10 +742,10 @@ static void ram_init(hwaddr addr, ram_addr_t RAM_size)
     RamDevice *d;
 
     /* allocate RAM */
-    dev = qdev_create(NULL, "memory");
+    dev = qdev_create(NULL, TYPE_SUN4U_MEMORY);
     s = SYS_BUS_DEVICE(dev);
 
-    d = FROM_SYSBUS(RamDevice, s);
+    d = SUN4U_RAM(dev);
     d->size = RAM_size;
     qdev_init_nofail(dev);
 
@@ -764,7 +767,7 @@ static void ram_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ram_info = {
-    .name          = "memory",
+    .name          = TYPE_SUN4U_MEMORY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RamDevice),
     .class_init    = ram_class_init,
commit 13575cf6dbe88ffa9d2f03dace03aedd9e003f8d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:48:18 2013 +0200

    sun4u: QOM cast cleanup for PROMState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 34a5e73..9568028 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -632,8 +632,12 @@ static const TypeInfo ebus_info = {
     .class_init    = ebus_class_init,
 };
 
+#define TYPE_OPENPROM "openprom"
+#define OPENPROM(obj) OBJECT_CHECK(PROMState, (obj), TYPE_OPENPROM)
+
 typedef struct PROMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion prom;
 } PROMState;
 
@@ -651,7 +655,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
     char *filename;
     int ret;
 
-    dev = qdev_create(NULL, "openprom");
+    dev = qdev_create(NULL, TYPE_OPENPROM);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -680,7 +684,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
 
 static int prom_init1(SysBusDevice *dev)
 {
-    PROMState *s = FROM_SYSBUS(PROMState, dev);
+    PROMState *s = OPENPROM(dev);
 
     memory_region_init_ram(&s->prom, OBJECT(s), "sun4u.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
@@ -703,7 +707,7 @@ static void prom_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo prom_info = {
-    .name          = "openprom",
+    .name          = TYPE_OPENPROM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PROMState),
     .class_init    = prom_class_init,
commit 5ab6b4c661ecf3c824e08de6f5c99a855d00fa84
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:45:23 2013 +0200

    sun4m: QOM cast cleanup for RamDevice
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index b943a07..942ca37 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -739,9 +739,12 @@ static const TypeInfo prom_info = {
     .class_init    = prom_class_init,
 };
 
-typedef struct RamDevice
-{
-    SysBusDevice busdev;
+#define TYPE_SUN4M_MEMORY "memory"
+#define SUN4M_RAM(obj) OBJECT_CHECK(RamDevice, (obj), TYPE_SUN4M_MEMORY)
+
+typedef struct RamDevice {
+    SysBusDevice parent_obj;
+
     MemoryRegion ram;
     uint64_t size;
 } RamDevice;
@@ -749,7 +752,7 @@ typedef struct RamDevice
 /* System RAM */
 static int ram_init1(SysBusDevice *dev)
 {
-    RamDevice *d = FROM_SYSBUS(RamDevice, dev);
+    RamDevice *d = SUN4M_RAM(dev);
 
     memory_region_init_ram(&d->ram, OBJECT(d), "sun4m.ram", d->size);
     vmstate_register_ram_global(&d->ram);
@@ -775,7 +778,7 @@ static void ram_init(hwaddr addr, ram_addr_t RAM_size,
     dev = qdev_create(NULL, "memory");
     s = SYS_BUS_DEVICE(dev);
 
-    d = FROM_SYSBUS(RamDevice, s);
+    d = SUN4M_RAM(dev);
     d->size = RAM_size;
     qdev_init_nofail(dev);
 
@@ -797,7 +800,7 @@ static void ram_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ram_info = {
-    .name          = "memory",
+    .name          = TYPE_SUN4M_MEMORY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RamDevice),
     .class_init    = ram_class_init,
commit e6f54c91758d99f476c7db01c449e01a54821e1c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:42:29 2013 +0200

    sun4m: QOM cast cleanup for PROMState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index e5c6881..b943a07 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -658,8 +658,12 @@ static const TypeInfo afx_info = {
     .class_init    = afx_class_init,
 };
 
+#define TYPE_OPENPROM "openprom"
+#define OPENPROM(obj) OBJECT_CHECK(PROMState, (obj), TYPE_OPENPROM)
+
 typedef struct PROMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion prom;
 } PROMState;
 
@@ -677,7 +681,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
     char *filename;
     int ret;
 
-    dev = qdev_create(NULL, "openprom");
+    dev = qdev_create(NULL, TYPE_OPENPROM);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -706,7 +710,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
 
 static int prom_init1(SysBusDevice *dev)
 {
-    PROMState *s = FROM_SYSBUS(PROMState, dev);
+    PROMState *s = OPENPROM(dev);
 
     memory_region_init_ram(&s->prom, OBJECT(s), "sun4m.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
@@ -729,7 +733,7 @@ static void prom_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo prom_info = {
-    .name          = "openprom",
+    .name          = TYPE_OPENPROM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PROMState),
     .class_init    = prom_class_init,
commit b3a4996524910049ac491c512858b7a38878a444
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:38:44 2013 +0200

    sun4m: QOM cast cleanup for AFXState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index eb3b11b..e5c6881 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -612,8 +612,12 @@ static const TypeInfo idreg_info = {
     .class_init    = idreg_class_init,
 };
 
+#define TYPE_TCX_AFX "tcx_afx"
+#define TCX_AFX(obj) OBJECT_CHECK(AFXState, (obj), TYPE_TCX_AFX)
+
 typedef struct AFXState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mem;
 } AFXState;
 
@@ -623,7 +627,7 @@ static void afx_init(hwaddr addr)
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "tcx_afx");
+    dev = qdev_create(NULL, TYPE_TCX_AFX);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -632,7 +636,7 @@ static void afx_init(hwaddr addr)
 
 static int afx_init1(SysBusDevice *dev)
 {
-    AFXState *s = FROM_SYSBUS(AFXState, dev);
+    AFXState *s = TCX_AFX(dev);
 
     memory_region_init_ram(&s->mem, OBJECT(s), "sun4m.afx", 4);
     vmstate_register_ram_global(&s->mem);
@@ -648,7 +652,7 @@ static void afx_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo afx_info = {
-    .name          = "tcx_afx",
+    .name          = TYPE_TCX_AFX,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AFXState),
     .class_init    = afx_class_init,
commit ef9dfa4c1c97db30d83dbcc8d31c334641b5f7ca
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:33:46 2013 +0200

    sun4m: QOM cast cleanup for IDRegState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 5c7bd31..eb3b11b 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -559,6 +559,9 @@ static void tcx_init(hwaddr addr, int vram_size, int width,
 }
 
 /* NCR89C100/MACIO Internal ID register */
+
+#define TYPE_MACIO_ID_REGISTER "macio_idreg"
+
 static const uint8_t idreg_data[] = { 0xfe, 0x81, 0x01, 0x03 };
 
 static void idreg_init(hwaddr addr)
@@ -566,7 +569,7 @@ static void idreg_init(hwaddr addr)
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "macio_idreg");
+    dev = qdev_create(NULL, TYPE_MACIO_ID_REGISTER);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -574,14 +577,18 @@ static void idreg_init(hwaddr addr)
     cpu_physical_memory_write_rom(addr, idreg_data, sizeof(idreg_data));
 }
 
+#define MACIO_ID_REGISTER(obj) \
+    OBJECT_CHECK(IDRegState, (obj), TYPE_MACIO_ID_REGISTER)
+
 typedef struct IDRegState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mem;
 } IDRegState;
 
 static int idreg_init1(SysBusDevice *dev)
 {
-    IDRegState *s = FROM_SYSBUS(IDRegState, dev);
+    IDRegState *s = MACIO_ID_REGISTER(dev);
 
     memory_region_init_ram(&s->mem, OBJECT(s),
                            "sun4m.idreg", sizeof(idreg_data));
@@ -599,7 +606,7 @@ static void idreg_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo idreg_info = {
-    .name          = "macio_idreg",
+    .name          = TYPE_MACIO_ID_REGISTER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IDRegState),
     .class_init    = idreg_class_init,
commit 630f44426825f18230072ce239a3dea72242e234
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:23:41 2013 +0200

    pl181: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index dc08595..03875bf 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -22,8 +22,12 @@ do { printf("pl181: " fmt , ## __VA_ARGS__); } while (0)
 
 #define PL181_FIFO_LEN 16
 
+#define TYPE_PL181 "pl181"
+#define PL181(obj) OBJECT_CHECK(PL181State, (obj), TYPE_PL181)
+
 typedef struct PL181State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     SDState *card;
     uint32_t clock;
@@ -449,7 +453,7 @@ static const MemoryRegionOps pl181_ops = {
 
 static void pl181_reset(DeviceState *d)
 {
-    PL181State *s = DO_UPCAST(PL181State, busdev.qdev, d);
+    PL181State *s = PL181(d);
 
     s->power = 0;
     s->cmdarg = 0;
@@ -474,16 +478,17 @@ static void pl181_reset(DeviceState *d)
     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
 }
 
-static int pl181_init(SysBusDevice *dev)
+static int pl181_init(SysBusDevice *sbd)
 {
-    PL181State *s = FROM_SYSBUS(PL181State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL181State *s = PL181(dev);
     DriveInfo *dinfo;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl181_ops, s, "pl181", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq[0]);
-    sysbus_init_irq(dev, &s->irq[1]);
-    qdev_init_gpio_out(&s->busdev.qdev, s->cardstatus, 2);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq[0]);
+    sysbus_init_irq(sbd, &s->irq[1]);
+    qdev_init_gpio_out(dev, s->cardstatus, 2);
     dinfo = drive_get_next(IF_SD);
     s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     return 0;
@@ -501,7 +506,7 @@ static void pl181_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl181_info = {
-    .name          = "pl181",
+    .name          = TYPE_PL181,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL181State),
     .class_init    = pl181_class_init,
commit 1d998d93acbbefc3804200ab4387cb0286b07d7b
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:20:09 2013 +0200

    pl181: Rename pl181_state to PL181State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index f5eb1e4..dc08595 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -22,7 +22,7 @@ do { printf("pl181: " fmt , ## __VA_ARGS__); } while (0)
 
 #define PL181_FIFO_LEN 16
 
-typedef struct {
+typedef struct PL181State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     SDState *card;
@@ -50,29 +50,29 @@ typedef struct {
     qemu_irq irq[2];
     /* GPIO outputs for 'card is readonly' and 'card inserted' */
     qemu_irq cardstatus[2];
-} pl181_state;
+} PL181State;
 
 static const VMStateDescription vmstate_pl181 = {
     .name = "pl181",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(clock, pl181_state),
-        VMSTATE_UINT32(power, pl181_state),
-        VMSTATE_UINT32(cmdarg, pl181_state),
-        VMSTATE_UINT32(cmd, pl181_state),
-        VMSTATE_UINT32(datatimer, pl181_state),
-        VMSTATE_UINT32(datalength, pl181_state),
-        VMSTATE_UINT32(respcmd, pl181_state),
-        VMSTATE_UINT32_ARRAY(response, pl181_state, 4),
-        VMSTATE_UINT32(datactrl, pl181_state),
-        VMSTATE_UINT32(datacnt, pl181_state),
-        VMSTATE_UINT32(status, pl181_state),
-        VMSTATE_UINT32_ARRAY(mask, pl181_state, 2),
-        VMSTATE_INT32(fifo_pos, pl181_state),
-        VMSTATE_INT32(fifo_len, pl181_state),
-        VMSTATE_INT32(linux_hack, pl181_state),
-        VMSTATE_UINT32_ARRAY(fifo, pl181_state, PL181_FIFO_LEN),
+        VMSTATE_UINT32(clock, PL181State),
+        VMSTATE_UINT32(power, PL181State),
+        VMSTATE_UINT32(cmdarg, PL181State),
+        VMSTATE_UINT32(cmd, PL181State),
+        VMSTATE_UINT32(datatimer, PL181State),
+        VMSTATE_UINT32(datalength, PL181State),
+        VMSTATE_UINT32(respcmd, PL181State),
+        VMSTATE_UINT32_ARRAY(response, PL181State, 4),
+        VMSTATE_UINT32(datactrl, PL181State),
+        VMSTATE_UINT32(datacnt, PL181State),
+        VMSTATE_UINT32(status, PL181State),
+        VMSTATE_UINT32_ARRAY(mask, PL181State, 2),
+        VMSTATE_INT32(fifo_pos, PL181State),
+        VMSTATE_INT32(fifo_len, PL181State),
+        VMSTATE_INT32(linux_hack, PL181State),
+        VMSTATE_UINT32_ARRAY(fifo, PL181State, PL181_FIFO_LEN),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -125,7 +125,7 @@ static const VMStateDescription vmstate_pl181 = {
 static const unsigned char pl181_id[] =
 { 0x81, 0x11, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl181_update(pl181_state *s)
+static void pl181_update(PL181State *s)
 {
     int i;
     for (i = 0; i < 2; i++) {
@@ -133,7 +133,7 @@ static void pl181_update(pl181_state *s)
     }
 }
 
-static void pl181_fifo_push(pl181_state *s, uint32_t value)
+static void pl181_fifo_push(PL181State *s, uint32_t value)
 {
     int n;
 
@@ -147,7 +147,7 @@ static void pl181_fifo_push(pl181_state *s, uint32_t value)
     DPRINTF("FIFO push %08x\n", (int)value);
 }
 
-static uint32_t pl181_fifo_pop(pl181_state *s)
+static uint32_t pl181_fifo_pop(PL181State *s)
 {
     uint32_t value;
 
@@ -162,7 +162,7 @@ static uint32_t pl181_fifo_pop(pl181_state *s)
     return value;
 }
 
-static void pl181_send_command(pl181_state *s)
+static void pl181_send_command(PL181State *s)
 {
     SDRequest request;
     uint8_t response[16];
@@ -207,7 +207,7 @@ error:
    the FIFO holding 32-bit words and the card taking data in single byte
    chunks.  FIFO bytes are transferred in little-endian order.  */
 
-static void pl181_fifo_run(pl181_state *s)
+static void pl181_fifo_run(PL181State *s)
 {
     uint32_t bits;
     uint32_t value = 0;
@@ -288,7 +288,7 @@ static void pl181_fifo_run(pl181_state *s)
 static uint64_t pl181_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl181_state *s = (pl181_state *)opaque;
+    PL181State *s = (PL181State *)opaque;
     uint32_t tmp;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -372,7 +372,7 @@ static uint64_t pl181_read(void *opaque, hwaddr offset,
 static void pl181_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl181_state *s = (pl181_state *)opaque;
+    PL181State *s = (PL181State *)opaque;
 
     switch (offset) {
     case 0x00: /* Power */
@@ -449,7 +449,7 @@ static const MemoryRegionOps pl181_ops = {
 
 static void pl181_reset(DeviceState *d)
 {
-    pl181_state *s = DO_UPCAST(pl181_state, busdev.qdev, d);
+    PL181State *s = DO_UPCAST(PL181State, busdev.qdev, d);
 
     s->power = 0;
     s->cmdarg = 0;
@@ -476,7 +476,7 @@ static void pl181_reset(DeviceState *d)
 
 static int pl181_init(SysBusDevice *dev)
 {
-    pl181_state *s = FROM_SYSBUS(pl181_state, dev);
+    PL181State *s = FROM_SYSBUS(PL181State, dev);
     DriveInfo *dinfo;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl181_ops, s, "pl181", 0x1000);
@@ -503,7 +503,7 @@ static void pl181_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl181_info = {
     .name          = "pl181",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl181_state),
+    .instance_size = sizeof(PL181State),
     .class_init    = pl181_class_init,
 };
 
commit 7a239e46f792b234d77425653a8259152df5d5de
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:18:50 2013 +0200

    milkymist-memcard: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index f69775c..42613b3 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -58,8 +58,13 @@ enum {
     R_MAX
 };
 
+#define TYPE_MILKYMIST_MEMCARD "milkymist-memcard"
+#define MILKYMIST_MEMCARD(obj) \
+    OBJECT_CHECK(MilkymistMemcardState, (obj), TYPE_MILKYMIST_MEMCARD)
+
 struct MilkymistMemcardState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     SDState *card;
 
@@ -231,8 +236,7 @@ static const MemoryRegionOps memcard_mmio_ops = {
 
 static void milkymist_memcard_reset(DeviceState *d)
 {
-    MilkymistMemcardState *s =
-            container_of(d, MilkymistMemcardState, busdev.qdev);
+    MilkymistMemcardState *s = MILKYMIST_MEMCARD(d);
     int i;
 
     s->command_write_ptr = 0;
@@ -246,7 +250,7 @@ static void milkymist_memcard_reset(DeviceState *d)
 
 static int milkymist_memcard_init(SysBusDevice *dev)
 {
-    MilkymistMemcardState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistMemcardState *s = MILKYMIST_MEMCARD(dev);
     DriveInfo *dinfo;
 
     dinfo = drive_get_next(IF_SD);
@@ -289,7 +293,7 @@ static void milkymist_memcard_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_memcard_info = {
-    .name          = "milkymist-memcard",
+    .name          = TYPE_MILKYMIST_MEMCARD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistMemcardState),
     .class_init    = milkymist_memcard_class_init,
commit 880fc798fd34cea6e6647a9210dc7458c9ceedb6
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:03:07 2013 +0200

    ppce500_spin: QOM cast cleanup
    
    Introduce type constant and use QOM cast.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index 11b7de2..78b23fa 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -42,8 +42,12 @@ typedef struct spin_info {
     uint64_t reserved;
 } QEMU_PACKED SpinInfo;
 
-typedef struct spin_state {
-    SysBusDevice busdev;
+#define TYPE_E500_SPIN "e500-spin"
+#define E500_SPIN(obj) OBJECT_CHECK(SpinState, (obj), TYPE_E500_SPIN)
+
+typedef struct SpinState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     SpinInfo spin[MAX_CPUS];
 } SpinState;
@@ -187,9 +191,7 @@ static const MemoryRegionOps spin_rw_ops = {
 
 static int ppce500_spin_initfn(SysBusDevice *dev)
 {
-    SpinState *s;
-
-    s = FROM_SYSBUS(SpinState, SYS_BUS_DEVICE(dev));
+    SpinState *s = E500_SPIN(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &spin_rw_ops, s,
                           "e500 spin pv device", sizeof(SpinInfo) * MAX_CPUS);
@@ -208,7 +210,7 @@ static void ppce500_spin_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ppce500_spin_info = {
-    .name          = "e500-spin",
+    .name          = TYPE_E500_SPIN,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SpinState),
     .class_init    = ppce500_spin_class_init,
commit 8c1892cf7297ff4972a4ad6dd601921c3a01d618
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:50:29 2013 +0200

    ds1225y: QOM cast cleanup for SysBusNvRamState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index cca6f43..f9a700b 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -104,14 +104,19 @@ static const VMStateDescription vmstate_nvram = {
     }
 };
 
+#define TYPE_DS1225Y "ds1225y"
+#define DS1225Y(obj) OBJECT_CHECK(SysBusNvRamState, (obj), TYPE_DS1225Y)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NvRamState nvram;
 } SysBusNvRamState;
 
 static int nvram_sysbus_initfn(SysBusDevice *dev)
 {
-    NvRamState *s = &FROM_SYSBUS(SysBusNvRamState, dev)->nvram;
+    SysBusNvRamState *sys = DS1225Y(dev);
+    NvRamState *s = &sys->nvram;
     FILE *file;
 
     s->contents = g_malloc0(s->chip_size);
@@ -151,7 +156,7 @@ static void nvram_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo nvram_sysbus_info = {
-    .name          = "ds1225y",
+    .name          = TYPE_DS1225Y,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysBusNvRamState),
     .class_init    = nvram_sysbus_class_init,
commit 14134f0eb57247e3ec3b8311931a11b344096591
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:47:09 2013 +0200

    ds1225y: Drop bogus qdev field from NvRamState
    
    It is not a device, and the field is not used from code either.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index fa218ce..cca6f43 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -26,7 +26,6 @@
 #include "trace.h"
 
 typedef struct {
-    DeviceState qdev;
     MemoryRegion iomem;
     uint32_t chip_size;
     char *filename;
commit 91a28042958f20eff01a4d441d7072fd1902d375
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:43:06 2013 +0200

    xilinx_ethlite: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index 2afc91a..3a2a6c2 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -47,9 +47,14 @@
 #define CTRL_P     0x2
 #define CTRL_S     0x1
 
+#define TYPE_XILINX_ETHLITE "xlnx.xps-ethernetlite"
+#define XILINX_ETHLITE(obj) \
+    OBJECT_CHECK(struct xlx_ethlite, (obj), TYPE_XILINX_ETHLITE)
+
 struct xlx_ethlite
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     NICState *nic;
@@ -214,20 +219,21 @@ static NetClientInfo net_xilinx_ethlite_info = {
     .cleanup = eth_cleanup,
 };
 
-static int xilinx_ethlite_init(SysBusDevice *dev)
+static int xilinx_ethlite_init(SysBusDevice *sbd)
 {
-    struct xlx_ethlite *s = FROM_SYSBUS(typeof (*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct xlx_ethlite *s = XILINX_ETHLITE(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->rxbuf = 0;
 
     memory_region_init_io(&s->mmio, OBJECT(s), &eth_ops, s,
                           "xlnx.xps-ethernetlite", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_xilinx_ethlite_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     return 0;
 }
@@ -249,7 +255,7 @@ static void xilinx_ethlite_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_ethlite_info = {
-    .name          = "xlnx.xps-ethernetlite",
+    .name          = TYPE_XILINX_ETHLITE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct xlx_ethlite),
     .class_init    = xilinx_ethlite_class_init,
commit 546921eac5abd7cc6c78f1ceeda3375697ac04bd
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:35:15 2013 +0200

    xgmac: QOM cast cleanup
    
    Introduce type constant and use QOM casts and typedef consistently.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index 997a5b5..9384fa0 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -135,8 +135,12 @@ typedef struct RxTxStats {
     uint64_t rx_mcast;
 } RxTxStats;
 
+#define TYPE_XGMAC "xgmac"
+#define XGMAC(obj) OBJECT_CHECK(XgmacState, (obj), TYPE_XGMAC)
+
 typedef struct XgmacState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq sbd_irq;
     qemu_irq pmt_irq;
@@ -173,14 +177,14 @@ static const VMStateDescription vmstate_xgmac = {
     }
 };
 
-static void xgmac_read_desc(struct XgmacState *s, struct desc *d, int rx)
+static void xgmac_read_desc(XgmacState *s, struct desc *d, int rx)
 {
     uint32_t addr = rx ? s->regs[DMA_CUR_RX_DESC_ADDR] :
         s->regs[DMA_CUR_TX_DESC_ADDR];
     cpu_physical_memory_read(addr, d, sizeof(*d));
 }
 
-static void xgmac_write_desc(struct XgmacState *s, struct desc *d, int rx)
+static void xgmac_write_desc(XgmacState *s, struct desc *d, int rx)
 {
     int reg = rx ? DMA_CUR_RX_DESC_ADDR : DMA_CUR_TX_DESC_ADDR;
     uint32_t addr = s->regs[reg];
@@ -195,7 +199,7 @@ static void xgmac_write_desc(struct XgmacState *s, struct desc *d, int rx)
     cpu_physical_memory_write(addr, d, sizeof(*d));
 }
 
-static void xgmac_enet_send(struct XgmacState *s)
+static void xgmac_enet_send(XgmacState *s)
 {
     struct desc bd;
     int frame_size;
@@ -246,7 +250,7 @@ static void xgmac_enet_send(struct XgmacState *s)
     }
 }
 
-static void enet_update_irq(struct XgmacState *s)
+static void enet_update_irq(XgmacState *s)
 {
     int stat = s->regs[DMA_STATUS] & s->regs[DMA_INTR_ENA];
     qemu_set_irq(s->sbd_irq, !!stat);
@@ -254,7 +258,7 @@ static void enet_update_irq(struct XgmacState *s)
 
 static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
 {
-    struct XgmacState *s = opaque;
+    XgmacState *s = opaque;
     uint64_t r = 0;
     addr >>= 2;
 
@@ -274,7 +278,7 @@ static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
 static void enet_write(void *opaque, hwaddr addr,
                        uint64_t value, unsigned size)
 {
-    struct XgmacState *s = opaque;
+    XgmacState *s = opaque;
 
     addr >>= 2;
     switch (addr) {
@@ -310,7 +314,7 @@ static const MemoryRegionOps enet_mem_ops = {
 
 static int eth_can_rx(NetClientState *nc)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
 
     /* RX enabled?  */
     return s->regs[DMA_CONTROL] & DMA_CONTROL_SR;
@@ -318,7 +322,7 @@ static int eth_can_rx(NetClientState *nc)
 
 static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
     static const unsigned char sa_bcast[6] = {0xff, 0xff, 0xff,
                                               0xff, 0xff, 0xff};
     int unicast, broadcast, multicast;
@@ -366,7 +370,8 @@ out:
 
 static void eth_cleanup(NetClientState *nc)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
+
     s->nic = NULL;
 }
 
@@ -378,20 +383,21 @@ static NetClientInfo net_xgmac_enet_info = {
     .cleanup = eth_cleanup,
 };
 
-static int xgmac_enet_init(SysBusDevice *dev)
+static int xgmac_enet_init(SysBusDevice *sbd)
 {
-    struct XgmacState *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    XgmacState *s = XGMAC(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &enet_mem_ops, s,
                           "xgmac", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->sbd_irq);
-    sysbus_init_irq(dev, &s->pmt_irq);
-    sysbus_init_irq(dev, &s->mci_irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->sbd_irq);
+    sysbus_init_irq(sbd, &s->pmt_irq);
+    sysbus_init_irq(sbd, &s->mci_irq);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_xgmac_enet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     s->regs[XGMAC_ADDR_HIGH(0)] = (s->conf.macaddr.a[5] << 8) |
@@ -405,7 +411,7 @@ static int xgmac_enet_init(SysBusDevice *dev)
 }
 
 static Property xgmac_properties[] = {
-    DEFINE_NIC_PROPERTIES(struct XgmacState, conf),
+    DEFINE_NIC_PROPERTIES(XgmacState, conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -420,9 +426,9 @@ static void xgmac_enet_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xgmac_enet_info = {
-    .name          = "xgmac",
+    .name          = TYPE_XGMAC,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct XgmacState),
+    .instance_size = sizeof(XgmacState),
     .class_init    = xgmac_enet_class_init,
 };
 
commit 0618db44b9da3a2525b414a0928d2b445f897eec
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:27:46 2013 +0200

    stellaris_enet: Fix NetClientInfo::cleanup
    
    Drop freeing stellaris_enet_state - that is done by QOM later on unref.
    
    Both MemoryRegion init and savevm registration happen in SysBusDevice
    initfn currently, so move them into an unrealizefn for now.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index 6194e33..9dd77f7 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -391,11 +391,7 @@ static void stellaris_enet_cleanup(NetClientState *nc)
 {
     stellaris_enet_state *s = qemu_get_nic_opaque(nc);
 
-    unregister_savevm(DEVICE(s), "stellaris_enet", s);
-
-    memory_region_destroy(&s->mmio);
-
-    g_free(s);
+    s->nic = NULL;
 }
 
 static NetClientInfo net_stellaris_enet_info = {
@@ -427,6 +423,15 @@ static int stellaris_enet_init(SysBusDevice *sbd)
     return 0;
 }
 
+static void stellaris_enet_unrealize(DeviceState *dev, Error **errp)
+{
+    stellaris_enet_state *s = STELLARIS_ENET(dev);
+
+    unregister_savevm(DEVICE(s), "stellaris_enet", s);
+
+    memory_region_destroy(&s->mmio);
+}
+
 static Property stellaris_enet_properties[] = {
     DEFINE_NIC_PROPERTIES(stellaris_enet_state, conf),
     DEFINE_PROP_END_OF_LIST(),
@@ -438,6 +443,7 @@ static void stellaris_enet_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = stellaris_enet_init;
+    dc->unrealize = stellaris_enet_unrealize;
     dc->props = stellaris_enet_properties;
 }
 
commit 2fa30abadfa2f9f3c47044f677e74988db274d0c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:23:22 2013 +0200

    stellaris_enet: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index aac7c76..6194e33 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -42,8 +42,13 @@ do { fprintf(stderr, "stellaris_enet: error: " fmt , ## __VA_ARGS__);} while (0)
 #define SE_TCTL_CRC     0x04
 #define SE_TCTL_DUPLEX  0x08
 
+#define TYPE_STELLARIS_ENET "stellaris_enet"
+#define STELLARIS_ENET(obj) \
+    OBJECT_CHECK(stellaris_enet_state, (obj), TYPE_STELLARIS_ENET)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t ris;
     uint32_t im;
     uint32_t rctl;
@@ -386,7 +391,7 @@ static void stellaris_enet_cleanup(NetClientState *nc)
 {
     stellaris_enet_state *s = qemu_get_nic_opaque(nc);
 
-    unregister_savevm(&s->busdev.qdev, "stellaris_enet", s);
+    unregister_savevm(DEVICE(s), "stellaris_enet", s);
 
     memory_region_destroy(&s->mmio);
 
@@ -401,22 +406,23 @@ static NetClientInfo net_stellaris_enet_info = {
     .cleanup = stellaris_enet_cleanup,
 };
 
-static int stellaris_enet_init(SysBusDevice *dev)
+static int stellaris_enet_init(SysBusDevice *sbd)
 {
-    stellaris_enet_state *s = FROM_SYSBUS(stellaris_enet_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_enet_state *s = STELLARIS_ENET(dev);
 
     memory_region_init_io(&s->mmio, OBJECT(s), &stellaris_enet_ops, s,
                           "stellaris_enet", 0x1000);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_stellaris_enet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     stellaris_enet_reset(s);
-    register_savevm(&s->busdev.qdev, "stellaris_enet", -1, 1,
+    register_savevm(dev, "stellaris_enet", -1, 1,
                     stellaris_enet_save, stellaris_enet_load, s);
     return 0;
 }
@@ -436,7 +442,7 @@ static void stellaris_enet_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_enet_info = {
-    .name          = "stellaris_enet",
+    .name          = TYPE_STELLARIS_ENET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_enet_state),
     .class_init    = stellaris_enet_class_init,
commit 926d152e4c5b56b7a76a4bc77b9cf2987119b884
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:17:48 2013 +0200

    smc91c111: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index c49e37a..f5963e2 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -16,8 +16,12 @@
 /* Number of 2k memory pages available.  */
 #define NUM_PACKETS 4
 
+#define TYPE_SMC91C111 "smc91c111"
+#define SMC91C111(obj) OBJECT_CHECK(smc91c111_state, (obj), TYPE_SMC91C111)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     uint16_t tcr;
@@ -254,7 +258,8 @@ static void smc91c111_queue_tx(smc91c111_state *s, int packet)
 
 static void smc91c111_reset(DeviceState *dev)
 {
-    smc91c111_state *s = FROM_SYSBUS(smc91c111_state, SYS_BUS_DEVICE(dev));
+    smc91c111_state *s = SMC91C111(dev);
+
     s->bank = 0;
     s->tx_fifo_len = 0;
     s->tx_fifo_done_len = 0;
@@ -302,8 +307,9 @@ static void smc91c111_writeb(void *opaque, hwaddr offset,
             return;
         case 5:
             SET_HIGH(rcr, value);
-            if (s->rcr & RCR_SOFT_RST)
-                smc91c111_reset(&s->busdev.qdev);
+            if (s->rcr & RCR_SOFT_RST) {
+                smc91c111_reset(DEVICE(s));
+            }
             return;
         case 10: case 11: /* RPCR */
             /* Ignored */
@@ -744,16 +750,18 @@ static NetClientInfo net_smc91c111_info = {
     .cleanup = smc91c111_cleanup,
 };
 
-static int smc91c111_init1(SysBusDevice *dev)
+static int smc91c111_init1(SysBusDevice *sbd)
 {
-    smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    smc91c111_state *s = SMC91C111(dev);
+
     memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
                           "smc91c111-mmio", 16);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     /* ??? Save/restore.  */
     return 0;
@@ -776,7 +784,7 @@ static void smc91c111_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo smc91c111_info = {
-    .name          = "smc91c111",
+    .name          = TYPE_SMC91C111,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(smc91c111_state),
     .class_init    = smc91c111_class_init,
@@ -795,7 +803,7 @@ void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
     SysBusDevice *s;
 
     qemu_check_nic_model(nd, "smc91c111");
-    dev = qdev_create(NULL, "smc91c111");
+    dev = qdev_create(NULL, TYPE_SMC91C111);
     qdev_set_nic_properties(dev, nd);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
commit 0e57587f2562dd0123817cefc4e95733f9daec8e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:13:17 2013 +0200

    milkymist-minimac2: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/milkymist-minimac2.c b/hw/net/milkymist-minimac2.c
index becd26c..1e92379 100644
--- a/hw/net/milkymist-minimac2.c
+++ b/hw/net/milkymist-minimac2.c
@@ -90,8 +90,13 @@ struct MilkymistMinimac2MdioState {
 };
 typedef struct MilkymistMinimac2MdioState MilkymistMinimac2MdioState;
 
+#define TYPE_MILKYMIST_MINIMAC2 "milkymist-minimac2"
+#define MILKYMIST_MINIMAC2(obj) \
+    OBJECT_CHECK(MilkymistMinimac2State, (obj), TYPE_MILKYMIST_MINIMAC2)
+
 struct MilkymistMinimac2State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     char *phy_model;
@@ -429,8 +434,7 @@ static void minimac2_cleanup(NetClientState *nc)
 
 static void milkymist_minimac2_reset(DeviceState *d)
 {
-    MilkymistMinimac2State *s =
-            container_of(d, MilkymistMinimac2State, busdev.qdev);
+    MilkymistMinimac2State *s = MILKYMIST_MINIMAC2(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -453,17 +457,18 @@ static NetClientInfo net_milkymist_minimac2_info = {
     .cleanup = minimac2_cleanup,
 };
 
-static int milkymist_minimac2_init(SysBusDevice *dev)
+static int milkymist_minimac2_init(SysBusDevice *sbd)
 {
-    MilkymistMinimac2State *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    MilkymistMinimac2State *s = MILKYMIST_MINIMAC2(dev);
     size_t buffers_size = TARGET_PAGE_ALIGN(3 * MINIMAC2_BUFFER_SIZE);
 
-    sysbus_init_irq(dev, &s->rx_irq);
-    sysbus_init_irq(dev, &s->tx_irq);
+    sysbus_init_irq(sbd, &s->rx_irq);
+    sysbus_init_irq(sbd, &s->tx_irq);
 
     memory_region_init_io(&s->regs_region, OBJECT(dev), &minimac2_ops, s,
                           "milkymist-minimac2", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->regs_region);
+    sysbus_init_mmio(sbd, &s->regs_region);
 
     /* register buffers memory */
     memory_region_init_ram(&s->buffers, OBJECT(dev), "milkymist-minimac2.buffers",
@@ -473,11 +478,11 @@ static int milkymist_minimac2_init(SysBusDevice *dev)
     s->rx1_buf = s->rx0_buf + MINIMAC2_BUFFER_SIZE;
     s->tx_buf = s->rx1_buf + MINIMAC2_BUFFER_SIZE;
 
-    sysbus_init_mmio(dev, &s->buffers);
+    sysbus_init_mmio(sbd, &s->buffers);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_milkymist_minimac2_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     return 0;
@@ -532,7 +537,7 @@ static void milkymist_minimac2_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_minimac2_info = {
-    .name          = "milkymist-minimac2",
+    .name          = TYPE_MILKYMIST_MINIMAC2,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistMinimac2State),
     .class_init    = milkymist_minimac2_class_init,
commit b1a2aaf77499fe6ac059eeceacc8e70858f1c65d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:08:14 2013 +0200

    lance: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/lance.c b/hw/net/lance.c
index 1be7b72..e339f02 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -43,8 +43,13 @@
 #include "pcnet.h"
 #include "trace.h"
 
+#define TYPE_LANCE "lance"
+#define SYSBUS_PCNET(obj) \
+    OBJECT_CHECK(SysBusPCNetState, (obj), TYPE_LANCE)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     PCNetState state;
 } SysBusPCNetState;
 
@@ -112,28 +117,29 @@ static const VMStateDescription vmstate_lance = {
     }
 };
 
-static int lance_init(SysBusDevice *dev)
+static int lance_init(SysBusDevice *sbd)
 {
-    SysBusPCNetState *d = FROM_SYSBUS(SysBusPCNetState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SysBusPCNetState *d = SYSBUS_PCNET(dev);
     PCNetState *s = &d->state;
 
     memory_region_init_io(&s->mmio, OBJECT(d), &lance_mem_ops, d,
                           "lance-mmio", 4);
 
-    qdev_init_gpio_in(&dev->qdev, parent_lance_reset, 1);
+    qdev_init_gpio_in(dev, parent_lance_reset, 1);
 
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->phys_mem_read = ledma_memory_read;
     s->phys_mem_write = ledma_memory_write;
-    return pcnet_common_init(&dev->qdev, s, &net_lance_info);
+    return pcnet_common_init(dev, s, &net_lance_info);
 }
 
 static void lance_reset(DeviceState *dev)
 {
-    SysBusPCNetState *d = DO_UPCAST(SysBusPCNetState, busdev.qdev, dev);
+    SysBusPCNetState *d = SYSBUS_PCNET(dev);
 
     pcnet_h_reset(&d->state);
 }
@@ -158,7 +164,7 @@ static void lance_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lance_info = {
-    .name          = "lance",
+    .name          = TYPE_LANCE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysBusPCNetState),
     .class_init    = lance_class_init,
commit 3ff66d101be9e2f08db1b674495b489f3c969810
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:55:02 2013 +0200

    lan9118: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index 3323f48..2c838f6 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -170,8 +170,12 @@ static const VMStateDescription vmstate_lan9118_packet = {
     }
 };
 
+#define TYPE_LAN9118 "lan9118"
+#define LAN9118(obj) OBJECT_CHECK(lan9118_state, (obj), TYPE_LAN9118)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     qemu_irq irq;
@@ -401,7 +405,8 @@ static void phy_reset(lan9118_state *s)
 
 static void lan9118_reset(DeviceState *d)
 {
-    lan9118_state *s = FROM_SYSBUS(lan9118_state, SYS_BUS_DEVICE(d));
+    lan9118_state *s = LAN9118(d);
+
     s->irq_cfg &= (IRQ_TYPE | IRQ_POL);
     s->int_sts = 0;
     s->int_en = 0;
@@ -1053,7 +1058,7 @@ static void lan9118_writel(void *opaque, hwaddr offset,
     case CSR_HW_CFG:
         if (val & 1) {
             /* SRST */
-            lan9118_reset(&s->busdev.qdev);
+            lan9118_reset(DEVICE(s));
         } else {
             s->hw_cfg = (val & 0x003f300) | (s->hw_cfg & 0x4);
         }
@@ -1320,9 +1325,10 @@ static NetClientInfo net_lan9118_info = {
     .link_status_changed = lan9118_set_link,
 };
 
-static int lan9118_init1(SysBusDevice *dev)
+static int lan9118_init1(SysBusDevice *sbd)
 {
-    lan9118_state *s = FROM_SYSBUS(lan9118_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    lan9118_state *s = LAN9118(dev);
     QEMUBH *bh;
     int i;
     const MemoryRegionOps *mem_ops =
@@ -1330,12 +1336,12 @@ static int lan9118_init1(SysBusDevice *dev)
 
     memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
                           "lan9118-mmio", 0x100);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_lan9118_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     s->eeprom[0] = 0xa5;
     for (i = 0; i < 6; i++) {
@@ -1370,7 +1376,7 @@ static void lan9118_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lan9118_info = {
-    .name          = "lan9118",
+    .name          = TYPE_LAN9118,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(lan9118_state),
     .class_init    = lan9118_class_init,
@@ -1389,7 +1395,7 @@ void lan9118_init(NICInfo *nd, uint32_t base, qemu_irq irq)
     SysBusDevice *s;
 
     qemu_check_nic_model(nd, "lan9118");
-    dev = qdev_create(NULL, "lan9118");
+    dev = qdev_create(NULL, TYPE_LAN9118);
     qdev_set_nic_properties(dev, nd);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
commit 58076497dfeff9721ec8f7476336292c8e0eb8c7
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:48:42 2013 +0200

    etraxfs_eth: Rename fs_eth to ETRAXFSEthState
    
    Also add a typedef.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/etraxfs_eth.c b/hw/net/etraxfs_eth.c
index dda1fc3..78ebbbc 100644
--- a/hw/net/etraxfs_eth.c
+++ b/hw/net/etraxfs_eth.c
@@ -324,9 +324,9 @@ static void mdio_cycle(struct qemu_mdio *bus)
 
 #define TYPE_ETRAX_FS_ETH "etraxfs-eth"
 #define ETRAX_FS_ETH(obj) \
-    OBJECT_CHECK(struct fs_eth, (obj), TYPE_ETRAX_FS_ETH)
+    OBJECT_CHECK(ETRAXFSEthState, (obj), TYPE_ETRAX_FS_ETH)
 
-struct fs_eth
+typedef struct ETRAXFSEthState
 {
     SysBusDevice parent_obj;
 
@@ -354,9 +354,9 @@ struct fs_eth
 
     /* PHY.     */
     struct qemu_phy phy;
-};
+} ETRAXFSEthState;
 
-static void eth_validate_duplex(struct fs_eth *eth)
+static void eth_validate_duplex(ETRAXFSEthState *eth)
 {
     struct qemu_phy *phy;
     unsigned int phy_duplex;
@@ -387,7 +387,7 @@ static void eth_validate_duplex(struct fs_eth *eth)
 static uint64_t
 eth_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
     uint32_t r = 0;
 
     addr >>= 2;
@@ -404,7 +404,7 @@ eth_read(void *opaque, hwaddr addr, unsigned int size)
     return r;
 }
 
-static void eth_update_ma(struct fs_eth *eth, int ma)
+static void eth_update_ma(ETRAXFSEthState *eth, int ma)
 {
     int reg;
     int i = 0;
@@ -433,7 +433,7 @@ static void
 eth_write(void *opaque, hwaddr addr,
           uint64_t val64, unsigned int size)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
     uint32_t value = val64;
 
     addr >>= 2;
@@ -477,7 +477,7 @@ eth_write(void *opaque, hwaddr addr,
 /* The ETRAX FS has a groupt address table (GAT) which works like a k=1 bloom
    filter dropping group addresses we have not joined.    The filter has 64
    bits (m). The has function is a simple nible xor of the group addr.    */
-static int eth_match_groupaddr(struct fs_eth *eth, const unsigned char *sa)
+static int eth_match_groupaddr(ETRAXFSEthState *eth, const unsigned char *sa)
 {
     unsigned int hsh;
     int m_individual = eth->regs[RW_REC_CTRL] & 4;
@@ -528,7 +528,7 @@ static int eth_can_receive(NetClientState *nc)
 static ssize_t eth_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
     unsigned char sa_bcast[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
     int use_ma0 = eth->regs[RW_REC_CTRL] & 1;
     int use_ma1 = eth->regs[RW_REC_CTRL] & 2;
     int r_bcast = eth->regs[RW_REC_CTRL] & 8;
@@ -552,12 +552,12 @@ static ssize_t eth_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     /* FIXME: Find another way to pass on the fake csum.  */
     etraxfs_dmac_input(eth->dma_in, (void *)buf, size + 4, 1);
 
-        return size;
+    return size;
 }
 
 static int eth_tx_push(void *opaque, unsigned char *buf, int len, bool eop)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
 
     D(printf("%s buf=%p len=%d\n", __func__, buf, len));
     qemu_send_packet(qemu_get_queue(eth->nic), buf, len);
@@ -566,7 +566,7 @@ static int eth_tx_push(void *opaque, unsigned char *buf, int len, bool eop)
 
 static void eth_set_link(NetClientState *nc)
 {
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
     D(printf("%s %d\n", __func__, nc->link_down));
     eth->phy.link = !nc->link_down;
 }
@@ -583,7 +583,7 @@ static const MemoryRegionOps eth_ops = {
 
 static void eth_cleanup(NetClientState *nc)
 {
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
 
     /* Disconnect the client.  */
     eth->dma_out->client.push = NULL;
@@ -605,7 +605,7 @@ static NetClientInfo net_etraxfs_info = {
 static int fs_eth_init(SysBusDevice *sbd)
 {
     DeviceState *dev = DEVICE(sbd);
-    struct fs_eth *s = ETRAX_FS_ETH(dev);
+    ETRAXFSEthState *s = ETRAX_FS_ETH(dev);
 
     if (!s->dma_out || !s->dma_in) {
         hw_error("Unconnected ETRAX-FS Ethernet MAC.\n");
@@ -632,10 +632,10 @@ static int fs_eth_init(SysBusDevice *sbd)
 }
 
 static Property etraxfs_eth_properties[] = {
-    DEFINE_PROP_UINT32("phyaddr", struct fs_eth, phyaddr, 1),
-    DEFINE_PROP_PTR("dma_out", struct fs_eth, vdma_out),
-    DEFINE_PROP_PTR("dma_in", struct fs_eth, vdma_in),
-    DEFINE_NIC_PROPERTIES(struct fs_eth, conf),
+    DEFINE_PROP_UINT32("phyaddr", ETRAXFSEthState, phyaddr, 1),
+    DEFINE_PROP_PTR("dma_out", ETRAXFSEthState, vdma_out),
+    DEFINE_PROP_PTR("dma_in", ETRAXFSEthState, vdma_in),
+    DEFINE_NIC_PROPERTIES(ETRAXFSEthState, conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -651,7 +651,7 @@ static void etraxfs_eth_class_init(ObjectClass *klass, void *data)
 static const TypeInfo etraxfs_eth_info = {
     .name          = TYPE_ETRAX_FS_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct fs_eth),
+    .instance_size = sizeof(ETRAXFSEthState),
     .class_init    = etraxfs_eth_class_init,
 };
 
commit 8784dfa4bc3cb6ee3b6115ea52a4cae2874be7f9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:44:01 2013 +0200

    etraxfs_eth: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/etraxfs_eth.c b/hw/net/etraxfs_eth.c
index ab9a215..dda1fc3 100644
--- a/hw/net/etraxfs_eth.c
+++ b/hw/net/etraxfs_eth.c
@@ -322,9 +322,14 @@ static void mdio_cycle(struct qemu_mdio *bus)
 #define R_STAT          0x0b
 #define FS_ETH_MAX_REGS      0x17
 
+#define TYPE_ETRAX_FS_ETH "etraxfs-eth"
+#define ETRAX_FS_ETH(obj) \
+    OBJECT_CHECK(struct fs_eth, (obj), TYPE_ETRAX_FS_ETH)
+
 struct fs_eth
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     NICState *nic;
     NICConf conf;
@@ -597,9 +602,10 @@ static NetClientInfo net_etraxfs_info = {
     .link_status_changed = eth_set_link,
 };
 
-static int fs_eth_init(SysBusDevice *dev)
+static int fs_eth_init(SysBusDevice *sbd)
 {
-    struct fs_eth *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct fs_eth *s = ETRAX_FS_ETH(dev);
 
     if (!s->dma_out || !s->dma_in) {
         hw_error("Unconnected ETRAX-FS Ethernet MAC.\n");
@@ -612,11 +618,11 @@ static int fs_eth_init(SysBusDevice *dev)
 
     memory_region_init_io(&s->mmio, OBJECT(dev), &eth_ops, s,
                           "etraxfs-eth", 0x5c);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_etraxfs_info, &s->conf,
-                          object_get_typename(OBJECT(s)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(s)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
 
@@ -643,7 +649,7 @@ static void etraxfs_eth_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_eth_info = {
-    .name          = "etraxfs-eth",
+    .name          = TYPE_ETRAX_FS_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct fs_eth),
     .class_init    = etraxfs_eth_class_init,
commit 318643beaa50f49d3bfa9e318b067784d8fb4f30
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:39:47 2013 +0200

    cadence_gem: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index ac929cb..4a355bb 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -315,8 +315,12 @@ static inline void rx_desc_set_length(unsigned *desc, unsigned len)
     desc[1] |= len;
 }
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_CADENCE_GEM "cadence_gem"
+#define GEM(obj) OBJECT_CHECK(GemState, (obj), TYPE_CADENCE_GEM)
+
+typedef struct GemState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     NICState *nic;
     NICConf conf;
@@ -945,7 +949,7 @@ static void gem_phy_reset(GemState *s)
 
 static void gem_reset(DeviceState *d)
 {
-    GemState *s = FROM_SYSBUS(GemState, SYS_BUS_DEVICE(d));
+    GemState *s = GEM(d);
 
     DB_PRINT("\n");
 
@@ -1155,22 +1159,22 @@ static NetClientInfo net_gem_info = {
     .link_status_changed = gem_set_link,
 };
 
-static int gem_init(SysBusDevice *dev)
+static int gem_init(SysBusDevice *sbd)
 {
-    GemState *s;
+    DeviceState *dev = DEVICE(sbd);
+    GemState *s = GEM(dev);
 
     DB_PRINT("\n");
 
-    s = FROM_SYSBUS(GemState, dev);
     gem_init_register_masks(s);
     memory_region_init_io(&s->iomem, OBJECT(s), &gem_ops, s,
                           "enet", sizeof(s->regs));
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_gem_info, &s->conf,
-            object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+            object_get_typename(OBJECT(dev)), dev->id, s);
 
     return 0;
 }
@@ -1206,10 +1210,10 @@ static void gem_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo gem_info = {
-    .class_init = gem_class_init,
-    .name  = "cadence_gem",
+    .name  = TYPE_CADENCE_GEM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(GemState),
+    .class_init = gem_class_init,
 };
 
 static void gem_register_types(void)
commit a054e2c2ddea91c8e34fe847327c6250f6f791d6
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:29:03 2013 +0200

    zynq_slcr: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index fc7a85f..e42a5b0 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -114,8 +114,12 @@ typedef enum {
   RESET_MAX
 } ResetValues;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_ZYNQ_SLCR "xilinx,zynq_slcr"
+#define ZYNQ_SLCR(obj) OBJECT_CHECK(ZynqSLCRState, (obj), TYPE_ZYNQ_SLCR)
+
+typedef struct ZynqSLCRState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     union {
@@ -158,9 +162,8 @@ typedef struct {
 
 static void zynq_slcr_reset(DeviceState *d)
 {
+    ZynqSLCRState *s = ZYNQ_SLCR(d);
     int i;
-    ZynqSLCRState *s =
-            FROM_SYSBUS(ZynqSLCRState, SYS_BUS_DEVICE(d));
 
     DB_PRINT("RESET\n");
 
@@ -492,7 +495,7 @@ static const MemoryRegionOps slcr_ops = {
 
 static int zynq_slcr_init(SysBusDevice *dev)
 {
-    ZynqSLCRState *s = FROM_SYSBUS(ZynqSLCRState, dev);
+    ZynqSLCRState *s = ZYNQ_SLCR(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &slcr_ops, s, "slcr", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -523,7 +526,7 @@ static void zynq_slcr_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo zynq_slcr_info = {
     .class_init = zynq_slcr_class_init,
-    .name  = "xilinx,zynq_slcr",
+    .name  = TYPE_ZYNQ_SLCR,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(ZynqSLCRState),
 };
commit f1a0a79f4faeac50ea490496e92d00d7260d9437
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:21:50 2013 +0200

    slavio_misc: QOM cast cleanup for APCState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index 1b93a01..767544e 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -57,8 +57,12 @@ typedef struct MiscState {
     uint16_t leds;
 } MiscState;
 
+#define TYPE_APC "apc"
+#define APC(obj) OBJECT_CHECK(APCState, (obj), TYPE_APC)
+
 typedef struct APCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq cpu_halt;
 } APCState;
@@ -411,7 +415,7 @@ static const VMStateDescription vmstate_misc = {
 
 static int apc_init1(SysBusDevice *dev)
 {
-    APCState *s = FROM_SYSBUS(APCState, dev);
+    APCState *s = APC(dev);
 
     sysbus_init_irq(dev, &s->cpu_halt);
 
@@ -498,7 +502,7 @@ static void apc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo apc_info = {
-    .name          = "apc",
+    .name          = TYPE_APC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MiscState),
     .class_init    = apc_class_init,
commit 95eb2084f9e59c50cb989ef0e717e0d933bd1480
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:19:11 2013 +0200

    slavio_misc: QOM cast cleanup for MiscState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index 00d9542..1b93a01 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -34,8 +34,12 @@
  * This also includes the PMC CPU idle controller.
  */
 
+#define TYPE_SLAVIO_MISC "slavio_misc"
+#define SLAVIO_MISC(obj) OBJECT_CHECK(MiscState, (obj), TYPE_SLAVIO_MISC)
+
 typedef struct MiscState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion cfg_iomem;
     MemoryRegion diag_iomem;
     MemoryRegion mdm_iomem;
@@ -88,7 +92,7 @@ static void slavio_misc_update_irq(void *opaque)
 
 static void slavio_misc_reset(DeviceState *d)
 {
-    MiscState *s = container_of(d, MiscState, busdev.qdev);
+    MiscState *s = SLAVIO_MISC(d);
 
     // Diagnostic and system control registers not cleared in reset
     s->config = s->aux1 = s->aux2 = s->mctrl = 0;
@@ -418,52 +422,53 @@ static int apc_init1(SysBusDevice *dev)
     return 0;
 }
 
-static int slavio_misc_init1(SysBusDevice *dev)
+static int slavio_misc_init1(SysBusDevice *sbd)
 {
-    MiscState *s = FROM_SYSBUS(MiscState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    MiscState *s = SLAVIO_MISC(dev);
 
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fdc_tc);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fdc_tc);
 
     /* 8 bit registers */
     /* Slavio control */
     memory_region_init_io(&s->cfg_iomem, OBJECT(s), &slavio_cfg_mem_ops, s,
                           "configuration", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->cfg_iomem);
+    sysbus_init_mmio(sbd, &s->cfg_iomem);
 
     /* Diagnostics */
     memory_region_init_io(&s->diag_iomem, OBJECT(s), &slavio_diag_mem_ops, s,
                           "diagnostic", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->diag_iomem);
+    sysbus_init_mmio(sbd, &s->diag_iomem);
 
     /* Modem control */
     memory_region_init_io(&s->mdm_iomem, OBJECT(s), &slavio_mdm_mem_ops, s,
                           "modem", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->mdm_iomem);
+    sysbus_init_mmio(sbd, &s->mdm_iomem);
 
     /* 16 bit registers */
     /* ss600mp diag LEDs */
     memory_region_init_io(&s->led_iomem, OBJECT(s), &slavio_led_mem_ops, s,
                           "leds", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->led_iomem);
+    sysbus_init_mmio(sbd, &s->led_iomem);
 
     /* 32 bit registers */
     /* System control */
     memory_region_init_io(&s->sysctrl_iomem, OBJECT(s), &slavio_sysctrl_mem_ops, s,
                           "system-control", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->sysctrl_iomem);
+    sysbus_init_mmio(sbd, &s->sysctrl_iomem);
 
     /* AUX 1 (Misc System Functions) */
     memory_region_init_io(&s->aux1_iomem, OBJECT(s), &slavio_aux1_mem_ops, s,
                           "misc-system-functions", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->aux1_iomem);
+    sysbus_init_mmio(sbd, &s->aux1_iomem);
 
     /* AUX 2 (Software Powerdown Control) */
     memory_region_init_io(&s->aux2_iomem, OBJECT(s), &slavio_aux2_mem_ops, s,
                           "software-powerdown-control", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->aux2_iomem);
+    sysbus_init_mmio(sbd, &s->aux2_iomem);
 
-    qdev_init_gpio_in(&dev->qdev, slavio_set_power_fail, 1);
+    qdev_init_gpio_in(dev, slavio_set_power_fail, 1);
 
     return 0;
 }
@@ -479,7 +484,7 @@ static void slavio_misc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo slavio_misc_info = {
-    .name          = "slavio_misc",
+    .name          = TYPE_SLAVIO_MISC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MiscState),
     .class_init    = slavio_misc_class_init,
commit af89a444932111807b4a5a5a799829c98bdab560
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:16:03 2013 +0200

    puv3_pm: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/puv3_pm.c b/hw/misc/puv3_pm.c
index 5592560..37f2369 100644
--- a/hw/misc/puv3_pm.c
+++ b/hw/misc/puv3_pm.c
@@ -14,8 +14,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_PM "puv3_pm"
+#define PUV3_PM(obj) OBJECT_CHECK(PUV3PMState, (obj), TYPE_PUV3_PM)
+
+typedef struct PUV3PMState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t reg_PMCR;
@@ -116,7 +120,7 @@ static const MemoryRegionOps puv3_pm_ops = {
 
 static int puv3_pm_init(SysBusDevice *dev)
 {
-    PUV3PMState *s = FROM_SYSBUS(PUV3PMState, dev);
+    PUV3PMState *s = PUV3_PM(dev);
 
     s->reg_PCGR = 0x0;
 
@@ -135,7 +139,7 @@ static void puv3_pm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_pm_info = {
-    .name = "puv3_pm",
+    .name = TYPE_PUV3_PM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3PMState),
     .class_init = puv3_pm_class_init,
commit 5c0e12f5a6f6da6cc63e4d0fd309f4699300daa0
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 22:32:18 2013 +0200

    mst_fpga: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/mst_fpga.c b/hw/misc/mst_fpga.c
index 604be5e..c96810f 100644
--- a/hw/misc/mst_fpga.c
+++ b/hw/misc/mst_fpga.c
@@ -35,25 +35,30 @@
 #define MST_PCMCIA_CD0_IRQ	9
 #define MST_PCMCIA_CD1_IRQ	13
 
+#define TYPE_MAINSTONE_FPGA "mainstone-fpga"
+#define MAINSTONE_FPGA(obj) \
+    OBJECT_CHECK(mst_irq_state, (obj), TYPE_MAINSTONE_FPGA)
+
 typedef struct mst_irq_state{
-	SysBusDevice busdev;
-	MemoryRegion iomem;
-
-	qemu_irq parent;
-
-	uint32_t prev_level;
-	uint32_t leddat1;
-	uint32_t leddat2;
-	uint32_t ledctrl;
-	uint32_t gpswr;
-	uint32_t mscwr1;
-	uint32_t mscwr2;
-	uint32_t mscwr3;
-	uint32_t mscrd;
-	uint32_t intmskena;
-	uint32_t intsetclr;
-	uint32_t pcmcia0;
-	uint32_t pcmcia1;
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+
+    qemu_irq parent;
+
+    uint32_t prev_level;
+    uint32_t leddat1;
+    uint32_t leddat2;
+    uint32_t ledctrl;
+    uint32_t gpswr;
+    uint32_t mscwr1;
+    uint32_t mscwr2;
+    uint32_t mscwr3;
+    uint32_t mscrd;
+    uint32_t intmskena;
+    uint32_t intsetclr;
+    uint32_t pcmcia0;
+    uint32_t pcmcia1;
 }mst_irq_state;
 
 static void
@@ -194,24 +199,23 @@ static int mst_fpga_post_load(void *opaque, int version_id)
 	return 0;
 }
 
-static int mst_fpga_init(SysBusDevice *dev)
+static int mst_fpga_init(SysBusDevice *sbd)
 {
-	mst_irq_state *s;
-
-	s = FROM_SYSBUS(mst_irq_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mst_irq_state *s = MAINSTONE_FPGA(dev);
 
-	s->pcmcia0 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
-	s->pcmcia1 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
+    s->pcmcia0 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
+    s->pcmcia1 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
 
-	sysbus_init_irq(dev, &s->parent);
+    sysbus_init_irq(sbd, &s->parent);
 
-	/* alloc the external 16 irqs */
-	qdev_init_gpio_in(&dev->qdev, mst_fpga_set_irq, MST_NUM_IRQS);
+    /* alloc the external 16 irqs */
+    qdev_init_gpio_in(dev, mst_fpga_set_irq, MST_NUM_IRQS);
 
-	memory_region_init_io(&s->iomem, OBJECT(s), &mst_fpga_ops, s,
-			    "fpga", 0x00100000);
-	sysbus_init_mmio(dev, &s->iomem);
-	return 0;
+    memory_region_init_io(&s->iomem, OBJECT(s), &mst_fpga_ops, s,
+                          "fpga", 0x00100000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    return 0;
 }
 
 static VMStateDescription vmstate_mst_fpga_regs = {
@@ -249,7 +253,7 @@ static void mst_fpga_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mst_fpga_info = {
-    .name          = "mainstone-fpga",
+    .name          = TYPE_MAINSTONE_FPGA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mst_irq_state),
     .class_init    = mst_fpga_class_init,
commit aee31f7b4b7e23cfcdab604b6edc5e7df8d5c32f
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 22:27:57 2013 +0200

    milkymist-pfpu: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/milkymist-pfpu.c b/hw/misc/milkymist-pfpu.c
index 2b64ee7..b3b2143 100644
--- a/hw/misc/milkymist-pfpu.c
+++ b/hw/misc/milkymist-pfpu.c
@@ -116,8 +116,13 @@ static const char *opcode_to_str[] = {
 };
 #endif
 
+#define TYPE_MILKYMIST_PFPU "milkymist-pfpu"
+#define MILKYMIST_PFPU(obj) \
+    OBJECT_CHECK(MilkymistPFPUState, (obj), TYPE_MILKYMIST_PFPU)
+
 struct MilkymistPFPUState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -473,7 +478,7 @@ static const MemoryRegionOps pfpu_mmio_ops = {
 
 static void milkymist_pfpu_reset(DeviceState *d)
 {
-    MilkymistPFPUState *s = container_of(d, MilkymistPFPUState, busdev.qdev);
+    MilkymistPFPUState *s = MILKYMIST_PFPU(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -493,7 +498,7 @@ static void milkymist_pfpu_reset(DeviceState *d)
 
 static int milkymist_pfpu_init(SysBusDevice *dev)
 {
-    MilkymistPFPUState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistPFPUState *s = MILKYMIST_PFPU(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -530,7 +535,7 @@ static void milkymist_pfpu_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_pfpu_info = {
-    .name          = "milkymist-pfpu",
+    .name          = TYPE_MILKYMIST_PFPU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistPFPUState),
     .class_init    = milkymist_pfpu_class_init,
commit 829617a97cd4316872465db6b28d304e49f45f05
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 22:24:22 2013 +0200

    milkymist-hpdmc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/milkymist-hpdmc.c b/hw/misc/milkymist-hpdmc.c
index a498881..aef135e 100644
--- a/hw/misc/milkymist-hpdmc.c
+++ b/hw/misc/milkymist-hpdmc.c
@@ -40,8 +40,13 @@ enum {
     IODELAY_PLL2_LOCKED  = (1<<7),
 };
 
+#define TYPE_MILKYMIST_HPDMC "milkymist-hpdmc"
+#define MILKYMIST_HPDMC(obj) \
+    OBJECT_CHECK(MilkymistHpdmcState, (obj), TYPE_MILKYMIST_HPDMC)
+
 struct MilkymistHpdmcState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     uint32_t regs[R_MAX];
@@ -111,7 +116,7 @@ static const MemoryRegionOps hpdmc_mmio_ops = {
 
 static void milkymist_hpdmc_reset(DeviceState *d)
 {
-    MilkymistHpdmcState *s = container_of(d, MilkymistHpdmcState, busdev.qdev);
+    MilkymistHpdmcState *s = MILKYMIST_HPDMC(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -125,7 +130,7 @@ static void milkymist_hpdmc_reset(DeviceState *d)
 
 static int milkymist_hpdmc_init(SysBusDevice *dev)
 {
-    MilkymistHpdmcState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistHpdmcState *s = MILKYMIST_HPDMC(dev);
 
     memory_region_init_io(&s->regs_region, OBJECT(dev), &hpdmc_mmio_ops, s,
             "milkymist-hpdmc", R_MAX * 4);
@@ -156,7 +161,7 @@ static void milkymist_hpdmc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_hpdmc_info = {
-    .name          = "milkymist-hpdmc",
+    .name          = TYPE_MILKYMIST_HPDMC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistHpdmcState),
     .class_init    = milkymist_hpdmc_class_init,
commit 816d323be3e66b82cd92657c783c0e5e7b88d6d9
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:59:04 2013 +0200

    lm32_sys: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/lm32_sys.c b/hw/misc/lm32_sys.c
index 060a5bf..9bdb781 100644
--- a/hw/misc/lm32_sys.c
+++ b/hw/misc/lm32_sys.c
@@ -44,8 +44,12 @@ enum {
 
 #define MAX_TESTNAME_LEN 16
 
+#define TYPE_LM32_SYS "lm32-sys"
+#define LM32_SYS(obj) OBJECT_CHECK(LM32SysState, (obj), TYPE_LM32_SYS)
+
 struct LM32SysState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t base;
     uint32_t regs[R_MAX];
@@ -104,7 +108,7 @@ static const MemoryRegionOps sys_ops = {
 
 static void sys_reset(DeviceState *d)
 {
-    LM32SysState *s = container_of(d, LM32SysState, busdev.qdev);
+    LM32SysState *s = LM32_SYS(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -115,7 +119,7 @@ static void sys_reset(DeviceState *d)
 
 static int lm32_sys_init(SysBusDevice *dev)
 {
-    LM32SysState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32SysState *s = LM32_SYS(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &sys_ops , s,
                           "sys", R_MAX * 4);
@@ -158,7 +162,7 @@ static void lm32_sys_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_sys_info = {
-    .name          = "lm32-sys",
+    .name          = TYPE_LM32_SYS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32SysState),
     .class_init    = lm32_sys_class_init,
commit b6e1df2e91fbf89226605a9459bc86c2aa0a404e
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:47:58 2013 +0200

    exynos4210_pmu: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index 28395ba..cbf0795 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -386,8 +386,13 @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
 #define PMU_NUM_OF_REGISTERS     \
     (sizeof(exynos4210_pmu_regs) / sizeof(Exynos4210PmuReg))
 
+#define TYPE_EXYNOS4210_PMU "exynos4210.pmu"
+#define EXYNOS4210_PMU(obj) \
+    OBJECT_CHECK(Exynos4210PmuState, (obj), TYPE_EXYNOS4210_PMU)
+
 typedef struct Exynos4210PmuState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t reg[PMU_NUM_OF_REGISTERS];
 } Exynos4210PmuState;
@@ -443,8 +448,7 @@ static const MemoryRegionOps exynos4210_pmu_ops = {
 
 static void exynos4210_pmu_reset(DeviceState *dev)
 {
-    Exynos4210PmuState *s =
-            container_of(dev, Exynos4210PmuState, busdev.qdev);
+    Exynos4210PmuState *s = EXYNOS4210_PMU(dev);
     unsigned i;
 
     /* Set default values for registers */
@@ -455,7 +459,7 @@ static void exynos4210_pmu_reset(DeviceState *dev)
 
 static int exynos4210_pmu_init(SysBusDevice *dev)
 {
-    Exynos4210PmuState *s = FROM_SYSBUS(Exynos4210PmuState, dev);
+    Exynos4210PmuState *s = EXYNOS4210_PMU(dev);
 
     /* memory mapping */
     memory_region_init_io(&s->iomem, OBJECT(dev), &exynos4210_pmu_ops, s,
@@ -485,7 +489,7 @@ static void exynos4210_pmu_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_pmu_info = {
-    .name          = "exynos4210.pmu",
+    .name          = TYPE_EXYNOS4210_PMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210PmuState),
     .class_init    = exynos4210_pmu_class_init,
commit 100bb15cb8e8788cca36f708c51c3d8e03041759
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:39:54 2013 +0200

    eccmemctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/eccmemctl.c b/hw/misc/eccmemctl.c
index 3de9675..96a69d4 100644
--- a/hw/misc/eccmemctl.c
+++ b/hw/misc/eccmemctl.c
@@ -120,8 +120,12 @@
 #define ECC_DIAG_SIZE  4
 #define ECC_DIAG_MASK  (ECC_DIAG_SIZE - 1)
 
+#define TYPE_ECC_MEMCTL "eccmemctl"
+#define ECC_MEMCTL(obj) OBJECT_CHECK(ECCState, (obj), TYPE_ECC_MEMCTL)
+
 typedef struct ECCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem, iomem_diag;
     qemu_irq irq;
     uint32_t regs[ECC_NREGS];
@@ -273,13 +277,14 @@ static const VMStateDescription vmstate_ecc = {
 
 static void ecc_reset(DeviceState *d)
 {
-    ECCState *s = container_of(d, ECCState, busdev.qdev);
+    ECCState *s = ECC_MEMCTL(d);
 
-    if (s->version == ECC_MCC)
+    if (s->version == ECC_MCC) {
         s->regs[ECC_MER] &= ECC_MER_REU;
-    else
+    } else {
         s->regs[ECC_MER] &= (ECC_MER_VER | ECC_MER_IMPL | ECC_MER_MRR |
                              ECC_MER_DCI);
+    }
     s->regs[ECC_MDR] = 0x20;
     s->regs[ECC_MFSR] = 0;
     s->regs[ECC_VCR] = 0;
@@ -292,7 +297,7 @@ static void ecc_reset(DeviceState *d)
 
 static int ecc_init1(SysBusDevice *dev)
 {
-    ECCState *s = FROM_SYSBUS(ECCState, dev);
+    ECCState *s = ECC_MEMCTL(dev);
 
     sysbus_init_irq(dev, &s->irq);
     s->regs[0] = s->version;
@@ -325,7 +330,7 @@ static void ecc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ecc_info = {
-    .name          = "eccmemctl",
+    .name          = TYPE_ECC_MEMCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ECCState),
     .class_init    = ecc_class_init,
commit ba4ea5bd299c03a7af87b0881ea6d445c46beddf
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:34:18 2013 +0200

    arm_sysctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c
index 5906ae5..4a911d4 100644
--- a/hw/misc/arm_sysctl.c
+++ b/hw/misc/arm_sysctl.c
@@ -16,8 +16,13 @@
 
 #define LOCK_VALUE 0xa05f
 
+#define TYPE_ARM_SYSCTL "realview_sysctl"
+#define ARM_SYSCTL(obj) \
+    OBJECT_CHECK(arm_sysctl_state, (obj), TYPE_ARM_SYSCTL)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq pl110_mux_ctrl;
 
@@ -85,7 +90,7 @@ static int board_id(arm_sysctl_state *s)
 
 static void arm_sysctl_reset(DeviceState *d)
 {
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, SYS_BUS_DEVICE(d));
+    arm_sysctl_state *s = ARM_SYSCTL(d);
     int i;
 
     s->leds = 0;
@@ -587,7 +592,7 @@ static void arm_sysctl_init(Object *obj)
 {
     DeviceState *dev = DEVICE(obj);
     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, sd);
+    arm_sysctl_state *s = ARM_SYSCTL(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &arm_sysctl_ops, s,
                           "arm-sysctl", 0x1000);
@@ -598,14 +603,15 @@ static void arm_sysctl_init(Object *obj)
 
 static void arm_sysctl_realize(DeviceState *d, Error **errp)
 {
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, SYS_BUS_DEVICE(d));
+    arm_sysctl_state *s = ARM_SYSCTL(d);
+
     s->db_clock = g_new0(uint32_t, s->db_num_clocks);
 }
 
 static void arm_sysctl_finalize(Object *obj)
 {
-    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, dev);
+    arm_sysctl_state *s = ARM_SYSCTL(obj);
+
     g_free(s->db_voltage);
     g_free(s->db_clock);
     g_free(s->db_clock_reset);
@@ -634,7 +640,7 @@ static void arm_sysctl_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo arm_sysctl_info = {
-    .name          = "realview_sysctl",
+    .name          = TYPE_ARM_SYSCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(arm_sysctl_state),
     .instance_init = arm_sysctl_init,
commit 0e8982e969304995dfa39e6767b0152564a72130
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:20:52 2013 +0200

    arm_l2x0: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index f3ce477..8e192cd 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -23,8 +23,12 @@
 /* L2C-310 r3p2 */
 #define CACHE_ID 0x410000c8
 
+#define TYPE_ARM_L2X0 "l2x0"
+#define ARM_L2X0(obj) OBJECT_CHECK(L2x0State, (obj), TYPE_ARM_L2X0)
+
 typedef struct L2x0State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t cache_type;
     uint32_t ctrl;
@@ -137,7 +141,7 @@ static void l2x0_priv_write(void *opaque, hwaddr offset,
 
 static void l2x0_priv_reset(DeviceState *dev)
 {
-    L2x0State *s = DO_UPCAST(L2x0State, busdev.qdev, dev);
+    L2x0State *s = ARM_L2X0(dev);
 
     s->ctrl = 0;
     s->aux_ctrl = 0x02020000;
@@ -155,7 +159,7 @@ static const MemoryRegionOps l2x0_mem_ops = {
 
 static int l2x0_priv_init(SysBusDevice *dev)
 {
-    L2x0State *s = FROM_SYSBUS(L2x0State, dev);
+    L2x0State *s = ARM_L2X0(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &l2x0_mem_ops, s,
                           "l2x0_cc", 0x1000);
@@ -181,7 +185,7 @@ static void l2x0_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo l2x0_info = {
-    .name = "l2x0",
+    .name = TYPE_ARM_L2X0,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(L2x0State),
     .class_init = l2x0_class_init,
commit ae1953d045eb1fdfc21279284d78c7f23aba9762
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:18:35 2013 +0200

    arm_l2x0: Rename l2x0_state to L2x0State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index 3d6acee..f3ce477 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -23,7 +23,7 @@
 /* L2C-310 r3p2 */
 #define CACHE_ID 0x410000c8
 
-typedef struct l2x0_state {
+typedef struct L2x0State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t cache_type;
@@ -33,19 +33,19 @@ typedef struct l2x0_state {
     uint32_t tag_ctrl;
     uint32_t filter_start;
     uint32_t filter_end;
-} l2x0_state;
+} L2x0State;
 
 static const VMStateDescription vmstate_l2x0 = {
     .name = "l2x0",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(ctrl, l2x0_state),
-        VMSTATE_UINT32(aux_ctrl, l2x0_state),
-        VMSTATE_UINT32(data_ctrl, l2x0_state),
-        VMSTATE_UINT32(tag_ctrl, l2x0_state),
-        VMSTATE_UINT32(filter_start, l2x0_state),
-        VMSTATE_UINT32(filter_end, l2x0_state),
+        VMSTATE_UINT32(ctrl, L2x0State),
+        VMSTATE_UINT32(aux_ctrl, L2x0State),
+        VMSTATE_UINT32(data_ctrl, L2x0State),
+        VMSTATE_UINT32(tag_ctrl, L2x0State),
+        VMSTATE_UINT32(filter_start, L2x0State),
+        VMSTATE_UINT32(filter_end, L2x0State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -55,7 +55,7 @@ static uint64_t l2x0_priv_read(void *opaque, hwaddr offset,
                                unsigned size)
 {
     uint32_t cache_data;
-    l2x0_state *s = (l2x0_state *)opaque;
+    L2x0State *s = (L2x0State *)opaque;
     offset &= 0xfff;
     if (offset >= 0x730 && offset < 0x800) {
         return 0; /* cache ops complete */
@@ -97,7 +97,7 @@ static uint64_t l2x0_priv_read(void *opaque, hwaddr offset,
 static void l2x0_priv_write(void *opaque, hwaddr offset,
                             uint64_t value, unsigned size)
 {
-    l2x0_state *s = (l2x0_state *)opaque;
+    L2x0State *s = (L2x0State *)opaque;
     offset &= 0xfff;
     if (offset >= 0x730 && offset < 0x800) {
         /* ignore */
@@ -137,7 +137,7 @@ static void l2x0_priv_write(void *opaque, hwaddr offset,
 
 static void l2x0_priv_reset(DeviceState *dev)
 {
-    l2x0_state *s = DO_UPCAST(l2x0_state, busdev.qdev, dev);
+    L2x0State *s = DO_UPCAST(L2x0State, busdev.qdev, dev);
 
     s->ctrl = 0;
     s->aux_ctrl = 0x02020000;
@@ -155,7 +155,7 @@ static const MemoryRegionOps l2x0_mem_ops = {
 
 static int l2x0_priv_init(SysBusDevice *dev)
 {
-    l2x0_state *s = FROM_SYSBUS(l2x0_state, dev);
+    L2x0State *s = FROM_SYSBUS(L2x0State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &l2x0_mem_ops, s,
                           "l2x0_cc", 0x1000);
@@ -164,7 +164,7 @@ static int l2x0_priv_init(SysBusDevice *dev)
 }
 
 static Property l2x0_properties[] = {
-    DEFINE_PROP_UINT32("cache-type", l2x0_state, cache_type, 0x1c100100),
+    DEFINE_PROP_UINT32("cache-type", L2x0State, cache_type, 0x1c100100),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -183,7 +183,7 @@ static void l2x0_class_init(ObjectClass *klass, void *data)
 static const TypeInfo l2x0_info = {
     .name = "l2x0",
     .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(l2x0_state),
+    .instance_size = sizeof(L2x0State),
     .class_init = l2x0_class_init,
 };
 
commit cc3e064ee948c612c38aa99a364f5af95422e5ec
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:46:22 2013 +0200

    xilinx_intc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/xilinx_intc.c b/hw/intc/xilinx_intc.c
index 25d2057..4a10398 100644
--- a/hw/intc/xilinx_intc.c
+++ b/hw/intc/xilinx_intc.c
@@ -37,9 +37,13 @@
 #define R_MER       7
 #define R_MAX       8
 
+#define TYPE_XILINX_INTC "xlnx.xps-intc"
+#define XILINX_INTC(obj) OBJECT_CHECK(struct xlx_pic, (obj), TYPE_XILINX_INTC)
+
 struct xlx_pic
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq parent_irq;
 
@@ -153,16 +157,17 @@ static void irq_handler(void *opaque, int irq, int level)
     update_irq(p);
 }
 
-static int xilinx_intc_init(SysBusDevice *dev)
+static int xilinx_intc_init(SysBusDevice *sbd)
 {
-    struct xlx_pic *p = FROM_SYSBUS(typeof (*p), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct xlx_pic *p = XILINX_INTC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &p->parent_irq);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &p->parent_irq);
 
     memory_region_init_io(&p->mmio, OBJECT(p), &pic_ops, p, "xlnx.xps-intc",
                           R_MAX * 4);
-    sysbus_init_mmio(dev, &p->mmio);
+    sysbus_init_mmio(sbd, &p->mmio);
     return 0;
 }
 
@@ -181,7 +186,7 @@ static void xilinx_intc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_intc_info = {
-    .name          = "xlnx.xps-intc",
+    .name          = TYPE_XILINX_INTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct xlx_pic),
     .class_init    = xilinx_intc_class_init,
commit 7abad863d7249b4b501923c3c28d952c473bf23a
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:40:40 2013 +0200

    slavio_intctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index b47d0f0..41a1672 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -53,8 +53,13 @@ typedef struct SLAVIO_CPUINTCTLState {
     uint32_t irl_out;
 } SLAVIO_CPUINTCTLState;
 
+#define TYPE_SLAVIO_INTCTL "slavio_intctl"
+#define SLAVIO_INTCTL(obj) \
+    OBJECT_CHECK(SLAVIO_INTCTLState, (obj), TYPE_SLAVIO_INTCTL)
+
 typedef struct SLAVIO_INTCTLState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 #ifdef DEBUG_IRQ_COUNT
     uint64_t irq_count[32];
@@ -206,12 +211,9 @@ static const MemoryRegionOps slavio_intctlm_mem_ops = {
 
 void slavio_pic_info(Monitor *mon, DeviceState *dev)
 {
-    SysBusDevice *sd;
-    SLAVIO_INTCTLState *s;
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     int i;
 
-    sd = SYS_BUS_DEVICE(dev);
-    s = FROM_SYSBUS(SLAVIO_INTCTLState, sd);
     for (i = 0; i < MAX_CPUS; i++) {
         monitor_printf(mon, "per-cpu %d: pending 0x%08x\n", i,
                        s->slaves[i].intreg_pending);
@@ -225,13 +227,11 @@ void slavio_irq_info(Monitor *mon, DeviceState *dev)
 #ifndef DEBUG_IRQ_COUNT
     monitor_printf(mon, "irq statistic code not compiled.\n");
 #else
-    SysBusDevice *sd;
-    SLAVIO_INTCTLState *s;
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     int i;
     int64_t count;
 
-    sd = SYS_BUS_DEVICE(dev);
-    s = FROM_SYSBUS(SLAVIO_INTCTLState, sd);
+    s = SLAVIO_INTCTL(dev);
     monitor_printf(mon, "IRQ statistics:\n");
     for (i = 0; i < 32; i++) {
         count = s->irq_count[i];
@@ -406,7 +406,7 @@ static const VMStateDescription vmstate_intctl = {
 
 static void slavio_intctl_reset(DeviceState *d)
 {
-    SLAVIO_INTCTLState *s = container_of(d, SLAVIO_INTCTLState, busdev.qdev);
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(d);
     int i;
 
     for (i = 0; i < MAX_CPUS; i++) {
@@ -419,27 +419,28 @@ static void slavio_intctl_reset(DeviceState *d)
     slavio_check_interrupts(s, 0);
 }
 
-static int slavio_intctl_init1(SysBusDevice *dev)
+static int slavio_intctl_init1(SysBusDevice *sbd)
 {
-    SLAVIO_INTCTLState *s = FROM_SYSBUS(SLAVIO_INTCTLState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     unsigned int i, j;
     char slave_name[45];
 
-    qdev_init_gpio_in(&dev->qdev, slavio_set_irq_all, 32 + MAX_CPUS);
+    qdev_init_gpio_in(dev, slavio_set_irq_all, 32 + MAX_CPUS);
     memory_region_init_io(&s->iomem, OBJECT(s), &slavio_intctlm_mem_ops, s,
                           "master-interrupt-controller", INTCTLM_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     for (i = 0; i < MAX_CPUS; i++) {
         snprintf(slave_name, sizeof(slave_name),
                  "slave-interrupt-controller-%i", i);
         for (j = 0; j < MAX_PILS; j++) {
-            sysbus_init_irq(dev, &s->cpu_irqs[i][j]);
+            sysbus_init_irq(sbd, &s->cpu_irqs[i][j]);
         }
         memory_region_init_io(&s->slaves[i].iomem, OBJECT(s),
                               &slavio_intctl_mem_ops,
                               &s->slaves[i], slave_name, INTCTL_SIZE);
-        sysbus_init_mmio(dev, &s->slaves[i].iomem);
+        sysbus_init_mmio(sbd, &s->slaves[i].iomem);
         s->slaves[i].cpu = i;
         s->slaves[i].master = s;
     }
@@ -458,7 +459,7 @@ static void slavio_intctl_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo slavio_intctl_info = {
-    .name          = "slavio_intctl",
+    .name          = TYPE_SLAVIO_INTCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLAVIO_INTCTLState),
     .class_init    = slavio_intctl_class_init,
commit b09a6f7b30591a5de4c4ceb22e3063a81e7317c4
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:34:29 2013 +0200

    realview_gic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/realview_gic.c b/hw/intc/realview_gic.c
index e122c2c..ce80447 100644
--- a/hw/intc/realview_gic.c
+++ b/hw/intc/realview_gic.c
@@ -9,8 +9,13 @@
 
 #include "hw/sysbus.h"
 
+#define TYPE_REALVIEW_GIC "realview_gic"
+#define REALVIEW_GIC(obj) \
+    OBJECT_CHECK(RealViewGICState, (obj), TYPE_REALVIEW_GIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     DeviceState *gic;
     MemoryRegion container;
 } RealViewGICState;
@@ -21,9 +26,10 @@ static void realview_gic_set_irq(void *opaque, int irq, int level)
     qemu_set_irq(qdev_get_gpio_in(s->gic, irq), level);
 }
 
-static int realview_gic_init(SysBusDevice *dev)
+static int realview_gic_init(SysBusDevice *sbd)
 {
-    RealViewGICState *s = FROM_SYSBUS(RealViewGICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    RealViewGICState *s = REALVIEW_GIC(dev);
     SysBusDevice *busdev;
     /* The GICs on the RealView boards have a fixed nonconfigurable
      * number of interrupt lines, so we don't need to expose this as
@@ -38,10 +44,10 @@ static int realview_gic_init(SysBusDevice *dev)
     busdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, busdev);
+    sysbus_pass_irq(sbd, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, realview_gic_set_irq, numirq - 32);
+    qdev_init_gpio_in(dev, realview_gic_set_irq, numirq - 32);
 
     memory_region_init(&s->container, OBJECT(s),
                        "realview-gic-container", 0x2000);
@@ -49,7 +55,7 @@ static int realview_gic_init(SysBusDevice *dev)
                                 sysbus_mmio_get_region(busdev, 1));
     memory_region_add_subregion(&s->container, 0x1000,
                                 sysbus_mmio_get_region(busdev, 0));
-    sysbus_init_mmio(dev, &s->container);
+    sysbus_init_mmio(sbd, &s->container);
     return 0;
 }
 
@@ -61,7 +67,7 @@ static void realview_gic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo realview_gic_info = {
-    .name          = "realview_gic",
+    .name          = TYPE_REALVIEW_GIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RealViewGICState),
     .class_init    = realview_gic_class_init,
commit 1ecdf4022ad968f4346905c269247ff3c5d2aa2d
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:30:57 2013 +0200

    puv3_intc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/puv3_intc.c b/hw/intc/puv3_intc.c
index 44b6651..c2803d0 100644
--- a/hw/intc/puv3_intc.c
+++ b/hw/intc/puv3_intc.c
@@ -13,8 +13,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_INTC "puv3_intc"
+#define PUV3_INTC(obj) OBJECT_CHECK(PUV3INTCState, (obj), TYPE_PUV3_INTC)
+
+typedef struct PUV3INTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq parent_irq;
 
@@ -96,19 +100,20 @@ static const MemoryRegionOps puv3_intc_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int puv3_intc_init(SysBusDevice *dev)
+static int puv3_intc_init(SysBusDevice *sbd)
 {
-    PUV3INTCState *s = FROM_SYSBUS(PUV3INTCState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PUV3INTCState *s = PUV3_INTC(dev);
 
-    qdev_init_gpio_in(&s->busdev.qdev, puv3_intc_handler, PUV3_IRQS_NR);
-    sysbus_init_irq(&s->busdev, &s->parent_irq);
+    qdev_init_gpio_in(dev, puv3_intc_handler, PUV3_IRQS_NR);
+    sysbus_init_irq(sbd, &s->parent_irq);
 
     s->reg_ICMR = 0;
     s->reg_ICPR = 0;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &puv3_intc_ops, s, "puv3_intc",
-            PUV3_REGS_OFFSET);
-    sysbus_init_mmio(dev, &s->iomem);
+                          PUV3_REGS_OFFSET);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -121,7 +126,7 @@ static void puv3_intc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_intc_info = {
-    .name = "puv3_intc",
+    .name = TYPE_PUV3_INTC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3INTCState),
     .class_init = puv3_intc_class_init,
commit 7fc3266f769880d5cb8d6c7995a1a5f898986baf
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:23:57 2013 +0200

    pl190: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index dfd6ebf..329680d 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -15,8 +15,12 @@
 
 #define PL190_NUM_PRIO 17
 
+#define TYPE_PL190 "pl190"
+#define PL190(obj) OBJECT_CHECK(PL190State, (obj), TYPE_PL190)
+
 typedef struct PL190State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t level;
     uint32_t soft_level;
@@ -218,29 +222,29 @@ static const MemoryRegionOps pl190_ops = {
 
 static void pl190_reset(DeviceState *d)
 {
-  PL190State *s = DO_UPCAST(PL190State, busdev.qdev, d);
-  int i;
+    PL190State *s = PL190(d);
+    int i;
 
-  for (i = 0; i < 16; i++)
-    {
-      s->vect_addr[i] = 0;
-      s->vect_control[i] = 0;
+    for (i = 0; i < 16; i++) {
+        s->vect_addr[i] = 0;
+        s->vect_control[i] = 0;
     }
-  s->vect_addr[16] = 0;
-  s->prio_mask[17] = 0xffffffff;
-  s->priority = PL190_NUM_PRIO;
-  pl190_update_vectors(s);
+    s->vect_addr[16] = 0;
+    s->prio_mask[17] = 0xffffffff;
+    s->priority = PL190_NUM_PRIO;
+    pl190_update_vectors(s);
 }
 
-static int pl190_init(SysBusDevice *dev)
+static int pl190_init(SysBusDevice *sbd)
 {
-    PL190State *s = FROM_SYSBUS(PL190State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL190State *s = PL190(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl190_ops, s, "pl190", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    qdev_init_gpio_in(&dev->qdev, pl190_set_irq, 32);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    qdev_init_gpio_in(dev, pl190_set_irq, 32);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
     return 0;
 }
 
@@ -275,7 +279,7 @@ static void pl190_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl190_info = {
-    .name          = "pl190",
+    .name          = TYPE_PL190,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL190State),
     .class_init    = pl190_class_init,
commit aefbc25695b00b6d6731ef0b8c53e12462bffd86
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:18:42 2013 +0200

    pl190: Rename pl190_state to PL190State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index fdb29d7..dfd6ebf 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -15,7 +15,7 @@
 
 #define PL190_NUM_PRIO 17
 
-typedef struct {
+typedef struct PL190State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t level;
@@ -32,18 +32,18 @@ typedef struct {
     int prev_prio[PL190_NUM_PRIO];
     qemu_irq irq;
     qemu_irq fiq;
-} pl190_state;
+} PL190State;
 
 static const unsigned char pl190_id[] =
 { 0x90, 0x11, 0x04, 0x00, 0x0D, 0xf0, 0x05, 0xb1 };
 
-static inline uint32_t pl190_irq_level(pl190_state *s)
+static inline uint32_t pl190_irq_level(PL190State *s)
 {
     return (s->level | s->soft_level) & s->irq_enable & ~s->fiq_select;
 }
 
 /* Update interrupts.  */
-static void pl190_update(pl190_state *s)
+static void pl190_update(PL190State *s)
 {
     uint32_t level = pl190_irq_level(s);
     int set;
@@ -56,7 +56,7 @@ static void pl190_update(pl190_state *s)
 
 static void pl190_set_irq(void *opaque, int irq, int level)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
 
     if (level)
         s->level |= 1u << irq;
@@ -65,7 +65,7 @@ static void pl190_set_irq(void *opaque, int irq, int level)
     pl190_update(s);
 }
 
-static void pl190_update_vectors(pl190_state *s)
+static void pl190_update_vectors(PL190State *s)
 {
     uint32_t mask;
     int i;
@@ -88,7 +88,7 @@ static void pl190_update_vectors(pl190_state *s)
 static uint64_t pl190_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
     int i;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -152,7 +152,7 @@ static uint64_t pl190_read(void *opaque, hwaddr offset,
 static void pl190_write(void *opaque, hwaddr offset,
                         uint64_t val, unsigned size)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
 
     if (offset >= 0x100 && offset < 0x140) {
         s->vect_addr[(offset - 0x100) >> 2] = val;
@@ -218,7 +218,7 @@ static const MemoryRegionOps pl190_ops = {
 
 static void pl190_reset(DeviceState *d)
 {
-  pl190_state *s = DO_UPCAST(pl190_state, busdev.qdev, d);
+  PL190State *s = DO_UPCAST(PL190State, busdev.qdev, d);
   int i;
 
   for (i = 0; i < 16; i++)
@@ -234,7 +234,7 @@ static void pl190_reset(DeviceState *d)
 
 static int pl190_init(SysBusDevice *dev)
 {
-    pl190_state *s = FROM_SYSBUS(pl190_state, dev);
+    PL190State *s = FROM_SYSBUS(PL190State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl190_ops, s, "pl190", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -249,16 +249,16 @@ static const VMStateDescription vmstate_pl190 = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(level, pl190_state),
-        VMSTATE_UINT32(soft_level, pl190_state),
-        VMSTATE_UINT32(irq_enable, pl190_state),
-        VMSTATE_UINT32(fiq_select, pl190_state),
-        VMSTATE_UINT8_ARRAY(vect_control, pl190_state, 16),
-        VMSTATE_UINT32_ARRAY(vect_addr, pl190_state, PL190_NUM_PRIO),
-        VMSTATE_UINT32_ARRAY(prio_mask, pl190_state, PL190_NUM_PRIO+1),
-        VMSTATE_INT32(protected, pl190_state),
-        VMSTATE_INT32(priority, pl190_state),
-        VMSTATE_INT32_ARRAY(prev_prio, pl190_state, PL190_NUM_PRIO),
+        VMSTATE_UINT32(level, PL190State),
+        VMSTATE_UINT32(soft_level, PL190State),
+        VMSTATE_UINT32(irq_enable, PL190State),
+        VMSTATE_UINT32(fiq_select, PL190State),
+        VMSTATE_UINT8_ARRAY(vect_control, PL190State, 16),
+        VMSTATE_UINT32_ARRAY(vect_addr, PL190State, PL190_NUM_PRIO),
+        VMSTATE_UINT32_ARRAY(prio_mask, PL190State, PL190_NUM_PRIO+1),
+        VMSTATE_INT32(protected, PL190State),
+        VMSTATE_INT32(priority, PL190State),
+        VMSTATE_INT32_ARRAY(prev_prio, PL190State, PL190_NUM_PRIO),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -277,7 +277,7 @@ static void pl190_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl190_info = {
     .name          = "pl190",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl190_state),
+    .instance_size = sizeof(PL190State),
     .class_init    = pl190_class_init,
 };
 
commit 47edc5a479e0927c6ce04eaf3e84db0ba7ddbb41
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:14:20 2013 +0200

    omap_intc: QOM'ify omap-intc and omap2-intc
    
    Create a new abstract base type and let omap-intc and omap2-intc inherit
    from it. Introduce a type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/omap_intc.c b/hw/intc/omap_intc.c
index bca8585..7dd63da 100644
--- a/hw/intc/omap_intc.c
+++ b/hw/intc/omap_intc.c
@@ -32,8 +32,13 @@ struct omap_intr_handler_bank_s {
     unsigned char priority[32];
 };
 
+#define TYPE_OMAP_INTC "common-omap-intc"
+#define OMAP_INTC(obj) \
+    OBJECT_CHECK(struct omap_intr_handler_s, (obj), TYPE_OMAP_INTC)
+
 struct omap_intr_handler_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq *pins;
     qemu_irq parent_intr[2];
     MemoryRegion mmio;
@@ -328,8 +333,7 @@ static const MemoryRegionOps omap_inth_mem_ops = {
 
 static void omap_inth_reset(DeviceState *dev)
 {
-    struct omap_intr_handler_s *s = FROM_SYSBUS(struct omap_intr_handler_s,
-                                                SYS_BUS_DEVICE(dev));
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
     int i;
 
     for (i = 0; i < s->nbanks; ++i){
@@ -356,20 +360,21 @@ static void omap_inth_reset(DeviceState *dev)
     qemu_set_irq(s->parent_intr[1], 0);
 }
 
-static int omap_intc_init(SysBusDevice *dev)
+static int omap_intc_init(SysBusDevice *sbd)
 {
-    struct omap_intr_handler_s *s;
-    s = FROM_SYSBUS(struct omap_intr_handler_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
+
     if (!s->iclk) {
         hw_error("omap-intc: clk not connected\n");
     }
     s->nbanks = 1;
-    sysbus_init_irq(dev, &s->parent_intr[0]);
-    sysbus_init_irq(dev, &s->parent_intr[1]);
-    qdev_init_gpio_in(&dev->qdev, omap_set_intr, s->nbanks * 32);
+    sysbus_init_irq(sbd, &s->parent_intr[0]);
+    sysbus_init_irq(sbd, &s->parent_intr[1]);
+    qdev_init_gpio_in(dev, omap_set_intr, s->nbanks * 32);
     memory_region_init_io(&s->mmio, OBJECT(s), &omap_inth_mem_ops, s,
                           "omap-intc", s->size);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -391,8 +396,7 @@ static void omap_intc_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo omap_intc_info = {
     .name          = "omap-intc",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct omap_intr_handler_s),
+    .parent        = TYPE_OMAP_INTC,
     .class_init    = omap_intc_class_init,
 };
 
@@ -500,8 +504,9 @@ static void omap2_inth_write(void *opaque, hwaddr addr,
     case 0x10:	/* INTC_SYSCONFIG */
         s->autoidle &= 4;
         s->autoidle |= (value & 1) << 2;
-        if (value & 2)						/* SOFTRESET */
-            omap_inth_reset(&s->busdev.qdev);
+        if (value & 2) {                                        /* SOFTRESET */
+            omap_inth_reset(DEVICE(s));
+        }
         return;
 
     case 0x48:	/* INTC_CONTROL */
@@ -594,10 +599,11 @@ static const MemoryRegionOps omap2_inth_mem_ops = {
     },
 };
 
-static int omap2_intc_init(SysBusDevice *dev)
+static int omap2_intc_init(SysBusDevice *sbd)
 {
-    struct omap_intr_handler_s *s;
-    s = FROM_SYSBUS(struct omap_intr_handler_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
+
     if (!s->iclk) {
         hw_error("omap2-intc: iclk not connected\n");
     }
@@ -606,12 +612,12 @@ static int omap2_intc_init(SysBusDevice *dev)
     }
     s->level_only = 1;
     s->nbanks = 3;
-    sysbus_init_irq(dev, &s->parent_intr[0]);
-    sysbus_init_irq(dev, &s->parent_intr[1]);
-    qdev_init_gpio_in(&dev->qdev, omap_set_intr_noedge, s->nbanks * 32);
+    sysbus_init_irq(sbd, &s->parent_intr[0]);
+    sysbus_init_irq(sbd, &s->parent_intr[1]);
+    qdev_init_gpio_in(dev, omap_set_intr_noedge, s->nbanks * 32);
     memory_region_init_io(&s->mmio, OBJECT(s), &omap2_inth_mem_ops, s,
                           "omap2-intc", 0x1000);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -635,13 +641,20 @@ static void omap2_intc_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo omap2_intc_info = {
     .name          = "omap2-intc",
+    .parent        = TYPE_OMAP_INTC,
+    .class_init    = omap2_intc_class_init,
+};
+
+static const TypeInfo omap_intc_type_info = {
+    .name          = TYPE_OMAP_INTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap_intr_handler_s),
-    .class_init    = omap2_intc_class_init,
+    .abstract      = true,
 };
 
 static void omap_intc_register_types(void)
 {
+    type_register_static(&omap_intc_type_info);
     type_register_static(&omap_intc_info);
     type_register_static(&omap2_intc_info);
 }
commit 1f8a9eac51427be2e9e63fcbe9d4d174640a0b19
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:53:49 2013 +0200

    lm32_pic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/lm32_pic.c b/hw/intc/lm32_pic.c
index b4e80c8..32d009f 100644
--- a/hw/intc/lm32_pic.c
+++ b/hw/intc/lm32_pic.c
@@ -26,8 +26,12 @@
 #include "trace.h"
 #include "hw/lm32/lm32_pic.h"
 
+#define TYPE_LM32_PIC "lm32-pic"
+#define LM32_PIC(obj) OBJECT_CHECK(LM32PicState, (obj), TYPE_LM32_PIC)
+
 struct LM32PicState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq parent_irq;
     uint32_t im;        /* interrupt mask */
     uint32_t ip;        /* interrupt pending */
@@ -99,7 +103,7 @@ static void irq_handler(void *opaque, int irq, int level)
 
 void lm32_pic_set_im(DeviceState *d, uint32_t im)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_set_im(im);
     s->im = im;
@@ -109,7 +113,7 @@ void lm32_pic_set_im(DeviceState *d, uint32_t im)
 
 void lm32_pic_set_ip(DeviceState *d, uint32_t ip)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_set_ip(ip);
 
@@ -121,7 +125,7 @@ void lm32_pic_set_ip(DeviceState *d, uint32_t ip)
 
 uint32_t lm32_pic_get_im(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_get_im(s->im);
     return s->im;
@@ -129,7 +133,7 @@ uint32_t lm32_pic_get_im(DeviceState *d)
 
 uint32_t lm32_pic_get_ip(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_get_ip(s->ip);
     return s->ip;
@@ -137,7 +141,7 @@ uint32_t lm32_pic_get_ip(DeviceState *d)
 
 static void pic_reset(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
     int i;
 
     s->im = 0;
@@ -148,12 +152,13 @@ static void pic_reset(DeviceState *d)
     }
 }
 
-static int lm32_pic_init(SysBusDevice *dev)
+static int lm32_pic_init(SysBusDevice *sbd)
 {
-    LM32PicState *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    LM32PicState *s = LM32_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
 
     pic = s;
 
@@ -185,7 +190,7 @@ static void lm32_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_pic_info = {
-    .name          = "lm32-pic",
+    .name          = TYPE_LM32_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32PicState),
     .class_init    = lm32_pic_class_init,
commit 730bf9323d799cc42520f4512dd76d843b26d480
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:26:18 2013 +0200

    grlib_irqmp: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/grlib_irqmp.c b/hw/intc/grlib_irqmp.c
index 181f614..42e00bc 100644
--- a/hw/intc/grlib_irqmp.c
+++ b/hw/intc/grlib_irqmp.c
@@ -45,10 +45,14 @@
 #define FORCE_OFFSET     0x80
 #define EXTENDED_OFFSET  0xC0
 
+#define TYPE_GRLIB_IRQMP "grlib,irqmp"
+#define GRLIB_IRQMP(obj) OBJECT_CHECK(IRQMP, (obj), TYPE_GRLIB_IRQMP)
+
 typedef struct IRQMPState IRQMPState;
 
 typedef struct IRQMP {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     void *set_pil_in;
@@ -102,19 +106,10 @@ static void grlib_irqmp_check_irqs(IRQMPState *state)
 
 void grlib_irqmp_ack(DeviceState *dev, int intno)
 {
-    SysBusDevice *sdev;
-    IRQMP        *irqmp;
+    IRQMP        *irqmp = GRLIB_IRQMP(dev);
     IRQMPState   *state;
     uint32_t      mask;
 
-    assert(dev != NULL);
-
-    sdev = SYS_BUS_DEVICE(dev);
-    assert(sdev != NULL);
-
-    irqmp = FROM_SYSBUS(typeof(*irqmp), sdev);
-    assert(irqmp != NULL);
-
     state = irqmp->state;
     assert(state != NULL);
 
@@ -132,15 +127,10 @@ void grlib_irqmp_ack(DeviceState *dev, int intno)
 
 void grlib_irqmp_set_irq(void *opaque, int irq, int level)
 {
-    IRQMP      *irqmp;
+    IRQMP      *irqmp = GRLIB_IRQMP(opaque);
     IRQMPState *s;
     int         i = 0;
 
-    assert(opaque != NULL);
-
-    irqmp = FROM_SYSBUS(typeof(*irqmp), SYS_BUS_DEVICE(opaque));
-    assert(irqmp != NULL);
-
     s = irqmp->state;
     assert(s         != NULL);
     assert(s->parent != NULL);
@@ -325,8 +315,7 @@ static const MemoryRegionOps grlib_irqmp_ops = {
 
 static void grlib_irqmp_reset(DeviceState *d)
 {
-    IRQMP *irqmp = container_of(d, IRQMP, busdev.qdev);
-    assert(irqmp        != NULL);
+    IRQMP *irqmp = GRLIB_IRQMP(d);
     assert(irqmp->state != NULL);
 
     memset(irqmp->state, 0, sizeof *irqmp->state);
@@ -335,9 +324,7 @@ static void grlib_irqmp_reset(DeviceState *d)
 
 static int grlib_irqmp_init(SysBusDevice *dev)
 {
-    IRQMP *irqmp = FROM_SYSBUS(typeof(*irqmp), dev);
-
-    assert(irqmp != NULL);
+    IRQMP *irqmp = GRLIB_IRQMP(dev);
 
     /* Check parameters */
     if (irqmp->set_pil_in == NULL) {
@@ -371,7 +358,7 @@ static void grlib_irqmp_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo grlib_irqmp_info = {
-    .name          = "grlib,irqmp",
+    .name          = TYPE_GRLIB_IRQMP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IRQMP),
     .class_init    = grlib_irqmp_class_init,
commit c5e22ae3464b52789023dbdce2f565d0f6be08e2
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:19:19 2013 +0200

    exynos4210_gic: QOM cast cleanup for exynos4210.irq_gate
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index f9afb97..5b913f7 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -372,8 +372,13 @@ type_init(exynos4210_gic_register_types)
  * output sysbus IRQ line. The output IRQ level is formed as OR between all
  * gpio inputs.
  */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_EXYNOS4210_IRQ_GATE "exynos4210.irq_gate"
+#define EXYNOS4210_IRQ_GATE(obj) \
+    OBJECT_CHECK(Exynos4210IRQGateState, (obj), TYPE_EXYNOS4210_IRQ_GATE)
+
+typedef struct Exynos4210IRQGateState {
+    SysBusDevice parent_obj;
 
     uint32_t n_in;      /* inputs amount */
     uint32_t *level;    /* input levels */
@@ -418,8 +423,7 @@ static void exynos4210_irq_gate_handler(void *opaque, int irq, int level)
 
 static void exynos4210_irq_gate_reset(DeviceState *d)
 {
-    Exynos4210IRQGateState *s =
-            DO_UPCAST(Exynos4210IRQGateState, busdev.qdev, d);
+    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(d);
 
     memset(s->level, 0, s->n_in * sizeof(*s->level));
 }
@@ -427,17 +431,18 @@ static void exynos4210_irq_gate_reset(DeviceState *d)
 /*
  * IRQ Gate initialization.
  */
-static int exynos4210_irq_gate_init(SysBusDevice *dev)
+static int exynos4210_irq_gate_init(SysBusDevice *sbd)
 {
-    Exynos4210IRQGateState *s = FROM_SYSBUS(Exynos4210IRQGateState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(dev);
 
     /* Allocate general purpose input signals and connect a handler to each of
      * them */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_irq_gate_handler, s->n_in);
+    qdev_init_gpio_in(dev, exynos4210_irq_gate_handler, s->n_in);
 
     s->level = g_malloc0(s->n_in * sizeof(*s->level));
 
-    sysbus_init_irq(dev, &s->out);
+    sysbus_init_irq(sbd, &s->out);
 
     return 0;
 }
@@ -454,7 +459,7 @@ static void exynos4210_irq_gate_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_irq_gate_info = {
-    .name          = "exynos4210.irq_gate",
+    .name          = TYPE_EXYNOS4210_IRQ_GATE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210IRQGateState),
     .class_init    = exynos4210_irq_gate_class_init,
commit 78c6abbd834e78a658e5910244397040c10a5b90
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:16:20 2013 +0200

    exynos4210_gic: QOM cast cleanup for exynos4210.gic
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index 6147f04..f9afb97 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -260,8 +260,13 @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
 
 /********* GIC part *********/
 
+#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
+#define EXYNOS4210_GIC(obj) \
+    OBJECT_CHECK(Exynos4210GicState, (obj), TYPE_EXYNOS4210_GIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion cpu_container;
     MemoryRegion dist_container;
     MemoryRegion cpu_alias[EXYNOS4210_NCPUS];
@@ -276,9 +281,10 @@ static void exynos4210_gic_set_irq(void *opaque, int irq, int level)
     qemu_set_irq(qdev_get_gpio_in(s->gic, irq), level);
 }
 
-static int exynos4210_gic_init(SysBusDevice *dev)
+static int exynos4210_gic_init(SysBusDevice *sbd)
 {
-    Exynos4210GicState *s = FROM_SYSBUS(Exynos4210GicState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210GicState *s = EXYNOS4210_GIC(dev);
     uint32_t i;
     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
     const char dist_prefix[] = "exynos4210-gic-alias_dist";
@@ -293,10 +299,10 @@ static int exynos4210_gic_init(SysBusDevice *dev)
     busdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, busdev);
+    sysbus_pass_irq(sbd, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_gic_set_irq,
+    qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
                       EXYNOS4210_GIC_NIRQ - 32);
 
     memory_region_init(&s->cpu_container, OBJECT(s), "exynos4210-cpu-container",
@@ -326,8 +332,8 @@ static int exynos4210_gic_init(SysBusDevice *dev)
                 EXYNOS4210_EXT_GIC_DIST_GET_OFFSET(i), &s->dist_alias[i]);
     }
 
-    sysbus_init_mmio(dev, &s->cpu_container);
-    sysbus_init_mmio(dev, &s->dist_container);
+    sysbus_init_mmio(sbd, &s->cpu_container);
+    sysbus_init_mmio(sbd, &s->dist_container);
 
     return 0;
 }
@@ -347,7 +353,7 @@ static void exynos4210_gic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_gic_info = {
-    .name          = "exynos4210.gic",
+    .name          = TYPE_EXYNOS4210_GIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210GicState),
     .class_init    = exynos4210_gic_class_init,
commit c03c6b9ccaa696b90a662dfcce82d84c50f832b8
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:11:37 2013 +0200

    exynos4210_combiner: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index 3b40976..ef5e8eb 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -56,8 +56,13 @@ typedef struct CombinerGroupState {
     uint8_t src_pending;        /* Pending source interrupts before masking */
 } CombinerGroupState;
 
+#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
+#define EXYNOS4210_COMBINER(obj) \
+    OBJECT_CHECK(Exynos4210CombinerState, (obj), TYPE_EXYNOS4210_COMBINER)
+
 typedef struct Exynos4210CombinerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     struct CombinerGroupState group[IIC_NGRP];
@@ -402,24 +407,24 @@ static const MemoryRegionOps exynos4210_combiner_ops = {
 /*
  * Internal Combiner initialization.
  */
-static int exynos4210_combiner_init(SysBusDevice *dev)
+static int exynos4210_combiner_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210CombinerState *s = EXYNOS4210_COMBINER(dev);
     unsigned int i;
-    struct Exynos4210CombinerState *s =
-            FROM_SYSBUS(struct Exynos4210CombinerState, dev);
 
     /* Allocate general purpose input signals and connect a handler to each of
      * them */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_combiner_handler, IIC_NIRQ);
+    qdev_init_gpio_in(dev, exynos4210_combiner_handler, IIC_NIRQ);
 
     /* Connect SysBusDev irqs to device specific irqs */
     for (i = 0; i < IIC_NIRQ; i++) {
-        sysbus_init_irq(dev, &s->output_irq[i]);
+        sysbus_init_irq(sbd, &s->output_irq[i]);
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_combiner_ops, s,
-            "exynos4210-combiner", IIC_REGION_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+                          "exynos4210-combiner", IIC_REGION_SIZE);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -441,7 +446,7 @@ static void exynos4210_combiner_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_combiner_info = {
-    .name          = "exynos4210.combiner",
+    .name          = TYPE_EXYNOS4210_COMBINER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210CombinerState),
     .class_init    = exynos4210_combiner_class_init,
commit 9062143f9e71479e98a62950178e7d803f304425
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:05:58 2013 +0200

    etraxfs_pic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/etraxfs_pic.c b/hw/intc/etraxfs_pic.c
index ce3a3f6..e02da53 100644
--- a/hw/intc/etraxfs_pic.c
+++ b/hw/intc/etraxfs_pic.c
@@ -36,9 +36,14 @@
 #define R_R_GURU    4
 #define R_MAX       5
 
+#define TYPE_ETRAX_FS_PIC "etraxfs,pic"
+#define ETRAX_FS_PIC(obj) \
+    OBJECT_CHECK(struct etrax_pic, (obj), TYPE_ETRAX_FS_PIC)
+
 struct etrax_pic
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     void *interrupt_vector;
     qemu_irq parent_irq;
@@ -138,17 +143,18 @@ static void irq_handler(void *opaque, int irq, int level)
     pic_update(fs);
 }
 
-static int etraxfs_pic_init(SysBusDevice *dev)
+static int etraxfs_pic_init(SysBusDevice *sbd)
 {
-    struct etrax_pic *s = FROM_SYSBUS(typeof (*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct etrax_pic *s = ETRAX_FS_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
-    sysbus_init_irq(dev, &s->parent_nmi);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
+    sysbus_init_irq(sbd, &s->parent_nmi);
 
     memory_region_init_io(&s->mmio, OBJECT(s), &pic_ops, s,
                           "etraxfs-pic", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -167,7 +173,7 @@ static void etraxfs_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_pic_info = {
-    .name          = "etraxfs,pic",
+    .name          = TYPE_ETRAX_FS_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct etrax_pic),
     .class_init    = etraxfs_pic_class_init,
commit 285b4432da565ebcca0bc5eab1783b77ef3450c0
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:57:48 2013 +0200

    arm_gic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index 8e34004..d431b7a 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -639,6 +639,7 @@ static const MemoryRegionOps gic_cpu_ops = {
 
 void gic_init_irqs_and_distributor(GICState *s, int num_irq)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
     int i;
 
     i = s->num_irq - GIC_INTERNAL;
@@ -652,9 +653,9 @@ void gic_init_irqs_and_distributor(GICState *s, int num_irq)
     if (s->revision != REV_NVIC) {
         i += (GIC_INTERNAL * s->num_cpu);
     }
-    qdev_init_gpio_in(&s->busdev.qdev, gic_set_irq, i);
+    qdev_init_gpio_in(DEVICE(s), gic_set_irq, i);
     for (i = 0; i < NUM_CPU(s); i++) {
-        sysbus_init_irq(&s->busdev, &s->parent_irq[i]);
+        sysbus_init_irq(sbd, &s->parent_irq[i]);
     }
     memory_region_init_io(&s->iomem, OBJECT(s), &gic_dist_ops, s,
                           "gic_dist", 0x1000);
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index 08560f2..709b5c2 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -110,7 +110,7 @@ static void arm_gic_common_realize(DeviceState *dev, Error **errp)
 
 static void arm_gic_common_reset(DeviceState *dev)
 {
-    GICState *s = FROM_SYSBUS(GICState, SYS_BUS_DEVICE(dev));
+    GICState *s = ARM_GIC_COMMON(dev);
     int i;
     memset(s->irq_state, 0, GIC_MAXIRQ * sizeof(gic_irq_state));
     for (i = 0 ; i < s->num_cpu; i++) {
diff --git a/hw/intc/gic_internal.h b/hw/intc/gic_internal.h
index 99a3bc3..1426437 100644
--- a/hw/intc/gic_internal.h
+++ b/hw/intc/gic_internal.h
@@ -70,7 +70,10 @@ typedef struct gic_irq_state {
 } gic_irq_state;
 
 typedef struct GICState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     qemu_irq parent_irq[NCPU];
     bool enabled;
     bool cpu_enabled[NCPU];
commit 3e5dd364d933ccc066cbea8620bdc16525e19230
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:49:24 2013 +0200

    pl050: QOM'ify pl050_keyboard and pl050_mouse
    
    Introduce an abstract type pl050 and let pl050_keyboar and pl050_mouse
    inherit from it, using different instance_init functions.
    Introduce a type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 8493abd..c1b08d5 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -10,8 +10,12 @@
 #include "hw/sysbus.h"
 #include "hw/input/ps2.h"
 
+#define TYPE_PL050 "pl050"
+#define PL050(obj) OBJECT_CHECK(PL050State, (obj), TYPE_PL050)
+
 typedef struct PL050State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     void *dev;
     uint32_t cr;
@@ -19,7 +23,7 @@ typedef struct PL050State {
     uint32_t last;
     int pending;
     qemu_irq irq;
-    int is_mouse;
+    bool is_mouse;
 } PL050State;
 
 static const VMStateDescription vmstate_pl050 = {
@@ -133,65 +137,67 @@ static const MemoryRegionOps pl050_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl050_init(SysBusDevice *dev, int is_mouse)
+static int pl050_initfn(SysBusDevice *dev)
 {
-    PL050State *s = FROM_SYSBUS(PL050State, dev);
+    PL050State *s = PL050(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl050_ops, s, "pl050", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
-    s->is_mouse = is_mouse;
-    if (s->is_mouse)
+    if (s->is_mouse) {
         s->dev = ps2_mouse_init(pl050_update, s);
-    else
+    } else {
         s->dev = ps2_kbd_init(pl050_update, s);
+    }
     return 0;
 }
 
-static int pl050_init_keyboard(SysBusDevice *dev)
+static void pl050_keyboard_init(Object *obj)
 {
-    return pl050_init(dev, 0);
-}
+    PL050State *s = PL050(obj);
 
-static int pl050_init_mouse(SysBusDevice *dev)
-{
-    return pl050_init(dev, 1);
+    s->is_mouse = false;
 }
 
-static void pl050_kbd_class_init(ObjectClass *klass, void *data)
+static void pl050_mouse_init(Object *obj)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    PL050State *s = PL050(obj);
 
-    k->init = pl050_init_keyboard;
-    dc->vmsd = &vmstate_pl050;
+    s->is_mouse = true;
 }
 
 static const TypeInfo pl050_kbd_info = {
     .name          = "pl050_keyboard",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL050State),
-    .class_init    = pl050_kbd_class_init,
+    .parent        = TYPE_PL050,
+    .instance_init = pl050_keyboard_init,
 };
 
-static void pl050_mouse_class_init(ObjectClass *klass, void *data)
+static const TypeInfo pl050_mouse_info = {
+    .name          = "pl050_mouse",
+    .parent        = TYPE_PL050,
+    .instance_init = pl050_mouse_init,
+};
+
+static void pl050_class_init(ObjectClass *oc, void *data)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(oc);
 
-    k->init = pl050_init_mouse;
+    sdc->init = pl050_initfn;
     dc->vmsd = &vmstate_pl050;
 }
 
-static const TypeInfo pl050_mouse_info = {
-    .name          = "pl050_mouse",
+static const TypeInfo pl050_type_info = {
+    .name          = TYPE_PL050,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL050State),
-    .class_init    = pl050_mouse_class_init,
+    .abstract      = true,
+    .class_init    = pl050_class_init,
 };
 
 static void pl050_register_types(void)
 {
+    type_register_static(&pl050_type_info);
     type_register_static(&pl050_kbd_info);
     type_register_static(&pl050_mouse_info);
 }
commit e607f25a620e769cb6a231314aa13804723ab734
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:40:25 2013 +0200

    pl050: Rename pl050_state to PL050State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 2312ffc..8493abd 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -10,7 +10,7 @@
 #include "hw/sysbus.h"
 #include "hw/input/ps2.h"
 
-typedef struct {
+typedef struct PL050State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     void *dev;
@@ -20,17 +20,17 @@ typedef struct {
     int pending;
     qemu_irq irq;
     int is_mouse;
-} pl050_state;
+} PL050State;
 
 static const VMStateDescription vmstate_pl050 = {
     .name = "pl050",
     .version_id = 2,
     .minimum_version_id = 2,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(cr, pl050_state),
-        VMSTATE_UINT32(clk, pl050_state),
-        VMSTATE_UINT32(last, pl050_state),
-        VMSTATE_INT32(pending, pl050_state),
+        VMSTATE_UINT32(cr, PL050State),
+        VMSTATE_UINT32(clk, PL050State),
+        VMSTATE_UINT32(last, PL050State),
+        VMSTATE_INT32(pending, PL050State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -48,7 +48,7 @@ static const unsigned char pl050_id[] =
 
 static void pl050_update(void *opaque, int level)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     int raise;
 
     s->pending = level;
@@ -60,7 +60,7 @@ static void pl050_update(void *opaque, int level)
 static uint64_t pl050_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     if (offset >= 0xfe0 && offset < 0x1000)
         return pl050_id[(offset - 0xfe0) >> 2];
 
@@ -103,7 +103,7 @@ static uint64_t pl050_read(void *opaque, hwaddr offset,
 static void pl050_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     switch (offset >> 2) {
     case 0: /* KMICR */
         s->cr = value;
@@ -135,7 +135,7 @@ static const MemoryRegionOps pl050_ops = {
 
 static int pl050_init(SysBusDevice *dev, int is_mouse)
 {
-    pl050_state *s = FROM_SYSBUS(pl050_state, dev);
+    PL050State *s = FROM_SYSBUS(PL050State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl050_ops, s, "pl050", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -170,7 +170,7 @@ static void pl050_kbd_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl050_kbd_info = {
     .name          = "pl050_keyboard",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl050_state),
+    .instance_size = sizeof(PL050State),
     .class_init    = pl050_kbd_class_init,
 };
 
@@ -186,7 +186,7 @@ static void pl050_mouse_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl050_mouse_info = {
     .name          = "pl050_mouse",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl050_state),
+    .instance_size = sizeof(PL050State),
     .class_init    = pl050_mouse_class_init,
 };
 
commit 2a052f6bf11f00b358cf4e0abdd6e2cf59648a71
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:37:02 2013 +0200

    milkymist-softusb: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/input/milkymist-softusb.c b/hw/input/milkymist-softusb.c
index 942cb79..ecde33c 100644
--- a/hw/input/milkymist-softusb.c
+++ b/hw/input/milkymist-softusb.c
@@ -44,8 +44,13 @@ enum {
 #define COMLOC_KEVT_PRODUCE  0x1142
 #define COMLOC_KEVT_BASE     0x1143
 
+#define TYPE_MILKYMIST_SOFTUSB "milkymist-softusb"
+#define MILKYMIST_SOFTUSB(obj) \
+    OBJECT_CHECK(MilkymistSoftUsbState, (obj), TYPE_MILKYMIST_SOFTUSB)
+
 struct MilkymistSoftUsbState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     HIDState hid_kbd;
     HIDState hid_mouse;
 
@@ -242,8 +247,7 @@ static void softusb_mouse_hid_datain(HIDState *hs)
 
 static void milkymist_softusb_reset(DeviceState *d)
 {
-    MilkymistSoftUsbState *s =
-            container_of(d, MilkymistSoftUsbState, busdev.qdev);
+    MilkymistSoftUsbState *s = MILKYMIST_SOFTUSB(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -261,7 +265,7 @@ static void milkymist_softusb_reset(DeviceState *d)
 
 static int milkymist_softusb_init(SysBusDevice *dev)
 {
-    MilkymistSoftUsbState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistSoftUsbState *s = MILKYMIST_SOFTUSB(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -320,7 +324,7 @@ static void milkymist_softusb_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_softusb_info = {
-    .name          = "milkymist-softusb",
+    .name          = TYPE_MILKYMIST_SOFTUSB,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistSoftUsbState),
     .class_init    = milkymist_softusb_class_init,
commit 93e7f5f42d0d3663acb94b24c8a9a329b5b13917
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:28:26 2013 +0200

    versatile_i2c: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/versatile_i2c.c b/hw/i2c/versatile_i2c.c
index 204dd3d..02e9f17 100644
--- a/hw/i2c/versatile_i2c.c
+++ b/hw/i2c/versatile_i2c.c
@@ -24,8 +24,13 @@
 #include "hw/sysbus.h"
 #include "bitbang_i2c.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_VERSATILE_I2C "versatile_i2c"
+#define VERSATILE_I2C(obj) \
+    OBJECT_CHECK(VersatileI2CState, (obj), TYPE_VERSATILE_I2C)
+
+typedef struct VersatileI2CState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     bitbang_i2c_interface *bitbang;
     int out;
@@ -72,16 +77,17 @@ static const MemoryRegionOps versatile_i2c_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int versatile_i2c_init(SysBusDevice *dev)
+static int versatile_i2c_init(SysBusDevice *sbd)
 {
-    VersatileI2CState *s = FROM_SYSBUS(VersatileI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    VersatileI2CState *s = VERSATILE_I2C(dev);
     i2c_bus *bus;
 
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    bus = i2c_init_bus(dev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
     memory_region_init_io(&s->iomem, OBJECT(s), &versatile_i2c_ops, s,
                           "versatile_i2c", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -93,7 +99,7 @@ static void versatile_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo versatile_i2c_info = {
-    .name          = "versatile_i2c",
+    .name          = TYPE_VERSATILE_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(VersatileI2CState),
     .class_init    = versatile_i2c_class_init,
commit 60ecfcb354e526c29874af17bbadaabeff47409c
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:24:27 2013 +0200

    omap_i2c: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/omap_i2c.c b/hw/i2c/omap_i2c.c
index f0eb448..f528b2b 100644
--- a/hw/i2c/omap_i2c.c
+++ b/hw/i2c/omap_i2c.c
@@ -21,9 +21,12 @@
 #include "hw/arm/omap.h"
 #include "hw/sysbus.h"
 
+#define TYPE_OMAP_I2C "omap_i2c"
+#define OMAP_I2C(obj) OBJECT_CHECK(OMAPI2CState, (obj), TYPE_OMAP_I2C)
 
 typedef struct OMAPI2CState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     qemu_irq drq[2];
@@ -130,8 +133,8 @@ static void omap_i2c_fifo_run(OMAPI2CState *s)
 
 static void omap_i2c_reset(DeviceState *dev)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState,
-                                  SYS_BUS_DEVICE(dev));
+    OMAPI2CState *s = OMAP_I2C(dev);
+
     s->mask = 0;
     s->stat = 0;
     s->dma = 0;
@@ -316,15 +319,17 @@ static void omap_i2c_write(void *opaque, hwaddr addr,
             return;
         }
 
-        if (value & 2)
-            omap_i2c_reset(&s->busdev.qdev);
+        if (value & 2) {
+            omap_i2c_reset(DEVICE(s));
+        }
         break;
 
     case 0x24:	/* I2C_CON */
         s->control = value & 0xcf87;
         if (~value & (1 << 15)) {				/* I2C_EN */
-            if (s->revision < OMAP2_INTR_REV)
-                omap_i2c_reset(&s->busdev.qdev);
+            if (s->revision < OMAP2_INTR_REV) {
+                omap_i2c_reset(DEVICE(s));
+            }
             break;
         }
         if ((value & (1 << 15)) && !(value & (1 << 10))) {	/* MST */
@@ -434,9 +439,10 @@ static const MemoryRegionOps omap_i2c_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int omap_i2c_init(SysBusDevice *dev)
+static int omap_i2c_init(SysBusDevice *sbd)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    OMAPI2CState *s = OMAP_I2C(dev);
 
     if (!s->fclk) {
         hw_error("omap_i2c: fclk not connected\n");
@@ -445,13 +451,13 @@ static int omap_i2c_init(SysBusDevice *dev)
         /* Note that OMAP1 doesn't have a separate interface clock */
         hw_error("omap_i2c: iclk not connected\n");
     }
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->drq[0]);
-    sysbus_init_irq(dev, &s->drq[1]);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->drq[0]);
+    sysbus_init_irq(sbd, &s->drq[1]);
     memory_region_init_io(&s->iomem, OBJECT(s), &omap_i2c_ops, s, "omap.i2c",
                           (s->revision < OMAP2_INTR_REV) ? 0x800 : 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    s->bus = i2c_init_bus(&dev->qdev, NULL);
+    sysbus_init_mmio(sbd, &s->iomem);
+    s->bus = i2c_init_bus(dev, NULL);
     return 0;
 }
 
@@ -472,7 +478,7 @@ static void omap_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo omap_i2c_info = {
-    .name = "omap_i2c",
+    .name = TYPE_OMAP_I2C,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OMAPI2CState),
     .class_init = omap_i2c_class_init,
@@ -485,7 +491,7 @@ static void omap_i2c_register_types(void)
 
 i2c_bus *omap_i2c_bus(DeviceState *omap_i2c)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState, SYS_BUS_DEVICE(omap_i2c));
+    OMAPI2CState *s = OMAP_I2C(omap_i2c);
     return s->bus;
 }
 
commit cc3c3b8a2239a7a1d49a83c047ae2bc63d8a71e8
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:13:46 2013 +0200

    bitbang_i2c: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index 853d455..ca59456 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -185,8 +185,13 @@ bitbang_i2c_interface *bitbang_i2c_init(i2c_bus *bus)
 }
 
 /* GPIO interface.  */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_GPIO_I2C "gpio_i2c"
+#define GPIO_I2C(obj) OBJECT_CHECK(GPIOI2CState, (obj), TYPE_GPIO_I2C)
+
+typedef struct GPIOI2CState {
+    SysBusDevice parent_obj;
+
     MemoryRegion dummy_iomem;
     bitbang_i2c_interface *bitbang;
     int last_level;
@@ -204,19 +209,20 @@ static void bitbang_i2c_gpio_set(void *opaque, int irq, int level)
     }
 }
 
-static int gpio_i2c_init(SysBusDevice *dev)
+static int gpio_i2c_init(SysBusDevice *sbd)
 {
-    GPIOI2CState *s = FROM_SYSBUS(GPIOI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    GPIOI2CState *s = GPIO_I2C(dev);
     i2c_bus *bus;
 
     memory_region_init(&s->dummy_iomem, OBJECT(s), "gpio_i2c", 0);
-    sysbus_init_mmio(dev, &s->dummy_iomem);
+    sysbus_init_mmio(sbd, &s->dummy_iomem);
 
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    bus = i2c_init_bus(dev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
 
-    qdev_init_gpio_in(&dev->qdev, bitbang_i2c_gpio_set, 2);
-    qdev_init_gpio_out(&dev->qdev, &s->out, 1);
+    qdev_init_gpio_in(dev, bitbang_i2c_gpio_set, 2);
+    qdev_init_gpio_out(dev, &s->out, 1);
 
     return 0;
 }
@@ -232,7 +238,7 @@ static void gpio_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo gpio_i2c_info = {
-    .name          = "gpio_i2c",
+    .name          = TYPE_GPIO_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GPIOI2CState),
     .class_init    = gpio_i2c_class_init,
commit a009de46bd50c88d18f19a1405e1348c679e08d6
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:41:16 2013 +0200

    gpio/zaurus: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index c235c3e..dc79a8b 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -24,9 +24,13 @@
 
 /* SCOOP devices */
 
+#define TYPE_SCOOP "scoop"
+#define SCOOP(obj) OBJECT_CHECK(ScoopInfo, (obj), TYPE_SCOOP)
+
 typedef struct ScoopInfo ScoopInfo;
 struct ScoopInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq handler[16];
     MemoryRegion iomem;
     uint16_t status;
@@ -162,16 +166,17 @@ static void scoop_gpio_set(void *opaque, int line, int level)
         s->gpio_level &= ~(1 << line);
 }
 
-static int scoop_init(SysBusDevice *dev)
+static int scoop_init(SysBusDevice *sbd)
 {
-    ScoopInfo *s = FROM_SYSBUS(ScoopInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    ScoopInfo *s = SCOOP(dev);
 
     s->status = 0x02;
-    qdev_init_gpio_out(&s->busdev.qdev, s->handler, 16);
-    qdev_init_gpio_in(&s->busdev.qdev, scoop_gpio_set, 16);
+    qdev_init_gpio_out(dev, s->handler, 16);
+    qdev_init_gpio_in(dev, scoop_gpio_set, 16);
     memory_region_init_io(&s->iomem, OBJECT(s), &scoop_ops, s, "scoop", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -237,7 +242,7 @@ static void scoop_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo scoop_sysbus_info = {
-    .name          = "scoop",
+    .name          = TYPE_SCOOP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ScoopInfo),
     .class_init    = scoop_sysbus_class_init,
commit 1ed09e2f4360cba2c480e64077421aa0cbc6ebc8
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:37:37 2013 +0200

    puv3_gpio: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/puv3_gpio.c b/hw/gpio/puv3_gpio.c
index 18671eb..39840aa 100644
--- a/hw/gpio/puv3_gpio.c
+++ b/hw/gpio/puv3_gpio.c
@@ -14,8 +14,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_GPIO "puv3_gpio"
+#define PUV3_GPIO(obj) OBJECT_CHECK(PUV3GPIOState, (obj), TYPE_PUV3_GPIO)
+
+typedef struct PUV3GPIOState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq[9];
 
@@ -96,7 +100,7 @@ static const MemoryRegionOps puv3_gpio_ops = {
 
 static int puv3_gpio_init(SysBusDevice *dev)
 {
-    PUV3GPIOState *s = FROM_SYSBUS(PUV3GPIOState, dev);
+    PUV3GPIOState *s = PUV3_GPIO(dev);
 
     s->reg_GPLR = 0;
     s->reg_GPDR = 0;
@@ -127,7 +131,7 @@ static void puv3_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_gpio_info = {
-    .name = "puv3_gpio",
+    .name = TYPE_PUV3_GPIO,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3GPIOState),
     .class_init = puv3_gpio_class_init,
commit 692a76d1c4a32573bf3cc19110c7fa6cc8c93f60
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:31:46 2013 +0200

    pl061: QOM'ify pl061 and pl061_luminary
    
    Let pl061_luminary inherit from pl061, with differing instance_init.
    Introduce type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index e97ad8a..dd4ea29 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -28,8 +28,12 @@ static const uint8_t pl061_id[12] =
 static const uint8_t pl061_id_luminary[12] =
   { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
+#define TYPE_PL061 "pl061"
+#define PL061(obj) OBJECT_CHECK(PL061State, (obj), TYPE_PL061)
+
 typedef struct PL061State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t locked;
     uint32_t data;
@@ -272,27 +276,32 @@ static const MemoryRegionOps pl061_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl061_init(SysBusDevice *dev, const unsigned char *id)
+static int pl061_initfn(SysBusDevice *sbd)
 {
-    PL061State *s = FROM_SYSBUS(PL061State, dev);
-    s->id = id;
+    DeviceState *dev = DEVICE(sbd);
+    PL061State *s = PL061(dev);
+
     memory_region_init_io(&s->iomem, OBJECT(s), &pl061_ops, s, "pl061", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&dev->qdev, pl061_set_irq, 8);
-    qdev_init_gpio_out(&dev->qdev, s->out, 8);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, pl061_set_irq, 8);
+    qdev_init_gpio_out(dev, s->out, 8);
     pl061_reset(s);
     return 0;
 }
 
-static int pl061_init_luminary(SysBusDevice *dev)
+static void pl061_luminary_init(Object *obj)
 {
-    return pl061_init(dev, pl061_id_luminary);
+    PL061State *s = PL061(obj);
+
+    s->id = pl061_id_luminary;
 }
 
-static int pl061_init_arm(SysBusDevice *dev)
+static void pl061_init(Object *obj)
 {
-    return pl061_init(dev, pl061_id);
+    PL061State *s = PL061(obj);
+
+    s->id = pl061_id;
 }
 
 static void pl061_class_init(ObjectClass *klass, void *data)
@@ -300,31 +309,22 @@ static void pl061_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pl061_init_arm;
+    k->init = pl061_initfn;
     dc->vmsd = &vmstate_pl061;
 }
 
 static const TypeInfo pl061_info = {
-    .name          = "pl061",
+    .name          = TYPE_PL061,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL061State),
+    .instance_init = pl061_init,
     .class_init    = pl061_class_init,
 };
 
-static void pl061_luminary_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl061_init_luminary;
-    dc->vmsd = &vmstate_pl061;
-}
-
 static const TypeInfo pl061_luminary_info = {
     .name          = "pl061_luminary",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL061State),
-    .class_init    = pl061_luminary_class_init,
+    .parent        = TYPE_PL061,
+    .instance_init = pl061_luminary_init,
 };
 
 static void pl061_register_types(void)
commit ee663e96e4db735d19dc2672150b6ccc87cc29fe
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:21:21 2013 +0200

    pl061: Rename pl061_state to PL061State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index a0bbf08..e97ad8a 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -28,7 +28,7 @@ static const uint8_t pl061_id[12] =
 static const uint8_t pl061_id_luminary[12] =
   { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
-typedef struct {
+typedef struct PL061State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t locked;
@@ -55,39 +55,39 @@ typedef struct {
     qemu_irq irq;
     qemu_irq out[8];
     const unsigned char *id;
-} pl061_state;
+} PL061State;
 
 static const VMStateDescription vmstate_pl061 = {
     .name = "pl061",
     .version_id = 2,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(locked, pl061_state),
-        VMSTATE_UINT32(data, pl061_state),
-        VMSTATE_UINT32(old_data, pl061_state),
-        VMSTATE_UINT32(dir, pl061_state),
-        VMSTATE_UINT32(isense, pl061_state),
-        VMSTATE_UINT32(ibe, pl061_state),
-        VMSTATE_UINT32(iev, pl061_state),
-        VMSTATE_UINT32(im, pl061_state),
-        VMSTATE_UINT32(istate, pl061_state),
-        VMSTATE_UINT32(afsel, pl061_state),
-        VMSTATE_UINT32(dr2r, pl061_state),
-        VMSTATE_UINT32(dr4r, pl061_state),
-        VMSTATE_UINT32(dr8r, pl061_state),
-        VMSTATE_UINT32(odr, pl061_state),
-        VMSTATE_UINT32(pur, pl061_state),
-        VMSTATE_UINT32(pdr, pl061_state),
-        VMSTATE_UINT32(slr, pl061_state),
-        VMSTATE_UINT32(den, pl061_state),
-        VMSTATE_UINT32(cr, pl061_state),
-        VMSTATE_UINT32(float_high, pl061_state),
-        VMSTATE_UINT32_V(amsel, pl061_state, 2),
+        VMSTATE_UINT32(locked, PL061State),
+        VMSTATE_UINT32(data, PL061State),
+        VMSTATE_UINT32(old_data, PL061State),
+        VMSTATE_UINT32(dir, PL061State),
+        VMSTATE_UINT32(isense, PL061State),
+        VMSTATE_UINT32(ibe, PL061State),
+        VMSTATE_UINT32(iev, PL061State),
+        VMSTATE_UINT32(im, PL061State),
+        VMSTATE_UINT32(istate, PL061State),
+        VMSTATE_UINT32(afsel, PL061State),
+        VMSTATE_UINT32(dr2r, PL061State),
+        VMSTATE_UINT32(dr4r, PL061State),
+        VMSTATE_UINT32(dr8r, PL061State),
+        VMSTATE_UINT32(odr, PL061State),
+        VMSTATE_UINT32(pur, PL061State),
+        VMSTATE_UINT32(pdr, PL061State),
+        VMSTATE_UINT32(slr, PL061State),
+        VMSTATE_UINT32(den, PL061State),
+        VMSTATE_UINT32(cr, PL061State),
+        VMSTATE_UINT32(float_high, PL061State),
+        VMSTATE_UINT32_V(amsel, PL061State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static void pl061_update(pl061_state *s)
+static void pl061_update(PL061State *s)
 {
     uint8_t changed;
     uint8_t mask;
@@ -116,7 +116,7 @@ static void pl061_update(pl061_state *s)
 static uint64_t pl061_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
 
     if (offset >= 0xfd0 && offset < 0x1000) {
         return s->id[(offset - 0xfd0) >> 2];
@@ -173,7 +173,7 @@ static uint64_t pl061_read(void *opaque, hwaddr offset,
 static void pl061_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
     uint8_t mask;
 
     if (offset < 0x400) {
@@ -246,7 +246,7 @@ static void pl061_write(void *opaque, hwaddr offset,
     pl061_update(s);
 }
 
-static void pl061_reset(pl061_state *s)
+static void pl061_reset(PL061State *s)
 {
   s->locked = 1;
   s->cr = 0xff;
@@ -254,7 +254,7 @@ static void pl061_reset(pl061_state *s)
 
 static void pl061_set_irq(void * opaque, int irq, int level)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
     uint8_t mask;
 
     mask = 1 << irq;
@@ -274,7 +274,7 @@ static const MemoryRegionOps pl061_ops = {
 
 static int pl061_init(SysBusDevice *dev, const unsigned char *id)
 {
-    pl061_state *s = FROM_SYSBUS(pl061_state, dev);
+    PL061State *s = FROM_SYSBUS(PL061State, dev);
     s->id = id;
     memory_region_init_io(&s->iomem, OBJECT(s), &pl061_ops, s, "pl061", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -307,7 +307,7 @@ static void pl061_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl061_info = {
     .name          = "pl061",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl061_state),
+    .instance_size = sizeof(PL061State),
     .class_init    = pl061_class_init,
 };
 
@@ -323,7 +323,7 @@ static void pl061_luminary_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl061_luminary_info = {
     .name          = "pl061_luminary",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl061_state),
+    .instance_size = sizeof(PL061State),
     .class_init    = pl061_luminary_class_init,
 };
 
commit 74d1e352be53d8208996772bb51c5a965fae7d06
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:19:36 2013 +0200

    omap_gpio: QOM cast cleanup for omap2_gpif_s
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 295caad..b8f572b 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -208,8 +208,13 @@ struct omap2_gpio_s {
     uint8_t delay;
 };
 
+#define TYPE_OMAP2_GPIO "omap2-gpio"
+#define OMAP2_GPIO(obj) \
+    OBJECT_CHECK(struct omap2_gpif_s, (obj), TYPE_OMAP2_GPIO)
+
 struct omap2_gpif_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int mpu_model;
     void *iclk;
@@ -599,9 +604,9 @@ static void omap_gpif_reset(DeviceState *dev)
 
 static void omap2_gpif_reset(DeviceState *dev)
 {
+    struct omap2_gpif_s *s = OMAP2_GPIO(dev);
     int i;
-    struct omap2_gpif_s *s = FROM_SYSBUS(struct omap2_gpif_s,
-                    SYS_BUS_DEVICE(dev));
+
     for (i = 0; i < s->modulecount; i++) {
         omap2_gpio_module_reset(&s->modules[i]);
     }
@@ -653,7 +658,7 @@ static void omap2_gpif_top_write(void *opaque, hwaddr addr,
 
     case 0x10:	/* IPGENERICOCPSPL_SYSCONFIG */
         if (value & (1 << 1))					/* SOFTRESET */
-            omap2_gpif_reset(&s->busdev.qdev);
+            omap2_gpif_reset(DEVICE(s));
         s->autoidle = value & 1;
         break;
 
@@ -690,10 +695,12 @@ static int omap_gpio_init(SysBusDevice *sbd)
     return 0;
 }
 
-static int omap2_gpio_init(SysBusDevice *dev)
+static int omap2_gpio_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    struct omap2_gpif_s *s = OMAP2_GPIO(dev);
     int i;
-    struct omap2_gpif_s *s = FROM_SYSBUS(struct omap2_gpif_s, dev);
+
     if (!s->iclk) {
         hw_error("omap2-gpio: iclk not connected\n");
     }
@@ -701,14 +708,14 @@ static int omap2_gpio_init(SysBusDevice *dev)
         s->modulecount = (s->mpu_model < omap2430) ? 4 : 5;
         memory_region_init_io(&s->iomem, OBJECT(s), &omap2_gpif_top_ops, s,
                               "omap2.gpio", 0x1000);
-        sysbus_init_mmio(dev, &s->iomem);
+        sysbus_init_mmio(sbd, &s->iomem);
     } else {
         s->modulecount = 6;
     }
     s->modules = g_malloc0(s->modulecount * sizeof(struct omap2_gpio_s));
     s->handler = g_malloc0(s->modulecount * 32 * sizeof(qemu_irq));
-    qdev_init_gpio_in(&dev->qdev, omap2_gpio_set, s->modulecount * 32);
-    qdev_init_gpio_out(&dev->qdev, s->handler, s->modulecount * 32);
+    qdev_init_gpio_in(dev, omap2_gpio_set, s->modulecount * 32);
+    qdev_init_gpio_out(dev, s->handler, s->modulecount * 32);
     for (i = 0; i < s->modulecount; i++) {
         struct omap2_gpio_s *m = &s->modules[i];
         if (!s->fclk[i]) {
@@ -716,12 +723,12 @@ static int omap2_gpio_init(SysBusDevice *dev)
         }
         m->revision = (s->mpu_model < omap3430) ? 0x18 : 0x25;
         m->handler = &s->handler[i * 32];
-        sysbus_init_irq(dev, &m->irq[0]); /* mpu irq */
-        sysbus_init_irq(dev, &m->irq[1]); /* dsp irq */
-        sysbus_init_irq(dev, &m->wkup);
+        sysbus_init_irq(sbd, &m->irq[0]); /* mpu irq */
+        sysbus_init_irq(sbd, &m->irq[1]); /* dsp irq */
+        sysbus_init_irq(sbd, &m->wkup);
         memory_region_init_io(&m->iomem, OBJECT(s), &omap2_gpio_module_ops, m,
                               "omap.gpio-module", 0x1000);
-        sysbus_init_mmio(dev, &m->iomem);
+        sysbus_init_mmio(sbd, &m->iomem);
     }
     return 0;
 }
@@ -784,7 +791,7 @@ static void omap2_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo omap2_gpio_info = {
-    .name          = "omap2-gpio",
+    .name          = TYPE_OMAP2_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap2_gpif_s),
     .class_init    = omap2_gpio_class_init,
commit 1d300b5f6f759f5d0a7866d3da320ebae0f0b79c
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:14:40 2013 +0200

    omap_gpio: QOM cast cleanup for omap_gpif_s
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 855afae..295caad 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -35,8 +35,13 @@ struct omap_gpio_s {
     uint16_t pins;
 };
 
+#define TYPE_OMAP1_GPIO "omap-gpio"
+#define OMAP1_GPIO(obj) \
+    OBJECT_CHECK(struct omap_gpif_s, (obj), TYPE_OMAP1_GPIO)
+
 struct omap_gpif_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int mpu_model;
     void *clk;
@@ -587,8 +592,8 @@ static const MemoryRegionOps omap2_gpio_module_ops = {
 
 static void omap_gpif_reset(DeviceState *dev)
 {
-    struct omap_gpif_s *s = FROM_SYSBUS(struct omap_gpif_s,
-                    SYS_BUS_DEVICE(dev));
+    struct omap_gpif_s *s = OMAP1_GPIO(dev);
+
     omap_gpio_reset(&s->omap1);
 }
 
@@ -668,18 +673,20 @@ static const MemoryRegionOps omap2_gpif_top_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int omap_gpio_init(SysBusDevice *dev)
+static int omap_gpio_init(SysBusDevice *sbd)
 {
-    struct omap_gpif_s *s = FROM_SYSBUS(struct omap_gpif_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_gpif_s *s = OMAP1_GPIO(dev);
+
     if (!s->clk) {
         hw_error("omap-gpio: clk not connected\n");
     }
-    qdev_init_gpio_in(&dev->qdev, omap_gpio_set, 16);
-    qdev_init_gpio_out(&dev->qdev, s->omap1.handler, 16);
-    sysbus_init_irq(dev, &s->omap1.irq);
+    qdev_init_gpio_in(dev, omap_gpio_set, 16);
+    qdev_init_gpio_out(dev, s->omap1.handler, 16);
+    sysbus_init_irq(sbd, &s->omap1.irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &omap_gpio_ops, &s->omap1,
                           "omap.gpio", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -748,7 +755,7 @@ static void omap_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo omap_gpio_info = {
-    .name          = "omap-gpio",
+    .name          = TYPE_OMAP1_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap_gpif_s),
     .class_init    = omap_gpio_class_init,
commit 049e7d226e08bbf50c17ffdc3a6793c6e45e77f2
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:58:49 2013 +0200

    sun4m_iommu: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/sun4m_iommu.c b/hw/dma/sun4m_iommu.c
index edb93f3..a04409a 100644
--- a/hw/dma/sun4m_iommu.c
+++ b/hw/dma/sun4m_iommu.c
@@ -126,8 +126,12 @@
 #define IOMMU_PAGE_SIZE     (1 << IOMMU_PAGE_SHIFT)
 #define IOMMU_PAGE_MASK     ~(IOMMU_PAGE_SIZE - 1)
 
+#define TYPE_SUN4M_IOMMU "iommu"
+#define SUN4M_IOMMU(obj) OBJECT_CHECK(IOMMUState, (obj), TYPE_SUN4M_IOMMU)
+
 typedef struct IOMMUState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t regs[IOMMU_NREGS];
     hwaddr iostart;
@@ -332,7 +336,7 @@ static const VMStateDescription vmstate_iommu = {
 
 static void iommu_reset(DeviceState *d)
 {
-    IOMMUState *s = container_of(d, IOMMUState, busdev.qdev);
+    IOMMUState *s = SUN4M_IOMMU(d);
 
     memset(s->regs, 0, IOMMU_NREGS * 4);
     s->iostart = 0;
@@ -345,7 +349,7 @@ static void iommu_reset(DeviceState *d)
 
 static int iommu_init1(SysBusDevice *dev)
 {
-    IOMMUState *s = FROM_SYSBUS(IOMMUState, dev);
+    IOMMUState *s = SUN4M_IOMMU(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -373,7 +377,7 @@ static void iommu_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo iommu_info = {
-    .name          = "iommu",
+    .name          = TYPE_SUN4M_IOMMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IOMMUState),
     .class_init    = iommu_class_init,
commit 70cd8d4b75e91272a28a140818a52f5e32ef4375
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:55:59 2013 +0200

    sparc32_dma: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/sparc32_dma.c b/hw/dma/sparc32_dma.c
index be6275f..2a92ffb 100644
--- a/hw/dma/sparc32_dma.c
+++ b/hw/dma/sparc32_dma.c
@@ -60,10 +60,14 @@
 /* XXX SCSI and ethernet should have different read-only bit masks */
 #define DMA_CSR_RO_MASK 0xfe000007
 
+#define TYPE_SPARC32_DMA "sparc32_dma"
+#define SPARC32_DMA(obj) OBJECT_CHECK(DMAState, (obj), TYPE_SPARC32_DMA)
+
 typedef struct DMAState DMAState;
 
 struct DMAState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t dmaregs[DMA_REGS];
     qemu_irq irq;
@@ -249,7 +253,7 @@ static const MemoryRegionOps dma_mem_ops = {
 
 static void dma_reset(DeviceState *d)
 {
-    DMAState *s = container_of(d, DMAState, busdev.qdev);
+    DMAState *s = SPARC32_DMA(d);
 
     memset(s->dmaregs, 0, DMA_SIZE);
     s->dmaregs[0] = DMA_VER;
@@ -266,20 +270,21 @@ static const VMStateDescription vmstate_dma = {
     }
 };
 
-static int sparc32_dma_init1(SysBusDevice *dev)
+static int sparc32_dma_init1(SysBusDevice *sbd)
 {
-    DMAState *s = FROM_SYSBUS(DMAState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    DMAState *s = SPARC32_DMA(dev);
     int reg_size;
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     reg_size = s->is_ledma ? DMA_ETH_SIZE : DMA_SIZE;
     memory_region_init_io(&s->iomem, OBJECT(s), &dma_mem_ops, s,
                           "dma", reg_size);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_in(&dev->qdev, dma_set_irq, 1);
-    qdev_init_gpio_out(&dev->qdev, s->gpio, 2);
+    qdev_init_gpio_in(dev, dma_set_irq, 1);
+    qdev_init_gpio_out(dev, s->gpio, 2);
 
     return 0;
 }
@@ -302,7 +307,7 @@ static void sparc32_dma_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sparc32_dma_info = {
-    .name          = "sparc32_dma",
+    .name          = TYPE_SPARC32_DMA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(DMAState),
     .class_init    = sparc32_dma_class_init,
commit 358cd7ac59ffbb4cef126439f829443d343e2b94
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:43:17 2013 +0200

    pxa2xx_dma: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/pxa2xx_dma.c b/hw/dma/pxa2xx_dma.c
index bc7bf4c..c013abb 100644
--- a/hw/dma/pxa2xx_dma.c
+++ b/hw/dma/pxa2xx_dma.c
@@ -26,8 +26,12 @@ typedef struct {
     int request;
 } PXA2xxDMAChannel;
 
+#define TYPE_PXA2XX_DMA "pxa2xx-dma"
+#define PXA2XX_DMA(obj) OBJECT_CHECK(PXA2xxDMAState, (obj), TYPE_PXA2XX_DMA)
+
 typedef struct PXA2xxDMAState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -445,11 +449,11 @@ static void pxa2xx_dma_request(void *opaque, int req_num, int on)
     }
 }
 
-static int pxa2xx_dma_init(SysBusDevice *dev)
+static int pxa2xx_dma_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxDMAState *s = PXA2XX_DMA(dev);
     int i;
-    PXA2xxDMAState *s;
-    s = FROM_SYSBUS(PXA2xxDMAState, dev);
 
     if (s->channels <= 0) {
         return -1;
@@ -463,12 +467,12 @@ static int pxa2xx_dma_init(SysBusDevice *dev)
 
     memset(s->req, 0, sizeof(uint8_t) * PXA2XX_DMA_NUM_REQUESTS);
 
-    qdev_init_gpio_in(&dev->qdev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
+    qdev_init_gpio_in(dev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_dma_ops, s,
                           "pxa2xx.dma", 0x00010000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     return 0;
 }
@@ -560,7 +564,7 @@ static void pxa2xx_dma_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_dma_info = {
-    .name          = "pxa2xx-dma",
+    .name          = TYPE_PXA2XX_DMA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxDMAState),
     .class_init    = pxa2xx_dma_class_init,
commit 6df7cdee0b0e3667a0e7f811a9682e492f21c738
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:04:39 2013 +0200

    puv3_dma: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/puv3_dma.c b/hw/dma/puv3_dma.c
index 36004ae..101bd7f 100644
--- a/hw/dma/puv3_dma.c
+++ b/hw/dma/puv3_dma.c
@@ -18,8 +18,12 @@
 #define PUV3_DMA_CH_MASK        (0xff)
 #define PUV3_DMA_CH(offset)     ((offset) >> 8)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_DMA "puv3_dma"
+#define PUV3_DMA(obj) OBJECT_CHECK(PUV3DMAState, (obj), TYPE_PUV3_DMA)
+
+typedef struct PUV3DMAState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t reg_CFG[PUV3_DMA_CH_NR];
 } PUV3DMAState;
@@ -73,7 +77,7 @@ static const MemoryRegionOps puv3_dma_ops = {
 
 static int puv3_dma_init(SysBusDevice *dev)
 {
-    PUV3DMAState *s = FROM_SYSBUS(PUV3DMAState, dev);
+    PUV3DMAState *s = PUV3_DMA(dev);
     int i;
 
     for (i = 0; i < PUV3_DMA_CH_NR; i++) {
@@ -95,7 +99,7 @@ static void puv3_dma_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_dma_info = {
-    .name = "puv3_dma",
+    .name = TYPE_PUV3_DMA,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3DMAState),
     .class_init = puv3_dma_class_init,
commit 4f800554f2b324b3cd5ea6a0e69e9e9b409aa65b
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 12:47:17 2013 +0200

    pl080: QOM'ify pl080 and pl081
    
    Let pl081 inherit from pl080 and replace triple SysBus initfn with two
    instance_inits.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 189a922..35b9015 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -35,8 +35,12 @@ typedef struct {
     uint32_t conf;
 } pl080_channel;
 
+#define TYPE_PL080 "pl080"
+#define PL080(obj) OBJECT_CHECK(PL080State, (obj), TYPE_PL080)
+
 typedef struct PL080State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint8_t tc_int;
     uint8_t tc_mask;
@@ -355,59 +359,44 @@ static const MemoryRegionOps pl080_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl08x_init(SysBusDevice *dev, int nchannels)
+static void pl080_init(Object *obj)
 {
-    PL080State *s = FROM_SYSBUS(PL080State, dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    PL080State *s = PL080(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->nchannels = nchannels;
-    return 0;
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->nchannels = 8;
 }
 
-static int pl080_init(SysBusDevice *dev)
+static void pl081_init(Object *obj)
 {
-    return pl08x_init(dev, 8);
-}
+    PL080State *s = PL080(obj);
 
-static int pl081_init(SysBusDevice *dev)
-{
-    return pl08x_init(dev, 2);
+    s->nchannels = 2;
 }
 
-static void pl080_class_init(ObjectClass *klass, void *data)
+static void pl080_class_init(ObjectClass *oc, void *data)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-    k->init = pl080_init;
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl080;
 }
 
 static const TypeInfo pl080_info = {
-    .name          = "pl080",
+    .name          = TYPE_PL080,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL080State),
+    .instance_init = pl080_init,
     .class_init    = pl080_class_init,
 };
 
-static void pl081_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl081_init;
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl080;
-}
-
 static const TypeInfo pl081_info = {
     .name          = "pl081",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL080State),
-    .class_init    = pl081_class_init,
+    .parent        = TYPE_PL080,
+    .instance_init = pl081_init,
 };
 
 /* The PL080 and PL081 are the same except for the number of channels
commit d7ba0a62c58c3a30bc75377b1209dafc613c73be
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 12:37:06 2013 +0200

    pl080: Rename pl080_state to PL080State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 7937c3e..189a922 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -35,7 +35,7 @@ typedef struct {
     uint32_t conf;
 } pl080_channel;
 
-typedef struct {
+typedef struct PL080State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint8_t tc_int;
@@ -51,7 +51,7 @@ typedef struct {
     /* Flag to avoid recursive DMA invocations.  */
     int running;
     qemu_irq irq;
-} pl080_state;
+} PL080State;
 
 static const VMStateDescription vmstate_pl080_channel = {
     .name = "pl080_channel",
@@ -72,20 +72,20 @@ static const VMStateDescription vmstate_pl080 = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_mask, pl080_state),
-        VMSTATE_UINT8(err_int, pl080_state),
-        VMSTATE_UINT8(err_mask, pl080_state),
-        VMSTATE_UINT32(conf, pl080_state),
-        VMSTATE_UINT32(sync, pl080_state),
-        VMSTATE_UINT32(req_single, pl080_state),
-        VMSTATE_UINT32(req_burst, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_STRUCT_ARRAY(chan, pl080_state, PL080_MAX_CHANNELS,
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_mask, PL080State),
+        VMSTATE_UINT8(err_int, PL080State),
+        VMSTATE_UINT8(err_mask, PL080State),
+        VMSTATE_UINT32(conf, PL080State),
+        VMSTATE_UINT32(sync, PL080State),
+        VMSTATE_UINT32(req_single, PL080State),
+        VMSTATE_UINT32(req_burst, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_STRUCT_ARRAY(chan, PL080State, PL080_MAX_CHANNELS,
                              1, vmstate_pl080_channel, pl080_channel),
-        VMSTATE_INT32(running, pl080_state),
+        VMSTATE_INT32(running, PL080State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -96,7 +96,7 @@ static const unsigned char pl080_id[] =
 static const unsigned char pl081_id[] =
 { 0x81, 0x10, 0x04, 0x0a, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl080_update(pl080_state *s)
+static void pl080_update(PL080State *s)
 {
     if ((s->tc_int & s->tc_mask)
             || (s->err_int & s->err_mask))
@@ -105,7 +105,7 @@ static void pl080_update(pl080_state *s)
         qemu_irq_lower(s->irq);
 }
 
-static void pl080_run(pl080_state *s)
+static void pl080_run(PL080State *s)
 {
     int c;
     int flow;
@@ -221,7 +221,7 @@ again:
 static uint64_t pl080_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl080_state *s = (pl080_state *)opaque;
+    PL080State *s = (PL080State *)opaque;
     uint32_t i;
     uint32_t mask;
 
@@ -290,7 +290,7 @@ static uint64_t pl080_read(void *opaque, hwaddr offset,
 static void pl080_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl080_state *s = (pl080_state *)opaque;
+    PL080State *s = (PL080State *)opaque;
     int i;
 
     if (offset >= 0x100 && offset < 0x200) {
@@ -357,7 +357,7 @@ static const MemoryRegionOps pl080_ops = {
 
 static int pl08x_init(SysBusDevice *dev, int nchannels)
 {
-    pl080_state *s = FROM_SYSBUS(pl080_state, dev);
+    PL080State *s = FROM_SYSBUS(PL080State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -389,7 +389,7 @@ static void pl080_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl080_info = {
     .name          = "pl080",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl080_state),
+    .instance_size = sizeof(PL080State),
     .class_init    = pl080_class_init,
 };
 
@@ -406,7 +406,7 @@ static void pl081_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl081_info = {
     .name          = "pl081",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl080_state),
+    .instance_size = sizeof(PL080State),
     .class_init    = pl081_class_init,
 };
 
commit 8df81c4b11f19eae16b88d5da3ab85704d49e6b0
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:48:30 2013 +0200

    empty_slot: QOM cast cleanup
    
    Introduce type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/core/empty_slot.c b/hw/core/empty_slot.c
index e624991..612b109 100644
--- a/hw/core/empty_slot.c
+++ b/hw/core/empty_slot.c
@@ -22,8 +22,12 @@
 #define DPRINTF(fmt, ...) do {} while (0)
 #endif
 
+#define TYPE_EMPTY_SLOT "empty_slot"
+#define EMPTY_SLOT(obj) OBJECT_CHECK(EmptySlot, (obj), TYPE_EMPTY_SLOT)
+
 typedef struct EmptySlot {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint64_t size;
 } EmptySlot;
@@ -55,9 +59,9 @@ void empty_slot_init(hwaddr addr, uint64_t slot_size)
         SysBusDevice *s;
         EmptySlot *e;
 
-        dev = qdev_create(NULL, "empty_slot");
+        dev = qdev_create(NULL, TYPE_EMPTY_SLOT);
         s = SYS_BUS_DEVICE(dev);
-        e = FROM_SYSBUS(EmptySlot, s);
+        e = EMPTY_SLOT(dev);
         e->size = slot_size;
 
         qdev_init_nofail(dev);
@@ -68,7 +72,7 @@ void empty_slot_init(hwaddr addr, uint64_t slot_size)
 
 static int empty_slot_init1(SysBusDevice *dev)
 {
-    EmptySlot *s = FROM_SYSBUS(EmptySlot, dev);
+    EmptySlot *s = EMPTY_SLOT(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &empty_slot_ops, s,
                           "empty-slot", s->size);
@@ -84,7 +88,7 @@ static void empty_slot_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo empty_slot_info = {
-    .name          = "empty_slot",
+    .name          = TYPE_EMPTY_SLOT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(EmptySlot),
     .class_init    = empty_slot_class_init,
commit 71ffe1a01faa90fa08805e8030120b3be0efda25
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:29:17 2013 +0200

    pl011: QOM'ify pl011 and pl011_luminary
    
    Let the Luminary variant inherit from the ARM one, overwriting its ID on
    instance_init. Introduce type constant and use QOM casts. Replace
    triplicated SysBusDevice initfn with QOM realizefn and instance_init.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index e0f7071..a8ae6f4 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -10,8 +10,12 @@
 #include "hw/sysbus.h"
 #include "sysemu/char.h"
 
+#define TYPE_PL011 "pl011"
+#define PL011(obj) OBJECT_CHECK(PL011State, (obj), TYPE_PL011)
+
 typedef struct PL011State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t readbuff;
     uint32_t flags;
@@ -261,64 +265,62 @@ static const VMStateDescription vmstate_pl011 = {
     }
 };
 
-static int pl011_init(SysBusDevice *dev, const unsigned char *id)
+static void pl011_init(Object *obj)
 {
-    PL011State *s = FROM_SYSBUS(PL011State, dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    PL011State *s = PL011(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl011_ops, s, "pl011", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->id = id;
-    s->chr = qemu_char_get_next_serial();
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->read_trigger = 1;
     s->ifl = 0x12;
     s->cr = 0x300;
     s->flags = 0x90;
-    if (s->chr) {
-        qemu_chr_add_handlers(s->chr, pl011_can_receive, pl011_receive,
-                              pl011_event, s);
-    }
-    vmstate_register(&dev->qdev, -1, &vmstate_pl011, s);
-    return 0;
-}
 
-static int pl011_arm_init(SysBusDevice *dev)
-{
-    return pl011_init(dev, pl011_id_arm);
+    s->id = pl011_id_arm;
 }
 
-static int pl011_luminary_init(SysBusDevice *dev)
+static void pl011_realize(DeviceState *dev, Error **errp)
 {
-    return pl011_init(dev, pl011_id_luminary);
+    PL011State *s = PL011(dev);
+
+    s->chr = qemu_char_get_next_serial();
+
+    if (s->chr) {
+        qemu_chr_add_handlers(s->chr, pl011_can_receive, pl011_receive,
+                              pl011_event, s);
+    }
 }
 
-static void pl011_arm_class_init(ObjectClass *klass, void *data)
+static void pl011_class_init(ObjectClass *oc, void *data)
 {
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-    sdc->init = pl011_arm_init;
+    dc->realize = pl011_realize;
+    dc->vmsd = &vmstate_pl011;
 }
 
 static const TypeInfo pl011_arm_info = {
-    .name          = "pl011",
+    .name          = TYPE_PL011,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL011State),
-    .class_init    = pl011_arm_class_init,
+    .instance_init = pl011_init,
+    .class_init    = pl011_class_init,
 };
 
-static void pl011_luminary_class_init(ObjectClass *klass, void *data)
+static void pl011_luminary_init(Object *obj)
 {
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
+    PL011State *s = PL011(obj);
 
-    sdc->init = pl011_luminary_init;
+    s->id = pl011_id_luminary;
 }
 
 static const TypeInfo pl011_luminary_info = {
     .name          = "pl011_luminary",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL011State),
-    .class_init    = pl011_luminary_class_init,
+    .parent        = TYPE_PL011,
+    .instance_init = pl011_luminary_init,
 };
 
 static void pl011_register_types(void)
commit ab640bfc2e0ae70ce7d11122ad30957ad53a1836
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:13:57 2013 +0200

    pl011: Rename pl011_state
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index ebec64f..e0f7071 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -10,7 +10,7 @@
 #include "hw/sysbus.h"
 #include "sysemu/char.h"
 
-typedef struct {
+typedef struct PL011State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t readbuff;
@@ -31,7 +31,7 @@ typedef struct {
     CharDriverState *chr;
     qemu_irq irq;
     const unsigned char *id;
-} pl011_state;
+} PL011State;
 
 #define PL011_INT_TX 0x20
 #define PL011_INT_RX 0x10
@@ -46,7 +46,7 @@ static const unsigned char pl011_id_arm[8] =
 static const unsigned char pl011_id_luminary[8] =
   { 0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl011_update(pl011_state *s)
+static void pl011_update(PL011State *s)
 {
     uint32_t flags;
 
@@ -57,7 +57,7 @@ static void pl011_update(pl011_state *s)
 static uint64_t pl011_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     uint32_t c;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -113,7 +113,7 @@ static uint64_t pl011_read(void *opaque, hwaddr offset,
     }
 }
 
-static void pl011_set_read_trigger(pl011_state *s)
+static void pl011_set_read_trigger(PL011State *s)
 {
 #if 0
     /* The docs say the RX interrupt is triggered when the FIFO exceeds
@@ -130,7 +130,7 @@ static void pl011_set_read_trigger(pl011_state *s)
 static void pl011_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     unsigned char ch;
 
     switch (offset >> 2) {
@@ -191,7 +191,7 @@ static void pl011_write(void *opaque, hwaddr offset,
 
 static int pl011_can_receive(void *opaque)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
 
     if (s->lcr & 0x10)
         return s->read_count < 16;
@@ -201,7 +201,7 @@ static int pl011_can_receive(void *opaque)
 
 static void pl011_put_fifo(void *opaque, uint32_t value)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     int slot;
 
     slot = s->read_pos + s->read_count;
@@ -242,28 +242,28 @@ static const VMStateDescription vmstate_pl011 = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_UINT32(readbuff, pl011_state),
-        VMSTATE_UINT32(flags, pl011_state),
-        VMSTATE_UINT32(lcr, pl011_state),
-        VMSTATE_UINT32(cr, pl011_state),
-        VMSTATE_UINT32(dmacr, pl011_state),
-        VMSTATE_UINT32(int_enabled, pl011_state),
-        VMSTATE_UINT32(int_level, pl011_state),
-        VMSTATE_UINT32_ARRAY(read_fifo, pl011_state, 16),
-        VMSTATE_UINT32(ilpr, pl011_state),
-        VMSTATE_UINT32(ibrd, pl011_state),
-        VMSTATE_UINT32(fbrd, pl011_state),
-        VMSTATE_UINT32(ifl, pl011_state),
-        VMSTATE_INT32(read_pos, pl011_state),
-        VMSTATE_INT32(read_count, pl011_state),
-        VMSTATE_INT32(read_trigger, pl011_state),
+        VMSTATE_UINT32(readbuff, PL011State),
+        VMSTATE_UINT32(flags, PL011State),
+        VMSTATE_UINT32(lcr, PL011State),
+        VMSTATE_UINT32(cr, PL011State),
+        VMSTATE_UINT32(dmacr, PL011State),
+        VMSTATE_UINT32(int_enabled, PL011State),
+        VMSTATE_UINT32(int_level, PL011State),
+        VMSTATE_UINT32_ARRAY(read_fifo, PL011State, 16),
+        VMSTATE_UINT32(ilpr, PL011State),
+        VMSTATE_UINT32(ibrd, PL011State),
+        VMSTATE_UINT32(fbrd, PL011State),
+        VMSTATE_UINT32(ifl, PL011State),
+        VMSTATE_INT32(read_pos, PL011State),
+        VMSTATE_INT32(read_count, PL011State),
+        VMSTATE_INT32(read_trigger, PL011State),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static int pl011_init(SysBusDevice *dev, const unsigned char *id)
 {
-    pl011_state *s = FROM_SYSBUS(pl011_state, dev);
+    PL011State *s = FROM_SYSBUS(PL011State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl011_ops, s, "pl011", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -303,7 +303,7 @@ static void pl011_arm_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl011_arm_info = {
     .name          = "pl011",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl011_state),
+    .instance_size = sizeof(PL011State),
     .class_init    = pl011_arm_class_init,
 };
 
@@ -317,7 +317,7 @@ static void pl011_luminary_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl011_luminary_info = {
     .name          = "pl011_luminary",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl011_state),
+    .instance_size = sizeof(PL011State),
     .class_init    = pl011_luminary_class_init,
 };
 
commit 79bbe8bf3dbd701a13e2abe0ca0acdfae3e2231d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:08:14 2013 +0200

    milkymist-uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/milkymist-uart.c b/hw/char/milkymist-uart.c
index 46deab2..2e4b5c5 100644
--- a/hw/char/milkymist-uart.c
+++ b/hw/char/milkymist-uart.c
@@ -52,8 +52,13 @@ enum {
     DBG_BREAK_EN = (1<<0),
 };
 
+#define TYPE_MILKYMIST_UART "milkymist-uart"
+#define MILKYMIST_UART(obj) \
+    OBJECT_CHECK(MilkymistUartState, (obj), TYPE_MILKYMIST_UART)
+
 struct MilkymistUartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -179,7 +184,7 @@ static void uart_event(void *opaque, int event)
 
 static void milkymist_uart_reset(DeviceState *d)
 {
-    MilkymistUartState *s = container_of(d, MilkymistUartState, busdev.qdev);
+    MilkymistUartState *s = MILKYMIST_UART(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -192,12 +197,12 @@ static void milkymist_uart_reset(DeviceState *d)
 
 static int milkymist_uart_init(SysBusDevice *dev)
 {
-    MilkymistUartState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistUartState *s = MILKYMIST_UART(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
     memory_region_init_io(&s->regs_region, OBJECT(s), &uart_mmio_ops, s,
-            "milkymist-uart", R_MAX * 4);
+                          "milkymist-uart", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
     s->chr = qemu_char_get_next_serial();
@@ -230,7 +235,7 @@ static void milkymist_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_uart_info = {
-    .name          = "milkymist-uart",
+    .name          = TYPE_MILKYMIST_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistUartState),
     .class_init    = milkymist_uart_class_init,
commit 85f3d3024588d27453788167566c34c3c658881d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:59:55 2013 +0200

    lm32_uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/lm32_uart.c b/hw/char/lm32_uart.c
index 37b38ba..85d7265 100644
--- a/hw/char/lm32_uart.c
+++ b/hw/char/lm32_uart.c
@@ -89,8 +89,12 @@ enum {
     MSR_DCD  = (1<<7),
 };
 
+#define TYPE_LM32_UART "lm32-uart"
+#define LM32_UART(obj) OBJECT_CHECK(LM32UartState, (obj), TYPE_LM32_UART)
+
 struct LM32UartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CharDriverState *chr;
     qemu_irq irq;
@@ -233,7 +237,7 @@ static void uart_event(void *opaque, int event)
 
 static void uart_reset(DeviceState *d)
 {
-    LM32UartState *s = container_of(d, LM32UartState, busdev.qdev);
+    LM32UartState *s = LM32_UART(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -246,7 +250,7 @@ static void uart_reset(DeviceState *d)
 
 static int lm32_uart_init(SysBusDevice *dev)
 {
-    LM32UartState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32UartState *s = LM32_UART(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -284,7 +288,7 @@ static void lm32_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_uart_info = {
-    .name          = "lm32-uart",
+    .name          = TYPE_LM32_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32UartState),
     .class_init    = lm32_uart_class_init,
commit a0b97927e34903ed280250f90deb6d3261cdc62f
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:56:36 2013 +0200

    lm32_juart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/lm32_juart.c b/hw/char/lm32_juart.c
index 154511e..252fe46 100644
--- a/hw/char/lm32_juart.c
+++ b/hw/char/lm32_juart.c
@@ -38,8 +38,11 @@ enum {
     JRX_FULL = (1<<8),
 };
 
+#define LM32_JUART(obj) OBJECT_CHECK(LM32JuartState, (obj), TYPE_LM32_JUART)
+
 struct LM32JuartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     CharDriverState *chr;
 
     uint32_t jtx;
@@ -49,7 +52,7 @@ typedef struct LM32JuartState LM32JuartState;
 
 uint32_t lm32_juart_get_jtx(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_get_jtx(s->jtx);
     return s->jtx;
@@ -57,7 +60,7 @@ uint32_t lm32_juart_get_jtx(DeviceState *d)
 
 uint32_t lm32_juart_get_jrx(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_get_jrx(s->jrx);
     return s->jrx;
@@ -65,7 +68,7 @@ uint32_t lm32_juart_get_jrx(DeviceState *d)
 
 void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
     unsigned char ch = jtx & 0xff;
 
     trace_lm32_juart_set_jtx(s->jtx);
@@ -78,7 +81,7 @@ void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx)
 
 void lm32_juart_set_jrx(DeviceState *d, uint32_t jtx)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_set_jrx(s->jrx);
     s->jrx &= ~JRX_FULL;
@@ -104,7 +107,7 @@ static void juart_event(void *opaque, int event)
 
 static void juart_reset(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     s->jtx = 0;
     s->jrx = 0;
@@ -112,7 +115,7 @@ static void juart_reset(DeviceState *d)
 
 static int lm32_juart_init(SysBusDevice *dev)
 {
-    LM32JuartState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32JuartState *s = LM32_JUART(dev);
 
     s->chr = qemu_char_get_next_serial();
     if (s->chr) {
@@ -145,7 +148,7 @@ static void lm32_juart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_juart_info = {
-    .name          = "lm32-juart",
+    .name          = TYPE_LM32_JUART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32JuartState),
     .class_init    = lm32_juart_class_init,
diff --git a/hw/lm32/lm32.h b/hw/lm32/lm32.h
index 236686e..18aa6fd 100644
--- a/hw/lm32/lm32.h
+++ b/hw/lm32/lm32.h
@@ -1,8 +1,7 @@
 #ifndef HW_LM32_H
 #define HW_LM32_H 1
 
-
-#include "qemu-common.h"
+#include "hw/char/lm32_juart.h"
 
 static inline DeviceState *lm32_pic_init(qemu_irq cpu_irq)
 {
@@ -21,7 +20,7 @@ static inline DeviceState *lm32_juart_init(void)
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "lm32-juart");
+    dev = qdev_create(NULL, TYPE_LM32_JUART);
     qdev_init_nofail(dev);
 
     return dev;
diff --git a/include/hw/char/lm32_juart.h b/include/hw/char/lm32_juart.h
index 1cd3148..70dc416 100644
--- a/include/hw/char/lm32_juart.h
+++ b/include/hw/char/lm32_juart.h
@@ -3,6 +3,8 @@
 
 #include "hw/qdev.h"
 
+#define TYPE_LM32_JUART "lm32-juart"
+
 uint32_t lm32_juart_get_jtx(DeviceState *d);
 uint32_t lm32_juart_get_jrx(DeviceState *d);
 void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx);
commit 0ee10242fd5c40ef0268147b23ba225b843e2d20
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:49:02 2013 +0200

    lm32_juart: Relocate and tidy header
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index 93ad19d..82ca5fb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -80,6 +80,7 @@ M: Michael Walle <michael at walle.cc>
 S: Maintained
 F: target-lm32/
 F: hw/lm32/
+F: hw/char/lm32_*
 
 M68K
 M: Paul Brook <paul at codesourcery.com>
diff --git a/hw/char/lm32_juart.c b/hw/char/lm32_juart.c
index 839f3eb..154511e 100644
--- a/hw/char/lm32_juart.c
+++ b/hw/char/lm32_juart.c
@@ -22,7 +22,7 @@
 #include "trace.h"
 #include "sysemu/char.h"
 
-#include "hw/lm32/lm32_juart.h"
+#include "hw/char/lm32_juart.h"
 
 enum {
     LM32_JUART_MIN_SAVE_VERSION = 0,
diff --git a/include/hw/char/lm32_juart.h b/include/hw/char/lm32_juart.h
new file mode 100644
index 0000000..1cd3148
--- /dev/null
+++ b/include/hw/char/lm32_juart.h
@@ -0,0 +1,11 @@
+#ifndef QEMU_HW_CHAR_LM32_JUART_H
+#define QEMU_HW_CHAR_LM32_JUART_H
+
+#include "hw/qdev.h"
+
+uint32_t lm32_juart_get_jtx(DeviceState *d);
+uint32_t lm32_juart_get_jrx(DeviceState *d);
+void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx);
+void lm32_juart_set_jrx(DeviceState *d, uint32_t jrx);
+
+#endif /* QEMU_HW_LM32_JUART_H */
diff --git a/include/hw/lm32/lm32_juart.h b/include/hw/lm32/lm32_juart.h
deleted file mode 100644
index 67fc586..0000000
--- a/include/hw/lm32/lm32_juart.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef QEMU_HW_LM32_JUART_H
-#define QEMU_HW_LM32_JUART_H
-
-#include "qemu-common.h"
-
-uint32_t lm32_juart_get_jtx(DeviceState *d);
-uint32_t lm32_juart_get_jrx(DeviceState *d);
-void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx);
-void lm32_juart_set_jrx(DeviceState *d, uint32_t jrx);
-
-#endif /* QEMU_HW_LM32_JUART_H */
diff --git a/target-lm32/op_helper.c b/target-lm32/op_helper.c
index f106873..2dab9f2 100644
--- a/target-lm32/op_helper.c
+++ b/target-lm32/op_helper.c
@@ -4,7 +4,7 @@
 #include "qemu/host-utils.h"
 
 #include "hw/lm32/lm32_pic.h"
-#include "hw/lm32/lm32_juart.h"
+#include "hw/char/lm32_juart.h"
 
 #if !defined(CONFIG_USER_ONLY)
 #define MMUSUFFIX _mmu
commit 8d8e34815e46a45afaa2689b49d5f97b6306b7f3
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:43:22 2013 +0200

    imx_serial: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 5c17eaa..7f16835 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -43,8 +43,12 @@ do { printf("imx_serial: " fmt , ##args); } while (0)
 #  define IPRINTF(fmt, args...) do {} while (0)
 #endif
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_SERIAL "imx-serial"
+#define IMX_SERIAL(obj) OBJECT_CHECK(IMXSerialState, (obj), TYPE_IMX_SERIAL)
+
+typedef struct IMXSerialState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int32_t readbuff;
 
@@ -169,7 +173,7 @@ static void imx_serial_reset(IMXSerialState *s)
 
 static void imx_serial_reset_at_boot(DeviceState *dev)
 {
-    IMXSerialState *s = container_of(dev, IMXSerialState, busdev.qdev);
+    IMXSerialState *s = IMX_SERIAL(dev);
 
     imx_serial_reset(s);
 
@@ -383,7 +387,7 @@ static const struct MemoryRegionOps imx_serial_ops = {
 
 static int imx_serial_init(SysBusDevice *dev)
 {
-    IMXSerialState *s = FROM_SYSBUS(IMXSerialState, dev);
+    IMXSerialState *s = IMX_SERIAL(dev);
 
 
     memory_region_init_io(&s->iomem, OBJECT(s), &imx_serial_ops, s,
@@ -410,7 +414,7 @@ void imx_serial_create(int uart, const hwaddr addr, qemu_irq irq)
     const char chr_name[] = "serial";
     char label[ARRAY_SIZE(chr_name) + 1];
 
-    dev = qdev_create(NULL, "imx-serial");
+    dev = qdev_create(NULL, TYPE_IMX_SERIAL);
 
     if (uart >= MAX_SERIAL_PORTS) {
         hw_error("Cannot assign uart %d: QEMU supports only %d ports\n",
@@ -455,7 +459,7 @@ static void imx_serial_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo imx_serial_info = {
-    .name = "imx-serial",
+    .name = TYPE_IMX_SERIAL,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXSerialState),
     .class_init = imx_serial_class_init,
commit ae8e04903138a51d15faaf501ea83569cd6cffa5
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:38:10 2013 +0200

    grlib_apbuart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index 82e1b95..35ef661 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -67,8 +67,13 @@
 
 #define FIFO_LENGTH 1024
 
+#define TYPE_GRLIB_APB_UART "grlib,apbuart"
+#define GRLIB_APB_UART(obj) \
+    OBJECT_CHECK(UART, (obj), TYPE_GRLIB_APB_UART)
+
 typedef struct UART {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -232,7 +237,7 @@ static const MemoryRegionOps grlib_apbuart_ops = {
 
 static int grlib_apbuart_init(SysBusDevice *dev)
 {
-    UART *uart = FROM_SYSBUS(typeof(*uart), dev);
+    UART *uart = GRLIB_APB_UART(dev);
 
     qemu_chr_add_handlers(uart->chr,
                           grlib_apbuart_can_receive,
@@ -252,7 +257,7 @@ static int grlib_apbuart_init(SysBusDevice *dev)
 
 static void grlib_apbuart_reset(DeviceState *d)
 {
-    UART *uart = container_of(d, UART, busdev.qdev);
+    UART *uart = GRLIB_APB_UART(d);
 
     /* Transmitter FIFO and shift registers are always empty in QEMU */
     uart->status =  UART_TRANSMIT_FIFO_EMPTY | UART_TRANSMIT_SHIFT_EMPTY;
@@ -279,7 +284,7 @@ static void grlib_apbuart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo grlib_apbuart_info = {
-    .name          = "grlib,apbuart",
+    .name          = TYPE_GRLIB_APB_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(UART),
     .class_init    = grlib_apbuart_class_init,
commit 61149ff6876dffd0de6f527424d9373e4ed2ad59
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:21:05 2013 +0200

    exynos4210_uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index 855ce7a..eef23a0 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -166,8 +166,13 @@ typedef struct {
     uint32_t    size;
 } Exynos4210UartFIFO;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_EXYNOS4210_UART "exynos4210.uart"
+#define EXYNOS4210_UART(obj) \
+    OBJECT_CHECK(Exynos4210UartState, (obj), TYPE_EXYNOS4210_UART)
+
+typedef struct Exynos4210UartState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t             reg[EXYNOS4210_UART_REGS_MEM_SIZE / sizeof(uint32_t)];
@@ -538,8 +543,7 @@ static void exynos4210_uart_event(void *opaque, int event)
 
 static void exynos4210_uart_reset(DeviceState *dev)
 {
-    Exynos4210UartState *s =
-            container_of(dev, Exynos4210UartState, busdev.qdev);
+    Exynos4210UartState *s = EXYNOS4210_UART(dev);
     int regs_number = sizeof(exynos4210_uart_regs)/sizeof(Exynos4210UartReg);
     int i;
 
@@ -582,10 +586,10 @@ static const VMStateDescription vmstate_exynos4210_uart = {
 };
 
 DeviceState *exynos4210_uart_create(hwaddr addr,
-                                 int fifo_size,
-                                 int channel,
-                                 CharDriverState *chr,
-                                 qemu_irq irq)
+                                    int fifo_size,
+                                    int channel,
+                                    CharDriverState *chr,
+                                    qemu_irq irq)
 {
     DeviceState  *dev;
     SysBusDevice *bus;
@@ -593,7 +597,7 @@ DeviceState *exynos4210_uart_create(hwaddr addr,
     const char chr_name[] = "serial";
     char label[ARRAY_SIZE(chr_name) + 1];
 
-    dev = qdev_create(NULL, "exynos4210.uart");
+    dev = qdev_create(NULL, TYPE_EXYNOS4210_UART);
 
     if (!chr) {
         if (channel >= MAX_SERIAL_PORTS) {
@@ -627,7 +631,7 @@ DeviceState *exynos4210_uart_create(hwaddr addr,
 
 static int exynos4210_uart_init(SysBusDevice *dev)
 {
-    Exynos4210UartState *s = FROM_SYSBUS(Exynos4210UartState, dev);
+    Exynos4210UartState *s = EXYNOS4210_UART(dev);
 
     /* memory mapping */
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_uart_ops, s,
@@ -662,7 +666,7 @@ static void exynos4210_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_uart_info = {
-    .name          = "exynos4210.uart",
+    .name          = TYPE_EXYNOS4210_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210UartState),
     .class_init    = exynos4210_uart_class_init,
commit 81069b20549b3f465f172efb86f7f5034b89463a
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 21:30:40 2013 +0200

    escc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/escc.c b/hw/char/escc.c
index 4c42198..6397f6f 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -96,8 +96,11 @@ typedef struct ChannelState {
     uint8_t rx, tx;
 } ChannelState;
 
+#define ESCC(obj) OBJECT_CHECK(ESCCState, (obj), TYPE_ESCC)
+
 typedef struct ESCCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     struct ChannelState chn[2];
     uint32_t it_shift;
     MemoryRegion mmio;
@@ -309,7 +312,7 @@ static void escc_reset_chn(ChannelState *s)
 
 static void escc_reset(DeviceState *d)
 {
-    ESCCState *s = container_of(d, ESCCState, busdev.qdev);
+    ESCCState *s = ESCC(d);
 
     escc_reset_chn(&s->chn[0]);
     escc_reset_chn(&s->chn[1]);
@@ -534,7 +537,7 @@ static void escc_mem_write(void *opaque, hwaddr addr,
                 escc_reset_chn(&serial->chn[1]);
                 return;
             case MINTR_RST_ALL:
-                escc_reset(&serial->busdev.qdev);
+                escc_reset(DEVICE(serial));
                 return;
             }
             break;
@@ -691,7 +694,7 @@ MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
     SysBusDevice *s;
     ESCCState *d;
 
-    dev = qdev_create(NULL, "escc");
+    dev = qdev_create(NULL, TYPE_ESCC);
     qdev_prop_set_uint32(dev, "disabled", 0);
     qdev_prop_set_uint32(dev, "frequency", clock);
     qdev_prop_set_uint32(dev, "it_shift", it_shift);
@@ -707,7 +710,7 @@ MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
         sysbus_mmio_map(s, 0, base);
     }
 
-    d = FROM_SYSBUS(ESCCState, s);
+    d = ESCC(s);
     return &d->mmio;
 }
 
@@ -852,7 +855,7 @@ void slavio_serial_ms_kbd_init(hwaddr base, qemu_irq irq,
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "escc");
+    dev = qdev_create(NULL, TYPE_ESCC);
     qdev_prop_set_uint32(dev, "disabled", disabled);
     qdev_prop_set_uint32(dev, "frequency", clock);
     qdev_prop_set_uint32(dev, "it_shift", it_shift);
@@ -869,7 +872,7 @@ void slavio_serial_ms_kbd_init(hwaddr base, qemu_irq irq,
 
 static int escc_init1(SysBusDevice *dev)
 {
-    ESCCState *s = FROM_SYSBUS(ESCCState, dev);
+    ESCCState *s = ESCC(dev);
     unsigned int i;
 
     s->chn[0].disabled = s->disabled;
@@ -924,7 +927,7 @@ static void escc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo escc_info = {
-    .name          = "escc",
+    .name          = TYPE_ESCC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ESCCState),
     .class_init    = escc_class_init,
diff --git a/include/hw/char/escc.h b/include/hw/char/escc.h
index bda3213..2742d70 100644
--- a/include/hw/char/escc.h
+++ b/include/hw/char/escc.h
@@ -2,6 +2,7 @@
 #define HW_ESCC_H 1
 
 /* escc.c */
+#define TYPE_ESCC "escc"
 #define ESCC_SIZE 4
 MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
               CharDriverState *chrA, CharDriverState *chrB,
commit 534f6ff925cd7c9c8cc10094173e691938ac723f
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 21:23:29 2013 +0200

    cadence_uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 4d457f8..3c2e960 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -106,8 +106,12 @@
 
 #define R_MAX (R_TTRIG + 1)
 
+#define TYPE_CADENCE_UART "cadence_uart"
+#define CADENCE_UART(obj) OBJECT_CHECK(UartState, (obj), TYPE_CADENCE_UART)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t r[R_MAX];
     uint8_t r_fifo[RX_FIFO_SIZE];
@@ -442,7 +446,7 @@ static void cadence_uart_reset(UartState *s)
 
 static int cadence_uart_init(SysBusDevice *dev)
 {
-    UartState *s = FROM_SYSBUS(UartState, dev);
+    UartState *s = CADENCE_UART(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &uart_ops, s, "uart", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -504,7 +508,7 @@ static void cadence_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo cadence_uart_info = {
-    .name          = "cadence_uart",
+    .name          = TYPE_CADENCE_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(UartState),
     .class_init    = cadence_uart_class_init,
commit cfc6b24578fdd55c26ed383c910fa18c4137b159
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:37:20 2013 +0200

    versatilepb: QOM cast cleanup for vpb_sic_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 725f60f..b48d84c 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -25,15 +25,19 @@
 
 /* Primary interrupt controller.  */
 
-typedef struct vpb_sic_state
-{
-  SysBusDevice busdev;
-  MemoryRegion iomem;
-  uint32_t level;
-  uint32_t mask;
-  uint32_t pic_enable;
-  qemu_irq parent[32];
-  int irq;
+#define TYPE_VERSATILE_PB_SIC "versatilepb_sic"
+#define VERSATILE_PB_SIC(obj) \
+    OBJECT_CHECK(vpb_sic_state, (obj), TYPE_VERSATILE_PB_SIC)
+
+typedef struct vpb_sic_state {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    uint32_t level;
+    uint32_t mask;
+    uint32_t pic_enable;
+    qemu_irq parent[32];
+    int irq;
 } vpb_sic_state;
 
 static const VMStateDescription vmstate_vpb_sic = {
@@ -144,19 +148,20 @@ static const MemoryRegionOps vpb_sic_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int vpb_sic_init(SysBusDevice *dev)
+static int vpb_sic_init(SysBusDevice *sbd)
 {
-    vpb_sic_state *s = FROM_SYSBUS(vpb_sic_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    vpb_sic_state *s = VERSATILE_PB_SIC(dev);
     int i;
 
-    qdev_init_gpio_in(&dev->qdev, vpb_sic_set_irq, 32);
+    qdev_init_gpio_in(dev, vpb_sic_set_irq, 32);
     for (i = 0; i < 32; i++) {
-        sysbus_init_irq(dev, &s->parent[i]);
+        sysbus_init_irq(sbd, &s->parent[i]);
     }
     s->irq = 31;
     memory_region_init_io(&s->iomem, OBJECT(s), &vpb_sic_ops, s,
                           "vpb-sic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -213,7 +218,7 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
     for (n = 0; n < 32; n++) {
         pic[n] = qdev_get_gpio_in(dev, n);
     }
-    dev = sysbus_create_simple("versatilepb_sic", 0x10003000, NULL);
+    dev = sysbus_create_simple(TYPE_VERSATILE_PB_SIC, 0x10003000, NULL);
     for (n = 0; n < 32; n++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), n, pic[n]);
         sic[n] = qdev_get_gpio_in(dev, n);
@@ -393,7 +398,7 @@ static void vpb_sic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo vpb_sic_info = {
-    .name          = "versatilepb_sic",
+    .name          = TYPE_VERSATILE_PB_SIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(vpb_sic_state),
     .class_init    = vpb_sic_class_init,
commit 0ca81872f741e6b93a5951d9a4f524829a911d40
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:32:06 2013 +0200

    strongarm: QOM cast cleanup for StrongARMSSPState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 61c2b22..82a9492 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -1336,8 +1336,14 @@ static const TypeInfo strongarm_uart_info = {
 };
 
 /* Synchronous Serial Ports */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_STRONGARM_SSP "strongarm-ssp"
+#define STRONGARM_SSP(obj) \
+    OBJECT_CHECK(StrongARMSSPState, (obj), TYPE_STRONGARM_SSP)
+
+typedef struct StrongARMSSPState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     SSIBus *bus;
@@ -1519,23 +1525,25 @@ static int strongarm_ssp_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static int strongarm_ssp_init(SysBusDevice *dev)
+static int strongarm_ssp_init(SysBusDevice *sbd)
 {
-    StrongARMSSPState *s = FROM_SYSBUS(StrongARMSSPState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMSSPState *s = STRONGARM_SSP(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ssp_ops, s,
                           "ssp", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    s->bus = ssi_create_bus(&dev->qdev, "ssi");
+    s->bus = ssi_create_bus(dev, "ssi");
     return 0;
 }
 
 static void strongarm_ssp_reset(DeviceState *dev)
 {
-    StrongARMSSPState *s = DO_UPCAST(StrongARMSSPState, busdev.qdev, dev);
+    StrongARMSSPState *s = STRONGARM_SSP(dev);
+
     s->sssr = 0x03; /* 3 bit data, SPI, disabled */
     s->rx_start = 0;
     s->rx_level = 0;
@@ -1569,7 +1577,7 @@ static void strongarm_ssp_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_ssp_info = {
-    .name          = "strongarm-ssp",
+    .name          = TYPE_STRONGARM_SSP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMSSPState),
     .class_init    = strongarm_ssp_class_init,
@@ -1633,7 +1641,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
                 qdev_get_gpio_in(s->pic, sa_serial[i].irq));
     }
 
-    s->ssp = sysbus_create_varargs("strongarm-ssp", 0x80070000,
+    s->ssp = sysbus_create_varargs(TYPE_STRONGARM_SSP, 0x80070000,
                 qdev_get_gpio_in(s->pic, SA_PIC_SSP), NULL);
     s->ssp_bus = (SSIBus *)qdev_get_child_bus(s->ssp, "ssi");
 
commit fff3af97b9e1b1a482d8951eddac2c45ede9bf08
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:29:14 2013 +0200

    strongarm: QOM cast cleanup for StrongARMUARTState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 421ac54..61c2b22 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -908,8 +908,13 @@ static const TypeInfo strongarm_ppc_info = {
 #define RX_FIFO_FRE (1 << 9)
 #define RX_FIFO_ROR (1 << 10)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_STRONGARM_UART "strongarm-uart"
+#define STRONGARM_UART(obj) \
+    OBJECT_CHECK(StrongARMUARTState, (obj), TYPE_STRONGARM_UART)
+
+typedef struct StrongARMUARTState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CharDriverState *chr;
     qemu_irq irq;
@@ -1225,7 +1230,7 @@ static const MemoryRegionOps strongarm_uart_ops = {
 
 static int strongarm_uart_init(SysBusDevice *dev)
 {
-    StrongARMUARTState *s = FROM_SYSBUS(StrongARMUARTState, dev);
+    StrongARMUARTState *s = STRONGARM_UART(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_uart_ops, s,
                           "uart", 0x10000);
@@ -1248,7 +1253,7 @@ static int strongarm_uart_init(SysBusDevice *dev)
 
 static void strongarm_uart_reset(DeviceState *dev)
 {
-    StrongARMUARTState *s = DO_UPCAST(StrongARMUARTState, busdev.qdev, dev);
+    StrongARMUARTState *s = STRONGARM_UART(dev);
 
     s->utcr0 = UTCR0_DSS; /* 8 data, no parity */
     s->brd = 23;    /* 9600 */
@@ -1324,7 +1329,7 @@ static void strongarm_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_uart_info = {
-    .name          = "strongarm-uart",
+    .name          = TYPE_STRONGARM_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMUARTState),
     .class_init    = strongarm_uart_class_init,
@@ -1619,7 +1624,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
     s->ppc = sysbus_create_varargs(TYPE_STRONGARM_PPC, 0x90060000, NULL);
 
     for (i = 0; sa_serial[i].io_base; i++) {
-        DeviceState *dev = qdev_create(NULL, "strongarm-uart");
+        DeviceState *dev = qdev_create(NULL, TYPE_STRONGARM_UART);
         qdev_prop_set_chr(dev, "chardev", serial_hds[i]);
         qdev_init_nofail(dev);
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
commit c71e67329188ee1081de53ef685e627c6e99cc87
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:26:04 2013 +0200

    strongarm: QOM cast cleanup for StrongARMPPCInfo
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index efb56b3..421ac54 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -706,9 +706,14 @@ static const TypeInfo strongarm_gpio_info = {
 #define PSDR 0x0c
 #define PPFR 0x10
 
+#define TYPE_STRONGARM_PPC "strongarm-ppc"
+#define STRONGARM_PPC(obj) \
+    OBJECT_CHECK(StrongARMPPCInfo, (obj), TYPE_STRONGARM_PPC)
+
 typedef struct StrongARMPPCInfo StrongARMPPCInfo;
 struct StrongARMPPCInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq handler[28];
 
@@ -817,19 +822,18 @@ static const MemoryRegionOps strongarm_ppc_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int strongarm_ppc_init(SysBusDevice *dev)
+static int strongarm_ppc_init(SysBusDevice *sbd)
 {
-    StrongARMPPCInfo *s;
-
-    s = FROM_SYSBUS(StrongARMPPCInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMPPCInfo *s = STRONGARM_PPC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, strongarm_ppc_set, 22);
-    qdev_init_gpio_out(&dev->qdev, s->handler, 22);
+    qdev_init_gpio_in(dev, strongarm_ppc_set, 22);
+    qdev_init_gpio_out(dev, s->handler, 22);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ppc_ops, s,
                           "ppc", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -860,7 +864,7 @@ static void strongarm_ppc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_ppc_info = {
-    .name          = "strongarm-ppc",
+    .name          = TYPE_STRONGARM_PPC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMPPCInfo),
     .class_init    = strongarm_ppc_class_init,
@@ -1612,7 +1616,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
 
     s->gpio = strongarm_gpio_init(0x90040000, s->pic);
 
-    s->ppc = sysbus_create_varargs("strongarm-ppc", 0x90060000, NULL);
+    s->ppc = sysbus_create_varargs(TYPE_STRONGARM_PPC, 0x90060000, NULL);
 
     for (i = 0; sa_serial[i].io_base; i++) {
         DeviceState *dev = qdev_create(NULL, "strongarm-uart");
commit f55beb8477e005f49514410cc00f6913729b01bd
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:23:14 2013 +0200

    strongarm: QOM cast cleanup for StrongARMGPIOInfo
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 78211a0..efb56b3 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -464,6 +464,10 @@ static const TypeInfo strongarm_rtc_sysbus_info = {
 #define GEDR 0x18
 #define GAFR 0x1c
 
+#define TYPE_STRONGARM_GPIO "strongarm-gpio"
+#define STRONGARM_GPIO(obj) \
+    OBJECT_CHECK(StrongARMGPIOInfo, (obj), TYPE_STRONGARM_GPIO)
+
 typedef struct StrongARMGPIOInfo StrongARMGPIOInfo;
 struct StrongARMGPIOInfo {
     SysBusDevice busdev;
@@ -630,7 +634,7 @@ static DeviceState *strongarm_gpio_init(hwaddr base,
     DeviceState *dev;
     int i;
 
-    dev = qdev_create(NULL, "strongarm-gpio");
+    dev = qdev_create(NULL, TYPE_STRONGARM_GPIO);
     qdev_init_nofail(dev);
 
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
@@ -641,24 +645,23 @@ static DeviceState *strongarm_gpio_init(hwaddr base,
     return dev;
 }
 
-static int strongarm_gpio_initfn(SysBusDevice *dev)
+static int strongarm_gpio_initfn(SysBusDevice *sbd)
 {
-    StrongARMGPIOInfo *s;
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMGPIOInfo *s = STRONGARM_GPIO(dev);
     int i;
 
-    s = FROM_SYSBUS(StrongARMGPIOInfo, dev);
-
-    qdev_init_gpio_in(&dev->qdev, strongarm_gpio_set, 28);
-    qdev_init_gpio_out(&dev->qdev, s->handler, 28);
+    qdev_init_gpio_in(dev, strongarm_gpio_set, 28);
+    qdev_init_gpio_out(dev, s->handler, 28);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_gpio_ops, s,
                           "gpio", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     for (i = 0; i < 11; i++) {
-        sysbus_init_irq(dev, &s->irqs[i]);
+        sysbus_init_irq(sbd, &s->irqs[i]);
     }
-    sysbus_init_irq(dev, &s->irqX);
+    sysbus_init_irq(sbd, &s->irqX);
 
     return 0;
 }
@@ -690,7 +693,7 @@ static void strongarm_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_gpio_info = {
-    .name          = "strongarm-gpio",
+    .name          = TYPE_STRONGARM_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMGPIOInfo),
     .class_init    = strongarm_gpio_class_init,
commit 4e00210522ecbbeb81d091cfca1f2cf3f3ae00d8
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:20:15 2013 +0200

    strongarm: QOM cast cleanup for StrongARMRTCState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 457f9c7..78211a0 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -242,8 +242,13 @@ static const TypeInfo strongarm_pic_info = {
  * trim delete isn't emulated, so
  * f = 32 768 / (RTTR_trim + 1) */
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_STRONGARM_RTC "strongarm-rtc"
+#define STRONGARM_RTC(obj) \
+    OBJECT_CHECK(StrongARMRTCState, (obj), TYPE_STRONGARM_RTC)
+
+typedef struct StrongARMRTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t rttr;
     uint32_t rtsr;
@@ -374,7 +379,7 @@ static const MemoryRegionOps strongarm_rtc_ops = {
 
 static int strongarm_rtc_init(SysBusDevice *dev)
 {
-    StrongARMRTCState *s = FROM_SYSBUS(StrongARMRTCState, dev);
+    StrongARMRTCState *s = STRONGARM_RTC(dev);
     struct tm tm;
 
     s->rttr = 0x0;
@@ -443,7 +448,7 @@ static void strongarm_rtc_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_rtc_sysbus_info = {
-    .name          = "strongarm-rtc",
+    .name          = TYPE_STRONGARM_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMRTCState),
     .class_init    = strongarm_rtc_sysbus_class_init,
@@ -1599,7 +1604,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
                     qdev_get_gpio_in(s->pic, SA_PIC_OSTC3),
                     NULL);
 
-    sysbus_create_simple("strongarm-rtc", 0x90010000,
+    sysbus_create_simple(TYPE_STRONGARM_RTC, 0x90010000,
                     qdev_get_gpio_in(s->pic, SA_PIC_RTC_ALARM));
 
     s->gpio = strongarm_gpio_init(0x90040000, s->pic);
commit 74e075f6fbb40992b698c2418aa19ad541abf71e
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:17:13 2013 +0200

    strongarm: QOM cast cleanup for StrongARMPICState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index feaaf45..457f9c7 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -70,8 +70,14 @@ static struct {
 };
 
 /* Interrupt Controller */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_STRONGARM_PIC "strongarm_pic"
+#define STRONGARM_PIC(obj) \
+    OBJECT_CHECK(StrongARMPICState, (obj), TYPE_STRONGARM_PIC)
+
+typedef struct StrongARMPICState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq    irq;
     qemu_irq    fiq;
@@ -168,16 +174,17 @@ static const MemoryRegionOps strongarm_pic_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int strongarm_pic_initfn(SysBusDevice *dev)
+static int strongarm_pic_initfn(SysBusDevice *sbd)
 {
-    StrongARMPICState *s = FROM_SYSBUS(StrongARMPICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMPICState *s = STRONGARM_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, strongarm_pic_set_irq, SA_PIC_SRCS);
+    qdev_init_gpio_in(dev, strongarm_pic_set_irq, SA_PIC_SRCS);
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_pic_ops, s,
                           "pic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
 
     return 0;
 }
@@ -214,7 +221,7 @@ static void strongarm_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_pic_info = {
-    .name          = "strongarm_pic",
+    .name          = TYPE_STRONGARM_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMPICState),
     .class_init    = strongarm_pic_class_init,
commit 7df7f67ae1bf6b2c81788a58de9cdf9cf9c03bc8
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:13:06 2013 +0200

    stellaris: QOM cast cleanup for stellaris_adc_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 05d1a0d..79f6b4e 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -897,9 +897,13 @@ static int stellaris_i2c_init(SysBusDevice *sbd)
 #define STELLARIS_ADC_FIFO_EMPTY    0x0100
 #define STELLARIS_ADC_FIFO_FULL     0x1000
 
-typedef struct
-{
-    SysBusDevice busdev;
+#define TYPE_STELLARIS_ADC "stellaris-adc"
+#define STELLARIS_ADC(obj) \
+    OBJECT_CHECK(stellaris_adc_state, (obj), TYPE_STELLARIS_ADC)
+
+typedef struct StellarisADCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t actss;
     uint32_t ris;
@@ -1148,21 +1152,22 @@ static const VMStateDescription vmstate_stellaris_adc = {
     }
 };
 
-static int stellaris_adc_init(SysBusDevice *dev)
+static int stellaris_adc_init(SysBusDevice *sbd)
 {
-    stellaris_adc_state *s = FROM_SYSBUS(stellaris_adc_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_adc_state *s = STELLARIS_ADC(dev);
     int n;
 
     for (n = 0; n < 4; n++) {
-        sysbus_init_irq(dev, &s->irq[n]);
+        sysbus_init_irq(sbd, &s->irq[n]);
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_adc_ops, s,
                           "adc", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     stellaris_adc_reset(s);
-    qdev_init_gpio_in(&dev->qdev, stellaris_adc_trigger, 1);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_adc, s);
+    qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
+    vmstate_register(dev, -1, &vmstate_stellaris_adc, s);
     return 0;
 }
 
@@ -1219,7 +1224,7 @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
                       flash_size, sram_size, kernel_filename, cpu_model);
 
     if (board->dc1 & (1 << 16)) {
-        dev = sysbus_create_varargs("stellaris-adc", 0x40038000,
+        dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     pic[14], pic[15], pic[16], pic[17], NULL);
         adc = qdev_get_gpio_in(dev, 0);
     } else {
@@ -1397,7 +1402,7 @@ static void stellaris_adc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_adc_info = {
-    .name          = "stellaris-adc",
+    .name          = TYPE_STELLARIS_ADC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_adc_state),
     .class_init    = stellaris_adc_class_init,
commit d94a40156b357cd519f9385ca1f57ea7850b9e18
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:08:23 2013 +0200

    stellaris: QOM cast cleanup for stellaris_i2c_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 9a7fafb..05d1a0d 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -685,8 +685,13 @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
 
 /* I2C controller.  */
 
+#define TYPE_STELLARIS_I2C "stellaris-i2c"
+#define STELLARIS_I2C(obj) \
+    OBJECT_CHECK(stellaris_i2c_state, (obj), TYPE_STELLARIS_I2C)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     i2c_bus *bus;
     qemu_irq irq;
     MemoryRegion iomem;
@@ -859,21 +864,22 @@ static const VMStateDescription vmstate_stellaris_i2c = {
     }
 };
 
-static int stellaris_i2c_init(SysBusDevice * dev)
+static int stellaris_i2c_init(SysBusDevice *sbd)
 {
-    stellaris_i2c_state *s = FROM_SYSBUS(stellaris_i2c_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_i2c_state *s = STELLARIS_I2C(dev);
     i2c_bus *bus;
 
-    sysbus_init_irq(dev, &s->irq);
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    sysbus_init_irq(sbd, &s->irq);
+    bus = i2c_init_bus(dev, "i2c");
     s->bus = bus;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_i2c_ops, s,
                           "i2c", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     /* ??? For now we only implement the master interface.  */
     stellaris_i2c_reset(s);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_i2c, s);
+    vmstate_register(dev, -1, &vmstate_stellaris_i2c, s);
     return 0;
 }
 
@@ -1244,7 +1250,7 @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
     }
 
     if (board->dc2 & (1 << 12)) {
-        dev = sysbus_create_simple("stellaris-i2c", 0x40020000, pic[8]);
+        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000, pic[8]);
         i2c = (i2c_bus *)qdev_get_child_bus(dev, "i2c");
         if (board->peripherals & BP_OLED_I2C) {
             i2c_create_slave(i2c, "ssd0303", 0x3d);
@@ -1363,7 +1369,7 @@ static void stellaris_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_i2c_info = {
-    .name          = "stellaris-i2c",
+    .name          = TYPE_STELLARIS_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_i2c_state),
     .class_init    = stellaris_i2c_class_init,
commit 8ef1d3947efd4044b6a33dcd0ccc5c857149e194
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:03:33 2013 +0200

    stellaris: QOM cast cleanup for gptm_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index a2b6b17..9a7fafb 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -43,8 +43,13 @@ typedef const struct {
 
 /* General purpose timer module.  */
 
+#define TYPE_STELLARIS_GPTM "stellaris-gptm"
+#define STELLARIS_GPTM(obj) \
+    OBJECT_CHECK(gptm_state, (obj), TYPE_STELLARIS_GPTM)
+
 typedef struct gptm_state {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t config;
     uint32_t mode[2];
@@ -300,21 +305,22 @@ static const VMStateDescription vmstate_stellaris_gptm = {
     }
 };
 
-static int stellaris_gptm_init(SysBusDevice *dev)
+static int stellaris_gptm_init(SysBusDevice *sbd)
 {
-    gptm_state *s = FROM_SYSBUS(gptm_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    gptm_state *s = STELLARIS_GPTM(dev);
 
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_out(&dev->qdev, &s->trigger, 1);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_out(dev, &s->trigger, 1);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &gptm_ops, s,
                           "gptm", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     s->opaque[0] = s->opaque[1] = s;
     s->timer[0] = qemu_new_timer_ns(vm_clock, gptm_tick, &s->opaque[0]);
     s->timer[1] = qemu_new_timer_ns(vm_clock, gptm_tick, &s->opaque[1]);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_gptm, s);
+    vmstate_register(dev, -1, &vmstate_stellaris_gptm, s);
     return 0;
 }
 
@@ -1215,7 +1221,7 @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
     }
     for (i = 0; i < 4; i++) {
         if (board->dc2 & (0x10000 << i)) {
-            dev = sysbus_create_simple("stellaris-gptm",
+            dev = sysbus_create_simple(TYPE_STELLARIS_GPTM,
                                        0x40030000 + i * 0x1000,
                                        pic[timer_irq[i]]);
             /* TODO: This is incorrect, but we get away with it because
@@ -1371,7 +1377,7 @@ static void stellaris_gptm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_gptm_info = {
-    .name          = "stellaris-gptm",
+    .name          = TYPE_STELLARIS_GPTM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(gptm_state),
     .class_init    = stellaris_gptm_class_init,
commit 73e9d965dd071ecde5cb31327b58469275691667
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 08:58:32 2013 +0200

    spitz: QOM cast cleanup for SpitzKeyboardState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index 0bf5c5c..34f9582 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -215,8 +215,13 @@ static const int spitz_gpiomap[5] = {
     SPITZ_GPIO_SWA, SPITZ_GPIO_SWB,
 };
 
+#define TYPE_SPITZ_KEYBOARD "spitz-keyboard"
+#define SPITZ_KEYBOARD(obj) \
+    OBJECT_CHECK(SpitzKeyboardState, (obj), TYPE_SPITZ_KEYBOARD)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq sense[SPITZ_KEY_SENSE_NUM];
     qemu_irq gpiomap[5];
     int keymap[0x80];
@@ -461,8 +466,8 @@ static void spitz_keyboard_register(PXA2xxState *cpu)
     DeviceState *dev;
     SpitzKeyboardState *s;
 
-    dev = sysbus_create_simple("spitz-keyboard", -1, NULL);
-    s = FROM_SYSBUS(SpitzKeyboardState, SYS_BUS_DEVICE(dev));
+    dev = sysbus_create_simple(TYPE_SPITZ_KEYBOARD, -1, NULL);
+    s = SPITZ_KEYBOARD(dev);
 
     for (i = 0; i < SPITZ_KEY_SENSE_NUM; i ++)
         qdev_connect_gpio_out(dev, i, qdev_get_gpio_in(cpu->gpio, spitz_gpio_key_sense[i]));
@@ -485,13 +490,12 @@ static void spitz_keyboard_register(PXA2xxState *cpu)
     qemu_add_kbd_event_handler(spitz_keyboard_handler, s);
 }
 
-static int spitz_keyboard_init(SysBusDevice *dev)
+static int spitz_keyboard_init(SysBusDevice *sbd)
 {
-    SpitzKeyboardState *s;
+    DeviceState *dev = DEVICE(sbd);
+    SpitzKeyboardState *s = SPITZ_KEYBOARD(dev);
     int i, j;
 
-    s = FROM_SYSBUS(SpitzKeyboardState, dev);
-
     for (i = 0; i < 0x80; i ++)
         s->keymap[i] = -1;
     for (i = 0; i < SPITZ_KEY_SENSE_NUM + 1; i ++)
@@ -502,8 +506,8 @@ static int spitz_keyboard_init(SysBusDevice *dev)
     spitz_keyboard_pre_map(s);
 
     s->kbdtimer = qemu_new_timer_ns(vm_clock, spitz_keyboard_tick, s);
-    qdev_init_gpio_in(&dev->qdev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
-    qdev_init_gpio_out(&dev->qdev, s->sense, SPITZ_KEY_SENSE_NUM);
+    qdev_init_gpio_in(dev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
+    qdev_init_gpio_out(dev, s->sense, SPITZ_KEY_SENSE_NUM);
 
     return 0;
 }
@@ -1065,7 +1069,7 @@ static void spitz_keyboard_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo spitz_keyboard_info = {
-    .name          = "spitz-keyboard",
+    .name          = TYPE_SPITZ_KEYBOARD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SpitzKeyboardState),
     .class_init    = spitz_keyboard_class_init,
commit 7eb8104a9cd274a14b9a8a6caf38d0720e56cd21
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 08:54:33 2013 +0200

    spitz: QOM cast cleanup for SLNANDState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index 593b75e..0bf5c5c 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -50,8 +50,12 @@
 #define FLASHCTL_RYBY		(1 << 5)
 #define FLASHCTL_NCE		(FLASHCTL_CE0 | FLASHCTL_CE1)
 
+#define TYPE_SL_NAND "sl-nand"
+#define SL_NAND(obj) OBJECT_CHECK(SLNANDState, (obj), TYPE_SL_NAND)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     DeviceState *nand;
     uint8_t ctl;
@@ -147,7 +151,7 @@ static void sl_flash_register(PXA2xxState *cpu, int size)
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "sl-nand");
+    dev = qdev_create(NULL, TYPE_SL_NAND);
 
     qdev_prop_set_uint8(dev, "manf_id", NAND_MFR_SAMSUNG);
     if (size == FLASH_128M)
@@ -159,12 +163,11 @@ static void sl_flash_register(PXA2xxState *cpu, int size)
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, FLASH_BASE);
 }
 
-static int sl_nand_init(SysBusDevice *dev) {
-    SLNANDState *s;
+static int sl_nand_init(SysBusDevice *dev)
+{
+    SLNANDState *s = SL_NAND(dev);
     DriveInfo *nand;
 
-    s = FROM_SYSBUS(SLNANDState, dev);
-
     s->ctl = 0;
     nand = drive_get(IF_MTD, 0, 0);
     s->nand = nand_init(nand ? nand->bdrv : NULL, s->manf_id, s->chip_id);
@@ -1027,7 +1030,7 @@ static void sl_nand_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sl_nand_info = {
-    .name          = "sl-nand",
+    .name          = TYPE_SL_NAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLNANDState),
     .class_init    = sl_nand_class_init,
commit 6050ed5fb98822220f71d69c46870bdf1f3bc076
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 02:08:09 2013 +0200

    pxa2xx_pic: QOM cast cleanup for PXA2xxPICState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
index 8929b6d..46d337c 100644
--- a/hw/arm/pxa2xx_pic.c
+++ b/hw/arm/pxa2xx_pic.c
@@ -31,8 +31,15 @@
 
 #define PXA2XX_PIC_SRCS	40
 
+#define TYPE_PXA2XX_PIC "pxa2xx_pic"
+#define PXA2XX_PIC(obj) \
+    OBJECT_CHECK(PXA2xxPICState, (obj), TYPE_PXA2XX_PIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     ARMCPU *cpu;
     uint32_t int_enabled[2];
@@ -260,9 +267,8 @@ static int pxa2xx_pic_post_load(void *opaque, int version_id)
 
 DeviceState *pxa2xx_pic_init(hwaddr base, ARMCPU *cpu)
 {
-    CPUARMState *env = &cpu->env;
-    DeviceState *dev = qdev_create(NULL, "pxa2xx_pic");
-    PXA2xxPICState *s = FROM_SYSBUS(PXA2xxPICState, SYS_BUS_DEVICE(dev));
+    DeviceState *dev = qdev_create(NULL, TYPE_PXA2XX_PIC);
+    PXA2xxPICState *s = PXA2XX_PIC(dev);
 
     s->cpu = cpu;
 
@@ -284,7 +290,7 @@ DeviceState *pxa2xx_pic_init(hwaddr base, ARMCPU *cpu)
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 
     /* Enable IC coprocessor access.  */
-    define_arm_cp_regs_with_opaque(arm_env_get_cpu(env), pxa_pic_cp_reginfo, s);
+    define_arm_cp_regs_with_opaque(cpu, pxa_pic_cp_reginfo, s);
 
     return dev;
 }
@@ -321,7 +327,7 @@ static void pxa2xx_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_pic_info = {
-    .name          = "pxa2xx_pic",
+    .name          = TYPE_PXA2XX_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxPICState),
     .class_init    = pxa2xx_pic_class_init,
commit 922bb317e488300c50344742cbd5e0028a8b3d77
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 02:03:39 2013 +0200

    pxa2xx_gpio: QOM cast cleanup for PXA2xxGPIOInfo
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx_gpio.c b/hw/arm/pxa2xx_gpio.c
index f8c3ee0..ca77f56 100644
--- a/hw/arm/pxa2xx_gpio.c
+++ b/hw/arm/pxa2xx_gpio.c
@@ -13,9 +13,16 @@
 
 #define PXA2XX_GPIO_BANKS	4
 
+#define TYPE_PXA2XX_GPIO "pxa2xx-gpio"
+#define PXA2XX_GPIO(obj) \
+    OBJECT_CHECK(PXA2xxGPIOInfo, (obj), TYPE_PXA2XX_GPIO)
+
 typedef struct PXA2xxGPIOInfo PXA2xxGPIOInfo;
 struct PXA2xxGPIOInfo {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq0, irq1, irqX;
     int lines;
@@ -256,7 +263,7 @@ DeviceState *pxa2xx_gpio_init(hwaddr base,
     CPUState *cs = CPU(cpu);
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "pxa2xx-gpio");
+    dev = qdev_create(NULL, TYPE_PXA2XX_GPIO);
     qdev_prop_set_int32(dev, "lines", lines);
     qdev_prop_set_int32(dev, "ncpu", cs->cpu_index);
     qdev_init_nofail(dev);
@@ -272,22 +279,21 @@ DeviceState *pxa2xx_gpio_init(hwaddr base,
     return dev;
 }
 
-static int pxa2xx_gpio_initfn(SysBusDevice *dev)
+static int pxa2xx_gpio_initfn(SysBusDevice *sbd)
 {
-    PXA2xxGPIOInfo *s;
-
-    s = FROM_SYSBUS(PXA2xxGPIOInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxGPIOInfo *s = PXA2XX_GPIO(dev);
 
     s->cpu = ARM_CPU(qemu_get_cpu(s->ncpu));
 
-    qdev_init_gpio_in(&dev->qdev, pxa2xx_gpio_set, s->lines);
-    qdev_init_gpio_out(&dev->qdev, s->handler, s->lines);
+    qdev_init_gpio_in(dev, pxa2xx_gpio_set, s->lines);
+    qdev_init_gpio_out(dev, s->handler, s->lines);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa_gpio_ops, s, "pxa2xx-gpio", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq0);
-    sysbus_init_irq(dev, &s->irq1);
-    sysbus_init_irq(dev, &s->irqX);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq0);
+    sysbus_init_irq(sbd, &s->irq1);
+    sysbus_init_irq(sbd, &s->irqX);
 
     return 0;
 }
@@ -298,7 +304,8 @@ static int pxa2xx_gpio_initfn(SysBusDevice *dev)
  */
 void pxa2xx_gpio_read_notifier(DeviceState *dev, qemu_irq handler)
 {
-    PXA2xxGPIOInfo *s = FROM_SYSBUS(PXA2xxGPIOInfo, SYS_BUS_DEVICE(dev));
+    PXA2xxGPIOInfo *s = PXA2XX_GPIO(dev);
+
     s->read_notify = handler;
 }
 
@@ -337,7 +344,7 @@ static void pxa2xx_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_gpio_info = {
-    .name          = "pxa2xx-gpio",
+    .name          = TYPE_PXA2XX_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxGPIOInfo),
     .class_init    = pxa2xx_gpio_class_init,
commit 5354c21ef905ab36015900e7d27d352bca47f285
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:56:59 2013 +0200

    pxa2xx: QOM cast cleanup for PXA2xxI2CState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 6548338..7de6453 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -1224,8 +1224,15 @@ typedef struct {
     PXA2xxI2CState *host;
 } PXA2xxI2CSlaveState;
 
+#define TYPE_PXA2XX_I2C "pxa2xx_i2c"
+#define PXA2XX_I2C(obj) \
+    OBJECT_CHECK(PXA2xxI2CState, (obj), TYPE_PXA2XX_I2C)
+
 struct PXA2xxI2CState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     PXA2xxI2CSlaveState *slave;
     i2c_bus *bus;
@@ -1473,16 +1480,16 @@ PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
     SysBusDevice *i2c_dev;
     PXA2xxI2CState *s;
 
-    i2c_dev = SYS_BUS_DEVICE(qdev_create(NULL, "pxa2xx_i2c"));
-    qdev_prop_set_uint32(&i2c_dev->qdev, "size", region_size + 1);
-    qdev_prop_set_uint32(&i2c_dev->qdev, "offset", base & region_size);
-
-    qdev_init_nofail(&i2c_dev->qdev);
+    dev = qdev_create(NULL, TYPE_PXA2XX_I2C);
+    qdev_prop_set_uint32(dev, "size", region_size + 1);
+    qdev_prop_set_uint32(dev, "offset", base & region_size);
+    qdev_init_nofail(dev);
 
+    i2c_dev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
     sysbus_connect_irq(i2c_dev, 0, irq);
 
-    s = FROM_SYSBUS(PXA2xxI2CState, i2c_dev);
+    s = PXA2XX_I2C(i2c_dev);
     /* FIXME: Should the slave device really be on a separate bus?  */
     dev = i2c_create_slave(i2c_init_bus(NULL, "dummy"), "pxa2xx-i2c-slave", 0);
     s->slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, I2C_SLAVE(dev));
@@ -1491,16 +1498,17 @@ PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
     return s;
 }
 
-static int pxa2xx_i2c_initfn(SysBusDevice *dev)
+static int pxa2xx_i2c_initfn(SysBusDevice *sbd)
 {
-    PXA2xxI2CState *s = FROM_SYSBUS(PXA2xxI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxI2CState *s = PXA2XX_I2C(dev);
 
-    s->bus = i2c_init_bus(&dev->qdev, "i2c");
+    s->bus = i2c_init_bus(dev, "i2c");
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_i2c_ops, s,
                           "pxa2xx-i2c", s->region_size);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     return 0;
 }
@@ -1528,7 +1536,7 @@ static void pxa2xx_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_i2c_info = {
-    .name          = "pxa2xx_i2c",
+    .name          = TYPE_PXA2XX_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxI2CState),
     .class_init    = pxa2xx_i2c_class_init,
commit 548c6f188ecfbb09b42a29393fc18252ab7bbf7d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:50:26 2013 +0200

    pxa2xx: QOM cast cleanup for PXA2xxRTCState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index babe22e..6548338 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -798,8 +798,15 @@ static int pxa2xx_ssp_init(SysBusDevice *sbd)
 #define RTCPICR		0x34	/* RTC Periodic Interrupt Counter register */
 #define PIAR		0x38	/* RTC Periodic Interrupt Alarm register */
 
+#define TYPE_PXA2XX_RTC "pxa2xx_rtc"
+#define PXA2XX_RTC(obj) \
+    OBJECT_CHECK(PXA2xxRTCState, (obj), TYPE_PXA2XX_RTC)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t rttr;
     uint32_t rtsr;
@@ -1110,7 +1117,7 @@ static const MemoryRegionOps pxa2xx_rtc_ops = {
 
 static int pxa2xx_rtc_init(SysBusDevice *dev)
 {
-    PXA2xxRTCState *s = FROM_SYSBUS(PXA2xxRTCState, dev);
+    PXA2xxRTCState *s = PXA2XX_RTC(dev);
     struct tm tm;
     int wom;
 
@@ -1205,7 +1212,7 @@ static void pxa2xx_rtc_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_rtc_sysbus_info = {
-    .name          = "pxa2xx_rtc",
+    .name          = TYPE_PXA2XX_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxRTCState),
     .class_init    = pxa2xx_rtc_sysbus_class_init,
@@ -2128,7 +2135,7 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
 
-    sysbus_create_simple("pxa2xx_rtc", 0x40900000,
+    sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
 
     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
@@ -2259,7 +2266,7 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
 
-    sysbus_create_simple("pxa2xx_rtc", 0x40900000,
+    sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
 
     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
commit 12a828041c666cf96d69cde85bd7ec03a7e8719f
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:45:10 2013 +0200

    pxa2xx: QOM cast cleanup for PXA2xxSSPState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 3c520d7..babe22e 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -457,9 +457,16 @@ static const VMStateDescription vmstate_pxa2xx_mm = {
     }
 };
 
+#define TYPE_PXA2XX_SSP "pxa2xx-ssp"
+#define PXA2XX_SSP(obj) \
+    OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
+
 /* Synchronous Serial Ports */
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq;
     int enable;
@@ -757,19 +764,20 @@ static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-static int pxa2xx_ssp_init(SysBusDevice *dev)
+static int pxa2xx_ssp_init(SysBusDevice *sbd)
 {
-    PXA2xxSSPState *s = FROM_SYSBUS(PXA2xxSSPState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxSSPState *s = PXA2XX_SSP(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_ssp_ops, s,
                           "pxa2xx-ssp", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    register_savevm(&dev->qdev, "pxa2xx_ssp", -1, 0,
+    sysbus_init_mmio(sbd, &s->iomem);
+    register_savevm(dev, "pxa2xx_ssp", -1, 0,
                     pxa2xx_ssp_save, pxa2xx_ssp_load, s);
 
-    s->bus = ssi_create_bus(&dev->qdev, "ssi");
+    s->bus = ssi_create_bus(dev, "ssi");
     return 0;
 }
 
@@ -2107,7 +2115,7 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
         DeviceState *dev;
-        dev = sysbus_create_simple("pxa2xx-ssp", pxa27x_ssp[i].io_base,
+        dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
                         qdev_get_gpio_in(s->pic, pxa27x_ssp[i].irqn));
         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
     }
@@ -2238,7 +2246,7 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
         DeviceState *dev;
-        dev = sysbus_create_simple("pxa2xx-ssp", pxa255_ssp[i].io_base,
+        dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
                         qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn));
         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
     }
@@ -2278,7 +2286,7 @@ static void pxa2xx_ssp_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_ssp_info = {
-    .name          = "pxa2xx-ssp",
+    .name          = TYPE_PXA2XX_SSP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxSSPState),
     .class_init    = pxa2xx_ssp_class_init,
commit 3bdf5327c9b3e449a3ea212d063baa7fac576b1b
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:38:59 2013 +0200

    musicpal: QOM cast cleanup for musicpal_key_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index ab54b2e..d715143 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -1436,8 +1436,15 @@ static const TypeInfo musicpal_gpio_info = {
 #define MP_KEY_BTN_VOLUME      (1 << 6)
 #define MP_KEY_BTN_NAVIGATION  (1 << 7)
 
+#define TYPE_MUSICPAL_KEY "musicpal_key"
+#define MUSICPAL_KEY(obj) \
+    OBJECT_CHECK(musicpal_key_state, (obj), TYPE_MUSICPAL_KEY)
+
 typedef struct musicpal_key_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t kbd_extended;
     uint32_t pressed_keys;
@@ -1521,17 +1528,18 @@ static void musicpal_key_event(void *opaque, int keycode)
     s->kbd_extended = 0;
 }
 
-static int musicpal_key_init(SysBusDevice *dev)
+static int musicpal_key_init(SysBusDevice *sbd)
 {
-    musicpal_key_state *s = FROM_SYSBUS(musicpal_key_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_key_state *s = MUSICPAL_KEY(dev);
 
     memory_region_init(&s->iomem, OBJECT(s), "dummy", 0);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     s->kbd_extended = 0;
     s->pressed_keys = 0;
 
-    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));
+    qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
 
     qemu_add_kbd_event_handler(musicpal_key_event, s);
 
@@ -1560,7 +1568,7 @@ static void musicpal_key_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo musicpal_key_info = {
-    .name          = "musicpal_key",
+    .name          = TYPE_MUSICPAL_KEY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_key_state),
     .class_init    = musicpal_key_class_init,
@@ -1684,7 +1692,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");
 
     lcd_dev = sysbus_create_simple(TYPE_MUSICPAL_LCD, MP_LCD_BASE, NULL);
-    key_dev = sysbus_create_simple("musicpal_key", -1, NULL);
+    key_dev = sysbus_create_simple(TYPE_MUSICPAL_KEY, -1, NULL);
 
     /* I2C read data */
     qdev_connect_gpio_out(i2c_dev, 0,
commit 7012d4b46b68dcffde1f12a5dfbce5c4c02dc3ff
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:36:24 2013 +0200

    musicpal: QOM cast cleanup for musicpal_gpio_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 21ec541..ab54b2e 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -1183,8 +1183,15 @@ static int mv88w8618_wlan_init(SysBusDevice *dev)
 /* LCD brightness bits in GPIO_OE_HI */
 #define MP_OE_LCD_BRIGHTNESS    0x0007
 
+#define TYPE_MUSICPAL_GPIO "musicpal_gpio"
+#define MUSICPAL_GPIO(obj) \
+    OBJECT_CHECK(musicpal_gpio_state, (obj), TYPE_MUSICPAL_GPIO)
+
 typedef struct musicpal_gpio_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t lcd_brightness;
     uint32_t out_state;
@@ -1344,8 +1351,7 @@ static const MemoryRegionOps musicpal_gpio_ops = {
 
 static void musicpal_gpio_reset(DeviceState *d)
 {
-    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state,
-                                         SYS_BUS_DEVICE(d));
+    musicpal_gpio_state *s = MUSICPAL_GPIO(d);
 
     s->lcd_brightness = 0;
     s->out_state = 0;
@@ -1355,19 +1361,20 @@ static void musicpal_gpio_reset(DeviceState *d)
     s->isr = 0;
 }
 
-static int musicpal_gpio_init(SysBusDevice *dev)
+static int musicpal_gpio_init(SysBusDevice *sbd)
 {
-    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_gpio_state *s = MUSICPAL_GPIO(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_gpio_ops, s,
                           "musicpal-gpio", MP_GPIO_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));
+    qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_gpio_pin_event, 32);
+    qdev_init_gpio_in(dev, musicpal_gpio_pin_event, 32);
 
     return 0;
 }
@@ -1399,7 +1406,7 @@ static void musicpal_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo musicpal_gpio_info = {
-    .name          = "musicpal_gpio",
+    .name          = TYPE_MUSICPAL_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_gpio_state),
     .class_init    = musicpal_gpio_class_init,
@@ -1671,7 +1678,8 @@ static void musicpal_init(QEMUMachineInitArgs *args)
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
-    dev = sysbus_create_simple("musicpal_gpio", MP_GPIO_BASE, pic[MP_GPIO_IRQ]);
+    dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
+                               pic[MP_GPIO_IRQ]);
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");
 
commit 5952b01cf82ba2385065c8fc9976b8907f215b36
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:32:00 2013 +0200

    musicpal: QOM cast cleanup for mv88w8618_flashcfg
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index b2a28d9..21ec541 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -982,8 +982,15 @@ static const TypeInfo mv88w8618_pit_info = {
 /* Flash config register offsets */
 #define MP_FLASHCFG_CFGR0    0x04
 
+#define TYPE_MV88W8618_FLASHCFG "mv88w8618_flashcfg"
+#define MV88W8618_FLASHCFG(obj) \
+    OBJECT_CHECK(mv88w8618_flashcfg_state, (obj), TYPE_MV88W8618_FLASHCFG)
+
 typedef struct mv88w8618_flashcfg_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t cfgr0;
 } mv88w8618_flashcfg_state;
@@ -1023,7 +1030,7 @@ static const MemoryRegionOps mv88w8618_flashcfg_ops = {
 
 static int mv88w8618_flashcfg_init(SysBusDevice *dev)
 {
-    mv88w8618_flashcfg_state *s = FROM_SYSBUS(mv88w8618_flashcfg_state, dev);
+    mv88w8618_flashcfg_state *s = MV88W8618_FLASHCFG(dev);
 
     s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_flashcfg_ops, s,
@@ -1053,7 +1060,7 @@ static void mv88w8618_flashcfg_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_flashcfg_info = {
-    .name          = "mv88w8618_flashcfg",
+    .name          = TYPE_MV88W8618_FLASHCFG,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_flashcfg_state),
     .class_init    = mv88w8618_flashcfg_class_init,
@@ -1651,7 +1658,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
 #endif
 
     }
-    sysbus_create_simple("mv88w8618_flashcfg", MP_FLASHCFG_BASE, NULL);
+    sysbus_create_simple(TYPE_MV88W8618_FLASHCFG, MP_FLASHCFG_BASE, NULL);
 
     qemu_check_nic_model(&nd_table[0], "mv88w8618");
     dev = qdev_create(NULL, TYPE_MV88W8618_ETH);
commit 4adc8541d970f5a52a8cb05f893f4afeec255d5b
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:27:32 2013 +0200

    musicpal: QOM cast cleanup for mv88w8618_pit_state
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index d6f593b..b2a28d9 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -816,8 +816,15 @@ typedef struct mv88w8618_timer_state {
     qemu_irq irq;
 } mv88w8618_timer_state;
 
+#define TYPE_MV88W8618_PIT "mv88w8618_pit"
+#define MV88W8618_PIT(obj) \
+    OBJECT_CHECK(mv88w8618_pit_state, (obj), TYPE_MV88W8618_PIT)
+
 typedef struct mv88w8618_pit_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     mv88w8618_timer_state timer[4];
 } mv88w8618_pit_state;
@@ -899,8 +906,7 @@ static void mv88w8618_pit_write(void *opaque, hwaddr offset,
 
 static void mv88w8618_pit_reset(DeviceState *d)
 {
-    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state,
-                                         SYS_BUS_DEVICE(d));
+    mv88w8618_pit_state *s = MV88W8618_PIT(d);
     int i;
 
     for (i = 0; i < 4; i++) {
@@ -917,7 +923,7 @@ static const MemoryRegionOps mv88w8618_pit_ops = {
 
 static int mv88w8618_pit_init(SysBusDevice *dev)
 {
-    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state, dev);
+    mv88w8618_pit_state *s = MV88W8618_PIT(dev);
     int i;
 
     /* Letting them all run at 1 MHz is likely just a pragmatic
@@ -967,7 +973,7 @@ static void mv88w8618_pit_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_pit_info = {
-    .name          = "mv88w8618_pit",
+    .name          = TYPE_MV88W8618_PIT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_pit_state),
     .class_init    = mv88w8618_pit_class_init,
@@ -1598,7 +1604,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
     }
-    sysbus_create_varargs("mv88w8618_pit", MP_PIT_BASE, pic[MP_TIMER1_IRQ],
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
commit c7bd0fd945c3f7f1d93a226dbe89a2ccf0503a58
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:22:07 2013 +0200

    musicpal: QOM cast cleanup mv88w8618_pic_state
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 0bc69e9..d6f593b 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -677,9 +677,15 @@ static const TypeInfo musicpal_lcd_info = {
 #define MP_PIC_ENABLE_SET       0x08
 #define MP_PIC_ENABLE_CLR       0x0C
 
-typedef struct mv88w8618_pic_state
-{
-    SysBusDevice busdev;
+#define TYPE_MV88W8618_PIC "mv88w8618_pic"
+#define MV88W8618_PIC(obj) \
+    OBJECT_CHECK(mv88w8618_pic_state, (obj), TYPE_MV88W8618_PIC)
+
+typedef struct mv88w8618_pic_state {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t level;
     uint32_t enabled;
@@ -737,8 +743,7 @@ static void mv88w8618_pic_write(void *opaque, hwaddr offset,
 
 static void mv88w8618_pic_reset(DeviceState *d)
 {
-    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state,
-                                         SYS_BUS_DEVICE(d));
+    mv88w8618_pic_state *s = MV88W8618_PIC(d);
 
     s->level = 0;
     s->enabled = 0;
@@ -752,9 +757,9 @@ static const MemoryRegionOps mv88w8618_pic_ops = {
 
 static int mv88w8618_pic_init(SysBusDevice *dev)
 {
-    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state, dev);
+    mv88w8618_pic_state *s = MV88W8618_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, mv88w8618_pic_set_irq, 32);
+    qdev_init_gpio_in(DEVICE(dev), mv88w8618_pic_set_irq, 32);
     sysbus_init_irq(dev, &s->parent_irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_pic_ops, s,
                           "musicpal-pic", MP_PIC_SIZE);
@@ -785,7 +790,7 @@ static void mv88w8618_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_pic_info = {
-    .name          = "mv88w8618_pic",
+    .name          = TYPE_MV88W8618_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_pic_state),
     .class_init    = mv88w8618_pic_class_init,
@@ -1588,7 +1593,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple("mv88w8618_pic", MP_PIC_BASE,
+    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                cpu_pic[ARM_PIC_CPU_IRQ]);
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
commit 2cca58fdc28fb860827a9f0bae1cd736df76cfa0
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:16:13 2013 +0200

    musicpal: QOM cast cleanup for musicpal_lcd_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 760630b..0bc69e9 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -462,8 +462,15 @@ static const TypeInfo mv88w8618_eth_info = {
 
 #define MP_LCD_TEXTCOLOR        0xe0e0ff /* RRGGBB */
 
+#define TYPE_MUSICPAL_LCD "musicpal_lcd"
+#define MUSICPAL_LCD(obj) \
+    OBJECT_CHECK(musicpal_lcd_state, (obj), TYPE_MUSICPAL_LCD)
+
 typedef struct musicpal_lcd_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t brightness;
     uint32_t mode;
@@ -614,20 +621,21 @@ static const GraphicHwOps musicpal_gfx_ops = {
     .gfx_update  = lcd_refresh,
 };
 
-static int musicpal_lcd_init(SysBusDevice *dev)
+static int musicpal_lcd_init(SysBusDevice *sbd)
 {
-    musicpal_lcd_state *s = FROM_SYSBUS(musicpal_lcd_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_lcd_state *s = MUSICPAL_LCD(dev);
 
     s->brightness = 7;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_lcd_ops, s,
                           "musicpal-lcd", MP_LCD_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    s->con = graphic_console_init(DEVICE(dev), &musicpal_gfx_ops, s);
+    s->con = graphic_console_init(dev, &musicpal_gfx_ops, s);
     qemu_console_resize(s->con, 128*3, 64*3);
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brightness_in, 3);
+    qdev_init_gpio_in(dev, musicpal_lcd_gpio_brightness_in, 3);
 
     return 0;
 }
@@ -658,7 +666,7 @@ static void musicpal_lcd_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo musicpal_lcd_info = {
-    .name          = "musicpal_lcd",
+    .name          = TYPE_MUSICPAL_LCD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_lcd_state),
     .class_init    = musicpal_lcd_class_init,
@@ -1649,7 +1657,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");
 
-    lcd_dev = sysbus_create_simple("musicpal_lcd", MP_LCD_BASE, NULL);
+    lcd_dev = sysbus_create_simple(TYPE_MUSICPAL_LCD, MP_LCD_BASE, NULL);
     key_dev = sysbus_create_simple("musicpal_key", -1, NULL);
 
     /* I2C read data */
commit a77d90e68a6a277f53bf9051c8fbc2b0d0cff1c1
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:12:52 2013 +0200

    musicpal: QOM cast cleanup for mv88w8618_eth_state
    
    Introduce type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index ddddd27..760630b 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -146,8 +146,15 @@ typedef struct mv88w8618_rx_desc {
     uint32_t next;
 } mv88w8618_rx_desc;
 
+#define TYPE_MV88W8618_ETH "mv88w8618_eth"
+#define MV88W8618_ETH(obj) \
+    OBJECT_CHECK(mv88w8618_eth_state, (obj), TYPE_MV88W8618_ETH)
+
 typedef struct mv88w8618_eth_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t smir;
@@ -382,16 +389,17 @@ static NetClientInfo net_mv88w8618_info = {
     .cleanup = eth_cleanup,
 };
 
-static int mv88w8618_eth_init(SysBusDevice *dev)
+static int mv88w8618_eth_init(SysBusDevice *sbd)
 {
-    mv88w8618_eth_state *s = FROM_SYSBUS(mv88w8618_eth_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mv88w8618_eth_state *s = MV88W8618_ETH(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->nic = qemu_new_nic(&net_mv88w8618_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_eth_ops, s,
                           "mv88w8618-eth", MP_ETH_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -429,7 +437,7 @@ static void mv88w8618_eth_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_eth_info = {
-    .name          = "mv88w8618_eth",
+    .name          = TYPE_MV88W8618_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_eth_state),
     .class_init    = mv88w8618_eth_class_init,
@@ -1627,7 +1635,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     sysbus_create_simple("mv88w8618_flashcfg", MP_FLASHCFG_BASE, NULL);
 
     qemu_check_nic_model(&nd_table[0], "mv88w8618");
-    dev = qdev_create(NULL, "mv88w8618_eth");
+    dev = qdev_create(NULL, TYPE_MV88W8618_ETH);
     qdev_set_nic_properties(dev, &nd_table[0]);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
commit 2c79fed33be49cb13c9ce01a6fc42240ee7dedc8
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jul 28 07:54:55 2013 +0200

    musicpal: Fix typo in name of local function
    
    The misspelling was spotted by Andreas Färber.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Jan Kiszka <jan.kiszka at web.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index b06d442..ddddd27 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -534,7 +534,7 @@ static void lcd_invalidate(void *opaque)
 {
 }
 
-static void musicpal_lcd_gpio_brigthness_in(void *opaque, int irq, int level)
+static void musicpal_lcd_gpio_brightness_in(void *opaque, int irq, int level)
 {
     musicpal_lcd_state *s = opaque;
     s->brightness &= ~(1 << irq);
@@ -619,7 +619,7 @@ static int musicpal_lcd_init(SysBusDevice *dev)
     s->con = graphic_console_init(DEVICE(dev), &musicpal_gfx_ops, s);
     qemu_console_resize(s->con, 128*3, 64*3);
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brigthness_in, 3);
+    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brightness_in, 3);
 
     return 0;
 }
commit 91b646264e1c1f37c9ffb3a602ad748b2a6b050c
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:08:01 2013 +0200

    integratorcp: QOM cast cleanup for icp_pic_state
    
    Introduce type constant and use QOM cast.
    Fix indentation.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index 58f4ed7..d518188 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -271,15 +271,21 @@ static int integratorcm_init(SysBusDevice *dev)
 /* Integrator/CP hardware emulation.  */
 /* Primary interrupt controller.  */
 
-typedef struct icp_pic_state
-{
-  SysBusDevice busdev;
-  MemoryRegion iomem;
-  uint32_t level;
-  uint32_t irq_enabled;
-  uint32_t fiq_enabled;
-  qemu_irq parent_irq;
-  qemu_irq parent_fiq;
+#define TYPE_INTEGRATOR_PIC "integrator_pic"
+#define INTEGRATOR_PIC(obj) \
+   OBJECT_CHECK(icp_pic_state, (obj), TYPE_INTEGRATOR_PIC)
+
+typedef struct icp_pic_state {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    MemoryRegion iomem;
+    uint32_t level;
+    uint32_t irq_enabled;
+    uint32_t fiq_enabled;
+    qemu_irq parent_irq;
+    qemu_irq parent_fiq;
 } icp_pic_state;
 
 static void icp_pic_update(icp_pic_state *s)
@@ -374,16 +380,17 @@ static const MemoryRegionOps icp_pic_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int icp_pic_init(SysBusDevice *dev)
+static int icp_pic_init(SysBusDevice *sbd)
 {
-    icp_pic_state *s = FROM_SYSBUS(icp_pic_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    icp_pic_state *s = INTEGRATOR_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, icp_pic_set_irq, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
-    sysbus_init_irq(dev, &s->parent_fiq);
+    qdev_init_gpio_in(dev, icp_pic_set_irq, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
+    sysbus_init_irq(sbd, &s->parent_fiq);
     memory_region_init_io(&s->iomem, OBJECT(s), &icp_pic_ops, s,
                           "icp-pic", 0x00800000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -487,13 +494,13 @@ static void integratorcp_init(QEMUMachineInitArgs *args)
     sysbus_mmio_map((SysBusDevice *)dev, 0, 0x10000000);
 
     cpu_pic = arm_pic_init_cpu(cpu);
-    dev = sysbus_create_varargs("integrator_pic", 0x14000000,
+    dev = sysbus_create_varargs(TYPE_INTEGRATOR_PIC, 0x14000000,
                                 cpu_pic[ARM_PIC_CPU_IRQ],
                                 cpu_pic[ARM_PIC_CPU_FIQ], NULL);
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
     }
-    sysbus_create_simple("integrator_pic", 0xca000000, pic[26]);
+    sysbus_create_simple(TYPE_INTEGRATOR_PIC, 0xca000000, pic[26]);
     sysbus_create_varargs("integrator_pit", 0x13000000,
                           pic[5], pic[6], pic[7], NULL);
     sysbus_create_simple("pl031", 0x15000000, pic[8]);
@@ -559,7 +566,7 @@ static void icp_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo icp_pic_info = {
-    .name          = "integrator_pic",
+    .name          = TYPE_INTEGRATOR_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(icp_pic_state),
     .class_init    = icp_pic_class_init,
commit 257ec289b297586f45d5ea5ea01adf8672aa6a05
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:00:27 2013 +0200

    integratorcp: QOM cast cleanup for integratorcm_state
    
    Rename to IntegratorCMState, introduce type constant and use QOM cast.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index 249a430..58f4ed7 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -15,8 +15,15 @@
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_INTEGRATOR_CM "integrator_core"
+#define INTEGRATOR_CM(obj) \
+    OBJECT_CHECK(IntegratorCMState, (obj), TYPE_INTEGRATOR_CM)
+
+typedef struct IntegratorCMState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t memsz;
     MemoryRegion flash;
@@ -31,7 +38,7 @@ typedef struct {
     uint32_t int_level;
     uint32_t irq_enabled;
     uint32_t fiq_enabled;
-} integratorcm_state;
+} IntegratorCMState;
 
 static uint8_t integrator_spd[128] = {
    128, 8, 4, 11, 9, 1, 64, 0,  2, 0xa0, 0xa0, 0, 0, 8, 0, 1,
@@ -41,7 +48,7 @@ static uint8_t integrator_spd[128] = {
 static uint64_t integratorcm_read(void *opaque, hwaddr offset,
                                   unsigned size)
 {
-    integratorcm_state *s = (integratorcm_state *)opaque;
+    IntegratorCMState *s = opaque;
     if (offset >= 0x100 && offset < 0x200) {
         /* CM_SPD */
         if (offset >= 0x180)
@@ -108,7 +115,7 @@ static uint64_t integratorcm_read(void *opaque, hwaddr offset,
     }
 }
 
-static void integratorcm_do_remap(integratorcm_state *s)
+static void integratorcm_do_remap(IntegratorCMState *s)
 {
     /* Sync memory region state with CM_CTRL REMAP bit:
      * bit 0 => flash at address 0; bit 1 => RAM
@@ -116,7 +123,7 @@ static void integratorcm_do_remap(integratorcm_state *s)
     memory_region_set_enabled(&s->flash, !(s->cm_ctrl & 4));
 }
 
-static void integratorcm_set_ctrl(integratorcm_state *s, uint32_t value)
+static void integratorcm_set_ctrl(IntegratorCMState *s, uint32_t value)
 {
     if (value & 8) {
         qemu_system_reset_request();
@@ -133,7 +140,7 @@ static void integratorcm_set_ctrl(integratorcm_state *s, uint32_t value)
     integratorcm_do_remap(s);
 }
 
-static void integratorcm_update(integratorcm_state *s)
+static void integratorcm_update(IntegratorCMState *s)
 {
     /* ??? The CPU irq/fiq is raised when either the core module or base PIC
        are active.  */
@@ -144,7 +151,7 @@ static void integratorcm_update(integratorcm_state *s)
 static void integratorcm_write(void *opaque, hwaddr offset,
                                uint64_t value, unsigned size)
 {
-    integratorcm_state *s = (integratorcm_state *)opaque;
+    IntegratorCMState *s = opaque;
     switch (offset >> 2) {
     case 2: /* CM_OSC */
         if (s->cm_lock == 0xa05f)
@@ -226,7 +233,7 @@ static const MemoryRegionOps integratorcm_ops = {
 
 static int integratorcm_init(SysBusDevice *dev)
 {
-    integratorcm_state *s = FROM_SYSBUS(integratorcm_state, dev);
+    IntegratorCMState *s = INTEGRATOR_CM(dev);
 
     s->cm_osc = 0x01000048;
     /* ??? What should the high bits of this value be?  */
@@ -474,7 +481,7 @@ static void integratorcp_init(QEMUMachineInitArgs *args)
     memory_region_init_alias(ram_alias, NULL, "ram.alias", ram, 0, ram_size);
     memory_region_add_subregion(address_space_mem, 0x80000000, ram_alias);
 
-    dev = qdev_create(NULL, "integrator_core");
+    dev = qdev_create(NULL, TYPE_INTEGRATOR_CM);
     qdev_prop_set_uint32(dev, "memsz", ram_size >> 20);
     qdev_init_nofail(dev);
     sysbus_mmio_map((SysBusDevice *)dev, 0, 0x10000000);
@@ -524,7 +531,7 @@ static void integratorcp_machine_init(void)
 machine_init(integratorcp_machine_init);
 
 static Property core_properties[] = {
-    DEFINE_PROP_UINT32("memsz", integratorcm_state, memsz, 0),
+    DEFINE_PROP_UINT32("memsz", IntegratorCMState, memsz, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -538,9 +545,9 @@ static void core_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo core_info = {
-    .name          = "integrator_core",
+    .name          = TYPE_INTEGRATOR_CM,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(integratorcm_state),
+    .instance_size = sizeof(IntegratorCMState),
     .class_init    = core_class_init,
 };
 
commit 426533faed4338f228c715fbec21a887692ad47c
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 00:52:40 2013 +0200

    highbank: QOM cast cleanup for HighbankRegsState
    
    Add type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index be264d3..35d5511 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -116,8 +116,15 @@ static const MemoryRegionOps hb_mem_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+#define TYPE_HIGHBANK_REGISTERS "highbank-regs"
+#define HIGHBANK_REGISTERS(obj) \
+    OBJECT_CHECK(HighbankRegsState, (obj), TYPE_HIGHBANK_REGISTERS)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion *iomem;
     uint32_t regs[NUM_REGS];
 } HighbankRegsState;
@@ -135,8 +142,7 @@ static VMStateDescription vmstate_highbank_regs = {
 
 static void highbank_regs_reset(DeviceState *dev)
 {
-    SysBusDevice *sys_dev = SYS_BUS_DEVICE(dev);
-    HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, sys_dev);
+    HighbankRegsState *s = HIGHBANK_REGISTERS(dev);
 
     s->regs[0x40] = 0x05F20121;
     s->regs[0x41] = 0x2;
@@ -146,7 +152,7 @@ static void highbank_regs_reset(DeviceState *dev)
 
 static int highbank_regs_init(SysBusDevice *dev)
 {
-    HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, dev);
+    HighbankRegsState *s = HIGHBANK_REGISTERS(dev);
 
     s->iomem = g_new(MemoryRegion, 1);
     memory_region_init_io(s->iomem, OBJECT(s), &hb_mem_ops, s->regs,
@@ -168,7 +174,7 @@ static void highbank_regs_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo highbank_regs_info = {
-    .name          = "highbank-regs",
+    .name          = TYPE_HIGHBANK_REGISTERS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(HighbankRegsState),
     .class_init    = highbank_regs_class_init,
commit 936230a713208659c664da20287fcb5e5811743a
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 00:46:43 2013 +0200

    armv7m: QOM cast cleanup for BitBandState
    
    Introduce TYPE_* constant and use QOM cast.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 5b22e84..82d36fb 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -114,15 +114,21 @@ static const MemoryRegionOps bitband_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+#define TYPE_BITBAND "ARM,bitband-memory"
+#define BITBAND(obj) OBJECT_CHECK(BitBandState, (obj), TYPE_BITBAND)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t base;
 } BitBandState;
 
 static int bitband_init(SysBusDevice *dev)
 {
-    BitBandState *s = FROM_SYSBUS(BitBandState, dev);
+    BitBandState *s = BITBAND(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &bitband_ops, &s->base,
                           "bitband", 0x02000000);
@@ -134,12 +140,12 @@ static void armv7m_bitband_init(void)
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "ARM,bitband-memory");
+    dev = qdev_create(NULL, TYPE_BITBAND);
     qdev_prop_set_uint32(dev, "base", 0x20000000);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x22000000);
 
-    dev = qdev_create(NULL, "ARM,bitband-memory");
+    dev = qdev_create(NULL, TYPE_BITBAND);
     qdev_prop_set_uint32(dev, "base", 0x40000000);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x42000000);
@@ -270,7 +276,7 @@ static void bitband_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo bitband_info = {
-    .name          = "ARM,bitband-memory",
+    .name          = TYPE_BITBAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(BitBandState),
     .class_init    = bitband_class_init,
commit bcb34c7a61bce00136d42442c592011e56d87161
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:50:54 2013 +0200

    imx_ccm: QOM cast cleanup
    
    Introduce type constant and use QOM casts.
    
    Acked-by: Peter Chubb <peter.chubb at nicta.com.au>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
index 816d5e8..63e33a4 100644
--- a/hw/misc/imx_ccm.c
+++ b/hw/misc/imx_ccm.c
@@ -29,8 +29,12 @@ do { printf("imx_ccm: " fmt , ##args); } while (0)
 
 static int imx_ccm_post_load(void *opaque, int version_id);
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_CCM "imx_ccm"
+#define IMX_CCM(obj) OBJECT_CHECK(IMXCCMState, (obj), TYPE_IMX_CCM)
+
+typedef struct IMXCCMState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t ccmr;
@@ -108,7 +112,7 @@ static const VMStateDescription vmstate_imx_ccm = {
 
 uint32_t imx_clock_frequency(DeviceState *dev, IMXClk clock)
 {
-    IMXCCMState *s = container_of(dev, IMXCCMState, busdev.qdev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     switch (clock) {
     case NOCLK:
@@ -178,7 +182,7 @@ static void update_clocks(IMXCCMState *s)
 
 static void imx_ccm_reset(DeviceState *dev)
 {
-    IMXCCMState *s = container_of(dev, IMXCCMState, busdev.qdev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     s->ccmr = 0x074b0b7b;
     s->pdr0 = 0xff870b48;
@@ -279,7 +283,7 @@ static const struct MemoryRegionOps imx_ccm_ops = {
 
 static int imx_ccm_init(SysBusDevice *dev)
 {
-    IMXCCMState *s = FROM_SYSBUS(typeof(*s), dev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &imx_ccm_ops, s,
                           "imx_ccm", 0x1000);
@@ -308,7 +312,7 @@ static void imx_ccm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo imx_ccm_info = {
-    .name = "imx_ccm",
+    .name = TYPE_IMX_CCM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXCCMState),
     .class_init = imx_ccm_class_init,
commit 5ff94a61c461111e25b67c7b9cabef035aa30225
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:31:08 2013 +0200

    imx_avic: QOM cast cleanup
    
    Introduce type constant, use QOM casts and prepare SysBus initfn for QOM
    realize by resolving SysBusDevice vs. DeviceState "dev" name conflict.
    
    Acked-by: Peter Chubb <peter.chubb at nicta.com.au>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/imx_avic.c b/hw/intc/imx_avic.c
index 75c8ffd..fb00e91 100644
--- a/hw/intc/imx_avic.c
+++ b/hw/intc/imx_avic.c
@@ -55,8 +55,13 @@ do { printf("imx_avic: " fmt , ##args); } while (0)
 #define PRIO_PER_WORD (sizeof(uint32_t) * 8 / 4)
 #define PRIO_WORDS (IMX_AVIC_NUM_IRQS/PRIO_PER_WORD)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_AVIC "imx_avic"
+#define IMX_AVIC(obj) \
+    OBJECT_CHECK(IMXAVICState, (obj), TYPE_IMX_AVIC)
+
+typedef struct IMXAVICState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint64_t pending;
     uint64_t enabled;
@@ -359,7 +364,8 @@ static const MemoryRegionOps imx_avic_ops = {
 
 static void imx_avic_reset(DeviceState *dev)
 {
-    IMXAVICState *s = container_of(dev, IMXAVICState, busdev.qdev);
+    IMXAVICState *s = IMX_AVIC(dev);
+
     s->pending = 0;
     s->enabled = 0;
     s->is_fiq = 0;
@@ -368,17 +374,18 @@ static void imx_avic_reset(DeviceState *dev)
     memset(s->prio, 0, sizeof s->prio);
 }
 
-static int imx_avic_init(SysBusDevice *dev)
+static int imx_avic_init(SysBusDevice *sbd)
 {
-    IMXAVICState *s = FROM_SYSBUS(IMXAVICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    IMXAVICState *s = IMX_AVIC(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &imx_avic_ops, s,
                           "imx_avic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_in(&dev->qdev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    qdev_init_gpio_in(dev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
 
     return 0;
 }
@@ -395,7 +402,7 @@ static void imx_avic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo imx_avic_info = {
-    .name = "imx_avic",
+    .name = TYPE_IMX_AVIC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXAVICState),
     .class_init = imx_avic_class_init,
commit 01774ddbcf42c9521fa66679f947eb49327b8e18
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 01:13:54 2013 +0200

    tcx: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 9fd48b5..24876d3 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -34,8 +34,12 @@
 #define TCX_THC_NREGS_24 0x1000
 #define TCX_TEC_NREGS    0x1000
 
+#define TYPE_TCX "SUNW,tcx"
+#define TCX(obj) OBJECT_CHECK(TCXState, (obj), TYPE_TCX)
+
 typedef struct TCXState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     QemuConsole *con;
     uint8_t *vram;
     uint32_t *vram24, *cplane;
@@ -423,7 +427,7 @@ static const VMStateDescription vmstate_tcx = {
 
 static void tcx_reset(DeviceState *d)
 {
-    TCXState *s = container_of(d, TCXState, busdev.qdev);
+    TCXState *s = TCX(d);
 
     /* Initialize palette */
     memset(s->r, 0, 256);
@@ -523,7 +527,7 @@ static const GraphicHwOps tcx24_ops = {
 
 static int tcx_init1(SysBusDevice *dev)
 {
-    TCXState *s = FROM_SYSBUS(TCXState, dev);
+    TCXState *s = TCX(dev);
     ram_addr_t vram_offset = 0;
     int size;
     uint8_t *vram_base;
@@ -609,7 +613,7 @@ static void tcx_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo tcx_info = {
-    .name          = "SUNW,tcx",
+    .name          = TYPE_TCX,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(TCXState),
     .class_init    = tcx_class_init,
commit 5d7a11e438f78a2656000a8d549f0dea412f3dc5
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 01:09:03 2013 +0200

    pl110: QOM'ify pl110, pl110_versatile and pl111
    
    Let pl110_versatile and pl111 inherit from pl110 and use PL110() cast;
    set their version index in an instance_init.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Set version PL110 explicitly, suggested by Hu Tao; fixed inheritence]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 1e36258..e79ab4b 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -39,8 +39,12 @@ enum pl110_version
     PL111
 };
 
+#define TYPE_PL110 "pl110"
+#define PL110(obj) OBJECT_CHECK(PL110State, (obj), TYPE_PL110)
+
 typedef struct PL110State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QemuConsole *con;
 
@@ -129,6 +133,7 @@ static int pl110_enabled(PL110State *s)
 static void pl110_update_display(void *opaque)
 {
     PL110State *s = (PL110State *)opaque;
+    SysBusDevice *sbd;
     DisplaySurface *surface = qemu_console_surface(s->con);
     drawfn* fntable;
     drawfn fn;
@@ -138,8 +143,11 @@ static void pl110_update_display(void *opaque)
     int first;
     int last;
 
-    if (!pl110_enabled(s))
+    if (!pl110_enabled(s)) {
         return;
+    }
+
+    sbd = SYS_BUS_DEVICE(s);
 
     switch (surface_bits_per_pixel(surface)) {
     case 0:
@@ -232,7 +240,7 @@ static void pl110_update_display(void *opaque)
     }
     dest_width *= s->cols;
     first = 0;
-    framebuffer_update_display(surface, sysbus_address_space(&s->busdev),
+    framebuffer_update_display(surface, sysbus_address_space(sbd),
                                s->upbase, s->cols, s->rows,
                                src_width, dest_width, 0,
                                s->invalidate,
@@ -449,30 +457,38 @@ static const GraphicHwOps pl110_gfx_ops = {
     .gfx_update  = pl110_update_display,
 };
 
-static int pl110_init(SysBusDevice *dev)
+static int pl110_initfn(SysBusDevice *sbd)
 {
-    PL110State *s = FROM_SYSBUS(PL110State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL110State *s = PL110(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&s->busdev.qdev, pl110_mux_ctrl_set, 1);
-    s->con = graphic_console_init(DEVICE(dev), &pl110_gfx_ops, s);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, pl110_mux_ctrl_set, 1);
+    s->con = graphic_console_init(dev, &pl110_gfx_ops, s);
     return 0;
 }
 
-static int pl110_versatile_init(SysBusDevice *dev)
+static void pl110_init(Object *obj)
+{
+    PL110State *s = PL110(obj);
+
+    s->version = PL110;
+}
+
+static void pl110_versatile_init(Object *obj)
 {
-    PL110State *s = FROM_SYSBUS(PL110State, dev);
+    PL110State *s = PL110(obj);
+
     s->version = PL110_VERSATILE;
-    return pl110_init(dev);
 }
 
-static int pl111_init(SysBusDevice *dev)
+static void pl111_init(Object *obj)
 {
-    PL110State *s = FROM_SYSBUS(PL110State, dev);
+    PL110State *s = PL110(obj);
+
     s->version = PL111;
-    return pl110_init(dev);
 }
 
 static void pl110_class_init(ObjectClass *klass, void *data)
@@ -480,53 +496,30 @@ static void pl110_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pl110_init;
+    k->init = pl110_initfn;
     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
 
 static const TypeInfo pl110_info = {
-    .name          = "pl110",
+    .name          = TYPE_PL110,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL110State),
+    .instance_init = pl110_init,
     .class_init    = pl110_class_init,
 };
 
-static void pl110_versatile_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl110_versatile_init;
-    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl110;
-}
-
 static const TypeInfo pl110_versatile_info = {
     .name          = "pl110_versatile",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL110State),
-    .class_init    = pl110_versatile_class_init,
+    .parent        = TYPE_PL110,
+    .instance_init = pl110_versatile_init,
 };
 
-static void pl111_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl111_init;
-    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl110;
-}
-
 static const TypeInfo pl111_info = {
     .name          = "pl111",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL110State),
-    .class_init    = pl111_class_init,
+    .parent        = TYPE_PL110,
+    .instance_init = pl111_init,
 };
 
 static void pl110_register_types(void)
commit 513960eaae0f33616e2f59d3b887b4d810763866
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:57:23 2013 +0200

    pl110: Rename pl110_state to PL110State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 31993a7..1e36258 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -39,7 +39,7 @@ enum pl110_version
     PL111
 };
 
-typedef struct {
+typedef struct PL110State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     QemuConsole *con;
@@ -59,7 +59,7 @@ typedef struct {
     uint32_t palette[256];
     uint32_t raw_palette[128];
     qemu_irq irq;
-} pl110_state;
+} PL110State;
 
 static int vmstate_pl110_post_load(void *opaque, int version_id);
 
@@ -69,20 +69,20 @@ static const VMStateDescription vmstate_pl110 = {
     .minimum_version_id = 1,
     .post_load = vmstate_pl110_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_INT32(version, pl110_state),
-        VMSTATE_UINT32_ARRAY(timing, pl110_state, 4),
-        VMSTATE_UINT32(cr, pl110_state),
-        VMSTATE_UINT32(upbase, pl110_state),
-        VMSTATE_UINT32(lpbase, pl110_state),
-        VMSTATE_UINT32(int_status, pl110_state),
-        VMSTATE_UINT32(int_mask, pl110_state),
-        VMSTATE_INT32(cols, pl110_state),
-        VMSTATE_INT32(rows, pl110_state),
-        VMSTATE_UINT32(bpp, pl110_state),
-        VMSTATE_INT32(invalidate, pl110_state),
-        VMSTATE_UINT32_ARRAY(palette, pl110_state, 256),
-        VMSTATE_UINT32_ARRAY(raw_palette, pl110_state, 128),
-        VMSTATE_UINT32_V(mux_ctrl, pl110_state, 2),
+        VMSTATE_INT32(version, PL110State),
+        VMSTATE_UINT32_ARRAY(timing, PL110State, 4),
+        VMSTATE_UINT32(cr, PL110State),
+        VMSTATE_UINT32(upbase, PL110State),
+        VMSTATE_UINT32(lpbase, PL110State),
+        VMSTATE_UINT32(int_status, PL110State),
+        VMSTATE_UINT32(int_mask, PL110State),
+        VMSTATE_INT32(cols, PL110State),
+        VMSTATE_INT32(rows, PL110State),
+        VMSTATE_UINT32(bpp, PL110State),
+        VMSTATE_INT32(invalidate, PL110State),
+        VMSTATE_UINT32_ARRAY(palette, PL110State, 256),
+        VMSTATE_UINT32_ARRAY(raw_palette, PL110State, 128),
+        VMSTATE_UINT32_V(mux_ctrl, PL110State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -121,14 +121,14 @@ static const unsigned char *idregs[] = {
 #define BITS 32
 #include "pl110_template.h"
 
-static int pl110_enabled(pl110_state *s)
+static int pl110_enabled(PL110State *s)
 {
   return (s->cr & PL110_CR_EN) && (s->cr & PL110_CR_PWR);
 }
 
 static void pl110_update_display(void *opaque)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     DisplaySurface *surface = qemu_console_surface(s->con);
     drawfn* fntable;
     drawfn fn;
@@ -246,14 +246,14 @@ static void pl110_update_display(void *opaque)
 
 static void pl110_invalidate_display(void * opaque)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     s->invalidate = 1;
     if (pl110_enabled(s)) {
         qemu_console_resize(s->con, s->cols, s->rows);
     }
 }
 
-static void pl110_update_palette(pl110_state *s, int n)
+static void pl110_update_palette(PL110State *s, int n)
 {
     DisplaySurface *surface = qemu_console_surface(s->con);
     int i;
@@ -289,7 +289,7 @@ static void pl110_update_palette(pl110_state *s, int n)
     }
 }
 
-static void pl110_resize(pl110_state *s, int width, int height)
+static void pl110_resize(PL110State *s, int width, int height)
 {
     if (width != s->cols || height != s->rows) {
         if (pl110_enabled(s)) {
@@ -301,7 +301,7 @@ static void pl110_resize(pl110_state *s, int width, int height)
 }
 
 /* Update interrupts.  */
-static void pl110_update(pl110_state *s)
+static void pl110_update(PL110State *s)
 {
   /* TODO: Implement interrupts.  */
 }
@@ -309,7 +309,7 @@ static void pl110_update(pl110_state *s)
 static uint64_t pl110_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
         return idregs[s->version][(offset - 0xfe0) >> 2];
@@ -359,7 +359,7 @@ static uint64_t pl110_read(void *opaque, hwaddr offset,
 static void pl110_write(void *opaque, hwaddr offset,
                         uint64_t val, unsigned size)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     int n;
 
     /* For simplicity invalidate the display whenever a control register
@@ -432,13 +432,13 @@ static const MemoryRegionOps pl110_ops = {
 
 static void pl110_mux_ctrl_set(void *opaque, int line, int level)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     s->mux_ctrl = level;
 }
 
 static int vmstate_pl110_post_load(void *opaque, int version_id)
 {
-    pl110_state *s = opaque;
+    PL110State *s = opaque;
     /* Make sure we redraw, and at the right size */
     pl110_invalidate_display(s);
     return 0;
@@ -451,7 +451,7 @@ static const GraphicHwOps pl110_gfx_ops = {
 
 static int pl110_init(SysBusDevice *dev)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    PL110State *s = FROM_SYSBUS(PL110State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -463,14 +463,14 @@ static int pl110_init(SysBusDevice *dev)
 
 static int pl110_versatile_init(SysBusDevice *dev)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    PL110State *s = FROM_SYSBUS(PL110State, dev);
     s->version = PL110_VERSATILE;
     return pl110_init(dev);
 }
 
 static int pl111_init(SysBusDevice *dev)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    PL110State *s = FROM_SYSBUS(PL110State, dev);
     s->version = PL111;
     return pl110_init(dev);
 }
@@ -489,7 +489,7 @@ static void pl110_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl110_info = {
     .name          = "pl110",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
+    .instance_size = sizeof(PL110State),
     .class_init    = pl110_class_init,
 };
 
@@ -507,7 +507,7 @@ static void pl110_versatile_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl110_versatile_info = {
     .name          = "pl110_versatile",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
+    .instance_size = sizeof(PL110State),
     .class_init    = pl110_versatile_class_init,
 };
 
@@ -525,7 +525,7 @@ static void pl111_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl111_info = {
     .name          = "pl111",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
+    .instance_size = sizeof(PL110State),
     .class_init    = pl111_class_init,
 };
 
commit 54df97bb0c625114ac8c7d8e236fbb7a2456e334
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:53:39 2013 +0200

    milkymist-vgafb: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/milkymist-vgafb.c b/hw/display/milkymist-vgafb.c
index 870b339..5150cb4 100644
--- a/hw/display/milkymist-vgafb.c
+++ b/hw/display/milkymist-vgafb.c
@@ -63,8 +63,13 @@ enum {
     CTRL_RESET = (1<<0),
 };
 
+#define TYPE_MILKYMIST_VGAFB "milkymist-vgafb"
+#define MILKYMIST_VGAFB(obj) \
+    OBJECT_CHECK(MilkymistVgafbState, (obj), TYPE_MILKYMIST_VGAFB)
+
 struct MilkymistVgafbState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     QemuConsole *con;
 
@@ -84,6 +89,7 @@ static int vgafb_enabled(MilkymistVgafbState *s)
 static void vgafb_update_display(void *opaque)
 {
     MilkymistVgafbState *s = opaque;
+    SysBusDevice *sbd;
     DisplaySurface *surface = qemu_console_surface(s->con);
     int first = 0;
     int last = 0;
@@ -93,6 +99,7 @@ static void vgafb_update_display(void *opaque)
         return;
     }
 
+    sbd = SYS_BUS_DEVICE(s);
     int dest_width = s->regs[R_HRES];
 
     switch (surface_bits_per_pixel(surface)) {
@@ -122,7 +129,7 @@ static void vgafb_update_display(void *opaque)
         break;
     }
 
-    framebuffer_update_display(surface, sysbus_address_space(&s->busdev),
+    framebuffer_update_display(surface, sysbus_address_space(sbd),
                                s->regs[R_BASEADDRESS] + s->fb_offset,
                                s->regs[R_HRES],
                                s->regs[R_VRES],
@@ -256,7 +263,7 @@ static const MemoryRegionOps vgafb_mmio_ops = {
 
 static void milkymist_vgafb_reset(DeviceState *d)
 {
-    MilkymistVgafbState *s = container_of(d, MilkymistVgafbState, busdev.qdev);
+    MilkymistVgafbState *s = MILKYMIST_VGAFB(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -277,7 +284,7 @@ static const GraphicHwOps vgafb_ops = {
 
 static int milkymist_vgafb_init(SysBusDevice *dev)
 {
-    MilkymistVgafbState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistVgafbState *s = MILKYMIST_VGAFB(dev);
 
     memory_region_init_io(&s->regs_region, OBJECT(s), &vgafb_mmio_ops, s,
             "milkymist-vgafb", R_MAX * 4);
@@ -324,7 +331,7 @@ static void milkymist_vgafb_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_vgafb_info = {
-    .name          = "milkymist-vgafb",
+    .name          = TYPE_MILKYMIST_VGAFB,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistVgafbState),
     .class_init    = milkymist_vgafb_class_init,
commit 56299135f5c32a8b606e4b62af9200a3cee65985
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:48:23 2013 +0200

    milkymist-tmu2: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/milkymist-tmu2.c b/hw/display/milkymist-tmu2.c
index efda082..b2a5fba 100644
--- a/hw/display/milkymist-tmu2.c
+++ b/hw/display/milkymist-tmu2.c
@@ -75,8 +75,13 @@ struct vertex {
     int y;
 } QEMU_PACKED;
 
+#define TYPE_MILKYMIST_TMU2 "milkymist-tmu2"
+#define MILKYMIST_TMU2(obj) \
+    OBJECT_CHECK(MilkymistTMU2State, (obj), TYPE_MILKYMIST_TMU2)
+
 struct MilkymistTMU2State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -429,7 +434,7 @@ static const MemoryRegionOps tmu2_mmio_ops = {
 
 static void milkymist_tmu2_reset(DeviceState *d)
 {
-    MilkymistTMU2State *s = container_of(d, MilkymistTMU2State, busdev.qdev);
+    MilkymistTMU2State *s = MILKYMIST_TMU2(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -439,7 +444,7 @@ static void milkymist_tmu2_reset(DeviceState *d)
 
 static int milkymist_tmu2_init(SysBusDevice *dev)
 {
-    MilkymistTMU2State *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistTMU2State *s = MILKYMIST_TMU2(dev);
 
     if (tmu2_glx_init(s)) {
         return 1;
@@ -476,7 +481,7 @@ static void milkymist_tmu2_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_tmu2_info = {
-    .name          = "milkymist-tmu2",
+    .name          = TYPE_MILKYMIST_TMU2,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistTMU2State),
     .class_init    = milkymist_tmu2_class_init,
commit 66c2de562f504895eeb407a04dddd4c76ab70c50
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:35:51 2013 +0200

    jazz_led: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/jazz_led.c b/hw/display/jazz_led.c
index 7f82037..8407e6c 100644
--- a/hw/display/jazz_led.c
+++ b/hw/display/jazz_led.c
@@ -32,8 +32,12 @@ typedef enum {
     REDRAW_NONE = 0, REDRAW_SEGMENTS = 1, REDRAW_BACKGROUND = 2,
 } screen_state_t;
 
+#define TYPE_JAZZ_LED "jazz-led"
+#define JAZZ_LED(obj) OBJECT_CHECK(LedState, (obj), TYPE_JAZZ_LED)
+
 typedef struct LedState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint8_t segments;
     QemuConsole *con;
@@ -262,7 +266,7 @@ static const GraphicHwOps jazz_led_ops = {
 
 static int jazz_led_init(SysBusDevice *dev)
 {
-    LedState *s = FROM_SYSBUS(LedState, dev);
+    LedState *s = JAZZ_LED(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &led_ops, s, "led", 1);
     sysbus_init_mmio(dev, &s->iomem);
@@ -274,7 +278,7 @@ static int jazz_led_init(SysBusDevice *dev)
 
 static void jazz_led_reset(DeviceState *d)
 {
-    LedState *s = DO_UPCAST(LedState, busdev.qdev, d);
+    LedState *s = JAZZ_LED(d);
 
     s->segments = 0;
     s->state = REDRAW_SEGMENTS | REDRAW_BACKGROUND;
@@ -293,7 +297,7 @@ static void jazz_led_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo jazz_led_info = {
-    .name          = "jazz-led",
+    .name          = TYPE_JAZZ_LED,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LedState),
     .class_init    = jazz_led_class_init,
commit 0f31aa86255e97295b4d81e3d03a527974746d63
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:30:30 2013 +0200

    g364fb: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/g364fb.c b/hw/display/g364fb.c
index 2d3e912..7082171 100644
--- a/hw/display/g364fb.c
+++ b/hw/display/g364fb.c
@@ -493,26 +493,33 @@ static void g364fb_init(DeviceState *dev, G364State *s)
     memory_region_set_coalescing(&s->mem_vram);
 }
 
+#define TYPE_G364 "sysbus-g364"
+#define G364(obj) OBJECT_CHECK(G364SysBusState, (obj), TYPE_G364)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     G364State g364;
 } G364SysBusState;
 
-static int g364fb_sysbus_init(SysBusDevice *dev)
+static int g364fb_sysbus_init(SysBusDevice *sbd)
 {
-    G364State *s = &FROM_SYSBUS(G364SysBusState, dev)->g364;
+    DeviceState *dev = DEVICE(sbd);
+    G364SysBusState *sbs = G364(dev);
+    G364State *s = &sbs->g364;
 
-    g364fb_init(&dev->qdev, s);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_mmio(dev, &s->mem_ctrl);
-    sysbus_init_mmio(dev, &s->mem_vram);
+    g364fb_init(dev, s);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_mmio(sbd, &s->mem_ctrl);
+    sysbus_init_mmio(sbd, &s->mem_vram);
 
     return 0;
 }
 
 static void g364fb_sysbus_reset(DeviceState *d)
 {
-    G364SysBusState *s = DO_UPCAST(G364SysBusState, busdev.qdev, d);
+    G364SysBusState *s = G364(d);
+
     g364fb_reset(&s->g364);
 }
 
@@ -536,7 +543,7 @@ static void g364fb_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo g364fb_sysbus_info = {
-    .name          = "sysbus-g364",
+    .name          = TYPE_G364,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(G364SysBusState),
     .class_init    = g364fb_sysbus_class_init,
commit f27321aa3a4368c1dbdd03f7e7629572c0fe18b3
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:24:50 2013 +0200

    exynos4210_fimd: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index eb168ea..65cca1d 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -292,8 +292,13 @@ struct Exynos4210fimdWindow {
     hwaddr fb_len;       /* Framebuffer length */
 };
 
+#define TYPE_EXYNOS4210_FIMD "exynos4210.fimd"
+#define EXYNOS4210_FIMD(obj) \
+    OBJECT_CHECK(Exynos4210fimdState, (obj), TYPE_EXYNOS4210_FIMD)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QemuConsole *console;
     qemu_irq irq[3];
@@ -1108,6 +1113,7 @@ static inline int fimd_get_buffer_id(Exynos4210fimdWindow *w)
  * VIDOSDA, VIDOSDB, VIDWADDx and SHADOWCON registers */
 static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
     Exynos4210fimdWindow *w = &s->window[win];
     hwaddr fb_start_addr, fb_mapped_len;
 
@@ -1131,8 +1137,8 @@ static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
      * does not support hot-unplug.
      */
     memory_region_unref(w->mem_section.mr);
-    w->mem_section = memory_region_find(sysbus_address_space(&s->busdev),
-            fb_start_addr, w->fb_len);
+    w->mem_section = memory_region_find(sysbus_address_space(sbd),
+                                        fb_start_addr, w->fb_len);
     assert(w->mem_section.mr);
     assert(w->mem_section.offset_within_address_space == fb_start_addr);
     DPRINT_TRACE("Window %u framebuffer changed: address=0x%08x, len=0x%x\n",
@@ -1328,7 +1334,7 @@ static void exynos4210_fimd_update(void *opaque)
 
 static void exynos4210_fimd_reset(DeviceState *d)
 {
-    Exynos4210fimdState *s = DO_UPCAST(Exynos4210fimdState, busdev.qdev, d);
+    Exynos4210fimdState *s = EXYNOS4210_FIMD(d);
     unsigned w;
 
     DPRINT_TRACE("Display controller reset\n");
@@ -1900,7 +1906,7 @@ static const GraphicHwOps exynos4210_fimd_ops = {
 
 static int exynos4210_fimd_init(SysBusDevice *dev)
 {
-    Exynos4210fimdState *s = FROM_SYSBUS(Exynos4210fimdState, dev);
+    Exynos4210fimdState *s = EXYNOS4210_FIMD(dev);
 
     s->ifb = NULL;
 
@@ -1927,7 +1933,7 @@ static void exynos4210_fimd_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_fimd_info = {
-    .name = "exynos4210.fimd",
+    .name = TYPE_EXYNOS4210_FIMD,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210fimdState),
     .class_init = exynos4210_fimd_class_init,
commit af073cd9de7fa120129815cf4d2ba64156571347
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:44:48 2013 +0200

    onenand: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field and
    prepare for QOM realize.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index 2776f64..aae9ee7 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -34,8 +34,12 @@
 /* Fixed */
 #define BLOCK_SHIFT	(PAGE_SHIFT + 6)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_ONE_NAND "onenand"
+#define ONE_NAND(obj) OBJECT_CHECK(OneNANDState, (obj), TYPE_ONE_NAND)
+
+typedef struct OneNANDState {
+    SysBusDevice parent_obj;
+
     struct {
         uint16_t man;
         uint16_t dev;
@@ -226,7 +230,9 @@ static void onenand_reset(OneNANDState *s, int cold)
 
 static void onenand_system_reset(DeviceState *dev)
 {
-    onenand_reset(FROM_SYSBUS(OneNANDState, SYS_BUS_DEVICE(dev)), 1);
+    OneNANDState *s = ONE_NAND(dev);
+
+    onenand_reset(s, 1);
 }
 
 static inline int onenand_load_main(OneNANDState *s, int sec, int secn,
@@ -757,11 +763,13 @@ static const MemoryRegionOps onenand_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int onenand_initfn(SysBusDevice *dev)
+static int onenand_initfn(SysBusDevice *sbd)
 {
-    OneNANDState *s = (OneNANDState *)dev;
+    DeviceState *dev = DEVICE(sbd);
+    OneNANDState *s = ONE_NAND(dev);
     uint32_t size = 1 << (24 + ((s->id.dev >> 4) & 7));
     void *ram;
+
     s->base = (hwaddr)-1;
     s->rdy = NULL;
     s->blocks = size >> BLOCK_SHIFT;
@@ -794,9 +802,9 @@ static int onenand_initfn(SysBusDevice *dev)
     s->data[1][0] = ram + ((0x0200 + (1 << (PAGE_SHIFT - 1))) << s->shift);
     s->data[1][1] = ram + ((0x8010 + (1 << (PAGE_SHIFT - 6))) << s->shift);
     onenand_mem_setup(s);
-    sysbus_init_irq(dev, &s->intr);
-    sysbus_init_mmio(dev, &s->container);
-    vmstate_register(&dev->qdev,
+    sysbus_init_irq(sbd, &s->intr);
+    sysbus_init_mmio(sbd, &s->container);
+    vmstate_register(dev,
                      ((s->shift & 0x7f) << 24)
                      | ((s->id.man & 0xff) << 16)
                      | ((s->id.dev & 0xff) << 8)
@@ -825,7 +833,7 @@ static void onenand_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo onenand_info = {
-    .name          = "onenand",
+    .name          = TYPE_ONE_NAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OneNANDState),
     .class_init    = onenand_class_init,
@@ -838,7 +846,9 @@ static void onenand_register_types(void)
 
 void *onenand_raw_otp(DeviceState *onenand_device)
 {
-    return FROM_SYSBUS(OneNANDState, SYS_BUS_DEVICE(onenand_device))->otp;
+    OneNANDState *s = ONE_NAND(onenand_device);
+
+    return s->otp;
 }
 
 type_init(onenand_register_types)
commit b354f03c5c044beeb758935890b7e48c70e2ff9d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:19:32 2013 +0200

    pl041: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index c4d4f75..5393b52 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -70,8 +70,12 @@ typedef struct {
     uint8_t rx_sample_size;
 } pl041_channel;
 
+#define TYPE_PL041 "pl041"
+#define PL041(obj) OBJECT_CHECK(PL041State, (obj), TYPE_PL041)
+
 typedef struct PL041State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -504,7 +508,7 @@ static void pl041_write(void *opaque, hwaddr offset,
 
 static void pl041_device_reset(DeviceState *d)
 {
-    PL041State *s = DO_UPCAST(PL041State, busdev.qdev, d);
+    PL041State *s = PL041(d);
 
     pl041_reset(s);
 }
@@ -517,7 +521,7 @@ static const MemoryRegionOps pl041_ops = {
 
 static int pl041_init(SysBusDevice *dev)
 {
-    PL041State *s = FROM_SYSBUS(PL041State, dev);
+    PL041State *s = PL041(dev);
 
     DBG_L1("pl041_init 0x%08x\n", (uint32_t)s);
 
@@ -635,7 +639,7 @@ static void pl041_device_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl041_device_info = {
-    .name          = "pl041",
+    .name          = TYPE_PL041,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL041State),
     .class_init    = pl041_device_class_init,
commit baae672597b90e364131241ec3a03730fe774052
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 19:45:52 2013 +0200

    pl041: Rename pl041_state to PL041State
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Split off renaming from QOM cast changes]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index b66d6d2..c4d4f75 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -70,7 +70,7 @@ typedef struct {
     uint8_t rx_sample_size;
 } pl041_channel;
 
-typedef struct {
+typedef struct PL041State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     qemu_irq irq;
@@ -80,7 +80,7 @@ typedef struct {
     pl041_regfile regs;
     pl041_channel fifo1;
     lm4549_state codec;
-} pl041_state;
+} PL041State;
 
 
 static const unsigned char pl041_default_id[8] = {
@@ -107,7 +107,7 @@ static const char *get_reg_name(hwaddr offset)
 }
 #endif
 
-static uint8_t pl041_compute_periphid3(pl041_state *s)
+static uint8_t pl041_compute_periphid3(PL041State *s)
 {
     uint8_t id3 = 1; /* One channel */
 
@@ -142,7 +142,7 @@ static uint8_t pl041_compute_periphid3(pl041_state *s)
     return id3;
 }
 
-static void pl041_reset(pl041_state *s)
+static void pl041_reset(PL041State *s)
 {
     DBG_L1("pl041_reset\n");
 
@@ -156,7 +156,7 @@ static void pl041_reset(pl041_state *s)
 }
 
 
-static void pl041_fifo1_write(pl041_state *s, uint32_t value)
+static void pl041_fifo1_write(PL041State *s, uint32_t value)
 {
     pl041_channel *channel = &s->fifo1;
     pl041_fifo *fifo = &s->fifo1.tx_fifo;
@@ -239,7 +239,7 @@ static void pl041_fifo1_write(pl041_state *s, uint32_t value)
     DBG_L2("fifo1_push sr1 = 0x%08x\n", s->regs.sr1);
 }
 
-static void pl041_fifo1_transmit(pl041_state *s)
+static void pl041_fifo1_transmit(PL041State *s)
 {
     pl041_channel *channel = &s->fifo1;
     pl041_fifo *fifo = &s->fifo1.tx_fifo;
@@ -291,7 +291,7 @@ static void pl041_fifo1_transmit(pl041_state *s)
     }
 }
 
-static void pl041_isr1_update(pl041_state *s)
+static void pl041_isr1_update(PL041State *s)
 {
     /* Update ISR1 */
     if (s->regs.sr1 & TXUNDERRUN) {
@@ -320,7 +320,7 @@ static void pl041_isr1_update(pl041_state *s)
 
 static void pl041_request_data(void *opaque)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
 
     /* Trigger pending transfers */
     pl041_fifo1_transmit(s);
@@ -330,7 +330,7 @@ static void pl041_request_data(void *opaque)
 static uint64_t pl041_read(void *opaque, hwaddr offset,
                                 unsigned size)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
     int value;
 
     if ((offset >= PL041_periphid0) && (offset <= PL041_pcellid3)) {
@@ -364,7 +364,7 @@ static uint64_t pl041_read(void *opaque, hwaddr offset,
 static void pl041_write(void *opaque, hwaddr offset,
                              uint64_t value, unsigned size)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
     uint16_t control, data;
     uint32_t result;
 
@@ -504,7 +504,7 @@ static void pl041_write(void *opaque, hwaddr offset,
 
 static void pl041_device_reset(DeviceState *d)
 {
-    pl041_state *s = DO_UPCAST(pl041_state, busdev.qdev, d);
+    PL041State *s = DO_UPCAST(PL041State, busdev.qdev, d);
 
     pl041_reset(s);
 }
@@ -517,7 +517,7 @@ static const MemoryRegionOps pl041_ops = {
 
 static int pl041_init(SysBusDevice *dev)
 {
-    pl041_state *s = FROM_SYSBUS(pl041_state, dev);
+    PL041State *s = FROM_SYSBUS(PL041State, dev);
 
     DBG_L1("pl041_init 0x%08x\n", (uint32_t)s);
 
@@ -603,12 +603,12 @@ static const VMStateDescription vmstate_pl041 = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(fifo_depth, pl041_state),
-        VMSTATE_STRUCT(regs, pl041_state, 0,
+        VMSTATE_UINT32(fifo_depth, PL041State),
+        VMSTATE_STRUCT(regs, PL041State, 0,
                        vmstate_pl041_regfile, pl041_regfile),
-        VMSTATE_STRUCT(fifo1, pl041_state, 0,
+        VMSTATE_STRUCT(fifo1, PL041State, 0,
                        vmstate_pl041_channel, pl041_channel),
-        VMSTATE_STRUCT(codec, pl041_state, 0,
+        VMSTATE_STRUCT(codec, PL041State, 0,
                        vmstate_lm4549_state, lm4549_state),
         VMSTATE_END_OF_LIST()
     }
@@ -616,7 +616,8 @@ static const VMStateDescription vmstate_pl041 = {
 
 static Property pl041_device_properties[] = {
     /* Non-compact FIFO depth property */
-    DEFINE_PROP_UINT32("nc_fifo_depth", pl041_state, fifo_depth, DEFAULT_FIFO_DEPTH),
+    DEFINE_PROP_UINT32("nc_fifo_depth", PL041State, fifo_depth,
+                       DEFAULT_FIFO_DEPTH),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -636,7 +637,7 @@ static void pl041_device_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl041_device_info = {
     .name          = "pl041",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl041_state),
+    .instance_size = sizeof(PL041State),
     .class_init    = pl041_device_class_init,
 };
 
commit 922cc6010e09ed5b976b2e60228b3d6fb09aa3a5
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:15:29 2013 +0200

    milkymist-ac97: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/milkymist-ac97.c b/hw/audio/milkymist-ac97.c
index 133de4e..9c0f7a0 100644
--- a/hw/audio/milkymist-ac97.c
+++ b/hw/audio/milkymist-ac97.c
@@ -51,8 +51,13 @@ enum {
     CTRL_EN = (1<<0),
 };
 
+#define TYPE_MILKYMIST_AC97 "milkymist-ac97"
+#define MILKYMIST_AC97(obj) \
+    OBJECT_CHECK(MilkymistAC97State, (obj), TYPE_MILKYMIST_AC97)
+
 struct MilkymistAC97State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     QEMUSoundCard card;
@@ -258,7 +263,7 @@ static void ac97_out_cb(void *opaque, int free_b)
 
 static void milkymist_ac97_reset(DeviceState *d)
 {
-    MilkymistAC97State *s = container_of(d, MilkymistAC97State, busdev.qdev);
+    MilkymistAC97State *s = MILKYMIST_AC97(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -280,7 +285,7 @@ static int ac97_post_load(void *opaque, int version_id)
 
 static int milkymist_ac97_init(SysBusDevice *dev)
 {
-    MilkymistAC97State *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistAC97State *s = MILKYMIST_AC97(dev);
 
     struct audsettings as;
     sysbus_init_irq(dev, &s->crrequest_irq);
@@ -330,7 +335,7 @@ static void milkymist_ac97_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_ac97_info = {
-    .name          = "milkymist-ac97",
+    .name          = TYPE_MILKYMIST_AC97,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistAC97State),
     .class_init    = milkymist_ac97_class_init,
commit 9e3f8599fc9b3a408fdaaa5a38d6bc328c08c4bb
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:10:44 2013 +0200

    audio/marvell_88w8618: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index b40ea43..97194ce 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -36,8 +36,13 @@
 #define MP_AUDIO_CLOCK_24MHZ    (1 << 9)
 #define MP_AUDIO_MONO           (1 << 14)
 
+#define TYPE_MV88W8618_AUDIO "mv88w8618_audio"
+#define MV88W8618_AUDIO(obj) \
+    OBJECT_CHECK(mv88w8618_audio_state, (obj), TYPE_MV88W8618_AUDIO)
+
 typedef struct mv88w8618_audio_state {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t playback_mode;
@@ -219,8 +224,7 @@ static void mv88w8618_audio_write(void *opaque, hwaddr offset,
 
 static void mv88w8618_audio_reset(DeviceState *d)
 {
-    mv88w8618_audio_state *s = FROM_SYSBUS(mv88w8618_audio_state,
-                                           SYS_BUS_DEVICE(d));
+    mv88w8618_audio_state *s = MV88W8618_AUDIO(d);
 
     s->playback_mode = 0;
     s->status = 0;
@@ -238,7 +242,7 @@ static const MemoryRegionOps mv88w8618_audio_ops = {
 
 static int mv88w8618_audio_init(SysBusDevice *dev)
 {
-    mv88w8618_audio_state *s = FROM_SYSBUS(mv88w8618_audio_state, dev);
+    mv88w8618_audio_state *s = MV88W8618_AUDIO(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -287,7 +291,7 @@ static void mv88w8618_audio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_audio_info = {
-    .name          = "mv88w8618_audio",
+    .name          = TYPE_MV88W8618_AUDIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_audio_state),
     .class_init    = mv88w8618_audio_class_init,
commit f9e741903982e55c0dc138ab2e61059a4f3c9a76
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:04:31 2013 +0200

    cs4231: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/cs4231.c b/hw/audio/cs4231.c
index fabe9e6..d19195a 100644
--- a/hw/audio/cs4231.c
+++ b/hw/audio/cs4231.c
@@ -33,8 +33,13 @@
 #define CS_DREGS 32
 #define CS_MAXDREG (CS_DREGS - 1)
 
+#define TYPE_CS4231 "SUNW,CS4231"
+#define CS4231(obj) \
+    OBJECT_CHECK(CSState, (obj), TYPE_CS4231)
+
 typedef struct CSState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t regs[CS_REGS];
@@ -47,7 +52,7 @@ typedef struct CSState {
 
 static void cs_reset(DeviceState *d)
 {
-    CSState *s = container_of(d, CSState, busdev.qdev);
+    CSState *s = CS4231(d);
 
     memset(s->regs, 0, CS_REGS * 4);
     memset(s->dregs, 0, CS_DREGS);
@@ -111,7 +116,7 @@ static void cs_mem_write(void *opaque, hwaddr addr,
         break;
     case 4:
         if (val & 1) {
-            cs_reset(&s->busdev.qdev);
+            cs_reset(DEVICE(s));
         }
         val &= 0x7f;
         s->regs[saddr] = val;
@@ -142,7 +147,7 @@ static const VMStateDescription vmstate_cs4231 = {
 
 static int cs4231_init1(SysBusDevice *dev)
 {
-    CSState *s = FROM_SYSBUS(CSState, dev);
+    CSState *s = CS4231(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &cs_mem_ops, s, "cs4321",
                           CS_SIZE);
@@ -168,7 +173,7 @@ static void cs4231_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo cs4231_info = {
-    .name          = "SUNW,CS4231",
+    .name          = TYPE_CS4231,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(CSState),
     .class_init    = cs4231_class_init,
commit 24bf6c1f2a0ab42e4f183a10b9e9cfe468a840b3
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:37:28 2013 +0200

    xilinx_uartlite: QOM cast cleanups
    
    Introduce type constant and use QOM casts.
    
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 929743c..b0d1d04 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -46,8 +46,13 @@
 #define CONTROL_RST_RX    0x02
 #define CONTROL_IE        0x10
 
+#define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
+#define XILINX_UARTLITE(obj) \
+    OBJECT_CHECK(XilinxUARTLite, (obj), TYPE_XILINX_UARTLITE)
+
 typedef struct XilinxUARTLite {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     CharDriverState *chr;
     qemu_irq irq;
@@ -193,7 +198,7 @@ static void uart_event(void *opaque, int event)
 
 static int xilinx_uartlite_init(SysBusDevice *dev)
 {
-    XilinxUARTLite *s = FROM_SYSBUS(typeof (*s), dev);
+    XilinxUARTLite *s = XILINX_UARTLITE(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -216,7 +221,7 @@ static void xilinx_uartlite_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_uartlite_info = {
-    .name          = "xlnx.xps-uartlite",
+    .name          = TYPE_XILINX_UARTLITE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(XilinxUARTLite),
     .class_init    = xilinx_uartlite_class_init,
commit 144712ca149f49b24e27b537d05943ee8ac9e22b
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:34:25 2013 +0200

    xilinx_uartlite: Rename xlx_uartlite to XilinxUARTLite
    
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index feca497..929743c 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -46,8 +46,7 @@
 #define CONTROL_RST_RX    0x02
 #define CONTROL_IE        0x10
 
-struct xlx_uartlite
-{
+typedef struct XilinxUARTLite {
     SysBusDevice busdev;
     MemoryRegion mmio;
     CharDriverState *chr;
@@ -58,9 +57,9 @@ struct xlx_uartlite
     unsigned int rx_fifo_len;
 
     uint32_t regs[R_MAX];
-};
+} XilinxUARTLite;
 
-static void uart_update_irq(struct xlx_uartlite *s)
+static void uart_update_irq(XilinxUARTLite *s)
 {
     unsigned int irq;
 
@@ -71,7 +70,7 @@ static void uart_update_irq(struct xlx_uartlite *s)
     qemu_set_irq(s->irq, irq);
 }
 
-static void uart_update_status(struct xlx_uartlite *s)
+static void uart_update_status(XilinxUARTLite *s)
 {
     uint32_t r;
 
@@ -86,7 +85,7 @@ static void uart_update_status(struct xlx_uartlite *s)
 static uint64_t
 uart_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
     uint32_t r = 0;
     addr >>= 2;
     switch (addr)
@@ -113,7 +112,7 @@ static void
 uart_write(void *opaque, hwaddr addr,
            uint64_t val64, unsigned int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
     uint32_t value = val64;
     unsigned char ch = value;
 
@@ -164,7 +163,7 @@ static const MemoryRegionOps uart_ops = {
 
 static void uart_rx(void *opaque, const uint8_t *buf, int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
 
     /* Got a byte.  */
     if (s->rx_fifo_len >= 8) {
@@ -182,7 +181,7 @@ static void uart_rx(void *opaque, const uint8_t *buf, int size)
 
 static int uart_can_rx(void *opaque)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
 
     return s->rx_fifo_len < sizeof(s->rx_fifo);
 }
@@ -194,7 +193,7 @@ static void uart_event(void *opaque, int event)
 
 static int xilinx_uartlite_init(SysBusDevice *dev)
 {
-    struct xlx_uartlite *s = FROM_SYSBUS(typeof (*s), dev);
+    XilinxUARTLite *s = FROM_SYSBUS(typeof (*s), dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -219,7 +218,7 @@ static void xilinx_uartlite_class_init(ObjectClass *klass, void *data)
 static const TypeInfo xilinx_uartlite_info = {
     .name          = "xlnx.xps-uartlite",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof (struct xlx_uartlite),
+    .instance_size = sizeof(XilinxUARTLite),
     .class_init    = xilinx_uartlite_class_init,
 };
 
commit b85423fe756e52b373c58c328bb59790ca081ec8
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 21:52:26 2013 +0200

    etraxfs_ser: QOM cast cleanups
    
    Rename etrax_serial to ETRAXSerial, introduce type constant and use QOM
    casts.
    
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/etraxfs_ser.c b/hw/char/etraxfs_ser.c
index d19af00..460094e 100644
--- a/hw/char/etraxfs_ser.c
+++ b/hw/char/etraxfs_ser.c
@@ -44,9 +44,13 @@
 #define STAT_TR_IDLE 22
 #define STAT_TR_RDY  24
 
-struct etrax_serial
-{
-    SysBusDevice busdev;
+#define TYPE_ETRAX_FS_SERIAL "etraxfs,serial"
+#define ETRAX_SERIAL(obj) \
+    OBJECT_CHECK(ETRAXSerial, (obj), TYPE_ETRAX_FS_SERIAL)
+
+typedef struct ETRAXSerial {
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     CharDriverState *chr;
     qemu_irq irq;
@@ -59,9 +63,9 @@ struct etrax_serial
 
     /* Control registers.  */
     uint32_t regs[R_MAX];
-};
+} ETRAXSerial;
 
-static void ser_update_irq(struct etrax_serial *s)
+static void ser_update_irq(ETRAXSerial *s)
 {
 
     if (s->rx_fifo_len) {
@@ -77,7 +81,7 @@ static void ser_update_irq(struct etrax_serial *s)
 static uint64_t
 ser_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     uint32_t r = 0;
 
     addr >>= 2;
@@ -112,7 +116,7 @@ static void
 ser_write(void *opaque, hwaddr addr,
           uint64_t val64, unsigned int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     uint32_t value = val64;
     unsigned char ch = val64;
 
@@ -156,7 +160,7 @@ static const MemoryRegionOps ser_ops = {
 
 static void serial_receive(void *opaque, const uint8_t *buf, int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     int i;
 
     /* Got a byte.  */
@@ -177,7 +181,7 @@ static void serial_receive(void *opaque, const uint8_t *buf, int size)
 
 static int serial_can_receive(void *opaque)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     int r;
 
     /* Is the receiver enabled?  */
@@ -196,7 +200,7 @@ static void serial_event(void *opaque, int event)
 
 static void etraxfs_ser_reset(DeviceState *d)
 {
-    struct etrax_serial *s = container_of(d, typeof(*s), busdev.qdev);
+    ETRAXSerial *s = ETRAX_SERIAL(d);
 
     /* transmitter begins ready and idle.  */
     s->regs[RS_STAT_DIN] |= (1 << STAT_TR_RDY);
@@ -208,7 +212,7 @@ static void etraxfs_ser_reset(DeviceState *d)
 
 static int etraxfs_ser_init(SysBusDevice *dev)
 {
-    struct etrax_serial *s = FROM_SYSBUS(typeof (*s), dev);
+    ETRAXSerial *s = ETRAX_SERIAL(dev);
 
     sysbus_init_irq(dev, &s->irq);
     memory_region_init_io(&s->mmio, OBJECT(s), &ser_ops, s,
@@ -216,10 +220,11 @@ static int etraxfs_ser_init(SysBusDevice *dev)
     sysbus_init_mmio(dev, &s->mmio);
 
     s->chr = qemu_char_get_next_serial();
-    if (s->chr)
+    if (s->chr) {
         qemu_chr_add_handlers(s->chr,
-                      serial_can_receive, serial_receive,
-                      serial_event, s);
+                              serial_can_receive, serial_receive,
+                              serial_event, s);
+    }
     return 0;
 }
 
@@ -233,9 +238,9 @@ static void etraxfs_ser_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_ser_info = {
-    .name          = "etraxfs,serial",
+    .name          = TYPE_ETRAX_FS_SERIAL,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct etrax_serial),
+    .instance_size = sizeof(ETRAXSerial),
     .class_init    = etraxfs_ser_class_init,
 };
 
commit bcb7575068581a7589234bdd55e8d9a9351611d9
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 12 19:56:00 2013 +0200

    pcie_port: Turn PCIEPort and PCIESlot into abstract QOM types
    
    Move PCIEPort's "port" property to the new type, same for "aer_log_max".
    Move PCIESlot's "chassis" and "slot" properties to the new type.
    
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index 815bed4..0f7f209 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -92,9 +92,8 @@ static void ioh3420_reset(DeviceState *qdev)
 
 static int ioh3420_initfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIEPort *p = PCIE_PORT(d);
+    PCIESlot *s = PCIE_SLOT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -148,9 +147,7 @@ err_bridge:
 
 static void ioh3420_exitfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIESlot *s = PCIE_SLOT(d);
 
     pcie_aer_exit(d);
     pcie_chassis_del_slot(s);
@@ -180,7 +177,7 @@ PCIESlot *ioh3420_init(PCIBus *bus, int devfn, bool multifunction,
     qdev_prop_set_uint16(qdev, "slot", slot);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIESlot, port, DO_UPCAST(PCIEPort, br, br));
+    return PCIE_SLOT(d);
 }
 
 static const VMStateDescription vmstate_ioh3420 = {
@@ -190,23 +187,13 @@ static const VMStateDescription vmstate_ioh3420 = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
-        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
-                       vmstate_pcie_aer_log, PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(parent_obj.parent_obj.parent_obj.exp.aer_log,
+                       PCIESlot, 0, vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property ioh3420_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIESlot, port.port, 0),
-    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
-    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-                       port.br.parent_obj.exp.aer_log.log_max,
-                       PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void ioh3420_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -224,13 +211,11 @@ static void ioh3420_class_init(ObjectClass *klass, void *data)
     dc->desc = "Intel IOH device id 3420 PCIE Root Port";
     dc->reset = ioh3420_reset;
     dc->vmsd = &vmstate_ioh3420;
-    dc->props = ioh3420_properties;
 }
 
 static const TypeInfo ioh3420_info = {
     .name          = "ioh3420",
-    .parent        = TYPE_PCI_BRIDGE,
-    .instance_size = sizeof(PCIESlot),
+    .parent        = TYPE_PCIE_SLOT,
     .class_init    = ioh3420_class_init,
 };
 
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 227a335..94f9781 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -56,9 +56,8 @@ static void xio3130_downstream_reset(DeviceState *qdev)
 
 static int xio3130_downstream_initfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIEPort *p = PCIE_PORT(d);
+    PCIESlot *s = PCIE_SLOT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -113,9 +112,7 @@ err_bridge:
 
 static void xio3130_downstream_exitfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIESlot *s = PCIE_SLOT(d);
 
     pcie_aer_exit(d);
     pcie_chassis_del_slot(s);
@@ -147,7 +144,7 @@ PCIESlot *xio3130_downstream_init(PCIBus *bus, int devfn, bool multifunction,
     qdev_prop_set_uint16(qdev, "slot", slot);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIESlot, port, DO_UPCAST(PCIEPort, br, br));
+    return PCIE_SLOT(d);
 }
 
 static const VMStateDescription vmstate_xio3130_downstream = {
@@ -157,23 +154,13 @@ static const VMStateDescription vmstate_xio3130_downstream = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
-        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
-                       vmstate_pcie_aer_log, PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(parent_obj.parent_obj.parent_obj.exp.aer_log,
+                       PCIESlot, 0, vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property xio3130_downstream_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIESlot, port.port, 0),
-    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
-    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-                       port.br.parent_obj.exp.aer_log.log_max,
-                       PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -191,13 +178,11 @@ static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
     dc->desc = "TI X3130 Downstream Port of PCI Express Switch";
     dc->reset = xio3130_downstream_reset;
     dc->vmsd = &vmstate_xio3130_downstream;
-    dc->props = xio3130_downstream_properties;
 }
 
 static const TypeInfo xio3130_downstream_info = {
     .name          = "xio3130-downstream",
-    .parent        = TYPE_PCI_BRIDGE,
-    .instance_size = sizeof(PCIESlot),
+    .parent        = TYPE_PCIE_SLOT,
     .class_init    = xio3130_downstream_class_init,
 };
 
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index b146253..59f97f6 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -53,8 +53,7 @@ static void xio3130_upstream_reset(DeviceState *qdev)
 
 static int xio3130_upstream_initfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
+    PCIEPort *p = PCIE_PORT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -125,7 +124,7 @@ PCIEPort *xio3130_upstream_init(PCIBus *bus, int devfn, bool multifunction,
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIEPort, br, br);
+    return PCIE_PORT(d);
 }
 
 static const VMStateDescription vmstate_xio3130_upstream = {
@@ -134,21 +133,13 @@ static const VMStateDescription vmstate_xio3130_upstream = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(br.parent_obj, PCIEPort),
-        VMSTATE_STRUCT(br.parent_obj.exp.aer_log, PCIEPort, 0,
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj, PCIEPort),
+        VMSTATE_STRUCT(parent_obj.parent_obj.exp.aer_log, PCIEPort, 0,
                        vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property xio3130_upstream_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIEPort,
-                       br.parent_obj.exp.aer_log.log_max,
-                       PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -166,13 +157,11 @@ static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
     dc->desc = "TI X3130 Upstream Port of PCI Express Switch";
     dc->reset = xio3130_upstream_reset;
     dc->vmsd = &vmstate_xio3130_upstream;
-    dc->props = xio3130_upstream_properties;
 }
 
 static const TypeInfo xio3130_upstream_info = {
     .name          = "x3130-upstream",
-    .parent        = TYPE_PCI_BRIDGE,
-    .instance_size = sizeof(PCIEPort),
+    .parent        = TYPE_PCIE_PORT,
     .class_init    = xio3130_upstream_class_init,
 };
 
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index 91b53a0..2adb030 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -116,3 +116,55 @@ void pcie_chassis_del_slot(PCIESlot *s)
 {
     QLIST_REMOVE(s, next);
 }
+
+static Property pcie_port_props[] = {
+    DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
+    DEFINE_PROP_UINT16("aer_log_max", PCIEPort,
+                       parent_obj.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void pcie_port_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->props = pcie_port_props;
+}
+
+static const TypeInfo pcie_port_type_info = {
+    .name = TYPE_PCIE_PORT,
+    .parent = TYPE_PCI_BRIDGE,
+    .instance_size = sizeof(PCIEPort),
+    .abstract = true,
+    .class_init = pcie_port_class_init,
+};
+
+static Property pcie_slot_props[] = {
+    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
+    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void pcie_slot_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->props = pcie_slot_props;
+}
+
+static const TypeInfo pcie_slot_type_info = {
+    .name = TYPE_PCIE_SLOT,
+    .parent = TYPE_PCIE_PORT,
+    .instance_size = sizeof(PCIESlot),
+    .abstract = true,
+    .class_init = pcie_slot_class_init,
+};
+
+static void pcie_port_register_types(void)
+{
+    type_register_static(&pcie_port_type_info);
+    type_register_static(&pcie_slot_type_info);
+}
+
+type_init(pcie_port_register_types)
diff --git a/include/hw/pci/pcie_port.h b/include/hw/pci/pcie_port.h
index d89aa61..e167bf7 100644
--- a/include/hw/pci/pcie_port.h
+++ b/include/hw/pci/pcie_port.h
@@ -24,8 +24,13 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_bus.h"
 
+#define TYPE_PCIE_PORT "pcie-port"
+#define PCIE_PORT(obj) OBJECT_CHECK(PCIEPort, (obj), TYPE_PCIE_PORT)
+
 struct PCIEPort {
-    PCIBridge   br;
+    /*< private >*/
+    PCIBridge   parent_obj;
+    /*< public >*/
 
     /* pci express switch port */
     uint8_t     port;
@@ -33,8 +38,13 @@ struct PCIEPort {
 
 void pcie_port_init_reg(PCIDevice *d);
 
+#define TYPE_PCIE_SLOT "pcie-slot"
+#define PCIE_SLOT(obj) OBJECT_CHECK(PCIESlot, (obj), TYPE_PCIE_SLOT)
+
 struct PCIESlot {
-    PCIEPort    port;
+    /*< private >*/
+    PCIEPort    parent_obj;
+    /*< public >*/
 
     /* pci express switch port with slot */
     uint8_t     chassis;
commit 5315dc78d089191e6a34a9f9f8913b7f365d504a
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 12 19:21:22 2013 +0200

    pci-bridge/i82801b11: Rename parent field
    
    Rename it to avoid accidental use.
    
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 82e92d8..8a5e426 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -52,7 +52,9 @@
 #define I82801ba_SSVID_SSID     0
 
 typedef struct I82801b11Bridge {
-    PCIBridge br;
+    /*< private >*/
+    PCIBridge parent_obj;
+    /*< public >*/
 } I82801b11Bridge;
 
 static int i82801b11_bridge_initfn(PCIDevice *d)
commit 57524e14cf12cbc148b0a268d93b3e8457a010a3
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 12 19:16:46 2013 +0200

    pci-bridge-dev: QOM parent field cleanup
    
    Rename it to avoid accidental use.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index af750c2..a9392c7 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -27,8 +27,15 @@
 #include "exec/memory.h"
 #include "hw/pci/pci_bus.h"
 
+#define TYPE_PCI_BRIDGE_DEV "pci-bridge"
+#define PCI_BRIDGE_DEV(obj) \
+    OBJECT_CHECK(PCIBridgeDev, (obj), TYPE_PCI_BRIDGE_DEV)
+
 struct PCIBridgeDev {
-    PCIBridge bridge;
+    /*< private >*/
+    PCIBridge parent_obj;
+    /*< public >*/
+
     MemoryRegion bar;
     uint8_t chassis_nr;
 #define PCI_BRIDGE_DEV_F_MSI_REQ 0
@@ -39,7 +46,7 @@ typedef struct PCIBridgeDev PCIBridgeDev;
 static int pci_bridge_dev_initfn(PCIDevice *dev)
 {
     PCIBridge *br = PCI_BRIDGE(dev);
-    PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
+    PCIBridgeDev *bridge_dev = PCI_BRIDGE_DEV(dev);
     int err;
 
     err = pci_bridge_initfn(dev, TYPE_PCI_BUS);
@@ -81,8 +88,7 @@ bridge_error:
 
 static void pci_bridge_dev_exitfn(PCIDevice *dev)
 {
-    PCIBridge *br = PCI_BRIDGE(dev);
-    PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
+    PCIBridgeDev *bridge_dev = PCI_BRIDGE_DEV(dev);
     if (msi_present(dev)) {
         msi_uninit(dev);
     }
@@ -104,7 +110,7 @@ static void pci_bridge_dev_write_config(PCIDevice *d,
 
 static void qdev_pci_bridge_dev_reset(DeviceState *qdev)
 {
-    PCIDevice *dev = DO_UPCAST(PCIDevice, qdev, qdev);
+    PCIDevice *dev = PCI_DEVICE(qdev);
 
     pci_bridge_reset(qdev);
     shpc_reset(dev);
@@ -120,8 +126,8 @@ static Property pci_bridge_dev_properties[] = {
 static const VMStateDescription pci_bridge_dev_vmstate = {
     .name = "pci_bridge",
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(bridge.parent_obj, PCIBridgeDev),
-        SHPC_VMSTATE(bridge.parent_obj.shpc, PCIBridgeDev),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIBridge),
+        SHPC_VMSTATE(shpc, PCIDevice),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -145,7 +151,7 @@ static void pci_bridge_dev_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pci_bridge_dev_info = {
-    .name = "pci-bridge",
+    .name          = TYPE_PCI_BRIDGE_DEV,
     .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridgeDev),
     .class_init = pci_bridge_dev_class_init,
commit f055e96bd4311d287c0e03faec02a1bdbc351925
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 11 17:13:43 2013 +0200

    pci-bridge: Turn PCIBridge into abstract QOM type
    
    Introduce TYPE_PCI_BRIDGE as base type and use PCI_BRIDGE() casts.
    
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    [AF: Updated pbm-bridge parent to TYPE_PCI_BRIDGE]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/dec.c b/hw/pci-bridge/dec.c
index efc07c4..e5e3be8 100644
--- a/hw/pci-bridge/dec.c
+++ b/hw/pci-bridge/dec.c
@@ -74,7 +74,7 @@ static void dec_21154_pci_bridge_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo dec_21154_pci_bridge_info = {
     .name          = "dec-21154-p2p-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridge),
     .class_init    = dec_21154_pci_bridge_class_init,
 };
@@ -86,7 +86,7 @@ PCIBus *pci_dec_21154_init(PCIBus *parent_bus, int devfn)
 
     dev = pci_create_multifunction(parent_bus, devfn, false,
                                    "dec-21154-p2p-bridge");
-    br = DO_UPCAST(PCIBridge, dev, dev);
+    br = PCI_BRIDGE(dev);
     pci_bridge_map_irq(br, "DEC 21154 PCI-PCI bridge", dec_map_irq);
     qdev_init_nofail(&dev->qdev);
     return pci_bridge_get_sec_bus(br);
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 0e521a8..82e92d8 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -93,7 +93,7 @@ static void i82801b11_bridge_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo i82801b11_bridge_info = {
     .name          = "i82801b11-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(I82801b11Bridge),
     .class_init    = i82801b11_bridge_class_init,
 };
@@ -109,8 +109,8 @@ PCIBus *ich9_d2pbr_init(PCIBus *bus, int devfn, int sec_bus)
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
-    qdev = &br->dev.qdev;
+    br = PCI_BRIDGE(d);
+    qdev = DEVICE(d);
 
     snprintf(buf, sizeof(buf), "pci.%d", sec_bus);
     pci_bridge_map_irq(br, buf, pci_swizzle_map_irq_fn);
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index 47122c5..815bed4 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -92,7 +92,7 @@ static void ioh3420_reset(DeviceState *qdev)
 
 static int ioh3420_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
     int rc;
@@ -148,7 +148,7 @@ err_bridge:
 
 static void ioh3420_exitfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
 
@@ -171,9 +171,9 @@ PCIESlot *ioh3420_init(PCIBus *bus, int devfn, bool multifunction,
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_prop_set_uint8(qdev, "chassis", chassis);
@@ -190,8 +190,8 @@ static const VMStateDescription vmstate_ioh3420 = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.dev, PCIESlot),
-        VMSTATE_STRUCT(port.br.dev.exp.aer_log, PCIESlot, 0,
+        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
                        vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
@@ -202,8 +202,8 @@ static Property ioh3420_properties[] = {
     DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
     DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
     DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-    port.br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
+                       port.br.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -229,7 +229,7 @@ static void ioh3420_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo ioh3420_info = {
     .name          = "ioh3420",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIESlot),
     .class_init    = ioh3420_class_init,
 };
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index a00642c..af750c2 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -38,7 +38,7 @@ typedef struct PCIBridgeDev PCIBridgeDev;
 
 static int pci_bridge_dev_initfn(PCIDevice *dev)
 {
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
+    PCIBridge *br = PCI_BRIDGE(dev);
     PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
     int err;
 
@@ -81,7 +81,7 @@ bridge_error:
 
 static void pci_bridge_dev_exitfn(PCIDevice *dev)
 {
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
+    PCIBridge *br = PCI_BRIDGE(dev);
     PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
     if (msi_present(dev)) {
         msi_uninit(dev);
@@ -120,8 +120,8 @@ static Property pci_bridge_dev_properties[] = {
 static const VMStateDescription pci_bridge_dev_vmstate = {
     .name = "pci_bridge",
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(bridge.dev, PCIBridgeDev),
-        SHPC_VMSTATE(bridge.dev.shpc, PCIBridgeDev),
+        VMSTATE_PCI_DEVICE(bridge.parent_obj, PCIBridgeDev),
+        SHPC_VMSTATE(bridge.parent_obj.shpc, PCIBridgeDev),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -146,7 +146,7 @@ static void pci_bridge_dev_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo pci_bridge_dev_info = {
     .name = "pci-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridgeDev),
     .class_init = pci_bridge_dev_class_init,
 };
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 33eff37..227a335 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -56,7 +56,7 @@ static void xio3130_downstream_reset(DeviceState *qdev)
 
 static int xio3130_downstream_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
     int rc;
@@ -113,7 +113,7 @@ err_bridge:
 
 static void xio3130_downstream_exitfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
 
@@ -138,9 +138,9 @@ PCIESlot *xio3130_downstream_init(PCIBus *bus, int devfn, bool multifunction,
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_prop_set_uint8(qdev, "chassis", chassis);
@@ -157,8 +157,8 @@ static const VMStateDescription vmstate_xio3130_downstream = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.dev, PCIESlot),
-        VMSTATE_STRUCT(port.br.dev.exp.aer_log, PCIESlot, 0,
+        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
                        vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
@@ -169,8 +169,8 @@ static Property xio3130_downstream_properties[] = {
     DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
     DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
     DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-    port.br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
+                       port.br.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -196,7 +196,7 @@ static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo xio3130_downstream_info = {
     .name          = "xio3130-downstream",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIESlot),
     .class_init    = xio3130_downstream_class_init,
 };
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index e9969a9..b146253 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -53,7 +53,7 @@ static void xio3130_upstream_reset(DeviceState *qdev)
 
 static int xio3130_upstream_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     int rc;
 
@@ -118,9 +118,9 @@ PCIEPort *xio3130_upstream_init(PCIBus *bus, int devfn, bool multifunction,
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_init_nofail(qdev);
@@ -134,17 +134,18 @@ static const VMStateDescription vmstate_xio3130_upstream = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(br.dev, PCIEPort),
-        VMSTATE_STRUCT(br.dev.exp.aer_log, PCIEPort, 0, vmstate_pcie_aer_log,
-                       PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(br.parent_obj, PCIEPort),
+        VMSTATE_STRUCT(br.parent_obj.exp.aer_log, PCIEPort, 0,
+                       vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static Property xio3130_upstream_properties[] = {
     DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIEPort, br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
+    DEFINE_PROP_UINT16("aer_log_max", PCIEPort,
+                       br.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -170,7 +171,7 @@ static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo xio3130_upstream_info = {
     .name          = "x3130-upstream",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIEPort),
     .class_init    = xio3130_upstream_class_init,
 };
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index bef7be1..92f289f 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -423,7 +423,7 @@ PCIBus *pci_apb_init(hwaddr special_base,
     /* APB secondary busses */
     pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 0), true,
                                    "pbm-bridge");
-    br = DO_UPCAST(PCIBridge, dev, pci_dev);
+    br = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 1",
                        pci_apb_map_irq);
     qdev_init_nofail(&pci_dev->qdev);
@@ -431,7 +431,7 @@ PCIBus *pci_apb_init(hwaddr special_base,
 
     pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 1), true,
                                    "pbm-bridge");
-    br = DO_UPCAST(PCIBridge, dev, pci_dev);
+    br = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 2",
                        pci_apb_map_irq);
     qdev_init_nofail(&pci_dev->qdev);
@@ -566,8 +566,7 @@ static void pbm_pci_bridge_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo pbm_pci_bridge_info = {
     .name          = "pbm-bridge",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIBridge),
+    .parent        = TYPE_PCI_BRIDGE,
     .class_init    = pbm_pci_bridge_class_init,
 };
 
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 81cf5a9..4c004f5 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -397,7 +397,7 @@ static int get_pci_config_device(QEMUFile *f, void *pv, size_t size)
 
     pci_update_mappings(s);
     if (pc->is_bridge) {
-        PCIBridge *b = container_of(s, PCIBridge, dev);
+        PCIBridge *b = PCI_BRIDGE(s);
         pci_bridge_update_mappings(b);
     }
 
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 02a396b..a90671d 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -141,8 +141,9 @@ static void pci_bridge_init_alias(PCIBridge *bridge, MemoryRegion *alias,
                                   MemoryRegion *parent_space,
                                   bool enabled)
 {
-    pcibus_t base = pci_bridge_get_base(&bridge->dev, type);
-    pcibus_t limit = pci_bridge_get_limit(&bridge->dev, type);
+    PCIDevice *bridge_dev = PCI_DEVICE(bridge);
+    pcibus_t base = pci_bridge_get_base(bridge_dev, type);
+    pcibus_t limit = pci_bridge_get_limit(bridge_dev, type);
     /* TODO: this doesn't handle base = 0 limit = 2^64 - 1 correctly.
      * Apparently no way to do this with existing memory APIs. */
     pcibus_t size = enabled && limit >= base ? limit + 1 - base : 0;
@@ -154,7 +155,8 @@ static void pci_bridge_init_alias(PCIBridge *bridge, MemoryRegion *alias,
 static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
                                         MemoryRegion *alias_vga)
 {
-    uint16_t brctl = pci_get_word(br->dev.config + PCI_BRIDGE_CONTROL);
+    PCIDevice *pd = PCI_DEVICE(br);
+    uint16_t brctl = pci_get_word(pd->config + PCI_BRIDGE_CONTROL);
 
     memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_LO], OBJECT(br),
                              "pci_bridge_vga_io_lo", &br->address_space_io,
@@ -167,7 +169,7 @@ static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
                              QEMU_PCI_VGA_MEM_BASE, QEMU_PCI_VGA_MEM_SIZE);
 
     if (brctl & PCI_BRIDGE_CTL_VGA) {
-        pci_register_vga(&br->dev, &alias_vga[QEMU_PCI_VGA_MEM],
+        pci_register_vga(pd, &alias_vga[QEMU_PCI_VGA_MEM],
                          &alias_vga[QEMU_PCI_VGA_IO_LO],
                          &alias_vga[QEMU_PCI_VGA_IO_HI]);
     }
@@ -175,9 +177,10 @@ static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
 
 static PCIBridgeWindows *pci_bridge_region_init(PCIBridge *br)
 {
-    PCIBus *parent = br->dev.bus;
+    PCIDevice *pd = PCI_DEVICE(br);
+    PCIBus *parent = pd->bus;
     PCIBridgeWindows *w = g_new(PCIBridgeWindows, 1);
-    uint16_t cmd = pci_get_word(br->dev.config + PCI_COMMAND);
+    uint16_t cmd = pci_get_word(pd->config + PCI_COMMAND);
 
     pci_bridge_init_alias(br, &w->alias_pref_mem,
                           PCI_BASE_ADDRESS_MEM_PREFETCH,
@@ -205,12 +208,13 @@ static PCIBridgeWindows *pci_bridge_region_init(PCIBridge *br)
 
 static void pci_bridge_region_del(PCIBridge *br, PCIBridgeWindows *w)
 {
-    PCIBus *parent = br->dev.bus;
+    PCIDevice *pd = PCI_DEVICE(br);
+    PCIBus *parent = pd->bus;
 
     memory_region_del_subregion(parent->address_space_io, &w->alias_io);
     memory_region_del_subregion(parent->address_space_mem, &w->alias_mem);
     memory_region_del_subregion(parent->address_space_mem, &w->alias_pref_mem);
-    pci_unregister_vga(&br->dev);
+    pci_unregister_vga(pd);
 }
 
 static void pci_bridge_region_cleanup(PCIBridge *br, PCIBridgeWindows *w)
@@ -241,7 +245,7 @@ void pci_bridge_update_mappings(PCIBridge *br)
 void pci_bridge_write_config(PCIDevice *d,
                              uint32_t address, uint32_t val, int len)
 {
-    PCIBridge *s = container_of(d, PCIBridge, dev);
+    PCIBridge *s = PCI_BRIDGE(d);
     uint16_t oldctl = pci_get_word(d->config + PCI_BRIDGE_CONTROL);
     uint16_t newctl;
 
@@ -331,7 +335,7 @@ void pci_bridge_reset(DeviceState *qdev)
 int pci_bridge_initfn(PCIDevice *dev, const char *typename)
 {
     PCIBus *parent = dev->bus;
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
+    PCIBridge *br = PCI_BRIDGE(dev);
     PCIBus *sec_bus = &br->sec_bus;
 
     pci_word_test_and_set_mask(dev->config + PCI_STATUS,
@@ -379,7 +383,7 @@ int pci_bridge_initfn(PCIDevice *dev, const char *typename)
 /* default qdev clean up function for PCI-to-PCI bridge */
 void pci_bridge_exitfn(PCIDevice *pci_dev)
 {
-    PCIBridge *s = DO_UPCAST(PCIBridge, dev, pci_dev);
+    PCIBridge *s = PCI_BRIDGE(pci_dev);
     assert(QLIST_EMPTY(&s->sec_bus.child));
     QLIST_REMOVE(&s->sec_bus, sibling);
     pci_bridge_region_del(s, s->windows);
@@ -400,3 +404,17 @@ void pci_bridge_map_irq(PCIBridge *br, const char* bus_name,
     br->map_irq = map_irq;
     br->bus_name = bus_name;
 }
+
+static const TypeInfo pci_bridge_type_info = {
+    .name = TYPE_PCI_BRIDGE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PCIBridge),
+    .abstract = true,
+};
+
+static void pci_bridge_register_types(void)
+{
+    type_register_static(&pci_bridge_type_info);
+}
+
+type_init(pci_bridge_register_types)
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 62bd0b8..50af3c1 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -305,7 +305,7 @@ void pcie_cap_slot_init(PCIDevice *dev, uint16_t slot)
 
     dev->exp.hpev_notified = false;
 
-    pci_bus_hotplug(pci_bridge_get_sec_bus(DO_UPCAST(PCIBridge, dev, dev)),
+    pci_bus_hotplug(pci_bridge_get_sec_bus(PCI_BRIDGE(dev)),
                     pcie_cap_slot_hotplug, &dev->qdev);
 }
 
diff --git a/include/hw/pci/pci_bus.h b/include/hw/pci/pci_bus.h
index 66762f6..9df1788 100644
--- a/include/hw/pci/pci_bus.h
+++ b/include/hw/pci/pci_bus.h
@@ -53,8 +53,13 @@ struct PCIBridgeWindows {
     MemoryRegion alias_vga[QEMU_PCI_VGA_NUM_REGIONS];
 };
 
+#define TYPE_PCI_BRIDGE "base-pci-bridge"
+#define PCI_BRIDGE(obj) OBJECT_CHECK(PCIBridge, (obj), TYPE_PCI_BRIDGE)
+
 struct PCIBridge {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
 
     /* private member */
     PCIBus sec_bus;
commit 45c0a675f9572f236b4be881576de9a626d2618f
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:11:10 2013 +0200

    arm11mpcore: QOM cast cleanups for mpcore_rirq_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index 31c9d5a..a786c62 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -161,11 +161,16 @@ static int mpcore_priv_init(SysBusDevice *sbd)
     return 0;
 }
 
+#define TYPE_REALVIEW_MPCORE_RIRQ "realview_mpcore"
+#define REALVIEW_MPCORE_RIRQ(obj) \
+    OBJECT_CHECK(mpcore_rirq_state, (obj), TYPE_REALVIEW_MPCORE_RIRQ)
+
 /* Dummy PIC to route IRQ lines.  The baseboard has 4 independent IRQ
    controllers.  The output of these, plus some of the raw input lines
    are fed into a single SMP-aware interrupt controller on the CPU.  */
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     SysBusDevice *priv;
     qemu_irq cpuic[32];
     qemu_irq rvic[4][64];
@@ -196,9 +201,10 @@ static void mpcore_rirq_set_irq(void *opaque, int irq, int level)
     }
 }
 
-static int realview_mpcore_init(SysBusDevice *dev)
+static int realview_mpcore_init(SysBusDevice *sbd)
 {
-    mpcore_rirq_state *s = FROM_SYSBUS(mpcore_rirq_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mpcore_rirq_state *s = REALVIEW_MPCORE_RIRQ(dev);
     DeviceState *gic;
     DeviceState *priv;
     int n;
@@ -208,7 +214,7 @@ static int realview_mpcore_init(SysBusDevice *dev)
     qdev_prop_set_uint32(priv, "num-cpu", s->num_cpu);
     qdev_init_nofail(priv);
     s->priv = SYS_BUS_DEVICE(priv);
-    sysbus_pass_irq(dev, s->priv);
+    sysbus_pass_irq(sbd, s->priv);
     for (i = 0; i < 32; i++) {
         s->cpuic[i] = qdev_get_gpio_in(priv, i);
     }
@@ -220,8 +226,8 @@ static int realview_mpcore_init(SysBusDevice *dev)
             s->rvic[n][i] = qdev_get_gpio_in(gic, i);
         }
     }
-    qdev_init_gpio_in(&dev->qdev, mpcore_rirq_set_irq, 64);
-    sysbus_init_mmio(dev, sysbus_mmio_get_region(s->priv, 0));
+    qdev_init_gpio_in(dev, mpcore_rirq_set_irq, 64);
+    sysbus_init_mmio(sbd, sysbus_mmio_get_region(s->priv, 0));
     return 0;
 }
 
@@ -240,7 +246,7 @@ static void mpcore_rirq_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mpcore_rirq_info = {
-    .name          = "realview_mpcore",
+    .name          = TYPE_REALVIEW_MPCORE_RIRQ,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mpcore_rirq_state),
     .class_init    = mpcore_rirq_class_init,
commit 56fc028166d00ecc8eb61cdfbec5a0305e15d670
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:59:01 2013 +0200

    arm11mpcore: QOM cast cleanups for ARM11MPCorePriveState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index 8eeb53e..31c9d5a 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -12,8 +12,13 @@
 
 /* MPCore private memory region.  */
 
+#define TYPE_ARM11MPCORE_PRIV "arm11mpcore_priv"
+#define ARM11MPCORE_PRIV(obj) \
+    OBJECT_CHECK(ARM11MPCorePriveState, (obj), TYPE_ARM11MPCORE_PRIV)
+
 typedef struct ARM11MPCorePriveState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t scu_control;
     int iomemtype;
     uint32_t old_timer_status[8];
@@ -125,9 +130,10 @@ static void mpcore_priv_map_setup(ARM11MPCorePriveState *s)
     }
 }
 
-static int mpcore_priv_init(SysBusDevice *dev)
+static int mpcore_priv_init(SysBusDevice *sbd)
 {
-    ARM11MPCorePriveState *s = FROM_SYSBUS(ARM11MPCorePriveState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    ARM11MPCorePriveState *s = ARM11MPCORE_PRIV(dev);
 
     s->gic = qdev_create(NULL, "arm_gic");
     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
@@ -137,10 +143,10 @@ static int mpcore_priv_init(SysBusDevice *dev)
     qdev_init_nofail(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, SYS_BUS_DEVICE(s->gic));
+    sysbus_pass_irq(sbd, SYS_BUS_DEVICE(s->gic));
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, mpcore_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(dev, mpcore_priv_set_irq, s->num_irq - 32);
 
     s->mptimer = qdev_create(NULL, "arm_mptimer");
     qdev_prop_set_uint32(s->mptimer, "num-cpu", s->num_cpu);
@@ -151,7 +157,7 @@ static int mpcore_priv_init(SysBusDevice *dev)
     qdev_init_nofail(s->wdtimer);
 
     mpcore_priv_map_setup(s);
-    sysbus_init_mmio(dev, &s->container);
+    sysbus_init_mmio(sbd, &s->container);
     return 0;
 }
 
@@ -198,7 +204,7 @@ static int realview_mpcore_init(SysBusDevice *dev)
     int n;
     int i;
 
-    priv = qdev_create(NULL, "arm11mpcore_priv");
+    priv = qdev_create(NULL, TYPE_ARM11MPCORE_PRIV);
     qdev_prop_set_uint32(priv, "num-cpu", s->num_cpu);
     qdev_init_nofail(priv);
     s->priv = SYS_BUS_DEVICE(priv);
@@ -264,7 +270,7 @@ static void mpcore_priv_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mpcore_priv_info = {
-    .name          = "arm11mpcore_priv",
+    .name          = TYPE_ARM11MPCORE_PRIV,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARM11MPCorePriveState),
     .class_init    = mpcore_priv_class_init,
commit 97da11d8571af72b714f5a45c171bed95a38368c
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Sun Jun 30 21:03:27 2013 +0200

    cpu/a15mpcore: QOM cast cleanup
    
    Introduce type constant and cast macro and rename A15MPPrivState::busdev
    field to parent_obj to enforce its use.
    
    Prepares for QOM realize.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index c736257..4f37964 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -23,8 +23,15 @@
 
 /* A15MP private memory region.  */
 
+#define TYPE_A15MPCORE_PRIV "a15mpcore_priv"
+#define A15MPCORE_PRIV(obj) \
+    OBJECT_CHECK(A15MPPrivState, (obj), TYPE_A15MPCORE_PRIV)
+
 typedef struct A15MPPrivState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     uint32_t num_irq;
     MemoryRegion container;
@@ -39,7 +46,7 @@ static void a15mp_priv_set_irq(void *opaque, int irq, int level)
 
 static int a15mp_priv_init(SysBusDevice *dev)
 {
-    A15MPPrivState *s = FROM_SYSBUS(A15MPPrivState, dev);
+    A15MPPrivState *s = A15MPCORE_PRIV(dev);
     SysBusDevice *busdev;
     const char *gictype = "arm_gic";
 
@@ -58,7 +65,7 @@ static int a15mp_priv_init(SysBusDevice *dev)
     sysbus_pass_irq(dev, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, a15mp_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(DEVICE(dev), a15mp_priv_set_irq, s->num_irq - 32);
 
     /* Memory map (addresses are offsets from PERIPHBASE):
      *  0x0000-0x0fff -- reserved
@@ -101,7 +108,7 @@ static void a15mp_priv_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo a15mp_priv_info = {
-    .name  = "a15mpcore_priv",
+    .name  = TYPE_A15MPCORE_PRIV,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(A15MPPrivState),
     .class_init = a15mp_priv_class_init,
commit 68653fd671d3e9b167aa2423dde67dad1b217340
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Sun Jun 30 19:37:10 2013 +0200

    timer/arm_mptimer: QOM cast cleanup
    
    Introduce type constant and cast macro and rename
    ARMMPTimerState::busdev to enforce its use.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index 0ceb240..9277315 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -41,8 +41,15 @@ typedef struct {
     MemoryRegion iomem;
 } TimerBlock;
 
+#define TYPE_ARM_MPTIMER "arm_mptimer"
+#define ARM_MPTIMER(obj) \
+    OBJECT_CHECK(ARMMPTimerState, (obj), TYPE_ARM_MPTIMER)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     TimerBlock timerblock[MAX_CPUS];
     MemoryRegion iomem;
@@ -210,9 +217,9 @@ static void timerblock_reset(TimerBlock *tb)
 
 static void arm_mptimer_reset(DeviceState *dev)
 {
-    ARMMPTimerState *s =
-        FROM_SYSBUS(ARMMPTimerState, SYS_BUS_DEVICE(dev));
+    ARMMPTimerState *s = ARM_MPTIMER(dev);
     int i;
+
     for (i = 0; i < ARRAY_SIZE(s->timerblock); i++) {
         timerblock_reset(&s->timerblock[i]);
     }
@@ -220,8 +227,9 @@ static void arm_mptimer_reset(DeviceState *dev)
 
 static int arm_mptimer_init(SysBusDevice *dev)
 {
-    ARMMPTimerState *s = FROM_SYSBUS(ARMMPTimerState, dev);
+    ARMMPTimerState *s = ARM_MPTIMER(dev);
     int i;
+
     if (s->num_cpu < 1 || s->num_cpu > MAX_CPUS) {
         hw_error("%s: num-cpu must be between 1 and %d\n", __func__, MAX_CPUS);
     }
@@ -294,7 +302,7 @@ static void arm_mptimer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo arm_mptimer_info = {
-    .name          = "arm_mptimer",
+    .name          = TYPE_ARM_MPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARMMPTimerState),
     .class_init    = arm_mptimer_class_init,
commit 5126fec766a3100de896cb92db45d862bd84a969
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Sun Jun 30 19:07:29 2013 +0200

    cpu/a9mpcore: QOM casting cleanup
    
    Introduce type constant and cast macro and enforce its use by
    renaming A9MPPrivState::busdev field to parent_obj.
    
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index 6c00a59..3e675e3 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -10,8 +10,15 @@
 
 #include "hw/sysbus.h"
 
+#define TYPE_A9MPCORE_PRIV "a9mpcore_priv"
+#define A9MPCORE_PRIV(obj) \
+    OBJECT_CHECK(A9MPPrivState, (obj), TYPE_A9MPCORE_PRIV)
+
 typedef struct A9MPPrivState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     MemoryRegion container;
     DeviceState *mptimer;
@@ -29,7 +36,7 @@ static void a9mp_priv_set_irq(void *opaque, int irq, int level)
 
 static int a9mp_priv_init(SysBusDevice *dev)
 {
-    A9MPPrivState *s = FROM_SYSBUS(A9MPPrivState, dev);
+    A9MPPrivState *s = A9MPCORE_PRIV(dev);
     SysBusDevice *timerbusdev, *wdtbusdev, *gicbusdev, *scubusdev;
     int i;
 
@@ -43,7 +50,7 @@ static int a9mp_priv_init(SysBusDevice *dev)
     sysbus_pass_irq(dev, gicbusdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, a9mp_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(DEVICE(dev), a9mp_priv_set_irq, s->num_irq - 32);
 
     s->scu = qdev_create(NULL, "a9-scu");
     qdev_prop_set_uint32(s->scu, "num-cpu", s->num_cpu);
@@ -124,7 +131,7 @@ static void a9mp_priv_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo a9mp_priv_info = {
-    .name          = "a9mpcore_priv",
+    .name          = TYPE_A9MPCORE_PRIV,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(A9MPPrivState),
     .class_init    = a9mp_priv_class_init,
commit f6c11d56442fafa5357ef1f1659b9e39e7bf578d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 17 18:44:48 2013 +0200

    ide: Introduce abstract QOM type for PCIIDEState
    
    Needed for QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index 33be386..d6ef799 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -127,7 +127,7 @@ static uint64_t bmdma_read(void *opaque, hwaddr addr,
                            unsigned size)
 {
     BMDMAState *bm = opaque;
-    PCIIDEState *pci_dev = bm->pci_dev;
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     uint32_t val;
 
     if (size != 1) {
@@ -139,16 +139,16 @@ static uint64_t bmdma_read(void *opaque, hwaddr addr,
         val = bm->cmd;
         break;
     case 1:
-        val = pci_dev->dev.config[MRDMODE];
+        val = pci_dev->config[MRDMODE];
         break;
     case 2:
         val = bm->status;
         break;
     case 3:
-        if (bm == &pci_dev->bmdma[0]) {
-            val = pci_dev->dev.config[UDIDETCR0];
+        if (bm == &bm->pci_dev->bmdma[0]) {
+            val = pci_dev->config[UDIDETCR0];
         } else {
-            val = pci_dev->dev.config[UDIDETCR1];
+            val = pci_dev->config[UDIDETCR1];
         }
         break;
     default:
@@ -165,7 +165,7 @@ static void bmdma_write(void *opaque, hwaddr addr,
                         uint64_t val, unsigned size)
 {
     BMDMAState *bm = opaque;
-    PCIIDEState *pci_dev = bm->pci_dev;
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
 
     if (size != 1) {
         return;
@@ -179,18 +179,19 @@ static void bmdma_write(void *opaque, hwaddr addr,
         bmdma_cmd_writeb(bm, val);
         break;
     case 1:
-        pci_dev->dev.config[MRDMODE] =
-            (pci_dev->dev.config[MRDMODE] & ~0x30) | (val & 0x30);
-        cmd646_update_irq(pci_dev);
+        pci_dev->config[MRDMODE] =
+            (pci_dev->config[MRDMODE] & ~0x30) | (val & 0x30);
+        cmd646_update_irq(bm->pci_dev);
         break;
     case 2:
         bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
         break;
     case 3:
-        if (bm == &pci_dev->bmdma[0])
-            pci_dev->dev.config[UDIDETCR0] = val;
-        else
-            pci_dev->dev.config[UDIDETCR1] = val;
+        if (bm == &bm->pci_dev->bmdma[0]) {
+            pci_dev->config[UDIDETCR0] = val;
+        } else {
+            pci_dev->config[UDIDETCR1] = val;
+        }
         break;
     }
 }
@@ -222,25 +223,29 @@ static void bmdma_setup_bar(PCIIDEState *d)
    registers */
 static void cmd646_update_irq(PCIIDEState *d)
 {
+    PCIDevice *pd = PCI_DEVICE(d);
     int pci_level;
-    pci_level = ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH0) &&
-                 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH0)) ||
-        ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH1) &&
-         !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH1));
-    qemu_set_irq(d->dev.irq[0], pci_level);
+
+    pci_level = ((pd->config[MRDMODE] & MRDMODE_INTR_CH0) &&
+                 !(pd->config[MRDMODE] & MRDMODE_BLK_CH0)) ||
+        ((pd->config[MRDMODE] & MRDMODE_INTR_CH1) &&
+         !(pd->config[MRDMODE] & MRDMODE_BLK_CH1));
+    qemu_set_irq(pd->irq[0], pci_level);
 }
 
 /* the PCI irq level is the logical OR of the two channels */
 static void cmd646_set_irq(void *opaque, int channel, int level)
 {
     PCIIDEState *d = opaque;
+    PCIDevice *pd = PCI_DEVICE(d);
     int irq_mask;
 
     irq_mask = MRDMODE_INTR_CH0 << channel;
-    if (level)
-        d->dev.config[MRDMODE] |= irq_mask;
-    else
-        d->dev.config[MRDMODE] &= ~irq_mask;
+    if (level) {
+        pd->config[MRDMODE] |= irq_mask;
+    } else {
+        pd->config[MRDMODE] &= ~irq_mask;
+    }
     cmd646_update_irq(d);
 }
 
@@ -257,8 +262,8 @@ static void cmd646_reset(void *opaque)
 /* CMD646 PCI IDE controller */
 static int pci_cmd646_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
     qemu_irq *irq;
     int i;
 
@@ -284,7 +289,7 @@ static int pci_cmd646_ide_initfn(PCIDevice *dev)
 
     irq = qemu_allocate_irqs(cmd646_set_irq, d, 2);
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(dev), i, 2);
         ide_init2(&d->bus[i], irq[i]);
 
         bmdma_init(&d->bus[i], &d->bmdma[i], d);
@@ -293,14 +298,14 @@ static int pci_cmd646_ide_initfn(PCIDevice *dev)
                                          &d->bmdma[i].dma);
     }
 
-    vmstate_register(&dev->qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
     qemu_register_reset(cmd646_reset, d);
     return 0;
 }
 
 static void pci_cmd646_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -347,8 +352,7 @@ static void cmd646_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo cmd646_ide_info = {
     .name          = "cmd646-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = cmd646_ide_class_init,
 };
 
diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 635a364..91151fc 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -56,13 +56,14 @@ static int bmdma_prepare_buf(IDEDMA *dma, int is_write)
 {
     BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
     IDEState *s = bmdma_active_if(bm);
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     struct {
         uint32_t addr;
         uint32_t size;
     } prd;
     int l, len;
 
-    pci_dma_sglist_init(&s->sg, &bm->pci_dev->dev,
+    pci_dma_sglist_init(&s->sg, pci_dev,
                         s->nsector / (BMDMA_PAGE_SIZE / 512) + 1);
     s->io_buffer_size = 0;
     for(;;) {
@@ -71,7 +72,7 @@ static int bmdma_prepare_buf(IDEDMA *dma, int is_write)
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE)
                 return s->io_buffer_size != 0;
-            pci_dma_read(&bm->pci_dev->dev, bm->cur_addr, &prd, 8);
+            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);
@@ -98,6 +99,7 @@ static int bmdma_rw_buf(IDEDMA *dma, int is_write)
 {
     BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
     IDEState *s = bmdma_active_if(bm);
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     struct {
         uint32_t addr;
         uint32_t size;
@@ -113,7 +115,7 @@ static int bmdma_rw_buf(IDEDMA *dma, int is_write)
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE)
                 return 0;
-            pci_dma_read(&bm->pci_dev->dev, bm->cur_addr, &prd, 8);
+            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);
@@ -128,10 +130,10 @@ static int bmdma_rw_buf(IDEDMA *dma, int is_write)
             l = bm->cur_prd_len;
         if (l > 0) {
             if (is_write) {
-                pci_dma_write(&bm->pci_dev->dev, bm->cur_prd_addr,
+                pci_dma_write(pci_dev, bm->cur_prd_addr,
                               s->io_buffer + s->io_buffer_index, l);
             } else {
-                pci_dma_read(&bm->pci_dev->dev, bm->cur_prd_addr,
+                pci_dma_read(pci_dev, bm->cur_prd_addr,
                              s->io_buffer + s->io_buffer_index, l);
             }
             bm->cur_prd_addr += l;
@@ -480,7 +482,7 @@ const VMStateDescription vmstate_ide_pci = {
     .minimum_version_id_old = 0,
     .post_load = ide_pci_post_load,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, PCIIDEState),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIIDEState),
         VMSTATE_STRUCT_ARRAY(bmdma, PCIIDEState, 2, 0,
                              vmstate_bmdma, BMDMAState),
         VMSTATE_IDE_BUS_ARRAY(bus, PCIIDEState, 2),
@@ -492,7 +494,7 @@ const VMStateDescription vmstate_ide_pci = {
 
 void pci_ide_create_devs(PCIDevice *dev, DriveInfo **hd_table)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     static const int bus[4]  = { 0, 0, 1, 1 };
     static const int unit[4] = { 0, 1, 0, 1 };
     int i;
@@ -531,3 +533,17 @@ void bmdma_init(IDEBus *bus, BMDMAState *bm, PCIIDEState *d)
     bus->irq = *irq;
     bm->pci_dev = d;
 }
+
+static const TypeInfo pci_ide_type_info = {
+    .name = TYPE_PCI_IDE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PCIIDEState),
+    .abstract = true,
+};
+
+static void pci_ide_register_types(void)
+{
+    type_register_static(&pci_ide_type_info);
+}
+
+type_init(pci_ide_register_types)
diff --git a/hw/ide/pci.h b/hw/ide/pci.h
index a694e54..2428275 100644
--- a/hw/ide/pci.h
+++ b/hw/ide/pci.h
@@ -37,8 +37,14 @@ typedef struct CMD646BAR {
     struct PCIIDEState *pci_dev;
 } CMD646BAR;
 
+#define TYPE_PCI_IDE "pci-ide"
+#define PCI_IDE(obj) OBJECT_CHECK(PCIIDEState, (obj), TYPE_PCI_IDE)
+
 typedef struct PCIIDEState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     IDEBus bus[2];
     BMDMAState bmdma[2];
     uint32_t secondary; /* used only for cmd646 */
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 238e758..e6e6c0b 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -106,7 +106,8 @@ static void bmdma_setup_bar(PCIIDEState *d)
 static void piix3_reset(void *opaque)
 {
     PCIIDEState *d = opaque;
-    uint8_t *pci_conf = d->dev.config;
+    PCIDevice *pd = PCI_DEVICE(d);
+    uint8_t *pci_conf = pd->config;
     int i;
 
     for (i = 0; i < 2; i++) {
@@ -149,15 +150,15 @@ static void pci_piix_init_ports(PCIIDEState *d) {
 
 static int pci_piix_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
 
     pci_conf[PCI_CLASS_PROG] = 0x80; // legacy ATA mode
 
     qemu_register_reset(piix3_reset, d);
 
     bmdma_setup_bar(d);
-    pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
+    pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
     vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
@@ -168,13 +169,11 @@ static int pci_piix_ide_initfn(PCIDevice *dev)
 
 static int pci_piix3_xen_ide_unplug(DeviceState *dev)
 {
-    PCIDevice *pci_dev;
     PCIIDEState *pci_ide;
     DriveInfo *di;
     int i = 0;
 
-    pci_dev = PCI_DEVICE(dev);
-    pci_ide = DO_UPCAST(PCIIDEState, dev, pci_dev);
+    pci_ide = PCI_IDE(dev);
 
     for (; i < 3; i++) {
         di = drive_get_by_index(IF_IDE, i);
@@ -203,7 +202,7 @@ PCIDevice *pci_piix3_xen_ide_init(PCIBus *bus, DriveInfo **hd_table, int devfn)
 
 static void pci_piix_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -254,8 +253,7 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo piix3_ide_info = {
     .name          = "piix3-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix3_ide_class_init,
 };
 
@@ -275,8 +273,7 @@ static void piix3_ide_xen_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo piix3_ide_xen_info = {
     .name          = "piix3-ide-xen",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix3_ide_xen_class_init,
 };
 
@@ -297,8 +294,7 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo piix4_ide_info = {
     .name          = "piix4-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix4_ide_class_init,
 };
 
diff --git a/hw/ide/via.c b/hw/ide/via.c
index d324884..e5fb297 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -108,7 +108,8 @@ static void bmdma_setup_bar(PCIIDEState *d)
 static void via_reset(void *opaque)
 {
     PCIIDEState *d = opaque;
-    uint8_t *pci_conf = d->dev.config;
+    PCIDevice *pd = PCI_DEVICE(d);
+    uint8_t *pci_conf = pd->config;
     int i;
 
     for (i = 0; i < 2; i++) {
@@ -158,7 +159,7 @@ static void vt82c686b_init_ports(PCIIDEState *d) {
     int i;
 
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(d), i, 2);
         ide_init_ioport(&d->bus[i], NULL, port_info[i].iobase,
                         port_info[i].iobase2);
         ide_init2(&d->bus[i], isa_get_irq(NULL, port_info[i].isairq));
@@ -173,17 +174,17 @@ static void vt82c686b_init_ports(PCIIDEState *d) {
 /* via ide func */
 static int vt82c686b_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
 
     pci_config_set_prog_interface(pci_conf, 0x8a); /* legacy ATA mode */
     pci_set_long(pci_conf + PCI_CAPABILITY_LIST, 0x000000c0);
 
     qemu_register_reset(via_reset, d);
     bmdma_setup_bar(d);
-    pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
+    pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
-    vmstate_register(&dev->qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
     vt82c686b_init_ports(d);
 
@@ -192,7 +193,7 @@ static int vt82c686b_ide_initfn(PCIDevice *dev)
 
 static void vt82c686b_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -229,8 +230,7 @@ static void via_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo via_ide_info = {
     .name          = "via-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = via_ide_class_init,
 };
 
commit 02a9594b4f0cb8a341fe91edb41c6424ad5ae4f9
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:56:30 2013 +1000

    ide/piix: QOM casting sweep
    
    Use standard QOM cast macro. Remove usage of DO_UPCAST() and
    direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 56cf00e..238e758 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -135,7 +135,7 @@ static void pci_piix_init_ports(PCIIDEState *d) {
     int i;
 
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(d), i, 2);
         ide_init_ioport(&d->bus[i], NULL, port_info[i].iobase,
                         port_info[i].iobase2);
         ide_init2(&d->bus[i], isa_get_irq(NULL, port_info[i].isairq));
@@ -159,7 +159,7 @@ static int pci_piix_ide_initfn(PCIDevice *dev)
     bmdma_setup_bar(d);
     pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
-    vmstate_register(&d->dev.qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
     pci_piix_init_ports(d);
 
@@ -173,7 +173,7 @@ static int pci_piix3_xen_ide_unplug(DeviceState *dev)
     DriveInfo *di;
     int i = 0;
 
-    pci_dev = DO_UPCAST(PCIDevice, qdev, dev);
+    pci_dev = PCI_DEVICE(dev);
     pci_ide = DO_UPCAST(PCIIDEState, dev, pci_dev);
 
     for (; i < 3; i++) {
@@ -188,7 +188,7 @@ static int pci_piix3_xen_ide_unplug(DeviceState *dev)
             drive_put_ref(di);
         }
     }
-    qdev_reset_all(&(pci_ide->dev.qdev));
+    qdev_reset_all(DEVICE(dev));
     return 0;
 }
 
commit 19d46d711d93cb3a37dada945cb3410278b94bc3
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 01:55:26 2013 +0200

    fdc: Fix inheritence for SUNW,fdtwo
    
    Since commit dd3be7420774f7dc8f37a96ca24d07f0b6f31b3b SUNW,fdtwo's
    initfn (realizefn since 940194c2369e50d91d1abf6f36d43853eea5e539)
    was using SYSBUS_FDC() cast. This uses type sysbus-fdc rather than
    SUNW,fdtwo.
    
    Fix this by letting SUNW,fdtwo and sysbus-fdc both inherit from an
    abstract type base-sysbus-fdc.
    
    This allows to consolidate realizefns by using instance_init functions.
    Clean up variable names and variable order while at it.
    
    Reported-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Cc: Hu Tao <hutao at cn.fujitsu.com>
    Tested-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 50a350f..e35ed2e 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -544,7 +544,7 @@ struct FDCtrl {
     uint8_t timer1;
 };
 
-#define TYPE_SYSBUS_FDC "sysbus-fdc"
+#define TYPE_SYSBUS_FDC "base-sysbus-fdc"
 #define SYSBUS_FDC(obj) OBJECT_CHECK(FDCtrlSysBus, (obj), TYPE_SYSBUS_FDC)
 
 typedef struct FDCtrlSysBus {
@@ -2055,7 +2055,7 @@ void fdctrl_init_sysbus(qemu_irq irq, int dma_chann,
     SysBusDevice *sbd;
     FDCtrlSysBus *sys;
 
-    dev = qdev_create(NULL, TYPE_SYSBUS_FDC);
+    dev = qdev_create(NULL, "sysbus-fdc");
     sys = SYSBUS_FDC(dev);
     fdctrl = &sys->state;
     fdctrl->dma_chann = dma_chann; /* FIXME */
@@ -2153,60 +2153,49 @@ static void isabus_fdc_realize(DeviceState *dev, Error **errp)
 
 static void sysbus_fdc_initfn(Object *obj)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
 
+    fdctrl->dma_chann = -1;
+
     memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_ops, fdctrl,
                           "fdc", 0x08);
+    sysbus_init_mmio(sbd, &fdctrl->iomem);
 }
 
-static void sysbus_fdc_realize(DeviceState *dev, Error **errp)
+static void sun4m_fdc_initfn(Object *obj)
 {
-    FDCtrlSysBus *sys = SYSBUS_FDC(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
-    SysBusDevice *b = SYS_BUS_DEVICE(dev);
-    Error *err = NULL;
 
-    sysbus_init_mmio(b, &fdctrl->iomem);
-    sysbus_init_irq(b, &fdctrl->irq);
-    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
-    fdctrl->dma_chann = -1;
+    fdctrl->sun4m = 1;
 
-    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    fdctrl_realize_common(fdctrl, &err);
-    if (err != NULL) {
-        error_propagate(errp, err);
-        return;
-    }
+    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_strict_ops,
+                          fdctrl, "fdctrl", 0x08);
+    sysbus_init_mmio(sbd, &fdctrl->iomem);
 }
 
-static void sun4m_fdc_initfn(Object *obj)
+static void sysbus_fdc_common_initfn(Object *obj)
 {
+    DeviceState *dev = DEVICE(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
 
-    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_strict_ops,
-                          fdctrl, "fdctrl", 0x08);
+    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
+
+    sysbus_init_irq(sbd, &fdctrl->irq);
+    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
 }
 
-static void sun4m_fdc_realize(DeviceState *dev, Error **errp)
+static void sysbus_fdc_common_realize(DeviceState *dev, Error **errp)
 {
     FDCtrlSysBus *sys = SYSBUS_FDC(dev);
     FDCtrl *fdctrl = &sys->state;
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    Error *err = NULL;
 
-    sysbus_init_mmio(sbd, &fdctrl->iomem);
-    sysbus_init_irq(sbd, &fdctrl->irq);
-    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
-
-    fdctrl->sun4m = 1;
-    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    fdctrl_realize_common(fdctrl, &err);
-    if (err != NULL) {
-        error_propagate(errp, err);
-        return;
-    }
+    fdctrl_realize_common(fdctrl, errp);
 }
 
 FDriveType isa_fdc_get_drive_type(ISADevice *fdc, int i)
@@ -2279,17 +2268,13 @@ static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->realize = sysbus_fdc_realize;
-    dc->reset = fdctrl_external_reset_sysbus;
-    dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sysbus_fdc_properties;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_fdc_info = {
-    .name          = TYPE_SYSBUS_FDC,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(FDCtrlSysBus),
+    .name          = "sysbus-fdc",
+    .parent        = TYPE_SYSBUS_FDC,
     .instance_init = sysbus_fdc_initfn,
     .class_init    = sysbus_fdc_class_init,
 };
@@ -2303,24 +2288,39 @@ static void sun4m_fdc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->realize = sun4m_fdc_realize;
-    dc->reset = fdctrl_external_reset_sysbus;
-    dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sun4m_fdc_properties;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sun4m_fdc_info = {
     .name          = "SUNW,fdtwo",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(FDCtrlSysBus),
+    .parent        = TYPE_SYSBUS_FDC,
     .instance_init = sun4m_fdc_initfn,
     .class_init    = sun4m_fdc_class_init,
 };
 
+static void sysbus_fdc_common_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = sysbus_fdc_common_realize;
+    dc->reset = fdctrl_external_reset_sysbus;
+    dc->vmsd = &vmstate_sysbus_fdc;
+}
+
+static const TypeInfo sysbus_fdc_type_info = {
+    .name          = TYPE_SYSBUS_FDC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(FDCtrlSysBus),
+    .instance_init = sysbus_fdc_common_initfn,
+    .abstract      = true,
+    .class_init    = sysbus_fdc_common_class_init,
+};
+
 static void fdc_register_types(void)
 {
     type_register_static(&isa_fdc_info);
+    type_register_static(&sysbus_fdc_type_info);
     type_register_static(&sysbus_fdc_info);
     type_register_static(&sun4m_fdc_info);
 }
commit eddbf0ab9db8385d7cb57e23891c1d41488b303e
Merge: 4ff1fac b0f2027
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 11:33:48 2013 -0500

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Stefan Hajnoczi (4) and others
    # Via Stefan Hajnoczi
    * stefanha/block:
      dataplane: refuse to start if device is already in use
      dataplane: enable virtio-blk x-data-plane=on live migration
      migration: fix spice migration
      migration: notify migration state before starting thread
      block: Repair the throttling code.
      gluster: Add image resize support
    
    Message-id: 1375112172-24863-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 4ff1fac4305f78d9cf987ca8abf3bda7f29c856e
Merge: 3a1da42 9337e3b
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 11:33:34 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into staging
    
    QOM CPUState refactorings
    
    * Fix x86 cpu-add
    * Change KVM PMU behavior for 1.6
    
    # gpg: Signature made Mon 29 Jul 2013 10:28:18 AM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Eduardo Habkost (2) and Andreas Färber (1)
    # Via Andreas Färber
    * afaerber/tags/qom-cpu-for-anthony:
      target-i386: Disable PMU CPUID leaf by default
      target-i386: Pass X86CPU object to cpu_x86_find_by_name()
      cpu: Partially revert "cpu: Change qemu_init_vcpu() argument to CPUState"

commit 3a1da42eb35a67d0dbc899dd571ea386fa11c4dd
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jul 26 16:44:34 2013 +0200

    qapi: Rename ChardevBackend member "memory" to "ringbuf"
    
    Commit 1da48c6 called the new member "memory" after commit 3949e59
    standardized "ringbuf".  Rename for consistency.
    
    However, member name "memory" is visible in QMP since 1.5.  It's
    undocumented just like the driver name.  Keep it working anyway.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374849874-25531-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index a56de74..a51f7d2 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3364,9 +3364,9 @@
 ##
 # @ChardevRingbuf:
 #
-# Configuration info for memory chardevs
+# Configuration info for ring buffer chardevs.
 #
-# @size: #optional Ringbuffer size, must be power of two, default is 65536
+# @size: #optional ring buffer size, must be power of two, default is 65536
 #
 # Since: 1.5
 ##
@@ -3397,6 +3397,8 @@
                                        'spicevmc' : 'ChardevSpiceChannel',
                                        'spiceport' : 'ChardevSpicePort',
                                        'vc'     : 'ChardevVC',
+                                       'ringbuf': 'ChardevRingbuf',
+                                       # next one is just for compatibility
                                        'memory' : 'ChardevRingbuf' } }
 
 ##
diff --git a/qemu-char.c b/qemu-char.c
index 742b73b..3f606c9 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3110,12 +3110,12 @@ static void qemu_chr_parse_ringbuf(QemuOpts *opts, ChardevBackend *backend,
 {
     int val;
 
-    backend->memory = g_new0(ChardevRingbuf, 1);
+    backend->ringbuf = g_new0(ChardevRingbuf, 1);
 
     val = qemu_opt_get_size(opts, "size", 0);
     if (val != 0) {
-        backend->memory->has_size = true;
-        backend->memory->size = val;
+        backend->ringbuf->has_size = true;
+        backend->ringbuf->size = val;
     }
 }
 
@@ -3723,8 +3723,9 @@ ChardevReturn *qmp_chardev_add(const char *id, ChardevBackend *backend,
     case CHARDEV_BACKEND_KIND_VC:
         chr = vc_init(backend->vc);
         break;
+    case CHARDEV_BACKEND_KIND_RINGBUF:
     case CHARDEV_BACKEND_KIND_MEMORY:
-        chr = qemu_chr_open_ringbuf(backend->memory, errp);
+        chr = qemu_chr_open_ringbuf(backend->ringbuf, errp);
         break;
     default:
         error_setg(errp, "unknown chardev backend (%d)", backend->kind);
@@ -3774,7 +3775,7 @@ static void register_types(void)
     register_char_driver_qapi("null", CHARDEV_BACKEND_KIND_NULL, NULL);
     register_char_driver("socket", qemu_chr_open_socket);
     register_char_driver("udp", qemu_chr_open_udp);
-    register_char_driver_qapi("ringbuf", CHARDEV_BACKEND_KIND_MEMORY,
+    register_char_driver_qapi("ringbuf", CHARDEV_BACKEND_KIND_RINGBUF,
                               qemu_chr_parse_ringbuf);
     register_char_driver_qapi("file", CHARDEV_BACKEND_KIND_FILE,
                               qemu_chr_parse_file_out);
commit c11ed9666d69abaf217c8800f299c519b487b7d3
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jul 26 16:44:33 2013 +0200

    qemu-char: Register ring buffer driver with correct name "ringbuf"
    
    The driver is new in 1.4, with the documented name "ringbuf".
    However, it's actual name is the completely undocumented "memory".
    Screwed up in commit 3949e59.  Fix code to match documentation.
    
    Keep the undocumented name working as an alias for compatibility.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374849874-25531-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index bd1aefb..742b73b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3774,7 +3774,7 @@ static void register_types(void)
     register_char_driver_qapi("null", CHARDEV_BACKEND_KIND_NULL, NULL);
     register_char_driver("socket", qemu_chr_open_socket);
     register_char_driver("udp", qemu_chr_open_udp);
-    register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
+    register_char_driver_qapi("ringbuf", CHARDEV_BACKEND_KIND_MEMORY,
                               qemu_chr_parse_ringbuf);
     register_char_driver_qapi("file", CHARDEV_BACKEND_KIND_FILE,
                               qemu_chr_parse_file_out);
@@ -3794,6 +3794,9 @@ static void register_types(void)
                               qemu_chr_parse_pipe);
     register_char_driver_qapi("mux", CHARDEV_BACKEND_KIND_MUX,
                               qemu_chr_parse_mux);
+    /* Bug-compatibility: */
+    register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
+                              qemu_chr_parse_ringbuf);
 }
 
 type_init(register_types);
commit 4f57378fe69836ee2585c4ca631ff50746940fa6
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jul 26 16:44:32 2013 +0200

    Revert "chardev: Make the name of memory device consistent"
    
    This reverts commit 6a85e60cb994bd95d1537aafbff65816f3de4637.
    
    Commit 51767e7 "qemu-char: Add new char backend CirMemCharDriver"
    introduced a memory ring buffer character device driver named
    "memory".  Commit 3949e59 "qemu-char: Saner naming of memchar stuff &
    doc fixes" changed the driver name to "ringbuf", along with a whole
    bunch of other names, with the following rationale:
    
        Naming is a mess.  The code calls the device driver
        CirMemCharDriver, the public API calls it "memory", "memchardev",
        or "memchar", and the special commands are named like
        "memchar-FOO".  "memory" is a particularly unfortunate choice,
        because there's another character device driver called
        MemoryDriver.  Moreover, the device's distinctive property is that
        it's a ring buffer, not that's in memory.
    
    This is what we released in 1.4.0.
    
    Unfortunately, the rename missed a critical instance of "memory": the
    actual driver name.  Thus, the new device could be used only by an
    entirely undocumented name.  The documented name did not work.
    Bummer.
    
    Commit 6a85e60 fixes this by changing the documentation to match the
    code.  It also changes some, but not all related occurences of
    "ringbuf" to "memory".  Left alone are identifiers in C code, HMP and
    QMP commands.  The latter are external interface, so they can't be
    changed.
    
    The result is an inconsistent mess.  Moreover, "memory" is a rotten
    name.  The device's distinctive property is that it's a ring buffer,
    not that's in memory.  User's don't care whether it's in RAM, flash,
    or carved into chocolate tablets by Oompa Loompas.
    
    Revert the commit.  Next commit will fix just the bug.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374849874-25531-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index f82d829..a56de74 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3362,7 +3362,7 @@
                                  '*rows'   : 'int' } }
 
 ##
-# @ChardevMemory:
+# @ChardevRingbuf:
 #
 # Configuration info for memory chardevs
 #
@@ -3370,7 +3370,7 @@
 #
 # Since: 1.5
 ##
-{ 'type': 'ChardevMemory', 'data': { '*size'  : 'int' } }
+{ 'type': 'ChardevRingbuf', 'data': { '*size'  : 'int' } }
 
 ##
 # @ChardevBackend:
@@ -3397,7 +3397,7 @@
                                        'spicevmc' : 'ChardevSpiceChannel',
                                        'spiceport' : 'ChardevSpicePort',
                                        'vc'     : 'ChardevVC',
-                                       'memory' : 'ChardevMemory' } }
+                                       'memory' : 'ChardevRingbuf' } }
 
 ##
 # @ChardevReturn:
diff --git a/qemu-char.c b/qemu-char.c
index c86ce4b..bd1aefb 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2783,8 +2783,8 @@ static void ringbuf_chr_close(struct CharDriverState *chr)
     chr->opaque = NULL;
 }
 
-static CharDriverState *qemu_chr_open_memory(ChardevMemory *opts,
-                                             Error **errp)
+static CharDriverState *qemu_chr_open_ringbuf(ChardevRingbuf *opts,
+                                              Error **errp)
 {
     CharDriverState *chr;
     RingBufCharDriver *d;
@@ -2796,7 +2796,7 @@ static CharDriverState *qemu_chr_open_memory(ChardevMemory *opts,
 
     /* The size must be power of 2 */
     if (d->size & (d->size - 1)) {
-        error_setg(errp, "size of memory chardev must be power of two");
+        error_setg(errp, "size of ringbuf chardev must be power of two");
         goto fail;
     }
 
@@ -3105,12 +3105,12 @@ static void qemu_chr_parse_pipe(QemuOpts *opts, ChardevBackend *backend,
     backend->pipe->device = g_strdup(device);
 }
 
-static void qemu_chr_parse_memory(QemuOpts *opts, ChardevBackend *backend,
-                                  Error **errp)
+static void qemu_chr_parse_ringbuf(QemuOpts *opts, ChardevBackend *backend,
+                                   Error **errp)
 {
     int val;
 
-    backend->memory = g_new0(ChardevMemory, 1);
+    backend->memory = g_new0(ChardevRingbuf, 1);
 
     val = qemu_opt_get_size(opts, "size", 0);
     if (val != 0) {
@@ -3724,7 +3724,7 @@ ChardevReturn *qmp_chardev_add(const char *id, ChardevBackend *backend,
         chr = vc_init(backend->vc);
         break;
     case CHARDEV_BACKEND_KIND_MEMORY:
-        chr = qemu_chr_open_memory(backend->memory, errp);
+        chr = qemu_chr_open_ringbuf(backend->memory, errp);
         break;
     default:
         error_setg(errp, "unknown chardev backend (%d)", backend->kind);
@@ -3775,7 +3775,7 @@ static void register_types(void)
     register_char_driver("socket", qemu_chr_open_socket);
     register_char_driver("udp", qemu_chr_open_udp);
     register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
-                              qemu_chr_parse_memory);
+                              qemu_chr_parse_ringbuf);
     register_char_driver_qapi("file", CHARDEV_BACKEND_KIND_FILE,
                               qemu_chr_parse_file_out);
     register_char_driver_qapi("stdio", CHARDEV_BACKEND_KIND_STDIO,
diff --git a/qemu-options.hx b/qemu-options.hx
index 25ecb55..d15338e 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1783,7 +1783,7 @@ DEF("chardev", HAS_ARG, QEMU_OPTION_chardev,
     "-chardev msmouse,id=id[,mux=on|off]\n"
     "-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]\n"
     "         [,mux=on|off]\n"
-    "-chardev memory,id=id[,size=size]\n"
+    "-chardev ringbuf,id=id[,size=size]\n"
     "-chardev file,id=id,path=path[,mux=on|off]\n"
     "-chardev pipe,id=id,path=path[,mux=on|off]\n"
 #ifdef _WIN32
@@ -1821,7 +1821,7 @@ Backend is one of:
 @option{udp},
 @option{msmouse},
 @option{vc},
- at option{memory},
+ at option{ringbuf},
 @option{file},
 @option{pipe},
 @option{console},
@@ -1930,7 +1930,7 @@ the console, in pixels.
 @option{cols} and @option{rows} specify that the console be sized to fit a text
 console with the given dimensions.
 
- at item -chardev memory ,id=@var{id} [,size=@var{size}]
+ at item -chardev ringbuf ,id=@var{id} [,size=@var{size}]
 
 Create a ring buffer with fixed size @option{size}.
 @var{size} must be a power of two, and defaults to @code{64K}).
commit f1a145e154b0a227a1e192009ca30b351de0a8ef
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:42:01 2013 +0200

    qapi.py: Permit comments starting anywhere on the line
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-10-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index f64b7b2..0ebea94 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -68,13 +68,12 @@ class QAPISchema:
 
     def accept(self):
         while True:
-            bol = self.cursor == 0 or self.src[self.cursor-1] == '\n'
             self.tok = self.src[self.cursor]
             self.pos = self.cursor
             self.cursor += 1
             self.val = None
 
-            if self.tok == '#' and bol:
+            if self.tok == '#':
                 self.cursor = self.src.find('\n', self.cursor)
             elif self.tok in ['{', '}', ':', ',', '[', ']']:
                 return
diff --git a/tests/qapi-schema/comments.err b/tests/qapi-schema/comments.err
index 4a82b26..e69de29 100644
--- a/tests/qapi-schema/comments.err
+++ b/tests/qapi-schema/comments.err
@@ -1 +0,0 @@
-<stdin>:2:33: Stray "#"
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
index d00491f..573541a 100644
--- a/tests/qapi-schema/comments.exit
+++ b/tests/qapi-schema/comments.exit
@@ -1 +1 @@
-1
+0
diff --git a/tests/qapi-schema/comments.out b/tests/qapi-schema/comments.out
index e69de29..e3bd904 100644
--- a/tests/qapi-schema/comments.out
+++ b/tests/qapi-schema/comments.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
commit 28b8bd4c759389bdc8430acfa588a23e4a9a7fb8
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:42:00 2013 +0200

    qapi.py: Rename expr_eval to expr in parse_schema()
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-9-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 75fc282..f64b7b2 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -168,15 +168,15 @@ def parse_schema(fp):
 
     exprs = []
 
-    for expr_eval in schema.exprs:
-        if expr_eval.has_key('enum'):
-            add_enum(expr_eval['enum'])
-        elif expr_eval.has_key('union'):
-            add_union(expr_eval)
-            add_enum('%sKind' % expr_eval['union'])
-        elif expr_eval.has_key('type'):
-            add_struct(expr_eval)
-        exprs.append(expr_eval)
+    for expr in schema.exprs:
+        if expr.has_key('enum'):
+            add_enum(expr['enum'])
+        elif expr.has_key('union'):
+            add_union(expr)
+            add_enum('%sKind' % expr['union'])
+        elif expr.has_key('type'):
+            add_struct(expr)
+        exprs.append(expr)
 
     return exprs
 
commit 5f3cd2b717c949f3afb502fb4c81193eb18ce6aa
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:59 2013 +0200

    qapi.py: Fix diagnosing non-objects at a schema's top-level
    
    Report syntax error instead of crashing.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-8-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 12fb29a..75fc282 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -64,7 +64,7 @@ class QAPISchema:
         self.accept()
 
         while self.tok != None:
-            self.exprs.append(self.get_expr())
+            self.exprs.append(self.get_expr(False))
 
     def accept(self):
         while True:
@@ -117,7 +117,7 @@ class QAPISchema:
             if self.tok != ':':
                 raise QAPISchemaError(self, 'Expected ":"')
             self.accept()
-            expr[key] = self.get_expr()
+            expr[key] = self.get_expr(True)
             if self.tok == '}':
                 self.accept()
                 return expr
@@ -135,7 +135,7 @@ class QAPISchema:
         if not self.tok in [ '{', '[', "'" ]:
             raise QAPISchemaError(self, 'Expected "{", "[", "]" or string')
         while True:
-            expr.append(self.get_expr())
+            expr.append(self.get_expr(True))
             if self.tok == ']':
                 self.accept()
                 return expr
@@ -143,7 +143,9 @@ class QAPISchema:
                 raise QAPISchemaError(self, 'Expected "," or "]"')
             self.accept()
 
-    def get_expr(self):
+    def get_expr(self, nested):
+        if self.tok != '{' and not nested:
+            raise QAPISchemaError(self, 'Expected "{"')
         if self.tok == '{':
             self.accept()
             expr = self.get_members()
diff --git a/tests/qapi-schema/non-objects.err b/tests/qapi-schema/non-objects.err
index 48c849d..a6c2dc2 100644
--- a/tests/qapi-schema/non-objects.err
+++ b/tests/qapi-schema/non-objects.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.AttributeError'>
+<stdin>:1:1: Expected "{"
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
index 48c849d..a6c2dc2 100644
--- a/tests/qapi-schema/quoted-structural-chars.err
+++ b/tests/qapi-schema/quoted-structural-chars.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.AttributeError'>
+<stdin>:1:1: Expected "{"
commit 6974ccd542d11ae5fb1e56dd3d753f2de5cc097e
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:58 2013 +0200

    qapi.py: Fix schema parser to check syntax systematically
    
    Fixes at least the following parser bugs:
    
    * accepts any token in place of a colon
    
    * treats comma as optional
    
    * crashes when closing braces or brackets are missing
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-7-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 0b48a1e..12fb29a 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -106,24 +106,42 @@ class QAPISchema:
 
     def get_members(self):
         expr = OrderedDict()
-        while self.tok != '}':
+        if self.tok == '}':
+            self.accept()
+            return expr
+        if self.tok != "'":
+            raise QAPISchemaError(self, 'Expected string or "}"')
+        while True:
             key = self.val
             self.accept()
-            self.accept()        # :
+            if self.tok != ':':
+                raise QAPISchemaError(self, 'Expected ":"')
+            self.accept()
             expr[key] = self.get_expr()
-            if self.tok == ',':
+            if self.tok == '}':
                 self.accept()
-        self.accept()
-        return expr
+                return expr
+            if self.tok != ',':
+                raise QAPISchemaError(self, 'Expected "," or "}"')
+            self.accept()
+            if self.tok != "'":
+                raise QAPISchemaError(self, 'Expected string')
 
     def get_values(self):
         expr = []
-        while self.tok != ']':
+        if self.tok == ']':
+            self.accept()
+            return expr
+        if not self.tok in [ '{', '[', "'" ]:
+            raise QAPISchemaError(self, 'Expected "{", "[", "]" or string')
+        while True:
             expr.append(self.get_expr())
-            if self.tok == ',':
+            if self.tok == ']':
                 self.accept()
-        self.accept()
-        return expr
+                return expr
+            if self.tok != ',':
+                raise QAPISchemaError(self, 'Expected "," or "]"')
+            self.accept()
 
     def get_expr(self):
         if self.tok == '{':
@@ -132,9 +150,11 @@ class QAPISchema:
         elif self.tok == '[':
             self.accept()
             expr = self.get_values()
-        else:
+        elif self.tok == "'":
             expr = self.val
             self.accept()
+        else:
+            raise QAPISchemaError(self, 'Expected "{", "[" or string')
         return expr
 
 def parse_schema(fp):
diff --git a/tests/qapi-schema/missing-colon.err b/tests/qapi-schema/missing-colon.err
index e69de29..9f2a355 100644
--- a/tests/qapi-schema/missing-colon.err
+++ b/tests/qapi-schema/missing-colon.err
@@ -0,0 +1 @@
+<stdin>:1:10: Expected ":"
diff --git a/tests/qapi-schema/missing-colon.exit b/tests/qapi-schema/missing-colon.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/missing-colon.exit
+++ b/tests/qapi-schema/missing-colon.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/missing-colon.out b/tests/qapi-schema/missing-colon.out
index e67068c..e69de29 100644
--- a/tests/qapi-schema/missing-colon.out
+++ b/tests/qapi-schema/missing-colon.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', None), ('data', ['good', 'bad', 'ugly'])])]
-[None]
-[]
diff --git a/tests/qapi-schema/missing-comma-list.err b/tests/qapi-schema/missing-comma-list.err
index e69de29..4fe0700 100644
--- a/tests/qapi-schema/missing-comma-list.err
+++ b/tests/qapi-schema/missing-comma-list.err
@@ -0,0 +1 @@
+<stdin>:2:20: Expected "," or "]"
diff --git a/tests/qapi-schema/missing-comma-list.exit b/tests/qapi-schema/missing-comma-list.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/missing-comma-list.exit
+++ b/tests/qapi-schema/missing-comma-list.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/missing-comma-list.out b/tests/qapi-schema/missing-comma-list.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/missing-comma-list.out
+++ b/tests/qapi-schema/missing-comma-list.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/missing-comma-object.err b/tests/qapi-schema/missing-comma-object.err
index e69de29..b0121b5 100644
--- a/tests/qapi-schema/missing-comma-object.err
+++ b/tests/qapi-schema/missing-comma-object.err
@@ -0,0 +1 @@
+<stdin>:2:3: Expected "," or "}"
diff --git a/tests/qapi-schema/missing-comma-object.exit b/tests/qapi-schema/missing-comma-object.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/missing-comma-object.exit
+++ b/tests/qapi-schema/missing-comma-object.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/missing-comma-object.out b/tests/qapi-schema/missing-comma-object.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/missing-comma-object.out
+++ b/tests/qapi-schema/missing-comma-object.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/trailing-comma-list.err b/tests/qapi-schema/trailing-comma-list.err
index e69de29..ff839a3 100644
--- a/tests/qapi-schema/trailing-comma-list.err
+++ b/tests/qapi-schema/trailing-comma-list.err
@@ -0,0 +1 @@
+<stdin>:2:36: Expected "{", "[" or string
diff --git a/tests/qapi-schema/trailing-comma-list.exit b/tests/qapi-schema/trailing-comma-list.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/trailing-comma-list.exit
+++ b/tests/qapi-schema/trailing-comma-list.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/trailing-comma-list.out b/tests/qapi-schema/trailing-comma-list.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/trailing-comma-list.out
+++ b/tests/qapi-schema/trailing-comma-list.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/trailing-comma-object.err b/tests/qapi-schema/trailing-comma-object.err
index e69de29..f540962 100644
--- a/tests/qapi-schema/trailing-comma-object.err
+++ b/tests/qapi-schema/trailing-comma-object.err
@@ -0,0 +1 @@
+<stdin>:2:38: Expected string
diff --git a/tests/qapi-schema/trailing-comma-object.exit b/tests/qapi-schema/trailing-comma-object.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/trailing-comma-object.exit
+++ b/tests/qapi-schema/trailing-comma-object.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/trailing-comma-object.out b/tests/qapi-schema/trailing-comma-object.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/trailing-comma-object.out
+++ b/tests/qapi-schema/trailing-comma-object.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/unclosed-list.err b/tests/qapi-schema/unclosed-list.err
index f9a9c2a..0e837a7 100644
--- a/tests/qapi-schema/unclosed-list.err
+++ b/tests/qapi-schema/unclosed-list.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.IndexError'>
+<stdin>:1:20: Expected "," or "]"
diff --git a/tests/qapi-schema/unclosed-object.err b/tests/qapi-schema/unclosed-object.err
index f9a9c2a..e6dc950 100644
--- a/tests/qapi-schema/unclosed-object.err
+++ b/tests/qapi-schema/unclosed-object.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.IndexError'>
+<stdin>:1:21: Expected "," or "}"
commit 9213aa5391f7c8d3766420d96888f1353af4c890
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:57 2013 +0200

    qapi.py: Reject invalid characters in schema file
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-6-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 342d16c..0b48a1e 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -101,6 +101,8 @@ class QAPISchema:
                 if self.cursor == len(self.src):
                     self.tok = None
                     return
+            elif not self.tok.isspace():
+                raise QAPISchemaError(self, 'Stray "%s"' % self.tok)
 
     def get_members(self):
         expr = OrderedDict()
diff --git a/tests/qapi-schema/comments.err b/tests/qapi-schema/comments.err
index e69de29..4a82b26 100644
--- a/tests/qapi-schema/comments.err
+++ b/tests/qapi-schema/comments.err
@@ -0,0 +1 @@
+<stdin>:2:33: Stray "#"
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/comments.exit
+++ b/tests/qapi-schema/comments.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/comments.out b/tests/qapi-schema/comments.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/comments.out
+++ b/tests/qapi-schema/comments.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/funny-char.err b/tests/qapi-schema/funny-char.err
index e69de29..d3dd293 100644
--- a/tests/qapi-schema/funny-char.err
+++ b/tests/qapi-schema/funny-char.err
@@ -0,0 +1 @@
+<stdin>:2:36: Stray ";"
diff --git a/tests/qapi-schema/funny-char.exit b/tests/qapi-schema/funny-char.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/funny-char.exit
+++ b/tests/qapi-schema/funny-char.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/funny-char.out b/tests/qapi-schema/funny-char.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/funny-char.out
+++ b/tests/qapi-schema/funny-char.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
commit 2caba36cc61ee3993334bc423f0852f8006fdfcf
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:56 2013 +0200

    qapi.py: Decent syntax error reporting
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-5-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 58e315b..342d16c 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -12,6 +12,7 @@
 # See the COPYING.LIB file in the top-level directory.
 
 from ordereddict import OrderedDict
+import sys
 
 builtin_types = [
     'str', 'int', 'number', 'bool',
@@ -34,6 +35,23 @@ builtin_type_qtypes = {
     'uint64':   'QTYPE_QINT',
 }
 
+class QAPISchemaError(Exception):
+    def __init__(self, schema, msg):
+        self.fp = schema.fp
+        self.msg = msg
+        self.line = self.col = 1
+        for ch in schema.src[0:schema.pos]:
+            if ch == '\n':
+                self.line += 1
+                self.col = 1
+            elif ch == '\t':
+                self.col = (self.col + 7) % 8 + 1
+            else:
+                self.col += 1
+
+    def __str__(self):
+        return "%s:%s:%s: %s" % (self.fp.name, self.line, self.col, self.msg)
+
 class QAPISchema:
 
     def __init__(self, fp):
@@ -52,6 +70,7 @@ class QAPISchema:
         while True:
             bol = self.cursor == 0 or self.src[self.cursor-1] == '\n'
             self.tok = self.src[self.cursor]
+            self.pos = self.cursor
             self.cursor += 1
             self.val = None
 
@@ -66,7 +85,8 @@ class QAPISchema:
                     ch = self.src[self.cursor]
                     self.cursor += 1
                     if ch == '\n':
-                        raise Exception("Mismatched quotes")
+                        raise QAPISchemaError(self,
+                                              'Missing terminating "\'"')
                     if esc:
                         string += ch
                         esc = False
@@ -116,7 +136,12 @@ class QAPISchema:
         return expr
 
 def parse_schema(fp):
-    schema = QAPISchema(fp)
+    try:
+        schema = QAPISchema(fp)
+    except QAPISchemaError as e:
+        print >>sys.stderr, e
+        exit(1)
+
     exprs = []
 
     for expr_eval in schema.exprs:
diff --git a/tests/qapi-schema/test-qapi.py b/tests/qapi-schema/test-qapi.py
index 3280eff..b3d1e1d 100644
--- a/tests/qapi-schema/test-qapi.py
+++ b/tests/qapi-schema/test-qapi.py
@@ -16,6 +16,8 @@ import sys
 
 try:
     exprs = parse_schema(sys.stdin)
+except SystemExit:
+    raise
 except:
     print >>sys.stderr, "Crashed:", sys.exc_info()[0]
     exit(1)
diff --git a/tests/qapi-schema/unclosed-string.err b/tests/qapi-schema/unclosed-string.err
index 5af46c2..948d883 100644
--- a/tests/qapi-schema/unclosed-string.err
+++ b/tests/qapi-schema/unclosed-string.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.Exception'>
+<stdin>:1:11: Missing terminating "'"
commit c7a3f25200c8692e969f21c7f2555630ec0d0d30
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:55 2013 +0200

    qapi.py: Restructure lexer and parser
    
    The parser has a rather unorthodox structure:
    
        Until EOF:
    
            Read a section:
    
                Generator function get_expr() yields one section after the
                other, as a string.  An unindented, non-empty line that
                isn't a comment starts a new section.
    
            Lexing:
    
                Split section into a list of tokens (strings), with help
                of generator function tokenize().
    
            Parsing:
    
                Parse the first expression from the list of tokens, with
                parse(), throw away any remaining tokens.
    
                In parse_schema(): record value of an enum, union or
                struct key (if any) in the appropriate global table,
                append expression to the list of expressions.
    
        Return list of expressions.
    
    Known issues:
    
    (1) Indentation is significant, unlike in real JSON.
    
    (2) Neither lexer nor parser have any idea of source positions.  Error
        reporting is hard, let's go shopping.
    
    (3) The one error we bother to detect, we "report" via raise.
    
    (4) The lexer silently ignores invalid characters.
    
    (5) If everything in a section gets ignored, the parser crashes.
    
    (6) The lexer treats a string containing a structural character exactly
        like the structural character.
    
    (7) Tokens trailing the first expression in a section are silently
        ignored.
    
    (8) The parser accepts any token in place of a colon.
    
    (9) The parser treats comma as optional.
    
    (10) parse() crashes on unexpected EOF.
    
    (11) parse_schema() crashes when a section's expression isn't a JSON
        object.
    
    Replace this piece of original art by a thoroughly unoriginal design.
    Takes care of (1), (2), (5), (6) and (7), and lays the groundwork for
    addressing the others.  Generated source files remain unchanged.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 38c808e..58e315b 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -2,9 +2,11 @@
 # QAPI helper library
 #
 # Copyright IBM, Corp. 2011
+# Copyright (c) 2013 Red Hat Inc.
 #
 # Authors:
 #  Anthony Liguori <aliguori at us.ibm.com>
+#  Markus Armbruster <armbru at redhat.com>
 #
 # This work is licensed under the terms of the GNU GPLv2.
 # See the COPYING.LIB file in the top-level directory.
@@ -32,91 +34,92 @@ builtin_type_qtypes = {
     'uint64':   'QTYPE_QINT',
 }
 
-def tokenize(data):
-    while len(data):
-        ch = data[0]
-        data = data[1:]
-        if ch in ['{', '}', ':', ',', '[', ']']:
-            yield ch
-        elif ch in ' \n':
-            None
-        elif ch == "'":
-            string = ''
-            esc = False
-            while True:
-                if (data == ''):
-                    raise Exception("Mismatched quotes")
-                ch = data[0]
-                data = data[1:]
-                if esc:
-                    string += ch
-                    esc = False
-                elif ch == "\\":
-                    esc = True
-                elif ch == "'":
-                    break
-                else:
-                    string += ch
-            yield string
-
-def parse(tokens):
-    if tokens[0] == '{':
-        ret = OrderedDict()
-        tokens = tokens[1:]
-        while tokens[0] != '}':
-            key = tokens[0]
-            tokens = tokens[1:]
-
-            tokens = tokens[1:] # :
-
-            value, tokens = parse(tokens)
-
-            if tokens[0] == ',':
-                tokens = tokens[1:]
-
-            ret[key] = value
-        tokens = tokens[1:]
-        return ret, tokens
-    elif tokens[0] == '[':
-        ret = []
-        tokens = tokens[1:]
-        while tokens[0] != ']':
-            value, tokens = parse(tokens)
-            if tokens[0] == ',':
-                tokens = tokens[1:]
-            ret.append(value)
-        tokens = tokens[1:]
-        return ret, tokens
-    else:
-        return tokens[0], tokens[1:]
-
-def evaluate(string):
-    return parse(map(lambda x: x, tokenize(string)))[0]
-
-def get_expr(fp):
-    expr = ''
-
-    for line in fp:
-        if line.startswith('#') or line == '\n':
-            continue
-
-        if line.startswith(' '):
-            expr += line
-        elif expr:
-            yield expr
-            expr = line
+class QAPISchema:
+
+    def __init__(self, fp):
+        self.fp = fp
+        self.src = fp.read()
+        if self.src == '' or self.src[-1] != '\n':
+            self.src += '\n'
+        self.cursor = 0
+        self.exprs = []
+        self.accept()
+
+        while self.tok != None:
+            self.exprs.append(self.get_expr())
+
+    def accept(self):
+        while True:
+            bol = self.cursor == 0 or self.src[self.cursor-1] == '\n'
+            self.tok = self.src[self.cursor]
+            self.cursor += 1
+            self.val = None
+
+            if self.tok == '#' and bol:
+                self.cursor = self.src.find('\n', self.cursor)
+            elif self.tok in ['{', '}', ':', ',', '[', ']']:
+                return
+            elif self.tok == "'":
+                string = ''
+                esc = False
+                while True:
+                    ch = self.src[self.cursor]
+                    self.cursor += 1
+                    if ch == '\n':
+                        raise Exception("Mismatched quotes")
+                    if esc:
+                        string += ch
+                        esc = False
+                    elif ch == "\\":
+                        esc = True
+                    elif ch == "'":
+                        self.val = string
+                        return
+                    else:
+                        string += ch
+            elif self.tok == '\n':
+                if self.cursor == len(self.src):
+                    self.tok = None
+                    return
+
+    def get_members(self):
+        expr = OrderedDict()
+        while self.tok != '}':
+            key = self.val
+            self.accept()
+            self.accept()        # :
+            expr[key] = self.get_expr()
+            if self.tok == ',':
+                self.accept()
+        self.accept()
+        return expr
+
+    def get_values(self):
+        expr = []
+        while self.tok != ']':
+            expr.append(self.get_expr())
+            if self.tok == ',':
+                self.accept()
+        self.accept()
+        return expr
+
+    def get_expr(self):
+        if self.tok == '{':
+            self.accept()
+            expr = self.get_members()
+        elif self.tok == '[':
+            self.accept()
+            expr = self.get_values()
         else:
-            expr += line
-
-    if expr:
-        yield expr
+            expr = self.val
+            self.accept()
+        return expr
 
 def parse_schema(fp):
+    schema = QAPISchema(fp)
     exprs = []
 
-    for expr in get_expr(fp):
-        expr_eval = evaluate(expr)
-
+    for expr_eval in schema.exprs:
         if expr_eval.has_key('enum'):
             add_enum(expr_eval['enum'])
         elif expr_eval.has_key('union'):
diff --git a/tests/qapi-schema/indented-expr.out b/tests/qapi-schema/indented-expr.out
index 98ae692..98af89a 100644
--- a/tests/qapi-schema/indented-expr.out
+++ b/tests/qapi-schema/indented-expr.out
@@ -1,3 +1,3 @@
-[OrderedDict([('id', 'eins')])]
+[OrderedDict([('id', 'eins')]), OrderedDict([('id', 'zwei')])]
 []
 []
diff --git a/tests/qapi-schema/missing-colon.out b/tests/qapi-schema/missing-colon.out
index 50f827e..e67068c 100644
--- a/tests/qapi-schema/missing-colon.out
+++ b/tests/qapi-schema/missing-colon.out
@@ -1,3 +1,3 @@
-[OrderedDict([('enum', ','), ('data', ['good', 'bad', 'ugly'])])]
-[',']
+[OrderedDict([('enum', None), ('data', ['good', 'bad', 'ugly'])])]
+[None]
 []
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
index e69de29..48c849d 100644
--- a/tests/qapi-schema/quoted-structural-chars.err
+++ b/tests/qapi-schema/quoted-structural-chars.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.AttributeError'>
diff --git a/tests/qapi-schema/quoted-structural-chars.exit b/tests/qapi-schema/quoted-structural-chars.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/quoted-structural-chars.exit
+++ b/tests/qapi-schema/quoted-structural-chars.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/quoted-structural-chars.out b/tests/qapi-schema/quoted-structural-chars.out
index 85405be..e69de29 100644
--- a/tests/qapi-schema/quoted-structural-chars.out
+++ b/tests/qapi-schema/quoted-structural-chars.out
@@ -1,3 +0,0 @@
-[OrderedDict([('key1', 'value1'), ('key2', [])])]
-[]
-[]
commit 4f193e34c6c41abdd06c134e584312077def2bda
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:54 2013 +0200

    tests: Use qapi-schema-test.json as schema parser test
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema-test.json b/qapi-schema-test.json
deleted file mode 100644
index 4434fa3..0000000
--- a/qapi-schema-test.json
+++ /dev/null
@@ -1,53 +0,0 @@
-# *-*- Mode: Python -*-*
-
-# for testing enums
-{ 'enum': 'EnumOne',
-  'data': [ 'value1', 'value2', 'value3' ] }
-{ 'type': 'NestedEnumsOne',
-  'data': { 'enum1': 'EnumOne', '*enum2': 'EnumOne', 'enum3': 'EnumOne', '*enum4': 'EnumOne' } }
-
-# for testing nested structs
-{ 'type': 'UserDefOne',
-  'data': { 'integer': 'int', 'string': 'str', '*enum1': 'EnumOne' } }
-
-{ 'type': 'UserDefTwo',
-  'data': { 'string': 'str',
-            'dict': { 'string': 'str',
-                      'dict': { 'userdef': 'UserDefOne', 'string': 'str' },
-                      '*dict2': { 'userdef': 'UserDefOne', 'string': 'str' } } } }
-
-{ 'type': 'UserDefNested',
-  'data': { 'string0': 'str',
-            'dict1': { 'string1': 'str',
-                       'dict2': { 'userdef1': 'UserDefOne', 'string2': 'str' },
-                       '*dict3': { 'userdef2': 'UserDefOne', 'string3': 'str' } } } }
-
-# for testing unions
-{ 'type': 'UserDefA',
-  'data': { 'boolean': 'bool' } }
-
-{ 'type': 'UserDefB',
-  'data': { 'integer': 'int' } }
-
-{ 'union': 'UserDefUnion',
-  'data': { 'a' : 'UserDefA', 'b' : 'UserDefB' } }
-
-# for testing native lists
-{ 'union': 'UserDefNativeListUnion',
-  'data': { 'integer': ['int'],
-            's8': ['int8'],
-            's16': ['int16'],
-            's32': ['int32'],
-            's64': ['int64'],
-            'u8': ['uint8'],
-            'u16': ['uint16'],
-            'u32': ['uint32'],
-            'u64': ['uint64'],
-            'number': ['number'],
-            'boolean': ['bool'],
-            'string': ['str'] } }
-
-# testing commands
-{ 'command': 'user_def_cmd', 'data': {} }
-{ 'command': 'user_def_cmd1', 'data': {'ud1a': 'UserDefOne'} }
-{ 'command': 'user_def_cmd2', 'data': {'ud1a': 'UserDefOne', 'ud1b': 'UserDefOne'}, 'returns': 'UserDefTwo' }
diff --git a/tests/Makefile b/tests/Makefile
index ddb957c..d044908 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -87,7 +87,7 @@ check-qapi-schema-y := $(addprefix tests/qapi-schema/, \
         comments.json empty.json funny-char.json indented-expr.json \
         missing-colon.json missing-comma-list.json \
         missing-comma-object.json non-objects.json \
-        quoted-structural-chars.json \
+        qapi-schema-test.json quoted-structural-chars.json \
         trailing-comma-list.json trailing-comma-object.json \
         unclosed-list.json unclosed-object.json unclosed-string.json)
 
@@ -125,13 +125,13 @@ tests/test-cutils$(EXESUF): tests/test-cutils.o util/cutils.o
 tests/test-int128$(EXESUF): tests/test-int128.o
 
 tests/test-qapi-types.c tests/test-qapi-types.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 tests/test-qapi-visit.c tests/test-qapi-visit.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 tests/test-qmp-commands.h tests/test-qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 
 tests/test-string-output-visitor$(EXESUF): tests/test-string-output-visitor.o $(test-qapi-obj-y) libqemuutil.a libqemustub.a
diff --git a/tests/qapi-schema/qapi-schema-test.err b/tests/qapi-schema/qapi-schema-test.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/qapi-schema-test.exit b/tests/qapi-schema/qapi-schema-test.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/qapi-schema-test.json b/tests/qapi-schema/qapi-schema-test.json
new file mode 100644
index 0000000..4434fa3
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.json
@@ -0,0 +1,53 @@
+# *-*- Mode: Python -*-*
+
+# for testing enums
+{ 'enum': 'EnumOne',
+  'data': [ 'value1', 'value2', 'value3' ] }
+{ 'type': 'NestedEnumsOne',
+  'data': { 'enum1': 'EnumOne', '*enum2': 'EnumOne', 'enum3': 'EnumOne', '*enum4': 'EnumOne' } }
+
+# for testing nested structs
+{ 'type': 'UserDefOne',
+  'data': { 'integer': 'int', 'string': 'str', '*enum1': 'EnumOne' } }
+
+{ 'type': 'UserDefTwo',
+  'data': { 'string': 'str',
+            'dict': { 'string': 'str',
+                      'dict': { 'userdef': 'UserDefOne', 'string': 'str' },
+                      '*dict2': { 'userdef': 'UserDefOne', 'string': 'str' } } } }
+
+{ 'type': 'UserDefNested',
+  'data': { 'string0': 'str',
+            'dict1': { 'string1': 'str',
+                       'dict2': { 'userdef1': 'UserDefOne', 'string2': 'str' },
+                       '*dict3': { 'userdef2': 'UserDefOne', 'string3': 'str' } } } }
+
+# for testing unions
+{ 'type': 'UserDefA',
+  'data': { 'boolean': 'bool' } }
+
+{ 'type': 'UserDefB',
+  'data': { 'integer': 'int' } }
+
+{ 'union': 'UserDefUnion',
+  'data': { 'a' : 'UserDefA', 'b' : 'UserDefB' } }
+
+# for testing native lists
+{ 'union': 'UserDefNativeListUnion',
+  'data': { 'integer': ['int'],
+            's8': ['int8'],
+            's16': ['int16'],
+            's32': ['int32'],
+            's64': ['int64'],
+            'u8': ['uint8'],
+            'u16': ['uint16'],
+            'u32': ['uint32'],
+            'u64': ['uint64'],
+            'number': ['number'],
+            'boolean': ['bool'],
+            'string': ['str'] } }
+
+# testing commands
+{ 'command': 'user_def_cmd', 'data': {} }
+{ 'command': 'user_def_cmd1', 'data': {'ud1a': 'UserDefOne'} }
+{ 'command': 'user_def_cmd2', 'data': {'ud1a': 'UserDefOne', 'ud1b': 'UserDefOne'}, 'returns': 'UserDefTwo' }
diff --git a/tests/qapi-schema/qapi-schema-test.out b/tests/qapi-schema/qapi-schema-test.out
new file mode 100644
index 0000000..fb00344
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.out
@@ -0,0 +1,19 @@
+[OrderedDict([('enum', 'EnumOne'), ('data', ['value1', 'value2', 'value3'])]),
+ OrderedDict([('type', 'NestedEnumsOne'), ('data', OrderedDict([('enum1', 'EnumOne'), ('*enum2', 'EnumOne'), ('enum3', 'EnumOne'), ('*enum4', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefOne'), ('data', OrderedDict([('integer', 'int'), ('string', 'str'), ('*enum1', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefTwo'), ('data', OrderedDict([('string', 'str'), ('dict', OrderedDict([('string', 'str'), ('dict', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')])), ('*dict2', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefNested'), ('data', OrderedDict([('string0', 'str'), ('dict1', OrderedDict([('string1', 'str'), ('dict2', OrderedDict([('userdef1', 'UserDefOne'), ('string2', 'str')])), ('*dict3', OrderedDict([('userdef2', 'UserDefOne'), ('string3', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefA'), ('data', OrderedDict([('boolean', 'bool')]))]),
+ OrderedDict([('type', 'UserDefB'), ('data', OrderedDict([('integer', 'int')]))]),
+ OrderedDict([('union', 'UserDefUnion'), ('data', OrderedDict([('a', 'UserDefA'), ('b', 'UserDefB')]))]),
+ OrderedDict([('union', 'UserDefNativeListUnion'), ('data', OrderedDict([('integer', ['int']), ('s8', ['int8']), ('s16', ['int16']), ('s32', ['int32']), ('s64', ['int64']), ('u8', ['uint8']), ('u16', ['uint16']), ('u32', ['uint32']), ('u64', ['uint64']), ('number', ['number']), ('boolean', ['bool']), ('string', ['str'])]))]),
+ OrderedDict([('command', 'user_def_cmd'), ('data', OrderedDict())]),
+ OrderedDict([('command', 'user_def_cmd1'), ('data', OrderedDict([('ud1a', 'UserDefOne')]))]),
+ OrderedDict([('command', 'user_def_cmd2'), ('data', OrderedDict([('ud1a', 'UserDefOne'), ('ud1b', 'UserDefOne')])), ('returns', 'UserDefTwo')])]
+['EnumOne', 'UserDefUnionKind', 'UserDefNativeListUnionKind']
+[OrderedDict([('type', 'NestedEnumsOne'), ('data', OrderedDict([('enum1', 'EnumOne'), ('*enum2', 'EnumOne'), ('enum3', 'EnumOne'), ('*enum4', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefOne'), ('data', OrderedDict([('integer', 'int'), ('string', 'str'), ('*enum1', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefTwo'), ('data', OrderedDict([('string', 'str'), ('dict', OrderedDict([('string', 'str'), ('dict', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')])), ('*dict2', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefNested'), ('data', OrderedDict([('string0', 'str'), ('dict1', OrderedDict([('string1', 'str'), ('dict2', OrderedDict([('userdef1', 'UserDefOne'), ('string2', 'str')])), ('*dict3', OrderedDict([('userdef2', 'UserDefOne'), ('string3', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefA'), ('data', OrderedDict([('boolean', 'bool')]))]),
+ OrderedDict([('type', 'UserDefB'), ('data', OrderedDict([('integer', 'int')]))])]
commit 98626572f18ddc61c08588c32a1773bc91f8624e
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:53 2013 +0200

    tests: QAPI schema parser tests
    
    The parser handles erroneous input badly.  To be improved shortly.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1374939721-7876-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/configure b/configure
index 1c0cc81..f0761ea 100755
--- a/configure
+++ b/configure
@@ -4502,7 +4502,7 @@ if [ "$dtc_internal" = "yes" ]; then
 fi
 
 # build tree in object directory in case the source is not in the current directory
-DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/libqos"
+DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/libqos tests/qapi-schema"
 DIRS="$DIRS pc-bios/optionrom pc-bios/spapr-rtas pc-bios/s390-ccw"
 DIRS="$DIRS roms/seabios roms/vgabios"
 DIRS="$DIRS qapi-generated"
diff --git a/tests/Makefile b/tests/Makefile
index cdbb79e..ddb957c 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -83,6 +83,14 @@ gcov-files-arm-y += hw/tmp105.c
 check-qtest-ppc-y += tests/boot-order-test$(EXESUF)
 check-qtest-ppc64-y += tests/boot-order-test$(EXESUF)
 
+check-qapi-schema-y := $(addprefix tests/qapi-schema/, \
+        comments.json empty.json funny-char.json indented-expr.json \
+        missing-colon.json missing-comma-list.json \
+        missing-comma-object.json non-objects.json \
+        quoted-structural-chars.json \
+        trailing-comma-list.json trailing-comma-object.json \
+        unclosed-list.json unclosed-object.json unclosed-string.json)
+
 GENERATED_HEADERS += tests/test-qapi-types.h tests/test-qapi-visit.h tests/test-qmp-commands.h
 
 test-obj-y = tests/check-qint.o tests/check-qstring.o tests/check-qdict.o \
@@ -171,6 +179,7 @@ check-help:
 	@echo " make check-qtest-TARGET   Run qtest tests for given target"
 	@echo " make check-qtest          Run qtest tests"
 	@echo " make check-unit           Run qobject tests"
+	@echo " make check-qapi-schema    Run QAPI schema tests"
 	@echo " make check-block          Run block tests"
 	@echo " make check-report.html    Generates an HTML test report"
 	@echo
@@ -233,13 +242,24 @@ check-report.html: check-report.xml
 check-tests/qemu-iotests-quick.sh: tests/qemu-iotests-quick.sh qemu-img$(EXESUF) qemu-io$(EXESUF)
 	$<
 
+.PHONY: check-tests/test-qapi.py
+check-tests/test-qapi.py: tests/test-qapi.py
+
+.PHONY: $(patsubst %, check-%, $(check-qapi-schema-y))
+$(patsubst %, check-%, $(check-qapi-schema-y)): check-%.json: $(SRC_PATH)/%.json
+	$(call quiet-command, PYTHONPATH=$(SRC_PATH)/scripts $(PYTHON) $(SRC_PATH)/tests/qapi-schema/test-qapi.py <$^ >$*.out 2>$*.err; echo $$? >$*.exit, "  TEST  $*.out")
+	@diff -q $(SRC_PATH)/$*.out $*.out
+	@diff -q $(SRC_PATH)/$*.err $*.err
+	@diff -q $(SRC_PATH)/$*.exit $*.exit
+
 # Consolidated targets
 
-.PHONY: check-qtest check-unit check
+.PHONY: check-qapi-schema check-qtest check-unit check
+check-qapi-schema: $(patsubst %,check-%, $(check-qapi-schema-y))
 check-qtest: $(patsubst %,check-qtest-%, $(QTEST_TARGETS))
 check-unit: $(patsubst %,check-%, $(check-unit-y))
 check-block: $(patsubst %,check-%, $(check-block-y))
-check: check-unit check-qtest
+check: check-qapi-schema check-unit check-qtest
 
 -include $(wildcard tests/*.d)
 -include $(wildcard tests/libqos/*.d)
diff --git a/tests/qapi-schema/comments.err b/tests/qapi-schema/comments.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/comments.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/comments.json b/tests/qapi-schema/comments.json
new file mode 100644
index 0000000..e643f3a
--- /dev/null
+++ b/tests/qapi-schema/comments.json
@@ -0,0 +1,4 @@
+# Unindented comment
+{ 'enum': 'Status',             # Comment to the right of code
+  # Indented comment
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/comments.out b/tests/qapi-schema/comments.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/comments.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/empty.err b/tests/qapi-schema/empty.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/empty.exit b/tests/qapi-schema/empty.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/empty.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/empty.json b/tests/qapi-schema/empty.json
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/empty.out b/tests/qapi-schema/empty.out
new file mode 100644
index 0000000..b7f89a4
--- /dev/null
+++ b/tests/qapi-schema/empty.out
@@ -0,0 +1,3 @@
+[]
+[]
+[]
diff --git a/tests/qapi-schema/funny-char.err b/tests/qapi-schema/funny-char.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/funny-char.exit b/tests/qapi-schema/funny-char.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/funny-char.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/funny-char.json b/tests/qapi-schema/funny-char.json
new file mode 100644
index 0000000..d4973a2
--- /dev/null
+++ b/tests/qapi-schema/funny-char.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly' ]; }
diff --git a/tests/qapi-schema/funny-char.out b/tests/qapi-schema/funny-char.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/funny-char.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/indented-expr.err b/tests/qapi-schema/indented-expr.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/indented-expr.exit b/tests/qapi-schema/indented-expr.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/indented-expr.json b/tests/qapi-schema/indented-expr.json
new file mode 100644
index 0000000..d80af60
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.json
@@ -0,0 +1,2 @@
+{ 'id' : 'eins' }
+ { 'id' : 'zwei' }
diff --git a/tests/qapi-schema/indented-expr.out b/tests/qapi-schema/indented-expr.out
new file mode 100644
index 0000000..98ae692
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.out
@@ -0,0 +1,3 @@
+[OrderedDict([('id', 'eins')])]
+[]
+[]
diff --git a/tests/qapi-schema/missing-colon.err b/tests/qapi-schema/missing-colon.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/missing-colon.exit b/tests/qapi-schema/missing-colon.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/missing-colon.json b/tests/qapi-schema/missing-colon.json
new file mode 100644
index 0000000..6fc27ce
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.json
@@ -0,0 +1,2 @@
+{ 'enum' 'Status',
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-colon.out b/tests/qapi-schema/missing-colon.out
new file mode 100644
index 0000000..50f827e
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', ','), ('data', ['good', 'bad', 'ugly'])])]
+[',']
+[]
diff --git a/tests/qapi-schema/missing-comma-list.err b/tests/qapi-schema/missing-comma-list.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/missing-comma-list.exit b/tests/qapi-schema/missing-comma-list.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/missing-comma-list.json b/tests/qapi-schema/missing-comma-list.json
new file mode 100644
index 0000000..1af39b2
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good' 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-comma-list.out b/tests/qapi-schema/missing-comma-list.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/missing-comma-object.err b/tests/qapi-schema/missing-comma-object.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/missing-comma-object.exit b/tests/qapi-schema/missing-comma-object.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/missing-comma-object.json b/tests/qapi-schema/missing-comma-object.json
new file mode 100644
index 0000000..50f5178
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status'
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-comma-object.out b/tests/qapi-schema/missing-comma-object.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/non-objects.err b/tests/qapi-schema/non-objects.err
new file mode 100644
index 0000000..48c849d
--- /dev/null
+++ b/tests/qapi-schema/non-objects.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.AttributeError'>
diff --git a/tests/qapi-schema/non-objects.exit b/tests/qapi-schema/non-objects.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/non-objects.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/non-objects.json b/tests/qapi-schema/non-objects.json
new file mode 100644
index 0000000..f3fa851
--- /dev/null
+++ b/tests/qapi-schema/non-objects.json
@@ -0,0 +1,2 @@
+'string'
+[ ]
diff --git a/tests/qapi-schema/non-objects.out b/tests/qapi-schema/non-objects.out
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/quoted-structural-chars.exit b/tests/qapi-schema/quoted-structural-chars.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/quoted-structural-chars.json b/tests/qapi-schema/quoted-structural-chars.json
new file mode 100644
index 0000000..9fe657a
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.json
@@ -0,0 +1 @@
+'{' 'key1' ':' 'value1' ',' 'key2' ':' '[' ']' '}'
diff --git a/tests/qapi-schema/quoted-structural-chars.out b/tests/qapi-schema/quoted-structural-chars.out
new file mode 100644
index 0000000..85405be
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.out
@@ -0,0 +1,3 @@
+[OrderedDict([('key1', 'value1'), ('key2', [])])]
+[]
+[]
diff --git a/tests/qapi-schema/test-qapi.py b/tests/qapi-schema/test-qapi.py
new file mode 100644
index 0000000..3280eff
--- /dev/null
+++ b/tests/qapi-schema/test-qapi.py
@@ -0,0 +1,25 @@
+#
+# QAPI parser test harness
+#
+# Copyright (c) 2013 Red Hat Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru at redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or later.
+# See the COPYING file in the top-level directory.
+#
+
+from qapi import *
+from pprint import pprint
+import sys
+
+try:
+    exprs = parse_schema(sys.stdin)
+except:
+    print >>sys.stderr, "Crashed:", sys.exc_info()[0]
+    exit(1)
+
+pprint(exprs)
+pprint(enum_types)
+pprint(struct_types)
diff --git a/tests/qapi-schema/trailing-comma-list.err b/tests/qapi-schema/trailing-comma-list.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/trailing-comma-list.exit b/tests/qapi-schema/trailing-comma-list.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/trailing-comma-list.json b/tests/qapi-schema/trailing-comma-list.json
new file mode 100644
index 0000000..9b0c8bd
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly', ] }
diff --git a/tests/qapi-schema/trailing-comma-list.out b/tests/qapi-schema/trailing-comma-list.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/trailing-comma-object.err b/tests/qapi-schema/trailing-comma-object.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/trailing-comma-object.exit b/tests/qapi-schema/trailing-comma-object.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/trailing-comma-object.json b/tests/qapi-schema/trailing-comma-object.json
new file mode 100644
index 0000000..bbaea55
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly' ], }
diff --git a/tests/qapi-schema/trailing-comma-object.out b/tests/qapi-schema/trailing-comma-object.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/unclosed-list.err b/tests/qapi-schema/unclosed-list.err
new file mode 100644
index 0000000..f9a9c2a
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.IndexError'>
diff --git a/tests/qapi-schema/unclosed-list.exit b/tests/qapi-schema/unclosed-list.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-list.json b/tests/qapi-schema/unclosed-list.json
new file mode 100644
index 0000000..e3e9566
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.json
@@ -0,0 +1 @@
+{ 'key': [ 'value' }
diff --git a/tests/qapi-schema/unclosed-list.out b/tests/qapi-schema/unclosed-list.out
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/unclosed-object.err b/tests/qapi-schema/unclosed-object.err
new file mode 100644
index 0000000..f9a9c2a
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.IndexError'>
diff --git a/tests/qapi-schema/unclosed-object.exit b/tests/qapi-schema/unclosed-object.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-object.json b/tests/qapi-schema/unclosed-object.json
new file mode 100644
index 0000000..8ac069d
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.json
@@ -0,0 +1 @@
+{ 'key': [ 'value' ]
diff --git a/tests/qapi-schema/unclosed-object.out b/tests/qapi-schema/unclosed-object.out
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/unclosed-string.err b/tests/qapi-schema/unclosed-string.err
new file mode 100644
index 0000000..5af46c2
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.Exception'>
diff --git a/tests/qapi-schema/unclosed-string.exit b/tests/qapi-schema/unclosed-string.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-string.json b/tests/qapi-schema/unclosed-string.json
new file mode 100644
index 0000000..8c16b6b
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.json
@@ -0,0 +1,2 @@
+{ 'text': 'lorem ips
+}
diff --git a/tests/qapi-schema/unclosed-string.out b/tests/qapi-schema/unclosed-string.out
new file mode 100644
index 0000000..e69de29
commit 55d5d04884305e17b24f378a9ec616bf7354c1ca
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Sun Jul 28 14:57:22 2013 +0200

    memory: add tracepoints for MMIO reads/writes
    
    This is quite handy to debug softmmu targets.
    
    Reviewed-by: Andreas Faerber <afaerber at suse.de>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1375016242-32651-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/memory.c b/memory.c
index 1494e95..ac6f3c6 100644
--- a/memory.c
+++ b/memory.c
@@ -19,6 +19,7 @@
 #include "qemu/bitops.h"
 #include "qom/object.h"
 #include "sysemu/kvm.h"
+#include "trace.h"
 #include <assert.h>
 
 #include "exec/memory-internal.h"
@@ -388,6 +389,7 @@ static void memory_region_oldmmio_read_accessor(MemoryRegion *mr,
     uint64_t tmp;
 
     tmp = mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr);
+    trace_memory_region_ops_read(mr, addr, tmp, size);
     *value |= (tmp & mask) << shift;
 }
 
@@ -404,6 +406,7 @@ static void memory_region_read_accessor(MemoryRegion *mr,
         qemu_flush_coalesced_mmio_buffer();
     }
     tmp = mr->ops->read(mr->opaque, addr, size);
+    trace_memory_region_ops_read(mr, addr, tmp, size);
     *value |= (tmp & mask) << shift;
 }
 
@@ -417,6 +420,7 @@ static void memory_region_oldmmio_write_accessor(MemoryRegion *mr,
     uint64_t tmp;
 
     tmp = (*value >> shift) & mask;
+    trace_memory_region_ops_write(mr, addr, tmp, size);
     mr->ops->old_mmio.write[ctz32(size)](mr->opaque, addr, tmp);
 }
 
@@ -433,6 +437,7 @@ static void memory_region_write_accessor(MemoryRegion *mr,
         qemu_flush_coalesced_mmio_buffer();
     }
     tmp = (*value >> shift) & mask;
+    trace_memory_region_ops_write(mr, addr, tmp, size);
     mr->ops->write(mr->opaque, addr, tmp, size);
 }
 
diff --git a/trace-events b/trace-events
index 0f7c8b4..3856b5c 100644
--- a/trace-events
+++ b/trace-events
@@ -1165,6 +1165,10 @@ kvm_vm_ioctl(int type, void *arg) "type %d, arg %p"
 kvm_vcpu_ioctl(int cpu_index, int type, void *arg) "cpu_index %d, type %d, arg %p"
 kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
 
+# memory.c
+memory_region_ops_read(void *mr, uint64_t addr, uint64_t value, unsigned size) "mr %p addr %#"PRIx64" value %#"PRIx64" size %u"
+memory_region_ops_write(void *mr, uint64_t addr, uint64_t value, unsigned size) "mr %p addr %#"PRIx64" value %#"PRIx64" size %u"
+
 # qom/object.c
 object_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
 object_class_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
commit 8cdd2e0abbf593a38a146d8dfc998754cefbc27a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 12:22:11 2013 +0100

    tpm.c: Don't try to put -1 in a variable of type TpmModel
    
    The TpmModel type is an enum (valid values 0 and 1), which means
    the compiler can legitimately decide that comparisons like
    'tpm_models[i] == -1' are never true. (For example it could
    pick 'unsigned char' as its type for representing the enum.)
    
    Avoid this issue by using TPM_MODEL_MAX to mark entries in
    the tpm_models[] array which aren't filled in, instead of -1.
    
    This silences a clang warning:
    
     tpm.c:43:27: error: comparison of constant -1 with expression of type
          'enum TpmModel' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
            if (tpm_models[i] == -1) {
                ~~~~~~~~~~~~~ ^  ~~
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375096931-13842-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tpm.c b/tpm.c
index f13c9bc..d68d69f 100644
--- a/tpm.c
+++ b/tpm.c
@@ -32,7 +32,7 @@ static TPMDriverOps const *be_drivers[TPM_MAX_DRIVERS] = {
 };
 
 static enum TpmModel tpm_models[TPM_MAX_MODELS] = {
-    -1,
+    TPM_MODEL_MAX,
 };
 
 int tpm_register_model(enum TpmModel model)
@@ -40,7 +40,7 @@ int tpm_register_model(enum TpmModel model)
     int i;
 
     for (i = 0; i < TPM_MAX_MODELS; i++) {
-        if (tpm_models[i] == -1) {
+        if (tpm_models[i] == TPM_MODEL_MAX) {
             tpm_models[i] = model;
             return 0;
         }
commit 125ee0ed9cad04307498ac2b7b0d51ad8a807360
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Mon Jul 29 17:17:45 2013 +0300

    devices: Associate devices to their logical category
    
    The category will be used to sort the devices displayed in
    the command line help.
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Message-id: 1375107465-25767-4-git-send-email-marcel.a at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index 35e2af4..de6f0fe 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -149,6 +149,7 @@ static void virtio_9p_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->props = virtio_9p_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_9p_device_init;
     vdc->get_features = virtio_9p_get_features;
     vdc->get_config = virtio_9p_get_config;
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 365b2f1..01b4dfb 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1420,6 +1420,7 @@ static void ac97_class_init (ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82801AA_5;
     k->revision = 0x01;
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel 82801AA AC97 Audio";
     dc->vmsd = &vmstate_ac97;
     dc->props = ac97_properties;
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index f72e6ee..0421d47 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -364,6 +364,7 @@ static void adlib_class_initfn (ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = adlib_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = ADLIB_DESC;
     dc->props = adlib_properties;
 }
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 7365c3c..666096b 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -685,6 +685,7 @@ static void cs4231a_class_initfn (ObjectClass *klass, void *data)
 
     dc->realize = cs4231a_realizefn;
     dc->reset = cs4231a_reset;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Crystal Semiconductor CS4231A";
     dc->vmsd = &vmstate_cs4231a;
     dc->props = cs4231a_properties;
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index f2c40da..adb66ce 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -1069,6 +1069,7 @@ static void es1370_class_init (ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
     k->subsystem_vendor_id = 0x4942;
     k->subsystem_id = 0x4c4c;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "ENSONIQ AudioPCI ES1370";
     dc->vmsd = &vmstate_es1370;
 }
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index f45ed0b..71be3c6 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -315,6 +315,7 @@ static void gus_class_initfn (ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = gus_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Gravis Ultrasound GF1";
     dc->vmsd = &vmstate_gus;
     dc->props = gus_properties;
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index 362d8c0..9550c97 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -1034,6 +1034,7 @@ static void hda_audio_output_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, output-only (line-out)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
@@ -1055,6 +1056,7 @@ static void hda_audio_duplex_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, duplex (line-out, line-in)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
@@ -1076,6 +1078,7 @@ static void hda_audio_micro_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, duplex (speaker, microphone)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 58984dc..32e44ad 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1258,6 +1258,7 @@ static void intel_hda_class_init_ich6(ObjectClass *klass, void *data)
 
     k->device_id = 0x2668;
     k->revision = 1;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel HD Audio Controller (ich6)";
 }
 
@@ -1268,6 +1269,7 @@ static void intel_hda_class_init_ich9(ObjectClass *klass, void *data)
 
     k->device_id = 0x293e;
     k->revision = 3;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel HD Audio Controller (ich9)";
 }
 
@@ -1296,6 +1298,7 @@ static void hda_codec_device_class_init(ObjectClass *klass, void *data)
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = hda_codec_dev_init;
     k->exit = hda_codec_dev_exit;
+    set_bit(DEVICE_CATEGORY_SOUND, k->categories);
     k->bus_type = TYPE_HDA_BUS;
     k->props = hda_props;
 }
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 7ad59a1..9004ce3 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -191,6 +191,7 @@ static void pcspk_class_initfn(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = pcspk_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->no_user = 1;
     dc->props = pcspk_properties;
 }
diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index 7d331b9..b66d6d2 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -626,6 +626,7 @@ static void pl041_device_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl041_init;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->no_user = 1;
     dc->reset = pl041_device_reset;
     dc->vmsd = &vmstate_pl041;
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index e697bc1..3e58688 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -1412,6 +1412,7 @@ static void sb16_class_initfn (ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = sb16_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Creative Sound Blaster 16";
     dc->vmsd = &vmstate_sb16;
     dc->props = sb16_properties;
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index d32f6ba..50a350f 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -2249,6 +2249,7 @@ static void isabus_fdc_class_init(ObjectClass *klass, void *data)
     dc->reset = fdctrl_external_reset_isa;
     dc->vmsd = &vmstate_isa_fdc;
     dc->props = isa_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo isa_fdc_info = {
@@ -2282,6 +2283,7 @@ static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
     dc->reset = fdctrl_external_reset_sysbus;
     dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sysbus_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_fdc_info = {
@@ -2305,6 +2307,7 @@ static void sun4m_fdc_class_init(ObjectClass *klass, void *data)
     dc->reset = fdctrl_external_reset_sysbus;
     dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sun4m_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sun4m_fdc_info = {
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index f15f04a..0263e5c 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -866,6 +866,7 @@ static void nvme_class_init(ObjectClass *oc, void *data)
     pc->revision = 1;
     pc->is_express = 1;
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "Non-Volatile Memory Express";
     dc->props = nvme_props;
     dc->vmsd = &nvme_vmstate;
diff --git a/hw/block/pc_sysfw.c b/hw/block/pc_sysfw.c
index 0669410..7db68f0 100644
--- a/hw/block/pc_sysfw.c
+++ b/hw/block/pc_sysfw.c
@@ -286,6 +286,7 @@ static void pcsysfw_class_init (ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "PC System Firmware";
     dc->init = pcsysfw_init;
     dc->props = pcsysfw_properties;
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 2973859..825011d 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -723,6 +723,7 @@ static void pflash_cfi01_class_init(ObjectClass *klass, void *data)
     dc->realize = pflash_cfi01_realize;
     dc->props = pflash_cfi01_properties;
     dc->vmsd = &vmstate_pflash;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index cf12469..a786233 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -704,6 +704,7 @@ static void virtio_blk_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_blk_device_exit;
     dc->props = virtio_blk_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_blk_device_init;
     vdc->get_config = virtio_blk_update_config;
     vdc->set_config = virtio_blk_set_config;
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index 03db12f..02d0d57 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -122,6 +122,7 @@ static void debugcon_isa_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = debugcon_isa_realizefn;
     dc->props = debugcon_isa_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo debugcon_isa_info = {
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 69b9ed2..5c17eaa 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -449,6 +449,7 @@ static void imx_serial_class_init(ObjectClass *klass, void *data)
     k->init = imx_serial_init;
     dc->vmsd = &vmstate_imx_serial;
     dc->reset = imx_serial_reset_at_boot;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "i.MX series UART";
     dc->props = imx32_serial_properties;
 }
diff --git a/hw/char/ipack.c b/hw/char/ipack.c
index e15540d..f890471 100644
--- a/hw/char/ipack.c
+++ b/hw/char/ipack.c
@@ -74,6 +74,7 @@ static Property ipack_device_props[] = {
 static void ipack_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
+    set_bit(DEVICE_CATEGORY_INPUT, k->categories);
     k->bus_type = TYPE_IPACK_BUS;
     k->init = ipack_device_dev_init;
     k->exit = ipack_device_dev_exit;
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index c9698a6..88e2cca 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -585,6 +585,7 @@ static void ipoctal_class_init(ObjectClass *klass, void *data)
     ic->mem_read8   = mem_read8;
     ic->mem_write8  = mem_write8;
 
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc    = "GE IP-Octal 232 8-channel RS-232 IndustryPack";
     dc->props   = ipoctal_properties;
     dc->vmsd    = &vmstate_ipoctal;
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index ad96ea5..7a3b264 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -607,6 +607,7 @@ static void parallel_isa_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = parallel_isa_realizefn;
     dc->props = parallel_isa_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo parallel_isa_info = {
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index cea8212..5cb77b3 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -102,6 +102,7 @@ static void serial_isa_class_initfn(ObjectClass *klass, void *data)
     dc->realize = serial_isa_realizefn;
     dc->vmsd = &vmstate_isa_serial;
     dc->props = serial_isa_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_isa_info = {
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index a17c702..aec6705 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -205,6 +205,7 @@ static void serial_pci_class_initfn(ObjectClass *klass, void *data)
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_serial;
     dc->props = serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static void multi_2x_serial_pci_class_initfn(ObjectClass *klass, void *data)
@@ -219,6 +220,7 @@ static void multi_2x_serial_pci_class_initfn(ObjectClass *klass, void *data)
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_multi_serial;
     dc->props = multi_2x_serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static void multi_4x_serial_pci_class_initfn(ObjectClass *klass, void *data)
@@ -233,6 +235,7 @@ static void multi_4x_serial_pci_class_initfn(ObjectClass *klass, void *data)
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_multi_serial;
     dc->props = multi_4x_serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_pci_info = {
diff --git a/hw/char/tpci200.c b/hw/char/tpci200.c
index a199e57..d9e17b2 100644
--- a/hw/char/tpci200.c
+++ b/hw/char/tpci200.c
@@ -652,6 +652,7 @@ static void tpci200_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_BRIDGE_OTHER;
     k->subsystem_vendor_id = PCI_VENDOR_ID_TEWS;
     k->subsystem_id = 0x300A;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "TEWS TPCI200 IndustryPack carrier";
     dc->vmsd = &vmstate_tpci200;
 }
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index cc3d1dd..da417c7 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -971,6 +971,7 @@ static void virtio_serial_port_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = virtser_port_qdev_init;
+    set_bit(DEVICE_CATEGORY_INPUT, k->categories);
     k->bus_type = TYPE_VIRTIO_SERIAL_BUS;
     k->exit = virtser_port_qdev_exit;
     k->unplug = qdev_simple_unplug_cb;
@@ -1017,6 +1018,7 @@ static void virtio_serial_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_serial_device_exit;
     dc->props = virtio_serial_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     vdc->init = virtio_serial_device_init;
     vdc->get_features = get_features;
     vdc->get_config = get_config;
diff --git a/hw/cpu/icc_bus.c b/hw/cpu/icc_bus.c
index 8788144..8748cc5 100644
--- a/hw/cpu/icc_bus.c
+++ b/hw/cpu/icc_bus.c
@@ -101,11 +101,19 @@ static void icc_bridge_init(Object *obj)
     s->icc_bus.apic_address_space = &s->apic_container;
 }
 
+static void icc_bridge_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
 static const TypeInfo icc_bridge_info = {
     .name  = TYPE_ICC_BRIDGE,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_init  = icc_bridge_init,
     .instance_size  = sizeof(ICCBridgeState),
+    .class_init = icc_bridge_class_init,
 };
 
 
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index a440575..dbd1f4a 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2937,6 +2937,7 @@ static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
     dc->vmsd  = &vmstate_cirrus_vga;
     dc->realize = isa_cirrus_vga_realizefn;
     dc->props = isa_cirrus_vga_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo isa_cirrus_vga_info = {
@@ -3002,6 +3003,7 @@ static void cirrus_vga_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
     k->device_id = CIRRUS_ID_CLGD5446;
     k->class_id = PCI_CLASS_DISPLAY_VGA;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Cirrus CLGD 54xx VGA";
     dc->vmsd = &vmstate_pci_cirrus_vga;
     dc->props = pci_vga_cirrus_properties;
diff --git a/hw/display/g364fb.c b/hw/display/g364fb.c
index 79a0a50..2d3e912 100644
--- a/hw/display/g364fb.c
+++ b/hw/display/g364fb.c
@@ -528,6 +528,7 @@ static void g364fb_sysbus_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = g364fb_sysbus_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "G364 framebuffer";
     dc->reset = g364fb_sysbus_reset;
     dc->vmsd = &vmstate_g364fb;
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 60afcf3..31993a7 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -481,6 +481,7 @@ static void pl110_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl110_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
@@ -498,6 +499,7 @@ static void pl110_versatile_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl110_versatile_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
@@ -515,6 +517,7 @@ static void pl111_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl111_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index ddefa06..c537057 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2323,6 +2323,7 @@ static void qxl_primary_class_init(ObjectClass *klass, void *data)
     k->vendor_id = REDHAT_PCI_VENDOR_ID;
     k->device_id = QXL_DEVICE_ID_STABLE;
     k->class_id = PCI_CLASS_DISPLAY_VGA;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Spice QXL GPU (primary, vga compatible)";
     dc->reset = qxl_reset_handler;
     dc->vmsd = &qxl_vmstate;
@@ -2345,6 +2346,7 @@ static void qxl_secondary_class_init(ObjectClass *klass, void *data)
     k->vendor_id = REDHAT_PCI_VENDOR_ID;
     k->device_id = QXL_DEVICE_ID_STABLE;
     k->class_id = PCI_CLASS_DISPLAY_OTHER;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Spice QXL GPU (secondary)";
     dc->reset = qxl_reset_handler;
     dc->vmsd = &qxl_vmstate;
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index 8d560ec..c2a19ad 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -87,6 +87,7 @@ static void vga_isa_class_initfn(ObjectClass *klass, void *data)
     dc->reset = vga_isa_reset;
     dc->vmsd = &vmstate_vga_common;
     dc->props = vga_isa_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vga_isa_info = {
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 3e150ab..b3a45c8 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -198,6 +198,7 @@ static void vga_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_DISPLAY_VGA;
     dc->vmsd = &vmstate_vga_pci;
     dc->props = vga_pci_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vga_info = {
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 3536cde..a6a8cdc 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1306,6 +1306,7 @@ static void vmsvga_class_init(ObjectClass *klass, void *data)
     dc->reset = vmsvga_reset;
     dc->vmsd = &vmstate_vmware_vga;
     dc->props = vga_vmware_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vmsvga_info = {
diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index 5f8b972..853d455 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -227,6 +227,7 @@ static void gpio_i2c_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = gpio_i2c_init;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Virtual GPIO to I2C bridge";
 }
 
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index 22ef3b9..c97e7f7 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -224,6 +224,7 @@ static void i2c_slave_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = i2c_slave_qdev_init;
+    set_bit(DEVICE_CATEGORY_MISC, k->categories);
     k->bus_type = TYPE_I2C_BUS;
     k->props = i2c_props;
 }
diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index ff33dc8..5618173 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -1856,6 +1856,7 @@ static void assign_class_init(ObjectClass *klass, void *data)
     dc->props       = assigned_dev_properties;
     dc->vmsd        = &vmstate_assigned_device;
     dc->reset       = reset_assigned_device;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc        = "KVM-based PCI passthrough";
 }
 
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 419adde..bba150f 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1338,6 +1338,7 @@ static void sysbus_ahci_class_init(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_sysbus_ahci;
     dc->props = sysbus_ahci_properties;
     dc->reset = sysbus_ahci_reset;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_ahci_info = {
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index 4eb5488..bff952b 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -160,6 +160,7 @@ static void ich_ahci_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_SATA;
     dc->vmsd = &vmstate_ich9_ahci;
     dc->reset = pci_ich9_reset;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo ich_ahci_info = {
diff --git a/hw/ide/isa.c b/hw/ide/isa.c
index 7243c82..bbc8c6b 100644
--- a/hw/ide/isa.c
+++ b/hw/ide/isa.c
@@ -118,6 +118,7 @@ static void isa_ide_class_initfn(ObjectClass *klass, void *data)
     dc->fw_name = "ide";
     dc->reset = isa_ide_reset;
     dc->props = isa_ide_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo isa_ide_info = {
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 58532fe..56cf00e 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -248,6 +248,7 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
@@ -267,6 +268,7 @@ static void piix3_ide_xen_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
     dc->unplug = pci_piix3_xen_ide_unplug;
 }
@@ -289,6 +291,7 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371AB;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
index 6a272b0..1d84e15 100644
--- a/hw/ide/qdev.c
+++ b/hw/ide/qdev.c
@@ -282,6 +282,7 @@ static void ide_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = ide_qdev_init;
+    set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
     k->bus_type = TYPE_IDE_BUS;
     k->props = ide_props;
 }
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 5a83191..d324884 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -223,6 +223,7 @@ static void via_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIA_IDE;
     k->revision = 0x06;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
diff --git a/hw/isa/i82378.c b/hw/isa/i82378.c
index b25ed04..a542134 100644
--- a/hw/isa/i82378.c
+++ b/hw/isa/i82378.c
@@ -261,6 +261,7 @@ static void pci_i82378_class_init(ObjectClass *klass, void *data)
     k->subsystem_vendor_id = 0x0;
     k->subsystem_id = 0x0;
     dc->vmsd = &vmstate_pci_i82378;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = i82378_properties;
 }
 
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index d1921aa..5633d08 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -600,6 +600,7 @@ static void ich9_lpc_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = ich9_lpc_reset;
     k->init = ich9_lpc_initfn;
     dc->vmsd = &vmstate_ich9_lpc;
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 2174eaa..8fe4fcb 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -281,6 +281,7 @@ static void via_ac97_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIA_AC97;
     k->revision = 0x50;
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "AC97";
 }
 
@@ -322,6 +323,7 @@ static void via_mc97_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIA_MC97;
     k->class_id = PCI_CLASS_COMMUNICATION_OTHER;
     k->revision = 0x30;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "MC97";
 }
 
@@ -401,6 +403,7 @@ static void via_pm_class_init(ObjectClass *klass, void *data)
     k->revision = 0x40;
     dc->desc = "PM";
     dc->vmsd = &vmstate_acpi;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = via_pm_properties;
 }
 
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index bfafa51..1e8d183 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -263,6 +263,7 @@ static void qdev_applesmc_class_init(ObjectClass *klass, void *data)
     dc->realize = applesmc_isa_realize;
     dc->reset = qdev_applesmc_isa_reset;
     dc->props = applesmc_isa_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo applesmc_isa_info = {
diff --git a/hw/misc/debugexit.c b/hw/misc/debugexit.c
index d754cf1..9db5680 100644
--- a/hw/misc/debugexit.c
+++ b/hw/misc/debugexit.c
@@ -58,6 +58,7 @@ static void debug_exit_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = debug_exit_realizefn;
     dc->props = debug_exit_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo debug_exit_info = {
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 4a74856..2838866 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -821,6 +821,7 @@ static void ivshmem_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_MEMORY_RAM;
     dc->reset = ivshmem_reset;
     dc->props = ivshmem_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo ivshmem_info = {
diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index 5867c70..18e94e0 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -188,6 +188,7 @@ static void testdev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->realize = testdev_realizefn;
 }
 
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index d69ff33..ca53b3f 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -315,6 +315,7 @@ static void pci_testdev_class_init(ObjectClass *klass, void *data)
     k->revision = 0x00;
     k->class_id = PCI_CLASS_OTHERS;
     dc->desc = "PCI Test Device";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->reset = qdev_pci_testdev_reset;
 }
 
diff --git a/hw/misc/sga.c b/hw/misc/sga.c
index 08803e7..83d2fd9 100644
--- a/hw/misc/sga.c
+++ b/hw/misc/sga.c
@@ -47,6 +47,7 @@ static void sga_class_initfn(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->realize = sga_realizefn;
     dc->desc = "Serial Graphics Adapter";
 }
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index ad8ce77..017e693 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -3299,6 +3299,7 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
     dc->props = vfio_pci_dev_properties;
     dc->vmsd = &vfio_pci_vmstate;
     dc->desc = "VFIO-based PCI device assignment";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     pdc->init = vfio_initfn;
     pdc->exit = vfio_exitfn;
     pdc->config_read = vfio_pci_read_config;
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index b952d8d..fdb1f89 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1400,6 +1400,7 @@ static void e1000_class_init(ObjectClass *klass, void *data)
     k->device_id = E1000_DEVID;
     k->revision = 0x03;
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "Intel Gigabit Ethernet";
     dc->reset = qdev_e1000_reset;
     dc->vmsd = &vmstate_e1000;
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index 25b7d0c..ffa60d5 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -2083,6 +2083,7 @@ static void eepro100_class_init(ObjectClass *klass, void *data)
 
     info = eepro100_get_class_by_name(object_class_get_name(klass));
 
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->props = e100_properties;
     dc->desc = info->desc;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
diff --git a/hw/net/lance.c b/hw/net/lance.c
index 98bcdfc..1be7b72 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -150,6 +150,7 @@ static void lance_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = lance_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->fw_name = "ethernet";
     dc->reset = lance_reset;
     dc->vmsd = &vmstate_lance;
diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 9080850..61578ed 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -264,6 +264,7 @@ static void mipsnet_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = mipsnet_sysbus_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "MIPS Simulator network device";
     dc->reset = mipsnet_sysbus_reset;
     dc->vmsd = &vmstate_mipsnet;
diff --git a/hw/net/ne2000-isa.c b/hw/net/ne2000-isa.c
index e3c8076..26b83ce 100644
--- a/hw/net/ne2000-isa.c
+++ b/hw/net/ne2000-isa.c
@@ -98,6 +98,7 @@ static void isa_ne2000_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = isa_ne2000_realizefn;
     dc->props = ne2000_isa_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo ne2000_isa_info = {
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 8d43fd9..31afd28 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -772,6 +772,7 @@ static void ne2000_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
     dc->vmsd = &vmstate_pci_ne2000;
     dc->props = ne2000_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo ne2000_info = {
diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index 4637557..513f345 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -713,6 +713,7 @@ static void open_eth_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = sysbus_open_eth_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "Opencores 10/100 Mbit Ethernet";
     dc->reset = qdev_open_eth_reset;
     dc->props = open_eth_properties;
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index 6ef28f7..2c2301c 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -366,6 +366,7 @@ static void pcnet_class_init(ObjectClass *klass, void *data)
     dc->reset = pci_reset;
     dc->vmsd = &vmstate_pci_pcnet;
     dc->props = pcnet_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo pcnet_info = {
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 6552034..ee3b690 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3563,6 +3563,7 @@ static void rtl8139_class_init(ObjectClass *klass, void *data)
     dc->reset = rtl8139_reset;
     dc->vmsd = &vmstate_rtl8139;
     dc->props = rtl8139_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo rtl8139_info = {
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 679f50c..aa1880c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1638,6 +1638,7 @@ static void virtio_net_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_net_device_exit;
     dc->props = virtio_net_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     vdc->init = virtio_net_device_init;
     vdc->get_config = virtio_net_get_config;
     vdc->set_config = virtio_net_set_config;
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 0f3c58c..49c2466 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2453,6 +2453,7 @@ static void vmxnet3_class_init(ObjectClass *class, void *data)
     dc->reset = vmxnet3_qdev_reset;
     dc->vmsd = &vmstate_vmxnet3;
     dc->props = vmxnet3_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo vmxnet3_info = {
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index b98bfb0..0e521a8 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -81,12 +81,14 @@ err_bridge:
 static void i82801b11_bridge_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
     k->is_bridge = 1;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82801BA_11;
     k->revision = ICH9_D2P_A2_REVISION;
     k->init = i82801b11_bridge_initfn;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo i82801b11_bridge_info = {
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index bb541eb..47122c5 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -220,6 +220,7 @@ static void ioh3420_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_IOH_EPORT;
     k->revision = PCI_DEVICE_ID_IOH_REV;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Intel IOH device id 3420 PCIE Root Port";
     dc->reset = ioh3420_reset;
     dc->vmsd = &vmstate_ioh3420;
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 5f11323..a00642c 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -141,6 +141,7 @@ static void pci_bridge_dev_class_init(ObjectClass *klass, void *data)
     dc->reset = qdev_pci_bridge_dev_reset;
     dc->props = pci_bridge_dev_properties;
     dc->vmsd = &pci_bridge_dev_vmstate;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo pci_bridge_dev_info = {
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 1810dd2..33eff37 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -187,6 +187,7 @@ static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_TI;
     k->device_id = PCI_DEVICE_ID_TI_XIO3130D;
     k->revision = XIO3130_REVISION;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "TI X3130 Downstream Port of PCI Express Switch";
     dc->reset = xio3130_downstream_reset;
     dc->vmsd = &vmstate_xio3130_downstream;
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 8e0d97a..e9969a9 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -161,6 +161,7 @@ static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_TI;
     k->device_id = PCI_DEVICE_ID_TI_XIO3130U;
     k->revision = XIO3130_REVISION;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "TI X3130 Upstream Port of PCI Express Switch";
     dc->reset = xio3130_upstream_reset;
     dc->vmsd = &vmstate_xio3130_upstream;
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index 3756ce9..bef7be1 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -536,6 +536,7 @@ static void pbm_host_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pci_pbm_init_device;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = pci_pbm_reset;
 }
 
@@ -558,6 +559,7 @@ static void pbm_pci_bridge_class_init(ObjectClass *klass, void *data)
     k->revision = 0x11;
     k->config_write = pci_bridge_write_config;
     k->is_bridge = 1;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = pci_bridge_reset;
     dc->vmsd = &vmstate_pci_device;
 }
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 646204e..f00793d 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -407,6 +407,7 @@ static void e500_pcihost_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = e500_pcihost_initfn;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = pcihost_properties;
     dc->vmsd = &vmstate_ppce500_pci;
 }
diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index b41d564..09d3b32 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -210,6 +210,7 @@ static void raven_pcihost_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->realize = raven_pcihost_realizefn;
     dc->fw_name = "pci";
     dc->no_user = 1;
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 6b1b3b7..69234de 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -78,6 +78,7 @@ static void q35_host_class_init(ObjectClass *klass, void *data)
     hc->root_bus_path = q35_host_root_bus_path;
     dc->realize = q35_host_realize;
     dc->props = mch_props;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->fw_name = "pci";
 }
 
@@ -306,6 +307,7 @@ static void mch_class_init(ObjectClass *klass, void *data)
     k->init = mch_init;
     k->config_write = mch_write_config;
     dc->reset = mch_reset;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Host bridge";
     dc->vmsd = &vmstate_mch;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 2ac21d4..d7ec173 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -392,6 +392,7 @@ static void esp_pci_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_AMD_SCSI;
     k->revision = 0x10;
     k->class_id = PCI_CLASS_STORAGE_SCSI;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "AMD Am53c974 PCscsi-PCI SCSI adapter";
     dc->reset = esp_pci_hard_reset;
     dc->vmsd = &vmstate_esp_pci_scsi;
@@ -512,6 +513,7 @@ static void dc390_class_init(ObjectClass *klass, void *data)
     k->init = dc390_scsi_init;
     k->config_read = dc390_read_config;
     k->config_write = dc390_write_config;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "Tekram DC-390 SCSI adapter";
 }
 
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 94639b8..101e957 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -720,6 +720,7 @@ static void sysbus_esp_class_init(ObjectClass *klass, void *data)
     dc->realize = sysbus_esp_realize;
     dc->reset = sysbus_esp_hard_reset;
     dc->vmsd = &vmstate_sysbus_esp_scsi;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_esp_info = {
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 776e31a..611f2aa 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2141,6 +2141,7 @@ static void lsi_class_init(ObjectClass *klass, void *data)
     k->subsystem_id = 0x1000;
     dc->reset = lsi_scsi_reset;
     dc->vmsd = &vmstate_lsi_scsi;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo lsi_info = {
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index eb52164..a6d5285 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2213,6 +2213,7 @@ static void megasas_class_init(ObjectClass *oc, void *data)
     dc->props = megasas_properties;
     dc->reset = megasas_scsi_reset;
     dc->vmsd = &vmstate_megasas;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "LSI MegaRAID SAS 1078";
 }
 
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index b5a863a..fbf9173 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -1881,6 +1881,7 @@ const VMStateDescription vmstate_scsi_device = {
 static void scsi_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
+    set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
     k->bus_type = TYPE_SCSI_BUS;
     k->init     = scsi_qdev_init;
     k->unplug   = scsi_qdev_unplug;
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 785e93f..9e770fb 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -267,6 +267,7 @@ static void vhost_scsi_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = vhost_scsi_exit;
     dc->props = vhost_scsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = vhost_scsi_init;
     vdc->get_features = vhost_scsi_get_features;
     vdc->set_config = vhost_scsi_set_config;
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 42cb73b..05da56b 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -669,8 +669,10 @@ static Property virtio_scsi_properties[] = {
 static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 {
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
     vdc->get_config = virtio_scsi_get_config;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static void virtio_scsi_class_init(ObjectClass *klass, void *data)
@@ -679,6 +681,7 @@ static void virtio_scsi_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_scsi_device_exit;
     dc->props = virtio_scsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_scsi_device_init;
     vdc->set_config = virtio_scsi_set_config;
     vdc->get_features = virtio_scsi_get_features;
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index e1074e1..d42b359 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1197,6 +1197,7 @@ static void pvscsi_class_init(ObjectClass *klass, void *data)
     dc->reset = pvscsi_reset;
     dc->vmsd = &vmstate_pvscsi;
     dc->props = pvscsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     k->config_write = pvscsi_write_config;
 }
 
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index deb6d47..aa913df 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -592,6 +592,7 @@ static void emulated_class_initfn(ObjectClass *klass, void *data)
     cc->exitfn = emulated_exitfn;
     cc->get_atr = emulated_get_atr;
     cc->apdu_from_guest = emulated_apdu_from_guest;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "emulated smartcard";
     dc->props = emulated_card_properties;
 }
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 5f01ff1..10f1d30 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -392,6 +392,7 @@ static void passthru_class_initfn(ObjectClass *klass, void *data)
     cc->exitfn = passthru_exitfn;
     cc->get_atr = passthru_get_atr;
     cc->apdu_from_guest = passthru_apdu_from_guest;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "passthrough smartcard";
     dc->vmsd = &passthru_vmstate;
     dc->props = passthru_card_properties;
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index 04933a9..c5420eb 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -673,6 +673,7 @@ static void usb_audio_class_init(ObjectClass *klass, void *data)
 
     dc->vmsd          = &vmstate_usb_audio;
     dc->props         = usb_audio_properties;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     k->product_desc   = "QEMU USB Audio Interface";
     k->usb_desc       = &desc_audio;
     k->init           = usb_audio_initfn;
diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
index 68cc1d4..f2fc2a8 100644
--- a/hw/usb/dev-bluetooth.c
+++ b/hw/usb/dev-bluetooth.c
@@ -553,6 +553,7 @@ static void usb_bt_class_initfn(ObjectClass *klass, void *data)
     uc->handle_data    = usb_bt_handle_data;
     uc->handle_destroy = usb_bt_handle_destroy;
     dc->vmsd = &vmstate_usb_bt;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo bt_info = {
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 31f3cde..66c6331 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -658,6 +658,7 @@ static void usb_tablet_class_initfn(ObjectClass *klass, void *data)
     uc->product_desc   = "QEMU USB Tablet";
     dc->vmsd = &vmstate_usb_ptr;
     dc->props = usb_tablet_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo usb_tablet_info = {
@@ -677,6 +678,7 @@ static void usb_mouse_class_initfn(ObjectClass *klass, void *data)
     uc->product_desc   = "QEMU USB Mouse";
     uc->usb_desc       = &desc_mouse;
     dc->vmsd = &vmstate_usb_ptr;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo usb_mouse_info = {
@@ -696,6 +698,7 @@ static void usb_keyboard_class_initfn(ObjectClass *klass, void *data)
     uc->product_desc   = "QEMU USB Keyboard";
     uc->usb_desc       = &desc_keyboard;
     dc->vmsd = &vmstate_usb_kbd;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo usb_keyboard_info = {
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 0b71abd..e865a98 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -574,6 +574,7 @@ static void usb_hub_class_initfn(ObjectClass *klass, void *data)
     uc->handle_control = usb_hub_handle_control;
     uc->handle_data    = usb_hub_handle_data;
     uc->handle_destroy = usb_hub_handle_destroy;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->fw_name = "hub";
     dc->vmsd = &vmstate_usb_hub;
 }
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 5473ac2..660d774 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1429,6 +1429,7 @@ static void usb_net_class_initfn(ObjectClass *klass, void *data)
     uc->handle_control = usb_net_handle_control;
     uc->handle_data    = usb_net_handle_data;
     uc->handle_destroy = usb_net_handle_destroy;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->fw_name = "network";
     dc->vmsd = &vmstate_usb_net;
     dc->props = net_properties;
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 2fc8a3b..0b150d4 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -590,6 +590,7 @@ static void usb_serial_class_initfn(ObjectClass *klass, void *data)
     uc->handle_data    = usb_serial_handle_data;
     dc->vmsd = &vmstate_usb_serial;
     dc->props = serial_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_info = {
@@ -617,6 +618,7 @@ static void usb_braille_class_initfn(ObjectClass *klass, void *data)
     uc->handle_data    = usb_serial_handle_data;
     dc->vmsd = &vmstate_usb_serial;
     dc->props = braille_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo braille_info = {
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index b33eb25..2233c54 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1449,6 +1449,7 @@ static void ccid_class_initfn(ObjectClass *klass, void *data)
     dc->desc = "CCID Rev 1.1 smartcard reader";
     dc->vmsd = &ccid_vmstate;
     dc->props = ccid_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo ccid_info = {
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 1954811..a8dc2fa 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -746,6 +746,7 @@ static void usb_msd_class_initfn_common(ObjectClass *klass)
     uc->handle_reset   = usb_msd_handle_reset;
     uc->handle_control = usb_msd_handle_control;
     uc->handle_data    = usb_msd_handle_data;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->fw_name = "storage";
     dc->vmsd = &vmstate_usb_msd;
 }
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 6efab62..63ad12e 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -916,6 +916,7 @@ static void usb_uas_class_initfn(ObjectClass *klass, void *data)
     uc->handle_control = usb_uas_handle_control;
     uc->handle_data    = usb_uas_handle_data;
     uc->handle_destroy = usb_uas_handle_destroy;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->fw_name = "storage";
     dc->vmsd = &vmstate_usb_uas;
 }
diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index 3be5cde..1b09235 100644
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -362,6 +362,7 @@ static void usb_wacom_class_init(ObjectClass *klass, void *data)
     uc->handle_control = usb_wacom_handle_control;
     uc->handle_data    = usb_wacom_handle_data;
     uc->handle_destroy = usb_wacom_handle_destroy;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "QEMU PenPartner Tablet";
     dc->vmsd = &vmstate_usb_wacom;
 }
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 5d229bc..4d21a0b 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -140,11 +140,13 @@ static const TypeInfo ehci_pci_type_info = {
 static void ehci_data_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
     EHCIPCIInfo *i = data;
 
     k->vendor_id = i->vendor_id;
     k->device_id = i->device_id;
     k->revision = i->revision;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static struct EHCIPCIInfo ehci_pci_info[] = {
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 54147b5..fe6eea5 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -70,6 +70,7 @@ static void ehci_sysbus_class_init(ObjectClass *klass, void *data)
     dc->realize = usb_ehci_sysbus_realize;
     dc->vmsd = &vmstate_ehci_sysbus;
     dc->props = ehci_sysbus_properties;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_type_info = {
@@ -85,7 +86,9 @@ static const TypeInfo ehci_type_info = {
 static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     sec->capsbase = 0x100;
     sec->opregbase = 0x140;
 }
@@ -99,9 +102,11 @@ static const TypeInfo ehci_xlnx_type_info = {
 static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x0;
     sec->opregbase = 0x10;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_exynos4210_type_info = {
@@ -113,9 +118,11 @@ static const TypeInfo ehci_exynos4210_type_info = {
 static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x100;
     sec->opregbase = 0x140;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_tegra2_type_info = {
@@ -183,11 +190,13 @@ static void fusbh200_ehci_init(Object *obj)
 static void fusbh200_ehci_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x0;
     sec->opregbase = 0x10;
     sec->portscbase = 0x20;
     sec->portnr = 1;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_fusbh200_type_info = {
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 2bab8ff..d438d64 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1917,6 +1917,7 @@ static void ohci_pci_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_APPLE_IPID_USB;
     k->class_id = PCI_CLASS_SERIAL_USB;
     k->no_hotplug = 1;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     dc->desc = "Apple USB Controller";
     dc->props = ohci_pci_properties;
 }
@@ -1939,6 +1940,7 @@ static void ohci_sysbus_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = ohci_realize_pxa;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     dc->desc = "OHCI USB Controller";
     dc->props = ohci_sysbus_properties;
 }
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 066072e..cb44abc 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1315,6 +1315,7 @@ static void uhci_class_init(ObjectClass *klass, void *data)
     k->no_hotplug = 1;
     dc->vmsd = &vmstate_uhci;
     dc->props = uhci_properties;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     u->info = *info;
 }
 
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 9ba3e3e..58f311d 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3591,6 +3591,7 @@ static void xhci_class_init(ObjectClass *klass, void *data)
     dc->vmsd    = &vmstate_xhci;
     dc->props   = xhci_properties;
     dc->reset   = xhci_reset;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     k->init         = usb_xhci_initfn;
     k->vendor_id    = PCI_VENDOR_ID_NEC;
     k->device_id    = PCI_DEVICE_ID_NEC_UPD720200;
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index e2f3cc8..f660770 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -1351,6 +1351,7 @@ static void usb_host_class_initfn(ObjectClass *klass, void *data)
     uc->flush_ep_queue = usb_host_flush_ep_queue;
     dc->vmsd = &vmstate_usb_host;
     dc->props = usb_host_dev_properties;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static TypeInfo usb_host_dev_info = {
diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index ca09a89..7901f4c 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -1530,6 +1530,7 @@ static void usb_host_class_initfn(ObjectClass *klass, void *data)
     uc->handle_destroy = usb_host_handle_destroy;
     dc->vmsd = &vmstate_usb_host;
     dc->props = usb_host_dev_properties;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo usb_host_dev_info = {
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index a594e95..8b8c010 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -2362,6 +2362,7 @@ static void usbredir_class_initfn(ObjectClass *klass, void *data)
     uc->ep_stopped     = usbredir_ep_stopped;
     dc->vmsd           = &usbredir_vmstate;
     dc->props          = usbredir_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo usbredir_dev_info = {
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 337cfa5..aac7f83 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -392,6 +392,7 @@ static void virtio_balloon_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_balloon_device_exit;
     dc->props = virtio_balloon_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     vdc->init = virtio_balloon_device_init;
     vdc->get_config = virtio_balloon_get_config;
     vdc->set_config = virtio_balloon_set_config;
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 54d6679..88cf994 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -370,6 +370,7 @@ static void virtio_mmio_class_init(ObjectClass *klass, void *data)
 
     dc->realize = virtio_mmio_realizefn;
     dc->reset = virtio_mmio_reset;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo virtio_mmio_info = {
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index c38cfd1..d37037e 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -911,6 +911,7 @@ static void virtio_9p_pci_class_init(ObjectClass *klass, void *data)
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_9P;
     pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
     pcidev_k->class_id = 0x2;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_9p_pci_properties;
 }
 
@@ -1065,6 +1066,7 @@ static void virtio_blk_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_blk_pci_properties;
     k->init = virtio_blk_pci_init;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
@@ -1135,6 +1137,7 @@ static void virtio_scsi_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_scsi_pci_init_pci;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_scsi_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
@@ -1191,6 +1194,7 @@ static void vhost_scsi_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = vhost_scsi_pci_init_pci;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = vhost_scsi_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
@@ -1271,6 +1275,7 @@ static void virtio_balloon_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_balloon_pci_init;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->props = virtio_balloon_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_BALLOON;
@@ -1356,6 +1361,7 @@ static void virtio_serial_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_serial_pci_init;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->props = virtio_serial_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_CONSOLE;
@@ -1417,6 +1423,7 @@ static void virtio_net_pci_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIRTIO_NET;
     k->revision = VIRTIO_PCI_ABI_VERSION;
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->props = virtio_net_properties;
     vpciklass->init = virtio_net_pci_init;
 }
@@ -1468,6 +1475,7 @@ static void virtio_rng_pci_class_init(ObjectClass *klass, void *data)
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
     k->init = virtio_rng_pci_init;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->props = virtio_rng_pci_properties;
 
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index cb787c7..bac8421 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -207,6 +207,7 @@ static void virtio_rng_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_rng_device_exit;
     dc->props = virtio_rng_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     vdc->init = virtio_rng_device_init;
     vdc->get_features = get_features;
 }
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 85aebc2..2e064ba 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -451,6 +451,7 @@ static void i6300esb_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_SYSTEM_OTHER;
     dc->reset = i6300esb_reset;
     dc->vmsd = &vmstate_i6300esb;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo i6300esb_info = {
diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index c788554..e97b4c3 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -137,6 +137,7 @@ static void wdt_ib700_class_init(ObjectClass *klass, void *data)
     dc->realize = wdt_ib700_realize;
     dc->reset = wdt_ib700_reset;
     dc->vmsd = &vmstate_ib700;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo wdt_ib700_info = {
diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index 6a8ba7e..79bf0b3 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -428,6 +428,7 @@ static void xen_platform_class_init(ObjectClass *klass, void *data)
     k->subsystem_vendor_id = PCI_VENDOR_ID_XEN;
     k->subsystem_id = PCI_DEVICE_ID_XEN_PLATFORM;
     k->revision = 1;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc = "XEN platform pci device";
     dc->reset = platform_reset;
     dc->vmsd = &vmstate_xen_platform;
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index d15a729..ca2d460 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -830,6 +830,7 @@ static void xen_pci_passthrough_class_init(ObjectClass *klass, void *data)
     k->exit = xen_pt_unregister_device;
     k->config_read = xen_pt_pci_read_config;
     k->config_write = xen_pt_pci_write_config;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc = "Assign an host PCI device with Xen";
     dc->props = xen_pci_passthrough_properties;
 };
commit 3d1237fb2ab4edb926c717767bb5e31d6053a7c5
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Mon Jul 29 17:17:44 2013 +0300

    qemu-help: Sort devices by logical functionality
    
    Categorize devices that appear as output to "-device ?" command
    by logical functionality. Sort the devices by logical categories
    before showing them to user.
    
    The sort is done by functionality rather than alphabetical.
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Message-id: 1375107465-25767-3-git-send-email-marcel.a at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index e8b89b1..46972f4 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -18,6 +18,34 @@ enum {
 #define DEVICE_CLASS(klass) OBJECT_CLASS_CHECK(DeviceClass, (klass), TYPE_DEVICE)
 #define DEVICE_GET_CLASS(obj) OBJECT_GET_CLASS(DeviceClass, (obj), TYPE_DEVICE)
 
+typedef enum DeviceCategory {
+    DEVICE_CATEGORY_BRIDGE,
+    DEVICE_CATEGORY_USB,
+    DEVICE_CATEGORY_STORAGE,
+    DEVICE_CATEGORY_NETWORK,
+    DEVICE_CATEGORY_INPUT,
+    DEVICE_CATEGORY_DISPLAY,
+    DEVICE_CATEGORY_SOUND,
+    DEVICE_CATEGORY_MISC,
+    DEVICE_CATEGORY_MAX
+} DeviceCategory;
+
+static inline const char *qdev_category_get_name(DeviceCategory category)
+{
+    static const char *category_names[DEVICE_CATEGORY_MAX] = {
+        [DEVICE_CATEGORY_BRIDGE]  = "Controller/Bridge/Hub",
+        [DEVICE_CATEGORY_USB]     = "USB",
+        [DEVICE_CATEGORY_STORAGE] = "Storage",
+        [DEVICE_CATEGORY_NETWORK] = "Network",
+        [DEVICE_CATEGORY_INPUT]   = "Input",
+        [DEVICE_CATEGORY_DISPLAY] = "Display",
+        [DEVICE_CATEGORY_SOUND]   = "Sound",
+        [DEVICE_CATEGORY_MISC]    = "Misc",
+    };
+
+    return category_names[category];
+};
+
 typedef int (*qdev_initfn)(DeviceState *dev);
 typedef int (*qdev_event)(DeviceState *dev);
 typedef void (*qdev_resetfn)(DeviceState *dev);
@@ -81,6 +109,7 @@ typedef struct DeviceClass {
     ObjectClass parent_class;
     /*< public >*/
 
+    DECLARE_BITMAP(categories, DEVICE_CATEGORY_MAX);
     const char *fw_name;
     const char *desc;
     Property *props;
diff --git a/qdev-monitor.c b/qdev-monitor.c
index e5adf6c..410cdcb 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -75,24 +75,27 @@ static bool qdev_class_has_alias(DeviceClass *dc)
     return (qdev_class_get_alias(dc) != NULL);
 }
 
-static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
+static void qdev_print_class_devinfo(DeviceClass *dc)
 {
-    DeviceClass *dc;
-    bool *show_no_user = opaque;
-
-    dc = (DeviceClass *)object_class_dynamic_cast(klass, TYPE_DEVICE);
+    DeviceCategory category;
 
-    if (!dc || (show_no_user && !*show_no_user && dc->no_user)) {
+    if (!dc) {
         return;
     }
 
-    error_printf("name \"%s\"", object_class_get_name(klass));
+    error_printf("name \"%s\"", object_class_get_name(OBJECT_CLASS(dc)));
     if (dc->bus_type) {
         error_printf(", bus %s", dc->bus_type);
     }
     if (qdev_class_has_alias(dc)) {
         error_printf(", alias \"%s\"", qdev_class_get_alias(dc));
     }
+    error_printf(", categories");
+    for (category = 0; category < DEVICE_CATEGORY_MAX; ++category) {
+        if (test_bit(category, dc->categories)) {
+            error_printf(" \"%s\"", qdev_category_get_name(category));
+        }
+    }
     if (dc->desc) {
         error_printf(", desc \"%s\"", dc->desc);
     }
@@ -102,6 +105,15 @@ static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
     error_printf("\n");
 }
 
+static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
+{
+    DeviceClass *dc;
+
+    dc = (DeviceClass *)object_class_dynamic_cast(klass, TYPE_DEVICE);
+
+    qdev_print_class_devinfo(dc);
+}
+
 static int set_property(const char *name, const char *value, void *opaque)
 {
     DeviceState *dev = opaque;
@@ -139,6 +151,21 @@ static const char *find_typename_by_alias(const char *alias)
     return NULL;
 }
 
+static void qdev_print_category_devices(DeviceCategory category)
+{
+    DeviceClass *dc;
+    GSList *list, *curr;
+
+    list = object_class_get_list(TYPE_DEVICE, false);
+    for (curr = list; curr; curr = g_slist_next(curr)) {
+        dc = (DeviceClass *)object_class_dynamic_cast(curr->data, TYPE_DEVICE);
+        if (!dc->no_user && test_bit(category, dc->categories)) {
+            qdev_print_class_devinfo(dc);
+        }
+    }
+    g_slist_free(list);
+}
+
 int qdev_device_help(QemuOpts *opts)
 {
     const char *driver;
@@ -147,8 +174,11 @@ int qdev_device_help(QemuOpts *opts)
 
     driver = qemu_opt_get(opts, "driver");
     if (driver && is_help_option(driver)) {
-        bool show_no_user = false;
-        object_class_foreach(qdev_print_devinfo, TYPE_DEVICE, false, &show_no_user);
+        DeviceCategory category;
+        for (category = 0; category < DEVICE_CATEGORY_MAX; ++category) {
+            qdev_print_category_devices(category);
+        }
+
         return 1;
     }
 
commit 949fc82314cc84162e64a5323764527a542421ce
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Mon Jul 29 17:17:43 2013 +0300

    hw: import bitmap operations in qdev-core header
    
    Made small tweaks in code to prevent compilation issues
    when importing qemu/bitmap.h in qdev-core
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Message-id: 1375107465-25767-2-git-send-email-marcel.a at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index 3a324fb..6e1ed1e 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -74,13 +74,14 @@ static void bit_prop_set(DeviceState *dev, Property *props, bool val)
     }
 }
 
-static int print_bit(DeviceState *dev, Property *prop, char *dest, size_t len)
+static int prop_print_bit(DeviceState *dev, Property *prop, char *dest,
+                          size_t len)
 {
     uint32_t *p = qdev_get_prop_ptr(dev, prop);
     return snprintf(dest, len, (*p & qdev_get_prop_mask(prop)) ? "on" : "off");
 }
 
-static void get_bit(Object *obj, Visitor *v, void *opaque,
+static void prop_get_bit(Object *obj, Visitor *v, void *opaque,
                     const char *name, Error **errp)
 {
     DeviceState *dev = DEVICE(obj);
@@ -91,7 +92,7 @@ static void get_bit(Object *obj, Visitor *v, void *opaque,
     visit_type_bool(v, &value, name, errp);
 }
 
-static void set_bit(Object *obj, Visitor *v, void *opaque,
+static void prop_set_bit(Object *obj, Visitor *v, void *opaque,
                     const char *name, Error **errp)
 {
     DeviceState *dev = DEVICE(obj);
@@ -115,9 +116,9 @@ static void set_bit(Object *obj, Visitor *v, void *opaque,
 PropertyInfo qdev_prop_bit = {
     .name  = "boolean",
     .legacy_name  = "on/off",
-    .print = print_bit,
-    .get   = get_bit,
-    .set   = set_bit,
+    .print = prop_print_bit,
+    .get   = prop_get_bit,
+    .set   = prop_set_bit,
 };
 
 /* --- bool --- */
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index e0befb2..25b7d0c 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -47,6 +47,7 @@
 #include "hw/nvram/eeprom93xx.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/dma.h"
+#include "qemu/bitops.h"
 
 /* QEMU sends frames smaller than 60 bytes to ethernet nics.
  * Such frames are rejected by real nics and their emulations.
@@ -105,7 +106,6 @@
 #define PCI_IO_SIZE             64
 #define PCI_FLASH_SIZE          (128 * KiB)
 
-#define BIT(n) (1 << (n))
 #define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
 
 /* The SCB accepts the following controls for the Tx and Rx units: */
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 7fbffcb..e8b89b1 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -4,6 +4,7 @@
 #include "qemu/queue.h"
 #include "qemu/option.h"
 #include "qemu/typedefs.h"
+#include "qemu/bitmap.h"
 #include "qom/object.h"
 #include "hw/irq.h"
 #include "qapi/error.h"
commit dbd94f8e4a0a3c4164af7be5bbf6d4e907f3cc03
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Mon Jul 29 14:48:39 2013 +1000

    spapr-vscsi: fix SOLNT bit in SRP_RSP
    
    The driver calculates SOLNT bit from UCSOLNT and  SCSOLNT bits from
    the request. The iu pointer has a type of srp_iu* which points to a union,
    so cmd and rsp overlap. As the vscsi_send_rsp function calls
    memset(iu, 0, sizeof(rsp)), it clears first 36 bytes of both cmd and rsp
    so cmd.sol_not is always zero at the moment of calculating rsp.sol_not.
    
    This fixes the bug.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1375073319-17488-1-git-send-email-aik at ozlabs.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 46f4455..3f4c53f 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -216,6 +216,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     union viosrp_iu *iu = &req->iu;
     uint64_t tag = iu->srp.rsp.tag;
     int total_len = sizeof(iu->srp.rsp);
+    uint8_t sol_not = iu->srp.cmd.sol_not;
 
     dprintf("VSCSI: Sending resp status: 0x%x, "
             "res_in: %d, res_out: %d\n", status, res_in, res_out);
@@ -248,7 +249,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     /* Handle success vs. failure */
     iu->srp.rsp.status = status;
     if (status) {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x04) >> 2;
+        iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2;
         if (req->senselen) {
             req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID;
             req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen);
@@ -256,7 +257,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
             total_len += req->senselen;
         }
     } else {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x02) >> 1;
+        iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1;
     }
 
     vscsi_send_iu(s, req, total_len, VIOSRP_SRP_FORMAT);
commit c04d6cfa3f17a335942f430a3d40e6041100f0c2
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 14:33:04 2013 -0500

    xics: rename types to be sane and follow coding style
    
        Basically, in HW the layout of the interrupt network is:
    
         - One ICP per processor thread (the "presenter"). This contains the
        registers to fetch a pending interrupt (ack), EOI, and control the
        processor priority.
    
         - One ICS per logical source of interrupts (ie, one per PCI host
        bridge, and a few others here or there). This contains the per-interrupt
        source configuration (target processor(s), priority, mask) and the
        per-interrupt internal state.
    
        Under PAPR, there is a single "virtual" ICS ... somewhat (it's a bit
        oddball what pHyp does here, arguably there are two but we can ignore
        that distinction). There is no register level access. A pair of firmware
        (RTAS) calls is used to configure each virtual interrupt.
    
        So our model here is somewhat the same. We have one ICS in the emulated
        XICS which arguably *is* the emulated XICS, there's no point making it a
        separate "device", that would just be gross, and each VCPU has an
        associated ICP.
    
    Yet we call the "XICS" struct icp_state and then the ICPs
    'struct icp_server_state'.  It's particularly confusing when all of the
    functions have xics_prefixes yet take *icp arguments.
    
    Rename:
    
      struct icp_state -> XICSState
      struct icp_server_state -> ICPState
      struct ics_state -> ICSState
      struct ics_irq_state -> ICSIRQState
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-12-git-send-email-aliguori at us.ibm.com
    [aik: added ics_resend() on post_load]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index 091912e..6b3c071 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -34,34 +34,19 @@
  * ICP: Presentation layer
  */
 
-struct icp_server_state {
-    uint32_t xirr;
-    uint8_t pending_priority;
-    uint8_t mfrr;
-    qemu_irq output;
-};
-
 #define XISR_MASK  0x00ffffff
 #define CPPR_MASK  0xff000000
 
 #define XISR(ss)   (((ss)->xirr) & XISR_MASK)
 #define CPPR(ss)   (((ss)->xirr) >> 24)
 
-struct ics_state;
-
-struct icp_state {
-    long nr_servers;
-    struct icp_server_state *ss;
-    struct ics_state *ics;
-};
-
-static void ics_reject(struct ics_state *ics, int nr);
-static void ics_resend(struct ics_state *ics);
-static void ics_eoi(struct ics_state *ics, int nr);
+static void ics_reject(ICSState *ics, int nr);
+static void ics_resend(ICSState *ics);
+static void ics_eoi(ICSState *ics, int nr);
 
-static void icp_check_ipi(struct icp_state *icp, int server)
+static void icp_check_ipi(XICSState *icp, int server)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     if (XISR(ss) && (ss->pending_priority <= ss->mfrr)) {
         return;
@@ -78,9 +63,9 @@ static void icp_check_ipi(struct icp_state *icp, int server)
     qemu_irq_raise(ss->output);
 }
 
-static void icp_resend(struct icp_state *icp, int server)
+static void icp_resend(XICSState *icp, int server)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     if (ss->mfrr < CPPR(ss)) {
         icp_check_ipi(icp, server);
@@ -88,9 +73,9 @@ static void icp_resend(struct icp_state *icp, int server)
     ics_resend(icp->ics);
 }
 
-static void icp_set_cppr(struct icp_state *icp, int server, uint8_t cppr)
+static void icp_set_cppr(XICSState *icp, int server, uint8_t cppr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
     uint8_t old_cppr;
     uint32_t old_xisr;
 
@@ -112,9 +97,9 @@ static void icp_set_cppr(struct icp_state *icp, int server, uint8_t cppr)
     }
 }
 
-static void icp_set_mfrr(struct icp_state *icp, int server, uint8_t mfrr)
+static void icp_set_mfrr(XICSState *icp, int server, uint8_t mfrr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     ss->mfrr = mfrr;
     if (mfrr < CPPR(ss)) {
@@ -122,7 +107,7 @@ static void icp_set_mfrr(struct icp_state *icp, int server, uint8_t mfrr)
     }
 }
 
-static uint32_t icp_accept(struct icp_server_state *ss)
+static uint32_t icp_accept(ICPState *ss)
 {
     uint32_t xirr = ss->xirr;
 
@@ -135,9 +120,9 @@ static uint32_t icp_accept(struct icp_server_state *ss)
     return xirr;
 }
 
-static void icp_eoi(struct icp_state *icp, int server, uint32_t xirr)
+static void icp_eoi(XICSState *icp, int server, uint32_t xirr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     /* Send EOI -> ICS */
     ss->xirr = (ss->xirr & ~CPPR_MASK) | (xirr & CPPR_MASK);
@@ -148,9 +133,9 @@ static void icp_eoi(struct icp_state *icp, int server, uint32_t xirr)
     }
 }
 
-static void icp_irq(struct icp_state *icp, int server, int nr, uint8_t priority)
+static void icp_irq(XICSState *icp, int server, int nr, uint8_t priority)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     trace_xics_icp_irq(server, nr, priority);
 
@@ -168,39 +153,59 @@ static void icp_irq(struct icp_state *icp, int server, int nr, uint8_t priority)
     }
 }
 
-/*
- * ICS: Source layer
- */
-
-struct ics_irq_state {
-    int server;
-    uint8_t priority;
-    uint8_t saved_priority;
-#define XICS_STATUS_ASSERTED           0x1
-#define XICS_STATUS_SENT               0x2
-#define XICS_STATUS_REJECTED           0x4
-#define XICS_STATUS_MASKED_PENDING     0x8
-    uint8_t status;
+static const VMStateDescription vmstate_icp_server = {
+    .name = "icp/server",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32(xirr, ICPState),
+        VMSTATE_UINT8(pending_priority, ICPState),
+        VMSTATE_UINT8(mfrr, ICPState),
+        VMSTATE_END_OF_LIST()
+    },
 };
 
-struct ics_state {
-    int nr_irqs;
-    int offset;
-    qemu_irq *qirqs;
-    bool *islsi;
-    struct ics_irq_state *irqs;
-    struct icp_state *icp;
+static void icp_reset(DeviceState *dev)
+{
+    ICPState *icp = ICP(dev);
+
+    icp->xirr = 0;
+    icp->pending_priority = 0xff;
+    icp->mfrr = 0xff;
+
+    /* Make all outputs are deasserted */
+    qemu_set_irq(icp->output, 0);
+}
+
+static void icp_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = icp_reset;
+    dc->vmsd = &vmstate_icp_server;
+}
+
+static TypeInfo icp_info = {
+    .name = TYPE_ICP,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(ICPState),
+    .class_init = icp_class_init,
 };
 
-static int ics_valid_irq(struct ics_state *ics, uint32_t nr)
+/*
+ * ICS: Source layer
+ */
+static int ics_valid_irq(ICSState *ics, uint32_t nr)
 {
     return (nr >= ics->offset)
         && (nr < (ics->offset + ics->nr_irqs));
 }
 
-static void resend_msi(struct ics_state *ics, int srcno)
+static void resend_msi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     /* FIXME: filter by server#? */
     if (irq->status & XICS_STATUS_REJECTED) {
@@ -212,9 +217,9 @@ static void resend_msi(struct ics_state *ics, int srcno)
     }
 }
 
-static void resend_lsi(struct ics_state *ics, int srcno)
+static void resend_lsi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     if ((irq->priority != 0xff)
         && (irq->status & XICS_STATUS_ASSERTED)
@@ -224,9 +229,9 @@ static void resend_lsi(struct ics_state *ics, int srcno)
     }
 }
 
-static void set_irq_msi(struct ics_state *ics, int srcno, int val)
+static void set_irq_msi(ICSState *ics, int srcno, int val)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_set_irq_msi(srcno, srcno + ics->offset);
 
@@ -240,9 +245,9 @@ static void set_irq_msi(struct ics_state *ics, int srcno, int val)
     }
 }
 
-static void set_irq_lsi(struct ics_state *ics, int srcno, int val)
+static void set_irq_lsi(ICSState *ics, int srcno, int val)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_set_irq_lsi(srcno, srcno + ics->offset);
     if (val) {
@@ -255,7 +260,7 @@ static void set_irq_lsi(struct ics_state *ics, int srcno, int val)
 
 static void ics_set_irq(void *opaque, int srcno, int val)
 {
-    struct ics_state *ics = (struct ics_state *)opaque;
+    ICSState *ics = (ICSState *)opaque;
 
     if (ics->islsi[srcno]) {
         set_irq_lsi(ics, srcno, val);
@@ -264,9 +269,9 @@ static void ics_set_irq(void *opaque, int srcno, int val)
     }
 }
 
-static void write_xive_msi(struct ics_state *ics, int srcno)
+static void write_xive_msi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     if (!(irq->status & XICS_STATUS_MASKED_PENDING)
         || (irq->priority == 0xff)) {
@@ -277,16 +282,16 @@ static void write_xive_msi(struct ics_state *ics, int srcno)
     icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
 }
 
-static void write_xive_lsi(struct ics_state *ics, int srcno)
+static void write_xive_lsi(ICSState *ics, int srcno)
 {
     resend_lsi(ics, srcno);
 }
 
-static void ics_write_xive(struct ics_state *ics, int nr, int server,
+static void ics_write_xive(ICSState *ics, int nr, int server,
                            uint8_t priority, uint8_t saved_priority)
 {
     int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     irq->server = server;
     irq->priority = priority;
@@ -301,16 +306,16 @@ static void ics_write_xive(struct ics_state *ics, int nr, int server,
     }
 }
 
-static void ics_reject(struct ics_state *ics, int nr)
+static void ics_reject(ICSState *ics, int nr)
 {
-    struct ics_irq_state *irq = ics->irqs + nr - ics->offset;
+    ICSIRQState *irq = ics->irqs + nr - ics->offset;
 
     trace_xics_ics_reject(nr, nr - ics->offset);
     irq->status |= XICS_STATUS_REJECTED; /* Irrelevant but harmless for LSI */
     irq->status &= ~XICS_STATUS_SENT; /* Irrelevant but harmless for MSI */
 }
 
-static void ics_resend(struct ics_state *ics)
+static void ics_resend(ICSState *ics)
 {
     int i;
 
@@ -324,10 +329,10 @@ static void ics_resend(struct ics_state *ics)
     }
 }
 
-static void ics_eoi(struct ics_state *ics, int nr)
+static void ics_eoi(ICSState *ics, int nr)
 {
     int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_ics_eoi(nr);
 
@@ -336,11 +341,92 @@ static void ics_eoi(struct ics_state *ics, int nr)
     }
 }
 
+static void ics_reset(DeviceState *dev)
+{
+    ICSState *ics = ICS(dev);
+    int i;
+
+    memset(ics->irqs, 0, sizeof(ICSIRQState) * ics->nr_irqs);
+    for (i = 0; i < ics->nr_irqs; i++) {
+        ics->irqs[i].priority = 0xff;
+        ics->irqs[i].saved_priority = 0xff;
+    }
+}
+
+static int ics_post_load(void *opaque, int version_id)
+{
+    int i;
+    ICSState *ics = opaque;
+
+    for (i = 0; i < ics->icp->nr_servers; i++) {
+        icp_resend(ics->icp, i);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_ics_irq = {
+    .name = "ics/irq",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(server, ICSIRQState),
+        VMSTATE_UINT8(priority, ICSIRQState),
+        VMSTATE_UINT8(saved_priority, ICSIRQState),
+        VMSTATE_UINT8(status, ICSIRQState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_ics = {
+    .name = "ics",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .post_load = ics_post_load,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(nr_irqs, ICSState),
+
+        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(irqs, ICSState, nr_irqs,
+                                             vmstate_ics_irq, ICSIRQState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static int ics_realize(DeviceState *dev)
+{
+    ICSState *ics = ICS(dev);
+
+    ics->irqs = g_malloc0(ics->nr_irqs * sizeof(ICSIRQState));
+    ics->islsi = g_malloc0(ics->nr_irqs * sizeof(bool));
+    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, ics->nr_irqs);
+
+    return 0;
+}
+
+static void ics_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->init = ics_realize;
+    dc->vmsd = &vmstate_ics;
+    dc->reset = ics_reset;
+}
+
+static TypeInfo ics_info = {
+    .name = TYPE_ICS,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(ICSState),
+    .class_init = ics_class_init,
+};
+
 /*
  * Exported functions
  */
 
-qemu_irq xics_get_qirq(struct icp_state *icp, int irq)
+qemu_irq xics_get_qirq(XICSState *icp, int irq)
 {
     if (!ics_valid_irq(icp->ics, irq)) {
         return NULL;
@@ -349,13 +435,17 @@ qemu_irq xics_get_qirq(struct icp_state *icp, int irq)
     return icp->ics->qirqs[irq - icp->ics->offset];
 }
 
-void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi)
+void xics_set_irq_type(XICSState *icp, int irq, bool lsi)
 {
     assert(ics_valid_irq(icp->ics, irq));
 
     icp->ics->islsi[irq - icp->ics->offset] = lsi;
 }
 
+/*
+ * Guest interfaces
+ */
+
 static target_ulong h_cppr(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                            target_ulong opcode, target_ulong *args)
 {
@@ -405,7 +495,7 @@ static void rtas_set_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr, server, priority;
 
     if ((nargs != 3) || (nret != 1)) {
@@ -433,7 +523,7 @@ static void rtas_get_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 3)) {
@@ -458,7 +548,7 @@ static void rtas_int_off(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                          uint32_t nargs, target_ulong args,
                          uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 1)) {
@@ -484,7 +574,7 @@ static void rtas_int_on(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                         uint32_t nargs, target_ulong args,
                         uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 1)) {
@@ -506,32 +596,27 @@ static void rtas_int_on(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     rtas_st(rets, 0, 0); /* Success */
 }
 
-static void xics_reset(void *opaque)
+/*
+ * XICS
+ */
+
+static void xics_reset(DeviceState *d)
 {
-    struct icp_state *icp = (struct icp_state *)opaque;
-    struct ics_state *ics = icp->ics;
+    XICSState *icp = XICS(d);
     int i;
 
     for (i = 0; i < icp->nr_servers; i++) {
-        icp->ss[i].xirr = 0;
-        icp->ss[i].pending_priority = 0xff;
-        icp->ss[i].mfrr = 0xff;
-        /* Make all outputs are deasserted */
-        qemu_set_irq(icp->ss[i].output, 0);
+        device_reset(DEVICE(&icp->ss[i]));
     }
 
-    memset(ics->irqs, 0, sizeof(struct ics_irq_state) * ics->nr_irqs);
-    for (i = 0; i < ics->nr_irqs; i++) {
-        ics->irqs[i].priority = 0xff;
-        ics->irqs[i].saved_priority = 0xff;
-    }
+    device_reset(DEVICE(icp->ics));
 }
 
-void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu)
+void xics_cpu_setup(XICSState *icp, PowerPCCPU *cpu)
 {
     CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
-    struct icp_server_state *ss = &icp->ss[cs->cpu_index];
+    ICPState *ss = &icp->ss[cs->cpu_index];
 
     assert(cs->cpu_index < icp->nr_servers);
 
@@ -551,37 +636,73 @@ void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu)
     }
 }
 
-struct icp_state *xics_system_init(int nr_servers, int nr_irqs)
+static void xics_realize(DeviceState *dev, Error **errp)
 {
-    struct icp_state *icp;
-    struct ics_state *ics;
-
-    icp = g_malloc0(sizeof(*icp));
-    icp->nr_servers = nr_servers;
-    icp->ss = g_malloc0(icp->nr_servers*sizeof(struct icp_server_state));
+    XICSState *icp = XICS(dev);
+    ICSState *ics = icp->ics;
+    int i;
 
-    ics = g_malloc0(sizeof(*ics));
-    ics->nr_irqs = nr_irqs;
+    ics->nr_irqs = icp->nr_irqs;
     ics->offset = XICS_IRQ_BASE;
-    ics->irqs = g_malloc0(nr_irqs * sizeof(struct ics_irq_state));
-    ics->islsi = g_malloc0(nr_irqs * sizeof(bool));
-
-    icp->ics = ics;
     ics->icp = icp;
+    qdev_init_nofail(DEVICE(ics));
 
-    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, nr_irqs);
+    icp->ss = g_malloc0(icp->nr_servers*sizeof(ICPState));
+    for (i = 0; i < icp->nr_servers; i++) {
+        char buffer[32];
+        object_initialize(&icp->ss[i], TYPE_ICP);
+        snprintf(buffer, sizeof(buffer), "icp[%d]", i);
+        object_property_add_child(OBJECT(icp), buffer, OBJECT(&icp->ss[i]), NULL);
+        qdev_init_nofail(DEVICE(&icp->ss[i]));
+    }
+}
 
-    spapr_register_hypercall(H_CPPR, h_cppr);
-    spapr_register_hypercall(H_IPI, h_ipi);
-    spapr_register_hypercall(H_XIRR, h_xirr);
-    spapr_register_hypercall(H_EOI, h_eoi);
+static void xics_initfn(Object *obj)
+{
+    XICSState *xics = XICS(obj);
+
+    xics->ics = ICS(object_new(TYPE_ICS));
+    object_property_add_child(obj, "ics", OBJECT(xics->ics), NULL);
+}
+
+static Property xics_properties[] = {
+    DEFINE_PROP_UINT32("nr_servers", XICSState, nr_servers, -1),
+    DEFINE_PROP_UINT32("nr_irqs", XICSState, nr_irqs, -1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xics_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = xics_realize;
+    dc->props = xics_properties;
+    dc->reset = xics_reset;
 
     spapr_rtas_register("ibm,set-xive", rtas_set_xive);
     spapr_rtas_register("ibm,get-xive", rtas_get_xive);
     spapr_rtas_register("ibm,int-off", rtas_int_off);
     spapr_rtas_register("ibm,int-on", rtas_int_on);
 
-    qemu_register_reset(xics_reset, icp);
+    spapr_register_hypercall(H_CPPR, h_cppr);
+    spapr_register_hypercall(H_IPI, h_ipi);
+    spapr_register_hypercall(H_XIRR, h_xirr);
+    spapr_register_hypercall(H_EOI, h_eoi);
+}
+
+static const TypeInfo xics_info = {
+    .name          = TYPE_XICS,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XICSState),
+    .class_init    = xics_class_init,
+    .instance_init = xics_initfn,
+};
 
-    return icp;
+static void xics_register_types(void)
+{
+    type_register_static(&xics_info);
+    type_register_static(&ics_info);
+    type_register_static(&icp_info);
 }
+
+type_init(xics_register_types)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 7144829..16bfab9 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -129,6 +129,34 @@ int spapr_allocate_irq_block(int num, bool lsi)
     return first;
 }
 
+static XICSState *try_create_xics(const char *type, int nr_servers,
+                                  int nr_irqs)
+{
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, type);
+    qdev_prop_set_uint32(dev, "nr_servers", nr_servers);
+    qdev_prop_set_uint32(dev, "nr_irqs", nr_irqs);
+    if (qdev_init(dev) < 0) {
+        return NULL;
+    }
+
+    return XICS(dev);
+}
+
+static XICSState *xics_system_init(int nr_servers, int nr_irqs)
+{
+    XICSState *icp = NULL;
+
+    icp = try_create_xics(TYPE_XICS, nr_servers, nr_irqs);
+    if (!icp) {
+        perror("Failed to create XICS\n");
+        abort();
+    }
+
+    return icp;
+}
+
 static int spapr_fixup_cpu_dt(void *fdt, sPAPREnvironment *spapr)
 {
     int ret = 0, offset;
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index b06ce79..9fc1972 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -7,7 +7,6 @@
 struct VIOsPAPRBus;
 struct sPAPRPHBState;
 struct sPAPRNVRAM;
-struct icp_state;
 
 #define HPTE64_V_HPTE_DIRTY     0x0000000000000040ULL
 
@@ -15,7 +14,7 @@ typedef struct sPAPREnvironment {
     struct VIOsPAPRBus *vio_bus;
     QLIST_HEAD(, sPAPRPHBState) phbs;
     struct sPAPRNVRAM *nvram;
-    struct icp_state *icp;
+    XICSState *icp;
 
     hwaddr ram_limit;
     void *htab;
diff --git a/include/hw/ppc/xics.h b/include/hw/ppc/xics.h
index 6bce042..66364c5 100644
--- a/include/hw/ppc/xics.h
+++ b/include/hw/ppc/xics.h
@@ -27,15 +27,77 @@
 #if !defined(__XICS_H__)
 #define __XICS_H__
 
+#include "hw/sysbus.h"
+
+#define TYPE_XICS "xics"
+#define XICS(obj) OBJECT_CHECK(XICSState, (obj), TYPE_XICS)
+
 #define XICS_IPI        0x2
-#define XICS_IRQ_BASE   0x10
+#define XICS_BUID       0x1
+#define XICS_IRQ_BASE   (XICS_BUID << 12)
+
+/*
+ * We currently only support one BUID which is our interrupt base
+ * (the kernel implementation supports more but we don't exploit
+ *  that yet)
+ */
+typedef struct XICSState XICSState;
+typedef struct ICPState ICPState;
+typedef struct ICSState ICSState;
+typedef struct ICSIRQState ICSIRQState;
+
+struct XICSState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+    uint32_t nr_servers;
+    uint32_t nr_irqs;
+    ICPState *ss;
+    ICSState *ics;
+};
+
+#define TYPE_ICP "icp"
+#define ICP(obj) OBJECT_CHECK(ICPState, (obj), TYPE_ICP)
+
+struct ICPState {
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+    uint32_t xirr;
+    uint8_t pending_priority;
+    uint8_t mfrr;
+    qemu_irq output;
+};
+
+#define TYPE_ICS "ics"
+#define ICS(obj) OBJECT_CHECK(ICSState, (obj), TYPE_ICS)
+
+struct ICSState {
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+    uint32_t nr_irqs;
+    uint32_t offset;
+    qemu_irq *qirqs;
+    bool *islsi;
+    ICSIRQState *irqs;
+    XICSState *icp;
+};
 
-struct icp_state;
+struct ICSIRQState {
+    uint32_t server;
+    uint8_t priority;
+    uint8_t saved_priority;
+#define XICS_STATUS_ASSERTED           0x1
+#define XICS_STATUS_SENT               0x2
+#define XICS_STATUS_REJECTED           0x4
+#define XICS_STATUS_MASKED_PENDING     0x8
+    uint8_t status;
+};
 
-qemu_irq xics_get_qirq(struct icp_state *icp, int irq);
-void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi);
+qemu_irq xics_get_qirq(XICSState *icp, int irq);
+void xics_set_irq_type(XICSState *icp, int irq, bool lsi);
 
-struct icp_state *xics_system_init(int nr_servers, int nr_irqs);
-void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu);
+void xics_cpu_setup(XICSState *icp, PowerPCCPU *cpu);
 
 #endif /* __XICS_H__ */
commit e68cb8b4fa7e20e666a3bfc571a0e075733d22bd
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Thu Jul 18 14:33:03 2013 -0500

    pseries: savevm support with KVM
    
    At present, the savevm / migration support for the pseries machine will not
    work when KVM is enabled.  That's because KVM manages the guest's hash page
    table in the host kernel, so qemu has no visibility of it.  This patch
    fixes this by using new kernel interfaces to extract and reinsert the
    guest's hash table during the migration process.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Message-id: 1374175984-8930-11-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 734a782..7144829 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -735,17 +735,27 @@ static int htab_save_setup(QEMUFile *f, void *opaque)
 {
     sPAPREnvironment *spapr = opaque;
 
-    spapr->htab_save_index = 0;
-    spapr->htab_first_pass = true;
-
     /* "Iteration" header */
     qemu_put_be32(f, spapr->htab_shift);
 
+    if (spapr->htab) {
+        spapr->htab_save_index = 0;
+        spapr->htab_first_pass = true;
+    } else {
+        assert(kvm_enabled());
+
+        spapr->htab_fd = kvmppc_get_htab_fd(false);
+        if (spapr->htab_fd < 0) {
+            fprintf(stderr, "Unable to open fd for reading hash table from KVM: %s\n",
+                    strerror(errno));
+            return -1;
+        }
+    }
+
+
     return 0;
 }
 
-#define MAX_ITERATION_NS    5000000 /* 5 ms */
-
 static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
                                  int64_t max_ns)
 {
@@ -796,8 +806,8 @@ static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
     spapr->htab_save_index = index;
 }
 
-static bool htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
-                                 int64_t max_ns)
+static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                int64_t max_ns)
 {
     bool final = max_ns < 0;
     int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
@@ -870,21 +880,32 @@ static bool htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
 
     spapr->htab_save_index = index;
 
-    return (examined >= htabslots) && (sent == 0);
+    return (examined >= htabslots) && (sent == 0) ? 1 : 0;
 }
 
+#define MAX_ITERATION_NS    5000000 /* 5 ms */
+#define MAX_KVM_BUF_SIZE    2048
+
 static int htab_save_iterate(QEMUFile *f, void *opaque)
 {
     sPAPREnvironment *spapr = opaque;
-    bool nothingleft = false;;
+    int rc = 0;
 
     /* Iteration header */
     qemu_put_be32(f, 0);
 
-    if (spapr->htab_first_pass) {
+    if (!spapr->htab) {
+        assert(kvm_enabled());
+
+        rc = kvmppc_save_htab(f, spapr->htab_fd,
+                              MAX_KVM_BUF_SIZE, MAX_ITERATION_NS);
+        if (rc < 0) {
+            return rc;
+        }
+    } else  if (spapr->htab_first_pass) {
         htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
     } else {
-        nothingleft = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
+        rc = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
     }
 
     /* End marker */
@@ -892,7 +913,7 @@ static int htab_save_iterate(QEMUFile *f, void *opaque)
     qemu_put_be16(f, 0);
     qemu_put_be16(f, 0);
 
-    return nothingleft ? 1 : 0;
+    return rc;
 }
 
 static int htab_save_complete(QEMUFile *f, void *opaque)
@@ -902,7 +923,20 @@ static int htab_save_complete(QEMUFile *f, void *opaque)
     /* Iteration header */
     qemu_put_be32(f, 0);
 
-    htab_save_later_pass(f, spapr, -1);
+    if (!spapr->htab) {
+        int rc;
+
+        assert(kvm_enabled());
+
+        rc = kvmppc_save_htab(f, spapr->htab_fd, MAX_KVM_BUF_SIZE, -1);
+        if (rc < 0) {
+            return rc;
+        }
+        close(spapr->htab_fd);
+        spapr->htab_fd = -1;
+    } else {
+        htab_save_later_pass(f, spapr, -1);
+    }
 
     /* End marker */
     qemu_put_be32(f, 0);
@@ -916,6 +950,7 @@ static int htab_load(QEMUFile *f, void *opaque, int version_id)
 {
     sPAPREnvironment *spapr = opaque;
     uint32_t section_hdr;
+    int fd = -1;
 
     if (version_id < 1 || version_id > 1) {
         fprintf(stderr, "htab_load() bad version\n");
@@ -932,6 +967,16 @@ static int htab_load(QEMUFile *f, void *opaque, int version_id)
         return 0;
     }
 
+    if (!spapr->htab) {
+        assert(kvm_enabled());
+
+        fd = kvmppc_get_htab_fd(true);
+        if (fd < 0) {
+            fprintf(stderr, "Unable to open fd to restore KVM hash table: %s\n",
+                    strerror(errno));
+        }
+    }
+
     while (true) {
         uint32_t index;
         uint16_t n_valid, n_invalid;
@@ -945,24 +990,41 @@ static int htab_load(QEMUFile *f, void *opaque, int version_id)
             break;
         }
 
-        if ((index + n_valid + n_invalid) >=
+        if ((index + n_valid + n_invalid) >
             (HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
             /* Bad index in stream */
             fprintf(stderr, "htab_load() bad index %d (%hd+%hd entries) "
-                    "in htab stream\n", index, n_valid, n_invalid);
+                    "in htab stream (htab_shift=%d)\n", index, n_valid, n_invalid,
+                    spapr->htab_shift);
             return -EINVAL;
         }
 
-        if (n_valid) {
-            qemu_get_buffer(f, HPTE(spapr->htab, index),
-                            HASH_PTE_SIZE_64 * n_valid);
-        }
-        if (n_invalid) {
-            memset(HPTE(spapr->htab, index + n_valid), 0,
-                   HASH_PTE_SIZE_64 * n_invalid);
+        if (spapr->htab) {
+            if (n_valid) {
+                qemu_get_buffer(f, HPTE(spapr->htab, index),
+                                HASH_PTE_SIZE_64 * n_valid);
+            }
+            if (n_invalid) {
+                memset(HPTE(spapr->htab, index + n_valid), 0,
+                       HASH_PTE_SIZE_64 * n_invalid);
+            }
+        } else {
+            int rc;
+
+            assert(fd >= 0);
+
+            rc = kvmppc_load_htab_chunk(f, fd, index, n_valid, n_invalid);
+            if (rc < 0) {
+                return rc;
+            }
         }
     }
 
+    if (!spapr->htab) {
+        assert(fd >= 0);
+        close(fd);
+    }
+
     return 0;
 }
 
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 00a6f58..b06ce79 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -37,6 +37,7 @@ typedef struct sPAPREnvironment {
     /* Migration state */
     int htab_save_index;
     bool htab_first_pass;
+    int htab_fd;
 } sPAPREnvironment;
 
 #define H_SUCCESS         0
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 9f2e4f0..27e2aaf 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -65,6 +65,7 @@ static int cap_one_reg;
 static int cap_epr;
 static int cap_ppc_watchdog;
 static int cap_papr;
+static int cap_htab_fd;
 
 /* XXX We have a race condition where we actually have a level triggered
  *     interrupt, but the infrastructure can't expose that yet, so the guest
@@ -101,6 +102,7 @@ int kvm_arch_init(KVMState *s)
     cap_ppc_watchdog = kvm_check_extension(s, KVM_CAP_PPC_BOOKE_WATCHDOG);
     /* Note: we don't set cap_papr here, because this capability is
      * only activated after this by kvmppc_set_papr() */
+    cap_htab_fd = kvm_check_extension(s, KVM_CAP_PPC_HTAB_FD);
 
     if (!cap_interrupt_level) {
         fprintf(stderr, "KVM: Couldn't find level irq capability. Expect the "
@@ -1788,6 +1790,73 @@ static int kvm_ppc_register_host_cpu_type(void)
 }
 
 
+int kvmppc_get_htab_fd(bool write)
+{
+    struct kvm_get_htab_fd s = {
+        .flags = write ? KVM_GET_HTAB_WRITE : 0,
+        .start_index = 0,
+    };
+
+    if (!cap_htab_fd) {
+        fprintf(stderr, "KVM version doesn't support saving the hash table\n");
+        return -1;
+    }
+
+    return kvm_vm_ioctl(kvm_state, KVM_PPC_GET_HTAB_FD, &s);
+}
+
+int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns)
+{
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+    uint8_t buf[bufsize];
+    ssize_t rc;
+
+    do {
+        rc = read(fd, buf, bufsize);
+        if (rc < 0) {
+            fprintf(stderr, "Error reading data from KVM HTAB fd: %s\n",
+                    strerror(errno));
+            return rc;
+        } else if (rc) {
+            /* Kernel already retuns data in BE format for the file */
+            qemu_put_buffer(f, buf, rc);
+        }
+    } while ((rc != 0)
+             && ((max_ns < 0)
+                 || ((qemu_get_clock_ns(rt_clock) - starttime) < max_ns)));
+
+    return (rc == 0) ? 1 : 0;
+}
+
+int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                           uint16_t n_valid, uint16_t n_invalid)
+{
+    struct kvm_get_htab_header *buf;
+    size_t chunksize = sizeof(*buf) + n_valid*HASH_PTE_SIZE_64;
+    ssize_t rc;
+
+    buf = alloca(chunksize);
+    /* This is KVM on ppc, so this is all big-endian */
+    buf->index = index;
+    buf->n_valid = n_valid;
+    buf->n_invalid = n_invalid;
+
+    qemu_get_buffer(f, (void *)(buf + 1), HASH_PTE_SIZE_64*n_valid);
+
+    rc = write(fd, buf, chunksize);
+    if (rc < 0) {
+        fprintf(stderr, "Error writing KVM hash table: %s\n",
+                strerror(errno));
+        return rc;
+    }
+    if (rc != chunksize) {
+        /* We should never get a short write on a single chunk */
+        fprintf(stderr, "Short write, restoring KVM hash table\n");
+        return -1;
+    }
+    return 0;
+}
+
 bool kvm_arch_stop_on_emulation_error(CPUState *cpu)
 {
     return true;
diff --git a/target-ppc/kvm_ppc.h b/target-ppc/kvm_ppc.h
index 771cfbe..4ae7bf2 100644
--- a/target-ppc/kvm_ppc.h
+++ b/target-ppc/kvm_ppc.h
@@ -38,6 +38,10 @@ uint64_t kvmppc_rma_size(uint64_t current_size, unsigned int hash_shift);
 #endif /* !CONFIG_USER_ONLY */
 int kvmppc_fixup_cpu(PowerPCCPU *cpu);
 bool kvmppc_has_cap_epr(void);
+int kvmppc_get_htab_fd(bool write);
+int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns);
+int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                           uint16_t n_valid, uint16_t n_invalid);
 
 #else
 
@@ -159,6 +163,24 @@ static inline bool kvmppc_has_cap_epr(void)
 {
     return false;
 }
+
+static inline int kvmppc_get_htab_fd(bool write)
+{
+    return -1;
+}
+
+static inline int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize,
+                                   int64_t max_ns)
+{
+    abort();
+}
+
+static inline int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                                         uint16_t n_valid, uint16_t n_invalid)
+{
+    abort();
+}
+
 #endif
 
 #ifndef CONFIG_KVM
commit 1112cf94c82dfc743b62b5bcb96dd20f47b683a8
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:33:02 2013 -0500

    pseries: savevm support for PCI host bridge
    
    This adds the necessary support for saving the state of the PAPR virtual
    PCI host bridge (or host bridges).
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-10-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 9dc6ca3..3156fdd 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -662,6 +662,54 @@ static Property spapr_phb_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_pci_lsi = {
+    .name = "spapr_pci/lsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32_EQUAL(irq, struct spapr_pci_lsi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_spapr_pci_msi = {
+    .name = "spapr_pci/lsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(config_addr, struct spapr_pci_msi),
+        VMSTATE_UINT32(irq, struct spapr_pci_msi),
+        VMSTATE_UINT32(nvec, struct spapr_pci_msi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_spapr_pci = {
+    .name = "spapr_pci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64_EQUAL(buid, sPAPRPHBState),
+        VMSTATE_UINT32_EQUAL(dma_liobn, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(mem_win_addr, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(mem_win_size, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(io_win_addr, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(io_win_size, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(msi_win_addr, sPAPRPHBState),
+        VMSTATE_STRUCT_ARRAY(lsi_table, sPAPRPHBState, PCI_NUM_PINS, 0,
+                             vmstate_spapr_pci_lsi, struct spapr_pci_lsi),
+        VMSTATE_STRUCT_ARRAY(msi_table, sPAPRPHBState, SPAPR_MSIX_MAX_DEVS, 0,
+                             vmstate_spapr_pci_msi, struct spapr_pci_msi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static const char *spapr_phb_root_bus_path(PCIHostState *host_bridge,
                                            PCIBus *rootbus)
 {
@@ -680,6 +728,7 @@ static void spapr_phb_class_init(ObjectClass *klass, void *data)
     sdc->init = spapr_phb_init;
     dc->props = spapr_phb_properties;
     dc->reset = spapr_phb_reset;
+    dc->vmsd = &vmstate_spapr_pci;
 }
 
 static const TypeInfo spapr_phb_info = {
diff --git a/include/hw/pci-host/spapr.h b/include/hw/pci-host/spapr.h
index 1e23dbf..93f9511 100644
--- a/include/hw/pci-host/spapr.h
+++ b/include/hw/pci-host/spapr.h
@@ -52,14 +52,14 @@ typedef struct sPAPRPHBState {
     sPAPRTCETable *tcet;
     AddressSpace iommu_as;
 
-    struct {
+    struct spapr_pci_lsi {
         uint32_t irq;
     } lsi_table[PCI_NUM_PINS];
 
-    struct {
+    struct spapr_pci_msi {
         uint32_t config_addr;
         uint32_t irq;
-        int nvec;
+        uint32_t nvec;
     } msi_table[SPAPR_MSIX_MAX_DEVS];
 
     QLIST_ENTRY(sPAPRPHBState) list;
commit 4be21d561d59da9d6f20f872882652bc3561f871
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:33:01 2013 -0500

    pseries: savevm support for pseries machine
    
    This adds the necessary pieces to implement savevm / migration for the
    pseries machine.  The most complex part here is migrating the hash
    table - for the paravirtualized pseries machine the guest's hash page
    table is not stored within guest memory, but externally and the guest
    accesses it via hypercalls.
    
    This patch uses a hypervisor reserved bit of the HPTE as a dirty bit
    (tracking changes to the HPTE itself, not the page it references).
    This is used to implement a live migration style incremental save and
    restore of the hash table contents.
    
    Normally a hash table is 16MB but it can get bigger depending on how
    much RAM the guest has. Due to its nature, updates to it are random so
    the live migration style is used for it.
    
    In addition it adds VMStateDescription information to save and restore
    the (few) remaining pieces of state information needed by the pseries
    machine.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-9-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index e340708..734a782 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -32,6 +32,7 @@
 #include "sysemu/cpus.h"
 #include "sysemu/kvm.h"
 #include "kvm_ppc.h"
+#include "mmu-hash64.h"
 
 #include "hw/boards.h"
 #include "hw/ppc/ppc.h"
@@ -666,7 +667,7 @@ static void spapr_cpu_reset(void *opaque)
 
     env->spr[SPR_HIOR] = 0;
 
-    env->external_htab = spapr->htab;
+    env->external_htab = (uint8_t *)spapr->htab;
     env->htab_base = -1;
     env->htab_mask = HTAB_SIZE(spapr) - 1;
     env->spr[SPR_SDR1] = (target_ulong)(uintptr_t)spapr->htab |
@@ -710,6 +711,268 @@ static int spapr_vga_init(PCIBus *pci_bus)
     }
 }
 
+static const VMStateDescription vmstate_spapr = {
+    .name = "spapr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(next_irq, sPAPREnvironment),
+
+        /* RTC offset */
+        VMSTATE_UINT64(rtc_offset, sPAPREnvironment),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+#define HPTE(_table, _i)   (void *)(((uint64_t *)(_table)) + ((_i) * 2))
+#define HPTE_VALID(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_VALID)
+#define HPTE_DIRTY(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_HPTE_DIRTY)
+#define CLEAN_HPTE(_hpte)  ((*(uint64_t *)(_hpte)) &= tswap64(~HPTE64_V_HPTE_DIRTY))
+
+static int htab_save_setup(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+
+    spapr->htab_save_index = 0;
+    spapr->htab_first_pass = true;
+
+    /* "Iteration" header */
+    qemu_put_be32(f, spapr->htab_shift);
+
+    return 0;
+}
+
+#define MAX_ITERATION_NS    5000000 /* 5 ms */
+
+static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                 int64_t max_ns)
+{
+    int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
+    int index = spapr->htab_save_index;
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+
+    assert(spapr->htab_first_pass);
+
+    do {
+        int chunkstart;
+
+        /* Consume invalid HPTEs */
+        while ((index < htabslots)
+               && !HPTE_VALID(HPTE(spapr->htab, index))) {
+            index++;
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+        }
+
+        /* Consume valid HPTEs */
+        chunkstart = index;
+        while ((index < htabslots)
+               && HPTE_VALID(HPTE(spapr->htab, index))) {
+            index++;
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+        }
+
+        if (index > chunkstart) {
+            int n_valid = index - chunkstart;
+
+            qemu_put_be32(f, chunkstart);
+            qemu_put_be16(f, n_valid);
+            qemu_put_be16(f, 0);
+            qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
+                            HASH_PTE_SIZE_64 * n_valid);
+
+            if ((qemu_get_clock_ns(rt_clock) - starttime) > max_ns) {
+                break;
+            }
+        }
+    } while ((index < htabslots) && !qemu_file_rate_limit(f));
+
+    if (index >= htabslots) {
+        assert(index == htabslots);
+        index = 0;
+        spapr->htab_first_pass = false;
+    }
+    spapr->htab_save_index = index;
+}
+
+static bool htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                 int64_t max_ns)
+{
+    bool final = max_ns < 0;
+    int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
+    int examined = 0, sent = 0;
+    int index = spapr->htab_save_index;
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+
+    assert(!spapr->htab_first_pass);
+
+    do {
+        int chunkstart, invalidstart;
+
+        /* Consume non-dirty HPTEs */
+        while ((index < htabslots)
+               && !HPTE_DIRTY(HPTE(spapr->htab, index))) {
+            index++;
+            examined++;
+        }
+
+        chunkstart = index;
+        /* Consume valid dirty HPTEs */
+        while ((index < htabslots)
+               && HPTE_DIRTY(HPTE(spapr->htab, index))
+               && HPTE_VALID(HPTE(spapr->htab, index))) {
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+            index++;
+            examined++;
+        }
+
+        invalidstart = index;
+        /* Consume invalid dirty HPTEs */
+        while ((index < htabslots)
+               && HPTE_DIRTY(HPTE(spapr->htab, index))
+               && !HPTE_VALID(HPTE(spapr->htab, index))) {
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+            index++;
+            examined++;
+        }
+
+        if (index > chunkstart) {
+            int n_valid = invalidstart - chunkstart;
+            int n_invalid = index - invalidstart;
+
+            qemu_put_be32(f, chunkstart);
+            qemu_put_be16(f, n_valid);
+            qemu_put_be16(f, n_invalid);
+            qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
+                            HASH_PTE_SIZE_64 * n_valid);
+            sent += index - chunkstart;
+
+            if (!final && (qemu_get_clock_ns(rt_clock) - starttime) > max_ns) {
+                break;
+            }
+        }
+
+        if (examined >= htabslots) {
+            break;
+        }
+
+        if (index >= htabslots) {
+            assert(index == htabslots);
+            index = 0;
+        }
+    } while ((examined < htabslots) && (!qemu_file_rate_limit(f) || final));
+
+    if (index >= htabslots) {
+        assert(index == htabslots);
+        index = 0;
+    }
+
+    spapr->htab_save_index = index;
+
+    return (examined >= htabslots) && (sent == 0);
+}
+
+static int htab_save_iterate(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+    bool nothingleft = false;;
+
+    /* Iteration header */
+    qemu_put_be32(f, 0);
+
+    if (spapr->htab_first_pass) {
+        htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
+    } else {
+        nothingleft = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
+    }
+
+    /* End marker */
+    qemu_put_be32(f, 0);
+    qemu_put_be16(f, 0);
+    qemu_put_be16(f, 0);
+
+    return nothingleft ? 1 : 0;
+}
+
+static int htab_save_complete(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+
+    /* Iteration header */
+    qemu_put_be32(f, 0);
+
+    htab_save_later_pass(f, spapr, -1);
+
+    /* End marker */
+    qemu_put_be32(f, 0);
+    qemu_put_be16(f, 0);
+    qemu_put_be16(f, 0);
+
+    return 0;
+}
+
+static int htab_load(QEMUFile *f, void *opaque, int version_id)
+{
+    sPAPREnvironment *spapr = opaque;
+    uint32_t section_hdr;
+
+    if (version_id < 1 || version_id > 1) {
+        fprintf(stderr, "htab_load() bad version\n");
+        return -EINVAL;
+    }
+
+    section_hdr = qemu_get_be32(f);
+
+    if (section_hdr) {
+        /* First section, just the hash shift */
+        if (spapr->htab_shift != section_hdr) {
+            return -EINVAL;
+        }
+        return 0;
+    }
+
+    while (true) {
+        uint32_t index;
+        uint16_t n_valid, n_invalid;
+
+        index = qemu_get_be32(f);
+        n_valid = qemu_get_be16(f);
+        n_invalid = qemu_get_be16(f);
+
+        if ((index == 0) && (n_valid == 0) && (n_invalid == 0)) {
+            /* End of Stream */
+            break;
+        }
+
+        if ((index + n_valid + n_invalid) >=
+            (HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
+            /* Bad index in stream */
+            fprintf(stderr, "htab_load() bad index %d (%hd+%hd entries) "
+                    "in htab stream\n", index, n_valid, n_invalid);
+            return -EINVAL;
+        }
+
+        if (n_valid) {
+            qemu_get_buffer(f, HPTE(spapr->htab, index),
+                            HASH_PTE_SIZE_64 * n_valid);
+        }
+        if (n_invalid) {
+            memset(HPTE(spapr->htab, index + n_valid), 0,
+                   HASH_PTE_SIZE_64 * n_invalid);
+        }
+    }
+
+    return 0;
+}
+
+static SaveVMHandlers savevm_htab_handlers = {
+    .save_live_setup = htab_save_setup,
+    .save_live_iterate = htab_save_iterate,
+    .save_live_complete = htab_save_complete,
+    .load_state = htab_load,
+};
+
 /* pSeries LPAR / sPAPR hardware init */
 static void ppc_spapr_init(QEMUMachineInitArgs *args)
 {
@@ -950,6 +1213,10 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
 
     spapr->entry_point = 0x100;
 
+    vmstate_register(NULL, 0, &vmstate_spapr, spapr);
+    register_savevm_live(NULL, "spapr/htab", -1, 1,
+                         &savevm_htab_handlers, spapr);
+
     /* Prepare the device tree */
     spapr->fdt_skel = spapr_create_fdt_skel(cpu_model,
                                             initrd_base, initrd_size,
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index ed32dec..67d6cd9 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -115,7 +115,7 @@ static target_ulong h_enter(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     }
     ppc_hash64_store_hpte1(env, hpte, ptel);
     /* eieio();  FIXME: need some sort of barrier for smp? */
-    ppc_hash64_store_hpte0(env, hpte, pteh);
+    ppc_hash64_store_hpte0(env, hpte, pteh | HPTE64_V_HPTE_DIRTY);
 
     args[0] = pte_index + i;
     return H_SUCCESS;
@@ -152,7 +152,7 @@ static RemoveResult remove_hpte(CPUPPCState *env, target_ulong ptex,
     }
     *vp = v;
     *rp = r;
-    ppc_hash64_store_hpte0(env, hpte, 0);
+    ppc_hash64_store_hpte0(env, hpte, HPTE64_V_HPTE_DIRTY);
     rb = compute_tlbie_rb(v, r, ptex);
     ppc_tlb_invalidate_one(env, rb);
     return REMOVE_SUCCESS;
@@ -282,11 +282,11 @@ static target_ulong h_protect(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     r |= (flags << 48) & HPTE64_R_KEY_HI;
     r |= flags & (HPTE64_R_PP | HPTE64_R_N | HPTE64_R_KEY_LO);
     rb = compute_tlbie_rb(v, r, pte_index);
-    ppc_hash64_store_hpte0(env, hpte, v & ~HPTE64_V_VALID);
+    ppc_hash64_store_hpte0(env, hpte, (v & ~HPTE64_V_VALID) | HPTE64_V_HPTE_DIRTY);
     ppc_tlb_invalidate_one(env, rb);
     ppc_hash64_store_hpte1(env, hpte, r);
     /* Don't need a memory barrier, due to qemu's global lock */
-    ppc_hash64_store_hpte0(env, hpte, v);
+    ppc_hash64_store_hpte0(env, hpte, v | HPTE64_V_HPTE_DIRTY);
     return H_SUCCESS;
 }
 
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 82ad7c0..00a6f58 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -9,6 +9,8 @@ struct sPAPRPHBState;
 struct sPAPRNVRAM;
 struct icp_state;
 
+#define HPTE64_V_HPTE_DIRTY     0x0000000000000040ULL
+
 typedef struct sPAPREnvironment {
     struct VIOsPAPRBus *vio_bus;
     QLIST_HEAD(, sPAPRPHBState) phbs;
@@ -17,20 +19,24 @@ typedef struct sPAPREnvironment {
 
     hwaddr ram_limit;
     void *htab;
-    long htab_shift;
+    uint32_t htab_shift;
     hwaddr rma_size;
     int vrma_adjust;
     hwaddr fdt_addr, rtas_addr;
     long rtas_size;
     void *fdt_skel;
     target_ulong entry_point;
-    int next_irq;
-    int rtc_offset;
+    uint32_t next_irq;
+    uint64_t rtc_offset;
     char *cpu_model;
     bool has_graphics;
 
     uint32_t epow_irq;
     Notifier epow_notifier;
+
+    /* Migration state */
+    int htab_save_index;
+    bool htab_first_pass;
 } sPAPREnvironment;
 
 #define H_SUCCESS         0
commit 1168ec7da182d417125d9dea46908c0cfa2c40b7
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:33:00 2013 -0500

    pseries: savevm support for PAPR virtual SCSI
    
    This patch adds the necessary support for saving the state of the PAPR VIO
    virtual SCSI device. This also saves and restores active SCSI requests.
    
    [aik: implemented vscsi_req save/restore]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-8-git-send-email-aliguori at us.ibm.com
    Cc: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index b0858e9..46f4455 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -578,6 +578,69 @@ static void vscsi_request_cancelled(SCSIRequest *sreq)
     vscsi_put_req(req);
 }
 
+static const VMStateDescription vmstate_spapr_vscsi_req = {
+    .name = "spapr_vscsi_req",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_BUFFER(crq.raw, vscsi_req),
+        VMSTATE_BUFFER(iu.srp.reserved, vscsi_req),
+        VMSTATE_UINT32(qtag, vscsi_req),
+        VMSTATE_BOOL(active, vscsi_req),
+        VMSTATE_UINT32(data_len, vscsi_req),
+        VMSTATE_BOOL(writing, vscsi_req),
+        VMSTATE_UINT32(senselen, vscsi_req),
+        VMSTATE_BUFFER(sense, vscsi_req),
+        VMSTATE_UINT8(dma_fmt, vscsi_req),
+        VMSTATE_UINT16(local_desc, vscsi_req),
+        VMSTATE_UINT16(total_desc, vscsi_req),
+        VMSTATE_UINT16(cdb_offset, vscsi_req),
+      /*Restart SCSI request from the beginning for now */
+      /*VMSTATE_UINT16(cur_desc_num, vscsi_req),
+        VMSTATE_UINT16(cur_desc_offset, vscsi_req),*/
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
+{
+    vscsi_req *req = sreq->hba_private;
+    assert(req->active);
+
+    vmstate_save_state(f, &vmstate_spapr_vscsi_req, req);
+
+    dprintf("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
+            req->qtag, req->cur_desc_num, req->cur_desc_offset);
+}
+
+static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq)
+{
+    SCSIBus *bus = sreq->bus;
+    VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(bus->qbus.parent);
+    vscsi_req *req;
+    int rc;
+
+    assert(sreq->tag < VSCSI_REQ_LIMIT);
+    req = &s->reqs[sreq->tag];
+    assert(!req->active);
+
+    memset(req, 0, sizeof(*req));
+    rc = vmstate_load_state(f, &vmstate_spapr_vscsi_req, req, 1);
+    if (rc) {
+        fprintf(stderr, "VSCSI: failed loading request tag#%u\n", sreq->tag);
+        return NULL;
+    }
+    assert(req->active);
+
+    req->sreq = scsi_req_ref(sreq);
+
+    dprintf("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
+            req->qtag, req->cur_desc_num, req->cur_desc_offset);
+
+    return req;
+}
+
 static void vscsi_process_login(VSCSIState *s, vscsi_req *req)
 {
     union viosrp_iu *iu = &req->iu;
@@ -932,7 +995,9 @@ static const struct SCSIBusInfo vscsi_scsi_info = {
 
     .transfer_data = vscsi_transfer_data,
     .complete = vscsi_command_complete,
-    .cancel = vscsi_request_cancelled
+    .cancel = vscsi_request_cancelled,
+    .save_request = vscsi_save_request,
+    .load_request = vscsi_load_request,
 };
 
 static void spapr_vscsi_reset(VIOsPAPRDevice *dev)
@@ -996,6 +1061,20 @@ static Property spapr_vscsi_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_vscsi = {
+    .name = "spapr_vscsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(vdev, VSCSIState),
+        /* VSCSI state */
+        /* ???? */
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1010,6 +1089,7 @@ static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
     k->signal_mask = 0x00000001;
     dc->props = spapr_vscsi_properties;
     k->rtce_window_size = 0x10000000;
+    dc->vmsd = &vmstate_spapr_vscsi;
 }
 
 static const TypeInfo spapr_vscsi_info = {
commit 8ca8a17c9a16eb3b2fedb3c74687c429e9cfc6aa
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Thu Jul 18 14:32:59 2013 -0500

    pseries: rework PAPR virtual SCSI
    
    The patch reimplements handling of indirect requests in order to
    simplify upcoming live migration support.
    - all pointers (except SCSIRequest*) were replaces with integer
    indexes and offsets;
    - DMA'ed srp_direct_buf kept untouched (ie. BE format);
    - vscsi_fetch_desc() is added, now it is the only place where
    descriptors are fetched and byteswapped;
    - vscsi_req struct fields converted to migration-friendly types;
    - many dprintf()'s fixed.
    
    This also removed an unused field 'lun' from the spapr_vscsi device
    which is assigned, but never used.  So, remove it.
    
    [David Gibson: removed unused 'lun']
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-7-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 55b44b9..b0858e9 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -75,20 +75,19 @@ typedef struct vscsi_req {
     /* SCSI request tracking */
     SCSIRequest             *sreq;
     uint32_t                qtag; /* qemu tag != srp tag */
-    int                     lun;
-    int                     active;
-    long                    data_len;
-    int                     writing;
-    int                     senselen;
+    bool                    active;
+    uint32_t                data_len;
+    bool                    writing;
+    uint32_t                senselen;
     uint8_t                 sense[SCSI_SENSE_BUF_SIZE];
 
     /* RDMA related bits */
     uint8_t                 dma_fmt;
-    struct srp_direct_buf   ext_desc;
-    struct srp_direct_buf   *cur_desc;
-    struct srp_indirect_buf *ind_desc;
-    int                     local_desc;
-    int                     total_desc;
+    uint16_t                local_desc;
+    uint16_t                total_desc;
+    uint16_t                cdb_offset;
+    uint16_t                cur_desc_num;
+    uint16_t                cur_desc_offset;
 } vscsi_req;
 
 #define TYPE_VIO_SPAPR_VSCSI_DEVICE "spapr-vscsi"
@@ -264,93 +263,138 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     return 0;
 }
 
-static inline void vscsi_swap_desc(struct srp_direct_buf *desc)
+static inline struct srp_direct_buf vscsi_swap_desc(struct srp_direct_buf desc)
 {
-    desc->va = be64_to_cpu(desc->va);
-    desc->len = be32_to_cpu(desc->len);
+    desc.va = be64_to_cpu(desc.va);
+    desc.len = be32_to_cpu(desc.len);
+    return desc;
+}
+
+static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
+                            unsigned n, unsigned buf_offset,
+                            struct srp_direct_buf *ret)
+{
+    struct srp_cmd *cmd = &req->iu.srp.cmd;
+
+    switch (req->dma_fmt) {
+    case SRP_NO_DATA_DESC: {
+        dprintf("VSCSI: no data descriptor\n");
+        return 0;
+    }
+    case SRP_DATA_DESC_DIRECT: {
+        memcpy(ret, cmd->add_data + req->cdb_offset, sizeof(*ret));
+        assert(req->cur_desc_num == 0);
+        dprintf("VSCSI: direct segment\n");
+        break;
+    }
+    case SRP_DATA_DESC_INDIRECT: {
+        struct srp_indirect_buf *tmp = (struct srp_indirect_buf *)
+                                       (cmd->add_data + req->cdb_offset);
+        if (n < req->local_desc) {
+            *ret = tmp->desc_list[n];
+            dprintf("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
+                    req->qtag, n, req->local_desc);
+
+        } else if (n < req->total_desc) {
+            int rc;
+            struct srp_direct_buf tbl_desc = vscsi_swap_desc(tmp->table_desc);
+            unsigned desc_offset = n * sizeof(struct srp_direct_buf);
+
+            if (desc_offset >= tbl_desc.len) {
+                dprintf("VSCSI:   #%d is ouf of range (%d bytes)\n",
+                        n, desc_offset);
+                return -1;
+            }
+            rc = spapr_vio_dma_read(&s->vdev, tbl_desc.va + desc_offset,
+                                    ret, sizeof(struct srp_direct_buf));
+            if (rc) {
+                dprintf("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
+                        rc);
+                return -1;
+            }
+            dprintf("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
+                    req->qtag, n, req->total_desc, tbl_desc.va, tbl_desc.len);
+        } else {
+            dprintf("VSCSI:   Out of descriptors !\n");
+            return 0;
+        }
+        break;
+    }
+    default:
+        fprintf(stderr, "VSCSI:   Unknown format %x\n", req->dma_fmt);
+        return -1;
+    }
+
+    *ret = vscsi_swap_desc(*ret);
+    if (buf_offset > ret->len) {
+        dprintf("   offset=%x is out of a descriptor #%d boundary=%x\n",
+                buf_offset, req->cur_desc_num, ret->len);
+        return -1;
+    }
+    ret->va += buf_offset;
+    ret->len -= buf_offset;
+
+    dprintf("   cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
+            req->cur_desc_num, req->cur_desc_offset, ret->va, ret->len);
+
+    return ret->len ? 1 : 0;
 }
 
 static int vscsi_srp_direct_data(VSCSIState *s, vscsi_req *req,
                                  uint8_t *buf, uint32_t len)
 {
-    struct srp_direct_buf *md = req->cur_desc;
+    struct srp_direct_buf md;
     uint32_t llen;
     int rc = 0;
 
-    dprintf("VSCSI: direct segment 0x%x bytes, va=0x%llx desc len=0x%x\n",
-            len, (unsigned long long)md->va, md->len);
+    rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
+    if (rc < 0) {
+        return -1;
+    } else if (rc == 0) {
+        return 0;
+    }
 
-    llen = MIN(len, md->len);
+    llen = MIN(len, md.len);
     if (llen) {
         if (req->writing) { /* writing = to device = reading from memory */
-            rc = spapr_vio_dma_read(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
         } else {
-            rc = spapr_vio_dma_write(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
         }
     }
-    md->len -= llen;
-    md->va += llen;
 
     if (rc) {
         return -1;
     }
+    req->cur_desc_offset += llen;
+
     return llen;
 }
 
 static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
                                    uint8_t *buf, uint32_t len)
 {
-    struct srp_direct_buf *td = &req->ind_desc->table_desc;
-    struct srp_direct_buf *md = req->cur_desc;
+    struct srp_direct_buf md;
     int rc = 0;
     uint32_t llen, total = 0;
 
-    dprintf("VSCSI: indirect segment 0x%x bytes, td va=0x%llx len=0x%x\n",
-            len, (unsigned long long)td->va, td->len);
+    dprintf("VSCSI: indirect segment 0x%x bytes\n", len);
 
     /* While we have data ... */
     while (len) {
-        /* If we have a descriptor but it's empty, go fetch a new one */
-        if (md && md->len == 0) {
-            /* More local available, use one */
-            if (req->local_desc) {
-                md = ++req->cur_desc;
-                --req->local_desc;
-                --req->total_desc;
-                td->va += sizeof(struct srp_direct_buf);
-            } else {
-                md = req->cur_desc = NULL;
-            }
-        }
-        /* No descriptor at hand, fetch one */
-        if (!md) {
-            if (!req->total_desc) {
-                dprintf("VSCSI:   Out of descriptors !\n");
-                break;
-            }
-            md = req->cur_desc = &req->ext_desc;
-            dprintf("VSCSI:   Reading desc from 0x%llx\n",
-                    (unsigned long long)td->va);
-            rc = spapr_vio_dma_read(&s->vdev, td->va, md,
-                                    sizeof(struct srp_direct_buf));
-            if (rc) {
-                dprintf("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
-                        rc);
-                break;
-            }
-            vscsi_swap_desc(md);
-            td->va += sizeof(struct srp_direct_buf);
-            --req->total_desc;
+        rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
+        if (rc < 0) {
+            return -1;
+        } else if (rc == 0) {
+            break;
         }
-        dprintf("VSCSI:   [desc va=0x%llx,len=0x%x] remaining=0x%x\n",
-                (unsigned long long)md->va, md->len, len);
 
         /* Perform transfer */
-        llen = MIN(len, md->len);
+        llen = MIN(len, md.len);
         if (req->writing) { /* writing = to device = reading from memory */
-            rc = spapr_vio_dma_read(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
         } else {
-            rc = spapr_vio_dma_write(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
         }
         if (rc) {
             dprintf("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
@@ -361,10 +405,18 @@ static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
 
         len -= llen;
         buf += llen;
+
         total += llen;
-        md->va += llen;
-        md->len -= llen;
+
+        /* Update current position in the current descriptor */
+        req->cur_desc_offset += llen;
+        if (md.len == llen) {
+            /* Go to the next descriptor if the current one finished */
+            ++req->cur_desc_num;
+            req->cur_desc_offset = 0;
+        }
     }
+
     return rc ? -1 : total;
 }
 
@@ -412,14 +464,13 @@ static int data_out_desc_size(struct srp_cmd *cmd)
 static int vscsi_preprocess_desc(vscsi_req *req)
 {
     struct srp_cmd *cmd = &req->iu.srp.cmd;
-    int offset, i;
 
-    offset = cmd->add_cdb_len & ~3;
+    req->cdb_offset = cmd->add_cdb_len & ~3;
 
     if (req->writing) {
         req->dma_fmt = cmd->buf_fmt >> 4;
     } else {
-        offset += data_out_desc_size(cmd);
+        req->cdb_offset += data_out_desc_size(cmd);
         req->dma_fmt = cmd->buf_fmt & ((1U << 4) - 1);
     }
 
@@ -427,31 +478,18 @@ static int vscsi_preprocess_desc(vscsi_req *req)
     case SRP_NO_DATA_DESC:
         break;
     case SRP_DATA_DESC_DIRECT:
-        req->cur_desc = (struct srp_direct_buf *)(cmd->add_data + offset);
         req->total_desc = req->local_desc = 1;
-        vscsi_swap_desc(req->cur_desc);
-        dprintf("VSCSI: using direct RDMA %s, 0x%x bytes MD: 0x%llx\n",
-                req->writing ? "write" : "read",
-                req->cur_desc->len, (unsigned long long)req->cur_desc->va);
         break;
-    case SRP_DATA_DESC_INDIRECT:
-        req->ind_desc = (struct srp_indirect_buf *)(cmd->add_data + offset);
-        vscsi_swap_desc(&req->ind_desc->table_desc);
-        req->total_desc = req->ind_desc->table_desc.len /
-            sizeof(struct srp_direct_buf);
+    case SRP_DATA_DESC_INDIRECT: {
+        struct srp_indirect_buf *ind_tmp = (struct srp_indirect_buf *)
+                (cmd->add_data + req->cdb_offset);
+
+        req->total_desc = be32_to_cpu(ind_tmp->table_desc.len) /
+                          sizeof(struct srp_direct_buf);
         req->local_desc = req->writing ? cmd->data_out_desc_cnt :
-            cmd->data_in_desc_cnt;
-        for (i = 0; i < req->local_desc; i++) {
-            vscsi_swap_desc(&req->ind_desc->desc_list[i]);
-        }
-        req->cur_desc = req->local_desc ? &req->ind_desc->desc_list[0] : NULL;
-        dprintf("VSCSI: using indirect RDMA %s, 0x%x bytes %d descs "
-                "(%d local) VA: 0x%llx\n",
-                req->writing ? "read" : "write",
-                be32_to_cpu(req->ind_desc->len),
-                req->total_desc, req->local_desc,
-                (unsigned long long)req->ind_desc->table_desc.va);
+                          cmd->data_in_desc_cnt;
         break;
+    }
     default:
         fprintf(stderr,
                 "vscsi_preprocess_desc: Unknown format %x\n", req->dma_fmt);
@@ -499,8 +537,8 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     vscsi_req *req = sreq->hba_private;
     int32_t res_in = 0, res_out = 0;
 
-    dprintf("VSCSI: SCSI cmd complete, r=0x%x tag=0x%x status=0x%x, req=%p\n",
-            reason, sreq->tag, status, req);
+    dprintf("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
+            sreq->tag, status, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
         return;
@@ -509,7 +547,7 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     if (status == CHECK_CONDITION) {
         req->senselen = scsi_req_get_sense(req->sreq, req->sense,
                                            sizeof(req->sense));
-        dprintf("VSCSI: Sense data, %d bytes:\n", len);
+        dprintf("VSCSI: Sense data, %d bytes:\n", req->senselen);
         dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[0], req->sense[1], req->sense[2], req->sense[3],
                 req->sense[4], req->sense[5], req->sense[6], req->sense[7]);
@@ -621,12 +659,11 @@ static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req)
         } return 1;
     }
 
-    req->lun = lun;
     req->sreq = scsi_req_new(sdev, req->qtag, lun, srp->cmd.cdb, req);
     n = scsi_req_enqueue(req->sreq);
 
-    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x ID %d LUN %d ret: %d\n",
-            req->qtag, srp->cmd.cdb[0], id, lun, n);
+    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
+            req->qtag, srp->cmd.cdb[0], lun, n);
 
     if (n) {
         /* Transfer direction must be set before preprocessing the
commit a83000f5e3fac30a7f213af1ba6a8f827622854d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 14:32:58 2013 -0500

    spapr-tce: make sPAPRTCETable a proper device
    
    Model TCE tables as a device that's hooked up as a child object to
    the owner.  Besides the code cleanup, we get a few nice benefits:
    
    1) free actually works now (it was dead code before)
    
    2) the TCE information is visible in the device tree
    
    3) we can expose table information as properties such that if we
       change the window_size, we can use globals to keep migration
       working.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-6-git-send-email-aliguori at us.ibm.com
    [dwg: pseries: savevm support for PAPR TCE tables]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    [alexey: ppc kvm: fix to compile]
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 48ae092..e340708 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -848,9 +848,6 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
     /* Set up EPOW events infrastructure */
     spapr_events_init(spapr);
 
-    /* Set up IOMMU */
-    spapr_iommu_init();
-
     /* Set up VIO bus */
     spapr->vio_bus = spapr_vio_bus_init();
 
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index 89b33a5..3d4a1fc 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -36,17 +36,6 @@ enum sPAPRTCEAccess {
     SPAPR_TCE_RW = 3,
 };
 
-struct sPAPRTCETable {
-    uint32_t liobn;
-    uint32_t window_size;
-    sPAPRTCE *table;
-    bool bypass;
-    int fd;
-    MemoryRegion iommu;
-    QLIST_ENTRY(sPAPRTCETable) list;
-};
-
-
 QLIST_HEAD(spapr_tce_tables, sPAPRTCETable) spapr_tce_tables;
 
 static sPAPRTCETable *spapr_tce_find_by_liobn(uint32_t liobn)
@@ -96,7 +85,7 @@ static IOMMUTLBEntry spapr_tce_translate_iommu(MemoryRegion *iommu, hwaddr addr)
         return (IOMMUTLBEntry) { .perm = IOMMU_NONE };
     }
 
-    tce = tcet->table[addr >> SPAPR_TCE_PAGE_SHIFT].tce;
+    tce = tcet->table[addr >> SPAPR_TCE_PAGE_SHIFT];
 
 #ifdef DEBUG_TCE
     fprintf(stderr, " ->  *paddr=0x%llx, *len=0x%llx\n",
@@ -112,55 +101,97 @@ static IOMMUTLBEntry spapr_tce_translate_iommu(MemoryRegion *iommu, hwaddr addr)
     };
 }
 
+static int spapr_tce_table_pre_load(void *opaque)
+{
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(opaque);
+
+    tcet->nb_table = tcet->window_size >> SPAPR_TCE_PAGE_SHIFT;
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_spapr_tce_table = {
+    .name = "spapr_iommu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .pre_load = spapr_tce_table_pre_load,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(liobn, sPAPRTCETable),
+        VMSTATE_UINT32_EQUAL(window_size, sPAPRTCETable),
+
+        /* IOMMU state */
+        VMSTATE_BOOL(bypass, sPAPRTCETable),
+        VMSTATE_VARRAY_UINT32(table, sPAPRTCETable, nb_table, 0, vmstate_info_uint64, uint64_t),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static MemoryRegionIOMMUOps spapr_iommu_ops = {
     .translate = spapr_tce_translate_iommu,
 };
 
-sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn, size_t window_size)
+static int spapr_tce_table_realize(DeviceState *dev)
 {
-    sPAPRTCETable *tcet;
-
-    if (spapr_tce_find_by_liobn(liobn)) {
-        fprintf(stderr, "Attempted to create TCE table with duplicate"
-                " LIOBN 0x%x\n", liobn);
-        return NULL;
-    }
-
-    if (!window_size) {
-        return NULL;
-    }
-
-    tcet = g_malloc0(sizeof(*tcet));
-    tcet->liobn = liobn;
-    tcet->window_size = window_size;
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);
 
     if (kvm_enabled()) {
-        tcet->table = kvmppc_create_spapr_tce(liobn,
-                                              window_size,
+        tcet->table = kvmppc_create_spapr_tce(tcet->liobn,
+                                              tcet->window_size,
                                               &tcet->fd);
     }
 
     if (!tcet->table) {
-        size_t table_size = (window_size >> SPAPR_TCE_PAGE_SHIFT)
-            * sizeof(sPAPRTCE);
+        size_t table_size = (tcet->window_size >> SPAPR_TCE_PAGE_SHIFT)
+            * sizeof(uint64_t);
         tcet->table = g_malloc0(table_size);
     }
+    tcet->nb_table = tcet->window_size >> SPAPR_TCE_PAGE_SHIFT;
 
 #ifdef DEBUG_TCE
     fprintf(stderr, "spapr_iommu: New TCE table @ %p, liobn=0x%x, "
             "table @ %p, fd=%d\n", tcet, liobn, tcet->table, tcet->fd);
 #endif
 
-    memory_region_init_iommu(&tcet->iommu, OBJECT(owner), &spapr_iommu_ops,
+    memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
                              "iommu-spapr", UINT64_MAX);
 
     QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
 
+    return 0;
+}
+
+sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn, size_t window_size)
+{
+    sPAPRTCETable *tcet;
+
+    if (spapr_tce_find_by_liobn(liobn)) {
+        fprintf(stderr, "Attempted to create TCE table with duplicate"
+                " LIOBN 0x%x\n", liobn);
+        return NULL;
+    }
+
+    if (!window_size) {
+        return NULL;
+    }
+
+    tcet = SPAPR_TCE_TABLE(object_new(TYPE_SPAPR_TCE_TABLE));
+    tcet->liobn = liobn;
+    tcet->window_size = window_size;
+
+    object_property_add_child(OBJECT(owner), "tce-table", OBJECT(tcet), NULL);
+
+    qdev_init_nofail(DEVICE(tcet));
+
     return tcet;
 }
 
-void spapr_tce_free(sPAPRTCETable *tcet)
+static void spapr_tce_table_finalize(Object *obj)
 {
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(obj);
+
     QLIST_REMOVE(tcet, list);
 
     if (!kvm_enabled() ||
@@ -168,8 +199,6 @@ void spapr_tce_free(sPAPRTCETable *tcet)
                                  tcet->window_size) != 0)) {
         g_free(tcet->table);
     }
-
-    g_free(tcet);
 }
 
 MemoryRegion *spapr_tce_get_iommu(sPAPRTCETable *tcet)
@@ -182,10 +211,11 @@ void spapr_tce_set_bypass(sPAPRTCETable *tcet, bool bypass)
     tcet->bypass = bypass;
 }
 
-void spapr_tce_reset(sPAPRTCETable *tcet)
+static void spapr_tce_reset(DeviceState *dev)
 {
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);
     size_t table_size = (tcet->window_size >> SPAPR_TCE_PAGE_SHIFT)
-        * sizeof(sPAPRTCE);
+        * sizeof(uint64_t);
 
     tcet->bypass = false;
     memset(tcet->table, 0, table_size);
@@ -194,7 +224,6 @@ void spapr_tce_reset(sPAPRTCETable *tcet)
 static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,
                                 target_ulong tce)
 {
-    sPAPRTCE *tcep;
     IOMMUTLBEntry entry;
 
     if (ioba >= tcet->window_size) {
@@ -203,8 +232,7 @@ static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,
         return H_PARAMETER;
     }
 
-    tcep = tcet->table + (ioba >> SPAPR_TCE_PAGE_SHIFT);
-    tcep->tce = tce;
+    tcet->table[ioba >> SPAPR_TCE_PAGE_SHIFT] = tce;
 
     entry.target_as = &address_space_memory,
     entry.iova = ioba & ~SPAPR_TCE_PAGE_MASK;
@@ -238,14 +266,6 @@ static target_ulong h_put_tce(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     return H_PARAMETER;
 }
 
-void spapr_iommu_init(void)
-{
-    QLIST_INIT(&spapr_tce_tables);
-
-    /* hcall-tce */
-    spapr_register_hypercall(H_PUT_TCE, h_put_tce);
-}
-
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
                  uint32_t liobn, uint64_t window, uint32_t size)
 {
@@ -286,3 +306,31 @@ int spapr_tcet_dma_dt(void *fdt, int node_off, const char *propname,
     return spapr_dma_dt(fdt, node_off, propname,
                         tcet->liobn, 0, tcet->window_size);
 }
+
+static void spapr_tce_table_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    dc->vmsd = &vmstate_spapr_tce_table;
+    dc->init = spapr_tce_table_realize;
+    dc->reset = spapr_tce_reset;
+
+    QLIST_INIT(&spapr_tce_tables);
+
+    /* hcall-tce */
+    spapr_register_hypercall(H_PUT_TCE, h_put_tce);
+}
+
+static TypeInfo spapr_tce_table_info = {
+    .name = TYPE_SPAPR_TCE_TABLE,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(sPAPRTCETable),
+    .class_init = spapr_tce_table_class_init,
+    .instance_finalize = spapr_tce_table_finalize,
+};
+
+static void register_types(void)
+{
+    type_register_static(&spapr_tce_table_info);
+}
+
+type_init(register_types);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index c880a75..9dc6ca3 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -645,7 +645,7 @@ static void spapr_phb_reset(DeviceState *qdev)
     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
 
     /* Reset the IOMMU state */
-    spapr_tce_reset(sphb->tcet);
+    device_reset(DEVICE(sphb->tcet));
 }
 
 static Property spapr_phb_properties[] = {
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 75ce19f..c3f85bf 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -316,7 +316,7 @@ int spapr_vio_send_crq(VIOsPAPRDevice *dev, uint8_t *crq)
 static void spapr_vio_quiesce_one(VIOsPAPRDevice *dev)
 {
     if (dev->tcet) {
-        spapr_tce_reset(dev->tcet);
+        device_reset(DEVICE(dev->tcet));
     }
     free_crq(dev);
 }
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index de95480..82ad7c0 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -334,10 +334,6 @@ int spapr_rtas_device_tree_setup(void *fdt, hwaddr rtas_addr,
 #define SPAPR_TCE_PAGE_SIZE    (1ULL << SPAPR_TCE_PAGE_SHIFT)
 #define SPAPR_TCE_PAGE_MASK    (SPAPR_TCE_PAGE_SIZE - 1)
 
-typedef struct sPAPRTCE {
-    uint64_t tce;
-} sPAPRTCE;
-
 #define SPAPR_VIO_BASE_LIOBN    0x00000000
 #define SPAPR_PCI_BASE_LIOBN    0x80000000
 
@@ -345,14 +341,27 @@ typedef struct sPAPRTCE {
 
 typedef struct sPAPRTCETable sPAPRTCETable;
 
-void spapr_iommu_init(void);
+#define TYPE_SPAPR_TCE_TABLE "spapr-tce-table"
+#define SPAPR_TCE_TABLE(obj) \
+    OBJECT_CHECK(sPAPRTCETable, (obj), TYPE_SPAPR_TCE_TABLE)
+
+struct sPAPRTCETable {
+    DeviceState parent;
+    uint32_t liobn;
+    uint32_t window_size;
+    uint32_t nb_table;
+    uint64_t *table;
+    bool bypass;
+    int fd;
+    MemoryRegion iommu;
+    QLIST_ENTRY(sPAPRTCETable) list;
+};
+
 void spapr_events_init(sPAPREnvironment *spapr);
 void spapr_events_fdt_skel(void *fdt, uint32_t epow_irq);
 sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn,
                                    size_t window_size);
 MemoryRegion *spapr_tce_get_iommu(sPAPRTCETable *tcet);
-void spapr_tce_free(sPAPRTCETable *tcet);
-void spapr_tce_reset(sPAPRTCETable *tcet);
 void spapr_tce_set_bypass(sPAPRTCETable *tcet, bool bypass);
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
                  uint32_t liobn, uint64_t window, uint32_t size);
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index b0099e1..9f2e4f0 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1626,7 +1626,7 @@ void *kvmppc_create_spapr_tce(uint32_t liobn, uint32_t window_size, int *pfd)
         return NULL;
     }
 
-    len = (window_size / SPAPR_TCE_PAGE_SIZE) * sizeof(sPAPRTCE);
+    len = (window_size / SPAPR_TCE_PAGE_SIZE) * sizeof(uint64_t);
     /* FIXME: round this up to page size */
 
     table = mmap(NULL, len, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
@@ -1649,7 +1649,7 @@ int kvmppc_remove_spapr_tce(void *table, int fd, uint32_t window_size)
         return -1;
     }
 
-    len = (window_size / SPAPR_TCE_PAGE_SIZE)*sizeof(sPAPRTCE);
+    len = (window_size / SPAPR_TCE_PAGE_SIZE)*sizeof(uint64_t);
     if ((munmap(table, len) < 0) ||
         (close(fd) < 0)) {
         fprintf(stderr, "KVM: Unexpected error removing TCE table: %s",
commit db1b58e937fd80513a4bb14432808495a5846ffe
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:32:57 2013 -0500

    pseries: savevm support for PAPR VIO logical tty
    
    This patch adds the necessary VMStateDescription information to support
    savevm/loadvm for the spapr_tty (PAPR logical serial) device.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-5-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 2993848..a799721 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -142,6 +142,21 @@ static Property spapr_vty_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_vty = {
+    .name = "spapr_vty",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(sdev, VIOsPAPRVTYDevice),
+
+        VMSTATE_UINT32(in, VIOsPAPRVTYDevice),
+        VMSTATE_UINT32(out, VIOsPAPRVTYDevice),
+        VMSTATE_BUFFER(buf, VIOsPAPRVTYDevice),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vty_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -152,6 +167,7 @@ static void spapr_vty_class_init(ObjectClass *klass, void *data)
     k->dt_type = "serial";
     k->dt_compatible = "hvterm1";
     dc->props = spapr_vty_properties;
+    dc->vmsd = &vmstate_spapr_vty;
 }
 
 static const TypeInfo spapr_vty_info = {
commit 686fefe48375c448bc2141973008818cd9b9c671
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:32:56 2013 -0500

    pseries: savevm support for PAPR VIO logical lan
    
    This patch adds the necessary VMStateDescription information to support
    savevm/loadvm for the spapr_llan (PAPR logical lan) device.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-4-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 03a09f2..46f7d5f 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -81,9 +81,9 @@ typedef struct VIOsPAPRVLANDevice {
     VIOsPAPRDevice sdev;
     NICConf nicconf;
     NICState *nic;
-    int isopen;
+    bool isopen;
     target_ulong buf_list;
-    int add_buf_ptr, use_buf_ptr, rx_bufs;
+    uint32_t add_buf_ptr, use_buf_ptr, rx_bufs;
     target_ulong rxq_ptr;
 } VIOsPAPRVLANDevice;
 
@@ -500,6 +500,25 @@ static Property spapr_vlan_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_llan = {
+    .name = "spapr_llan",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(sdev, VIOsPAPRVLANDevice),
+        /* LLAN state */
+        VMSTATE_BOOL(isopen, VIOsPAPRVLANDevice),
+        VMSTATE_UINTTL(buf_list, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(add_buf_ptr, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(use_buf_ptr, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(rx_bufs, VIOsPAPRVLANDevice),
+        VMSTATE_UINTTL(rxq_ptr, VIOsPAPRVLANDevice),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vlan_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -514,6 +533,7 @@ static void spapr_vlan_class_init(ObjectClass *klass, void *data)
     k->signal_mask = 0x1;
     dc->props = spapr_vlan_properties;
     k->rtce_window_size = 0x10000000;
+    dc->vmsd = &vmstate_spapr_llan;
 }
 
 static const TypeInfo spapr_vlan_info = {
commit b368a7d864d6f32caba4ac9fb3b9738d1180315d
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:32:55 2013 -0500

    pseries: savevm support for VIO devices
    
    This patch adds helpers to allow PAPR VIO devices to save state common
    to all VIO devices during savevm.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-3-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 7c6f6e4..75ce19f 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -542,6 +542,26 @@ static const TypeInfo spapr_vio_bridge_info = {
     .class_init    = spapr_vio_bridge_class_init,
 };
 
+const VMStateDescription vmstate_spapr_vio = {
+    .name = "spapr_vio",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(reg, VIOsPAPRDevice),
+        VMSTATE_UINT32_EQUAL(irq, VIOsPAPRDevice),
+
+        /* General VIO device state */
+        VMSTATE_UINTTL(signal_state, VIOsPAPRDevice),
+        VMSTATE_UINT64(crq.qladdr, VIOsPAPRDevice),
+        VMSTATE_UINT32(crq.qsize, VIOsPAPRDevice),
+        VMSTATE_UINT32(crq.qnext, VIOsPAPRDevice),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void vio_spapr_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index 3609327..46edc2a 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -134,4 +134,9 @@ VIOsPAPRDevice *spapr_vty_get_default(VIOsPAPRBus *bus);
 
 void spapr_vio_quiesce(void);
 
+extern const VMStateDescription vmstate_spapr_vio;
+
+#define VMSTATE_SPAPR_VIO(_f, _s) \
+    VMSTATE_STRUCT(_f, _s, 0, vmstate_spapr_vio, VIOsPAPRDevice)
+
 #endif /* _HW_SPAPR_VIO_H */
commit a90db1584a00dc1d1439dc7729d99674b666b85e
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Thu Jul 18 14:32:54 2013 -0500

    target-ppc: Convert ppc cpu savevm to VMStateDescription
    
    The savevm code for the powerpc cpu emulation is currently based around
    the old register_savevm() rather than register_vmstate() method.  It's also
    rather broken, missing some important state on some CPU models.
    
    This patch completely rewrites the savevm for target-ppc, using the new
    VMStateDescription approach.  Exactly what needs to be saved in what
    configurations has been more carefully examined, too.  This introduces a
    new version (5) of the cpu save format.  The old load function is retained
    to support version 4 images.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-2-git-send-email-aliguori at us.ibm.com
    [aik: ppc cpu savevm convertion fixed to use PowerPCCPU instead of CPUPPCState]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index fc0d737..f3c710a 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -109,4 +109,8 @@ hwaddr ppc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 int ppc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int ppc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_ppc_cpu;
+#endif
+
 #endif
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 6f51e1f..711db08 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -948,7 +948,7 @@ struct CPUPPCState {
 #if defined(TARGET_PPC64)
     /* PowerPC 64 SLB area */
     ppc_slb_t slb[64];
-    int slb_nr;
+    int32_t slb_nr;
 #endif
     /* segment registers */
     hwaddr htab_base;
@@ -957,11 +957,11 @@ struct CPUPPCState {
     /* externally stored hash table */
     uint8_t *external_htab;
     /* BATs */
-    int nb_BATs;
+    uint32_t nb_BATs;
     target_ulong DBAT[2][8];
     target_ulong IBAT[2][8];
     /* PowerPC TLB registers (for 4xx, e500 and 60x software driven TLBs) */
-    int nb_tlb;      /* Total number of TLB                                  */
+    int32_t nb_tlb;      /* Total number of TLB                              */
     int tlb_per_way; /* Speed-up helper: used to avoid divisions at run time */
     int nb_ways;     /* Number of ways in the TLB set                        */
     int last_way;    /* Last used way used to allocate TLB in a LRU way      */
@@ -1176,8 +1176,6 @@ static inline CPUPPCState *cpu_init(const char *cpu_model)
 #define cpu_signal_handler cpu_ppc_signal_handler
 #define cpu_list ppc_cpu_list
 
-#define CPU_SAVE_VERSION 4
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _user
 #define MMU_MODE1_SUFFIX _kernel
diff --git a/target-ppc/machine.c b/target-ppc/machine.c
index 2d10adb..12e1512 100644
--- a/target-ppc/machine.c
+++ b/target-ppc/machine.c
@@ -1,96 +1,12 @@
 #include "hw/hw.h"
 #include "hw/boards.h"
 #include "sysemu/kvm.h"
+#include "helper_regs.h"
 
-void cpu_save(QEMUFile *f, void *opaque)
+static int cpu_load_old(QEMUFile *f, void *opaque, int version_id)
 {
-    CPUPPCState *env = (CPUPPCState *)opaque;
-    unsigned int i, j;
-    uint32_t fpscr;
-    target_ulong xer;
-
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->gpr[i]);
-#if !defined(TARGET_PPC64)
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->gprh[i]);
-#endif
-    qemu_put_betls(f, &env->lr);
-    qemu_put_betls(f, &env->ctr);
-    for (i = 0; i < 8; i++)
-        qemu_put_be32s(f, &env->crf[i]);
-    xer = cpu_read_xer(env);
-    qemu_put_betls(f, &xer);
-    qemu_put_betls(f, &env->reserve_addr);
-    qemu_put_betls(f, &env->msr);
-    for (i = 0; i < 4; i++)
-        qemu_put_betls(f, &env->tgpr[i]);
-    for (i = 0; i < 32; i++) {
-        union {
-            float64 d;
-            uint64_t l;
-        } u;
-        u.d = env->fpr[i];
-        qemu_put_be64(f, u.l);
-    }
-    fpscr = env->fpscr;
-    qemu_put_be32s(f, &fpscr);
-    qemu_put_sbe32s(f, &env->access_type);
-#if defined(TARGET_PPC64)
-    qemu_put_betls(f, &env->spr[SPR_ASR]);
-    qemu_put_sbe32s(f, &env->slb_nr);
-#endif
-    qemu_put_betls(f, &env->spr[SPR_SDR1]);
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->sr[i]);
-    for (i = 0; i < 2; i++)
-        for (j = 0; j < 8; j++)
-            qemu_put_betls(f, &env->DBAT[i][j]);
-    for (i = 0; i < 2; i++)
-        for (j = 0; j < 8; j++)
-            qemu_put_betls(f, &env->IBAT[i][j]);
-    qemu_put_sbe32s(f, &env->nb_tlb);
-    qemu_put_sbe32s(f, &env->tlb_per_way);
-    qemu_put_sbe32s(f, &env->nb_ways);
-    qemu_put_sbe32s(f, &env->last_way);
-    qemu_put_sbe32s(f, &env->id_tlbs);
-    qemu_put_sbe32s(f, &env->nb_pids);
-    if (env->tlb.tlb6) {
-        // XXX assumes 6xx
-        for (i = 0; i < env->nb_tlb; i++) {
-            qemu_put_betls(f, &env->tlb.tlb6[i].pte0);
-            qemu_put_betls(f, &env->tlb.tlb6[i].pte1);
-            qemu_put_betls(f, &env->tlb.tlb6[i].EPN);
-        }
-    }
-    for (i = 0; i < 4; i++)
-        qemu_put_betls(f, &env->pb[i]);
-    for (i = 0; i < 1024; i++)
-        qemu_put_betls(f, &env->spr[i]);
-    qemu_put_be32s(f, &env->vscr);
-    qemu_put_be64s(f, &env->spe_acc);
-    qemu_put_be32s(f, &env->spe_fscr);
-    qemu_put_betls(f, &env->msr_mask);
-    qemu_put_be32s(f, &env->flags);
-    qemu_put_sbe32s(f, &env->error_code);
-    qemu_put_be32s(f, &env->pending_interrupts);
-    qemu_put_be32s(f, &env->irq_input_state);
-    for (i = 0; i < POWERPC_EXCP_NB; i++)
-        qemu_put_betls(f, &env->excp_vectors[i]);
-    qemu_put_betls(f, &env->excp_prefix);
-    qemu_put_betls(f, &env->ivor_mask);
-    qemu_put_betls(f, &env->ivpr_mask);
-    qemu_put_betls(f, &env->hreset_vector);
-    qemu_put_betls(f, &env->nip);
-    qemu_put_betls(f, &env->hflags);
-    qemu_put_betls(f, &env->hflags_nmsr);
-    qemu_put_sbe32s(f, &env->mmu_idx);
-    qemu_put_sbe32(f, 0);
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-    CPUPPCState *env = (CPUPPCState *)opaque;
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
     unsigned int i, j;
     target_ulong sdr1;
     uint32_t fpscr;
@@ -177,3 +93,442 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 
     return 0;
 }
+
+static int get_avr(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_avr_t *v = pv;
+
+    v->u64[0] = qemu_get_be64(f);
+    v->u64[1] = qemu_get_be64(f);
+
+    return 0;
+}
+
+static void put_avr(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_avr_t *v = pv;
+
+    qemu_put_be64(f, v->u64[0]);
+    qemu_put_be64(f, v->u64[1]);
+}
+
+const VMStateInfo vmstate_info_avr = {
+    .name = "avr",
+    .get  = get_avr,
+    .put  = put_avr,
+};
+
+#define VMSTATE_AVR_ARRAY_V(_f, _s, _n, _v)                       \
+    VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_avr, ppc_avr_t)
+
+#define VMSTATE_AVR_ARRAY(_f, _s, _n)                             \
+    VMSTATE_AVR_ARRAY_V(_f, _s, _n, 0)
+
+static void cpu_pre_save(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+    int i;
+
+    env->spr[SPR_LR] = env->lr;
+    env->spr[SPR_CTR] = env->ctr;
+    env->spr[SPR_XER] = env->xer;
+#if defined(TARGET_PPC64)
+    env->spr[SPR_CFAR] = env->cfar;
+#endif
+    env->spr[SPR_BOOKE_SPEFSCR] = env->spe_fscr;
+
+    for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
+        env->spr[SPR_DBAT0U + 2*i] = env->DBAT[0][i];
+        env->spr[SPR_DBAT0U + 2*i + 1] = env->DBAT[1][i];
+        env->spr[SPR_IBAT0U + 2*i] = env->IBAT[0][i];
+        env->spr[SPR_IBAT0U + 2*i + 1] = env->IBAT[1][i];
+    }
+    for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
+        env->spr[SPR_DBAT4U + 2*i] = env->DBAT[0][i+4];
+        env->spr[SPR_DBAT4U + 2*i + 1] = env->DBAT[1][i+4];
+        env->spr[SPR_IBAT4U + 2*i] = env->IBAT[0][i+4];
+        env->spr[SPR_IBAT4U + 2*i + 1] = env->IBAT[1][i+4];
+    }
+}
+
+static int cpu_post_load(void *opaque, int version_id)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+    int i;
+
+    env->lr = env->spr[SPR_LR];
+    env->ctr = env->spr[SPR_CTR];
+    env->xer = env->spr[SPR_XER];
+#if defined(TARGET_PPC64)
+    env->cfar = env->spr[SPR_CFAR];
+#endif
+    env->spe_fscr = env->spr[SPR_BOOKE_SPEFSCR];
+
+    for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
+        env->DBAT[0][i] = env->spr[SPR_DBAT0U + 2*i];
+        env->DBAT[1][i] = env->spr[SPR_DBAT0U + 2*i + 1];
+        env->IBAT[0][i] = env->spr[SPR_IBAT0U + 2*i];
+        env->IBAT[1][i] = env->spr[SPR_IBAT0U + 2*i + 1];
+    }
+    for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
+        env->DBAT[0][i+4] = env->spr[SPR_DBAT4U + 2*i];
+        env->DBAT[1][i+4] = env->spr[SPR_DBAT4U + 2*i + 1];
+        env->IBAT[0][i+4] = env->spr[SPR_IBAT4U + 2*i];
+        env->IBAT[1][i+4] = env->spr[SPR_IBAT4U + 2*i + 1];
+    }
+
+    /* Restore htab_base and htab_mask variables */
+    ppc_store_sdr1(env, env->spr[SPR_SDR1]);
+
+    hreg_compute_hflags(env);
+    hreg_compute_mem_idx(env);
+
+    return 0;
+}
+
+static bool fpu_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags & PPC_FLOAT);
+}
+
+static const VMStateDescription vmstate_fpu = {
+    .name = "cpu/fpu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_FLOAT64_ARRAY(env.fpr, PowerPCCPU, 32),
+        VMSTATE_UINTTL(env.fpscr, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool altivec_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags & PPC_ALTIVEC);
+}
+
+static const VMStateDescription vmstate_altivec = {
+    .name = "cpu/altivec",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_AVR_ARRAY(env.avr, PowerPCCPU, 32),
+        VMSTATE_UINT32(env.vscr, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool vsx_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags2 & PPC2_VSX);
+}
+
+static const VMStateDescription vmstate_vsx = {
+    .name = "cpu/vsx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64_ARRAY(env.vsr, PowerPCCPU, 32),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool sr_needed(void *opaque)
+{
+#ifdef TARGET_PPC64
+    PowerPCCPU *cpu = opaque;
+
+    return !(cpu->env.mmu_model & POWERPC_MMU_64);
+#else
+    return true;
+#endif
+}
+
+static const VMStateDescription vmstate_sr = {
+    .name = "cpu/sr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL_ARRAY(env.sr, PowerPCCPU, 32),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+#ifdef TARGET_PPC64
+static int get_slbe(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_slb_t *v = pv;
+
+    v->esid = qemu_get_be64(f);
+    v->vsid = qemu_get_be64(f);
+
+    return 0;
+}
+
+static void put_slbe(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_slb_t *v = pv;
+
+    qemu_put_be64(f, v->esid);
+    qemu_put_be64(f, v->vsid);
+}
+
+const VMStateInfo vmstate_info_slbe = {
+    .name = "slbe",
+    .get  = get_slbe,
+    .put  = put_slbe,
+};
+
+#define VMSTATE_SLB_ARRAY_V(_f, _s, _n, _v)                       \
+    VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_slbe, ppc_slb_t)
+
+#define VMSTATE_SLB_ARRAY(_f, _s, _n)                             \
+    VMSTATE_SLB_ARRAY_V(_f, _s, _n, 0)
+
+static bool slb_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    /* We don't support any of the old segment table based 64-bit CPUs */
+    return (cpu->env.mmu_model & POWERPC_MMU_64);
+}
+
+static const VMStateDescription vmstate_slb = {
+    .name = "cpu/slb",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.slb_nr, PowerPCCPU),
+        VMSTATE_SLB_ARRAY(env.slb, PowerPCCPU, 64),
+        VMSTATE_END_OF_LIST()
+    }
+};
+#endif /* TARGET_PPC64 */
+
+static const VMStateDescription vmstate_tlb6xx_entry = {
+    .name = "cpu/tlb6xx_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL(pte0, ppc6xx_tlb_t),
+        VMSTATE_UINTTL(pte1, ppc6xx_tlb_t),
+        VMSTATE_UINTTL(EPN, ppc6xx_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlb6xx_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_6XX);
+}
+
+static const VMStateDescription vmstate_tlb6xx = {
+    .name = "cpu/tlb6xx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlb6, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlb6xx_entry,
+                                            ppc6xx_tlb_t),
+        VMSTATE_UINTTL_ARRAY(env.tgpr, PowerPCCPU, 4),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_tlbemb_entry = {
+    .name = "cpu/tlbemb_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(RPN, ppcemb_tlb_t),
+        VMSTATE_UINTTL(EPN, ppcemb_tlb_t),
+        VMSTATE_UINTTL(PID, ppcemb_tlb_t),
+        VMSTATE_UINTTL(size, ppcemb_tlb_t),
+        VMSTATE_UINT32(prot, ppcemb_tlb_t),
+        VMSTATE_UINT32(attr, ppcemb_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlbemb_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_EMB);
+}
+
+static bool pbr403_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    uint32_t pvr = cpu->env.spr[SPR_PVR];
+
+    return (pvr & 0xffff0000) == 0x00200000;
+}
+
+static const VMStateDescription vmstate_pbr403 = {
+    .name = "cpu/pbr403",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL_ARRAY(env.pb, PowerPCCPU, 4),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_tlbemb = {
+    .name = "cpu/tlb6xx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbe, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlbemb_entry,
+                                            ppcemb_tlb_t),
+        /* 403 protection registers */
+        VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection []) {
+        {
+            .vmsd = &vmstate_pbr403,
+            .needed = pbr403_needed,
+        } , {
+            /* empty */
+        }
+    }
+};
+
+static const VMStateDescription vmstate_tlbmas_entry = {
+    .name = "cpu/tlbmas_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(mas8, ppcmas_tlb_t),
+        VMSTATE_UINT32(mas1, ppcmas_tlb_t),
+        VMSTATE_UINT64(mas2, ppcmas_tlb_t),
+        VMSTATE_UINT64(mas7_3, ppcmas_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlbmas_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_MAS);
+}
+
+static const VMStateDescription vmstate_tlbmas = {
+    .name = "cpu/tlbmas",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbm, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlbmas_entry,
+                                            ppcmas_tlb_t),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+const VMStateDescription vmstate_ppc_cpu = {
+    .name = "cpu",
+    .version_id = 5,
+    .minimum_version_id = 5,
+    .minimum_version_id_old = 4,
+    .load_state_old = cpu_load_old,
+    .pre_save = cpu_pre_save,
+    .post_load = cpu_post_load,
+    .fields      = (VMStateField []) {
+        /* Verify we haven't changed the pvr */
+        VMSTATE_UINTTL_EQUAL(env.spr[SPR_PVR], PowerPCCPU),
+
+        /* User mode architected state */
+        VMSTATE_UINTTL_ARRAY(env.gpr, PowerPCCPU, 32),
+#if !defined(TARGET_PPC64)
+        VMSTATE_UINTTL_ARRAY(env.gprh, PowerPCCPU, 32),
+#endif
+        VMSTATE_UINT32_ARRAY(env.crf, PowerPCCPU, 8),
+        VMSTATE_UINTTL(env.nip, PowerPCCPU),
+
+        /* SPRs */
+        VMSTATE_UINTTL_ARRAY(env.spr, PowerPCCPU, 1024),
+        VMSTATE_UINT64(env.spe_acc, PowerPCCPU),
+
+        /* Reservation */
+        VMSTATE_UINTTL(env.reserve_addr, PowerPCCPU),
+
+        /* Supervisor mode architected state */
+        VMSTATE_UINTTL(env.msr, PowerPCCPU),
+
+        /* Internal state */
+        VMSTATE_UINTTL(env.hflags_nmsr, PowerPCCPU),
+        /* FIXME: access_type? */
+
+        /* Sanity checking */
+        VMSTATE_UINTTL_EQUAL(env.msr_mask, PowerPCCPU),
+        VMSTATE_UINT64_EQUAL(env.insns_flags, PowerPCCPU),
+        VMSTATE_UINT64_EQUAL(env.insns_flags2, PowerPCCPU),
+        VMSTATE_UINT32_EQUAL(env.nb_BATs, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection []) {
+        {
+            .vmsd = &vmstate_fpu,
+            .needed = fpu_needed,
+        } , {
+            .vmsd = &vmstate_altivec,
+            .needed = altivec_needed,
+        } , {
+            .vmsd = &vmstate_vsx,
+            .needed = vsx_needed,
+        } , {
+            .vmsd = &vmstate_sr,
+            .needed = sr_needed,
+        } , {
+#ifdef TARGET_PPC64
+            .vmsd = &vmstate_slb,
+            .needed = slb_needed,
+        } , {
+#endif /* TARGET_PPC64 */
+            .vmsd = &vmstate_tlb6xx,
+            .needed = tlb6xx_needed,
+        } , {
+            .vmsd = &vmstate_tlbemb,
+            .needed = tlbemb_needed,
+        } , {
+            .vmsd = &vmstate_tlbmas,
+            .needed = tlbmas_needed,
+        } , {
+            /* empty */
+        }
+    }
+};
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 8215946..44069e6 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8462,6 +8462,7 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
+    cc->vmsd = &vmstate_ppc_cpu;
 #endif
 
     cc->gdb_num_core_regs = 71;
commit b0f2027cde31c645524256763672e09eeb204a9a
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:02:00 2013 +0200

    dataplane: refuse to start if device is already in use
    
    Dataplane must check whether a block device is in use before launching
    the dataplane thread.  This is necessary since the thread does not
    synchronize with the main loop and I/O requests could cause corruption.
    
    One example is when a drive is added and a block job is started before
    hotplugging the virtio-blk-pci adapter.  In this case we must not use
    dataplane mode.
    
    Cc: qemu-stable at nongnu.org
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 63c3ffa..411becc 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -415,6 +415,14 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *blk,
         return false;
     }
 
+    /* If dataplane is (re-)enabled while the guest is running there could be
+     * block jobs that can conflict.
+     */
+    if (bdrv_in_use(blk->conf.bs)) {
+        error_report("cannot start dataplane thread while device is in use");
+        return false;
+    }
+
     fd = raw_get_aio_fd(blk->conf.bs);
     if (fd < 0) {
         error_report("drive is incompatible with x-data-plane, "
commit 84db52d059f3296abf7783968645c4a96d21b099
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:01:59 2013 +0200

    dataplane: enable virtio-blk x-data-plane=on live migration
    
    Although the dataplane thread does not cooperate with dirty memory
    logging yet it's fairly easy to temporarily disable dataplane during
    live migration.  This way virtio-blk can live migrate when
    x-data-plane=on.
    
    The dataplane thread will restart after migration is cancelled or if the
    guest resuming virtio-blk operation after migration completes.
    
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 2faed43..63c3ffa 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -18,7 +18,6 @@
 #include "qemu/error-report.h"
 #include "hw/virtio/dataplane/vring.h"
 #include "ioq.h"
-#include "migration/migration.h"
 #include "block/block.h"
 #include "hw/virtio/virtio-blk.h"
 #include "virtio-blk.h"
@@ -69,8 +68,6 @@ struct VirtIOBlockDataPlane {
                                              queue */
 
     unsigned int num_reqs;
-
-    Error *migration_blocker;
 };
 
 /* Raise an interrupt to signal guest, if necessary */
@@ -433,10 +430,6 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *blk,
     /* Prevent block operations that conflict with data plane thread */
     bdrv_set_in_use(blk->conf.bs, 1);
 
-    error_setg(&s->migration_blocker,
-            "x-data-plane does not support migration");
-    migrate_add_blocker(s->migration_blocker);
-
     *dataplane = s;
     return true;
 }
@@ -448,8 +441,6 @@ void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s)
     }
 
     virtio_blk_data_plane_stop(s);
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
     bdrv_set_in_use(s->blk->conf.bs, 0);
     g_free(s);
 }
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index cf12469..1237b6a 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -19,6 +19,7 @@
 #include "hw/virtio/virtio-blk.h"
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
 # include "dataplane/virtio-blk.h"
+# include "migration/migration.h"
 #endif
 #include "block/scsi.h"
 #ifdef __linux__
@@ -628,6 +629,34 @@ void virtio_blk_set_conf(DeviceState *dev, VirtIOBlkConf *blk)
     memcpy(&(s->blk), blk, sizeof(struct VirtIOBlkConf));
 }
 
+#ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+/* Disable dataplane thread during live migration since it does not
+ * update the dirty memory bitmap yet.
+ */
+static void virtio_blk_migration_state_changed(Notifier *notifier, void *data)
+{
+    VirtIOBlock *s = container_of(notifier, VirtIOBlock,
+                                  migration_state_notifier);
+    MigrationState *mig = data;
+
+    if (migration_in_setup(mig)) {
+        if (!s->dataplane) {
+            return;
+        }
+        virtio_blk_data_plane_destroy(s->dataplane);
+        s->dataplane = NULL;
+    } else if (migration_has_finished(mig) ||
+               migration_has_failed(mig)) {
+        if (s->dataplane) {
+            return;
+        }
+        bdrv_drain_all(); /* complete in-flight non-dataplane requests */
+        virtio_blk_data_plane_create(VIRTIO_DEVICE(s), &s->blk,
+                                     &s->dataplane);
+    }
+}
+#endif /* CONFIG_VIRTIO_BLK_DATA_PLANE */
+
 static int virtio_blk_device_init(VirtIODevice *vdev)
 {
     DeviceState *qdev = DEVICE(vdev);
@@ -664,6 +693,8 @@ static int virtio_blk_device_init(VirtIODevice *vdev)
         virtio_cleanup(vdev);
         return -1;
     }
+    s->migration_state_notifier.notify = virtio_blk_migration_state_changed;
+    add_migration_state_change_notifier(&s->migration_state_notifier);
 #endif
 
     s->change = qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);
@@ -683,6 +714,7 @@ static int virtio_blk_device_exit(DeviceState *dev)
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIOBlock *s = VIRTIO_BLK(dev);
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+    remove_migration_state_change_notifier(&s->migration_state_notifier);
     virtio_blk_data_plane_destroy(s->dataplane);
     s->dataplane = NULL;
 #endif
diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index fc71853..b87cf49 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -125,6 +125,7 @@ typedef struct VirtIOBlock {
     unsigned short sector_mask;
     VMChangeStateEntry *change;
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+    Notifier migration_state_notifier;
     struct VirtIOBlockDataPlane *dataplane;
 #endif
 } VirtIOBlock;
commit 02edd2e7665bceb307bedd8afe625c0f7e8d7cfa
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:01:58 2013 +0200

    migration: fix spice migration
    
    Commit 29ae8a4133082e16970c9d4be09f4b6a15034617 ("rdma: introduce
    MIG_STATE_NONE and change MIG_STATE_SETUP state transition") changed the
    state transitions during migration setup.
    
    Spice used to be notified with MIG_STATE_ACTIVE and it detected this
    using migration_is_active().  Spice is now notified with
    MIG_STATE_SETUP and migration_is_active() no longer works.
    
    Replace migration_is_active() with migration_in_setup() to fix spice
    migration.
    
    Cc: Michael R. Hines <mrhines at us.ibm.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/include/migration/migration.h b/include/migration/migration.h
index 08c772d..140e6b4 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -90,7 +90,7 @@ int migrate_fd_close(MigrationState *s);
 
 void add_migration_state_change_notifier(Notifier *notify);
 void remove_migration_state_change_notifier(Notifier *notify);
-bool migration_is_active(MigrationState *);
+bool migration_in_setup(MigrationState *);
 bool migration_has_finished(MigrationState *);
 bool migration_has_failed(MigrationState *);
 MigrationState *migrate_get_current(void);
diff --git a/migration.c b/migration.c
index a5ed26b..9fc7294 100644
--- a/migration.c
+++ b/migration.c
@@ -338,9 +338,9 @@ void remove_migration_state_change_notifier(Notifier *notify)
     notifier_remove(notify);
 }
 
-bool migration_is_active(MigrationState *s)
+bool migration_in_setup(MigrationState *s)
 {
-    return s->state == MIG_STATE_ACTIVE;
+    return s->state == MIG_STATE_SETUP;
 }
 
 bool migration_has_finished(MigrationState *s)
diff --git a/ui/spice-core.c b/ui/spice-core.c
index f308fd9..033fd89 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -563,7 +563,7 @@ static void migration_state_notifier(Notifier *notifier, void *data)
 {
     MigrationState *s = data;
 
-    if (migration_is_active(s)) {
+    if (migration_in_setup(s)) {
         spice_server_migrate_start(spice_server);
     } else if (migration_has_finished(s)) {
         spice_server_migrate_end(spice_server, true);
commit 9287ac271d83166f99e050a0e0a4ebd462f7eb2b
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:01:57 2013 +0200

    migration: notify migration state before starting thread
    
    The migration thread runs outside the QEMU global mutex when possible.
    Therefore we must notify migration state change *before* starting the
    migration thread.
    
    This allows registered listeners to act before live migration iterations
    begin.  Therefore they can get into a state that allows for live
    migration.  When the migration thread starts everything will be ready.
    
    Without this patch there is a race condition during migration setup,
    depending on whether the migration thread has already transitioned from
    SETUP to ACTIVE state.
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/migration.c b/migration.c
index e12e784..a5ed26b 100644
--- a/migration.c
+++ b/migration.c
@@ -658,7 +658,9 @@ void migrate_fd_connect(MigrationState *s)
     qemu_file_set_rate_limit(s->file,
                              s->bandwidth_limit / XFER_LIMIT_RATIO);
 
+    /* Notify before starting migration thread */
+    notifier_list_notify(&migration_state_notifiers, s);
+
     qemu_thread_create(&s->thread, migration_thread, s,
                        QEMU_THREAD_JOINABLE);
-    notifier_list_notify(&migration_state_notifiers, s);
 }
commit b681a1c73e15e08c70c10cccd9c9f5b65cca12e8
Author: Benoît Canet <benoit at irqsave.net>
Date:   Fri Jul 26 22:39:22 2013 +0200

    block: Repair the throttling code.
    
    The throttling code was segfaulting since commit
    02ffb504485f0920cfc75a0982a602f824a9a4f4 because some qemu_co_queue_next caller
    does not run in a coroutine.
    qemu_co_queue_do_restart assume that the caller is a coroutinne.
    As suggested by Stefan fix this by entering the coroutine directly.
    Also make sure like suggested that qemu_co_queue_next() and
    qemu_co_queue_restart_all() can be called only in coroutines.
    
    Signed-off-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index c77cfd1..01b66d8 100644
--- a/block.c
+++ b/block.c
@@ -127,7 +127,7 @@ void bdrv_io_limits_disable(BlockDriverState *bs)
 {
     bs->io_limits_enabled = false;
 
-    while (qemu_co_queue_next(&bs->throttled_reqs));
+    do {} while (qemu_co_enter_next(&bs->throttled_reqs));
 
     if (bs->block_timer) {
         qemu_del_timer(bs->block_timer);
@@ -143,7 +143,7 @@ static void bdrv_block_timer(void *opaque)
 {
     BlockDriverState *bs = opaque;
 
-    qemu_co_queue_next(&bs->throttled_reqs);
+    qemu_co_enter_next(&bs->throttled_reqs);
 }
 
 void bdrv_io_limits_enable(BlockDriverState *bs)
@@ -1452,8 +1452,7 @@ void bdrv_drain_all(void)
          * a busy wait.
          */
         QTAILQ_FOREACH(bs, &bdrv_states, list) {
-            if (!qemu_co_queue_empty(&bs->throttled_reqs)) {
-                qemu_co_queue_restart_all(&bs->throttled_reqs);
+            while (qemu_co_enter_next(&bs->throttled_reqs)) {
                 busy = true;
             }
         }
diff --git a/include/block/coroutine.h b/include/block/coroutine.h
index 377805a..1f2db3e 100644
--- a/include/block/coroutine.h
+++ b/include/block/coroutine.h
@@ -130,12 +130,17 @@ void coroutine_fn qemu_co_queue_wait_insert_head(CoQueue *queue);
  *
  * Returns true if a coroutine was restarted, false if the queue is empty.
  */
-bool qemu_co_queue_next(CoQueue *queue);
+bool coroutine_fn qemu_co_queue_next(CoQueue *queue);
 
 /**
  * Restarts all coroutines in the CoQueue and leaves the queue empty.
  */
-void qemu_co_queue_restart_all(CoQueue *queue);
+void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue);
+
+/**
+ * Enter the next coroutine in the queue
+ */
+bool qemu_co_enter_next(CoQueue *queue);
 
 /**
  * Checks if the CoQueue is empty.
diff --git a/qemu-coroutine-lock.c b/qemu-coroutine-lock.c
index d9fea49..aeb33b9 100644
--- a/qemu-coroutine-lock.c
+++ b/qemu-coroutine-lock.c
@@ -88,16 +88,32 @@ static bool qemu_co_queue_do_restart(CoQueue *queue, bool single)
     return true;
 }
 
-bool qemu_co_queue_next(CoQueue *queue)
+bool coroutine_fn qemu_co_queue_next(CoQueue *queue)
 {
+    assert(qemu_in_coroutine());
     return qemu_co_queue_do_restart(queue, true);
 }
 
-void qemu_co_queue_restart_all(CoQueue *queue)
+void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue)
 {
+    assert(qemu_in_coroutine());
     qemu_co_queue_do_restart(queue, false);
 }
 
+bool qemu_co_enter_next(CoQueue *queue)
+{
+    Coroutine *next;
+
+    next = QTAILQ_FIRST(&queue->entries);
+    if (!next) {
+        return false;
+    }
+
+    QTAILQ_REMOVE(&queue->entries, next, co_queue_next);
+    qemu_coroutine_enter(next, NULL);
+    return true;
+}
+
 bool qemu_co_queue_empty(CoQueue *queue)
 {
     return (QTAILQ_FIRST(&queue->entries) == NULL);
commit 42ec24e2851674e0899f71933e0d7d9125f31d76
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Jul 19 19:51:33 2013 +0530

    gluster: Add image resize support
    
    Implement .bdrv_truncate in GlusterFS block driver so that GlusterFS backend
    can support image resizing.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Bharata B Rao <bharata at linux.vnet.ibm.com>
    Tested-by: Bharata B Rao <bharata at linux.vnet.ibm.com>
    Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/gluster.c b/block/gluster.c
index 6de418c..645b7f1 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -493,6 +493,19 @@ out:
     return NULL;
 }
 
+static int qemu_gluster_truncate(BlockDriverState *bs, int64_t offset)
+{
+    int ret;
+    BDRVGlusterState *s = bs->opaque;
+
+    ret = glfs_ftruncate(s->fd, offset);
+    if (ret < 0) {
+        return -errno;
+    }
+
+    return 0;
+}
+
 static BlockDriverAIOCB *qemu_gluster_aio_readv(BlockDriverState *bs,
         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
         BlockDriverCompletionFunc *cb, void *opaque)
@@ -631,6 +644,7 @@ static BlockDriver bdrv_gluster = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -650,6 +664,7 @@ static BlockDriver bdrv_gluster_tcp = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -669,6 +684,7 @@ static BlockDriver bdrv_gluster_unix = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -688,6 +704,7 @@ static BlockDriver bdrv_gluster_rdma = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
commit 9337e3b6e1d779215423d9b419d42200506deaab
Author: Eduardo Habkost <ehabkost at redhat.com>
Date:   Fri Jul 26 17:09:36 2013 -0300

    target-i386: Disable PMU CPUID leaf by default
    
    Bug description: QEMU currently gets all bits from GET_SUPPORTED_CPUID
    for CPUID leaf 0xA and passes them directly to the guest. This makes
    the guest ABI depend on host kernel and host CPU capabilities, and
    breaks live migration if we migrate between hosts with different
    capabilities (e.g., different number of PMU counters).
    
    Add a "pmu" property to X86CPU, and set it to true only on "-cpu host",
    or on pc-*-1.5 and older machine-types.
    
    For now, setting pmu=on will enable the current passthrough mode that
    doesn't have any ABI stability guarantees, but in the future we may
    implement a mode where the PMU CPUID bits are stable and configurable.
    
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Cc: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 7fb97b0..09c2dd4 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -235,6 +235,10 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
             .driver   = "virtio-net-pci",\
             .property = "any_layout",\
             .value    = "off",\
+        },{\
+            .driver = TYPE_X86_CPU,\
+            .property = "pmu",\
+            .value = "on",\
         }
 
 #define PC_COMPAT_1_4 \
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 60d2b5d..53b4c34 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -68,6 +68,13 @@ typedef struct X86CPU {
 
     /* Features that were filtered out because of missing host capabilities */
     uint32_t filtered_features[FEATURE_WORDS];
+
+    /* Enable PMU CPUID bits. This can't be enabled by default yet because
+     * it doesn't have ABI stability guarantees, as it passes all PMU CPUID
+     * bits returned by GET_SUPPORTED_CPUID (that depend on host CPU and kernel
+     * capabilities) directly to the guest.
+     */
+    bool enable_pmu;
 } X86CPU;
 
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 80143bf..71ab915 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1479,6 +1479,7 @@ static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
                                 const char *name)
 {
     x86_def_t *def;
+    Error *err = NULL;
     int i;
 
     if (name == NULL) {
@@ -1486,6 +1487,8 @@ static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
     }
     if (kvm_enabled() && strcmp(name, "host") == 0) {
         kvm_cpu_fill_host(x86_cpu_def);
+        object_property_set_bool(OBJECT(cpu), true, "pmu", &err);
+        assert_no_error(err);
         return 0;
     }
 
@@ -2017,7 +2020,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         break;
     case 0xA:
         /* Architectural Performance Monitoring Leaf */
-        if (kvm_enabled()) {
+        if (kvm_enabled() && cpu->enable_pmu) {
             KVMState *s = cs->kvm_state;
 
             *eax = kvm_arch_get_supported_cpuid(s, 0xA, count, R_EAX);
@@ -2523,6 +2526,11 @@ static void x86_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
     cpu->env.eip = tb->pc - tb->cs_base;
 }
 
+static Property x86_cpu_properties[] = {
+    DEFINE_PROP_BOOL("pmu", X86CPU, enable_pmu, false),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
@@ -2532,6 +2540,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     xcc->parent_realize = dc->realize;
     dc->realize = x86_cpu_realizefn;
     dc->bus_type = TYPE_ICC_BUS;
+    dc->props = x86_cpu_properties;
 
     xcc->parent_reset = cc->reset;
     cc->reset = x86_cpu_reset;
commit c139911261c5acc9dae56b1180db320ba25636bd
Author: Eduardo Habkost <ehabkost at redhat.com>
Date:   Fri Jul 26 17:09:35 2013 -0300

    target-i386: Pass X86CPU object to cpu_x86_find_by_name()
    
    This will help us change the initialization code to not require carrying
    some intermediate values in a x86_def_t struct (and eventually kill the
    x86_def_t struct entirely).
    
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index df2fb1b..80143bf 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1475,7 +1475,8 @@ static void x86_cpu_get_feature_words(Object *obj, Visitor *v, void *opaque,
     error_propagate(errp, err);
 }
 
-static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *name)
+static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
+                                const char *name)
 {
     x86_def_t *def;
     int i;
@@ -1742,7 +1743,7 @@ static void cpu_x86_register(X86CPU *cpu, const char *name, Error **errp)
 
     memset(def, 0, sizeof(*def));
 
-    if (cpu_x86_find_by_name(def, name) < 0) {
+    if (cpu_x86_find_by_name(cpu, def, name) < 0) {
         error_setg(errp, "Unable to find CPU definition: %s", name);
         return;
     }
commit 14a10fc39923b3af07c8c46d22cb20843bee3a72
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 02:53:25 2013 +0200

    cpu: Partially revert "cpu: Change qemu_init_vcpu() argument to CPUState"
    
    Commit c643bed99 moved qemu_init_vcpu() calls to common CPUState code.
    This causes x86 cpu-add to fail with "KVM: setting VAPIC address failed".
    
    The reason for the failure is that CPUClass::kvm_fd is not yet
    initialized in the following call graph:
    ->x86_cpu_realizefn
     ->x86_cpu_apic_realize
      ->qdev_init
       ->device_set_realized
        ->device_reset (hotplugged == 1)
         ->apic_reset_common
          ->vapic_base_update
           ->kvm_apic_vapic_base_update
    This causes attempted KVM vCPU ioctls to fail.
    
    By contrast, in the non-hotplug case the APIC is reset much later, when
    the vCPU is already initialized.
    
    As a quick and safe solution, move the qemu_init_vcpu() call back into
    the targets' realize functions.
    
    Reported-by: Chen Fan <chen.fan.fnst at cn.fujitsu.com>
    Acked-by: Igor Mammedov <imammedo at redhat.com> (for i386)
    Tested-by: Jia Liu <proljc at gmail.com> (for openrisc)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/qom/cpu.c b/qom/cpu.c
index dbc9fb6..aa95108 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -228,8 +228,6 @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
 {
     CPUState *cpu = CPU(dev);
 
-    qemu_init_vcpu(cpu);
-
     if (dev->hotplugged) {
         cpu_synchronize_post_init(cpu);
         notifier_list_notify(&cpu_added_notifiers, dev);
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 64c70bc..cfad2ea 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -33,8 +33,11 @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
 
 static void alpha_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     AlphaCPUClass *acc = ALPHA_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(cs);
+
     acc->parent_realize(dev, errp);
 }
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 87d35c6..5a7566b 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -159,6 +159,7 @@ static void arm_cpu_finalizefn(Object *obj)
 
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     ARMCPU *cpu = ARM_CPU(dev);
     ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev);
     CPUARMState *env = &cpu->env;
@@ -214,7 +215,8 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
     init_cpreg_list(cpu);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     acc->parent_realize(dev, errp);
 }
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 45f2d6b..44301a4 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -137,10 +137,11 @@ void cris_cpu_list(FILE *f, fprintf_function cpu_fprintf)
 
 static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    CRISCPU *cpu = CRIS_CPU(dev);
+    CPUState *cs = CPU(dev);
     CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     ccc->parent_realize(dev, errp);
 }
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 2b59b7d..df2fb1b 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2333,6 +2333,7 @@ static void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
 
 static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     X86CPU *cpu = X86_CPU(dev);
     X86CPUClass *xcc = X86_CPU_GET_CLASS(dev);
     CPUX86State *env = &cpu->env;
@@ -2387,12 +2388,13 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 #endif
 
     mce_init(cpu);
+    qemu_init_vcpu(cs);
 
     x86_cpu_apic_realize(cpu, &local_err);
     if (local_err != NULL) {
         goto out;
     }
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
 
     xcc->parent_realize(dev, &local_err);
 out:
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 962d553..869878c 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -46,10 +46,12 @@ static void lm32_cpu_reset(CPUState *s)
 
 static void lm32_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    LM32CPU *cpu = LM32_CPU(dev);
+    CPUState *cs = CPU(dev);
     LM32CPUClass *lcc = LM32_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+
+    qemu_init_vcpu(cs);
 
     lcc->parent_realize(dev, errp);
 }
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index c0bcb0d..008d8db 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -143,12 +143,14 @@ static const M68kCPUInfo m68k_cpus[] = {
 
 static void m68k_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     M68kCPU *cpu = M68K_CPU(dev);
     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(dev);
 
     m68k_cpu_init_gdb(cpu);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index c75d1bd..0ef9aa4 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -90,10 +90,11 @@ static void mb_cpu_reset(CPUState *s)
 
 static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(dev);
+    CPUState *cs = CPU(dev);
     MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index f81f9e9..9dd47e8 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -62,10 +62,11 @@ static void mips_cpu_reset(CPUState *s)
 
 static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MIPSCPU *cpu = MIPS_CPU(dev);
+    CPUState *cs = CPU(dev);
     MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 6550be5..d97a091 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -45,10 +45,11 @@ static void moxie_cpu_reset(CPUState *s)
 
 static void moxie_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MoxieCPU *cpu = MOXIE_CPU(dev);
+    CPUState *cs = CPU(dev);
     MoxieCPUClass *mcc = MOXIE_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index aa269fb..075f00a 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -66,10 +66,11 @@ static inline void set_feature(OpenRISCCPU *cpu, int feature)
 
 static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    OpenRISCCPU *cpu = OPENRISC_CPU(dev);
+    CPUState *cs = CPU(dev);
     OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     occ->parent_realize(dev, errp);
 }
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 8215946..3c81798 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7861,6 +7861,8 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
                                  34, "power-spe.xml", 0);
     }
 
+    qemu_init_vcpu(cs);
+
     pcc->parent_realize(dev, errp);
 
 #if defined(PPC_DUMP_CPU)
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 1d16da3..9b82495 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -101,10 +101,11 @@ static void s390_cpu_machine_reset_cb(void *opaque)
 
 static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    S390CPU *cpu = S390_CPU(dev);
+    CPUState *cs = CPU(dev);
     S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     scc->parent_realize(dev, errp);
 }
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index bda3c51..34b2b57 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -240,10 +240,11 @@ static const TypeInfo sh7785_type_info = {
 
 static void superh_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    SuperHCPU *cpu = SUPERH_CPU(dev);
+    CPUState *cs = CPU(dev);
     SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     scc->parent_realize(dev, errp);
 }
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index c7b4a90..47ce60d 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -743,6 +743,8 @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(CPU(dev));
+
     scc->parent_realize(dev, errp);
 }
 
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 46813e5..3f78208 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -92,6 +92,8 @@ static void uc32_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     UniCore32CPUClass *ucc = UNICORE32_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(CPU(dev));
+
     ucc->parent_realize(dev, errp);
 }
 
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index e966aa0..c19d17a 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -90,6 +90,8 @@ static void xtensa_cpu_realizefn(DeviceState *dev, Error **errp)
 
     cs->gdb_num_regs = xcc->config->gdb_regmap.num_regs;
 
+    qemu_init_vcpu(cs);
+
     xcc->parent_realize(dev, errp);
 }
 
commit fdc43322c978d78e79e692872dcec7b4f6a447f1
Merge: b0a71c3 8fbab3b
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 07:30:31 2013 -0500

    Merge remote-tracking branch 'sstabellini/xen-130729' into staging
    
    # By Paul Durrant (1) and Stefano Stabellini (1)
    # Via Stefano Stabellini
    * sstabellini/xen-130729:
      Xen PV Device
      xen_disk: support "direct-io-safe" backend option
    
    Message-id: 1375096790-12815-1-git-send-email-stefano.stabellini at eu.citrix.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit b0a71c3b397b12db727ce483f01b3336160ef6a1
Merge: f60a0d6 867b18d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 07:30:21 2013 -0500

    Merge remote-tracking branch 'agraf/s390-for-upstream' into staging
    
    # By Alexander Graf (1) and others
    # Via Alexander Graf
    * agraf/s390-for-upstream:
      s390: update s390-ccw.img
      s390/ipl: Fix boot order
      s390/IPL: Allow boot from other ssid than 0
    
    Message-id: 1375092324-23943-1-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit f60a0d6ab9ea9ba900ba3936c3471851f28f7bc4
Merge: 200a063 f53ec69
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 07:30:06 2013 -0500

    Merge remote-tracking branch 'sweil/w32' into staging
    
    # By Stefan Weil (10) and others
    # Via Aurelien Jarno (1) and Stefan Weil (1)
    * sweil/w32: (27 commits)
      w32, w64: Add build rule for installer
      target-mips: fix mipsdsp_mul_q31_q31
      mips_malta: fix copy of the 0x1fc00000 region
      linux-user: correct argument number for sys_mremap and sys_splice
      target-mips: Remove assignment to a variable which is never used
      target-mips: fix mipsdsp_trunc16_sat16_round
      hw/mips: align initrd to 64KB to avoid kernel error
      pflash_cfi01: duplicate status byte from bits 23:16 for 32bit reads
      mips_malta: generate SMBUS EEPROM data
      mips_malta: cap BIOS endian swap length at 0x3e0000 bytes
      mips_malta: generate SPD EEPROM data at runtime
      mips_malta: correct reading MIPS revision at 0x1fc00010
      mips_malta: fix BIOS endianness swapping
      mips_malta: QOM cast cleanup
      target-mips: fix branch in likely delay slot tcg assert
      target-mips: fix multiplication in mipsdsp_rndq15_mul_q15_q15
      target-mips: Remove assignment to a variable which is never used
      misc: Use g_assert_not_reached for code which is expected to be unreachable
      qemu-options: mention C-a h in the -nographic doc
      misc: Fix new typos in comments and strings
      ...
    
    Message-id: 1374989579-24933-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 8fbab3b62a271526c782110aed0ae160eb38c296
Author: Paul Durrant <paul.durrant at citrix.com>
Date:   Mon Jul 29 10:58:01 2013 +0000

    Xen PV Device
    
    Introduces a new Xen PV PCI device which will act as a binding point for
    PV drivers for Xen.
    The device has parameterized vendor-id, device-id and revision to allow to
    be configured as a binding point for any vendor's PV drivers.
    
    Signed-off-by: Paul Durrant <paul.durrant at citrix.com>
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/xen/Makefile.objs b/hw/xen/Makefile.objs
index 2017560..ce640c6 100644
--- a/hw/xen/Makefile.objs
+++ b/hw/xen/Makefile.objs
@@ -1,6 +1,6 @@
 # xen backend driver support
 common-obj-$(CONFIG_XEN_BACKEND) += xen_backend.o xen_devconfig.o
 
-obj-$(CONFIG_XEN_I386) += xen_platform.o xen_apic.o
+obj-$(CONFIG_XEN_I386) += xen_platform.o xen_apic.o xen_pvdevice.o
 obj-$(CONFIG_XEN_PCI_PASSTHROUGH) += xen-host-pci-device.o
 obj-$(CONFIG_XEN_PCI_PASSTHROUGH) += xen_pt.o xen_pt_config_init.o xen_pt_msi.o
diff --git a/hw/xen/xen_pvdevice.c b/hw/xen/xen_pvdevice.c
new file mode 100644
index 0000000..1132c89
--- /dev/null
+++ b/hw/xen/xen_pvdevice.c
@@ -0,0 +1,131 @@
+/* Copyright (c) Citrix Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms,
+ * with or without modification, are permitted provided
+ * that the following conditions are met:
+ *
+ * *   Redistributions of source code must retain the above
+ *     copyright notice, this list of conditions and the
+ *     following disclaimer.
+ * *   Redistributions in binary form must reproduce the above
+ *     copyright notice, this list of conditions and the
+ *     following disclaimer in the documentation and/or other
+ *     materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+ * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "hw/hw.h"
+#include "hw/pci/pci.h"
+#include "trace.h"
+
+#define TYPE_XEN_PV_DEVICE  "xen-pvdevice"
+
+#define XEN_PV_DEVICE(obj) \
+     OBJECT_CHECK(XenPVDevice, (obj), TYPE_XEN_PV_DEVICE)
+
+typedef struct XenPVDevice {
+    /*< private >*/
+    PCIDevice       parent_obj;
+    /*< public >*/
+    uint16_t        vendor_id;
+    uint16_t        device_id;
+    uint8_t         revision;
+    uint32_t        size;
+    MemoryRegion    mmio;
+} XenPVDevice;
+
+static uint64_t xen_pv_mmio_read(void *opaque, hwaddr addr,
+                                 unsigned size)
+{
+    trace_xen_pv_mmio_read(addr);
+
+    return ~(uint64_t)0;
+}
+
+static void xen_pv_mmio_write(void *opaque, hwaddr addr,
+                              uint64_t val, unsigned size)
+{
+    trace_xen_pv_mmio_write(addr);
+}
+
+static const MemoryRegionOps xen_pv_mmio_ops = {
+    .read = &xen_pv_mmio_read,
+    .write = &xen_pv_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static int xen_pv_init(PCIDevice *pci_dev)
+{
+    XenPVDevice *d = XEN_PV_DEVICE(pci_dev);
+    uint8_t *pci_conf;
+
+    pci_conf = pci_dev->config;
+
+    pci_set_word(pci_conf + PCI_VENDOR_ID, d->vendor_id);
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, d->vendor_id);
+    pci_set_word(pci_conf + PCI_DEVICE_ID, d->device_id);
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, d->device_id);
+    pci_set_byte(pci_conf + PCI_REVISION_ID, d->revision);
+
+    pci_set_word(pci_conf + PCI_COMMAND, PCI_COMMAND_MEMORY);
+
+    pci_config_set_prog_interface(pci_conf, 0);
+
+    pci_conf[PCI_INTERRUPT_PIN] = 1;
+
+    memory_region_init_io(&d->mmio, NULL, &xen_pv_mmio_ops, d,
+                          "mmio", d->size);
+
+    pci_register_bar(pci_dev, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
+                     &d->mmio);
+
+    return 0;
+}
+
+static Property xen_pv_props[] = {
+    DEFINE_PROP_UINT16("vendor-id", XenPVDevice, vendor_id, PCI_VENDOR_ID_XEN),
+    DEFINE_PROP_UINT16("device-id", XenPVDevice, device_id, PCI_DEVICE_ID_XEN_PVDEVICE),
+    DEFINE_PROP_UINT8("revision", XenPVDevice, revision, 0x01),
+    DEFINE_PROP_UINT32("size", XenPVDevice, size, 0x400000),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void xen_pv_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->init = xen_pv_init;
+    k->class_id = PCI_CLASS_SYSTEM_OTHER;
+    dc->desc = "Xen PV Device";
+    dc->props = xen_pv_props;
+}
+
+static const TypeInfo xen_pv_type_info = {
+    .name          = TYPE_XEN_PV_DEVICE,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(XenPVDevice),
+    .class_init    = xen_pv_class_init,
+};
+
+static void xen_pv_register_types(void)
+{
+    type_register_static(&xen_pv_type_info);
+}
+
+type_init(xen_pv_register_types)
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index d7933bf..3ddaf6a 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -143,8 +143,9 @@
 
 #define PCI_DEVICE_ID_INTEL_Q35_MCH      0x29c0
 
-#define PCI_VENDOR_ID_XEN               0x5853
-#define PCI_DEVICE_ID_XEN_PLATFORM      0x0001
+#define PCI_VENDOR_ID_XEN                0x5853
+#define PCI_DEVICE_ID_XEN_PLATFORM       0x0001
+#define PCI_DEVICE_ID_XEN_PVDEVICE       0x0002
 
 #define PCI_VENDOR_ID_NEC                0x1033
 #define PCI_DEVICE_ID_NEC_UPD720200      0x0194
diff --git a/trace-events b/trace-events
index 002df83..0f7c8b4 100644
--- a/trace-events
+++ b/trace-events
@@ -1168,3 +1168,7 @@ kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
 # qom/object.c
 object_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
 object_class_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
+
+# hw/xen/xen_pvdevice.c
+xen_pv_mmio_read(uint64_t addr) "WARNING: read from Xen PV Device MMIO space (address %"PRIx64")"
+xen_pv_mmio_write(uint64_t addr) "WARNING: write to Xen PV Device MMIO space (address %"PRIx64")"
commit 454ae734f1d9f591345fa78376435a8e74bb4edd
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Mon Jul 29 10:56:38 2013 +0000

    xen_disk: support "direct-io-safe" backend option
    
    Support backend option "direct-io-safe".  This is documented as
    follows in the Xen backend specification:
    
     * direct-io-safe
     *      Values:         0/1 (boolean)
     *      Default Value:  0
     *
     *      The underlying storage is not affected by the direct IO memory
     *      lifetime bug.  See:
     *        http://lists.xen.org/archives/html/xen-devel/2012-12/msg01154.html
     *
     *      Therefore this option gives the backend permission to use
     *      O_DIRECT, notwithstanding that bug.
     *
     *      That is, if this option is enabled, use of O_DIRECT is safe,
     *      in circumstances where we would normally have avoided it as a
     *      workaround for that bug.  This option is not relevant for all
     *      backends, and even not necessarily supported for those for
     *      which it is relevant.  A backend which knows that it is not
     *      affected by the bug can ignore this option.
     *
     *      This option doesn't require a backend to use O_DIRECT, so it
     *      should not be used to try to control the caching behaviour.
    
    Also, BDRV_O_NATIVE_AIO is ignored if BDRV_O_NOCACHE, so clarify the
    default flags passed to the qemu block layer.
    
    The original proposal for a "cache" backend option has been dropped
    because it was believed too wide, especially considering that at the
    moment the backend doesn't have a way to tell the toolstack that it is
    capable of supporting it.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Signed-off-by: Ian Jackson <Ian.Jackson at eu.citrix.com>

diff --git a/hw/block/xen_disk.c b/hw/block/xen_disk.c
index 247f32f..727f433 100644
--- a/hw/block/xen_disk.c
+++ b/hw/block/xen_disk.c
@@ -93,6 +93,7 @@ struct XenBlkDev {
     char                *type;
     char                *dev;
     char                *devtype;
+    bool                directiosafe;
     const char          *fileproto;
     const char          *filename;
     int                 ring_ref;
@@ -701,6 +702,7 @@ static int blk_init(struct XenDevice *xendev)
 {
     struct XenBlkDev *blkdev = container_of(xendev, struct XenBlkDev, xendev);
     int info = 0;
+    char *directiosafe = NULL;
 
     /* read xenstore entries */
     if (blkdev->params == NULL) {
@@ -733,6 +735,8 @@ static int blk_init(struct XenDevice *xendev)
     if (blkdev->devtype == NULL) {
         blkdev->devtype = xenstore_read_be_str(&blkdev->xendev, "device-type");
     }
+    directiosafe = xenstore_read_be_str(&blkdev->xendev, "direct-io-safe");
+    blkdev->directiosafe = (directiosafe && atoi(directiosafe));
 
     /* do we have all we need? */
     if (blkdev->params == NULL ||
@@ -760,6 +764,8 @@ static int blk_init(struct XenDevice *xendev)
     xenstore_write_be_int(&blkdev->xendev, "feature-flush-cache", 1);
     xenstore_write_be_int(&blkdev->xendev, "feature-persistent", 1);
     xenstore_write_be_int(&blkdev->xendev, "info", info);
+
+    g_free(directiosafe);
     return 0;
 
 out_error:
@@ -773,6 +779,8 @@ out_error:
     blkdev->dev = NULL;
     g_free(blkdev->devtype);
     blkdev->devtype = NULL;
+    g_free(directiosafe);
+    blkdev->directiosafe = false;
     return -1;
 }
 
@@ -783,7 +791,11 @@ static int blk_connect(struct XenDevice *xendev)
     bool readonly = true;
 
     /* read-only ? */
-    qflags = BDRV_O_CACHE_WB | BDRV_O_NATIVE_AIO;
+    if (blkdev->directiosafe) {
+        qflags = BDRV_O_NOCACHE | BDRV_O_NATIVE_AIO;
+    } else {
+        qflags = BDRV_O_CACHE_WB;
+    }
     if (strcmp(blkdev->mode, "w") == 0) {
         qflags |= BDRV_O_RDWR;
         readonly = false;
commit 867b18db2155c0c99ab767c4ac563e144c85871d
Author: Alexander Graf <agraf at suse.de>
Date:   Mon Jun 24 14:56:51 2013 +0200

    s390: update s390-ccw.img
    
    This enables the following patches:
    
      s390/IPL: Allow boot from other ssid than 0
      s390/ipl: Fix spurious errors in virtio
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/pc-bios/s390-ccw.img b/pc-bios/s390-ccw.img
index 1b2a11e..05fc7c2 100644
Binary files a/pc-bios/s390-ccw.img and b/pc-bios/s390-ccw.img differ
commit 5c8ded6ef55761e80353f42d8e59c6e233a2f51a
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Tue Jun 18 14:31:52 2013 +0200

    s390/ipl: Fix boot order
    
    The latest ipl code adaptions collided with some of the virtio
    refactoring rework. This resulted in always booting the first
    disk. Let's fix booting from a given ID.
    The new code also checks for command lines without bootindex to
    avoid random behaviour when accessing dev_st (==0).
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 0aeb003..d69adb2 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -154,17 +154,19 @@ static void s390_ipl_reset(DeviceState *dev)
     env->psw.mask = IPL_PSW_MASK;
 
     if (!ipl->kernel) {
-        /* booting firmware, tell what device to boot from */
+        /* Tell firmware, if there is a preferred boot device */
+        env->regs[7] = -1;
         DeviceState *dev_st = get_boot_device(0);
-        VirtioCcwDevice *ccw_dev = (VirtioCcwDevice *) object_dynamic_cast(
-                OBJECT(&(dev_st->parent_obj)), "virtio-blk-ccw");
-
-        if (ccw_dev) {
-            env->regs[7] = ccw_dev->sch->cssid << 24 |
-                           ccw_dev->sch->ssid << 16 |
-                           ccw_dev->sch->devno;
-        } else {
-            env->regs[7] = -1;
+        if (dev_st) {
+            VirtioCcwDevice *ccw_dev = (VirtioCcwDevice *) object_dynamic_cast(
+                OBJECT(qdev_get_parent_bus(dev_st)->parent),
+                TYPE_VIRTIO_CCW_DEVICE);
+
+            if (ccw_dev) {
+                env->regs[7] = ccw_dev->sch->cssid << 24 |
+                               ccw_dev->sch->ssid << 16 |
+                               ccw_dev->sch->devno;
+            }
         }
     }
 
commit c8cda8748eceeeb06f1952e7e765a0919103644d
Author: Dominik Dingel <dingel at linux.vnet.ibm.com>
Date:   Mon Jun 17 14:29:42 2013 +0200

    s390/IPL: Allow boot from other ssid than 0
    
    We now take the subchannel set id also into account to find the boot device.
    If we want to use a subchannel set other than the default set 0, we first
    need to enable the mss facility.
    
    Signed-off-by: Dominik Dingel <dingel at linux.vnet.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/pc-bios/s390-ccw/cio.h b/pc-bios/s390-ccw/cio.h
index cb5815a..f5b4549 100644
--- a/pc-bios/s390-ccw/cio.h
+++ b/pc-bios/s390-ccw/cio.h
@@ -93,6 +93,26 @@ struct subchannel_id {
         __u32 sch_no : 16;
 } __attribute__ ((packed, aligned(4)));
 
+struct chsc_header {
+    __u16 length;
+    __u16 code;
+} __attribute__((packed));
+
+struct chsc_area_sda {
+    struct chsc_header request;
+    __u8 reserved1:4;
+    __u8 format:4;
+    __u8 reserved2;
+    __u16 operation_code;
+    __u32 reserved3;
+    __u32 reserved4;
+    __u32 operation_data_area[252];
+    struct chsc_header response;
+    __u32 reserved5:4;
+    __u32 format2:4;
+    __u32 reserved6:24;
+} __attribute__((packed));
+
 /*
  * TPI info structure
  */
diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
index 1665c57..c5d5332 100644
--- a/pc-bios/s390-ccw/main.c
+++ b/pc-bios/s390-ccw/main.c
@@ -35,6 +35,13 @@ static void virtio_setup(uint64_t dev_info)
         check_devno = true;
         dev_no = dev_info & 0xffff;
         debug_print_int("device no. ", dev_no);
+        blk_schid.ssid = (dev_info >> 16) & 0x3;
+        if (blk_schid.ssid != 0) {
+            debug_print_int("ssid ", blk_schid.ssid);
+            if (enable_mss_facility() != 0) {
+                virtio_panic("Failed to enable mss facility\n");
+            }
+        }
     }
 
     for (i = 0; i < 0x10000; i++) {
diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
index 8241b0a..5e871ac 100644
--- a/pc-bios/s390-ccw/s390-ccw.h
+++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -61,6 +61,7 @@ unsigned long virtio_load_direct(ulong rec_list1, ulong rec_list2,
 bool virtio_is_blk(struct subchannel_id schid);
 void virtio_setup_block(struct subchannel_id schid);
 int virtio_read(ulong sector, void *load_addr);
+int enable_mss_facility(void);
 
 /* bootmap.c */
 int zipl_load(void);
diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
index f438af1..49f2d29 100644
--- a/pc-bios/s390-ccw/virtio.c
+++ b/pc-bios/s390-ccw/virtio.c
@@ -13,6 +13,8 @@
 
 struct vring block;
 
+static char chsc_page[PAGE_SIZE] __attribute__((__aligned__(PAGE_SIZE)));
+
 static long kvm_hypercall(unsigned long nr, unsigned long param1,
                           unsigned long param2)
 {
@@ -301,3 +303,19 @@ bool virtio_is_blk(struct subchannel_id schid)
     return true;
 }
 
+int enable_mss_facility(void)
+{
+    int ret;
+    struct chsc_area_sda *sda_area = (struct chsc_area_sda *) chsc_page;
+
+    memset(sda_area, 0, PAGE_SIZE);
+    sda_area->request.length = 0x0400;
+    sda_area->request.code = 0x0031;
+    sda_area->operation_code = 0x2;
+
+    ret = chsc(sda_area);
+    if ((ret == 0) && (sda_area->response.code == 0x0001)) {
+        return 0;
+    }
+    return -EIO;
+}
commit f53ec6999287bfdc4f0dfdb6427baa1853f8952a
Author: Stefan Weil <sw at weilnetz.de>
Date:   Mon Jul 15 23:49:57 2013 +0200

    w32, w64: Add build rule for installer
    
    The new rules in Makefile allow building installers for QEMU on Windows
    using NSIS, a package which is also available for Linux distributions
    (so cross builds are possible).
    
    The rules for NSIS are in qemu.nsi which also uses two new images.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/Makefile b/Makefile
index c06bfab..29f1043 100644
--- a/Makefile
+++ b/Makefile
@@ -437,6 +437,61 @@ qemu-doc.dvi qemu-doc.html qemu-doc.info qemu-doc.pdf: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi \
 	qemu-monitor.texi qemu-img-cmds.texi
 
+ifdef CONFIG_WIN32
+
+INSTALLER = qemu-setup-$(VERSION)$(EXESUF)
+
+nsisflags = -V2 -NOCD
+
+ifneq ($(wildcard $(SRC_PATH)/dll),)
+ifeq ($(ARCH),x86_64)
+# 64 bit executables
+DLL_PATH = $(SRC_PATH)/dll/w64
+nsisflags += -DW64
+else
+# 32 bit executables
+DLL_PATH = $(SRC_PATH)/dll/w32
+endif
+endif
+
+.PHONY: installer
+installer: $(INSTALLER)
+
+INSTDIR=/tmp/qemu-nsis
+
+$(INSTALLER): $(SRC_PATH)/qemu.nsi
+	make install prefix=${INSTDIR}
+ifdef SIGNCODE
+	(cd ${INSTDIR}; \
+         for i in *.exe; do \
+           $(SIGNCODE) $${i}; \
+         done \
+        )
+endif # SIGNCODE
+	(cd ${INSTDIR}; \
+         for i in qemu-system-*.exe; do \
+           arch=$${i%.exe}; \
+           arch=$${arch#qemu-system-}; \
+           echo Section \"$$arch\" Section_$$arch; \
+           echo SetOutPath \"\$$INSTDIR\"; \
+           echo File \"\$${BINDIR}\\$$i\"; \
+           echo SectionEnd; \
+         done \
+        ) >${INSTDIR}/system-emulations.nsh
+	makensis $(nsisflags) \
+                $(if $(BUILD_DOCS),-DCONFIG_DOCUMENTATION="y") \
+                $(if $(CONFIG_GTK),-DCONFIG_GTK="y") \
+                -DBINDIR="${INSTDIR}" \
+                $(if $(DLL_PATH),-DDLLDIR="$(DLL_PATH)") \
+                -DSRCDIR="$(SRC_PATH)" \
+                -DOUTFILE="$(INSTALLER)" \
+                $(SRC_PATH)/qemu.nsi
+	rm -r ${INSTDIR}
+ifdef SIGNCODE
+	$(SIGNCODE) $(INSTALLER)
+endif # SIGNCODE
+endif # CONFIG_WIN
+
 # Add a dependency on the generated files, so that they are always
 # rebuilt before other object files
 ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
diff --git a/pc-bios/qemu-nsis.bmp b/pc-bios/qemu-nsis.bmp
new file mode 100644
index 0000000..ae82cd2
Binary files /dev/null and b/pc-bios/qemu-nsis.bmp differ
diff --git a/pc-bios/qemu-nsis.ico b/pc-bios/qemu-nsis.ico
new file mode 100644
index 0000000..1d0128c
Binary files /dev/null and b/pc-bios/qemu-nsis.ico differ
diff --git a/qemu.nsi b/qemu.nsi
new file mode 100644
index 0000000..1d57455
--- /dev/null
+++ b/qemu.nsi
@@ -0,0 +1,250 @@
+;!/usr/bin/makensis
+
+; This NSIS script creates an installer for QEMU on Windows.
+
+; Copyright (C) 2006-2012 Stefan Weil
+;
+; This program is free software: you can redistribute it and/or modify
+; it under the terms of the GNU General Public License as published by
+; the Free Software Foundation, either version 2 of the License, or
+; (at your option) version 3 or any later version.
+;
+; This program is distributed in the hope that it will be useful,
+; but WITHOUT ANY WARRANTY; without even the implied warranty of
+; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+; GNU General Public License for more details.
+;
+; You should have received a copy of the GNU General Public License
+; along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+; NSIS_WIN32_MAKENSIS
+
+!define PRODUCT "QEMU"
+!define URL     "http://www.qemu.org/"
+
+!define UNINST_EXE "$INSTDIR\qemu-uninstall.exe"
+!define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\${PRODUCT}"
+
+!ifndef BINDIR
+!define BINDIR nsis.tmp
+!endif
+!ifndef SRCDIR
+!define SRCDIR .
+!endif
+!ifndef OUTFILE
+!define OUTFILE "qemu-setup.exe"
+!endif
+
+; Optionally install documentation.
+!ifndef CONFIG_DOCUMENTATION
+!define CONFIG_DOCUMENTATION
+!endif
+
+; Use maximum compression.
+SetCompressor /SOLID lzma
+
+!include "MUI2.nsh"
+
+; The name of the installer.
+Name "QEMU"
+
+; The file to write
+OutFile "${OUTFILE}"
+
+; The default installation directory.
+!ifdef W64
+InstallDir $PROGRAMFILES64\qemu
+!else
+InstallDir $PROGRAMFILES\qemu
+!endif
+
+; Registry key to check for directory (so if you install again, it will
+; overwrite the old one automatically)
+InstallDirRegKey HKLM "Software\qemu" "Install_Dir"
+
+; Request administrator privileges for Windows Vista.
+RequestExecutionLevel admin
+
+;--------------------------------
+; Interface Settings.
+;!define MUI_HEADERIMAGE "qemu-nsis.bmp"
+; !define MUI_SPECIALBITMAP "qemu.bmp"
+!define MUI_ICON "${SRCDIR}\pc-bios\qemu-nsis.ico"
+!define MUI_UNICON "${SRCDIR}\pc-bios\qemu-nsis.ico"
+!define MUI_WELCOMEFINISHPAGE_BITMAP "${SRCDIR}\pc-bios\qemu-nsis.bmp"
+; !define MUI_HEADERIMAGE_BITMAP "qemu-install.bmp"
+; !define MUI_HEADERIMAGE_UNBITMAP "qemu-uninstall.bmp"
+; !define MUI_COMPONENTSPAGE_SMALLDESC
+; !define MUI_WELCOMEPAGE_TEXT "Insert text here.$\r$\n$\r$\n$\r$\n$_CLICK"
+
+;--------------------------------
+; Pages.
+
+!insertmacro MUI_PAGE_WELCOME
+!insertmacro MUI_PAGE_LICENSE "${SRCDIR}\COPYING"
+!insertmacro MUI_PAGE_COMPONENTS
+!insertmacro MUI_PAGE_DIRECTORY
+!insertmacro MUI_PAGE_INSTFILES
+!define MUI_FINISHPAGE_LINK "Visit the QEMU Wiki online!"
+!define MUI_FINISHPAGE_LINK_LOCATION "${URL}"
+!insertmacro MUI_PAGE_FINISH
+
+!insertmacro MUI_UNPAGE_CONFIRM
+!insertmacro MUI_UNPAGE_INSTFILES
+
+;--------------------------------
+; Languages.
+
+!insertmacro MUI_LANGUAGE "English"
+!insertmacro MUI_LANGUAGE "French"
+!insertmacro MUI_LANGUAGE "German"
+
+;--------------------------------
+
+; The stuff to install.
+Section "${PRODUCT} (required)"
+
+    SectionIn RO
+
+    ; Set output path to the installation directory.
+    SetOutPath "$INSTDIR"
+
+    File "${SRCDIR}\Changelog"
+    File "${SRCDIR}\COPYING"
+    File "${SRCDIR}\COPYING.LIB"
+    File "${SRCDIR}\README"
+    File "${SRCDIR}\VERSION"
+
+    File "${BINDIR}\*.bmp"
+    File "${BINDIR}\*.bin"
+    File "${BINDIR}\*.dtb"
+    File "${BINDIR}\*.rom"
+    File "${BINDIR}\openbios-*"
+
+    File /r "${BINDIR}\keymaps"
+!ifdef CONFIG_GTK
+    File /r "${BINDIR}\share"
+!endif
+
+!ifdef W64
+    SetRegView 64
+!endif
+
+    ; Write the installation path into the registry
+    WriteRegStr HKLM SOFTWARE\${PRODUCT} "Install_Dir" "$INSTDIR"
+
+    ; Write the uninstall keys for Windows
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayName" "QEMU"
+    WriteRegStr HKLM "${UNINST_KEY}" "UninstallString" '"${UNINST_EXE}"'
+    WriteRegDWORD HKLM "${UNINST_KEY}" "NoModify" 1
+    WriteRegDWORD HKLM "${UNINST_KEY}" "NoRepair" 1
+    WriteUninstaller "qemu-uninstall.exe"
+SectionEnd
+
+Section "Tools" SectionTools
+    SetOutPath "$INSTDIR"
+    File "${BINDIR}\qemu-img.exe"
+    File "${BINDIR}\qemu-io.exe"
+SectionEnd
+
+SectionGroup "System Emulations" SectionSystem
+
+!include "${BINDIR}\system-emulations.nsh"
+
+SectionGroupEnd
+
+!ifdef DLLDIR
+Section "Libraries (DLL)" SectionDll
+    SetOutPath "$INSTDIR"
+    File "${DLLDIR}\*.dll"
+SectionEnd
+!endif
+
+!ifdef CONFIG_DOCUMENTATION
+Section "Documentation" SectionDoc
+    SetOutPath "$INSTDIR"
+    File "${BINDIR}\qemu-doc.html"
+    File "${BINDIR}\qemu-tech.html"
+    CreateDirectory "$SMPROGRAMS\${PRODUCT}"
+    CreateShortCut "$SMPROGRAMS\${PRODUCT}\User Documentation.lnk" "$INSTDIR\qemu-doc.html" "" "$INSTDIR\qemu-doc.html" 0
+    CreateShortCut "$SMPROGRAMS\${PRODUCT}\Technical Documentation.lnk" "$INSTDIR\qemu-tech.html" "" "$INSTDIR\qemu-tech.html" 0
+SectionEnd
+!endif
+
+; Optional section (can be disabled by the user)
+Section "Start Menu Shortcuts" SectionMenu
+    CreateDirectory "$SMPROGRAMS\${PRODUCT}"
+    CreateShortCut "$SMPROGRAMS\${PRODUCT}\Uninstall.lnk" "${UNINST_EXE}" "" "${UNINST_EXE}" 0
+SectionEnd
+
+;--------------------------------
+
+; Uninstaller
+
+Section "Uninstall"
+    ; Remove registry keys
+!ifdef W64
+    SetRegView 64
+!endif
+    DeleteRegKey HKLM "${UNINST_KEY}"
+    DeleteRegKey HKLM SOFTWARE\${PRODUCT}
+
+    ; Remove shortcuts, if any
+    Delete "$SMPROGRAMS\${PRODUCT}\User Documentation.lnk"
+    Delete "$SMPROGRAMS\${PRODUCT}\Technical Documentation.lnk"
+    Delete "$SMPROGRAMS\${PRODUCT}\Uninstall.lnk"
+    RMDir "$SMPROGRAMS\${PRODUCT}"
+
+    ; Remove files and directories used
+    Delete "$INSTDIR\Changelog"
+    Delete "$INSTDIR\COPYING"
+    Delete "$INSTDIR\COPYING.LIB"
+    Delete "$INSTDIR\README"
+    Delete "$INSTDIR\VERSION"
+    Delete "$INSTDIR\*.bmp"
+    Delete "$INSTDIR\*.bin"
+    Delete "$INSTDIR\*.dll"
+    Delete "$INSTDIR\*.dtb"
+    Delete "$INSTDIR\*.rom"
+    Delete "$INSTDIR\openbios-*"
+    Delete "$INSTDIR\qemu-img.exe"
+    Delete "$INSTDIR\qemu-io.exe"
+    Delete "$INSTDIR\qemu.exe"
+    Delete "$INSTDIR\qemu-system-*.exe"
+    Delete "$INSTDIR\qemu-doc.html"
+    Delete "$INSTDIR\qemu-tech.html"
+    RMDir /r "$INSTDIR\keymaps"
+    RMDir /r "$INSTDIR\share"
+    ; Remove generated files
+    Delete "$INSTDIR\stderr.txt"
+    Delete "$INSTDIR\stdout.txt"
+    ; Remove uninstaller
+    Delete "${UNINST_EXE}"
+    RMDir "$INSTDIR"
+SectionEnd
+
+;--------------------------------
+
+; Descriptions (mouse-over).
+!insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem}  "System emulation."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha}  "Alpha system emulation."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386}   "PC i386 system emulation."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w}  "PC i386 system emulation (GUI)."
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."
+!ifdef DLLDIR
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionDll}   "Runtime Libraries (DLL)."
+!endif
+!ifdef CONFIG_DOCUMENTATION
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionDoc}   "Documentation."
+!endif
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionMenu}  "Menu entries."
+!insertmacro MUI_FUNCTION_DESCRIPTION_END
+
+;--------------------------------
+; Functions.
+
+Function .onInit
+    !insertmacro MUI_LANGDLL_DISPLAY
+FunctionEnd
commit 461bdb3414c40d6806194bf68c91521496b1042d
Merge: b6a9f46 6c86f40
Author: Aurelien Jarno <aurelien at aurel32.net>
Date:   Mon Jul 29 09:03:23 2013 +0200

    Merge branch 'trivial-patches' of git://git.corpit.ru/qemu
    
    * 'trivial-patches' of git://git.corpit.ru/qemu:
      target-mips: Remove assignment to a variable which is never used
      misc: Use g_assert_not_reached for code which is expected to be unreachable
      qemu-options: mention C-a h in the -nographic doc
      misc: Fix new typos in comments and strings
      linux-user: correct argument number for sys_mremap and sys_splice
      PPC: dbdma: macio: Fix format specifiers (build regression)
      watchdog: Remove break after exit
      exec: Remove env from list of poisoned names
      hw/9pfs: Fix potential memory leak and avoid reuse of freed memory
      timer: make timers_state static
      aes: Remove unused code (NDEBUG, u16)

commit b6a9f4682e62c686995cc1a1fe2ef4a57a92020b
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Mon Jul 29 04:06:12 2013 +0200

    target-mips: fix mipsdsp_mul_q31_q31
    
    Multiplication of two fractional word elements is not correct when sign
    extension/promotion is needed. This change fixes it by adding correct
    casts from unsigned to signed values.
    In addition, the tests (dpaq_sa_l_w.c and dpsq_sa_l_w.c) have been extended
    to trigger the current issue.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-mips/dsp_helper.c b/target-mips/dsp_helper.c
index 93f5d9e..b088a25 100644
--- a/target-mips/dsp_helper.c
+++ b/target-mips/dsp_helper.c
@@ -583,7 +583,7 @@ static inline int64_t mipsdsp_mul_q31_q31(int32_t ac, uint32_t a, uint32_t b,
         temp = (0x01ull << 63) - 1;
         set_DSPControl_overflow_flag(1, 16 + ac, env);
     } else {
-        temp = ((uint64_t)a * (uint64_t)b) << 1;
+        temp = ((int64_t)(int32_t)a * (int32_t)b) << 1;
     }
 
     return temp;
diff --git a/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c b/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c
index ce86484..cbf9007 100644
--- a/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c
+++ b/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c
@@ -14,7 +14,7 @@ int main()
     resultdsp = 0x01;
     __asm
         ("mthi        %0, $ac1\n\t"
-         "mtlo        %0, $ac1\n\t"
+         "mtlo        %1, $ac1\n\t"
          "dpaq_sa.l.w $ac1, %3, %4\n\t"
          "mfhi        %0,   $ac1\n\t"
          "mflo        %1,   $ac1\n\t"
@@ -27,8 +27,8 @@ int main()
     assert(ach == resulth);
     assert(acl == resultl);
 
-    ach = 0x12;
-    acl = 0x48;
+    ach = 0x00000012;
+    acl = 0x00000048;
     rs  = 0x80000000;
     rt  = 0x80000000;
 
@@ -37,7 +37,7 @@ int main()
     resultdsp = 0x01;
     __asm
         ("mthi        %0, $ac1\n\t"
-         "mtlo        %0, $ac1\n\t"
+         "mtlo        %1, $ac1\n\t"
          "dpaq_sa.l.w $ac1, %3, %4\n\t"
          "mfhi        %0,   $ac1\n\t"
          "mflo        %1,   $ac1\n\t"
@@ -51,16 +51,64 @@ int main()
     assert(acl == resultl);
 
     ach = 0x741532A0;
-    acl = 0xfceabb08;
+    acl = 0xFCEABB08;
     rs  = 0x80000000;
     rt  = 0x80000000;
 
-    resulth   = 0x7fffffff;
-    resultl   = 0xffffffff;
+    resulth   = 0x7FFFFFFF;
+    resultl   = 0xFFFFFFFF;
     resultdsp = 0x01;
     __asm
         ("mthi        %0, $ac1\n\t"
-         "mtlo        %0, $ac1\n\t"
+         "mtlo        %1, $ac1\n\t"
+         "dpaq_sa.l.w $ac1, %3, %4\n\t"
+         "mfhi        %0,   $ac1\n\t"
+         "mflo        %1,   $ac1\n\t"
+         "rddsp       %2\n\t"
+         : "+r"(ach), "+r"(acl), "=r"(dsp)
+         : "r"(rs), "r"(rt)
+        );
+    dsp = (dsp >> 17) & 0x01;
+    assert(dsp == resultdsp);
+    assert(ach == resulth);
+    assert(acl == resultl);
+
+    ach = 0;
+    acl = 0;
+    rs  = 0xC0000000;
+    rt  = 0x7FFFFFFF;
+
+    resulth   = 0xC0000000;
+    resultl   = 0x80000000;
+    resultdsp = 0;
+    __asm
+        ("wrdsp       $0\n\t"
+         "mthi        %0, $ac1\n\t"
+         "mtlo        %1, $ac1\n\t"
+         "dpaq_sa.l.w $ac1, %3, %4\n\t"
+         "mfhi        %0,   $ac1\n\t"
+         "mflo        %1,   $ac1\n\t"
+         "rddsp       %2\n\t"
+         : "+r"(ach), "+r"(acl), "=r"(dsp)
+         : "r"(rs), "r"(rt)
+        );
+    dsp = (dsp >> 17) & 0x01;
+    assert(dsp == resultdsp);
+    assert(ach == resulth);
+    assert(acl == resultl);
+
+    ach = 0x20000000;
+    acl = 0;
+    rs  = 0xE0000000;
+    rt  = 0x7FFFFFFF;
+
+    resulth   = 0;
+    resultl   = 0x40000000;
+    resultdsp = 0;
+    __asm
+        ("wrdsp       $0\n\t"
+         "mthi        %0, $ac1\n\t"
+         "mtlo        %1, $ac1\n\t"
          "dpaq_sa.l.w $ac1, %3, %4\n\t"
          "mfhi        %0,   $ac1\n\t"
          "mflo        %1,   $ac1\n\t"
diff --git a/tests/tcg/mips/mips32-dsp/dpsq_sa_l_w.c b/tests/tcg/mips/mips32-dsp/dpsq_sa_l_w.c
index b7b73fd..eda3b14 100644
--- a/tests/tcg/mips/mips32-dsp/dpsq_sa_l_w.c
+++ b/tests/tcg/mips/mips32-dsp/dpsq_sa_l_w.c
@@ -9,8 +9,8 @@ int main()
 
     rs      = 0xBC0123AD;
     rt      = 0x01643721;
-    resulth = 0xfdf4cbe0;
-    resultl = 0xd138776b;
+    resulth = 0x00BD3A22;
+    resultl = 0xD138776B;
     resultdsp = 0x00;
     __asm
         ("mthi  %0, $ac1\n\t"
commit f05d4d94d6bb0e240e6cfda65972fd86601f9f0d
Author: Aurelien Jarno <aurelien at aurel32.net>
Date:   Mon Jul 29 07:00:29 2013 +0200

    mips_malta: fix copy of the 0x1fc00000 region
    
    Copy the whole 0x1fe000000 region into 0x1fc00000, independently of the
    loaded BIOS size. This fix the MIPS make check tests.
    
    Reported-by: Andreas Färber <afaerber at suse.de>
    Tested-by: Andreas Färber <afaerber at suse.de>
    Cc: Paul Burton <paul.burton at imgtec.com>
    Cc: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 2dc66f7..1589b59 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -1036,9 +1036,9 @@ void mips_malta_init(QEMUMachineInitArgs *args)
      */
     memory_region_init_ram(bios_copy, NULL, "bios.1fc", BIOS_SIZE);
     if (!rom_copy(memory_region_get_ram_ptr(bios_copy),
-                  FLASH_ADDRESS, bios_size)) {
+                  FLASH_ADDRESS, BIOS_SIZE)) {
         memcpy(memory_region_get_ram_ptr(bios_copy),
-               memory_region_get_ram_ptr(bios), bios_size);
+               memory_region_get_ram_ptr(bios), BIOS_SIZE);
     }
     memory_region_set_readonly(bios_copy, true);
     memory_region_add_subregion(system_memory, RESET_ADDRESS, bios_copy);
commit b0932e0617c65ae1cb0362416ec0ef32766abf5d
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Tue Jul 23 19:00:10 2013 +0200

    linux-user: correct argument number for sys_mremap and sys_splice
    
    sys_mremap missed 5th argument (new_address), which caused examples that
    remap to a specific address to fail.
    sys_splice missed 5th and 6th argument which caused different examples to
    fail.
    This change has an effect on MIPS target only.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/linux-user/main.c b/linux-user/main.c
index 5309117..03859bc 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -1920,7 +1920,7 @@ static const uint8_t mips_syscall_args[] = {
 	MIPS_SYS(sys_sched_get_priority_min, 1)
 	MIPS_SYS(sys_sched_rr_get_interval, 2)	/* 4165 */
 	MIPS_SYS(sys_nanosleep,	2)
-	MIPS_SYS(sys_mremap	, 4)
+	MIPS_SYS(sys_mremap	, 5)
 	MIPS_SYS(sys_accept	, 3)
 	MIPS_SYS(sys_bind	, 3)
 	MIPS_SYS(sys_connect	, 3)	/* 4170 */
@@ -2057,7 +2057,7 @@ static const uint8_t mips_syscall_args[] = {
 	MIPS_SYS(sys_pselect6, 6)
 	MIPS_SYS(sys_ppoll, 5)
 	MIPS_SYS(sys_unshare, 1)
-	MIPS_SYS(sys_splice, 4)
+	MIPS_SYS(sys_splice, 6)
 	MIPS_SYS(sys_sync_file_range, 7) /* 4305 */
 	MIPS_SYS(sys_tee, 4)
 	MIPS_SYS(sys_vmsplice, 4)
commit d2e46d59cac7d8259bf80abcddfebde87014d610
Author: Stefan Weil <sw at weilnetz.de>
Date:   Thu Jul 25 22:10:31 2013 +0200

    target-mips: Remove assignment to a variable which is never used
    
    This assignment causes a compiler warning for compilations with the compiler
    option -Wunused-but-set-variable (which is included with -Wextra).
    
    Removing it allows using -Wextra for QEMU code without suppressing too many
    extra warnings.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 5cf1c3f..b828375 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -1735,7 +1735,6 @@ target_ulong helper_evpe(CPUMIPSState *env)
 void helper_fork(target_ulong arg1, target_ulong arg2)
 {
     // arg1 = rt, arg2 = rs
-    arg1 = 0;
     // TODO: store to TC register
 }
 
commit d36c231f4b7386bd8230aa17d362b925aa419b2f
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Mon Jul 1 01:54:47 2013 +0200

    target-mips: fix mipsdsp_trunc16_sat16_round
    
    This change corrects rounding and saturation of Q31 fractional value in
    mipsdsp_trunc16_sat16_round(). Overflow detection was incorrect for the
    corner case for PRECRQ_RS.PH, and this test case is also part of the change.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-mips/dsp_helper.c b/target-mips/dsp_helper.c
index c718a78..93f5d9e 100644
--- a/target-mips/dsp_helper.c
+++ b/target-mips/dsp_helper.c
@@ -648,16 +648,22 @@ static inline int32_t mipsdsp_sat16_mul_q15_q15(uint16_t a, uint16_t b,
 static inline uint16_t mipsdsp_trunc16_sat16_round(int32_t a,
                                                    CPUMIPSState *env)
 {
-    int64_t temp;
+    uint16_t temp;
 
-    temp = (int32_t)a + 0x00008000;
 
-    if (a > (int)0x7fff8000) {
-        temp = 0x7FFFFFFF;
+    /*
+     * The value 0x00008000 will be added to the input Q31 value, and the code
+     * needs to check if the addition causes an overflow. Since a positive value
+     * is added, overflow can happen in one direction only.
+     */
+    if (a > 0x7FFF7FFF) {
+        temp = 0x7FFF;
         set_DSPControl_overflow_flag(1, 22, env);
+    } else {
+        temp = ((a + 0x8000) >> 16) & 0xFFFF;
     }
 
-    return (temp >> 16) & 0xFFFF;
+    return temp;
 }
 
 static inline uint8_t mipsdsp_sat8_reduce_precision(uint16_t a,
diff --git a/tests/tcg/mips/mips32-dsp/precrq_rs_ph_w.c b/tests/tcg/mips/mips32-dsp/precrq_rs_ph_w.c
index 3535b37..da6845b 100644
--- a/tests/tcg/mips/mips32-dsp/precrq_rs_ph_w.c
+++ b/tests/tcg/mips/mips32-dsp/precrq_rs_ph_w.c
@@ -12,18 +12,34 @@ int main()
     result = 0x12348765;
 
     __asm
-        ("precrq_rs.ph.w %0, %1, %2\n\t"
+        ("wrdsp $0\n\t"
+         "precrq_rs.ph.w %0, %1, %2\n\t"
          : "=r"(rd)
          : "r"(rs), "r"(rt)
         );
     assert(result == rd);
 
-    rs = 0x7fffC678;
+    rs = 0x7FFFC678;
     rt = 0x865432A0;
-    result = 0x7fff8654;
+    result = 0x7FFF8654;
 
     __asm
-        ("precrq_rs.ph.w %0, %2, %3\n\t"
+        ("wrdsp $0\n\t"
+         "precrq_rs.ph.w %0, %2, %3\n\t"
+         "rddsp %1\n\t"
+         : "=r"(rd), "=r"(dsp)
+         : "r"(rs), "r"(rt)
+        );
+    assert(((dsp >> 22) & 0x01) == 1);
+    assert(result == rd);
+
+    rs = 0xBEEFFEED;
+    rt = 0x7FFF8000;
+    result = 0xBEF07FFF;
+
+    __asm
+        ("wrdsp $0\n\t"
+         "precrq_rs.ph.w %0, %2, %3\n\t"
          "rddsp %1\n\t"
          : "=r"(rd), "=r"(dsp)
          : "r"(rs), "r"(rt)
commit 05b3274b6bedb68ff78b76c642e17e97f3181c2f
Author: James Hogan <james.hogan at imgtec.com>
Date:   Thu Jun 27 08:35:27 2013 +0100

    hw/mips: align initrd to 64KB to avoid kernel error
    
    The Linux kernel can be configured to use 64KB pages, but it also
    requires initrd to be page aligned. Therefore, to be safe, align the
    initrd to 64KB using a new INITRD_PAGE_MASK rather than
    TARGET_PAGE_MASK.
    
    Signed-off-by: James Hogan <james.hogan at imgtec.com>
    Signed-off-by: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index a7e9dcf..9901441 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -126,7 +126,7 @@ static int64_t load_kernel (CPUMIPSState *env)
     if (loaderparams.initrd_filename) {
         initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
-            initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
+            initrd_offset = (kernel_high + ~INITRD_PAGE_MASK) & INITRD_PAGE_MASK;
             if (initrd_offset + initrd_size > ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 28c351d..2dc66f7 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -792,7 +792,7 @@ static int64_t load_kernel (void)
     if (loaderparams.initrd_filename) {
         initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
-            initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
+            initrd_offset = (kernel_high + ~INITRD_PAGE_MASK) & INITRD_PAGE_MASK;
             if (initrd_offset + initrd_size > ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
diff --git a/hw/mips/mips_mipssim.c b/hw/mips/mips_mipssim.c
index e8802c1..fea1a15 100644
--- a/hw/mips/mips_mipssim.c
+++ b/hw/mips/mips_mipssim.c
@@ -83,7 +83,7 @@ static int64_t load_kernel(void)
     if (loaderparams.initrd_filename) {
         initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
-            initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
+            initrd_offset = (kernel_high + ~INITRD_PAGE_MASK) & INITRD_PAGE_MASK;
             if (initrd_offset + initrd_size > loaderparams.ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index 4bc2e3f..7af08b8 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -102,7 +102,7 @@ static int64_t load_kernel(void)
     if (loaderparams.initrd_filename) {
         initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
-            initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
+            initrd_offset = (kernel_high + ~INITRD_PAGE_MASK) & INITRD_PAGE_MASK;
             if (initrd_offset + initrd_size > ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
diff --git a/include/hw/mips/mips.h b/include/hw/mips/mips.h
index 291e85f..2a7a9c9 100644
--- a/include/hw/mips/mips.h
+++ b/include/hw/mips/mips.h
@@ -2,6 +2,9 @@
 #define HW_MIPS_H
 /* Definitions for mips board emulation.  */
 
+/* Kernels can be configured with 64KB pages */
+#define INITRD_PAGE_MASK (~((1 << 16) - 1))
+
 #include "exec/memory.h"
 
 /* gt64xxx.c */
commit ea0a4f34418c9f2cad9722bb27acd6349148fac0
Author: Paul Burton <paul.burton at imgtec.com>
Date:   Fri Jun 14 08:30:48 2013 +0100

    pflash_cfi01: duplicate status byte from bits 23:16 for 32bit reads
    
    The firmware commonly used with MIPS Malta boards (YAMON) reads the
    status of the pflash with a 32bit memory access. On real hardware
    this results in the status byte being mirrored in the upper 16 bits
    of the read value. For example if the status byte is represented by
    SS then the hardware reads 0x00SS00SS. The YAMON firmware compares the
    status against 32bit values expecting the mirrored value and fails
    without it.
    
    Signed-off-by: Paul Burton <paul.burton at imgtec.com>
    Signed-off-by: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 2bcd731..2973859 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -192,6 +192,9 @@ static uint32_t pflash_read (pflash_t *pfl, hwaddr offset,
     case 0xe8: /* Write block */
         /* Status register read */
         ret = pfl->status;
+        if (width > 2) {
+            ret |= pfl->status << 16;
+        }
         DPRINTF("%s: status %x\n", __func__, ret);
         break;
     case 0x90:
commit 35c648078aa493c3b976840eb7cf2e53ab5b7a2d
Author: Paul Burton <paul.burton at imgtec.com>
Date:   Fri Jun 14 08:30:47 2013 +0100

    mips_malta: generate SMBUS EEPROM data
    
    The malta contains 2 EEPROMs, one containing SPD data for the SDRAM and
    another containing board information such as serial number and MAC
    address. These are both exposed via the PIIX4 SMBUS. Generating this
    data and providing it to smbus_eeprom_init will allow YAMON to read a
    serial number for the board and prevent it from warning that the EEPROM
    data is invalid.
    
    We already have the contents of the SPD EEPROM which are exposed via
    FPGA I2C accesses, this is provided as part of the SMBUS EEPROM data
    too for consistency.
    
    Signed-off-by: Paul Burton <paul.burton at imgtec.com>
    Signed-off-by: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index a740f61..28c351d 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -149,7 +149,7 @@ struct _eeprom24c0x_t {
 
 typedef struct _eeprom24c0x_t eeprom24c0x_t;
 
-static eeprom24c0x_t eeprom = {
+static eeprom24c0x_t spd_eeprom = {
     .contents = {
         /* 00000000: */ 0x80,0x08,0xFF,0x0D,0x0A,0xFF,0x40,0x00,
         /* 00000008: */ 0x01,0x75,0x54,0x00,0x82,0x08,0x00,0x01,
@@ -170,10 +170,10 @@ static eeprom24c0x_t eeprom = {
     },
 };
 
-static void eeprom_generate(eeprom24c0x_t *eeprom, ram_addr_t ram_size)
+static void generate_eeprom_spd(uint8_t *eeprom, ram_addr_t ram_size)
 {
     enum { SDR = 0x4, DDR2 = 0x8 } type;
-    uint8_t *spd = eeprom->contents;
+    uint8_t *spd = spd_eeprom.contents;
     uint8_t nbanks = 0;
     uint16_t density = 0;
     int i;
@@ -218,71 +218,109 @@ static void eeprom_generate(eeprom24c0x_t *eeprom, ram_addr_t ram_size)
     for (i = 0; i < 63; i++) {
         spd[63] += spd[i];
     }
+
+    /* copy for SMBUS */
+    memcpy(eeprom, spd, sizeof(spd_eeprom.contents));
+}
+
+static void generate_eeprom_serial(uint8_t *eeprom)
+{
+    int i, pos = 0;
+    uint8_t mac[6] = { 0x00 };
+    uint8_t sn[5] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
+
+    /* version */
+    eeprom[pos++] = 0x01;
+
+    /* count */
+    eeprom[pos++] = 0x02;
+
+    /* MAC address */
+    eeprom[pos++] = 0x01; /* MAC */
+    eeprom[pos++] = 0x06; /* length */
+    memcpy(&eeprom[pos], mac, sizeof(mac));
+    pos += sizeof(mac);
+
+    /* serial number */
+    eeprom[pos++] = 0x02; /* serial */
+    eeprom[pos++] = 0x05; /* length */
+    memcpy(&eeprom[pos], sn, sizeof(sn));
+    pos += sizeof(sn);
+
+    /* checksum */
+    eeprom[pos] = 0;
+    for (i = 0; i < pos; i++) {
+        eeprom[pos] += eeprom[i];
+    }
 }
 
-static uint8_t eeprom24c0x_read(void)
+static uint8_t eeprom24c0x_read(eeprom24c0x_t *eeprom)
 {
     logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
-        eeprom.tick, eeprom.scl, eeprom.sda, eeprom.data);
-    return eeprom.sda;
+        eeprom->tick, eeprom->scl, eeprom->sda, eeprom->data);
+    return eeprom->sda;
 }
 
-static void eeprom24c0x_write(int scl, int sda)
+static void eeprom24c0x_write(eeprom24c0x_t *eeprom, int scl, int sda)
 {
-    if (eeprom.scl && scl && (eeprom.sda != sda)) {
+    if (eeprom->scl && scl && (eeprom->sda != sda)) {
         logout("%u: scl = %u->%u, sda = %u->%u i2c %s\n",
-                eeprom.tick, eeprom.scl, scl, eeprom.sda, sda, sda ? "stop" : "start");
+                eeprom->tick, eeprom->scl, scl, eeprom->sda, sda,
+                sda ? "stop" : "start");
         if (!sda) {
-            eeprom.tick = 1;
-            eeprom.command = 0;
+            eeprom->tick = 1;
+            eeprom->command = 0;
         }
-    } else if (eeprom.tick == 0 && !eeprom.ack) {
+    } else if (eeprom->tick == 0 && !eeprom->ack) {
         /* Waiting for start. */
         logout("%u: scl = %u->%u, sda = %u->%u wait for i2c start\n",
-                eeprom.tick, eeprom.scl, scl, eeprom.sda, sda);
-    } else if (!eeprom.scl && scl) {
+                eeprom->tick, eeprom->scl, scl, eeprom->sda, sda);
+    } else if (!eeprom->scl && scl) {
         logout("%u: scl = %u->%u, sda = %u->%u trigger bit\n",
-                eeprom.tick, eeprom.scl, scl, eeprom.sda, sda);
-        if (eeprom.ack) {
+                eeprom->tick, eeprom->scl, scl, eeprom->sda, sda);
+        if (eeprom->ack) {
             logout("\ti2c ack bit = 0\n");
             sda = 0;
-            eeprom.ack = 0;
-        } else if (eeprom.sda == sda) {
+            eeprom->ack = 0;
+        } else if (eeprom->sda == sda) {
             uint8_t bit = (sda != 0);
             logout("\ti2c bit = %d\n", bit);
-            if (eeprom.tick < 9) {
-                eeprom.command <<= 1;
-                eeprom.command += bit;
-                eeprom.tick++;
-                if (eeprom.tick == 9) {
-                    logout("\tcommand 0x%04x, %s\n", eeprom.command, bit ? "read" : "write");
-                    eeprom.ack = 1;
+            if (eeprom->tick < 9) {
+                eeprom->command <<= 1;
+                eeprom->command += bit;
+                eeprom->tick++;
+                if (eeprom->tick == 9) {
+                    logout("\tcommand 0x%04x, %s\n", eeprom->command,
+                           bit ? "read" : "write");
+                    eeprom->ack = 1;
                 }
-            } else if (eeprom.tick < 17) {
-                if (eeprom.command & 1) {
-                    sda = ((eeprom.data & 0x80) != 0);
+            } else if (eeprom->tick < 17) {
+                if (eeprom->command & 1) {
+                    sda = ((eeprom->data & 0x80) != 0);
                 }
-                eeprom.address <<= 1;
-                eeprom.address += bit;
-                eeprom.tick++;
-                eeprom.data <<= 1;
-                if (eeprom.tick == 17) {
-                    eeprom.data = eeprom.contents[eeprom.address];
-                    logout("\taddress 0x%04x, data 0x%02x\n", eeprom.address, eeprom.data);
-                    eeprom.ack = 1;
-                    eeprom.tick = 0;
+                eeprom->address <<= 1;
+                eeprom->address += bit;
+                eeprom->tick++;
+                eeprom->data <<= 1;
+                if (eeprom->tick == 17) {
+                    eeprom->data = eeprom->contents[eeprom->address];
+                    logout("\taddress 0x%04x, data 0x%02x\n",
+                           eeprom->address, eeprom->data);
+                    eeprom->ack = 1;
+                    eeprom->tick = 0;
                 }
-            } else if (eeprom.tick >= 17) {
+            } else if (eeprom->tick >= 17) {
                 sda = 0;
             }
         } else {
             logout("\tsda changed with raising scl\n");
         }
     } else {
-        logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom.tick, eeprom.scl, scl, eeprom.sda, sda);
+        logout("%u: scl = %u->%u, sda = %u->%u\n", eeprom->tick, eeprom->scl,
+               scl, eeprom->sda, sda);
     }
-    eeprom.scl = scl;
-    eeprom.sda = sda;
+    eeprom->scl = scl;
+    eeprom->sda = sda;
 }
 
 static uint64_t malta_fpga_read(void *opaque, hwaddr addr,
@@ -345,7 +383,7 @@ static uint64_t malta_fpga_read(void *opaque, hwaddr addr,
 
     /* I2CINP Register */
     case 0x00b00:
-        val = ((s->i2cin & ~1) | eeprom24c0x_read());
+        val = ((s->i2cin & ~1) | eeprom24c0x_read(&spd_eeprom));
         break;
 
     /* I2COE Register */
@@ -441,7 +479,7 @@ static void malta_fpga_write(void *opaque, hwaddr addr,
 
     /* I2COUT Register */
     case 0x00b10:
-        eeprom24c0x_write(val & 0x02, val & 0x01);
+        eeprom24c0x_write(&spd_eeprom, val & 0x02, val & 0x01);
         s->i2cout = val;
         break;
 
@@ -846,6 +884,8 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *bios, *bios_copy = g_new(MemoryRegion, 1);
     target_long bios_size = FLASH_SIZE;
+    const size_t smbus_eeprom_size = 8 * 256;
+    uint8_t *smbus_eeprom_buf = g_malloc0(smbus_eeprom_size);
     int64_t kernel_entry;
     PCIBus *pci_bus;
     ISABus *isa_bus;
@@ -914,7 +954,8 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     memory_region_add_subregion(system_memory, 0, ram);
 
     /* generate SPD EEPROM data */
-    eeprom_generate(&eeprom, ram_size);
+    generate_eeprom_spd(&smbus_eeprom_buf[0 * 256], ram_size);
+    generate_eeprom_serial(&smbus_eeprom_buf[6 * 256]);
 
 #ifdef TARGET_WORDS_BIGENDIAN
     be = 1;
@@ -1035,8 +1076,8 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     pci_create_simple(pci_bus, piix4_devfn + 2, "piix4-usb-uhci");
     smbus = piix4_pm_init(pci_bus, piix4_devfn + 3, 0x1100,
                           isa_get_irq(NULL, 9), NULL, 0, NULL);
-    /* TODO: Populate SPD eeprom data.  */
-    smbus_eeprom_init(smbus, 8, NULL, 0);
+    smbus_eeprom_init(smbus, 8, smbus_eeprom_buf, smbus_eeprom_size);
+    g_free(smbus_eeprom_buf);
     pit = pit_init(isa_bus, 0x40, 0, NULL);
     cpu_exit_irq = qemu_allocate_irqs(cpu_request_exit, NULL, 1);
     DMA_init(0, cpu_exit_irq);
commit 1817f56a834f55311af20d1c004b259c16fb1515
Author: Paul Burton <paul.burton at imgtec.com>
Date:   Fri Jun 14 08:30:46 2013 +0100

    mips_malta: cap BIOS endian swap length at 0x3e0000 bytes
    
    This preserves the final sector of the pflash which is used by YAMON to
    hold environment variables. If the endianness of the environment data
    is swapped then YAMON will fail to load environment variables from
    pflash.
    
    Signed-off-by: Paul Burton <paul.burton at imgtec.com>
    Signed-off-by: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index e06e19d..a740f61 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -978,7 +978,7 @@ void mips_malta_init(QEMUMachineInitArgs *args)
             if (!addr) {
                 addr = memory_region_get_ram_ptr(bios);
             }
-            end = (void *)addr + bios_size;
+            end = (void *)addr + MIN(bios_size, 0x3e0000);
             while (addr < end) {
                 bswap32s(addr);
                 addr++;
commit 02bccc7796fec8b39dca9affc8bff8edebe0a867
Author: Paul Burton <paul.burton at imgtec.com>
Date:   Fri Jun 14 08:30:45 2013 +0100

    mips_malta: generate SPD EEPROM data at runtime
    
    The SPD EEPROM specifies the amount of memory present in the system and
    thus its correct contents can only be known at runtime. Calculating
    parts of the data on init allows the data to accurately reflect the
    amount of target memory present and allow YAMON to boot with an
    arbitrary amount of SDRAM.
    
    Where possible the SPD data will favor indicating 2 banks of SDRAM
    rather than 1. For example the default 128MB of target memory will be
    represented as 2x64MB banks rather than 1x128MB bank. This allows
    versions of MIPS BIOS code (such as YAMON 2.22 and older) to boot
    despite a bug preventing them from handling a single bank of SDRAM with
    the Galileo GT64120 system controller emulated by QEMU.
    
    Signed-off-by: Paul Burton <paul.burton at imgtec.com>
    Signed-off-by: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 2edc8e1..e06e19d 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -47,6 +47,7 @@
 #include "sysemu/blockdev.h"
 #include "exec/address-spaces.h"
 #include "hw/sysbus.h"             /* SysBusDevice */
+#include "qemu/host-utils.h"
 
 //#define DEBUG_BOARD_INIT
 
@@ -150,10 +151,10 @@ typedef struct _eeprom24c0x_t eeprom24c0x_t;
 
 static eeprom24c0x_t eeprom = {
     .contents = {
-        /* 00000000: */ 0x80,0x08,0x04,0x0D,0x0A,0x01,0x40,0x00,
+        /* 00000000: */ 0x80,0x08,0xFF,0x0D,0x0A,0xFF,0x40,0x00,
         /* 00000008: */ 0x01,0x75,0x54,0x00,0x82,0x08,0x00,0x01,
-        /* 00000010: */ 0x8F,0x04,0x02,0x01,0x01,0x00,0x0E,0x00,
-        /* 00000018: */ 0x00,0x00,0x00,0x14,0x0F,0x14,0x2D,0x40,
+        /* 00000010: */ 0x8F,0x04,0x02,0x01,0x01,0x00,0x00,0x00,
+        /* 00000018: */ 0x00,0x00,0x00,0x14,0x0F,0x14,0x2D,0xFF,
         /* 00000020: */ 0x15,0x08,0x15,0x08,0x00,0x00,0x00,0x00,
         /* 00000028: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
         /* 00000030: */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
@@ -169,6 +170,56 @@ static eeprom24c0x_t eeprom = {
     },
 };
 
+static void eeprom_generate(eeprom24c0x_t *eeprom, ram_addr_t ram_size)
+{
+    enum { SDR = 0x4, DDR2 = 0x8 } type;
+    uint8_t *spd = eeprom->contents;
+    uint8_t nbanks = 0;
+    uint16_t density = 0;
+    int i;
+
+    /* work in terms of MB */
+    ram_size >>= 20;
+
+    while ((ram_size >= 4) && (nbanks <= 2)) {
+        int sz_log2 = MIN(31 - clz32(ram_size), 14);
+        nbanks++;
+        density |= 1 << (sz_log2 - 2);
+        ram_size -= 1 << sz_log2;
+    }
+
+    /* split to 2 banks if possible */
+    if ((nbanks == 1) && (density > 1)) {
+        nbanks++;
+        density >>= 1;
+    }
+
+    if (density & 0xff00) {
+        density = (density & 0xe0) | ((density >> 8) & 0x1f);
+        type = DDR2;
+    } else if (!(density & 0x1f)) {
+        type = DDR2;
+    } else {
+        type = SDR;
+    }
+
+    if (ram_size) {
+        fprintf(stderr, "Warning: SPD cannot represent final %dMB"
+                " of SDRAM\n", (int)ram_size);
+    }
+
+    /* fill in SPD memory information */
+    spd[2] = type;
+    spd[5] = nbanks;
+    spd[31] = density;
+
+    /* checksum */
+    spd[63] = 0;
+    for (i = 0; i < 63; i++) {
+        spd[63] += spd[i];
+    }
+}
+
 static uint8_t eeprom24c0x_read(void)
 {
     logout("%u: scl = %u, sda = %u, data = 0x%02x\n",
@@ -862,6 +913,9 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(system_memory, 0, ram);
 
+    /* generate SPD EEPROM data */
+    eeprom_generate(&eeprom, ram_size);
+
 #ifdef TARGET_WORDS_BIGENDIAN
     be = 1;
 #else
commit a427338b222b43197c2776cbc996936df0302f51
Author: Paul Burton <paul.burton at imgtec.com>
Date:   Fri Jun 14 08:30:44 2013 +0100

    mips_malta: correct reading MIPS revision at 0x1fc00010
    
    Rather than modifying the BIOS code at its original location, copy it
    for the 0x1fc00000 region & modify the copy. This means the original
    ROM code is correctly readable at 0x1e000010 whilst the MIPS revision
    is readable at 0x1fc00010.
    
    Additionally the code previously operated on target memory which would
    later be overwritten by the BIOS image upon CPU reset if the -bios
    argument was used to specify the BIOS image. This led to the written
    MIPS revision being lost. Copying using rom_copy when -bios is used
    fixes this issue.
    
    Signed-off-by: Paul Burton <paul.burton at imgtec.com>
    Signed-off-by: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 05d9bf5..2edc8e1 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -793,7 +793,7 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     pflash_t *fl;
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *ram = g_new(MemoryRegion, 1);
-    MemoryRegion *bios, *bios_alias = g_new(MemoryRegion, 1);
+    MemoryRegion *bios, *bios_copy = g_new(MemoryRegion, 1);
     target_long bios_size = FLASH_SIZE;
     int64_t kernel_entry;
     PCIBus *pci_bus;
@@ -933,14 +933,23 @@ void mips_malta_init(QEMUMachineInitArgs *args)
 #endif
     }
 
-    /* Map the BIOS at a 2nd physical location, as on the real board. */
-    memory_region_init_alias(bios_alias, NULL, "bios.1fc", bios, 0, BIOS_SIZE);
-    memory_region_add_subregion(system_memory, RESET_ADDRESS, bios_alias);
+    /*
+     * Map the BIOS at a 2nd physical location, as on the real board.
+     * Copy it so that we can patch in the MIPS revision, which cannot be
+     * handled by an overlapping region as the resulting ROM code subpage
+     * regions are not executable.
+     */
+    memory_region_init_ram(bios_copy, NULL, "bios.1fc", BIOS_SIZE);
+    if (!rom_copy(memory_region_get_ram_ptr(bios_copy),
+                  FLASH_ADDRESS, bios_size)) {
+        memcpy(memory_region_get_ram_ptr(bios_copy),
+               memory_region_get_ram_ptr(bios), bios_size);
+    }
+    memory_region_set_readonly(bios_copy, true);
+    memory_region_add_subregion(system_memory, RESET_ADDRESS, bios_copy);
 
-    /* Board ID = 0x420 (Malta Board with CoreLV)
-       XXX: theoretically 0x1e000010 should map to flash and 0x1fc00010 should
-       map to the board ID. */
-    stl_p(memory_region_get_ram_ptr(bios) + 0x10, 0x00000420);
+    /* Board ID = 0x420 (Malta Board with CoreLV) */
+    stl_p(memory_region_get_ram_ptr(bios_copy) + 0x10, 0x00000420);
 
     /* Init internal devices */
     cpu_mips_irq_init_cpu(env);
commit a2b8813d62fa5a35adc1a7bf58de5b2ffb754f5d
Author: Paul Burton <paul.burton at imgtec.com>
Date:   Fri Jun 14 08:30:43 2013 +0100

    mips_malta: fix BIOS endianness swapping
    
    If the target is little endian (mipsel) then the BIOS image endianness
    is swapped so that the big endian BIOS binaries commonly produced can be
    loaded correctly.
    
    When using the -bios argument the BIOS is loaded using
    load_image_targphys, however this doesn't perform the load to target
    memory immediately. Instead it loads the BIOS file into a struct Rom
    which will later be written to target memory upon reset. However the
    endianness conversion was being performed before this, on init, and
    operating on the target memory which at this point is blank & will later
    be overwritten by the (big endian) BIOS image. Correct this by operating
    on the data referenced by struct Rom rather than the target memory when
    the -bios argument is used.
    
    Signed-off-by: Paul Burton <paul.burton at imgtec.com>
    Signed-off-by: Leon Alrae <leon.alrae at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index e932fdc..05d9bf5 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -920,8 +920,11 @@ void mips_malta_init(QEMUMachineInitArgs *args)
            a neat trick which allows bi-endian firmware. */
 #ifndef TARGET_WORDS_BIGENDIAN
         {
-            uint32_t *addr = memory_region_get_ram_ptr(bios);
-            uint32_t *end = addr + bios_size;
+            uint32_t *end, *addr = rom_ptr(FLASH_ADDRESS);
+            if (!addr) {
+                addr = memory_region_get_ram_ptr(bios);
+            }
+            end = (void *)addr + bios_size;
             while (addr < end) {
                 bswap32s(addr);
                 addr++;
commit cba5cb67becd66f8eae4177c4f95756f3f9bb77a
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 22:19:54 2013 +0200

    mips_malta: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index dad58c0..e932fdc 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -79,8 +79,12 @@ typedef struct {
     SerialState *uart;
 } MaltaFPGAState;
 
+#define TYPE_MIPS_MALTA "mips-malta"
+#define MIPS_MALTA(obj) OBJECT_CHECK(MaltaState, (obj), TYPE_MIPS_MALTA)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq *i8259;
 } MaltaState;
 
@@ -808,8 +812,8 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     int fl_sectors = bios_size >> 16;
     int be;
 
-    DeviceState *dev = qdev_create(NULL, "mips-malta");
-    MaltaState *s = DO_UPCAST(MaltaState, busdev.qdev, dev);
+    DeviceState *dev = qdev_create(NULL, TYPE_MIPS_MALTA);
+    MaltaState *s = MIPS_MALTA(dev);
 
     qdev_init_nofail(dev);
 
@@ -1004,7 +1008,7 @@ static void mips_malta_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mips_malta_device = {
-    .name          = "mips-malta",
+    .name          = TYPE_MIPS_MALTA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MaltaState),
     .class_init    = mips_malta_class_init,
commit 240ce26a0533a6e5ee472789fbfbd9f7f939197e
Author: James Hogan <james.hogan at imgtec.com>
Date:   Mon Jun 24 17:45:39 2013 +0100

    target-mips: fix branch in likely delay slot tcg assert
    
    When a branch delay slot contains another branch instruction, the code
    generated raises an exception, however since is_branch==1,
    handle_delay_slot() doesn't get called immediately. This means
    ctx->bstate isn't set to BS_BRANCH, and the decoder continues decoding
    until a non-branch instruction is found.
    
    If the first branch was a branch likely instruction then each
    instruction after it generates code for the unlikely case, to go to the
    next tb starting after the delay slot. This results in multiple goto_tb
    tcg ops being generated with the same exit number. When debug is enabled
    this hits:
    
    tcg-op.h:2589: tcg_gen_goto_tb: Assertion `(tcg_ctx.goto_tb_issue_mask & (1 << idx)) == 0' failed.
    
    This is fixed by removing is_branch entirely, and calling
    handle_delay_slot() if (ctx.hflags & MIPS_HFLAG_BMASK) was set prior to
    the current instruction being decoded. This still prevents
    handle_delay_slot() being called immediately after a branch but allows
    it to still be called after a branch within a delay slot.
    
    Signed-off-by: James Hogan <james.hogan at imgtec.com>
    Signed-off-by: Yongbok Kim <yongbok.kim at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-mips/translate.c b/target-mips/translate.c
index 877f8df..c1d57a7 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -9571,8 +9571,7 @@ static void decode_i64_mips16 (DisasContext *ctx,
 }
 #endif
 
-static int decode_extended_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
-                                       int *is_branch)
+static int decode_extended_mips16_opc (CPUMIPSState *env, DisasContext *ctx)
 {
     int extend = cpu_lduw_code(env, ctx->pc + 2);
     int op, rx, ry, funct, sa;
@@ -9763,8 +9762,7 @@ static int decode_extended_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
     return 4;
 }
 
-static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
-                              int *is_branch)
+static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx)
 {
     int rx, ry;
     int sa;
@@ -9807,7 +9805,6 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
         op = ((ctx->opcode >> 10) & 0x1) ? OPC_JALXS : OPC_JALS;
         gen_compute_branch(ctx, op, 4, rx, ry, offset);
         n_bytes = 4;
-        *is_branch = 1;
         break;
     case M16_OPC_BEQZ:
         gen_compute_branch(ctx, OPC_BEQ, 2, rx, 0, ((int8_t)ctx->opcode) << 1);
@@ -10046,9 +10043,6 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
                 }
 
                 gen_compute_branch(ctx, op, 2, ra ? 31 : rx, 31, 0);
-                if (!nd) {
-                    *is_branch = 1;
-                }
             }
             break;
         case RR_SDBBP:
@@ -10193,7 +10187,7 @@ static int decode_mips16_opc (CPUMIPSState *env, DisasContext *ctx,
         }
         break;
     case M16_OPC_EXTEND:
-        decode_extended_mips16_opc(env, ctx, is_branch);
+        decode_extended_mips16_opc(env, ctx);
         n_bytes = 4;
         break;
 #if defined(TARGET_MIPS64)
@@ -10802,7 +10796,7 @@ static void gen_ldst_multiple (DisasContext *ctx, uint32_t opc, int reglist,
 }
 
 
-static void gen_pool16c_insn(DisasContext *ctx, int *is_branch)
+static void gen_pool16c_insn(DisasContext *ctx)
 {
     int rd = mmreg((ctx->opcode >> 3) & 0x7);
     int rs = mmreg(ctx->opcode & 0x7);
@@ -10864,7 +10858,6 @@ static void gen_pool16c_insn(DisasContext *ctx, int *is_branch)
 
             gen_compute_branch(ctx, OPC_JR, 2, reg, 0, 0);
         }
-        *is_branch = 1;
         break;
     case JRC16 + 0:
     case JRC16 + 1:
@@ -10889,7 +10882,6 @@ static void gen_pool16c_insn(DisasContext *ctx, int *is_branch)
 
             gen_compute_branch(ctx, opc, 2, reg, 31, 0);
         }
-        *is_branch = 1;
         break;
     case MFHI16 + 0:
     case MFHI16 + 1:
@@ -11020,8 +11012,7 @@ static void gen_ldst_pair (DisasContext *ctx, uint32_t opc, int rd,
     tcg_temp_free(t1);
 }
 
-static void gen_pool32axf (CPUMIPSState *env, DisasContext *ctx, int rt, int rs,
-                           int *is_branch)
+static void gen_pool32axf (CPUMIPSState *env, DisasContext *ctx, int rt, int rs)
 {
     int extension = (ctx->opcode >> 6) & 0x3f;
     int minor = (ctx->opcode >> 12) & 0xf;
@@ -11147,12 +11138,10 @@ static void gen_pool32axf (CPUMIPSState *env, DisasContext *ctx, int rt, int rs,
         case JALR:
         case JALR_HB:
             gen_compute_branch (ctx, OPC_JALR, 4, rs, rt, 0);
-            *is_branch = 1;
             break;
         case JALRS:
         case JALRS_HB:
             gen_compute_branch (ctx, OPC_JALRS, 4, rs, rt, 0);
-            *is_branch = 1;
             break;
         default:
             goto pool32axf_invalid;
@@ -11551,7 +11540,7 @@ static void gen_pool32fxf(DisasContext *ctx, int rt, int rs)
 }
 
 static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
-                                    uint16_t insn_hw1, int *is_branch)
+                                    uint16_t insn_hw1)
 {
     int32_t offset;
     uint16_t insn;
@@ -11685,7 +11674,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
             gen_bitops(ctx, OPC_EXT, rt, rs, rr, rd);
             return;
         case POOL32AXF:
-            gen_pool32axf(env, ctx, rt, rs, is_branch);
+            gen_pool32axf(env, ctx, rt, rs);
             break;
         case 0x07:
             generate_exception(ctx, EXCP_BREAK);
@@ -12048,7 +12037,6 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
             mips32_op = OPC_BGTZ;
         do_branch:
             gen_compute_branch(ctx, mips32_op, 4, rs, -1, imm << 1);
-            *is_branch = 1;
             break;
 
             /* Traps */
@@ -12109,7 +12097,6 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
         do_cp1branch:
             gen_compute_branch1(ctx, mips32_op,
                                 (ctx->opcode >> 18) & 0x7, imm << 1);
-            *is_branch = 1;
             break;
         case BPOSGE64:
         case BPOSGE32:
@@ -12216,30 +12203,24 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
     case JALX32:
         offset = (int32_t)(ctx->opcode & 0x3FFFFFF) << 2;
         gen_compute_branch(ctx, OPC_JALX, 4, rt, rs, offset);
-        *is_branch = 1;
         break;
     case JALS32:
         offset = (int32_t)(ctx->opcode & 0x3FFFFFF) << 1;
         gen_compute_branch(ctx, OPC_JALS, 4, rt, rs, offset);
-        *is_branch = 1;
         break;
     case BEQ32:
         gen_compute_branch(ctx, OPC_BEQ, 4, rt, rs, imm << 1);
-        *is_branch = 1;
         break;
     case BNE32:
         gen_compute_branch(ctx, OPC_BNE, 4, rt, rs, imm << 1);
-        *is_branch = 1;
         break;
     case J32:
         gen_compute_branch(ctx, OPC_J, 4, rt, rs,
                            (int32_t)(ctx->opcode & 0x3FFFFFF) << 1);
-        *is_branch = 1;
         break;
     case JAL32:
         gen_compute_branch(ctx, OPC_JAL, 4, rt, rs,
                            (int32_t)(ctx->opcode & 0x3FFFFFF) << 1);
-        *is_branch = 1;
         break;
         /* Floating point (COP1) */
     case LWC132:
@@ -12309,7 +12290,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
     }
 }
 
-static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx)
 {
     uint32_t op;
 
@@ -12442,7 +12423,7 @@ static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx, int *is_b
         }
         break;
     case POOL16C:
-        gen_pool16c_insn(ctx, is_branch);
+        gen_pool16c_insn(ctx);
         break;
     case LWGP16:
         {
@@ -12582,14 +12563,12 @@ static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx, int *is_b
     case B16:
         gen_compute_branch(ctx, OPC_BEQ, 2, 0, 0,
                            SIMM(ctx->opcode, 0, 10) << 1);
-        *is_branch = 1;
         break;
     case BNEZ16:
     case BEQZ16:
         gen_compute_branch(ctx, op == BNEZ16 ? OPC_BNE : OPC_BEQ, 2,
                            mmreg(uMIPS_RD(ctx->opcode)),
                            0, SIMM(ctx->opcode, 0, 7) << 1);
-        *is_branch = 1;
         break;
     case LI16:
         {
@@ -12610,7 +12589,7 @@ static int decode_micromips_opc (CPUMIPSState *env, DisasContext *ctx, int *is_b
         generate_exception(ctx, EXCP_RI);
         break;
     default:
-        decode_micromips32_opc (env, ctx, op, is_branch);
+        decode_micromips32_opc (env, ctx, op);
         return 4;
     }
 
@@ -14346,7 +14325,7 @@ static void gen_mipsdsp_accinsn(DisasContext *ctx, uint32_t op1, uint32_t op2,
 
 /* End MIPSDSP functions. */
 
-static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
+static void decode_opc (CPUMIPSState *env, DisasContext *ctx)
 {
     int32_t offset;
     int rs, rt, rd, sa;
@@ -14460,7 +14439,6 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
             break;
         case OPC_JR ... OPC_JALR:
             gen_compute_branch(ctx, op1, 4, rs, rd, sa);
-            *is_branch = 1;
             break;
         case OPC_TGE ... OPC_TEQ: /* Traps */
         case OPC_TNE:
@@ -15227,7 +15205,6 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
         case OPC_BLTZ ... OPC_BGEZL: /* REGIMM branches */
         case OPC_BLTZAL ... OPC_BGEZALL:
             gen_compute_branch(ctx, op1, 4, rs, -1, imm << 2);
-            *is_branch = 1;
             break;
         case OPC_TGEI ... OPC_TEQI: /* REGIMM traps */
         case OPC_TNEI:
@@ -15243,7 +15220,6 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
 #endif
             check_dsp(ctx);
             gen_compute_branch(ctx, op1, 4, -1, -2, (int32_t)imm << 2);
-            *is_branch = 1;
             break;
         default:            /* Invalid */
             MIPS_INVAL("regimm");
@@ -15355,12 +15331,10 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
     case OPC_J ... OPC_JAL: /* Jump */
          offset = (int32_t)(ctx->opcode & 0x3FFFFFF) << 2;
          gen_compute_branch(ctx, op, 4, rs, rt, offset);
-         *is_branch = 1;
          break;
     case OPC_BEQ ... OPC_BGTZ: /* Branch */
     case OPC_BEQL ... OPC_BGTZL:
          gen_compute_branch(ctx, op, 4, rs, rt, imm << 2);
-         *is_branch = 1;
          break;
     case OPC_LB ... OPC_LWR: /* Load and stores */
     case OPC_LL:
@@ -15420,7 +15394,6 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
             case OPC_BC1:
                 gen_compute_branch1(ctx, MASK_BC1(ctx->opcode),
                                     (rt >> 2) & 0x7, imm << 2);
-                *is_branch = 1;
                 break;
             case OPC_S_FMT:
             case OPC_D_FMT:
@@ -15527,7 +15500,6 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
         check_insn(ctx, ASE_MIPS16 | ASE_MICROMIPS);
         offset = (int32_t)(ctx->opcode & 0x3FFFFFF) << 2;
         gen_compute_branch(ctx, op, 4, rs, rt, offset);
-        *is_branch = 1;
         break;
     case OPC_MDMX:
         check_insn(ctx, ASE_MDMX);
@@ -15553,7 +15525,7 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
     int num_insns;
     int max_insns;
     int insn_bytes;
-    int is_branch;
+    int is_delay;
 
     if (search_pc)
         qemu_log("search pc %d\n", search_pc);
@@ -15611,23 +15583,23 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
         if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO))
             gen_io_start();
 
-        is_branch = 0;
+        is_delay = ctx.hflags & MIPS_HFLAG_BMASK;
         if (!(ctx.hflags & MIPS_HFLAG_M16)) {
             ctx.opcode = cpu_ldl_code(env, ctx.pc);
             insn_bytes = 4;
-            decode_opc(env, &ctx, &is_branch);
+            decode_opc(env, &ctx);
         } else if (ctx.insn_flags & ASE_MICROMIPS) {
             ctx.opcode = cpu_lduw_code(env, ctx.pc);
-            insn_bytes = decode_micromips_opc(env, &ctx, &is_branch);
+            insn_bytes = decode_micromips_opc(env, &ctx);
         } else if (ctx.insn_flags & ASE_MIPS16) {
             ctx.opcode = cpu_lduw_code(env, ctx.pc);
-            insn_bytes = decode_mips16_opc(env, &ctx, &is_branch);
+            insn_bytes = decode_mips16_opc(env, &ctx);
         } else {
             generate_exception(&ctx, EXCP_RI);
             ctx.bstate = BS_STOP;
             break;
         }
-        if (!is_branch) {
+        if (is_delay) {
             handle_delay_slot(&ctx, insn_bytes);
         }
         ctx.pc += insn_bytes;
commit 4877866ee4fbd760c943577bb6d1eba489fb6c6e
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Thu May 23 19:37:53 2013 +0200

    target-mips: fix multiplication in mipsdsp_rndq15_mul_q15_q15
    
    Multiplication of Q15 fractional halfword vectors was incorrect in the
    previous implementation of mipsdsp_rndq15_mul_q15_q15. It failed to take
    element signs into account. This change fixes it, and it adds a test case
    for it.
    
    The change also removes unnecessary cast in the function
    mipsdsp_mul_q15_q15_overflowflag21().
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Reviewed-by: Richard Henderson  <rth at twiddle.net>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-mips/dsp_helper.c b/target-mips/dsp_helper.c
index 4116de9..c718a78 100644
--- a/target-mips/dsp_helper.c
+++ b/target-mips/dsp_helper.c
@@ -390,7 +390,7 @@ static inline int32_t mipsdsp_mul_q15_q15_overflowflag21(uint16_t a, uint16_t b,
         temp = 0x7FFFFFFF;
         set_DSPControl_overflow_flag(1, 21, env);
     } else {
-        temp = ((int32_t)(int16_t)a * (int32_t)(int16_t)b) << 1;
+        temp = ((int16_t)a * (int16_t)b) << 1;
     }
 
     return temp;
@@ -622,7 +622,7 @@ static inline int16_t mipsdsp_rndq15_mul_q15_q15(uint16_t a, uint16_t b,
         temp = 0x7FFF0000;
         set_DSPControl_overflow_flag(1, 21, env);
     } else {
-        temp = (a * b) << 1;
+        temp = ((int16_t)a * (int16_t)b) << 1;
         temp = temp + 0x00008000;
     }
 
diff --git a/tests/tcg/mips/mips32-dsp/mulq_rs_ph.c b/tests/tcg/mips/mips32-dsp/mulq_rs_ph.c
index c720603..370c2a8 100644
--- a/tests/tcg/mips/mips32-dsp/mulq_rs_ph.c
+++ b/tests/tcg/mips/mips32-dsp/mulq_rs_ph.c
@@ -12,7 +12,24 @@ int main()
     resultdsp = 1;
 
     __asm
-        ("mulq_rs.ph %0, %2, %3\n\t"
+        ("wrdsp $0\n\t"
+         "mulq_rs.ph %0, %2, %3\n\t"
+         "rddsp %1\n\t"
+         : "=r"(rd), "=r"(dsp)
+         : "r"(rs), "r"(rt)
+        );
+    dsp = (dsp >> 21) & 0x01;
+    assert(rd  == result);
+    assert(dsp == resultdsp);
+
+    rs = 0x80011234;
+    rt = 0x80024321;
+    result = 0x7FFD098C;
+    resultdsp = 0;
+
+    __asm
+        ("wrdsp $0\n\t"
+         "mulq_rs.ph %0, %2, %3\n\t"
          "rddsp %1\n\t"
          : "=r"(rd), "=r"(dsp)
          : "r"(rs), "r"(rt)
commit 6c86f405efd6532b58ad1b607cc9f11e856ef5ca
Author: Stefan Weil <sw at weilnetz.de>
Date:   Thu Jul 25 22:10:31 2013 +0200

    target-mips: Remove assignment to a variable which is never used
    
    This assignment causes a compiler warning for compilations with the compiler
    option -Wunused-but-set-variable (which is included with -Wextra).
    
    Removing it allows using -Wextra for QEMU code without suppressing too many
    extra warnings.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 5cf1c3f..b828375 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -1735,7 +1735,6 @@ target_ulong helper_evpe(CPUMIPSState *env)
 void helper_fork(target_ulong arg1, target_ulong arg2)
 {
     // arg1 = rt, arg2 = rs
-    arg1 = 0;
     // TODO: store to TC register
 }
 
commit dfc6f86567c58bc4dd02f4db098fc4c2221e85b5
Author: Stefan Weil <sw at weilnetz.de>
Date:   Thu Jul 25 18:21:28 2013 +0200

    misc: Use g_assert_not_reached for code which is expected to be unreachable
    
    The macro g_assert_not_reached is a better self documenting replacement
    for assert(0) or assert(false).
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/blockdev.c b/blockdev.c
index 4534864..7879e85 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1029,7 +1029,7 @@ static void abort_prepare(BlkTransactionState *common, Error **errp)
 
 static void abort_commit(BlkTransactionState *common)
 {
-    assert(false); /* this action never succeeds */
+    g_assert_not_reached(); /* this action never succeeds */
 }
 
 static const BdrvActionOps actions[] = {
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index b39ff08..0f3c58c 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -528,7 +528,7 @@ vmxnet3_setup_tx_offloads(VMXNET3State *s)
         break;
 
     default:
-        assert(false);
+        g_assert_not_reached();
         return false;
     }
 
@@ -575,7 +575,7 @@ vmxnet3_on_tx_done_update_stats(VMXNET3State *s, int qidx,
             stats->ucastBytesTxOK += tot_len;
             break;
         default:
-            assert(false);
+            g_assert_not_reached();
         }
 
         if (s->offload_mode == VMXNET3_OM_TSO) {
@@ -599,7 +599,7 @@ vmxnet3_on_tx_done_update_stats(VMXNET3State *s, int qidx,
         break;
 
     default:
-        assert(false);
+        g_assert_not_reached();
     }
 }
 
@@ -634,7 +634,7 @@ vmxnet3_on_rx_done_update_stats(VMXNET3State *s,
             stats->ucastBytesRxOK += tot_len;
             break;
         default:
-            assert(false);
+            g_assert_not_reached();
         }
 
         if (tot_len > s->mtu) {
@@ -643,7 +643,7 @@ vmxnet3_on_rx_done_update_stats(VMXNET3State *s,
         }
         break;
     default:
-        assert(false);
+        g_assert_not_reached();
     }
 }
 
@@ -1106,7 +1106,7 @@ vmxnet3_io_bar0_read(void *opaque, hwaddr addr, unsigned size)
 {
     if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_IMR,
                         VMXNET3_MAX_INTRS, VMXNET3_REG_ALIGN)) {
-        assert(false);
+        g_assert_not_reached();
     }
 
     VMW_CBPRN("BAR0 unknown read [%" PRIx64 "], size %d", addr, size);
@@ -1651,7 +1651,7 @@ vmxnet3_io_bar1_write(void *opaque,
     case VMXNET3_REG_ICR:
         VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
                   val, size);
-        assert(false);
+        g_assert_not_reached();
         break;
 
     /* Event Cause Register */
@@ -1801,7 +1801,7 @@ vmxnet3_rx_filter_may_indicate(VMXNET3State *s, const void *data,
         break;
 
     default:
-        assert(false);
+        g_assert_not_reached();
     }
 
     return true;
diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c
index fc01e4d..f7344c4 100644
--- a/hw/net/vmxnet_tx_pkt.c
+++ b/hw/net/vmxnet_tx_pkt.c
@@ -287,7 +287,7 @@ void vmxnet_tx_pkt_build_vheader(struct VmxnetTxPkt *pkt, bool tso_enable,
         break;
 
     default:
-        assert(false);
+        g_assert_not_reached();
     }
 
     if (csum_enable) {
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 67e4b24..010a0d0 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1357,7 +1357,7 @@ static void ehci_execute_complete(EHCIQueue *q)
     default:
         /* should not be triggerable */
         fprintf(stderr, "USB invalid response %d\n", p->packet.status);
-        assert(0);
+        g_assert_not_reached();
         break;
     }
 
@@ -2142,7 +2142,7 @@ static void ehci_advance_state(EHCIState *ehci, int async)
         default:
             fprintf(stderr, "Bad state!\n");
             again = -1;
-            assert(0);
+            g_assert_not_reached();
             break;
         }
 
@@ -2206,7 +2206,7 @@ static void ehci_advance_async_state(EHCIState *ehci)
         /* this should only be due to a developer mistake */
         fprintf(stderr, "ehci: Bad asynchronous state %d. "
                 "Resetting to active\n", ehci->astate);
-        assert(0);
+        g_assert_not_reached();
     }
 }
 
@@ -2256,7 +2256,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
         /* this should only be due to a developer mistake */
         fprintf(stderr, "ehci: Bad periodic state %d. "
                 "Resetting to active\n", ehci->pstate);
-        assert(0);
+        g_assert_not_reached();
     }
 }
 
diff --git a/net/eth.c b/net/eth.c
index 1d7494d..7c61132 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -73,7 +73,7 @@ eth_get_gso_type(uint16_t l3_proto, uint8_t *l3_hdr, uint8_t l4proto)
     }
 
     /* Unsupported offload */
-    assert(false);
+    g_assert_not_reached();
 
     return VIRTIO_NET_HDR_GSO_NONE | ecn_state;
 }
diff --git a/qdev-monitor.c b/qdev-monitor.c
index e54dbc2..e5adf6c 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -360,7 +360,7 @@ static BusState *qbus_find(const char *path)
 
         /* find device */
         if (sscanf(path+pos, "%127[^/]%n", elem, &len) != 1) {
-            assert(0);
+            g_assert_not_reached();
             elem[0] = len = 0;
         }
         pos += len;
@@ -397,7 +397,7 @@ static BusState *qbus_find(const char *path)
 
         /* find bus */
         if (sscanf(path+pos, "%127[^/]%n", elem, &len) != 1) {
-            assert(0);
+            g_assert_not_reached();
             elem[0] = len = 0;
         }
         pos += len;
diff --git a/target-arm/helper.c b/target-arm/helper.c
index b0c3ca1..4968391 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1653,7 +1653,7 @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                                 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
                                 r2->crn, r2->crm, r2->opc1, r2->opc2,
                                 oldreg->name, r2->name);
-                        assert(0);
+                        g_assert_not_reached();
                     }
                 }
                 g_hash_table_insert(cpu->cp_regs, key, r2);
diff --git a/tests/test-qmp-input-visitor.c b/tests/test-qmp-input-visitor.c
index 2741eef..0beb8fb 100644
--- a/tests/test-qmp-input-visitor.c
+++ b/tests/test-qmp-input-visitor.c
@@ -394,7 +394,7 @@ static void test_native_list_integer_helper(TestInputVisitorData *data,
         break;
     }
     default:
-        g_assert(false);
+        g_assert_not_reached();
     }
 
     g_string_free(gstr_union, true);
diff --git a/tests/test-qmp-output-visitor.c b/tests/test-qmp-output-visitor.c
index b2fa9a7..e073d83 100644
--- a/tests/test-qmp-output-visitor.c
+++ b/tests/test-qmp-output-visitor.c
@@ -559,7 +559,7 @@ static void init_native_list(UserDefNativeListUnion *cvalue)
         break;
     }
     default:
-        g_assert(false);
+        g_assert_not_reached();
     }
 }
 
@@ -645,7 +645,7 @@ static void check_native_list(QObject *qobj,
         }
         break;
     default:
-        g_assert(false);
+        g_assert_not_reached();
     }
     QDECREF(qlist);
 }
diff --git a/tests/test-visitor-serialization.c b/tests/test-visitor-serialization.c
index ee7916b..9aaa587 100644
--- a/tests/test-visitor-serialization.c
+++ b/tests/test-visitor-serialization.c
@@ -136,7 +136,7 @@ static void visit_primitive_type(Visitor *v, void **native, Error **errp)
         visit_type_int64(v, &pt->value.s64, NULL, errp);
         break;
     case PTYPE_EOL:
-        g_assert(false);
+        g_assert_not_reached();
     }
 }
 
@@ -181,7 +181,7 @@ static void visit_primitive_list(Visitor *v, void **native, Error **errp)
         visit_type_uint64List(v, &pl->value.u64_integers, NULL, errp);
         break;
     default:
-        g_assert(false);
+        g_assert_not_reached();
     }
 }
 
@@ -500,7 +500,7 @@ static void test_primitive_lists(gconstpointer opaque)
             break;
         }
         default:
-            g_assert(0);
+            g_assert_not_reached();
         }
     }
 
@@ -656,7 +656,7 @@ static void test_primitive_lists(gconstpointer opaque)
             break;
         }
         default:
-            g_assert(0);
+            g_assert_not_reached();
         }
         i++;
     } while (cur_head);
commit b031f413b9e68899032f04fc05fd0a6b62039b2b
Author: Ramkumar Ramachandra <artagnon at gmail.com>
Date:   Sat Jul 20 16:53:09 2013 +0530

    qemu-options: mention C-a h in the -nographic doc
    
    Otherwise, a new user will be wondering how to switch between the
    console and monitor.
    
    Cc: Anthony Liguori <aliguori at us.ibm.com>
    Cc: Stefan Hajnoczi <stefanha at redhat.com>
    Cc: Markus Armbruster <armbru at redhat.com>
    Cc: Marcelo Tosatti <mtosatti at redhat.com>
    Cc: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Ramkumar Ramachandra <artagnon at gmail.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-options.hx b/qemu-options.hx
index 2dbfd42..25ecb55 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -844,7 +844,8 @@ you can totally disable graphical output so that QEMU is a simple
 command line application. The emulated serial port is redirected on
 the console and muxed with the monitor (unless redirected elsewhere
 explicitly). Therefore, you can still use QEMU to debug a Linux kernel
-with a serial console.
+with a serial console.  Use @key{C-a h} for help on switching between
+the console and monitor.
 ETEXI
 
 DEF("curses", 0, QEMU_OPTION_curses,
commit 52f350227f737b649f09e56ed32eaf1265605611
Author: Stefan Weil <sw at weilnetz.de>
Date:   Wed Jul 24 19:48:56 2013 +0200

    misc: Fix new typos in comments and strings
    
    All these typos were found by codespell.
    
    sould -> should
    emperical -> empirical
    intialization -> initialization
    successfuly -> successfully
    gaurantee -> guarantee
    
    Fix also another error (before before) in the same context.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/block/vhdx.h b/block/vhdx.h
index c3b64c6..fb687ed 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -168,7 +168,7 @@ typedef struct QEMU_PACKED VHDXLogEntryHeader {
                                            vhdx_header.  If not found in
                                            vhdx_header, it is invalid */
     uint64_t    flushed_file_offset;    /* see spec for full details - this
-                                           sould be vhdx file size in bytes */
+                                           should be vhdx file size in bytes */
     uint64_t    last_file_offset;       /* size in bytes that all allocated
                                            file structures fit into */
 } VHDXLogEntryHeader;
diff --git a/docs/rdma.txt b/docs/rdma.txt
index 45d1c8a..8d1e003 100644
--- a/docs/rdma.txt
+++ b/docs/rdma.txt
@@ -199,7 +199,7 @@ Version #1 requires that all server implementations of the protocol must
 check this field and register all requests found in the array of commands located
 in the data portion and return an equal number of results in the response.
 The maximum number of repeats is hard-coded to 4096. This is a conservative
-limit based on the maximum size of a SEND message along with emperical
+limit based on the maximum size of a SEND message along with empirical
 observations on the maximum future benefit of simultaneous page registrations.
 
 The 'type' field has 12 different command values:
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 3fa72a9..337cfa5 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -53,8 +53,8 @@ static const char *balloon_stat_names[] = {
 /*
  * reset_stats - Mark all items in the stats array as unset
  *
- * This function needs to be called at device intialization and before
- * before updating to a set of newly-generated stats.  This will ensure that no
+ * This function needs to be called at device initialization and before
+ * updating to a set of newly-generated stats.  This will ensure that no
  * stale values stick around in case the guest reports a subset of the supported
  * statistics.
  */
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index d7ee774..d15a729 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -756,7 +756,8 @@ static int xen_pt_initfn(PCIDevice *d)
 out:
     memory_listener_register(&s->memory_listener, &address_space_memory);
     memory_listener_register(&s->io_listener, &address_space_io);
-    XEN_PT_LOG(d, "Real physical device %02x:%02x.%d registered successfuly!\n",
+    XEN_PT_LOG(d,
+               "Real physical device %02x:%02x.%d registered successfully!\n",
                s->hostaddr.bus, s->hostaddr.slot, s->hostaddr.function);
 
     return 0;
diff --git a/migration-rdma.c b/migration-rdma.c
index d044830..4828738 100644
--- a/migration-rdma.c
+++ b/migration-rdma.c
@@ -2494,7 +2494,7 @@ static int qemu_rdma_close(void *opaque)
  *    @size == 0 :
  *        A 'hint' or 'advice' that means that we wish to speculatively
  *        and asynchronously unregister this memory. In this case, there is no
- *        gaurantee that the unregister will actually happen, for example,
+ *        guarantee that the unregister will actually happen, for example,
  *        if the memory is being actively transmitted. Additionally, the memory
  *        may be re-registered at any future time if a write within the same
  *        chunk was requested again, even if you attempted to unregister it
@@ -2570,7 +2570,7 @@ static size_t qemu_rdma_save_page(QEMUFile *f, void *opaque,
         qemu_rdma_signal_unregister(rdma, index, chunk, 0);
 
         /*
-         * TODO: Synchronous, gauranteed unregistration (should not occur during
+         * TODO: Synchronous, guaranteed unregistration (should not occur during
          * fast-path). Otherwise, unregisters will process on the next call to
          * qemu_rdma_drain_cq()
         if (size < 0) {
commit 6064be7912ab262f0abd85ad042fafd435ad6651
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Tue Jul 23 19:00:10 2013 +0200

    linux-user: correct argument number for sys_mremap and sys_splice
    
    sys_mremap missed 5th argument (new_address), which caused examples that
    remap to a specific address to fail.
    sys_splice missed 5th and 6th argument which caused different examples to
    fail.
    This change has an effect on MIPS target only.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/linux-user/main.c b/linux-user/main.c
index 5309117..03859bc 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -1920,7 +1920,7 @@ static const uint8_t mips_syscall_args[] = {
 	MIPS_SYS(sys_sched_get_priority_min, 1)
 	MIPS_SYS(sys_sched_rr_get_interval, 2)	/* 4165 */
 	MIPS_SYS(sys_nanosleep,	2)
-	MIPS_SYS(sys_mremap	, 4)
+	MIPS_SYS(sys_mremap	, 5)
 	MIPS_SYS(sys_accept	, 3)
 	MIPS_SYS(sys_bind	, 3)
 	MIPS_SYS(sys_connect	, 3)	/* 4170 */
@@ -2057,7 +2057,7 @@ static const uint8_t mips_syscall_args[] = {
 	MIPS_SYS(sys_pselect6, 6)
 	MIPS_SYS(sys_ppoll, 5)
 	MIPS_SYS(sys_unshare, 1)
-	MIPS_SYS(sys_splice, 4)
+	MIPS_SYS(sys_splice, 6)
 	MIPS_SYS(sys_sync_file_range, 7) /* 4305 */
 	MIPS_SYS(sys_tee, 4)
 	MIPS_SYS(sys_vmsplice, 4)
commit 04dd125942b11136a8c96d36591ad043b8653a7b
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Jul 12 18:48:39 2013 +0200

    PPC: dbdma: macio: Fix format specifiers (build regression)
    
    Fix a number of warnings for 32 bit builds (tested on MingW and Linux):
    
      CC    hw/ide/macio.o
    qemu/hw/ide/macio.c: In function 'pmac_ide_atapi_transfer_cb':
    qemu/hw/ide/macio.c:134:9: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'hwaddr' [-Werror=format]
    qemu/hw/ide/macio.c: In function 'pmac_ide_transfer_cb':
    qemu/hw/ide/macio.c:215:5: error: format '%ld' expects argument of type 'long int', but argument 5 has type 'int64_t' [-Werror=format]
    qemu/hw/ide/macio.c:222:9: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'hwaddr' [-Werror=format]
    qemu/hw/ide/macio.c:264:9: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'hwaddr' [-Werror=format]
    cc1: all warnings being treated as errors
    make: *** [hw/ide/macio.o] Error 1
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Acked-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 38ad924..ef4ba2b 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -131,7 +131,7 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
         int sector_num = (s->lba << 2) + (s->io_buffer_index >> 9);
         int nsector = io->len >> 9;
 
-        MACIO_DPRINTF("precopying unaligned %d bytes to %#lx\n",
+        MACIO_DPRINTF("precopying unaligned %d bytes to %#" HWADDR_PRIx "\n",
                       unaligned, io->addr + io->len - unaligned);
 
         bdrv_read(s->bs, sector_num + nsector, io->remainder, 1);
@@ -212,14 +212,15 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
         s->nsector -= n;
     }
 
-    MACIO_DPRINTF("remainder: %d io->len: %d nsector: %d sector_num: %ld\n",
+    MACIO_DPRINTF("remainder: %d io->len: %d nsector: %d "
+                  "sector_num: %" PRId64 "\n",
                   io->remainder_len, io->len, s->nsector, sector_num);
     if (io->remainder_len && io->len) {
         /* guest wants the rest of its previous transfer */
         int remainder_len = MIN(io->remainder_len, io->len);
         uint8_t *p = &io->remainder[0x200 - remainder_len];
 
-        MACIO_DPRINTF("copying remainder %d bytes at %#lx\n",
+        MACIO_DPRINTF("copying remainder %d bytes at %#" HWADDR_PRIx "\n",
                       remainder_len, io->addr);
 
         switch (s->dma_cmd) {
@@ -261,7 +262,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     if (unaligned) {
         int nsector = io->len >> 9;
 
-        MACIO_DPRINTF("precopying unaligned %d bytes to %#lx\n",
+        MACIO_DPRINTF("precopying unaligned %d bytes to %#" HWADDR_PRIx "\n",
                       unaligned, io->addr + io->len - unaligned);
 
         switch (s->dma_cmd) {
commit f6019e5fada012f7f396c89968f2c242f92f40df
Author: Stefan Weil <sw at weilnetz.de>
Date:   Tue Jul 23 06:46:49 2013 +0200

    watchdog: Remove break after exit
    
    This was dead code.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/watchdog/watchdog.c b/hw/watchdog/watchdog.c
index cb4e1f9..387962e 100644
--- a/hw/watchdog/watchdog.c
+++ b/hw/watchdog/watchdog.c
@@ -128,7 +128,6 @@ void watchdog_perform_action(void)
     case WDT_POWEROFF:          /* same as 'quit' command in monitor */
         watchdog_mon_event("poweroff");
         exit(0);
-        break;
 
     case WDT_PAUSE:             /* same as 'stop' command in monitor */
         watchdog_mon_event("pause");
commit 0dd60ae2f4efd2966e8d6cb7db653d5d17a68c62
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jul 21 16:43:14 2013 +0200

    exec: Remove env from list of poisoned names
    
    The global variable env was removed some time ago, so this name may be
    used without any restriction now.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/include/exec/poison.h b/include/exec/poison.h
index 2341a75..a4b1eca 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -36,7 +36,6 @@
 #pragma GCC poison TARGET_PAGE_ALIGN
 
 #pragma GCC poison CPUArchState
-#pragma GCC poison env
 
 #pragma GCC poison lduw_phys
 #pragma GCC poison ldl_phys
commit 80cba1b71eb9a75404d1effddec8ffa9f0d6d6fb
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 16 12:14:36 2013 +0200

    hw/9pfs: Fix potential memory leak and avoid reuse of freed memory
    
    The leak was reported by cppcheck.
    
    Function proxy_init also calls g_free for ctx->fs_root.
    Avoid reuse of this memory by setting ctx->fs_root to NULL.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: M. Mohan Kumar <mohan at in.ibm.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/9pfs/virtio-9p-proxy.c b/hw/9pfs/virtio-9p-proxy.c
index 8ba2959..5f44bb7 100644
--- a/hw/9pfs/virtio-9p-proxy.c
+++ b/hw/9pfs/virtio-9p-proxy.c
@@ -1153,10 +1153,12 @@ static int proxy_init(FsContext *ctx)
         sock_id = atoi(ctx->fs_root);
         if (sock_id < 0) {
             fprintf(stderr, "socket descriptor not initialized\n");
+            g_free(proxy);
             return -1;
         }
     }
     g_free(ctx->fs_root);
+    ctx->fs_root = NULL;
 
     proxy->in_iovec.iov_base  = g_malloc(PROXY_MAX_IO_SZ + PROXY_HDR_SZ);
     proxy->in_iovec.iov_len   = PROXY_MAX_IO_SZ + PROXY_HDR_SZ;
commit d9cd4007d5c7e877a006392eeafb2291f06d6685
Author: Liu Ping Fan <qemulist at gmail.com>
Date:   Sun Jul 21 08:43:00 2013 +0000

    timer: make timers_state static
    
    Signed-off-by: Liu Ping Fan <pingfank at linux.vnet.ibm.com>
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/cpus.c b/cpus.c
index ca6b886..0f65e76 100644
--- a/cpus.c
+++ b/cpus.c
@@ -112,7 +112,7 @@ typedef struct TimersState {
     int64_t dummy;
 } TimersState;
 
-TimersState timers_state;
+static TimersState timers_state;
 
 /* Return the virtual CPU time, based on the instruction counter.  */
 int64_t cpu_get_icount(void)
commit 9220eeed62e06e115c83e6ffed24907c24c99197
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sat Jun 29 15:10:48 2013 +0000

    aes: Remove unused code (NDEBUG, u16)
    
    The current code includes assert.h very early (from qemu-common.h),
    so the definition of NDEBUG was without any effect.
    
    In the initial version from 2004, NDEBUG was used to disable the assertions.
    Those assertions are not in time critical code, so it is no longer
    reasonable to disable them and the definition of NDEBUG can be removed.
    
    Type u16 is also unused and therefore does not need a type definition.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/aes.c b/util/aes.c
index 91e97fa..4b4d88e 100644
--- a/util/aes.c
+++ b/util/aes.c
@@ -30,12 +30,7 @@
 #include "qemu-common.h"
 #include "qemu/aes.h"
 
-#ifndef NDEBUG
-#define NDEBUG
-#endif
-
 typedef uint32_t u32;
-typedef uint16_t u16;
 typedef uint8_t u8;
 
 /* This controls loop-unrolling in aes_core.c */
commit 200a06397f5d3e982028fd78b25b420507ade021
Merge: b96919e 5b24c64
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jul 26 17:53:19 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into staging
    
    QOM CPUState refactorings
    
    * Fix cpu_memory_rw_debug() breakage in s390x KVM
    * Replace final CPUArchState in sysemu/kvm.h
    * Introduce model subclasses for XtensaCPU
    * Introduce CPUClass::gdb_num[_core]_regs
    * Introduce CPUClass::gdb_core_xml_file
    * Introduce CPUClass::gdb_{read,write}_register()
    * Propagate CPUState further in gdbstub
    
    # gpg: Signature made Fri 26 Jul 2013 05:04:28 PM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Andreas Färber (23) and others
    # Via Andreas Färber
    * afaerber/tags/qom-cpu-for-anthony: (25 commits)
      cpu: Introduce CPUClass::gdb_core_xml_file for GDB_CORE_XML
      target-cris: Factor out CPUClass::gdb_read_register() hook for v10
      cpu: Introduce CPUClass::gdb_{read,write}_register()
      gdbstub: Replace GET_REG*() macros with gdb_get_reg*() functions
      target-xtensa: Move cpu_gdb_{read,write}_register()
      target-lm32: Move cpu_gdb_{read,write}_register()
      target-s390x: Move cpu_gdb_{read,write}_register()
      target-alpha: Move cpu_gdb_{read,write}_register()
      target-cris: Move cpu_gdb_{read,write}_register()
      target-microblaze: Move cpu_gdb_{read,write}_register()
      target-sh4: Move cpu_gdb_{read,write}_register()
      target-openrisc: Move cpu_gdb_{read,write}_register()
      target-mips: Move cpu_gdb_{read,write}_register()
      target-m68k: Move cpu_gdb_{read,write}_register()
      target-arm: Move cpu_gdb_{read,write}_register()
      target-sparc: Move cpu_gdb_{read,write}_register()
      target-ppc: Move cpu_gdb_{read,write}_register()
      target-i386: Move cpu_gdb_{read,write}_register()
      cpu: Introduce CPUState::gdb_num_regs and CPUClass::gdb_num_core_regs
      gdbstub: Drop dead code in cpu_gdb_{read,write}_register()
      ...

commit 5b24c64188b8253e2f004191c7e8d4a799f90eaa
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 15:08:22 2013 +0200

    cpu: Introduce CPUClass::gdb_core_xml_file for GDB_CORE_XML
    
    Replace the GDB_CORE_XML define in gdbstub.c with a CPUClass field.
    Use first_cpu for qSupported and qXfer:features:read: for now.
    Add a stub for xml_builtin.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index d8a5a0e..1af25a6 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -485,25 +485,6 @@ static int put_packet(GDBState *s, const char *buf)
     return put_packet_binary(s, buf, strlen(buf));
 }
 
-#if defined(TARGET_PPC)
-
-#if defined (TARGET_PPC64)
-#define GDB_CORE_XML "power64-core.xml"
-#else
-#define GDB_CORE_XML "power-core.xml"
-#endif
-
-#elif defined (TARGET_ARM)
-
-#define GDB_CORE_XML "arm-core.xml"
-
-#elif defined (TARGET_M68K)
-
-#define GDB_CORE_XML "cf-core.xml"
-
-#endif
-
-#ifdef GDB_CORE_XML
 /* Encode data using the encoding for 'x' packets.  */
 static int memtox(char *buf, const char *mem, int len)
 {
@@ -525,7 +506,8 @@ static int memtox(char *buf, const char *mem, int len)
     return p - buf;
 }
 
-static const char *get_feature_xml(const char *p, const char **newp)
+static const char *get_feature_xml(const char *p, const char **newp,
+                                   CPUClass *cc)
 {
     size_t len;
     int i;
@@ -549,7 +531,7 @@ static const char *get_feature_xml(const char *p, const char **newp)
                      "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
                      "<target>"
                      "<xi:include href=\"%s\"/>",
-                     GDB_CORE_XML);
+                     cc->gdb_core_xml_file);
 
             for (r = cpu->gdb_regs; r; r = r->next) {
                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
@@ -567,7 +549,6 @@ static const char *get_feature_xml(const char *p, const char **newp)
     }
     return name ? xml_builtin[i][1] : NULL;
 }
-#endif
 
 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 {
@@ -773,6 +754,7 @@ static CPUState *find_cpu(uint32_t thread_id)
 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 {
     CPUState *cpu;
+    CPUClass *cc;
     const char *p;
     uint32_t thread;
     int ch, reg_size, type, res;
@@ -1135,20 +1117,25 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
 #endif /* !CONFIG_USER_ONLY */
         if (strncmp(p, "Supported", 9) == 0) {
             snprintf(buf, sizeof(buf), "PacketSize=%x", MAX_PACKET_LENGTH);
-#ifdef GDB_CORE_XML
-            pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
-#endif
+            cc = CPU_GET_CLASS(first_cpu);
+            if (cc->gdb_core_xml_file != NULL) {
+                pstrcat(buf, sizeof(buf), ";qXfer:features:read+");
+            }
             put_packet(s, buf);
             break;
         }
-#ifdef GDB_CORE_XML
         if (strncmp(p, "Xfer:features:read:", 19) == 0) {
             const char *xml;
             target_ulong total_len;
 
+            cc = CPU_GET_CLASS(first_cpu);
+            if (cc->gdb_core_xml_file == NULL) {
+                goto unknown_command;
+            }
+
             gdb_has_xml = true;
             p += 19;
-            xml = get_feature_xml(p, &p);
+            xml = get_feature_xml(p, &p, cc);
             if (!xml) {
                 snprintf(buf, sizeof(buf), "E00");
                 put_packet(s, buf);
@@ -1180,7 +1167,6 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             put_packet_binary(s, buf, len + 1);
             break;
         }
-#endif
         /* Unrecognised 'q' command.  */
         goto unknown_command;
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index c001474..0d6e95c 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -84,6 +84,7 @@ struct TranslationBlock;
  * @gdb_write_register: Callback for letting GDB write a register.
  * @vmsd: State description for migration.
  * @gdb_num_core_regs: Number of core registers accessible to GDB.
+ * @gdb_core_xml_file: File name for core registers GDB XML description.
  *
  * Represents a CPU family or model.
  */
@@ -125,6 +126,7 @@ typedef struct CPUClass {
 
     const struct VMStateDescription *vmsd;
     int gdb_num_core_regs;
+    const char *gdb_core_xml_file;
 } CPUClass;
 
 struct KVMState;
diff --git a/stubs/Makefile.objs b/stubs/Makefile.objs
index 9b701b4..f306cba 100644
--- a/stubs/Makefile.objs
+++ b/stubs/Makefile.objs
@@ -7,6 +7,7 @@ stub-obj-y += fdset-add-fd.o
 stub-obj-y += fdset-find-fd.o
 stub-obj-y += fdset-get-fd.o
 stub-obj-y += fdset-remove-fd.o
+stub-obj-y += gdbstub.o
 stub-obj-y += get-fd.o
 stub-obj-y += get-vm-name.o
 stub-obj-y += iothread-lock.o
diff --git a/stubs/gdbstub.c b/stubs/gdbstub.c
new file mode 100644
index 0000000..c1dbfe7
--- /dev/null
+++ b/stubs/gdbstub.c
@@ -0,0 +1,5 @@
+#include "qemu-common.h"
+
+const char *const xml_builtin[][2] = {
+  { NULL, NULL }
+};
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index a493cc2..87d35c6 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -831,6 +831,7 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->vmsd = &vmstate_arm_cpu;
 #endif
     cc->gdb_num_core_regs = 26;
+    cc->gdb_core_xml_file = "arm-core.xml";
 }
 
 static void cpu_register(const ARMCPUInfo *info)
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 01a70f1..c0bcb0d 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -197,6 +197,7 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 #endif
     dc->vmsd = &vmstate_m68k_cpu;
     cc->gdb_num_core_regs = 18;
+    cc->gdb_core_xml_file = "cf-core.xml";
 }
 
 static void register_cpu_type(const M68kCPUInfo *info)
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 370d243..8215946 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8465,6 +8465,11 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #endif
 
     cc->gdb_num_core_regs = 71;
+#if defined(TARGET_PPC64)
+    cc->gdb_core_xml_file = "power64-core.xml";
+#else
+    cc->gdb_core_xml_file = "power-core.xml";
+#endif
 }
 
 static const TypeInfo ppc_cpu_type_info = {
commit 90431220be42d773084d88635961a45febb01c5d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 14:39:41 2013 +0200

    target-cris: Factor out CPUClass::gdb_read_register() hook for v10
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index 3e92ea0..7559366 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -81,6 +81,7 @@ void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
 
 hwaddr cris_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
+int crisv10_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int cris_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 8fcc95d..45f2d6b 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -175,6 +175,7 @@ static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
 
     ccc->vr = 8;
     cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 }
 
 static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
@@ -184,6 +185,7 @@ static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
 
     ccc->vr = 9;
     cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 }
 
 static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
@@ -193,6 +195,7 @@ static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
 
     ccc->vr = 10;
     cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 }
 
 static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
@@ -202,6 +205,7 @@ static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
 
     ccc->vr = 11;
     cc->do_interrupt = crisv10_cpu_do_interrupt;
+    cc->gdb_read_register = crisv10_cpu_gdb_read_register;
 }
 
 static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
diff --git a/target-cris/gdbstub.c b/target-cris/gdbstub.c
index 958a370..5db3683 100644
--- a/target-cris/gdbstub.c
+++ b/target-cris/gdbstub.c
@@ -21,9 +21,11 @@
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
 
-static int
-read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
+int crisv10_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    CRISCPU *cpu = CRIS_CPU(cs);
+    CPUCRISState *env = &cpu->env;
+
     if (n < 15) {
         return gdb_get_reg32(mem_buf, env->regs[n]);
     }
@@ -57,10 +59,6 @@ int cris_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
     CPUCRISState *env = &cpu->env;
     uint8_t srs;
 
-    if (env->pregs[PR_VR] < 32) {
-        return read_register_crisv10(env, mem_buf, n);
-    }
-
     srs = env->pregs[PR_SRS];
     if (n < 16) {
         return gdb_get_reg32(mem_buf, env->regs[n]);
commit 5b50e790f9e9403d11b4164193b76530ee85a2a1
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jun 29 04:18:45 2013 +0200

    cpu: Introduce CPUClass::gdb_{read,write}_register()
    
    Completes migration of target-specific code to new target-*/gdbstub.c.
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Acked-by: Max Filippov <jcmvbkbc at gmail.com> (for xtensa)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index eb50630..d8a5a0e 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -40,7 +40,6 @@
 #include "cpu.h"
 #include "qemu/sockets.h"
 #include "sysemu/kvm.h"
-#include "qemu/bitops.h"
 
 static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
                                          uint8_t *buf, int len, bool is_write)
@@ -316,10 +315,7 @@ static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
 
 static GDBState *gdbserver_state;
 
-/* This is an ugly hack to cope with both new and old gdb.
-   If gdb sends qXfer:features:read then assume we're talking to a newish
-   gdb that understands target descriptions.  */
-static int gdb_has_xml;
+bool gdb_has_xml;
 
 #ifdef CONFIG_USER_ONLY
 /* XXX: This is not thread safe.  Do we care?  */
@@ -489,11 +485,7 @@ static int put_packet(GDBState *s, const char *buf)
     return put_packet_binary(s, buf, strlen(buf));
 }
 
-#if defined(TARGET_I386)
-
-#include "target-i386/gdbstub.c"
-
-#elif defined (TARGET_PPC)
+#if defined(TARGET_PPC)
 
 #if defined (TARGET_PPC64)
 #define GDB_CORE_XML "power64-core.xml"
@@ -501,72 +493,14 @@ static int put_packet(GDBState *s, const char *buf)
 #define GDB_CORE_XML "power-core.xml"
 #endif
 
-#include "target-ppc/gdbstub.c"
-
-#elif defined (TARGET_SPARC)
-
-#include "target-sparc/gdbstub.c"
-
 #elif defined (TARGET_ARM)
 
 #define GDB_CORE_XML "arm-core.xml"
 
-#include "target-arm/gdbstub.c"
-
 #elif defined (TARGET_M68K)
 
 #define GDB_CORE_XML "cf-core.xml"
 
-#include "target-m68k/gdbstub.c"
-
-#elif defined (TARGET_MIPS)
-
-#include "target-mips/gdbstub.c"
-
-#elif defined(TARGET_OPENRISC)
-
-#include "target-openrisc/gdbstub.c"
-
-#elif defined (TARGET_SH4)
-
-#include "target-sh4/gdbstub.c"
-
-#elif defined (TARGET_MICROBLAZE)
-
-#include "target-microblaze/gdbstub.c"
-
-#elif defined (TARGET_CRIS)
-
-#include "target-cris/gdbstub.c"
-
-#elif defined (TARGET_ALPHA)
-
-#include "target-alpha/gdbstub.c"
-
-#elif defined (TARGET_S390X)
-
-#include "target-s390x/gdbstub.c"
-
-#elif defined (TARGET_LM32)
-
-#include "target-lm32/gdbstub.c"
-
-#elif defined(TARGET_XTENSA)
-
-#include "target-xtensa/gdbstub.c"
-
-#else
-
-static int cpu_gdb_read_register(CPUArchState *env, uint8_t *mem_buf, int n)
-{
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUArchState *env, uint8_t *mem_buf, int n)
-{
-    return 0;
-}
-
 #endif
 
 #ifdef GDB_CORE_XML
@@ -642,7 +576,7 @@ static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
     GDBRegisterState *r;
 
     if (reg < cc->gdb_num_core_regs) {
-        return cpu_gdb_read_register(env, mem_buf, reg);
+        return cc->gdb_read_register(cpu, mem_buf, reg);
     }
 
     for (r = cpu->gdb_regs; r; r = r->next) {
@@ -660,7 +594,7 @@ static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
     GDBRegisterState *r;
 
     if (reg < cc->gdb_num_core_regs) {
-        return cpu_gdb_write_register(env, mem_buf, reg);
+        return cc->gdb_write_register(cpu, mem_buf, reg);
     }
 
     for (r = cpu->gdb_regs; r; r = r->next) {
@@ -1212,7 +1146,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             const char *xml;
             target_ulong total_len;
 
-            gdb_has_xml = 1;
+            gdb_has_xml = true;
             p += 19;
             xml = get_feature_xml(p, &p);
             if (!xml) {
@@ -1621,7 +1555,7 @@ static void gdb_accept(void)
     s->c_cpu = first_cpu;
     s->g_cpu = first_cpu;
     s->fd = fd;
-    gdb_has_xml = 0;
+    gdb_has_xml = false;
 
     gdbserver_state = s;
 
@@ -1707,7 +1641,7 @@ static void gdb_chr_event(void *opaque, int event)
     switch (event) {
     case CHR_EVENT_OPENED:
         vm_stop(RUN_STATE_PAUSED);
-        gdb_has_xml = 0;
+        gdb_has_xml = false;
         break;
     default:
         break;
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index a5bd341..a608a26 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -84,6 +84,14 @@ int gdbserver_start(int);
 int gdbserver_start(const char *port);
 #endif
 
+/**
+ * gdb_has_xml:
+ * This is an ugly hack to cope with both new and old gdb.
+ * If gdb sends qXfer:features:read then assume we're talking to a newish
+ * gdb that understands target descriptions.
+ */
+extern bool gdb_has_xml;
+
 /* in gdbstub-xml.c, generated by scripts/feature_to_c.sh */
 extern const char *const xml_builtin[][2];
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 195fe59..c001474 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -80,6 +80,8 @@ struct TranslationBlock;
  * @synchronize_from_tb: Callback for synchronizing state from a TCG
  * #TranslationBlock.
  * @get_phys_page_debug: Callback for obtaining a physical address.
+ * @gdb_read_register: Callback for letting GDB read a register.
+ * @gdb_write_register: Callback for letting GDB write a register.
  * @vmsd: State description for migration.
  * @gdb_num_core_regs: Number of core registers accessible to GDB.
  *
@@ -109,6 +111,8 @@ typedef struct CPUClass {
     void (*set_pc)(CPUState *cpu, vaddr value);
     void (*synchronize_from_tb)(CPUState *cpu, struct TranslationBlock *tb);
     hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
+    int (*gdb_read_register)(CPUState *cpu, uint8_t *buf, int reg);
+    int (*gdb_write_register)(CPUState *cpu, uint8_t *buf, int reg);
 
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
diff --git a/qom/cpu.c b/qom/cpu.c
index 2839ddf..dbc9fb6 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -157,6 +157,17 @@ static int cpu_common_write_elf64_note(WriteCoreDumpFunction f,
 }
 
 
+static int cpu_common_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg)
+{
+    return 0;
+}
+
+static int cpu_common_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg)
+{
+    return 0;
+}
+
+
 void cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                     int flags)
 {
@@ -253,6 +264,8 @@ static void cpu_class_init(ObjectClass *klass, void *data)
     k->write_elf32_note = cpu_common_write_elf32_note;
     k->write_elf64_qemunote = cpu_common_write_elf64_qemunote;
     k->write_elf64_note = cpu_common_write_elf64_note;
+    k->gdb_read_register = cpu_common_gdb_read_register;
+    k->gdb_write_register = cpu_common_gdb_write_register;
     dc->realize = cpu_common_realizefn;
     dc->no_user = 1;
 }
diff --git a/target-alpha/Makefile.objs b/target-alpha/Makefile.objs
index 590304c..b96c5da 100644
--- a/target-alpha/Makefile.objs
+++ b/target-alpha/Makefile.objs
@@ -1,3 +1,4 @@
 obj-$(CONFIG_SOFTMMU) += machine.o
 obj-y += translate.o helper.o cpu.o
 obj-y += int_helper.o fpu_helper.o sys_helper.o mem_helper.o
+obj-y += gdbstub.o
diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index b2eeba3..2ebc9bc 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -82,5 +82,7 @@ void alpha_cpu_do_interrupt(CPUState *cpu);
 void alpha_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
                           int flags);
 hwaddr alpha_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int alpha_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int alpha_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index cc0f69a..64c70bc 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -271,6 +271,8 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = alpha_cpu_do_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
+    cc->gdb_read_register = alpha_cpu_gdb_read_register;
+    cc->gdb_write_register = alpha_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->do_unassigned_access = alpha_cpu_unassigned_access;
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
diff --git a/target-alpha/gdbstub.c b/target-alpha/gdbstub.c
index 1c18698..980f140 100644
--- a/target-alpha/gdbstub.c
+++ b/target-alpha/gdbstub.c
@@ -17,9 +17,14 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
-static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
+int alpha_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    AlphaCPU *cpu = ALPHA_CPU(cs);
+    CPUAlphaState *env = &cpu->env;
     uint64_t val;
     CPU_DoubleU d;
 
@@ -52,8 +57,10 @@ static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
     return gdb_get_regl(mem_buf, val);
 }
 
-static int cpu_gdb_write_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
+int alpha_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    AlphaCPU *cpu = ALPHA_CPU(cs);
+    CPUAlphaState *env = &cpu->env;
     target_ulong tmp = ldtul_p(mem_buf);
     CPU_DoubleU d;
 
diff --git a/target-arm/Makefile.objs b/target-arm/Makefile.objs
index 4a6e52e..2d9f77f 100644
--- a/target-arm/Makefile.objs
+++ b/target-arm/Makefile.objs
@@ -4,3 +4,4 @@ obj-$(CONFIG_KVM) += kvm.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
 obj-y += translate.o op_helper.o helper.o cpu.o
 obj-y += neon_helper.o iwmmxt_helper.o
+obj-y += gdbstub.o
diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 02162c9..cf36587 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -149,4 +149,7 @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
 
 hwaddr arm_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
+int arm_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+
 #endif
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index f39c19f..a493cc2 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -824,6 +824,8 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = arm_cpu_do_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
+    cc->gdb_read_register = arm_cpu_gdb_read_register;
+    cc->gdb_write_register = arm_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = arm_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_arm_cpu;
diff --git a/target-arm/gdbstub.c b/target-arm/gdbstub.c
index e1c7df4..1c34396 100644
--- a/target-arm/gdbstub.c
+++ b/target-arm/gdbstub.c
@@ -17,6 +17,9 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
    whatever the target description contains.  Due to a historical mishap
@@ -24,8 +27,11 @@
    We hack round this by giving the FPA regs zero size when talking to a
    newer gdb.  */
 
-static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
+int arm_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
     if (n < 16) {
         /* Core integer register.  */
         return gdb_get_reg32(mem_buf, env->regs[n]);
@@ -53,8 +59,10 @@ static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUARMState *env, uint8_t *mem_buf, int n)
+int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
     uint32_t tmp;
 
     tmp = ldl_p(mem_buf);
diff --git a/target-cris/Makefile.objs b/target-cris/Makefile.objs
index afb87bc..7779227 100644
--- a/target-cris/Makefile.objs
+++ b/target-cris/Makefile.objs
@@ -1,2 +1,3 @@
 obj-y += translate.o op_helper.o helper.o cpu.o
+obj-y += gdbstub.o
 obj-$(CONFIG_SOFTMMU) += mmu.o machine.o
diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index d7baf07..3e92ea0 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -81,4 +81,7 @@ void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
 
 hwaddr cris_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
+int cris_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+
 #endif
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 31eeddf..8fcc95d 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -255,6 +255,8 @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = cris_cpu_do_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
+    cc->gdb_read_register = cris_cpu_gdb_read_register;
+    cc->gdb_write_register = cris_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
 #endif
diff --git a/target-cris/gdbstub.c b/target-cris/gdbstub.c
index ed23966..958a370 100644
--- a/target-cris/gdbstub.c
+++ b/target-cris/gdbstub.c
@@ -17,6 +17,9 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
 static int
 read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
@@ -48,8 +51,10 @@ read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_read_register(CPUCRISState *env, uint8_t *mem_buf, int n)
+int cris_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    CRISCPU *cpu = CRIS_CPU(cs);
+    CPUCRISState *env = &cpu->env;
     uint8_t srs;
 
     if (env->pregs[PR_VR] < 32) {
@@ -85,8 +90,10 @@ static int cpu_gdb_read_register(CPUCRISState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUCRISState *env, uint8_t *mem_buf, int n)
+int cris_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    CRISCPU *cpu = CRIS_CPU(cs);
+    CPUCRISState *env = &cpu->env;
     uint32_t tmp;
 
     if (n > 49) {
diff --git a/target-i386/Makefile.objs b/target-i386/Makefile.objs
index c1d4f05..3b629d4d 100644
--- a/target-i386/Makefile.objs
+++ b/target-i386/Makefile.objs
@@ -1,6 +1,7 @@
 obj-y += translate.o helper.o cpu.o
 obj-y += excp_helper.o fpu_helper.o cc_helper.o int_helper.o svm_helper.o
 obj-y += smm_helper.o misc_helper.o mem_helper.o seg_helper.o
+obj-y += gdbstub.o
 obj-$(CONFIG_SOFTMMU) += machine.o arch_memory_mapping.o arch_dump.o
 obj-$(CONFIG_KVM) += kvm.o hyperv.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index d928562..60d2b5d 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -106,4 +106,7 @@ void x86_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
 
 hwaddr x86_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
+int x86_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int x86_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+
 #endif
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index df9832e..2b59b7d 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2538,6 +2538,8 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
     cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
+    cc->gdb_read_register = x86_cpu_gdb_read_register;
+    cc->gdb_write_register = x86_cpu_gdb_write_register;
     cc->get_arch_id = x86_cpu_get_arch_id;
     cc->get_paging_enabled = x86_cpu_get_paging_enabled;
 #ifndef CONFIG_USER_ONLY
diff --git a/target-i386/gdbstub.c b/target-i386/gdbstub.c
index 0a4d97d..15bebef 100644
--- a/target-i386/gdbstub.c
+++ b/target-i386/gdbstub.c
@@ -17,6 +17,9 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
 #ifdef TARGET_X86_64
 static const int gpr_map[16] = {
@@ -35,8 +38,11 @@ static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 #define IDX_XMM_REGS    (IDX_FP_REGS + 16)
 #define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
 
-static int cpu_gdb_read_register(CPUX86State *env, uint8_t *mem_buf, int n)
+int x86_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
     if (n < CPU_NB_REGS) {
         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
             return gdb_get_reg64(mem_buf, env->regs[gpr_map[n]]);
@@ -108,8 +114,9 @@ static int cpu_gdb_read_register(CPUX86State *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_x86_gdb_load_seg(CPUX86State *env, int sreg, uint8_t *mem_buf)
+static int x86_cpu_gdb_load_seg(X86CPU *cpu, int sreg, uint8_t *mem_buf)
 {
+    CPUX86State *env = &cpu->env;
     uint16_t selector = ldl_p(mem_buf);
 
     if (selector != env->segs[sreg].selector) {
@@ -135,8 +142,10 @@ static int cpu_x86_gdb_load_seg(CPUX86State *env, int sreg, uint8_t *mem_buf)
     return 4;
 }
 
-static int cpu_gdb_write_register(CPUX86State *env, uint8_t *mem_buf, int n)
+int x86_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
     uint32_t tmp;
 
     if (n < CPU_NB_REGS) {
@@ -179,17 +188,17 @@ static int cpu_gdb_write_register(CPUX86State *env, uint8_t *mem_buf, int n)
             return 4;
 
         case IDX_SEG_REGS:
-            return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
+            return x86_cpu_gdb_load_seg(cpu, R_CS, mem_buf);
         case IDX_SEG_REGS + 1:
-            return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
+            return x86_cpu_gdb_load_seg(cpu, R_SS, mem_buf);
         case IDX_SEG_REGS + 2:
-            return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
+            return x86_cpu_gdb_load_seg(cpu, R_DS, mem_buf);
         case IDX_SEG_REGS + 3:
-            return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
+            return x86_cpu_gdb_load_seg(cpu, R_ES, mem_buf);
         case IDX_SEG_REGS + 4:
-            return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
+            return x86_cpu_gdb_load_seg(cpu, R_FS, mem_buf);
         case IDX_SEG_REGS + 5:
-            return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
+            return x86_cpu_gdb_load_seg(cpu, R_GS, mem_buf);
 
         case IDX_FP_REGS + 8:
             env->fpuc = ldl_p(mem_buf);
diff --git a/target-lm32/Makefile.objs b/target-lm32/Makefile.objs
index ca20f21..4023687 100644
--- a/target-lm32/Makefile.objs
+++ b/target-lm32/Makefile.objs
@@ -1,2 +1,3 @@
 obj-y += translate.o op_helper.o helper.o cpu.o
+obj-y += gdbstub.o
 obj-$(CONFIG_SOFTMMU) += machine.o
diff --git a/target-lm32/cpu-qom.h b/target-lm32/cpu-qom.h
index 9e27329..723f604 100644
--- a/target-lm32/cpu-qom.h
+++ b/target-lm32/cpu-qom.h
@@ -79,5 +79,7 @@ void lm32_cpu_do_interrupt(CPUState *cpu);
 void lm32_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
 hwaddr lm32_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int lm32_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int lm32_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index aa52696..962d553 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -87,6 +87,8 @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = lm32_cpu_do_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
+    cc->gdb_read_register = lm32_cpu_gdb_read_register;
+    cc->gdb_write_register = lm32_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
diff --git a/target-lm32/gdbstub.c b/target-lm32/gdbstub.c
index 17f08f5..4979a98 100644
--- a/target-lm32/gdbstub.c
+++ b/target-lm32/gdbstub.c
@@ -17,10 +17,16 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 #include "hw/lm32/lm32_pic.h"
 
-static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
+int lm32_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    LM32CPU *cpu = LM32_CPU(cs);
+    CPULM32State *env = &cpu->env;
+
     if (n < 32) {
         return gdb_get_reg32(mem_buf, env->regs[n]);
     } else {
@@ -45,10 +51,11 @@ static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPULM32State *env, uint8_t *mem_buf, int n)
+int lm32_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
-    LM32CPU *cpu = lm32_env_get_cpu(env);
-    CPUClass *cc = CPU_GET_CLASS(cpu);
+    LM32CPU *cpu = LM32_CPU(cs);
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    CPULM32State *env = &cpu->env;
     uint32_t tmp;
 
     if (n > cc->gdb_num_core_regs) {
diff --git a/target-m68k/Makefile.objs b/target-m68k/Makefile.objs
index 2e2b850..02cf616 100644
--- a/target-m68k/Makefile.objs
+++ b/target-m68k/Makefile.objs
@@ -1,2 +1,3 @@
 obj-y += m68k-semi.o
 obj-y += translate.o op_helper.o helper.o cpu.o
+obj-y += gdbstub.o
diff --git a/target-m68k/cpu-qom.h b/target-m68k/cpu-qom.h
index 7115707..7f388ed 100644
--- a/target-m68k/cpu-qom.h
+++ b/target-m68k/cpu-qom.h
@@ -74,5 +74,7 @@ void m68k_cpu_do_interrupt(CPUState *cpu);
 void m68k_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
 hwaddr m68k_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int m68k_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 93200d9..01a70f1 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -190,6 +190,8 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->do_interrupt = m68k_cpu_do_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
+    cc->gdb_read_register = m68k_cpu_gdb_read_register;
+    cc->gdb_write_register = m68k_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
 #endif
diff --git a/target-m68k/gdbstub.c b/target-m68k/gdbstub.c
index 9fa9fa6..ae8179c 100644
--- a/target-m68k/gdbstub.c
+++ b/target-m68k/gdbstub.c
@@ -17,9 +17,15 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
-static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
+int m68k_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
     if (n < 8) {
         /* D0-D7 */
         return gdb_get_reg32(mem_buf, env->dregs[n]);
@@ -39,8 +45,10 @@ static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUM68KState *env, uint8_t *mem_buf, int n)
+int m68k_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
     uint32_t tmp;
 
     tmp = ldl_p(mem_buf);
diff --git a/target-microblaze/Makefile.objs b/target-microblaze/Makefile.objs
index 985330e..f3d7b44 100644
--- a/target-microblaze/Makefile.objs
+++ b/target-microblaze/Makefile.objs
@@ -1,2 +1,3 @@
 obj-y += translate.o op_helper.o helper.o cpu.o
+obj-y += gdbstub.o
 obj-$(CONFIG_SOFTMMU) += mmu.o
diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index 1318a36..35a12b4 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -75,5 +75,7 @@ void mb_cpu_do_interrupt(CPUState *cs);
 void mb_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                        int flags);
 hwaddr mb_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int mb_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 758b0cb..c75d1bd 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -141,6 +141,8 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = mb_cpu_do_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
+    cc->gdb_read_register = mb_cpu_gdb_read_register;
+    cc->gdb_write_register = mb_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->do_unassigned_access = mb_cpu_unassigned_access;
     cc->get_phys_page_debug = mb_cpu_get_phys_page_debug;
diff --git a/target-microblaze/gdbstub.c b/target-microblaze/gdbstub.c
index 678de21..a70e2ee 100644
--- a/target-microblaze/gdbstub.c
+++ b/target-microblaze/gdbstub.c
@@ -17,9 +17,15 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
-static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
+int mb_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+    CPUMBState *env = &cpu->env;
+
     if (n < 32) {
         return gdb_get_reg32(mem_buf, env->regs[n]);
     } else {
@@ -28,10 +34,11 @@ static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUMBState *env, uint8_t *mem_buf, int n)
+int mb_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
-    MicroBlazeCPU *cpu = mb_env_get_cpu(env);
-    CPUClass *cc = CPU_GET_CLASS(cpu);
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    CPUMBState *env = &cpu->env;
     uint32_t tmp;
 
     if (n > cc->gdb_num_core_regs) {
diff --git a/target-mips/Makefile.objs b/target-mips/Makefile.objs
index 119c816..0277d56 100644
--- a/target-mips/Makefile.objs
+++ b/target-mips/Makefile.objs
@@ -1,2 +1,3 @@
 obj-y += translate.o dsp_helper.o op_helper.o lmi_helper.o helper.o cpu.o
+obj-y += gdbstub.o
 obj-$(CONFIG_SOFTMMU) += machine.o
diff --git a/target-mips/cpu-qom.h b/target-mips/cpu-qom.h
index 7c8e616..8877f81 100644
--- a/target-mips/cpu-qom.h
+++ b/target-mips/cpu-qom.h
@@ -78,5 +78,7 @@ void mips_cpu_do_interrupt(CPUState *cpu);
 void mips_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
 hwaddr mips_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int mips_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int mips_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index e667fb7..f81f9e9 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -100,6 +100,8 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
+    cc->gdb_read_register = mips_cpu_gdb_read_register;
+    cc->gdb_write_register = mips_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->do_unassigned_access = mips_cpu_unassigned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
diff --git a/target-mips/gdbstub.c b/target-mips/gdbstub.c
index db826d8..5b72d58 100644
--- a/target-mips/gdbstub.c
+++ b/target-mips/gdbstub.c
@@ -17,9 +17,15 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
-static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
+int mips_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    MIPSCPU *cpu = MIPS_CPU(cs);
+    CPUMIPSState *env = &cpu->env;
+
     if (n < 32) {
         return gdb_get_regl(mem_buf, env->active_tc.gpr[n]);
     }
@@ -78,8 +84,10 @@ static unsigned int ieee_rm[] = {
     set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], \
                             &env->active_fpu.fp_status)
 
-static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
+int mips_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    MIPSCPU *cpu = MIPS_CPU(cs);
+    CPUMIPSState *env = &cpu->env;
     target_ulong tmp;
 
     tmp = ldtul_p(mem_buf);
diff --git a/target-openrisc/Makefile.objs b/target-openrisc/Makefile.objs
index 44dc539..397d016 100644
--- a/target-openrisc/Makefile.objs
+++ b/target-openrisc/Makefile.objs
@@ -2,3 +2,4 @@ obj-$(CONFIG_SOFTMMU) += machine.o
 obj-y += cpu.o exception.o interrupt.o mmu.o translate.o
 obj-y += exception_helper.o fpu_helper.o int_helper.o \
          interrupt_helper.o mmu_helper.o sys_helper.o
+obj-y += gdbstub.o
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index 9b042e1..aa269fb 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -155,6 +155,8 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = openrisc_cpu_do_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
+    cc->gdb_read_register = openrisc_cpu_gdb_read_register;
+    cc->gdb_write_register = openrisc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index 3ddb767..8fd0bc0 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -350,6 +350,8 @@ void openrisc_cpu_do_interrupt(CPUState *cpu);
 void openrisc_cpu_dump_state(CPUState *cpu, FILE *f,
                              fprintf_function cpu_fprintf, int flags);
 hwaddr openrisc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int openrisc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int openrisc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void openrisc_translate_init(void);
 int cpu_openrisc_handle_mmu_fault(CPUOpenRISCState *env,
                                   target_ulong address,
diff --git a/target-openrisc/gdbstub.c b/target-openrisc/gdbstub.c
index bdb8d2c..18bcc46 100644
--- a/target-openrisc/gdbstub.c
+++ b/target-openrisc/gdbstub.c
@@ -17,9 +17,15 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
-static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
+int openrisc_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+    CPUOpenRISCState *env = &cpu->env;
+
     if (n < 32) {
         return gdb_get_reg32(mem_buf, env->gpr[n]);
     } else {
@@ -40,11 +46,11 @@ static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUOpenRISCState *env,
-                                  uint8_t *mem_buf, int n)
+int openrisc_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
-    OpenRISCCPU *cpu = openrisc_env_get_cpu(env);
-    CPUClass *cc = CPU_GET_CLASS(cpu);
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    CPUOpenRISCState *env = &cpu->env;
     uint32_t tmp;
 
     if (n > cc->gdb_num_core_regs) {
diff --git a/target-ppc/Makefile.objs b/target-ppc/Makefile.objs
index 6e78cb3..f72e399 100644
--- a/target-ppc/Makefile.objs
+++ b/target-ppc/Makefile.objs
@@ -13,3 +13,4 @@ obj-y += timebase_helper.o
 obj-y += misc_helper.o
 obj-y += mem_helper.o
 obj-$(CONFIG_USER_ONLY) += user_only_helper.o
+obj-y += gdbstub.o
diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index 3341c51..fc0d737 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -106,5 +106,7 @@ void ppc_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
 void ppc_cpu_dump_statistics(CPUState *cpu, FILE *f,
                              fprintf_function cpu_fprintf, int flags);
 hwaddr ppc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int ppc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int ppc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-ppc/gdbstub.c b/target-ppc/gdbstub.c
index 40a9d7b..1c91090 100644
--- a/target-ppc/gdbstub.c
+++ b/target-ppc/gdbstub.c
@@ -17,6 +17,9 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
  * expects whatever the target description contains.  Due to a
@@ -25,8 +28,11 @@
  * FP regs zero size when talking to a newer gdb.
  */
 
-static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
+int ppc_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    CPUPPCState *env = &cpu->env;
+
     if (n < 32) {
         /* gprs */
         return gdb_get_regl(mem_buf, env->gpr[n]);
@@ -70,8 +76,11 @@ static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
+int ppc_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    CPUPPCState *env = &cpu->env;
+
     if (n < 32) {
         /* gprs */
         env->gpr[n] = ldtul_p(mem_buf);
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 9116193..370d243 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8458,6 +8458,8 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
+    cc->gdb_read_register = ppc_cpu_gdb_read_register;
+    cc->gdb_write_register = ppc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
 #endif
diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
index 4e63417..ab938e7 100644
--- a/target-s390x/Makefile.objs
+++ b/target-s390x/Makefile.objs
@@ -1,4 +1,5 @@
 obj-y += translate.o helper.o cpu.o interrupt.o
 obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o misc_helper.o
+obj-y += gdbstub.o
 obj-$(CONFIG_SOFTMMU) += ioinst.o
 obj-$(CONFIG_KVM) += kvm.o
diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index a4fe8fb..0d63b1c 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -75,5 +75,7 @@ void s390_cpu_do_interrupt(CPUState *cpu);
 void s390_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
 hwaddr s390_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int s390_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int s390_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 8f99d7c..1d16da3 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -173,6 +173,8 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = s390_cpu_do_interrupt;
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
+    cc->gdb_read_register = s390_cpu_gdb_read_register;
+    cc->gdb_write_register = s390_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = s390_cpu_get_phys_page_debug;
 #endif
diff --git a/target-s390x/gdbstub.c b/target-s390x/gdbstub.c
index ee3e984..a129742 100644
--- a/target-s390x/gdbstub.c
+++ b/target-s390x/gdbstub.c
@@ -17,9 +17,15 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
+#include "qemu/bitops.h"
 
-static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
+int s390_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    S390CPU *cpu = S390_CPU(cs);
+    CPUS390XState *env = &cpu->env;
     uint64_t val;
     int cc_op;
 
@@ -43,8 +49,10 @@ static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUS390XState *env, uint8_t *mem_buf, int n)
+int s390_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    S390CPU *cpu = S390_CPU(cs);
+    CPUS390XState *env = &cpu->env;
     target_ulong tmpl;
     uint32_t tmp32;
     int r = 8;
diff --git a/target-sh4/Makefile.objs b/target-sh4/Makefile.objs
index cb448a8..a285358 100644
--- a/target-sh4/Makefile.objs
+++ b/target-sh4/Makefile.objs
@@ -1 +1,2 @@
 obj-y += translate.o op_helper.o helper.o cpu.o
+obj-y += gdbstub.o
diff --git a/target-sh4/cpu-qom.h b/target-sh4/cpu-qom.h
index 7c9160b..c04e786 100644
--- a/target-sh4/cpu-qom.h
+++ b/target-sh4/cpu-qom.h
@@ -87,5 +87,7 @@ void superh_cpu_do_interrupt(CPUState *cpu);
 void superh_cpu_dump_state(CPUState *cpu, FILE *f,
                            fprintf_function cpu_fprintf, int flags);
 hwaddr superh_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int superh_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int superh_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 35f0535..bda3c51 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -286,6 +286,8 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
+    cc->gdb_read_register = superh_cpu_gdb_read_register;
+    cc->gdb_write_register = superh_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
diff --git a/target-sh4/gdbstub.c b/target-sh4/gdbstub.c
index fb85718..df4fa2a 100644
--- a/target-sh4/gdbstub.c
+++ b/target-sh4/gdbstub.c
@@ -17,12 +17,18 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
 /* FIXME: We should use XML for this.  */
 
-static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
+int superh_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+    CPUSH4State *env = &cpu->env;
+
     switch (n) {
     case 0 ... 7:
         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
@@ -70,8 +76,11 @@ static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
+int superh_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+    CPUSH4State *env = &cpu->env;
+
     switch (n) {
     case 0 ... 7:
         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
diff --git a/target-sparc/Makefile.objs b/target-sparc/Makefile.objs
index 9fc42ea..1cd81cc 100644
--- a/target-sparc/Makefile.objs
+++ b/target-sparc/Makefile.objs
@@ -4,3 +4,4 @@ obj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
 obj-$(TARGET_SPARC) += int32_helper.o
 obj-$(TARGET_SPARC64) += int64_helper.o
 obj-$(TARGET_SPARC64) += vis_helper.o
+obj-y += gdbstub.o
diff --git a/target-sparc/cpu-qom.h b/target-sparc/cpu-qom.h
index 39d975b..8e3e0de 100644
--- a/target-sparc/cpu-qom.h
+++ b/target-sparc/cpu-qom.h
@@ -79,5 +79,7 @@ void sparc_cpu_do_interrupt(CPUState *cpu);
 void sparc_cpu_dump_state(CPUState *cpu, FILE *f,
                           fprintf_function cpu_fprintf, int flags);
 hwaddr sparc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int sparc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int sparc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 388a632..c7b4a90 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -787,6 +787,8 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 #endif
     cc->set_pc = sparc_cpu_set_pc;
     cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
+    cc->gdb_read_register = sparc_cpu_gdb_read_register;
+    cc->gdb_write_register = sparc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->do_unassigned_access = sparc_cpu_unassigned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
diff --git a/target-sparc/gdbstub.c b/target-sparc/gdbstub.c
index 460c0b7..3de3242 100644
--- a/target-sparc/gdbstub.c
+++ b/target-sparc/gdbstub.c
@@ -17,6 +17,9 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
 #ifdef TARGET_ABI32
 #define gdb_get_rega(buf, val) gdb_get_reg32(buf, val)
@@ -24,8 +27,11 @@
 #define gdb_get_rega(buf, val) gdb_get_regl(buf, val)
 #endif
 
-static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
+int sparc_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    CPUSPARCState *env = &cpu->env;
+
     if (n < 8) {
         /* g0..g7 */
         return gdb_get_rega(mem_buf, env->gregs[n]);
@@ -98,8 +104,10 @@ static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static int cpu_gdb_write_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
+int sparc_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    CPUSPARCState *env = &cpu->env;
 #if defined(TARGET_ABI32)
     abi_ulong tmp;
 
diff --git a/target-xtensa/Makefile.objs b/target-xtensa/Makefile.objs
index 644b7f9..5c150a8 100644
--- a/target-xtensa/Makefile.objs
+++ b/target-xtensa/Makefile.objs
@@ -3,3 +3,4 @@ obj-y += core-dc232b.o
 obj-y += core-dc233c.o
 obj-y += core-fsf.o
 obj-y += translate.o op_helper.o helper.o cpu.o
+obj-y += gdbstub.o
diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index 1b9479e..c6cc2d9 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -87,5 +87,7 @@ void xtensa_cpu_do_interrupt(CPUState *cpu);
 void xtensa_cpu_dump_state(CPUState *cpu, FILE *f,
                            fprintf_function cpu_fprintf, int flags);
 hwaddr xtensa_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int xtensa_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int xtensa_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 #endif
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index 560fa0c..e966aa0 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -133,6 +133,8 @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = xtensa_cpu_do_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
+    cc->gdb_read_register = xtensa_cpu_gdb_read_register;
+    cc->gdb_write_register = xtensa_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
 #endif
diff --git a/target-xtensa/gdbstub.c b/target-xtensa/gdbstub.c
index c963563..9e13b20 100644
--- a/target-xtensa/gdbstub.c
+++ b/target-xtensa/gdbstub.c
@@ -17,9 +17,14 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
+#include "config.h"
+#include "qemu-common.h"
+#include "exec/gdbstub.h"
 
-static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
+int xtensa_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    XtensaCPU *cpu = XTENSA_CPU(cs);
+    CPUXtensaState *env = &cpu->env;
     const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
 
     if (n < 0 || n >= env->config->gdb_regmap.num_regs) {
@@ -55,8 +60,10 @@ static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
     }
 }
 
-static int cpu_gdb_write_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
+int xtensa_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
+    XtensaCPU *cpu = XTENSA_CPU(cs);
+    CPUXtensaState *env = &cpu->env;
     uint32_t tmp;
     const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
 
commit 986a2998932e978e63fc3b7ead1fef81f7aad52e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 13:05:05 2013 +0200

    gdbstub: Replace GET_REG*() macros with gdb_get_reg*() functions
    
    This avoids polluting the global namespace with a non-prefixed macro and
    makes it obvious in the call sites that we return.
    
    Semi-automatic conversion using, e.g.,
     sed -i 's/GET_REGL(/return gdb_get_regl(mem_buf, /g' target-*/gdbstub.c
    followed by manual tweaking for sparc's GET_REGA() and Coding Style.
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Acked-by: Max Filippov <jcmvbkbc at gmail.com> (for xtensa)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 7527195..eb50630 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -489,35 +489,6 @@ static int put_packet(GDBState *s, const char *buf)
     return put_packet_binary(s, buf, strlen(buf));
 }
 
-/* The GDB remote protocol transfers values in target byte order.  This means
-   we can use the raw memory access routines to access the value buffer.
-   Conveniently, these also handle the case where the buffer is mis-aligned.
- */
-#define GET_REG8(val) do { \
-    stb_p(mem_buf, val); \
-    return 1; \
-    } while(0)
-#define GET_REG16(val) do { \
-    stw_p(mem_buf, val); \
-    return 2; \
-    } while(0)
-#define GET_REG32(val) do { \
-    stl_p(mem_buf, val); \
-    return 4; \
-    } while(0)
-#define GET_REG64(val) do { \
-    stq_p(mem_buf, val); \
-    return 8; \
-    } while(0)
-
-#if TARGET_LONG_BITS == 64
-#define GET_REGL(val) GET_REG64(val)
-#define ldtul_p(addr) ldq_p(addr)
-#else
-#define GET_REGL(val) GET_REG32(val)
-#define ldtul_p(addr) ldl_p(addr)
-#endif
-
 #if defined(TARGET_I386)
 
 #include "target-i386/gdbstub.c"
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 7ea1ad7..a5bd341 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -39,6 +39,43 @@ static inline int cpu_index(CPUState *cpu)
 #endif
 }
 
+/* The GDB remote protocol transfers values in target byte order.  This means
+ * we can use the raw memory access routines to access the value buffer.
+ * Conveniently, these also handle the case where the buffer is mis-aligned.
+ */
+
+static inline int gdb_get_reg8(uint8_t *mem_buf, uint8_t val)
+{
+    stb_p(mem_buf, val);
+    return 1;
+}
+
+static inline int gdb_get_reg16(uint8_t *mem_buf, uint16_t val)
+{
+    stw_p(mem_buf, val);
+    return 2;
+}
+
+static inline int gdb_get_reg32(uint8_t *mem_buf, uint32_t val)
+{
+    stl_p(mem_buf, val);
+    return 4;
+}
+
+static inline int gdb_get_reg64(uint8_t *mem_buf, uint64_t val)
+{
+    stq_p(mem_buf, val);
+    return 8;
+}
+
+#if TARGET_LONG_BITS == 64
+#define gdb_get_regl(buf, val) gdb_get_reg64(buf, val)
+#define ldtul_p(addr) ldq_p(addr)
+#else
+#define gdb_get_regl(buf, val) gdb_get_reg32(buf, val)
+#define ldtul_p(addr) ldl_p(addr)
+#endif
+
 #endif
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target-alpha/gdbstub.c b/target-alpha/gdbstub.c
index b23afe4..1c18698 100644
--- a/target-alpha/gdbstub.c
+++ b/target-alpha/gdbstub.c
@@ -49,7 +49,7 @@ static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
     default:
         return 0;
     }
-    GET_REGL(val);
+    return gdb_get_regl(mem_buf, val);
 }
 
 static int cpu_gdb_write_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
diff --git a/target-arm/gdbstub.c b/target-arm/gdbstub.c
index 74903a3..e1c7df4 100644
--- a/target-arm/gdbstub.c
+++ b/target-arm/gdbstub.c
@@ -28,7 +28,7 @@ static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
 {
     if (n < 16) {
         /* Core integer register.  */
-        GET_REG32(env->regs[n]);
+        return gdb_get_reg32(mem_buf, env->regs[n]);
     }
     if (n < 24) {
         /* FPA registers.  */
@@ -44,10 +44,10 @@ static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
         if (gdb_has_xml) {
             return 0;
         }
-        GET_REG32(0);
+        return gdb_get_reg32(mem_buf, 0);
     case 25:
         /* CPSR */
-        GET_REG32(cpsr_read(env));
+        return gdb_get_reg32(mem_buf, cpsr_read(env));
     }
     /* Unknown register.  */
     return 0;
diff --git a/target-cris/gdbstub.c b/target-cris/gdbstub.c
index b48224a..ed23966 100644
--- a/target-cris/gdbstub.c
+++ b/target-cris/gdbstub.c
@@ -22,25 +22,25 @@ static int
 read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
 {
     if (n < 15) {
-        GET_REG32(env->regs[n]);
+        return gdb_get_reg32(mem_buf, env->regs[n]);
     }
 
     if (n == 15) {
-        GET_REG32(env->pc);
+        return gdb_get_reg32(mem_buf, env->pc);
     }
 
     if (n < 32) {
         switch (n) {
         case 16:
-            GET_REG8(env->pregs[n - 16]);
+            return gdb_get_reg8(mem_buf, env->pregs[n - 16]);
         case 17:
-            GET_REG8(env->pregs[n - 16]);
+            return gdb_get_reg8(mem_buf, env->pregs[n - 16]);
         case 20:
         case 21:
-            GET_REG16(env->pregs[n - 16]);
+            return gdb_get_reg16(mem_buf, env->pregs[n - 16]);
         default:
             if (n >= 23) {
-                GET_REG32(env->pregs[n - 16]);
+                return gdb_get_reg32(mem_buf, env->pregs[n - 16]);
             }
             break;
         }
@@ -58,28 +58,28 @@ static int cpu_gdb_read_register(CPUCRISState *env, uint8_t *mem_buf, int n)
 
     srs = env->pregs[PR_SRS];
     if (n < 16) {
-        GET_REG32(env->regs[n]);
+        return gdb_get_reg32(mem_buf, env->regs[n]);
     }
 
     if (n >= 21 && n < 32) {
-        GET_REG32(env->pregs[n - 16]);
+        return gdb_get_reg32(mem_buf, env->pregs[n - 16]);
     }
     if (n >= 33 && n < 49) {
-        GET_REG32(env->sregs[srs][n - 33]);
+        return gdb_get_reg32(mem_buf, env->sregs[srs][n - 33]);
     }
     switch (n) {
     case 16:
-        GET_REG8(env->pregs[0]);
+        return gdb_get_reg8(mem_buf, env->pregs[0]);
     case 17:
-        GET_REG8(env->pregs[1]);
+        return gdb_get_reg8(mem_buf, env->pregs[1]);
     case 18:
-        GET_REG32(env->pregs[2]);
+        return gdb_get_reg32(mem_buf, env->pregs[2]);
     case 19:
-        GET_REG8(srs);
+        return gdb_get_reg8(mem_buf, srs);
     case 20:
-        GET_REG16(env->pregs[4]);
+        return gdb_get_reg16(mem_buf, env->pregs[4]);
     case 32:
-        GET_REG32(env->pc);
+        return gdb_get_reg32(mem_buf, env->pc);
     }
 
     return 0;
diff --git a/target-i386/gdbstub.c b/target-i386/gdbstub.c
index 974d8ad..0a4d97d 100644
--- a/target-i386/gdbstub.c
+++ b/target-i386/gdbstub.c
@@ -39,9 +39,9 @@ static int cpu_gdb_read_register(CPUX86State *env, uint8_t *mem_buf, int n)
 {
     if (n < CPU_NB_REGS) {
         if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
-            GET_REG64(env->regs[gpr_map[n]]);
+            return gdb_get_reg64(mem_buf, env->regs[gpr_map[n]]);
         } else if (n < CPU_NB_REGS32) {
-            GET_REG32(env->regs[gpr_map32[n]]);
+            return gdb_get_reg32(mem_buf, env->regs[gpr_map32[n]]);
         }
     } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
 #ifdef USE_X86LDOUBLE
@@ -63,46 +63,46 @@ static int cpu_gdb_read_register(CPUX86State *env, uint8_t *mem_buf, int n)
         switch (n) {
         case IDX_IP_REG:
             if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
-                GET_REG64(env->eip);
+                return gdb_get_reg64(mem_buf, env->eip);
             } else {
-                GET_REG32(env->eip);
+                return gdb_get_reg32(mem_buf, env->eip);
             }
         case IDX_FLAGS_REG:
-            GET_REG32(env->eflags);
+            return gdb_get_reg32(mem_buf, env->eflags);
 
         case IDX_SEG_REGS:
-            GET_REG32(env->segs[R_CS].selector);
+            return gdb_get_reg32(mem_buf, env->segs[R_CS].selector);
         case IDX_SEG_REGS + 1:
-            GET_REG32(env->segs[R_SS].selector);
+            return gdb_get_reg32(mem_buf, env->segs[R_SS].selector);
         case IDX_SEG_REGS + 2:
-            GET_REG32(env->segs[R_DS].selector);
+            return gdb_get_reg32(mem_buf, env->segs[R_DS].selector);
         case IDX_SEG_REGS + 3:
-            GET_REG32(env->segs[R_ES].selector);
+            return gdb_get_reg32(mem_buf, env->segs[R_ES].selector);
         case IDX_SEG_REGS + 4:
-            GET_REG32(env->segs[R_FS].selector);
+            return gdb_get_reg32(mem_buf, env->segs[R_FS].selector);
         case IDX_SEG_REGS + 5:
-            GET_REG32(env->segs[R_GS].selector);
+            return gdb_get_reg32(mem_buf, env->segs[R_GS].selector);
 
         case IDX_FP_REGS + 8:
-            GET_REG32(env->fpuc);
+            return gdb_get_reg32(mem_buf, env->fpuc);
         case IDX_FP_REGS + 9:
-            GET_REG32((env->fpus & ~0x3800) |
-                      (env->fpstt & 0x7) << 11);
+            return gdb_get_reg32(mem_buf, (env->fpus & ~0x3800) |
+                                          (env->fpstt & 0x7) << 11);
         case IDX_FP_REGS + 10:
-            GET_REG32(0); /* ftag */
+            return gdb_get_reg32(mem_buf, 0); /* ftag */
         case IDX_FP_REGS + 11:
-            GET_REG32(0); /* fiseg */
+            return gdb_get_reg32(mem_buf, 0); /* fiseg */
         case IDX_FP_REGS + 12:
-            GET_REG32(0); /* fioff */
+            return gdb_get_reg32(mem_buf, 0); /* fioff */
         case IDX_FP_REGS + 13:
-            GET_REG32(0); /* foseg */
+            return gdb_get_reg32(mem_buf, 0); /* foseg */
         case IDX_FP_REGS + 14:
-            GET_REG32(0); /* fooff */
+            return gdb_get_reg32(mem_buf, 0); /* fooff */
         case IDX_FP_REGS + 15:
-            GET_REG32(0); /* fop */
+            return gdb_get_reg32(mem_buf, 0); /* fop */
 
         case IDX_MXCSR_REG:
-            GET_REG32(env->mxcsr);
+            return gdb_get_reg32(mem_buf, env->mxcsr);
         }
     }
     return 0;
diff --git a/target-lm32/gdbstub.c b/target-lm32/gdbstub.c
index 732a633..17f08f5 100644
--- a/target-lm32/gdbstub.c
+++ b/target-lm32/gdbstub.c
@@ -22,24 +22,24 @@
 static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
-        GET_REG32(env->regs[n]);
+        return gdb_get_reg32(mem_buf, env->regs[n]);
     } else {
         switch (n) {
         case 32:
-            GET_REG32(env->pc);
+            return gdb_get_reg32(mem_buf, env->pc);
         /* FIXME: put in right exception ID */
         case 33:
-            GET_REG32(0);
+            return gdb_get_reg32(mem_buf, 0);
         case 34:
-            GET_REG32(env->eba);
+            return gdb_get_reg32(mem_buf, env->eba);
         case 35:
-            GET_REG32(env->deba);
+            return gdb_get_reg32(mem_buf, env->deba);
         case 36:
-            GET_REG32(env->ie);
+            return gdb_get_reg32(mem_buf, env->ie);
         case 37:
-            GET_REG32(lm32_pic_get_im(env->pic_state));
+            return gdb_get_reg32(mem_buf, lm32_pic_get_im(env->pic_state));
         case 38:
-            GET_REG32(lm32_pic_get_ip(env->pic_state));
+            return gdb_get_reg32(mem_buf, lm32_pic_get_ip(env->pic_state));
         }
     }
     return 0;
diff --git a/target-m68k/gdbstub.c b/target-m68k/gdbstub.c
index 2eb4b98..9fa9fa6 100644
--- a/target-m68k/gdbstub.c
+++ b/target-m68k/gdbstub.c
@@ -22,16 +22,16 @@ static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
 {
     if (n < 8) {
         /* D0-D7 */
-        GET_REG32(env->dregs[n]);
+        return gdb_get_reg32(mem_buf, env->dregs[n]);
     } else if (n < 16) {
         /* A0-A7 */
-        GET_REG32(env->aregs[n - 8]);
+        return gdb_get_reg32(mem_buf, env->aregs[n - 8]);
     } else {
         switch (n) {
         case 16:
-            GET_REG32(env->sr);
+            return gdb_get_reg32(mem_buf, env->sr);
         case 17:
-            GET_REG32(env->pc);
+            return gdb_get_reg32(mem_buf, env->pc);
         }
     }
     /* FP registers not included here because they vary between
diff --git a/target-microblaze/gdbstub.c b/target-microblaze/gdbstub.c
index 96c4bc0..678de21 100644
--- a/target-microblaze/gdbstub.c
+++ b/target-microblaze/gdbstub.c
@@ -21,9 +21,9 @@
 static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
-        GET_REG32(env->regs[n]);
+        return gdb_get_reg32(mem_buf, env->regs[n]);
     } else {
-        GET_REG32(env->sregs[n - 32]);
+        return gdb_get_reg32(mem_buf, env->sregs[n - 32]);
     }
     return 0;
 }
diff --git a/target-mips/gdbstub.c b/target-mips/gdbstub.c
index 15dc281..db826d8 100644
--- a/target-mips/gdbstub.c
+++ b/target-mips/gdbstub.c
@@ -21,44 +21,47 @@
 static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
-        GET_REGL(env->active_tc.gpr[n]);
+        return gdb_get_regl(mem_buf, env->active_tc.gpr[n]);
     }
     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
         if (n >= 38 && n < 70) {
             if (env->CP0_Status & (1 << CP0St_FR)) {
-                GET_REGL(env->active_fpu.fpr[n - 38].d);
+                return gdb_get_regl(mem_buf,
+                    env->active_fpu.fpr[n - 38].d);
             } else {
-                GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
+                return gdb_get_regl(mem_buf,
+                    env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
             }
         }
         switch (n) {
         case 70:
-            GET_REGL((int32_t)env->active_fpu.fcr31);
+            return gdb_get_regl(mem_buf, (int32_t)env->active_fpu.fcr31);
         case 71:
-            GET_REGL((int32_t)env->active_fpu.fcr0);
+            return gdb_get_regl(mem_buf, (int32_t)env->active_fpu.fcr0);
         }
     }
     switch (n) {
     case 32:
-        GET_REGL((int32_t)env->CP0_Status);
+        return gdb_get_regl(mem_buf, (int32_t)env->CP0_Status);
     case 33:
-        GET_REGL(env->active_tc.LO[0]);
+        return gdb_get_regl(mem_buf, env->active_tc.LO[0]);
     case 34:
-        GET_REGL(env->active_tc.HI[0]);
+        return gdb_get_regl(mem_buf, env->active_tc.HI[0]);
     case 35:
-        GET_REGL(env->CP0_BadVAddr);
+        return gdb_get_regl(mem_buf, env->CP0_BadVAddr);
     case 36:
-        GET_REGL((int32_t)env->CP0_Cause);
+        return gdb_get_regl(mem_buf, (int32_t)env->CP0_Cause);
     case 37:
-        GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
+        return gdb_get_regl(mem_buf, env->active_tc.PC |
+                                     !!(env->hflags & MIPS_HFLAG_M16));
     case 72:
-        GET_REGL(0); /* fp */
+        return gdb_get_regl(mem_buf, 0); /* fp */
     case 89:
-        GET_REGL((int32_t)env->CP0_PRid);
+        return gdb_get_regl(mem_buf, (int32_t)env->CP0_PRid);
     }
     if (n >= 73 && n <= 88) {
         /* 16 embedded regs.  */
-        GET_REGL(0);
+        return gdb_get_regl(mem_buf, 0);
     }
 
     return 0;
diff --git a/target-openrisc/gdbstub.c b/target-openrisc/gdbstub.c
index fba096a..bdb8d2c 100644
--- a/target-openrisc/gdbstub.c
+++ b/target-openrisc/gdbstub.c
@@ -21,17 +21,17 @@
 static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
-        GET_REG32(env->gpr[n]);
+        return gdb_get_reg32(mem_buf, env->gpr[n]);
     } else {
         switch (n) {
         case 32:    /* PPC */
-            GET_REG32(env->ppc);
+            return gdb_get_reg32(mem_buf, env->ppc);
 
         case 33:    /* NPC */
-            GET_REG32(env->npc);
+            return gdb_get_reg32(mem_buf, env->npc);
 
         case 34:    /* SR */
-            GET_REG32(env->sr);
+            return gdb_get_reg32(mem_buf, env->sr);
 
         default:
             break;
diff --git a/target-ppc/gdbstub.c b/target-ppc/gdbstub.c
index b834e60..40a9d7b 100644
--- a/target-ppc/gdbstub.c
+++ b/target-ppc/gdbstub.c
@@ -29,7 +29,7 @@ static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
         /* gprs */
-        GET_REGL(env->gpr[n]);
+        return gdb_get_regl(mem_buf, env->gpr[n]);
     } else if (n < 64) {
         /* fprs */
         if (gdb_has_xml) {
@@ -40,9 +40,9 @@ static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
     } else {
         switch (n) {
         case 64:
-            GET_REGL(env->nip);
+            return gdb_get_regl(mem_buf, env->nip);
         case 65:
-            GET_REGL(env->msr);
+            return gdb_get_regl(mem_buf, env->msr);
         case 66:
             {
                 uint32_t cr = 0;
@@ -50,20 +50,20 @@ static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
                 for (i = 0; i < 8; i++) {
                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
                 }
-                GET_REG32(cr);
+                return gdb_get_reg32(mem_buf, cr);
             }
         case 67:
-            GET_REGL(env->lr);
+            return gdb_get_regl(mem_buf, env->lr);
         case 68:
-            GET_REGL(env->ctr);
+            return gdb_get_regl(mem_buf, env->ctr);
         case 69:
-            GET_REGL(env->xer);
+            return gdb_get_regl(mem_buf, env->xer);
         case 70:
             {
                 if (gdb_has_xml) {
                     return 0;
                 }
-                GET_REG32(env->fpscr);
+                return gdb_get_reg32(mem_buf, env->fpscr);
             }
         }
     }
diff --git a/target-s390x/gdbstub.c b/target-s390x/gdbstub.c
index c966143..ee3e984 100644
--- a/target-s390x/gdbstub.c
+++ b/target-s390x/gdbstub.c
@@ -27,17 +27,17 @@ static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
     case S390_PSWM_REGNUM:
         cc_op = calc_cc(env, env->cc_op, env->cc_src, env->cc_dst, env->cc_vr);
         val = deposit64(env->psw.mask, 44, 2, cc_op);
-        GET_REGL(val);
+        return gdb_get_regl(mem_buf, val);
     case S390_PSWA_REGNUM:
-        GET_REGL(env->psw.addr);
+        return gdb_get_regl(mem_buf, env->psw.addr);
     case S390_R0_REGNUM ... S390_R15_REGNUM:
-        GET_REGL(env->regs[n-S390_R0_REGNUM]);
+        return gdb_get_regl(mem_buf, env->regs[n-S390_R0_REGNUM]);
     case S390_A0_REGNUM ... S390_A15_REGNUM:
-        GET_REG32(env->aregs[n-S390_A0_REGNUM]);
+        return gdb_get_reg32(mem_buf, env->aregs[n-S390_A0_REGNUM]);
     case S390_FPC_REGNUM:
-        GET_REG32(env->fpc);
+        return gdb_get_reg32(mem_buf, env->fpc);
     case S390_F0_REGNUM ... S390_F15_REGNUM:
-        GET_REG64(env->fregs[n-S390_F0_REGNUM].ll);
+        return gdb_get_reg64(mem_buf, env->fregs[n-S390_F0_REGNUM].ll);
     }
 
     return 0;
diff --git a/target-sh4/gdbstub.c b/target-sh4/gdbstub.c
index 38bc630..fb85718 100644
--- a/target-sh4/gdbstub.c
+++ b/target-sh4/gdbstub.c
@@ -26,30 +26,30 @@ static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
     switch (n) {
     case 0 ... 7:
         if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
-            GET_REGL(env->gregs[n + 16]);
+            return gdb_get_regl(mem_buf, env->gregs[n + 16]);
         } else {
-            GET_REGL(env->gregs[n]);
+            return gdb_get_regl(mem_buf, env->gregs[n]);
         }
     case 8 ... 15:
-        GET_REGL(env->gregs[n]);
+        return gdb_get_regl(mem_buf, env->gregs[n]);
     case 16:
-        GET_REGL(env->pc);
+        return gdb_get_regl(mem_buf, env->pc);
     case 17:
-        GET_REGL(env->pr);
+        return gdb_get_regl(mem_buf, env->pr);
     case 18:
-        GET_REGL(env->gbr);
+        return gdb_get_regl(mem_buf, env->gbr);
     case 19:
-        GET_REGL(env->vbr);
+        return gdb_get_regl(mem_buf, env->vbr);
     case 20:
-        GET_REGL(env->mach);
+        return gdb_get_regl(mem_buf, env->mach);
     case 21:
-        GET_REGL(env->macl);
+        return gdb_get_regl(mem_buf, env->macl);
     case 22:
-        GET_REGL(env->sr);
+        return gdb_get_regl(mem_buf, env->sr);
     case 23:
-        GET_REGL(env->fpul);
+        return gdb_get_regl(mem_buf, env->fpul);
     case 24:
-        GET_REGL(env->fpscr);
+        return gdb_get_regl(mem_buf, env->fpscr);
     case 25 ... 40:
         if (env->fpscr & FPSCR_FR) {
             stfl_p(mem_buf, env->fregs[n - 9]);
@@ -58,13 +58,13 @@ static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
         }
         return 4;
     case 41:
-        GET_REGL(env->ssr);
+        return gdb_get_regl(mem_buf, env->ssr);
     case 42:
-        GET_REGL(env->spc);
+        return gdb_get_regl(mem_buf, env->spc);
     case 43 ... 50:
-        GET_REGL(env->gregs[n - 43]);
+        return gdb_get_regl(mem_buf, env->gregs[n - 43]);
     case 51 ... 58:
-        GET_REGL(env->gregs[n - (51 - 16)]);
+        return gdb_get_regl(mem_buf, env->gregs[n - (51 - 16)]);
     }
 
     return 0;
diff --git a/target-sparc/gdbstub.c b/target-sparc/gdbstub.c
index 914f586..460c0b7 100644
--- a/target-sparc/gdbstub.c
+++ b/target-sparc/gdbstub.c
@@ -19,80 +19,80 @@
  */
 
 #ifdef TARGET_ABI32
-#define GET_REGA(val) GET_REG32(val)
+#define gdb_get_rega(buf, val) gdb_get_reg32(buf, val)
 #else
-#define GET_REGA(val) GET_REGL(val)
+#define gdb_get_rega(buf, val) gdb_get_regl(buf, val)
 #endif
 
 static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
 {
     if (n < 8) {
         /* g0..g7 */
-        GET_REGA(env->gregs[n]);
+        return gdb_get_rega(mem_buf, env->gregs[n]);
     }
     if (n < 32) {
         /* register window */
-        GET_REGA(env->regwptr[n - 8]);
+        return gdb_get_rega(mem_buf, env->regwptr[n - 8]);
     }
 #if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
     if (n < 64) {
         /* fprs */
         if (n & 1) {
-            GET_REG32(env->fpr[(n - 32) / 2].l.lower);
+            return gdb_get_reg32(mem_buf, env->fpr[(n - 32) / 2].l.lower);
         } else {
-            GET_REG32(env->fpr[(n - 32) / 2].l.upper);
+            return gdb_get_reg32(mem_buf, env->fpr[(n - 32) / 2].l.upper);
         }
     }
     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
     switch (n) {
     case 64:
-        GET_REGA(env->y);
+        return gdb_get_rega(mem_buf, env->y);
     case 65:
-        GET_REGA(cpu_get_psr(env));
+        return gdb_get_rega(mem_buf, cpu_get_psr(env));
     case 66:
-        GET_REGA(env->wim);
+        return gdb_get_rega(mem_buf, env->wim);
     case 67:
-        GET_REGA(env->tbr);
+        return gdb_get_rega(mem_buf, env->tbr);
     case 68:
-        GET_REGA(env->pc);
+        return gdb_get_rega(mem_buf, env->pc);
     case 69:
-        GET_REGA(env->npc);
+        return gdb_get_rega(mem_buf, env->npc);
     case 70:
-        GET_REGA(env->fsr);
+        return gdb_get_rega(mem_buf, env->fsr);
     case 71:
-        GET_REGA(0); /* csr */
+        return gdb_get_rega(mem_buf, 0); /* csr */
     default:
-        GET_REGA(0);
+        return gdb_get_rega(mem_buf, 0);
     }
 #else
     if (n < 64) {
         /* f0-f31 */
         if (n & 1) {
-            GET_REG32(env->fpr[(n - 32) / 2].l.lower);
+            return gdb_get_reg32(mem_buf, env->fpr[(n - 32) / 2].l.lower);
         } else {
-            GET_REG32(env->fpr[(n - 32) / 2].l.upper);
+            return gdb_get_reg32(mem_buf, env->fpr[(n - 32) / 2].l.upper);
         }
     }
     if (n < 80) {
         /* f32-f62 (double width, even numbers only) */
-        GET_REG64(env->fpr[(n - 32) / 2].ll);
+        return gdb_get_reg64(mem_buf, env->fpr[(n - 32) / 2].ll);
     }
     switch (n) {
     case 80:
-        GET_REGL(env->pc);
+        return gdb_get_regl(mem_buf, env->pc);
     case 81:
-        GET_REGL(env->npc);
+        return gdb_get_regl(mem_buf, env->npc);
     case 82:
-        GET_REGL((cpu_get_ccr(env) << 32) |
-                 ((env->asi & 0xff) << 24) |
-                 ((env->pstate & 0xfff) << 8) |
-                 cpu_get_cwp64(env));
+        return gdb_get_regl(mem_buf, (cpu_get_ccr(env) << 32) |
+                                     ((env->asi & 0xff) << 24) |
+                                     ((env->pstate & 0xfff) << 8) |
+                                     cpu_get_cwp64(env));
     case 83:
-        GET_REGL(env->fsr);
+        return gdb_get_regl(mem_buf, env->fsr);
     case 84:
-        GET_REGL(env->fprs);
+        return gdb_get_regl(mem_buf, env->fprs);
     case 85:
-        GET_REGL(env->y);
+        return gdb_get_regl(mem_buf, env->y);
     }
 #endif
     return 0;
diff --git a/target-xtensa/gdbstub.c b/target-xtensa/gdbstub.c
index 0880b7c..c963563 100644
--- a/target-xtensa/gdbstub.c
+++ b/target-xtensa/gdbstub.c
@@ -28,23 +28,25 @@ static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
 
     switch (reg->type) {
     case 9: /*pc*/
-        GET_REG32(env->pc);
+        return gdb_get_reg32(mem_buf, env->pc);
 
     case 1: /*ar*/
         xtensa_sync_phys_from_window(env);
-        GET_REG32(env->phys_regs[(reg->targno & 0xff) % env->config->nareg]);
+        return gdb_get_reg32(mem_buf, env->phys_regs[(reg->targno & 0xff)
+                                                     % env->config->nareg]);
 
     case 2: /*SR*/
-        GET_REG32(env->sregs[reg->targno & 0xff]);
+        return gdb_get_reg32(mem_buf, env->sregs[reg->targno & 0xff]);
 
     case 3: /*UR*/
-        GET_REG32(env->uregs[reg->targno & 0xff]);
+        return gdb_get_reg32(mem_buf, env->uregs[reg->targno & 0xff]);
 
     case 4: /*f*/
-        GET_REG32(float32_val(env->fregs[reg->targno & 0x0f]));
+        return gdb_get_reg32(mem_buf, float32_val(env->fregs[reg->targno
+                                                             & 0x0f]));
 
     case 8: /*a*/
-        GET_REG32(env->regs[reg->targno & 0x0f]);
+        return gdb_get_reg32(mem_buf, env->regs[reg->targno & 0x0f]);
 
     default:
         qemu_log("%s from reg %d of unsupported type %d\n",
commit 25d8ac0e31c3c68dfdd6da7c33b87870b4a3b623
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:57:38 2013 +0200

    target-xtensa: Move cpu_gdb_{read,write}_register()
    
    Acked-by: Max Filippov <jcmvbkbc at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 8a2f80c..7527195 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -582,86 +582,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined(TARGET_XTENSA)
 
-static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
-{
-    const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
-
-    if (n < 0 || n >= env->config->gdb_regmap.num_regs) {
-        return 0;
-    }
-
-    switch (reg->type) {
-    case 9: /*pc*/
-        GET_REG32(env->pc);
-
-    case 1: /*ar*/
-        xtensa_sync_phys_from_window(env);
-        GET_REG32(env->phys_regs[(reg->targno & 0xff) % env->config->nareg]);
-
-    case 2: /*SR*/
-        GET_REG32(env->sregs[reg->targno & 0xff]);
-
-    case 3: /*UR*/
-        GET_REG32(env->uregs[reg->targno & 0xff]);
-
-    case 4: /*f*/
-        GET_REG32(float32_val(env->fregs[reg->targno & 0x0f]));
-
-    case 8: /*a*/
-        GET_REG32(env->regs[reg->targno & 0x0f]);
-
-    default:
-        qemu_log("%s from reg %d of unsupported type %d\n",
-                 __func__, n, reg->type);
-        return 0;
-    }
-}
-
-static int cpu_gdb_write_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
-{
-    uint32_t tmp;
-    const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
-
-    if (n < 0 || n >= env->config->gdb_regmap.num_regs) {
-        return 0;
-    }
-
-    tmp = ldl_p(mem_buf);
-
-    switch (reg->type) {
-    case 9: /*pc*/
-        env->pc = tmp;
-        break;
-
-    case 1: /*ar*/
-        env->phys_regs[(reg->targno & 0xff) % env->config->nareg] = tmp;
-        xtensa_sync_window_from_phys(env);
-        break;
-
-    case 2: /*SR*/
-        env->sregs[reg->targno & 0xff] = tmp;
-        break;
-
-    case 3: /*UR*/
-        env->uregs[reg->targno & 0xff] = tmp;
-        break;
+#include "target-xtensa/gdbstub.c"
 
-    case 4: /*f*/
-        env->fregs[reg->targno & 0x0f] = make_float32(tmp);
-        break;
-
-    case 8: /*a*/
-        env->regs[reg->targno & 0x0f] = tmp;
-        break;
-
-    default:
-        qemu_log("%s to reg %d of unsupported type %d\n",
-                 __func__, n, reg->type);
-        return 0;
-    }
-
-    return 4;
-}
 #else
 
 static int cpu_gdb_read_register(CPUArchState *env, uint8_t *mem_buf, int n)
diff --git a/target-xtensa/gdbstub.c b/target-xtensa/gdbstub.c
new file mode 100644
index 0000000..0880b7c
--- /dev/null
+++ b/target-xtensa/gdbstub.c
@@ -0,0 +1,100 @@
+/*
+ * Xtensa gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
+{
+    const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
+
+    if (n < 0 || n >= env->config->gdb_regmap.num_regs) {
+        return 0;
+    }
+
+    switch (reg->type) {
+    case 9: /*pc*/
+        GET_REG32(env->pc);
+
+    case 1: /*ar*/
+        xtensa_sync_phys_from_window(env);
+        GET_REG32(env->phys_regs[(reg->targno & 0xff) % env->config->nareg]);
+
+    case 2: /*SR*/
+        GET_REG32(env->sregs[reg->targno & 0xff]);
+
+    case 3: /*UR*/
+        GET_REG32(env->uregs[reg->targno & 0xff]);
+
+    case 4: /*f*/
+        GET_REG32(float32_val(env->fregs[reg->targno & 0x0f]));
+
+    case 8: /*a*/
+        GET_REG32(env->regs[reg->targno & 0x0f]);
+
+    default:
+        qemu_log("%s from reg %d of unsupported type %d\n",
+                 __func__, n, reg->type);
+        return 0;
+    }
+}
+
+static int cpu_gdb_write_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
+{
+    uint32_t tmp;
+    const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
+
+    if (n < 0 || n >= env->config->gdb_regmap.num_regs) {
+        return 0;
+    }
+
+    tmp = ldl_p(mem_buf);
+
+    switch (reg->type) {
+    case 9: /*pc*/
+        env->pc = tmp;
+        break;
+
+    case 1: /*ar*/
+        env->phys_regs[(reg->targno & 0xff) % env->config->nareg] = tmp;
+        xtensa_sync_window_from_phys(env);
+        break;
+
+    case 2: /*SR*/
+        env->sregs[reg->targno & 0xff] = tmp;
+        break;
+
+    case 3: /*UR*/
+        env->uregs[reg->targno & 0xff] = tmp;
+        break;
+
+    case 4: /*f*/
+        env->fregs[reg->targno & 0x0f] = make_float32(tmp);
+        break;
+
+    case 8: /*a*/
+        env->regs[reg->targno & 0x0f] = tmp;
+        break;
+
+    default:
+        qemu_log("%s to reg %d of unsupported type %d\n",
+                 __func__, n, reg->type);
+        return 0;
+    }
+
+    return 4;
+}
commit d0ff8d056d3aab93b4a7b7910f938652c2febc77
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:55:44 2013 +0200

    target-lm32: Move cpu_gdb_{read,write}_register()
    
    Acked-by: Michael Walle <michael at walle.cc>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 58502f3..8a2f80c 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -578,72 +578,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_LM32)
 
-#include "hw/lm32/lm32_pic.h"
+#include "target-lm32/gdbstub.c"
 
-static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
-{
-    if (n < 32) {
-        GET_REG32(env->regs[n]);
-    } else {
-        switch (n) {
-        case 32:
-            GET_REG32(env->pc);
-        /* FIXME: put in right exception ID */
-        case 33:
-            GET_REG32(0);
-        case 34:
-            GET_REG32(env->eba);
-        case 35:
-            GET_REG32(env->deba);
-        case 36:
-            GET_REG32(env->ie);
-        case 37:
-            GET_REG32(lm32_pic_get_im(env->pic_state));
-        case 38:
-            GET_REG32(lm32_pic_get_ip(env->pic_state));
-        }
-    }
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPULM32State *env, uint8_t *mem_buf, int n)
-{
-    LM32CPU *cpu = lm32_env_get_cpu(env);
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-    uint32_t tmp;
-
-    if (n > cc->gdb_num_core_regs) {
-        return 0;
-    }
-
-    tmp = ldl_p(mem_buf);
-
-    if (n < 32) {
-        env->regs[n] = tmp;
-    } else {
-        switch (n) {
-        case 32:
-            env->pc = tmp;
-            break;
-        case 34:
-            env->eba = tmp;
-            break;
-        case 35:
-            env->deba = tmp;
-            break;
-        case 36:
-            env->ie = tmp;
-            break;
-        case 37:
-            lm32_pic_set_im(env->pic_state, tmp);
-            break;
-        case 38:
-            lm32_pic_set_ip(env->pic_state, tmp);
-            break;
-        }
-    }
-    return 4;
-}
 #elif defined(TARGET_XTENSA)
 
 static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
diff --git a/target-lm32/gdbstub.c b/target-lm32/gdbstub.c
new file mode 100644
index 0000000..732a633
--- /dev/null
+++ b/target-lm32/gdbstub.c
@@ -0,0 +1,85 @@
+/*
+ * LM32 gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#include "hw/lm32/lm32_pic.h"
+
+static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
+{
+    if (n < 32) {
+        GET_REG32(env->regs[n]);
+    } else {
+        switch (n) {
+        case 32:
+            GET_REG32(env->pc);
+        /* FIXME: put in right exception ID */
+        case 33:
+            GET_REG32(0);
+        case 34:
+            GET_REG32(env->eba);
+        case 35:
+            GET_REG32(env->deba);
+        case 36:
+            GET_REG32(env->ie);
+        case 37:
+            GET_REG32(lm32_pic_get_im(env->pic_state));
+        case 38:
+            GET_REG32(lm32_pic_get_ip(env->pic_state));
+        }
+    }
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPULM32State *env, uint8_t *mem_buf, int n)
+{
+    LM32CPU *cpu = lm32_env_get_cpu(env);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+    uint32_t tmp;
+
+    if (n > cc->gdb_num_core_regs) {
+        return 0;
+    }
+
+    tmp = ldl_p(mem_buf);
+
+    if (n < 32) {
+        env->regs[n] = tmp;
+    } else {
+        switch (n) {
+        case 32:
+            env->pc = tmp;
+            break;
+        case 34:
+            env->eba = tmp;
+            break;
+        case 35:
+            env->deba = tmp;
+            break;
+        case 36:
+            env->ie = tmp;
+            break;
+        case 37:
+            lm32_pic_set_im(env->pic_state, tmp);
+            break;
+        case 38:
+            lm32_pic_set_ip(env->pic_state, tmp);
+            break;
+        }
+    }
+    return 4;
+}
commit cfae5c905a29128372e1f8ec4a29d70e1361d07b
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:54:12 2013 +0200

    target-s390x: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 51e64bb..58502f3 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -574,66 +574,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_S390X)
 
-static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
-{
-    uint64_t val;
-    int cc_op;
-
-    switch (n) {
-    case S390_PSWM_REGNUM:
-        cc_op = calc_cc(env, env->cc_op, env->cc_src, env->cc_dst, env->cc_vr);
-        val = deposit64(env->psw.mask, 44, 2, cc_op);
-        GET_REGL(val);
-    case S390_PSWA_REGNUM:
-        GET_REGL(env->psw.addr);
-    case S390_R0_REGNUM ... S390_R15_REGNUM:
-        GET_REGL(env->regs[n-S390_R0_REGNUM]);
-    case S390_A0_REGNUM ... S390_A15_REGNUM:
-        GET_REG32(env->aregs[n-S390_A0_REGNUM]);
-    case S390_FPC_REGNUM:
-        GET_REG32(env->fpc);
-    case S390_F0_REGNUM ... S390_F15_REGNUM:
-        GET_REG64(env->fregs[n-S390_F0_REGNUM].ll);
-    }
-
-    return 0;
-}
+#include "target-s390x/gdbstub.c"
 
-static int cpu_gdb_write_register(CPUS390XState *env, uint8_t *mem_buf, int n)
-{
-    target_ulong tmpl;
-    uint32_t tmp32;
-    int r = 8;
-    tmpl = ldtul_p(mem_buf);
-    tmp32 = ldl_p(mem_buf);
-
-    switch (n) {
-    case S390_PSWM_REGNUM:
-        env->psw.mask = tmpl;
-        env->cc_op = extract64(tmpl, 44, 2);
-        break;
-    case S390_PSWA_REGNUM:
-        env->psw.addr = tmpl;
-        break;
-    case S390_R0_REGNUM ... S390_R15_REGNUM:
-        env->regs[n-S390_R0_REGNUM] = tmpl;
-        break;
-    case S390_A0_REGNUM ... S390_A15_REGNUM:
-        env->aregs[n-S390_A0_REGNUM] = tmp32;
-        r = 4;
-        break;
-    case S390_FPC_REGNUM:
-        env->fpc = tmp32;
-        r = 4;
-        break;
-    case S390_F0_REGNUM ... S390_F15_REGNUM:
-        env->fregs[n-S390_F0_REGNUM].ll = tmpl;
-        break;
-    default:
-        return 0;
-    }
-    return r;
-}
 #elif defined (TARGET_LM32)
 
 #include "hw/lm32/lm32_pic.h"
diff --git a/target-s390x/gdbstub.c b/target-s390x/gdbstub.c
new file mode 100644
index 0000000..c966143
--- /dev/null
+++ b/target-s390x/gdbstub.c
@@ -0,0 +1,80 @@
+/*
+ * s390x gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
+{
+    uint64_t val;
+    int cc_op;
+
+    switch (n) {
+    case S390_PSWM_REGNUM:
+        cc_op = calc_cc(env, env->cc_op, env->cc_src, env->cc_dst, env->cc_vr);
+        val = deposit64(env->psw.mask, 44, 2, cc_op);
+        GET_REGL(val);
+    case S390_PSWA_REGNUM:
+        GET_REGL(env->psw.addr);
+    case S390_R0_REGNUM ... S390_R15_REGNUM:
+        GET_REGL(env->regs[n-S390_R0_REGNUM]);
+    case S390_A0_REGNUM ... S390_A15_REGNUM:
+        GET_REG32(env->aregs[n-S390_A0_REGNUM]);
+    case S390_FPC_REGNUM:
+        GET_REG32(env->fpc);
+    case S390_F0_REGNUM ... S390_F15_REGNUM:
+        GET_REG64(env->fregs[n-S390_F0_REGNUM].ll);
+    }
+
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUS390XState *env, uint8_t *mem_buf, int n)
+{
+    target_ulong tmpl;
+    uint32_t tmp32;
+    int r = 8;
+    tmpl = ldtul_p(mem_buf);
+    tmp32 = ldl_p(mem_buf);
+
+    switch (n) {
+    case S390_PSWM_REGNUM:
+        env->psw.mask = tmpl;
+        env->cc_op = extract64(tmpl, 44, 2);
+        break;
+    case S390_PSWA_REGNUM:
+        env->psw.addr = tmpl;
+        break;
+    case S390_R0_REGNUM ... S390_R15_REGNUM:
+        env->regs[n-S390_R0_REGNUM] = tmpl;
+        break;
+    case S390_A0_REGNUM ... S390_A15_REGNUM:
+        env->aregs[n-S390_A0_REGNUM] = tmp32;
+        r = 4;
+        break;
+    case S390_FPC_REGNUM:
+        env->fpc = tmp32;
+        r = 4;
+        break;
+    case S390_F0_REGNUM ... S390_F15_REGNUM:
+        env->fregs[n-S390_F0_REGNUM].ll = tmpl;
+        break;
+    default:
+        return 0;
+    }
+    return r;
+}
commit c3ce8eb3c50272d81bfea30ae9a9bd959fd68a54
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:52:32 2013 +0200

    target-alpha: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 9ffb41f..51e64bb 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -570,72 +570,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_ALPHA)
 
-static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
-{
-    uint64_t val;
-    CPU_DoubleU d;
-
-    switch (n) {
-    case 0 ... 30:
-        val = env->ir[n];
-        break;
-    case 32 ... 62:
-        d.d = env->fir[n - 32];
-        val = d.ll;
-        break;
-    case 63:
-        val = cpu_alpha_load_fpcr(env);
-        break;
-    case 64:
-        val = env->pc;
-        break;
-    case 66:
-        val = env->unique;
-        break;
-    case 31:
-    case 65:
-        /* 31 really is the zero register; 65 is unassigned in the
-           gdb protocol, but is still required to occupy 8 bytes. */
-        val = 0;
-        break;
-    default:
-        return 0;
-    }
-    GET_REGL(val);
-}
+#include "target-alpha/gdbstub.c"
 
-static int cpu_gdb_write_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
-{
-    target_ulong tmp = ldtul_p(mem_buf);
-    CPU_DoubleU d;
-
-    switch (n) {
-    case 0 ... 30:
-        env->ir[n] = tmp;
-        break;
-    case 32 ... 62:
-        d.ll = tmp;
-        env->fir[n - 32] = d.d;
-        break;
-    case 63:
-        cpu_alpha_store_fpcr(env, tmp);
-        break;
-    case 64:
-        env->pc = tmp;
-        break;
-    case 66:
-        env->unique = tmp;
-        break;
-    case 31:
-    case 65:
-        /* 31 really is the zero register; 65 is unassigned in the
-           gdb protocol, but is still required to occupy 8 bytes. */
-        break;
-    default:
-        return 0;
-    }
-    return 8;
-}
 #elif defined (TARGET_S390X)
 
 static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
diff --git a/target-alpha/gdbstub.c b/target-alpha/gdbstub.c
new file mode 100644
index 0000000..b23afe4
--- /dev/null
+++ b/target-alpha/gdbstub.c
@@ -0,0 +1,86 @@
+/*
+ * Alpha gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
+{
+    uint64_t val;
+    CPU_DoubleU d;
+
+    switch (n) {
+    case 0 ... 30:
+        val = env->ir[n];
+        break;
+    case 32 ... 62:
+        d.d = env->fir[n - 32];
+        val = d.ll;
+        break;
+    case 63:
+        val = cpu_alpha_load_fpcr(env);
+        break;
+    case 64:
+        val = env->pc;
+        break;
+    case 66:
+        val = env->unique;
+        break;
+    case 31:
+    case 65:
+        /* 31 really is the zero register; 65 is unassigned in the
+           gdb protocol, but is still required to occupy 8 bytes. */
+        val = 0;
+        break;
+    default:
+        return 0;
+    }
+    GET_REGL(val);
+}
+
+static int cpu_gdb_write_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
+{
+    target_ulong tmp = ldtul_p(mem_buf);
+    CPU_DoubleU d;
+
+    switch (n) {
+    case 0 ... 30:
+        env->ir[n] = tmp;
+        break;
+    case 32 ... 62:
+        d.ll = tmp;
+        env->fir[n - 32] = d.d;
+        break;
+    case 63:
+        cpu_alpha_store_fpcr(env, tmp);
+        break;
+    case 64:
+        env->pc = tmp;
+        break;
+    case 66:
+        env->unique = tmp;
+        break;
+    case 31:
+    case 65:
+        /* 31 really is the zero register; 65 is unassigned in the
+           gdb protocol, but is still required to occupy 8 bytes. */
+        break;
+    default:
+        return 0;
+    }
+    return 8;
+}
commit 213c19d69fb9c7537afb8539bbdf12dba90ba0ef
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:50:22 2013 +0200

    target-cris: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index ab030b5..9ffb41f 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -566,111 +566,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_CRIS)
 
-static int
-read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 15) {
-        GET_REG32(env->regs[n]);
-    }
-
-    if (n == 15) {
-        GET_REG32(env->pc);
-    }
-
-    if (n < 32) {
-        switch (n) {
-        case 16:
-            GET_REG8(env->pregs[n - 16]);
-        case 17:
-            GET_REG8(env->pregs[n - 16]);
-        case 20:
-        case 21:
-            GET_REG16(env->pregs[n - 16]);
-        default:
-            if (n >= 23) {
-                GET_REG32(env->pregs[n - 16]);
-            }
-            break;
-        }
-    }
-    return 0;
-}
-
-static int cpu_gdb_read_register(CPUCRISState *env, uint8_t *mem_buf, int n)
-{
-    uint8_t srs;
-
-    if (env->pregs[PR_VR] < 32) {
-        return read_register_crisv10(env, mem_buf, n);
-    }
-
-    srs = env->pregs[PR_SRS];
-    if (n < 16) {
-        GET_REG32(env->regs[n]);
-    }
-
-    if (n >= 21 && n < 32) {
-        GET_REG32(env->pregs[n - 16]);
-    }
-    if (n >= 33 && n < 49) {
-        GET_REG32(env->sregs[srs][n - 33]);
-    }
-    switch (n) {
-    case 16:
-        GET_REG8(env->pregs[0]);
-    case 17:
-        GET_REG8(env->pregs[1]);
-    case 18:
-        GET_REG32(env->pregs[2]);
-    case 19:
-        GET_REG8(srs);
-    case 20:
-        GET_REG16(env->pregs[4]);
-    case 32:
-        GET_REG32(env->pc);
-    }
-
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUCRISState *env, uint8_t *mem_buf, int n)
-{
-    uint32_t tmp;
-
-    if (n > 49) {
-        return 0;
-    }
-
-    tmp = ldl_p(mem_buf);
-
-    if (n < 16) {
-        env->regs[n] = tmp;
-    }
-
-    if (n >= 21 && n < 32) {
-        env->pregs[n - 16] = tmp;
-    }
-
-    /* FIXME: Should support function regs be writable?  */
-    switch (n) {
-    case 16:
-        return 1;
-    case 17:
-        return 1;
-    case 18:
-        env->pregs[PR_PID] = tmp;
-        break;
-    case 19:
-        return 1;
-    case 20:
-        return 2;
-    case 32:
-        env->pc = tmp;
-        break;
-    }
+#include "target-cris/gdbstub.c"
 
-    return 4;
-}
 #elif defined (TARGET_ALPHA)
 
 static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
diff --git a/target-cris/gdbstub.c b/target-cris/gdbstub.c
new file mode 100644
index 0000000..b48224a
--- /dev/null
+++ b/target-cris/gdbstub.c
@@ -0,0 +1,125 @@
+/*
+ * CRIS gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int
+read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 15) {
+        GET_REG32(env->regs[n]);
+    }
+
+    if (n == 15) {
+        GET_REG32(env->pc);
+    }
+
+    if (n < 32) {
+        switch (n) {
+        case 16:
+            GET_REG8(env->pregs[n - 16]);
+        case 17:
+            GET_REG8(env->pregs[n - 16]);
+        case 20:
+        case 21:
+            GET_REG16(env->pregs[n - 16]);
+        default:
+            if (n >= 23) {
+                GET_REG32(env->pregs[n - 16]);
+            }
+            break;
+        }
+    }
+    return 0;
+}
+
+static int cpu_gdb_read_register(CPUCRISState *env, uint8_t *mem_buf, int n)
+{
+    uint8_t srs;
+
+    if (env->pregs[PR_VR] < 32) {
+        return read_register_crisv10(env, mem_buf, n);
+    }
+
+    srs = env->pregs[PR_SRS];
+    if (n < 16) {
+        GET_REG32(env->regs[n]);
+    }
+
+    if (n >= 21 && n < 32) {
+        GET_REG32(env->pregs[n - 16]);
+    }
+    if (n >= 33 && n < 49) {
+        GET_REG32(env->sregs[srs][n - 33]);
+    }
+    switch (n) {
+    case 16:
+        GET_REG8(env->pregs[0]);
+    case 17:
+        GET_REG8(env->pregs[1]);
+    case 18:
+        GET_REG32(env->pregs[2]);
+    case 19:
+        GET_REG8(srs);
+    case 20:
+        GET_REG16(env->pregs[4]);
+    case 32:
+        GET_REG32(env->pc);
+    }
+
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUCRISState *env, uint8_t *mem_buf, int n)
+{
+    uint32_t tmp;
+
+    if (n > 49) {
+        return 0;
+    }
+
+    tmp = ldl_p(mem_buf);
+
+    if (n < 16) {
+        env->regs[n] = tmp;
+    }
+
+    if (n >= 21 && n < 32) {
+        env->pregs[n - 16] = tmp;
+    }
+
+    /* FIXME: Should support function regs be writable?  */
+    switch (n) {
+    case 16:
+        return 1;
+    case 17:
+        return 1;
+    case 18:
+        env->pregs[PR_PID] = tmp;
+        break;
+    case 19:
+        return 1;
+    case 20:
+        return 2;
+    case 32:
+        env->pc = tmp;
+        break;
+    }
+
+    return 4;
+}
commit eabfc2398f3e4e553843c15b1e3a3af2a52a7fcb
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:45:47 2013 +0200

    target-microblaze: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 61b1bc7..ab030b5 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -562,35 +562,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_MICROBLAZE)
 
-static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 32) {
-        GET_REG32(env->regs[n]);
-    } else {
-        GET_REG32(env->sregs[n - 32]);
-    }
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUMBState *env, uint8_t *mem_buf, int n)
-{
-    MicroBlazeCPU *cpu = mb_env_get_cpu(env);
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-    uint32_t tmp;
+#include "target-microblaze/gdbstub.c"
 
-    if (n > cc->gdb_num_core_regs) {
-        return 0;
-    }
-
-    tmp = ldl_p(mem_buf);
-
-    if (n < 32) {
-        env->regs[n] = tmp;
-    } else {
-        env->sregs[n - 32] = tmp;
-    }
-    return 4;
-}
 #elif defined (TARGET_CRIS)
 
 static int
diff --git a/target-microblaze/gdbstub.c b/target-microblaze/gdbstub.c
new file mode 100644
index 0000000..96c4bc0
--- /dev/null
+++ b/target-microblaze/gdbstub.c
@@ -0,0 +1,49 @@
+/*
+ * MicroBlaze gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 32) {
+        GET_REG32(env->regs[n]);
+    } else {
+        GET_REG32(env->sregs[n - 32]);
+    }
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUMBState *env, uint8_t *mem_buf, int n)
+{
+    MicroBlazeCPU *cpu = mb_env_get_cpu(env);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+    uint32_t tmp;
+
+    if (n > cc->gdb_num_core_regs) {
+        return 0;
+    }
+
+    tmp = ldl_p(mem_buf);
+
+    if (n < 32) {
+        env->regs[n] = tmp;
+    } else {
+        env->sregs[n - 32] = tmp;
+    }
+    return 4;
+}
commit 2f93773241f99457a0957a43b2490be6f594cfa7
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:42:52 2013 +0200

    target-sh4: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 7bcdd3f..61b1bc7 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -558,123 +558,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_SH4)
 
-/* Hint: Use "set architecture sh4" in GDB to see fpu registers */
-/* FIXME: We should use XML for this.  */
+#include "target-sh4/gdbstub.c"
 
-static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
-{
-    switch (n) {
-    case 0 ... 7:
-        if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
-            GET_REGL(env->gregs[n + 16]);
-        } else {
-            GET_REGL(env->gregs[n]);
-        }
-    case 8 ... 15:
-        GET_REGL(env->gregs[n]);
-    case 16:
-        GET_REGL(env->pc);
-    case 17:
-        GET_REGL(env->pr);
-    case 18:
-        GET_REGL(env->gbr);
-    case 19:
-        GET_REGL(env->vbr);
-    case 20:
-        GET_REGL(env->mach);
-    case 21:
-        GET_REGL(env->macl);
-    case 22:
-        GET_REGL(env->sr);
-    case 23:
-        GET_REGL(env->fpul);
-    case 24:
-        GET_REGL(env->fpscr);
-    case 25 ... 40:
-        if (env->fpscr & FPSCR_FR) {
-            stfl_p(mem_buf, env->fregs[n - 9]);
-        } else {
-            stfl_p(mem_buf, env->fregs[n - 25]);
-        }
-        return 4;
-    case 41:
-        GET_REGL(env->ssr);
-    case 42:
-        GET_REGL(env->spc);
-    case 43 ... 50:
-        GET_REGL(env->gregs[n - 43]);
-    case 51 ... 58:
-        GET_REGL(env->gregs[n - (51 - 16)]);
-    }
-
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
-{
-    switch (n) {
-    case 0 ... 7:
-        if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
-            env->gregs[n + 16] = ldl_p(mem_buf);
-        } else {
-            env->gregs[n] = ldl_p(mem_buf);
-        }
-        break;
-    case 8 ... 15:
-        env->gregs[n] = ldl_p(mem_buf);
-        break;
-    case 16:
-        env->pc = ldl_p(mem_buf);
-        break;
-    case 17:
-        env->pr = ldl_p(mem_buf);
-        break;
-    case 18:
-        env->gbr = ldl_p(mem_buf);
-        break;
-    case 19:
-        env->vbr = ldl_p(mem_buf);
-        break;
-    case 20:
-        env->mach = ldl_p(mem_buf);
-        break;
-    case 21:
-        env->macl = ldl_p(mem_buf);
-        break;
-    case 22:
-        env->sr = ldl_p(mem_buf);
-        break;
-    case 23:
-        env->fpul = ldl_p(mem_buf);
-        break;
-    case 24:
-        env->fpscr = ldl_p(mem_buf);
-        break;
-    case 25 ... 40:
-        if (env->fpscr & FPSCR_FR) {
-            env->fregs[n - 9] = ldfl_p(mem_buf);
-        } else {
-            env->fregs[n - 25] = ldfl_p(mem_buf);
-        }
-        break;
-    case 41:
-        env->ssr = ldl_p(mem_buf);
-        break;
-    case 42:
-        env->spc = ldl_p(mem_buf);
-        break;
-    case 43 ... 50:
-        env->gregs[n - 43] = ldl_p(mem_buf);
-        break;
-    case 51 ... 58:
-        env->gregs[n - (51 - 16)] = ldl_p(mem_buf);
-        break;
-    default:
-        return 0;
-    }
-
-    return 4;
-}
 #elif defined (TARGET_MICROBLAZE)
 
 static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
diff --git a/target-sh4/gdbstub.c b/target-sh4/gdbstub.c
new file mode 100644
index 0000000..38bc630
--- /dev/null
+++ b/target-sh4/gdbstub.c
@@ -0,0 +1,137 @@
+/*
+ * SuperH gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* Hint: Use "set architecture sh4" in GDB to see fpu registers */
+/* FIXME: We should use XML for this.  */
+
+static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
+{
+    switch (n) {
+    case 0 ... 7:
+        if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
+            GET_REGL(env->gregs[n + 16]);
+        } else {
+            GET_REGL(env->gregs[n]);
+        }
+    case 8 ... 15:
+        GET_REGL(env->gregs[n]);
+    case 16:
+        GET_REGL(env->pc);
+    case 17:
+        GET_REGL(env->pr);
+    case 18:
+        GET_REGL(env->gbr);
+    case 19:
+        GET_REGL(env->vbr);
+    case 20:
+        GET_REGL(env->mach);
+    case 21:
+        GET_REGL(env->macl);
+    case 22:
+        GET_REGL(env->sr);
+    case 23:
+        GET_REGL(env->fpul);
+    case 24:
+        GET_REGL(env->fpscr);
+    case 25 ... 40:
+        if (env->fpscr & FPSCR_FR) {
+            stfl_p(mem_buf, env->fregs[n - 9]);
+        } else {
+            stfl_p(mem_buf, env->fregs[n - 25]);
+        }
+        return 4;
+    case 41:
+        GET_REGL(env->ssr);
+    case 42:
+        GET_REGL(env->spc);
+    case 43 ... 50:
+        GET_REGL(env->gregs[n - 43]);
+    case 51 ... 58:
+        GET_REGL(env->gregs[n - (51 - 16)]);
+    }
+
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
+{
+    switch (n) {
+    case 0 ... 7:
+        if ((env->sr & (SR_MD | SR_RB)) == (SR_MD | SR_RB)) {
+            env->gregs[n + 16] = ldl_p(mem_buf);
+        } else {
+            env->gregs[n] = ldl_p(mem_buf);
+        }
+        break;
+    case 8 ... 15:
+        env->gregs[n] = ldl_p(mem_buf);
+        break;
+    case 16:
+        env->pc = ldl_p(mem_buf);
+        break;
+    case 17:
+        env->pr = ldl_p(mem_buf);
+        break;
+    case 18:
+        env->gbr = ldl_p(mem_buf);
+        break;
+    case 19:
+        env->vbr = ldl_p(mem_buf);
+        break;
+    case 20:
+        env->mach = ldl_p(mem_buf);
+        break;
+    case 21:
+        env->macl = ldl_p(mem_buf);
+        break;
+    case 22:
+        env->sr = ldl_p(mem_buf);
+        break;
+    case 23:
+        env->fpul = ldl_p(mem_buf);
+        break;
+    case 24:
+        env->fpscr = ldl_p(mem_buf);
+        break;
+    case 25 ... 40:
+        if (env->fpscr & FPSCR_FR) {
+            env->fregs[n - 9] = ldfl_p(mem_buf);
+        } else {
+            env->fregs[n - 25] = ldfl_p(mem_buf);
+        }
+        break;
+    case 41:
+        env->ssr = ldl_p(mem_buf);
+        break;
+    case 42:
+        env->spc = ldl_p(mem_buf);
+        break;
+    case 43 ... 50:
+        env->gregs[n - 43] = ldl_p(mem_buf);
+        break;
+    case 51 ... 58:
+        env->gregs[n - (51 - 16)] = ldl_p(mem_buf);
+        break;
+    default:
+        return 0;
+    }
+
+    return 4;
+}
commit 30028739eb6b2e95b94b957f3b4f8f258da3aa88
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:40:38 2013 +0200

    target-openrisc: Move cpu_gdb_{read,write}_register()
    
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 7ee0870..7bcdd3f 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -554,63 +554,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined(TARGET_OPENRISC)
 
-static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 32) {
-        GET_REG32(env->gpr[n]);
-    } else {
-        switch (n) {
-        case 32:    /* PPC */
-            GET_REG32(env->ppc);
-
-        case 33:    /* NPC */
-            GET_REG32(env->npc);
-
-        case 34:    /* SR */
-            GET_REG32(env->sr);
-
-        default:
-            break;
-        }
-    }
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUOpenRISCState *env,
-                                  uint8_t *mem_buf, int n)
-{
-    OpenRISCCPU *cpu = openrisc_env_get_cpu(env);
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-    uint32_t tmp;
-
-    if (n > cc->gdb_num_core_regs) {
-        return 0;
-    }
-
-    tmp = ldl_p(mem_buf);
-
-    if (n < 32) {
-        env->gpr[n] = tmp;
-    } else {
-        switch (n) {
-        case 32: /* PPC */
-            env->ppc = tmp;
-            break;
+#include "target-openrisc/gdbstub.c"
 
-        case 33: /* NPC */
-            env->npc = tmp;
-            break;
-
-        case 34: /* SR */
-            env->sr = tmp;
-            break;
-
-        default:
-            break;
-        }
-    }
-    return 4;
-}
 #elif defined (TARGET_SH4)
 
 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
diff --git a/target-openrisc/gdbstub.c b/target-openrisc/gdbstub.c
new file mode 100644
index 0000000..fba096a
--- /dev/null
+++ b/target-openrisc/gdbstub.c
@@ -0,0 +1,77 @@
+/*
+ * OpenRISC gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 32) {
+        GET_REG32(env->gpr[n]);
+    } else {
+        switch (n) {
+        case 32:    /* PPC */
+            GET_REG32(env->ppc);
+
+        case 33:    /* NPC */
+            GET_REG32(env->npc);
+
+        case 34:    /* SR */
+            GET_REG32(env->sr);
+
+        default:
+            break;
+        }
+    }
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUOpenRISCState *env,
+                                  uint8_t *mem_buf, int n)
+{
+    OpenRISCCPU *cpu = openrisc_env_get_cpu(env);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+    uint32_t tmp;
+
+    if (n > cc->gdb_num_core_regs) {
+        return 0;
+    }
+
+    tmp = ldl_p(mem_buf);
+
+    if (n < 32) {
+        env->gpr[n] = tmp;
+    } else {
+        switch (n) {
+        case 32: /* PPC */
+            env->ppc = tmp;
+            break;
+
+        case 33: /* NPC */
+            env->npc = tmp;
+            break;
+
+        case 34: /* SR */
+            env->sr = tmp;
+            break;
+
+        default:
+            break;
+        }
+    }
+    return 4;
+}
commit b96919e068388309b655c7dc1afa41706d728efd
Author: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
Date:   Fri Jul 26 21:42:51 2013 +0100

    sun4m: add display width and height to the firmware configuration
    
    Currently the graphics resolution for TCX is fixed at 1024x768, however
    other framebuffers are capable of supporting additional resolutions.
    
    Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    CC: Anthony Liguori <aliguori at us.ibm.com>
    CC: Blue Swirl <blauwirbel at gmail.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 7a0c1ab..5c7bd31 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -66,6 +66,8 @@
 #define PROM_FILENAME        "openbios-sparc32"
 #define CFG_ADDR             0xd00000510ULL
 #define FW_CFG_SUN4M_DEPTH   (FW_CFG_ARCH_LOCAL + 0x00)
+#define FW_CFG_SUN4M_WIDTH   (FW_CFG_ARCH_LOCAL + 0x01)
+#define FW_CFG_SUN4M_HEIGHT  (FW_CFG_ARCH_LOCAL + 0x02)
 
 #define MAX_CPUS 16
 #define MAX_PILS 16
@@ -991,6 +993,8 @@ static void sun4m_hw_init(const struct sun4m_hwdef *hwdef, ram_addr_t RAM_size,
     fw_cfg_add_i64(fw_cfg, FW_CFG_RAM_SIZE, (uint64_t)ram_size);
     fw_cfg_add_i16(fw_cfg, FW_CFG_MACHINE_ID, hwdef->machine_id);
     fw_cfg_add_i16(fw_cfg, FW_CFG_SUN4M_DEPTH, graphic_depth);
+    fw_cfg_add_i16(fw_cfg, FW_CFG_SUN4M_WIDTH, graphic_width);
+    fw_cfg_add_i16(fw_cfg, FW_CFG_SUN4M_HEIGHT, graphic_height);
     fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, KERNEL_LOAD_ADDR);
     fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, kernel_size);
     if (kernel_cmdline) {
commit 405c97c3a5950d8a49b90cb977e33b6b3f9a8f95
Merge: 2fb861e e340936
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jul 26 16:54:19 2013 -0500

    Merge remote-tracking branch 'kwolf/for-anthony' into staging
    
    # By Kevin Wolf (16) and Ian Main (2)
    # Via Kevin Wolf
    * kwolf/for-anthony:
      Add tests for sync modes 'TOP' and 'NONE'
      Implement sync modes for drive-backup.
      Implement qdict_flatten()
      blockdev: Split up 'cache' option
      blockdev: Rename 'readonly' option to 'read-only'
      qcow2: Use dashes instead of underscores in options
      blockdev: Rename I/O throttling options for QMP
      QemuOpts: Add qemu_opt_unset()
      block: Allow "driver" option on the top level
      qapi: Anonymous unions
      qapi.py: Maintain a list of union types
      qapi: Add consume argument to qmp_input_get_object()
      qapi: Flat unions with arbitrary discriminator
      qapi: Add visitor for implicit structs
      docs: Document QAPI union types
      qapi-visit.py: Implement 'base' for unions
      qapi-visit.py: Split off generate_visit_struct_fields()
      qapi-types.py: Implement 'base' for unions
    
    Message-id: 1374870032-31672-1-git-send-email-kwolf at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 2fb861eb02f0955876e15b3de1f9c2d1f469dcf2
Author: Eduardo Otubo <otubo at linux.vnet.ibm.com>
Date:   Mon Jul 22 15:33:37 2013 -0300

    seccomp: removing unused syscalls gtom whitelist
    
    v3 update:
     - reincluding getrlimit(), it is used by Xen.
    
    v2 update:
     - reincluding setrlimit(), it is used by Xen.
    
    Signed-off-by: Eduardo Otubo <otubo at linux.vnet.ibm.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1374518017-10424-3-git-send-email-otubo at linux.vnet.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 1d5fd71..3298de8 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -108,7 +108,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(lseek), 245 },
     { SCMP_SYS(pselect6), 245 },
     { SCMP_SYS(fork), 245 },
-    { SCMP_SYS(eventfd), 245 },
     { SCMP_SYS(rt_sigprocmask), 245 },
     { SCMP_SYS(write), 244 },
     { SCMP_SYS(fcntl), 243 },
@@ -144,7 +143,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(newfstatat), 241 },
     { SCMP_SYS(shutdown), 241 },
     { SCMP_SYS(getsockopt), 241 },
-    { SCMP_SYS(semctl), 241 },
     { SCMP_SYS(semop), 241 },
     { SCMP_SYS(semtimedop), 241 },
     { SCMP_SYS(epoll_ctl_old), 241 },
@@ -192,12 +190,10 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(lchown), 241 },
     { SCMP_SYS(fchownat), 241 },
     { SCMP_SYS(fstatfs), 241 },
-    { SCMP_SYS(sendfile), 241 },
     { SCMP_SYS(getitimer), 241 },
     { SCMP_SYS(syncfs), 241 },
     { SCMP_SYS(fsync), 241 },
     { SCMP_SYS(fchdir), 241 },
-    { SCMP_SYS(flock), 241 },
     { SCMP_SYS(msync), 241 },
     { SCMP_SYS(sched_setparam), 241 },
     { SCMP_SYS(sched_setscheduler), 241 },
commit 7d7b2ad43603d6c130b64bdc064bb8572505bb25
Author: Eduardo Otubo <otubo at linux.vnet.ibm.com>
Date:   Mon Jul 22 15:33:36 2013 -0300

    seccomp: no need to check arch in syscall whitelist
    
    v2 update:
    - set libseccomp 2.1.0 as requirement on configure script.
    
    Since libseccomp 2.0 there's no need to check the architecture type
    anymore.
    
    Signed-off-by: Eduardo Otubo <otubo at linux.vnet.ibm.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1374518017-10424-2-git-send-email-otubo at linux.vnet.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/configure b/configure
index f5e299a..1c0cc81 100755
--- a/configure
+++ b/configure
@@ -1469,7 +1469,7 @@ libs_softmmu="$libs_softmmu -lz"
 # libseccomp check
 
 if test "$seccomp" != "no" ; then
-    if $pkg_config --atleast-version=1.0.0 libseccomp --modversion >/dev/null 2>&1; then
+    if $pkg_config --atleast-version=2.1.0 libseccomp --modversion >/dev/null 2>&1; then
         libs_softmmu="$libs_softmmu `$pkg_config --libs libseccomp`"
         QEMU_CFLAGS="$QEMU_CFLAGS `$pkg_config --cflags libseccomp`"
 	seccomp="yes"
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index ca123bf..1d5fd71 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -26,12 +26,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(timer_gettime), 254 },
     { SCMP_SYS(futex), 253 },
     { SCMP_SYS(select), 252 },
-#if defined(__x86_64__)
     { SCMP_SYS(recvfrom), 251 },
     { SCMP_SYS(sendto), 250 },
-#elif defined(__i386__)
     { SCMP_SYS(socketcall), 250 },
-#endif
     { SCMP_SYS(read), 249 },
     { SCMP_SYS(brk), 248 },
     { SCMP_SYS(clone), 247 },
@@ -40,7 +37,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(execve), 245 },
     { SCMP_SYS(open), 245 },
     { SCMP_SYS(ioctl), 245 },
-#if defined(__x86_64__)
     { SCMP_SYS(socket), 245 },
     { SCMP_SYS(setsockopt), 245 },
     { SCMP_SYS(recvmsg), 245 },
@@ -51,9 +47,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(bind), 245 },
     { SCMP_SYS(listen), 245 },
     { SCMP_SYS(semget), 245 },
-#elif defined(__i386__)
     { SCMP_SYS(ipc), 245 },
-#endif
     { SCMP_SYS(gettimeofday), 245 },
     { SCMP_SYS(readlink), 245 },
     { SCMP_SYS(access), 245 },
@@ -64,7 +58,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(statfs), 245 },
     { SCMP_SYS(unlink), 245 },
     { SCMP_SYS(wait4), 245 },
-#if defined(__i386__)
     { SCMP_SYS(fcntl64), 245 },
     { SCMP_SYS(fstat64), 245 },
     { SCMP_SYS(stat64), 245 },
@@ -77,7 +70,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(_llseek), 245 },
     { SCMP_SYS(mmap2), 245 },
     { SCMP_SYS(sigprocmask), 245 },
-#endif
     { SCMP_SYS(sched_getparam), 245 },
     { SCMP_SYS(sched_getscheduler), 245 },
     { SCMP_SYS(fstat), 245 },
@@ -145,9 +137,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(epoll_create), 242 },
     { SCMP_SYS(epoll_ctl), 242 },
     { SCMP_SYS(epoll_wait), 242 },
-#if defined(__i386__)
     { SCMP_SYS(waitpid), 242 },
-#elif defined(__x86_64__)
     { SCMP_SYS(getsockname), 242 },
     { SCMP_SYS(getpeername), 242 },
     { SCMP_SYS(accept4), 242 },
@@ -159,7 +149,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(semtimedop), 241 },
     { SCMP_SYS(epoll_ctl_old), 241 },
     { SCMP_SYS(epoll_wait_old), 241 },
-#endif
     { SCMP_SYS(epoll_pwait), 241 },
     { SCMP_SYS(epoll_create1), 241 },
     { SCMP_SYS(ppoll), 241 },
@@ -174,7 +163,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(getresuid), 241 },
     { SCMP_SYS(getresgid), 241 },
     { SCMP_SYS(getgroups), 241 },
-#if defined(__i386__)
     { SCMP_SYS(getresuid32), 241 },
     { SCMP_SYS(getresgid32), 241 },
     { SCMP_SYS(getgroups32), 241 },
@@ -193,7 +181,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(lstat64), 241 },
     { SCMP_SYS(sendfile64), 241 },
     { SCMP_SYS(ugetrlimit), 241 },
-#endif
     { SCMP_SYS(alarm), 241 },
     { SCMP_SYS(rt_sigsuspend), 241 },
     { SCMP_SYS(rt_sigqueueinfo), 241 },
commit 814ac26c2d3820b85f05b696735d4e1e6d7d05aa
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:38:42 2013 +0200

    target-mips: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 3ed2bfe..7ee0870 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -550,130 +550,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_MIPS)
 
-static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 32) {
-        GET_REGL(env->active_tc.gpr[n]);
-    }
-    if (env->CP0_Config1 & (1 << CP0C1_FP)) {
-        if (n >= 38 && n < 70) {
-            if (env->CP0_Status & (1 << CP0St_FR)) {
-                GET_REGL(env->active_fpu.fpr[n - 38].d);
-            } else {
-                GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
-            }
-        }
-        switch (n) {
-        case 70:
-            GET_REGL((int32_t)env->active_fpu.fcr31);
-        case 71:
-            GET_REGL((int32_t)env->active_fpu.fcr0);
-        }
-    }
-    switch (n) {
-    case 32:
-        GET_REGL((int32_t)env->CP0_Status);
-    case 33:
-        GET_REGL(env->active_tc.LO[0]);
-    case 34:
-        GET_REGL(env->active_tc.HI[0]);
-    case 35:
-        GET_REGL(env->CP0_BadVAddr);
-    case 36:
-        GET_REGL((int32_t)env->CP0_Cause);
-    case 37:
-        GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
-    case 72:
-        GET_REGL(0); /* fp */
-    case 89:
-        GET_REGL((int32_t)env->CP0_PRid);
-    }
-    if (n >= 73 && n <= 88) {
-        /* 16 embedded regs.  */
-        GET_REGL(0);
-    }
-
-    return 0;
-}
-
-/* convert MIPS rounding mode in FCR31 to IEEE library */
-static unsigned int ieee_rm[] = {
-    float_round_nearest_even,
-    float_round_to_zero,
-    float_round_up,
-    float_round_down
-};
-#define RESTORE_ROUNDING_MODE \
-    set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], \
-                            &env->active_fpu.fp_status)
-
-static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
-{
-    target_ulong tmp;
-
-    tmp = ldtul_p(mem_buf);
-
-    if (n < 32) {
-        env->active_tc.gpr[n] = tmp;
-        return sizeof(target_ulong);
-    }
-    if (env->CP0_Config1 & (1 << CP0C1_FP)
-            && n >= 38 && n < 73) {
-        if (n < 70) {
-            if (env->CP0_Status & (1 << CP0St_FR)) {
-                env->active_fpu.fpr[n - 38].d = tmp;
-            } else {
-                env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
-            }
-        }
-        switch (n) {
-        case 70:
-            env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
-            /* set rounding mode */
-            RESTORE_ROUNDING_MODE;
-            break;
-        case 71:
-            env->active_fpu.fcr0 = tmp;
-            break;
-        }
-        return sizeof(target_ulong);
-    }
-    switch (n) {
-    case 32:
-        env->CP0_Status = tmp;
-        break;
-    case 33:
-        env->active_tc.LO[0] = tmp;
-        break;
-    case 34:
-        env->active_tc.HI[0] = tmp;
-        break;
-    case 35:
-        env->CP0_BadVAddr = tmp;
-        break;
-    case 36:
-        env->CP0_Cause = tmp;
-        break;
-    case 37:
-        env->active_tc.PC = tmp & ~(target_ulong)1;
-        if (tmp & 1) {
-            env->hflags |= MIPS_HFLAG_M16;
-        } else {
-            env->hflags &= ~(MIPS_HFLAG_M16);
-        }
-        break;
-    case 72: /* fp, ignored */
-        break;
-    default:
-        if (n > 89) {
-            return 0;
-        }
-        /* Other registers are readonly.  Ignore writes.  */
-        break;
-    }
+#include "target-mips/gdbstub.c"
 
-    return sizeof(target_ulong);
-}
 #elif defined(TARGET_OPENRISC)
 
 static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
diff --git a/target-mips/gdbstub.c b/target-mips/gdbstub.c
new file mode 100644
index 0000000..15dc281
--- /dev/null
+++ b/target-mips/gdbstub.c
@@ -0,0 +1,144 @@
+/*
+ * MIPS gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 32) {
+        GET_REGL(env->active_tc.gpr[n]);
+    }
+    if (env->CP0_Config1 & (1 << CP0C1_FP)) {
+        if (n >= 38 && n < 70) {
+            if (env->CP0_Status & (1 << CP0St_FR)) {
+                GET_REGL(env->active_fpu.fpr[n - 38].d);
+            } else {
+                GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
+            }
+        }
+        switch (n) {
+        case 70:
+            GET_REGL((int32_t)env->active_fpu.fcr31);
+        case 71:
+            GET_REGL((int32_t)env->active_fpu.fcr0);
+        }
+    }
+    switch (n) {
+    case 32:
+        GET_REGL((int32_t)env->CP0_Status);
+    case 33:
+        GET_REGL(env->active_tc.LO[0]);
+    case 34:
+        GET_REGL(env->active_tc.HI[0]);
+    case 35:
+        GET_REGL(env->CP0_BadVAddr);
+    case 36:
+        GET_REGL((int32_t)env->CP0_Cause);
+    case 37:
+        GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
+    case 72:
+        GET_REGL(0); /* fp */
+    case 89:
+        GET_REGL((int32_t)env->CP0_PRid);
+    }
+    if (n >= 73 && n <= 88) {
+        /* 16 embedded regs.  */
+        GET_REGL(0);
+    }
+
+    return 0;
+}
+
+/* convert MIPS rounding mode in FCR31 to IEEE library */
+static unsigned int ieee_rm[] = {
+    float_round_nearest_even,
+    float_round_to_zero,
+    float_round_up,
+    float_round_down
+};
+#define RESTORE_ROUNDING_MODE \
+    set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], \
+                            &env->active_fpu.fp_status)
+
+static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
+{
+    target_ulong tmp;
+
+    tmp = ldtul_p(mem_buf);
+
+    if (n < 32) {
+        env->active_tc.gpr[n] = tmp;
+        return sizeof(target_ulong);
+    }
+    if (env->CP0_Config1 & (1 << CP0C1_FP)
+            && n >= 38 && n < 73) {
+        if (n < 70) {
+            if (env->CP0_Status & (1 << CP0St_FR)) {
+                env->active_fpu.fpr[n - 38].d = tmp;
+            } else {
+                env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
+            }
+        }
+        switch (n) {
+        case 70:
+            env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
+            /* set rounding mode */
+            RESTORE_ROUNDING_MODE;
+            break;
+        case 71:
+            env->active_fpu.fcr0 = tmp;
+            break;
+        }
+        return sizeof(target_ulong);
+    }
+    switch (n) {
+    case 32:
+        env->CP0_Status = tmp;
+        break;
+    case 33:
+        env->active_tc.LO[0] = tmp;
+        break;
+    case 34:
+        env->active_tc.HI[0] = tmp;
+        break;
+    case 35:
+        env->CP0_BadVAddr = tmp;
+        break;
+    case 36:
+        env->CP0_Cause = tmp;
+        break;
+    case 37:
+        env->active_tc.PC = tmp & ~(target_ulong)1;
+        if (tmp & 1) {
+            env->hflags |= MIPS_HFLAG_M16;
+        } else {
+            env->hflags &= ~(MIPS_HFLAG_M16);
+        }
+        break;
+    case 72: /* fp, ignored */
+        break;
+    default:
+        if (n > 89) {
+            return 0;
+        }
+        /* Other registers are readonly.  Ignore writes.  */
+        break;
+    }
+
+    return sizeof(target_ulong);
+}
commit c88de14ca45257feb82e23f3ff07e861010bd5ba
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:33:56 2013 +0200

    target-m68k: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 73e6411..3ed2bfe 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -546,53 +546,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #define GDB_CORE_XML "cf-core.xml"
 
-static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 8) {
-        /* D0-D7 */
-        GET_REG32(env->dregs[n]);
-    } else if (n < 16) {
-        /* A0-A7 */
-        GET_REG32(env->aregs[n - 8]);
-    } else {
-        switch (n) {
-        case 16:
-            GET_REG32(env->sr);
-        case 17:
-            GET_REG32(env->pc);
-        }
-    }
-    /* FP registers not included here because they vary between
-       ColdFire and m68k.  Use XML bits for these.  */
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUM68KState *env, uint8_t *mem_buf, int n)
-{
-    uint32_t tmp;
-
-    tmp = ldl_p(mem_buf);
+#include "target-m68k/gdbstub.c"
 
-    if (n < 8) {
-        /* D0-D7 */
-        env->dregs[n] = tmp;
-    } else if (n < 16) {
-        /* A0-A7 */
-        env->aregs[n - 8] = tmp;
-    } else {
-        switch (n) {
-        case 16:
-            env->sr = tmp;
-            break;
-        case 17:
-            env->pc = tmp;
-            break;
-        default:
-            return 0;
-        }
-    }
-    return 4;
-}
 #elif defined (TARGET_MIPS)
 
 static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
diff --git a/target-m68k/gdbstub.c b/target-m68k/gdbstub.c
new file mode 100644
index 0000000..2eb4b98
--- /dev/null
+++ b/target-m68k/gdbstub.c
@@ -0,0 +1,67 @@
+/*
+ * m68k gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 8) {
+        /* D0-D7 */
+        GET_REG32(env->dregs[n]);
+    } else if (n < 16) {
+        /* A0-A7 */
+        GET_REG32(env->aregs[n - 8]);
+    } else {
+        switch (n) {
+        case 16:
+            GET_REG32(env->sr);
+        case 17:
+            GET_REG32(env->pc);
+        }
+    }
+    /* FP registers not included here because they vary between
+       ColdFire and m68k.  Use XML bits for these.  */
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUM68KState *env, uint8_t *mem_buf, int n)
+{
+    uint32_t tmp;
+
+    tmp = ldl_p(mem_buf);
+
+    if (n < 8) {
+        /* D0-D7 */
+        env->dregs[n] = tmp;
+    } else if (n < 16) {
+        /* A0-A7 */
+        env->aregs[n - 8] = tmp;
+    } else {
+        switch (n) {
+        case 16:
+            env->sr = tmp;
+            break;
+        case 17:
+            env->pc = tmp;
+            break;
+        default:
+            return 0;
+        }
+    }
+    return 4;
+}
commit 58850dad68f3458cf430395db2e016f1d03ad7de
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:32:15 2013 +0200

    target-arm: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index bf98eb0..73e6411 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -538,81 +538,9 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_ARM)
 
-/* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
-   whatever the target description contains.  Due to a historical mishap
-   the FPA registers appear in between core integer regs and the CPSR.
-   We hack round this by giving the FPA regs zero size when talking to a
-   newer gdb.  */
 #define GDB_CORE_XML "arm-core.xml"
 
-static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 16) {
-        /* Core integer register.  */
-        GET_REG32(env->regs[n]);
-    }
-    if (n < 24) {
-        /* FPA registers.  */
-        if (gdb_has_xml) {
-            return 0;
-        }
-        memset(mem_buf, 0, 12);
-        return 12;
-    }
-    switch (n) {
-    case 24:
-        /* FPA status register.  */
-        if (gdb_has_xml) {
-            return 0;
-        }
-        GET_REG32(0);
-    case 25:
-        /* CPSR */
-        GET_REG32(cpsr_read(env));
-    }
-    /* Unknown register.  */
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUARMState *env, uint8_t *mem_buf, int n)
-{
-    uint32_t tmp;
-
-    tmp = ldl_p(mem_buf);
-
-    /* Mask out low bit of PC to workaround gdb bugs.  This will probably
-       cause problems if we ever implement the Jazelle DBX extensions.  */
-    if (n == 15) {
-        tmp &= ~1;
-    }
-
-    if (n < 16) {
-        /* Core integer register.  */
-        env->regs[n] = tmp;
-        return 4;
-    }
-    if (n < 24) { /* 16-23 */
-        /* FPA registers (ignored).  */
-        if (gdb_has_xml) {
-            return 0;
-        }
-        return 12;
-    }
-    switch (n) {
-    case 24:
-        /* FPA status register (ignored).  */
-        if (gdb_has_xml) {
-            return 0;
-        }
-        return 4;
-    case 25:
-        /* CPSR */
-        cpsr_write(env, tmp, 0xffffffff);
-        return 4;
-    }
-    /* Unknown register.  */
-    return 0;
-}
+#include "target-arm/gdbstub.c"
 
 #elif defined (TARGET_M68K)
 
diff --git a/target-arm/gdbstub.c b/target-arm/gdbstub.c
new file mode 100644
index 0000000..74903a3
--- /dev/null
+++ b/target-arm/gdbstub.c
@@ -0,0 +1,94 @@
+/*
+ * ARM gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
+   whatever the target description contains.  Due to a historical mishap
+   the FPA registers appear in between core integer regs and the CPSR.
+   We hack round this by giving the FPA regs zero size when talking to a
+   newer gdb.  */
+
+static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 16) {
+        /* Core integer register.  */
+        GET_REG32(env->regs[n]);
+    }
+    if (n < 24) {
+        /* FPA registers.  */
+        if (gdb_has_xml) {
+            return 0;
+        }
+        memset(mem_buf, 0, 12);
+        return 12;
+    }
+    switch (n) {
+    case 24:
+        /* FPA status register.  */
+        if (gdb_has_xml) {
+            return 0;
+        }
+        GET_REG32(0);
+    case 25:
+        /* CPSR */
+        GET_REG32(cpsr_read(env));
+    }
+    /* Unknown register.  */
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUARMState *env, uint8_t *mem_buf, int n)
+{
+    uint32_t tmp;
+
+    tmp = ldl_p(mem_buf);
+
+    /* Mask out low bit of PC to workaround gdb bugs.  This will probably
+       cause problems if we ever implement the Jazelle DBX extensions.  */
+    if (n == 15) {
+        tmp &= ~1;
+    }
+
+    if (n < 16) {
+        /* Core integer register.  */
+        env->regs[n] = tmp;
+        return 4;
+    }
+    if (n < 24) { /* 16-23 */
+        /* FPA registers (ignored).  */
+        if (gdb_has_xml) {
+            return 0;
+        }
+        return 12;
+    }
+    switch (n) {
+    case 24:
+        /* FPA status register (ignored).  */
+        if (gdb_has_xml) {
+            return 0;
+        }
+        return 4;
+    case 25:
+        /* CPSR */
+        cpsr_write(env, tmp, 0xffffffff);
+        return 4;
+    }
+    /* Unknown register.  */
+    return 0;
+}
commit d19c87f44d8d7bac48d4b35863ae825f872ed54a
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:29:26 2013 +0200

    target-sparc: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index c858b7f..bf98eb0 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -534,186 +534,8 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_SPARC)
 
-#ifdef TARGET_ABI32
-#define GET_REGA(val) GET_REG32(val)
-#else
-#define GET_REGA(val) GET_REGL(val)
-#endif
+#include "target-sparc/gdbstub.c"
 
-static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 8) {
-        /* g0..g7 */
-        GET_REGA(env->gregs[n]);
-    }
-    if (n < 32) {
-        /* register window */
-        GET_REGA(env->regwptr[n - 8]);
-    }
-#if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
-    if (n < 64) {
-        /* fprs */
-        if (n & 1) {
-            GET_REG32(env->fpr[(n - 32) / 2].l.lower);
-        } else {
-            GET_REG32(env->fpr[(n - 32) / 2].l.upper);
-        }
-    }
-    /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
-    switch (n) {
-    case 64:
-        GET_REGA(env->y);
-    case 65:
-        GET_REGA(cpu_get_psr(env));
-    case 66:
-        GET_REGA(env->wim);
-    case 67:
-        GET_REGA(env->tbr);
-    case 68:
-        GET_REGA(env->pc);
-    case 69:
-        GET_REGA(env->npc);
-    case 70:
-        GET_REGA(env->fsr);
-    case 71:
-        GET_REGA(0); /* csr */
-    default:
-        GET_REGA(0);
-    }
-#else
-    if (n < 64) {
-        /* f0-f31 */
-        if (n & 1) {
-            GET_REG32(env->fpr[(n - 32) / 2].l.lower);
-        } else {
-            GET_REG32(env->fpr[(n - 32) / 2].l.upper);
-        }
-    }
-    if (n < 80) {
-        /* f32-f62 (double width, even numbers only) */
-        GET_REG64(env->fpr[(n - 32) / 2].ll);
-    }
-    switch (n) {
-    case 80:
-        GET_REGL(env->pc);
-    case 81:
-        GET_REGL(env->npc);
-    case 82:
-        GET_REGL((cpu_get_ccr(env) << 32) |
-                 ((env->asi & 0xff) << 24) |
-                 ((env->pstate & 0xfff) << 8) |
-                 cpu_get_cwp64(env));
-    case 83:
-        GET_REGL(env->fsr);
-    case 84:
-        GET_REGL(env->fprs);
-    case 85:
-        GET_REGL(env->y);
-    }
-#endif
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
-{
-#if defined(TARGET_ABI32)
-    abi_ulong tmp;
-
-    tmp = ldl_p(mem_buf);
-#else
-    target_ulong tmp;
-
-    tmp = ldtul_p(mem_buf);
-#endif
-
-    if (n < 8) {
-        /* g0..g7 */
-        env->gregs[n] = tmp;
-    } else if (n < 32) {
-        /* register window */
-        env->regwptr[n - 8] = tmp;
-    }
-#if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
-    else if (n < 64) {
-        /* fprs */
-        /* f0-f31 */
-        if (n & 1) {
-            env->fpr[(n - 32) / 2].l.lower = tmp;
-        } else {
-            env->fpr[(n - 32) / 2].l.upper = tmp;
-        }
-    } else {
-        /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
-        switch (n) {
-        case 64:
-            env->y = tmp;
-            break;
-        case 65:
-            cpu_put_psr(env, tmp);
-            break;
-        case 66:
-            env->wim = tmp;
-            break;
-        case 67:
-            env->tbr = tmp;
-            break;
-        case 68:
-            env->pc = tmp;
-            break;
-        case 69:
-            env->npc = tmp;
-            break;
-        case 70:
-            env->fsr = tmp;
-            break;
-        default:
-            return 0;
-        }
-    }
-    return 4;
-#else
-    else if (n < 64) {
-        /* f0-f31 */
-        tmp = ldl_p(mem_buf);
-        if (n & 1) {
-            env->fpr[(n - 32) / 2].l.lower = tmp;
-        } else {
-            env->fpr[(n - 32) / 2].l.upper = tmp;
-        }
-        return 4;
-    } else if (n < 80) {
-        /* f32-f62 (double width, even numbers only) */
-        env->fpr[(n - 32) / 2].ll = tmp;
-    } else {
-        switch (n) {
-        case 80:
-            env->pc = tmp;
-            break;
-        case 81:
-            env->npc = tmp;
-            break;
-        case 82:
-            cpu_put_ccr(env, tmp >> 32);
-            env->asi = (tmp >> 24) & 0xff;
-            env->pstate = (tmp >> 8) & 0xfff;
-            cpu_put_cwp64(env, tmp & 0xff);
-            break;
-        case 83:
-            env->fsr = tmp;
-            break;
-        case 84:
-            env->fprs = tmp;
-            break;
-        case 85:
-            env->y = tmp;
-            break;
-        default:
-            return 0;
-        }
-    }
-    return 8;
-#endif
-}
 #elif defined (TARGET_ARM)
 
 /* Old gdb always expect FPA registers.  Newer (xml-aware) gdb only expect
diff --git a/target-sparc/gdbstub.c b/target-sparc/gdbstub.c
new file mode 100644
index 0000000..914f586
--- /dev/null
+++ b/target-sparc/gdbstub.c
@@ -0,0 +1,200 @@
+/*
+ * SPARC gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifdef TARGET_ABI32
+#define GET_REGA(val) GET_REG32(val)
+#else
+#define GET_REGA(val) GET_REGL(val)
+#endif
+
+static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 8) {
+        /* g0..g7 */
+        GET_REGA(env->gregs[n]);
+    }
+    if (n < 32) {
+        /* register window */
+        GET_REGA(env->regwptr[n - 8]);
+    }
+#if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
+    if (n < 64) {
+        /* fprs */
+        if (n & 1) {
+            GET_REG32(env->fpr[(n - 32) / 2].l.lower);
+        } else {
+            GET_REG32(env->fpr[(n - 32) / 2].l.upper);
+        }
+    }
+    /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
+    switch (n) {
+    case 64:
+        GET_REGA(env->y);
+    case 65:
+        GET_REGA(cpu_get_psr(env));
+    case 66:
+        GET_REGA(env->wim);
+    case 67:
+        GET_REGA(env->tbr);
+    case 68:
+        GET_REGA(env->pc);
+    case 69:
+        GET_REGA(env->npc);
+    case 70:
+        GET_REGA(env->fsr);
+    case 71:
+        GET_REGA(0); /* csr */
+    default:
+        GET_REGA(0);
+    }
+#else
+    if (n < 64) {
+        /* f0-f31 */
+        if (n & 1) {
+            GET_REG32(env->fpr[(n - 32) / 2].l.lower);
+        } else {
+            GET_REG32(env->fpr[(n - 32) / 2].l.upper);
+        }
+    }
+    if (n < 80) {
+        /* f32-f62 (double width, even numbers only) */
+        GET_REG64(env->fpr[(n - 32) / 2].ll);
+    }
+    switch (n) {
+    case 80:
+        GET_REGL(env->pc);
+    case 81:
+        GET_REGL(env->npc);
+    case 82:
+        GET_REGL((cpu_get_ccr(env) << 32) |
+                 ((env->asi & 0xff) << 24) |
+                 ((env->pstate & 0xfff) << 8) |
+                 cpu_get_cwp64(env));
+    case 83:
+        GET_REGL(env->fsr);
+    case 84:
+        GET_REGL(env->fprs);
+    case 85:
+        GET_REGL(env->y);
+    }
+#endif
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
+{
+#if defined(TARGET_ABI32)
+    abi_ulong tmp;
+
+    tmp = ldl_p(mem_buf);
+#else
+    target_ulong tmp;
+
+    tmp = ldtul_p(mem_buf);
+#endif
+
+    if (n < 8) {
+        /* g0..g7 */
+        env->gregs[n] = tmp;
+    } else if (n < 32) {
+        /* register window */
+        env->regwptr[n - 8] = tmp;
+    }
+#if defined(TARGET_ABI32) || !defined(TARGET_SPARC64)
+    else if (n < 64) {
+        /* fprs */
+        /* f0-f31 */
+        if (n & 1) {
+            env->fpr[(n - 32) / 2].l.lower = tmp;
+        } else {
+            env->fpr[(n - 32) / 2].l.upper = tmp;
+        }
+    } else {
+        /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
+        switch (n) {
+        case 64:
+            env->y = tmp;
+            break;
+        case 65:
+            cpu_put_psr(env, tmp);
+            break;
+        case 66:
+            env->wim = tmp;
+            break;
+        case 67:
+            env->tbr = tmp;
+            break;
+        case 68:
+            env->pc = tmp;
+            break;
+        case 69:
+            env->npc = tmp;
+            break;
+        case 70:
+            env->fsr = tmp;
+            break;
+        default:
+            return 0;
+        }
+    }
+    return 4;
+#else
+    else if (n < 64) {
+        /* f0-f31 */
+        tmp = ldl_p(mem_buf);
+        if (n & 1) {
+            env->fpr[(n - 32) / 2].l.lower = tmp;
+        } else {
+            env->fpr[(n - 32) / 2].l.upper = tmp;
+        }
+        return 4;
+    } else if (n < 80) {
+        /* f32-f62 (double width, even numbers only) */
+        env->fpr[(n - 32) / 2].ll = tmp;
+    } else {
+        switch (n) {
+        case 80:
+            env->pc = tmp;
+            break;
+        case 81:
+            env->npc = tmp;
+            break;
+        case 82:
+            cpu_put_ccr(env, tmp >> 32);
+            env->asi = (tmp >> 24) & 0xff;
+            env->pstate = (tmp >> 8) & 0xfff;
+            cpu_put_cwp64(env, tmp & 0xff);
+            break;
+        case 83:
+            env->fsr = tmp;
+            break;
+        case 84:
+            env->fprs = tmp;
+            break;
+        case 85:
+            env->y = tmp;
+            break;
+        default:
+            return 0;
+        }
+    }
+    return 8;
+#endif
+}
commit 0980bfabbc2e93d42c6b5ade578b371c36f6f23d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:26:33 2013 +0200

    target-ppc: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 5a23204..c858b7f 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -524,112 +524,13 @@ static int put_packet(GDBState *s, const char *buf)
 
 #elif defined (TARGET_PPC)
 
-/* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
-   expects whatever the target description contains.  Due to a
-   historical mishap the FP registers appear in between core integer
-   regs and PC, MSR, CR, and so forth.  We hack round this by giving the
-   FP regs zero size when talking to a newer gdb.  */
 #if defined (TARGET_PPC64)
 #define GDB_CORE_XML "power64-core.xml"
 #else
 #define GDB_CORE_XML "power-core.xml"
 #endif
 
-static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 32) {
-        /* gprs */
-        GET_REGL(env->gpr[n]);
-    } else if (n < 64) {
-        /* fprs */
-        if (gdb_has_xml) {
-            return 0;
-        }
-        stfq_p(mem_buf, env->fpr[n-32]);
-        return 8;
-    } else {
-        switch (n) {
-        case 64:
-            GET_REGL(env->nip);
-        case 65:
-            GET_REGL(env->msr);
-        case 66:
-            {
-                uint32_t cr = 0;
-                int i;
-                for (i = 0; i < 8; i++) {
-                    cr |= env->crf[i] << (32 - ((i + 1) * 4));
-                }
-                GET_REG32(cr);
-            }
-        case 67:
-            GET_REGL(env->lr);
-        case 68:
-            GET_REGL(env->ctr);
-        case 69:
-            GET_REGL(env->xer);
-        case 70:
-            {
-                if (gdb_has_xml) {
-                    return 0;
-                }
-                GET_REG32(env->fpscr);
-            }
-        }
-    }
-    return 0;
-}
-
-static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
-{
-    if (n < 32) {
-        /* gprs */
-        env->gpr[n] = ldtul_p(mem_buf);
-        return sizeof(target_ulong);
-    } else if (n < 64) {
-        /* fprs */
-        if (gdb_has_xml) {
-            return 0;
-        }
-        env->fpr[n-32] = ldfq_p(mem_buf);
-        return 8;
-    } else {
-        switch (n) {
-        case 64:
-            env->nip = ldtul_p(mem_buf);
-            return sizeof(target_ulong);
-        case 65:
-            ppc_store_msr(env, ldtul_p(mem_buf));
-            return sizeof(target_ulong);
-        case 66:
-            {
-                uint32_t cr = ldl_p(mem_buf);
-                int i;
-                for (i = 0; i < 8; i++) {
-                    env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
-                }
-                return 4;
-            }
-        case 67:
-            env->lr = ldtul_p(mem_buf);
-            return sizeof(target_ulong);
-        case 68:
-            env->ctr = ldtul_p(mem_buf);
-            return sizeof(target_ulong);
-        case 69:
-            env->xer = ldtul_p(mem_buf);
-            return sizeof(target_ulong);
-        case 70:
-            /* fpscr */
-            if (gdb_has_xml) {
-                return 0;
-            }
-            store_fpscr(env, ldtul_p(mem_buf), 0xffffffff);
-            return sizeof(target_ulong);
-        }
-    }
-    return 0;
-}
+#include "target-ppc/gdbstub.c"
 
 #elif defined (TARGET_SPARC)
 
diff --git a/target-ppc/gdbstub.c b/target-ppc/gdbstub.c
new file mode 100644
index 0000000..b834e60
--- /dev/null
+++ b/target-ppc/gdbstub.c
@@ -0,0 +1,122 @@
+/*
+ * PowerPC gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
+ * expects whatever the target description contains.  Due to a
+ * historical mishap the FP registers appear in between core integer
+ * regs and PC, MSR, CR, and so forth.  We hack round this by giving the
+ * FP regs zero size when talking to a newer gdb.
+ */
+
+static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 32) {
+        /* gprs */
+        GET_REGL(env->gpr[n]);
+    } else if (n < 64) {
+        /* fprs */
+        if (gdb_has_xml) {
+            return 0;
+        }
+        stfq_p(mem_buf, env->fpr[n-32]);
+        return 8;
+    } else {
+        switch (n) {
+        case 64:
+            GET_REGL(env->nip);
+        case 65:
+            GET_REGL(env->msr);
+        case 66:
+            {
+                uint32_t cr = 0;
+                int i;
+                for (i = 0; i < 8; i++) {
+                    cr |= env->crf[i] << (32 - ((i + 1) * 4));
+                }
+                GET_REG32(cr);
+            }
+        case 67:
+            GET_REGL(env->lr);
+        case 68:
+            GET_REGL(env->ctr);
+        case 69:
+            GET_REGL(env->xer);
+        case 70:
+            {
+                if (gdb_has_xml) {
+                    return 0;
+                }
+                GET_REG32(env->fpscr);
+            }
+        }
+    }
+    return 0;
+}
+
+static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
+{
+    if (n < 32) {
+        /* gprs */
+        env->gpr[n] = ldtul_p(mem_buf);
+        return sizeof(target_ulong);
+    } else if (n < 64) {
+        /* fprs */
+        if (gdb_has_xml) {
+            return 0;
+        }
+        env->fpr[n-32] = ldfq_p(mem_buf);
+        return 8;
+    } else {
+        switch (n) {
+        case 64:
+            env->nip = ldtul_p(mem_buf);
+            return sizeof(target_ulong);
+        case 65:
+            ppc_store_msr(env, ldtul_p(mem_buf));
+            return sizeof(target_ulong);
+        case 66:
+            {
+                uint32_t cr = ldl_p(mem_buf);
+                int i;
+                for (i = 0; i < 8; i++) {
+                    env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
+                }
+                return 4;
+            }
+        case 67:
+            env->lr = ldtul_p(mem_buf);
+            return sizeof(target_ulong);
+        case 68:
+            env->ctr = ldtul_p(mem_buf);
+            return sizeof(target_ulong);
+        case 69:
+            env->xer = ldtul_p(mem_buf);
+            return sizeof(target_ulong);
+        case 70:
+            /* fpscr */
+            if (gdb_has_xml) {
+                return 0;
+            }
+            store_fpscr(env, ldtul_p(mem_buf), 0xffffffff);
+            return sizeof(target_ulong);
+        }
+    }
+    return 0;
+}
commit f20f9df06e6f724d2ccdaf5f9a6dae45c061db75
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 12:07:54 2013 +0200

    target-i386: Move cpu_gdb_{read,write}_register()
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 4879055..5a23204 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -520,208 +520,7 @@ static int put_packet(GDBState *s, const char *buf)
 
 #if defined(TARGET_I386)
 
-#ifdef TARGET_X86_64
-static const int gpr_map[16] = {
-    R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
-    8, 9, 10, 11, 12, 13, 14, 15
-};
-#else
-#define gpr_map gpr_map32
-#endif
-static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
-
-#define IDX_IP_REG      CPU_NB_REGS
-#define IDX_FLAGS_REG   (IDX_IP_REG + 1)
-#define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
-#define IDX_FP_REGS     (IDX_SEG_REGS + 6)
-#define IDX_XMM_REGS    (IDX_FP_REGS + 16)
-#define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
-
-static int cpu_gdb_read_register(CPUX86State *env, uint8_t *mem_buf, int n)
-{
-    if (n < CPU_NB_REGS) {
-        if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
-            GET_REG64(env->regs[gpr_map[n]]);
-        } else if (n < CPU_NB_REGS32) {
-            GET_REG32(env->regs[gpr_map32[n]]);
-        }
-    } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
-#ifdef USE_X86LDOUBLE
-        /* FIXME: byteswap float values - after fixing fpregs layout. */
-        memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
-#else
-        memset(mem_buf, 0, 10);
-#endif
-        return 10;
-    } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
-        n -= IDX_XMM_REGS;
-        if (n < CPU_NB_REGS32 ||
-            (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
-            stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
-            stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
-            return 16;
-        }
-    } else {
-        switch (n) {
-        case IDX_IP_REG:
-            if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
-                GET_REG64(env->eip);
-            } else {
-                GET_REG32(env->eip);
-            }
-        case IDX_FLAGS_REG:
-            GET_REG32(env->eflags);
-
-        case IDX_SEG_REGS:
-            GET_REG32(env->segs[R_CS].selector);
-        case IDX_SEG_REGS + 1:
-            GET_REG32(env->segs[R_SS].selector);
-        case IDX_SEG_REGS + 2:
-            GET_REG32(env->segs[R_DS].selector);
-        case IDX_SEG_REGS + 3:
-            GET_REG32(env->segs[R_ES].selector);
-        case IDX_SEG_REGS + 4:
-            GET_REG32(env->segs[R_FS].selector);
-        case IDX_SEG_REGS + 5:
-            GET_REG32(env->segs[R_GS].selector);
-
-        case IDX_FP_REGS + 8:
-            GET_REG32(env->fpuc);
-        case IDX_FP_REGS + 9:
-            GET_REG32((env->fpus & ~0x3800) |
-                      (env->fpstt & 0x7) << 11);
-        case IDX_FP_REGS + 10:
-            GET_REG32(0); /* ftag */
-        case IDX_FP_REGS + 11:
-            GET_REG32(0); /* fiseg */
-        case IDX_FP_REGS + 12:
-            GET_REG32(0); /* fioff */
-        case IDX_FP_REGS + 13:
-            GET_REG32(0); /* foseg */
-        case IDX_FP_REGS + 14:
-            GET_REG32(0); /* fooff */
-        case IDX_FP_REGS + 15:
-            GET_REG32(0); /* fop */
-
-        case IDX_MXCSR_REG:
-            GET_REG32(env->mxcsr);
-        }
-    }
-    return 0;
-}
-
-static int cpu_x86_gdb_load_seg(CPUX86State *env, int sreg, uint8_t *mem_buf)
-{
-    uint16_t selector = ldl_p(mem_buf);
-
-    if (selector != env->segs[sreg].selector) {
-#if defined(CONFIG_USER_ONLY)
-        cpu_x86_load_seg(env, sreg, selector);
-#else
-        unsigned int limit, flags;
-        target_ulong base;
-
-        if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
-            base = selector << 4;
-            limit = 0xffff;
-            flags = 0;
-        } else {
-            if (!cpu_x86_get_descr_debug(env, selector, &base, &limit,
-                                         &flags)) {
-                return 4;
-            }
-        }
-        cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
-#endif
-    }
-    return 4;
-}
-
-static int cpu_gdb_write_register(CPUX86State *env, uint8_t *mem_buf, int n)
-{
-    uint32_t tmp;
-
-    if (n < CPU_NB_REGS) {
-        if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
-            env->regs[gpr_map[n]] = ldtul_p(mem_buf);
-            return sizeof(target_ulong);
-        } else if (n < CPU_NB_REGS32) {
-            n = gpr_map32[n];
-            env->regs[n] &= ~0xffffffffUL;
-            env->regs[n] |= (uint32_t)ldl_p(mem_buf);
-            return 4;
-        }
-    } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
-#ifdef USE_X86LDOUBLE
-        /* FIXME: byteswap float values - after fixing fpregs layout. */
-        memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
-#endif
-        return 10;
-    } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
-        n -= IDX_XMM_REGS;
-        if (n < CPU_NB_REGS32 ||
-            (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
-            env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
-            env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
-            return 16;
-        }
-    } else {
-        switch (n) {
-        case IDX_IP_REG:
-            if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
-                env->eip = ldq_p(mem_buf);
-                return 8;
-            } else {
-                env->eip &= ~0xffffffffUL;
-                env->eip |= (uint32_t)ldl_p(mem_buf);
-                return 4;
-            }
-        case IDX_FLAGS_REG:
-            env->eflags = ldl_p(mem_buf);
-            return 4;
-
-        case IDX_SEG_REGS:
-            return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
-        case IDX_SEG_REGS + 1:
-            return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
-        case IDX_SEG_REGS + 2:
-            return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
-        case IDX_SEG_REGS + 3:
-            return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
-        case IDX_SEG_REGS + 4:
-            return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
-        case IDX_SEG_REGS + 5:
-            return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
-
-        case IDX_FP_REGS + 8:
-            env->fpuc = ldl_p(mem_buf);
-            return 4;
-        case IDX_FP_REGS + 9:
-            tmp = ldl_p(mem_buf);
-            env->fpstt = (tmp >> 11) & 7;
-            env->fpus = tmp & ~0x3800;
-            return 4;
-        case IDX_FP_REGS + 10: /* ftag */
-            return 4;
-        case IDX_FP_REGS + 11: /* fiseg */
-            return 4;
-        case IDX_FP_REGS + 12: /* fioff */
-            return 4;
-        case IDX_FP_REGS + 13: /* foseg */
-            return 4;
-        case IDX_FP_REGS + 14: /* fooff */
-            return 4;
-        case IDX_FP_REGS + 15: /* fop */
-            return 4;
-
-        case IDX_MXCSR_REG:
-            env->mxcsr = ldl_p(mem_buf);
-            return 4;
-        }
-    }
-    /* Unrecognised register.  */
-    return 0;
-}
+#include "target-i386/gdbstub.c"
 
 #elif defined (TARGET_PPC)
 
diff --git a/target-i386/gdbstub.c b/target-i386/gdbstub.c
new file mode 100644
index 0000000..974d8ad
--- /dev/null
+++ b/target-i386/gdbstub.c
@@ -0,0 +1,222 @@
+/*
+ * x86 gdb server stub
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2013 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifdef TARGET_X86_64
+static const int gpr_map[16] = {
+    R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
+    8, 9, 10, 11, 12, 13, 14, 15
+};
+#else
+#define gpr_map gpr_map32
+#endif
+static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
+
+#define IDX_IP_REG      CPU_NB_REGS
+#define IDX_FLAGS_REG   (IDX_IP_REG + 1)
+#define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
+#define IDX_FP_REGS     (IDX_SEG_REGS + 6)
+#define IDX_XMM_REGS    (IDX_FP_REGS + 16)
+#define IDX_MXCSR_REG   (IDX_XMM_REGS + CPU_NB_REGS)
+
+static int cpu_gdb_read_register(CPUX86State *env, uint8_t *mem_buf, int n)
+{
+    if (n < CPU_NB_REGS) {
+        if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
+            GET_REG64(env->regs[gpr_map[n]]);
+        } else if (n < CPU_NB_REGS32) {
+            GET_REG32(env->regs[gpr_map32[n]]);
+        }
+    } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
+#ifdef USE_X86LDOUBLE
+        /* FIXME: byteswap float values - after fixing fpregs layout. */
+        memcpy(mem_buf, &env->fpregs[n - IDX_FP_REGS], 10);
+#else
+        memset(mem_buf, 0, 10);
+#endif
+        return 10;
+    } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
+        n -= IDX_XMM_REGS;
+        if (n < CPU_NB_REGS32 ||
+            (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
+            stq_p(mem_buf, env->xmm_regs[n].XMM_Q(0));
+            stq_p(mem_buf + 8, env->xmm_regs[n].XMM_Q(1));
+            return 16;
+        }
+    } else {
+        switch (n) {
+        case IDX_IP_REG:
+            if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
+                GET_REG64(env->eip);
+            } else {
+                GET_REG32(env->eip);
+            }
+        case IDX_FLAGS_REG:
+            GET_REG32(env->eflags);
+
+        case IDX_SEG_REGS:
+            GET_REG32(env->segs[R_CS].selector);
+        case IDX_SEG_REGS + 1:
+            GET_REG32(env->segs[R_SS].selector);
+        case IDX_SEG_REGS + 2:
+            GET_REG32(env->segs[R_DS].selector);
+        case IDX_SEG_REGS + 3:
+            GET_REG32(env->segs[R_ES].selector);
+        case IDX_SEG_REGS + 4:
+            GET_REG32(env->segs[R_FS].selector);
+        case IDX_SEG_REGS + 5:
+            GET_REG32(env->segs[R_GS].selector);
+
+        case IDX_FP_REGS + 8:
+            GET_REG32(env->fpuc);
+        case IDX_FP_REGS + 9:
+            GET_REG32((env->fpus & ~0x3800) |
+                      (env->fpstt & 0x7) << 11);
+        case IDX_FP_REGS + 10:
+            GET_REG32(0); /* ftag */
+        case IDX_FP_REGS + 11:
+            GET_REG32(0); /* fiseg */
+        case IDX_FP_REGS + 12:
+            GET_REG32(0); /* fioff */
+        case IDX_FP_REGS + 13:
+            GET_REG32(0); /* foseg */
+        case IDX_FP_REGS + 14:
+            GET_REG32(0); /* fooff */
+        case IDX_FP_REGS + 15:
+            GET_REG32(0); /* fop */
+
+        case IDX_MXCSR_REG:
+            GET_REG32(env->mxcsr);
+        }
+    }
+    return 0;
+}
+
+static int cpu_x86_gdb_load_seg(CPUX86State *env, int sreg, uint8_t *mem_buf)
+{
+    uint16_t selector = ldl_p(mem_buf);
+
+    if (selector != env->segs[sreg].selector) {
+#if defined(CONFIG_USER_ONLY)
+        cpu_x86_load_seg(env, sreg, selector);
+#else
+        unsigned int limit, flags;
+        target_ulong base;
+
+        if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
+            base = selector << 4;
+            limit = 0xffff;
+            flags = 0;
+        } else {
+            if (!cpu_x86_get_descr_debug(env, selector, &base, &limit,
+                                         &flags)) {
+                return 4;
+            }
+        }
+        cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
+#endif
+    }
+    return 4;
+}
+
+static int cpu_gdb_write_register(CPUX86State *env, uint8_t *mem_buf, int n)
+{
+    uint32_t tmp;
+
+    if (n < CPU_NB_REGS) {
+        if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
+            env->regs[gpr_map[n]] = ldtul_p(mem_buf);
+            return sizeof(target_ulong);
+        } else if (n < CPU_NB_REGS32) {
+            n = gpr_map32[n];
+            env->regs[n] &= ~0xffffffffUL;
+            env->regs[n] |= (uint32_t)ldl_p(mem_buf);
+            return 4;
+        }
+    } else if (n >= IDX_FP_REGS && n < IDX_FP_REGS + 8) {
+#ifdef USE_X86LDOUBLE
+        /* FIXME: byteswap float values - after fixing fpregs layout. */
+        memcpy(&env->fpregs[n - IDX_FP_REGS], mem_buf, 10);
+#endif
+        return 10;
+    } else if (n >= IDX_XMM_REGS && n < IDX_XMM_REGS + CPU_NB_REGS) {
+        n -= IDX_XMM_REGS;
+        if (n < CPU_NB_REGS32 ||
+            (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK)) {
+            env->xmm_regs[n].XMM_Q(0) = ldq_p(mem_buf);
+            env->xmm_regs[n].XMM_Q(1) = ldq_p(mem_buf + 8);
+            return 16;
+        }
+    } else {
+        switch (n) {
+        case IDX_IP_REG:
+            if (TARGET_LONG_BITS == 64 && env->hflags & HF_CS64_MASK) {
+                env->eip = ldq_p(mem_buf);
+                return 8;
+            } else {
+                env->eip &= ~0xffffffffUL;
+                env->eip |= (uint32_t)ldl_p(mem_buf);
+                return 4;
+            }
+        case IDX_FLAGS_REG:
+            env->eflags = ldl_p(mem_buf);
+            return 4;
+
+        case IDX_SEG_REGS:
+            return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
+        case IDX_SEG_REGS + 1:
+            return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
+        case IDX_SEG_REGS + 2:
+            return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
+        case IDX_SEG_REGS + 3:
+            return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
+        case IDX_SEG_REGS + 4:
+            return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
+        case IDX_SEG_REGS + 5:
+            return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
+
+        case IDX_FP_REGS + 8:
+            env->fpuc = ldl_p(mem_buf);
+            return 4;
+        case IDX_FP_REGS + 9:
+            tmp = ldl_p(mem_buf);
+            env->fpstt = (tmp >> 11) & 7;
+            env->fpus = tmp & ~0x3800;
+            return 4;
+        case IDX_FP_REGS + 10: /* ftag */
+            return 4;
+        case IDX_FP_REGS + 11: /* fiseg */
+            return 4;
+        case IDX_FP_REGS + 12: /* fioff */
+            return 4;
+        case IDX_FP_REGS + 13: /* foseg */
+            return 4;
+        case IDX_FP_REGS + 14: /* fooff */
+            return 4;
+        case IDX_FP_REGS + 15: /* fop */
+            return 4;
+
+        case IDX_MXCSR_REG:
+            env->mxcsr = ldl_p(mem_buf);
+            return 4;
+        }
+    }
+    /* Unrecognised register.  */
+    return 0;
+}
commit a0e372f0c49ac01faeaeb73a6e8f50e8ac615f34
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 28 23:18:47 2013 +0200

    cpu: Introduce CPUState::gdb_num_regs and CPUClass::gdb_num_core_regs
    
    CPUState::gdb_num_regs replaces num_g_regs.
    CPUClass::gdb_num_core_regs replaces NUM_CORE_REGS.
    
    Allows building gdb_register_coprocessor() for xtensa, too.
    
    As a side effect this should fix coprocessor register numbering for SMP.
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Acked-by: Max Filippov <jcmvbkbc at gmail.com> (for xtensa)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 9ede3de..4879055 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -530,8 +530,6 @@ static const int gpr_map[16] = {
 #endif
 static const int gpr_map32[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
 
-#define NUM_CORE_REGS (CPU_NB_REGS * 2 + 25)
-
 #define IDX_IP_REG      CPU_NB_REGS
 #define IDX_FLAGS_REG   (IDX_IP_REG + 1)
 #define IDX_SEG_REGS    (IDX_FLAGS_REG + 1)
@@ -732,7 +730,6 @@ static int cpu_gdb_write_register(CPUX86State *env, uint8_t *mem_buf, int n)
    historical mishap the FP registers appear in between core integer
    regs and PC, MSR, CR, and so forth.  We hack round this by giving the
    FP regs zero size when talking to a newer gdb.  */
-#define NUM_CORE_REGS 71
 #if defined (TARGET_PPC64)
 #define GDB_CORE_XML "power64-core.xml"
 #else
@@ -837,12 +834,6 @@ static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
 
 #elif defined (TARGET_SPARC)
 
-#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
-#define NUM_CORE_REGS 86
-#else
-#define NUM_CORE_REGS 72
-#endif
-
 #ifdef TARGET_ABI32
 #define GET_REGA(val) GET_REG32(val)
 #else
@@ -1030,7 +1021,6 @@ static int cpu_gdb_write_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
    the FPA registers appear in between core integer regs and the CPSR.
    We hack round this by giving the FPA regs zero size when talking to a
    newer gdb.  */
-#define NUM_CORE_REGS 26
 #define GDB_CORE_XML "arm-core.xml"
 
 static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
@@ -1104,8 +1094,6 @@ static int cpu_gdb_write_register(CPUARMState *env, uint8_t *mem_buf, int n)
 
 #elif defined (TARGET_M68K)
 
-#define NUM_CORE_REGS 18
-
 #define GDB_CORE_XML "cf-core.xml"
 
 static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
@@ -1157,8 +1145,6 @@ static int cpu_gdb_write_register(CPUM68KState *env, uint8_t *mem_buf, int n)
 }
 #elif defined (TARGET_MIPS)
 
-#define NUM_CORE_REGS 73
-
 static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
@@ -1285,8 +1271,6 @@ static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
 }
 #elif defined(TARGET_OPENRISC)
 
-#define NUM_CORE_REGS (32 + 3)
-
 static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
@@ -1312,9 +1296,11 @@ static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
 static int cpu_gdb_write_register(CPUOpenRISCState *env,
                                   uint8_t *mem_buf, int n)
 {
+    OpenRISCCPU *cpu = openrisc_env_get_cpu(env);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
     uint32_t tmp;
 
-    if (n > NUM_CORE_REGS) {
+    if (n > cc->gdb_num_core_regs) {
         return 0;
     }
 
@@ -1347,8 +1333,6 @@ static int cpu_gdb_write_register(CPUOpenRISCState *env,
 /* Hint: Use "set architecture sh4" in GDB to see fpu registers */
 /* FIXME: We should use XML for this.  */
 
-#define NUM_CORE_REGS 59
-
 static int cpu_gdb_read_register(CPUSH4State *env, uint8_t *mem_buf, int n)
 {
     switch (n) {
@@ -1465,8 +1449,6 @@ static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
 }
 #elif defined (TARGET_MICROBLAZE)
 
-#define NUM_CORE_REGS (32 + 5)
-
 static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
@@ -1479,9 +1461,11 @@ static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
 
 static int cpu_gdb_write_register(CPUMBState *env, uint8_t *mem_buf, int n)
 {
+    MicroBlazeCPU *cpu = mb_env_get_cpu(env);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
     uint32_t tmp;
 
-    if (n > NUM_CORE_REGS) {
+    if (n > cc->gdb_num_core_regs) {
         return 0;
     }
 
@@ -1496,8 +1480,6 @@ static int cpu_gdb_write_register(CPUMBState *env, uint8_t *mem_buf, int n)
 }
 #elif defined (TARGET_CRIS)
 
-#define NUM_CORE_REGS 49
-
 static int
 read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
 {
@@ -1605,8 +1587,6 @@ static int cpu_gdb_write_register(CPUCRISState *env, uint8_t *mem_buf, int n)
 }
 #elif defined (TARGET_ALPHA)
 
-#define NUM_CORE_REGS 67
-
 static int cpu_gdb_read_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
 {
     uint64_t val;
@@ -1675,8 +1655,6 @@ static int cpu_gdb_write_register(CPUAlphaState *env, uint8_t *mem_buf, int n)
 }
 #elif defined (TARGET_S390X)
 
-#define NUM_CORE_REGS  S390_NUM_REGS
-
 static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
 {
     uint64_t val;
@@ -1740,7 +1718,6 @@ static int cpu_gdb_write_register(CPUS390XState *env, uint8_t *mem_buf, int n)
 #elif defined (TARGET_LM32)
 
 #include "hw/lm32/lm32_pic.h"
-#define NUM_CORE_REGS (32 + 7)
 
 static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
 {
@@ -1770,9 +1747,11 @@ static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
 
 static int cpu_gdb_write_register(CPULM32State *env, uint8_t *mem_buf, int n)
 {
+    LM32CPU *cpu = lm32_env_get_cpu(env);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
     uint32_t tmp;
 
-    if (n > NUM_CORE_REGS) {
+    if (n > cc->gdb_num_core_regs) {
         return 0;
     }
 
@@ -1806,14 +1785,6 @@ static int cpu_gdb_write_register(CPULM32State *env, uint8_t *mem_buf, int n)
 }
 #elif defined(TARGET_XTENSA)
 
-/* Use num_core_regs to see only non-privileged registers in an unmodified gdb.
- * Use num_regs to see all registers. gdb modification is required for that:
- * reset bit 0 in the 'flags' field of the registers definitions in the
- * gdb/xtensa-config.c inside gdb source tree or inside gdb overlay.
- */
-#define NUM_CORE_REGS (env->config->gdb_regmap.num_regs)
-#define num_g_regs NUM_CORE_REGS
-
 static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
 {
     const XtensaGdbReg *reg = env->config->gdb_regmap.reg + n;
@@ -1896,8 +1867,6 @@ static int cpu_gdb_write_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
 }
 #else
 
-#define NUM_CORE_REGS 0
-
 static int cpu_gdb_read_register(CPUArchState *env, uint8_t *mem_buf, int n)
 {
     return 0;
@@ -1910,10 +1879,6 @@ static int cpu_gdb_write_register(CPUArchState *env, uint8_t *mem_buf, int n)
 
 #endif
 
-#if !defined(TARGET_XTENSA)
-static int num_g_regs = NUM_CORE_REGS;
-#endif
-
 #ifdef GDB_CORE_XML
 /* Encode data using the encoding for 'x' packets.  */
 static int memtox(char *buf, const char *mem, int len)
@@ -1982,11 +1947,13 @@ static const char *get_feature_xml(const char *p, const char **newp)
 
 static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 {
+    CPUClass *cc = CPU_GET_CLASS(cpu);
     CPUArchState *env = cpu->env_ptr;
     GDBRegisterState *r;
 
-    if (reg < NUM_CORE_REGS)
+    if (reg < cc->gdb_num_core_regs) {
         return cpu_gdb_read_register(env, mem_buf, reg);
+    }
 
     for (r = cpu->gdb_regs; r; r = r->next) {
         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
@@ -1998,11 +1965,13 @@ static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 
 static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 {
+    CPUClass *cc = CPU_GET_CLASS(cpu);
     CPUArchState *env = cpu->env_ptr;
     GDBRegisterState *r;
 
-    if (reg < NUM_CORE_REGS)
+    if (reg < cc->gdb_num_core_regs) {
         return cpu_gdb_write_register(env, mem_buf, reg);
+    }
 
     for (r = cpu->gdb_regs; r; r = r->next) {
         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
@@ -2012,7 +1981,6 @@ static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
     return 0;
 }
 
-#if !defined(TARGET_XTENSA)
 /* Register a supplemental set of CPU registers.  If g_pos is nonzero it
    specifies the first register number and these registers are included in
    a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
@@ -2025,7 +1993,6 @@ void gdb_register_coprocessor(CPUState *cpu,
 {
     GDBRegisterState *s;
     GDBRegisterState **p;
-    static int last_reg = NUM_CORE_REGS;
 
     p = &cpu->gdb_regs;
     while (*p) {
@@ -2036,25 +2003,22 @@ void gdb_register_coprocessor(CPUState *cpu,
     }
 
     s = g_new0(GDBRegisterState, 1);
-    s->base_reg = last_reg;
+    s->base_reg = cpu->gdb_num_regs;
     s->num_regs = num_regs;
     s->get_reg = get_reg;
     s->set_reg = set_reg;
     s->xml = xml;
 
     /* Add to end of list.  */
-    last_reg += num_regs;
+    cpu->gdb_num_regs += num_regs;
     *p = s;
     if (g_pos) {
         if (g_pos != s->base_reg) {
             fprintf(stderr, "Error: Bad gdb register numbering for '%s'\n"
                     "Expected %d got %d\n", xml, g_pos, s->base_reg);
-        } else {
-            num_g_regs = last_reg;
         }
     }
 }
-#endif
 
 #ifndef CONFIG_USER_ONLY
 static const int xlat_gdb_type[] = {
@@ -2184,9 +2148,6 @@ static CPUState *find_cpu(uint32_t thread_id)
 
 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 {
-#ifdef TARGET_XTENSA
-    CPUArchState *env;
-#endif
     CPUState *cpu;
     const char *p;
     uint32_t thread;
@@ -2334,11 +2295,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         break;
     case 'g':
         cpu_synchronize_state(s->g_cpu);
-#ifdef TARGET_XTENSA
-        env = s->g_cpu->env_ptr;
-#endif
         len = 0;
-        for (addr = 0; addr < num_g_regs; addr++) {
+        for (addr = 0; addr < s->g_cpu->gdb_num_regs; addr++) {
             reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
             len += reg_size;
         }
@@ -2347,13 +2305,10 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         break;
     case 'G':
         cpu_synchronize_state(s->g_cpu);
-#ifdef TARGET_XTENSA
-        env = s->g_cpu->env_ptr;
-#endif
         registers = mem_buf;
         len = strlen(p) / 2;
         hextomem((uint8_t *)registers, p, len);
-        for (addr = 0; addr < num_g_regs && len > 0; addr++) {
+        for (addr = 0; addr < s->g_cpu->gdb_num_regs && len > 0; addr++) {
             reg_size = gdb_write_register(s->g_cpu, registers, addr);
             len -= reg_size;
             registers += reg_size;
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index daf1835..195fe59 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -81,6 +81,7 @@ struct TranslationBlock;
  * #TranslationBlock.
  * @get_phys_page_debug: Callback for obtaining a physical address.
  * @vmsd: State description for migration.
+ * @gdb_num_core_regs: Number of core registers accessible to GDB.
  *
  * Represents a CPU family or model.
  */
@@ -109,7 +110,6 @@ typedef struct CPUClass {
     void (*synchronize_from_tb)(CPUState *cpu, struct TranslationBlock *tb);
     hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
 
-    const struct VMStateDescription *vmsd;
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
                             int cpuid, void *opaque);
     int (*write_elf64_qemunote)(WriteCoreDumpFunction f, CPUState *cpu,
@@ -118,6 +118,9 @@ typedef struct CPUClass {
                             int cpuid, void *opaque);
     int (*write_elf32_qemunote)(WriteCoreDumpFunction f, CPUState *cpu,
                                 void *opaque);
+
+    const struct VMStateDescription *vmsd;
+    int gdb_num_core_regs;
 } CPUClass;
 
 struct KVMState;
@@ -142,6 +145,7 @@ struct kvm_run;
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
  * @gdb_regs: Additional GDB registers.
+ * @gdb_num_regs: Number of total registers accessible to GDB.
  * @next_cpu: Next CPU sharing TB cache.
  * @kvm_fd: vCPU file descriptor for KVM.
  *
@@ -177,6 +181,7 @@ struct CPUState {
     void *env_ptr; /* CPUArchState */
     struct TranslationBlock *current_tb;
     struct GDBRegisterState *gdb_regs;
+    int gdb_num_regs;
     CPUState *next_cpu;
 
     int kvm_fd;
diff --git a/qom/cpu.c b/qom/cpu.c
index 5c45ab5..2839ddf 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -226,6 +226,14 @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
     }
 }
 
+static void cpu_common_initfn(Object *obj)
+{
+    CPUState *cpu = CPU(obj);
+    CPUClass *cc = CPU_GET_CLASS(obj);
+
+    cpu->gdb_num_regs = cc->gdb_num_core_regs;
+}
+
 static int64_t cpu_common_get_arch_id(CPUState *cpu)
 {
     return cpu->cpu_index;
@@ -253,6 +261,7 @@ static const TypeInfo cpu_type_info = {
     .name = TYPE_CPU,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(CPUState),
+    .instance_init = cpu_common_initfn,
     .abstract = true,
     .class_size = sizeof(CPUClass),
     .class_init = cpu_class_init,
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index c8c8c2c..cc0f69a 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -276,6 +276,7 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_alpha_cpu;
 #endif
+    cc->gdb_num_core_regs = 67;
 }
 
 static const TypeInfo alpha_cpu_type_info = {
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index d3906a4..f39c19f 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -828,6 +828,7 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = arm_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_arm_cpu;
 #endif
+    cc->gdb_num_core_regs = 26;
 }
 
 static void cpu_register(const ARMCPUInfo *info)
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index ba095e7..31eeddf 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -258,6 +258,8 @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
 #endif
+
+    cc->gdb_num_core_regs = 49;
 }
 
 static const TypeInfo cris_cpu_type_info = {
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index cd350cb..df9832e 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2549,6 +2549,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->write_elf32_qemunote = x86_cpu_write_elf32_qemunote;
     cc->vmsd = &vmstate_x86_cpu;
 #endif
+    cc->gdb_num_core_regs = CPU_NB_REGS * 2 + 25;
 }
 
 static const TypeInfo x86_cpu_type_info = {
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index ce55e48..aa52696 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -91,6 +91,7 @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
     cc->vmsd = &vmstate_lm32_cpu;
 #endif
+    cc->gdb_num_core_regs = 32 + 7;
 }
 
 static const TypeInfo lm32_cpu_type_info = {
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 988f476..93200d9 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -194,6 +194,7 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
 #endif
     dc->vmsd = &vmstate_m68k_cpu;
+    cc->gdb_num_core_regs = 18;
 }
 
 static void register_cpu_type(const M68kCPUInfo *info)
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 9f10c8c..758b0cb 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -147,6 +147,7 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 #endif
     dc->vmsd = &vmstate_mb_cpu;
     dc->props = mb_properties;
+    cc->gdb_num_core_regs = 32 + 5;
 }
 
 static const TypeInfo mb_cpu_type_info = {
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 4834c86..e667fb7 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -104,6 +104,8 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->do_unassigned_access = mips_cpu_unassigned_access;
     cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
 #endif
+
+    cc->gdb_num_core_regs = 73;
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index 7718820..9b042e1 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -159,6 +159,7 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
     dc->vmsd = &vmstate_openrisc_cpu;
 #endif
+    cc->gdb_num_core_regs = 32 + 3;
 }
 
 static void cpu_register(const OpenRISCCPUInfo *info)
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 0b0844f..9116193 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8461,6 +8461,8 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
 #endif
+
+    cc->gdb_num_core_regs = 71;
 }
 
 static const TypeInfo ppc_cpu_type_info = {
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index cb89d1a..8f99d7c 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -177,6 +177,7 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = s390_cpu_get_phys_page_debug;
 #endif
     dc->vmsd = &vmstate_s390_cpu;
+    cc->gdb_num_core_regs = S390_NUM_REGS;
 }
 
 static const TypeInfo s390_cpu_type_info = {
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 51a7757..35f0535 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -290,6 +290,7 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
 #endif
     dc->vmsd = &vmstate_sh_cpu;
+    cc->gdb_num_core_regs = 59;
 }
 
 static const TypeInfo superh_cpu_type_info = {
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index d1d0339..388a632 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -791,6 +791,12 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_unassigned_access = sparc_cpu_unassigned_access;
     cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
 #endif
+
+#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
+    cc->gdb_num_core_regs = 86;
+#else
+    cc->gdb_num_core_regs = 72;
+#endif
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index 5a39971..560fa0c 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -85,8 +85,11 @@ static ObjectClass *xtensa_cpu_class_by_name(const char *cpu_model)
 
 static void xtensa_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(dev);
 
+    cs->gdb_num_regs = xcc->config->gdb_regmap.num_regs;
+
     xcc->parent_realize(dev, errp);
 }
 
diff --git a/target-xtensa/helper.c b/target-xtensa/helper.c
index e309879..a0f9993 100644
--- a/target-xtensa/helper.c
+++ b/target-xtensa/helper.c
@@ -37,10 +37,18 @@ static struct XtensaConfigList *xtensa_cores;
 
 static void xtensa_core_class_init(ObjectClass *oc, void *data)
 {
+    CPUClass *cc = CPU_CLASS(oc);
     XtensaCPUClass *xcc = XTENSA_CPU_CLASS(oc);
     const XtensaConfig *config = data;
 
     xcc->config = config;
+
+    /* Use num_core_regs to see only non-privileged registers in an unmodified
+     * gdb. Use num_regs to see all registers. gdb modification is required
+     * for that: reset bit 0 in the 'flags' field of the registers definitions
+     * in the gdb/xtensa-config.c inside gdb source tree or inside gdb overlay.
+     */
+    cc->gdb_num_core_regs = config->gdb_regmap.num_regs;
 }
 
 void xtensa_register_core(XtensaConfigList *node)
commit 19a77215f1ba966c4d37dadec45f38be789b8529
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 11:52:52 2013 +0200

    gdbstub: Drop dead code in cpu_gdb_{read,write}_register()
    
    GET_REG*() macros include a return statement, thus no need for break.
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index cd25c06..9ede3de 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1295,15 +1295,12 @@ static int cpu_gdb_read_register(CPUOpenRISCState *env, uint8_t *mem_buf, int n)
         switch (n) {
         case 32:    /* PPC */
             GET_REG32(env->ppc);
-            break;
 
         case 33:    /* NPC */
             GET_REG32(env->npc);
-            break;
 
         case 34:    /* SR */
             GET_REG32(env->sr);
-            break;
 
         default:
             break;
@@ -1516,14 +1513,11 @@ read_register_crisv10(CPUCRISState *env, uint8_t *mem_buf, int n)
         switch (n) {
         case 16:
             GET_REG8(env->pregs[n - 16]);
-            break;
         case 17:
             GET_REG8(env->pregs[n - 16]);
-            break;
         case 20:
         case 21:
             GET_REG16(env->pregs[n - 16]);
-            break;
         default:
             if (n >= 23) {
                 GET_REG32(env->pregs[n - 16]);
@@ -1693,22 +1687,16 @@ static int cpu_gdb_read_register(CPUS390XState *env, uint8_t *mem_buf, int n)
         cc_op = calc_cc(env, env->cc_op, env->cc_src, env->cc_dst, env->cc_vr);
         val = deposit64(env->psw.mask, 44, 2, cc_op);
         GET_REGL(val);
-        break;
     case S390_PSWA_REGNUM:
         GET_REGL(env->psw.addr);
-        break;
     case S390_R0_REGNUM ... S390_R15_REGNUM:
         GET_REGL(env->regs[n-S390_R0_REGNUM]);
-        break;
     case S390_A0_REGNUM ... S390_A15_REGNUM:
         GET_REG32(env->aregs[n-S390_A0_REGNUM]);
-        break;
     case S390_FPC_REGNUM:
         GET_REG32(env->fpc);
-        break;
     case S390_F0_REGNUM ... S390_F15_REGNUM:
         GET_REG64(env->fregs[n-S390_F0_REGNUM].ll);
-        break;
     }
 
     return 0;
@@ -1762,26 +1750,19 @@ static int cpu_gdb_read_register(CPULM32State *env, uint8_t *mem_buf, int n)
         switch (n) {
         case 32:
             GET_REG32(env->pc);
-            break;
         /* FIXME: put in right exception ID */
         case 33:
             GET_REG32(0);
-            break;
         case 34:
             GET_REG32(env->eba);
-            break;
         case 35:
             GET_REG32(env->deba);
-            break;
         case 36:
             GET_REG32(env->ie);
-            break;
         case 37:
             GET_REG32(lm32_pic_get_im(env->pic_state));
-            break;
         case 38:
             GET_REG32(lm32_pic_get_ip(env->pic_state));
-            break;
         }
     }
     return 0;
@@ -1844,28 +1825,22 @@ static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
     switch (reg->type) {
     case 9: /*pc*/
         GET_REG32(env->pc);
-        break;
 
     case 1: /*ar*/
         xtensa_sync_phys_from_window(env);
         GET_REG32(env->phys_regs[(reg->targno & 0xff) % env->config->nareg]);
-        break;
 
     case 2: /*SR*/
         GET_REG32(env->sregs[reg->targno & 0xff]);
-        break;
 
     case 3: /*UR*/
         GET_REG32(env->uregs[reg->targno & 0xff]);
-        break;
 
     case 4: /*f*/
         GET_REG32(float32_val(env->fregs[reg->targno & 0x0f]));
-        break;
 
     case 8: /*a*/
         GET_REG32(env->regs[reg->targno & 0x0f]);
-        break;
 
     default:
         qemu_log("%s from reg %d of unsupported type %d\n",
commit 47d74ef57a0fe66fa2fdcce46b4daec4f60a1fc8
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 11:17:26 2013 +0200

    gdbstub: Fix cpu_gdb_{read,write}_register() Coding Style
    
    Add braces, replace tabs, remove trailing whitespace, drop space before
    parenthesis and place break etc. below case statements.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 35ca7c2..cd25c06 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -571,26 +571,42 @@ static int cpu_gdb_read_register(CPUX86State *env, uint8_t *mem_buf, int n)
             } else {
                 GET_REG32(env->eip);
             }
-        case IDX_FLAGS_REG: GET_REG32(env->eflags);
-
-        case IDX_SEG_REGS:     GET_REG32(env->segs[R_CS].selector);
-        case IDX_SEG_REGS + 1: GET_REG32(env->segs[R_SS].selector);
-        case IDX_SEG_REGS + 2: GET_REG32(env->segs[R_DS].selector);
-        case IDX_SEG_REGS + 3: GET_REG32(env->segs[R_ES].selector);
-        case IDX_SEG_REGS + 4: GET_REG32(env->segs[R_FS].selector);
-        case IDX_SEG_REGS + 5: GET_REG32(env->segs[R_GS].selector);
+        case IDX_FLAGS_REG:
+            GET_REG32(env->eflags);
+
+        case IDX_SEG_REGS:
+            GET_REG32(env->segs[R_CS].selector);
+        case IDX_SEG_REGS + 1:
+            GET_REG32(env->segs[R_SS].selector);
+        case IDX_SEG_REGS + 2:
+            GET_REG32(env->segs[R_DS].selector);
+        case IDX_SEG_REGS + 3:
+            GET_REG32(env->segs[R_ES].selector);
+        case IDX_SEG_REGS + 4:
+            GET_REG32(env->segs[R_FS].selector);
+        case IDX_SEG_REGS + 5:
+            GET_REG32(env->segs[R_GS].selector);
 
-        case IDX_FP_REGS + 8:  GET_REG32(env->fpuc);
-        case IDX_FP_REGS + 9:  GET_REG32((env->fpus & ~0x3800) |
-                                         (env->fpstt & 0x7) << 11);
-        case IDX_FP_REGS + 10: GET_REG32(0); /* ftag */
-        case IDX_FP_REGS + 11: GET_REG32(0); /* fiseg */
-        case IDX_FP_REGS + 12: GET_REG32(0); /* fioff */
-        case IDX_FP_REGS + 13: GET_REG32(0); /* foseg */
-        case IDX_FP_REGS + 14: GET_REG32(0); /* fooff */
-        case IDX_FP_REGS + 15: GET_REG32(0); /* fop */
+        case IDX_FP_REGS + 8:
+            GET_REG32(env->fpuc);
+        case IDX_FP_REGS + 9:
+            GET_REG32((env->fpus & ~0x3800) |
+                      (env->fpstt & 0x7) << 11);
+        case IDX_FP_REGS + 10:
+            GET_REG32(0); /* ftag */
+        case IDX_FP_REGS + 11:
+            GET_REG32(0); /* fiseg */
+        case IDX_FP_REGS + 12:
+            GET_REG32(0); /* fioff */
+        case IDX_FP_REGS + 13:
+            GET_REG32(0); /* foseg */
+        case IDX_FP_REGS + 14:
+            GET_REG32(0); /* fooff */
+        case IDX_FP_REGS + 15:
+            GET_REG32(0); /* fop */
 
-        case IDX_MXCSR_REG: GET_REG32(env->mxcsr);
+        case IDX_MXCSR_REG:
+            GET_REG32(env->mxcsr);
         }
     }
     return 0;
@@ -612,8 +628,10 @@ static int cpu_x86_gdb_load_seg(CPUX86State *env, int sreg, uint8_t *mem_buf)
             limit = 0xffff;
             flags = 0;
         } else {
-            if (!cpu_x86_get_descr_debug(env, selector, &base, &limit, &flags))
+            if (!cpu_x86_get_descr_debug(env, selector, &base, &limit,
+                                         &flags)) {
                 return 4;
+            }
         }
         cpu_x86_load_seg_cache(env, sreg, selector, base, limit, flags);
 #endif
@@ -664,12 +682,18 @@ static int cpu_gdb_write_register(CPUX86State *env, uint8_t *mem_buf, int n)
             env->eflags = ldl_p(mem_buf);
             return 4;
 
-        case IDX_SEG_REGS:     return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
-        case IDX_SEG_REGS + 1: return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
-        case IDX_SEG_REGS + 2: return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
-        case IDX_SEG_REGS + 3: return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
-        case IDX_SEG_REGS + 4: return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
-        case IDX_SEG_REGS + 5: return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
+        case IDX_SEG_REGS:
+            return cpu_x86_gdb_load_seg(env, R_CS, mem_buf);
+        case IDX_SEG_REGS + 1:
+            return cpu_x86_gdb_load_seg(env, R_SS, mem_buf);
+        case IDX_SEG_REGS + 2:
+            return cpu_x86_gdb_load_seg(env, R_DS, mem_buf);
+        case IDX_SEG_REGS + 3:
+            return cpu_x86_gdb_load_seg(env, R_ES, mem_buf);
+        case IDX_SEG_REGS + 4:
+            return cpu_x86_gdb_load_seg(env, R_FS, mem_buf);
+        case IDX_SEG_REGS + 5:
+            return cpu_x86_gdb_load_seg(env, R_GS, mem_buf);
 
         case IDX_FP_REGS + 8:
             env->fpuc = ldl_p(mem_buf);
@@ -679,12 +703,18 @@ static int cpu_gdb_write_register(CPUX86State *env, uint8_t *mem_buf, int n)
             env->fpstt = (tmp >> 11) & 7;
             env->fpus = tmp & ~0x3800;
             return 4;
-        case IDX_FP_REGS + 10: /* ftag */  return 4;
-        case IDX_FP_REGS + 11: /* fiseg */ return 4;
-        case IDX_FP_REGS + 12: /* fioff */ return 4;
-        case IDX_FP_REGS + 13: /* foseg */ return 4;
-        case IDX_FP_REGS + 14: /* fooff */ return 4;
-        case IDX_FP_REGS + 15: /* fop */   return 4;
+        case IDX_FP_REGS + 10: /* ftag */
+            return 4;
+        case IDX_FP_REGS + 11: /* fiseg */
+            return 4;
+        case IDX_FP_REGS + 12: /* fioff */
+            return 4;
+        case IDX_FP_REGS + 13: /* foseg */
+            return 4;
+        case IDX_FP_REGS + 14: /* fooff */
+            return 4;
+        case IDX_FP_REGS + 15: /* fop */
+            return 4;
 
         case IDX_MXCSR_REG:
             env->mxcsr = ldl_p(mem_buf);
@@ -716,29 +746,37 @@ static int cpu_gdb_read_register(CPUPPCState *env, uint8_t *mem_buf, int n)
         GET_REGL(env->gpr[n]);
     } else if (n < 64) {
         /* fprs */
-        if (gdb_has_xml)
+        if (gdb_has_xml) {
             return 0;
+        }
         stfq_p(mem_buf, env->fpr[n-32]);
         return 8;
     } else {
         switch (n) {
-        case 64: GET_REGL(env->nip);
-        case 65: GET_REGL(env->msr);
+        case 64:
+            GET_REGL(env->nip);
+        case 65:
+            GET_REGL(env->msr);
         case 66:
             {
                 uint32_t cr = 0;
                 int i;
-                for (i = 0; i < 8; i++)
+                for (i = 0; i < 8; i++) {
                     cr |= env->crf[i] << (32 - ((i + 1) * 4));
+                }
                 GET_REG32(cr);
             }
-        case 67: GET_REGL(env->lr);
-        case 68: GET_REGL(env->ctr);
-        case 69: GET_REGL(env->xer);
+        case 67:
+            GET_REGL(env->lr);
+        case 68:
+            GET_REGL(env->ctr);
+        case 69:
+            GET_REGL(env->xer);
         case 70:
             {
-                if (gdb_has_xml)
+                if (gdb_has_xml) {
                     return 0;
+                }
                 GET_REG32(env->fpscr);
             }
         }
@@ -754,8 +792,9 @@ static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
         return sizeof(target_ulong);
     } else if (n < 64) {
         /* fprs */
-        if (gdb_has_xml)
+        if (gdb_has_xml) {
             return 0;
+        }
         env->fpr[n-32] = ldfq_p(mem_buf);
         return 8;
     } else {
@@ -770,8 +809,9 @@ static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
             {
                 uint32_t cr = ldl_p(mem_buf);
                 int i;
-                for (i = 0; i < 8; i++)
+                for (i = 0; i < 8; i++) {
                     env->crf[i] = (cr >> (32 - ((i + 1) * 4))) & 0xF;
+                }
                 return 4;
             }
         case 67:
@@ -785,8 +825,9 @@ static int cpu_gdb_write_register(CPUPPCState *env, uint8_t *mem_buf, int n)
             return sizeof(target_ulong);
         case 70:
             /* fpscr */
-            if (gdb_has_xml)
+            if (gdb_has_xml) {
                 return 0;
+            }
             store_fpscr(env, ldtul_p(mem_buf), 0xffffffff);
             return sizeof(target_ulong);
         }
@@ -829,15 +870,24 @@ static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
     }
     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
     switch (n) {
-    case 64: GET_REGA(env->y);
-    case 65: GET_REGA(cpu_get_psr(env));
-    case 66: GET_REGA(env->wim);
-    case 67: GET_REGA(env->tbr);
-    case 68: GET_REGA(env->pc);
-    case 69: GET_REGA(env->npc);
-    case 70: GET_REGA(env->fsr);
-    case 71: GET_REGA(0); /* csr */
-    default: GET_REGA(0);
+    case 64:
+        GET_REGA(env->y);
+    case 65:
+        GET_REGA(cpu_get_psr(env));
+    case 66:
+        GET_REGA(env->wim);
+    case 67:
+        GET_REGA(env->tbr);
+    case 68:
+        GET_REGA(env->pc);
+    case 69:
+        GET_REGA(env->npc);
+    case 70:
+        GET_REGA(env->fsr);
+    case 71:
+        GET_REGA(0); /* csr */
+    default:
+        GET_REGA(0);
     }
 #else
     if (n < 64) {
@@ -853,15 +903,21 @@ static int cpu_gdb_read_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
         GET_REG64(env->fpr[(n - 32) / 2].ll);
     }
     switch (n) {
-    case 80: GET_REGL(env->pc);
-    case 81: GET_REGL(env->npc);
-    case 82: GET_REGL((cpu_get_ccr(env) << 32) |
-                      ((env->asi & 0xff) << 24) |
-                      ((env->pstate & 0xfff) << 8) |
-                      cpu_get_cwp64(env));
-    case 83: GET_REGL(env->fsr);
-    case 84: GET_REGL(env->fprs);
-    case 85: GET_REGL(env->y);
+    case 80:
+        GET_REGL(env->pc);
+    case 81:
+        GET_REGL(env->npc);
+    case 82:
+        GET_REGL((cpu_get_ccr(env) << 32) |
+                 ((env->asi & 0xff) << 24) |
+                 ((env->pstate & 0xfff) << 8) |
+                 cpu_get_cwp64(env));
+    case 83:
+        GET_REGL(env->fsr);
+    case 84:
+        GET_REGL(env->fprs);
+    case 85:
+        GET_REGL(env->y);
     }
 #endif
     return 0;
@@ -898,14 +954,29 @@ static int cpu_gdb_write_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
     } else {
         /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
         switch (n) {
-        case 64: env->y = tmp; break;
-        case 65: cpu_put_psr(env, tmp); break;
-        case 66: env->wim = tmp; break;
-        case 67: env->tbr = tmp; break;
-        case 68: env->pc = tmp; break;
-        case 69: env->npc = tmp; break;
-        case 70: env->fsr = tmp; break;
-        default: return 0;
+        case 64:
+            env->y = tmp;
+            break;
+        case 65:
+            cpu_put_psr(env, tmp);
+            break;
+        case 66:
+            env->wim = tmp;
+            break;
+        case 67:
+            env->tbr = tmp;
+            break;
+        case 68:
+            env->pc = tmp;
+            break;
+        case 69:
+            env->npc = tmp;
+            break;
+        case 70:
+            env->fsr = tmp;
+            break;
+        default:
+            return 0;
         }
     }
     return 4;
@@ -924,18 +995,29 @@ static int cpu_gdb_write_register(CPUSPARCState *env, uint8_t *mem_buf, int n)
         env->fpr[(n - 32) / 2].ll = tmp;
     } else {
         switch (n) {
-        case 80: env->pc = tmp; break;
-        case 81: env->npc = tmp; break;
+        case 80:
+            env->pc = tmp;
+            break;
+        case 81:
+            env->npc = tmp;
+            break;
         case 82:
             cpu_put_ccr(env, tmp >> 32);
-	    env->asi = (tmp >> 24) & 0xff;
-	    env->pstate = (tmp >> 8) & 0xfff;
+            env->asi = (tmp >> 24) & 0xff;
+            env->pstate = (tmp >> 8) & 0xfff;
             cpu_put_cwp64(env, tmp & 0xff);
-	    break;
-        case 83: env->fsr = tmp; break;
-        case 84: env->fprs = tmp; break;
-        case 85: env->y = tmp; break;
-        default: return 0;
+            break;
+        case 83:
+            env->fsr = tmp;
+            break;
+        case 84:
+            env->fprs = tmp;
+            break;
+        case 85:
+            env->y = tmp;
+            break;
+        default:
+            return 0;
         }
     }
     return 8;
@@ -959,16 +1041,18 @@ static int cpu_gdb_read_register(CPUARMState *env, uint8_t *mem_buf, int n)
     }
     if (n < 24) {
         /* FPA registers.  */
-        if (gdb_has_xml)
+        if (gdb_has_xml) {
             return 0;
+        }
         memset(mem_buf, 0, 12);
         return 12;
     }
     switch (n) {
     case 24:
         /* FPA status register.  */
-        if (gdb_has_xml)
+        if (gdb_has_xml) {
             return 0;
+        }
         GET_REG32(0);
     case 25:
         /* CPSR */
@@ -986,8 +1070,9 @@ static int cpu_gdb_write_register(CPUARMState *env, uint8_t *mem_buf, int n)
 
     /* Mask out low bit of PC to workaround gdb bugs.  This will probably
        cause problems if we ever implement the Jazelle DBX extensions.  */
-    if (n == 15)
+    if (n == 15) {
         tmp &= ~1;
+    }
 
     if (n < 16) {
         /* Core integer register.  */
@@ -996,19 +1081,21 @@ static int cpu_gdb_write_register(CPUARMState *env, uint8_t *mem_buf, int n)
     }
     if (n < 24) { /* 16-23 */
         /* FPA registers (ignored).  */
-        if (gdb_has_xml)
+        if (gdb_has_xml) {
             return 0;
+        }
         return 12;
     }
     switch (n) {
     case 24:
         /* FPA status register (ignored).  */
-        if (gdb_has_xml)
+        if (gdb_has_xml) {
             return 0;
+        }
         return 4;
     case 25:
         /* CPSR */
-        cpsr_write (env, tmp, 0xffffffff);
+        cpsr_write(env, tmp, 0xffffffff);
         return 4;
     }
     /* Unknown register.  */
@@ -1030,9 +1117,11 @@ static int cpu_gdb_read_register(CPUM68KState *env, uint8_t *mem_buf, int n)
         /* A0-A7 */
         GET_REG32(env->aregs[n - 8]);
     } else {
-	switch (n) {
-        case 16: GET_REG32(env->sr);
-        case 17: GET_REG32(env->pc);
+        switch (n) {
+        case 16:
+            GET_REG32(env->sr);
+        case 17:
+            GET_REG32(env->pc);
         }
     }
     /* FP registers not included here because they vary between
@@ -1054,9 +1143,14 @@ static int cpu_gdb_write_register(CPUM68KState *env, uint8_t *mem_buf, int n)
         env->aregs[n - 8] = tmp;
     } else {
         switch (n) {
-        case 16: env->sr = tmp; break;
-        case 17: env->pc = tmp; break;
-        default: return 0;
+        case 16:
+            env->sr = tmp;
+            break;
+        case 17:
+            env->pc = tmp;
+            break;
+        default:
+            return 0;
         }
     }
     return 4;
@@ -1072,44 +1166,55 @@ static int cpu_gdb_read_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
     }
     if (env->CP0_Config1 & (1 << CP0C1_FP)) {
         if (n >= 38 && n < 70) {
-            if (env->CP0_Status & (1 << CP0St_FR))
-		GET_REGL(env->active_fpu.fpr[n - 38].d);
-            else
-		GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
+            if (env->CP0_Status & (1 << CP0St_FR)) {
+                GET_REGL(env->active_fpu.fpr[n - 38].d);
+            } else {
+                GET_REGL(env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
+            }
         }
         switch (n) {
-        case 70: GET_REGL((int32_t)env->active_fpu.fcr31);
-        case 71: GET_REGL((int32_t)env->active_fpu.fcr0);
+        case 70:
+            GET_REGL((int32_t)env->active_fpu.fcr31);
+        case 71:
+            GET_REGL((int32_t)env->active_fpu.fcr0);
         }
     }
     switch (n) {
-    case 32: GET_REGL((int32_t)env->CP0_Status);
-    case 33: GET_REGL(env->active_tc.LO[0]);
-    case 34: GET_REGL(env->active_tc.HI[0]);
-    case 35: GET_REGL(env->CP0_BadVAddr);
-    case 36: GET_REGL((int32_t)env->CP0_Cause);
-    case 37: GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
-    case 72: GET_REGL(0); /* fp */
-    case 89: GET_REGL((int32_t)env->CP0_PRid);
+    case 32:
+        GET_REGL((int32_t)env->CP0_Status);
+    case 33:
+        GET_REGL(env->active_tc.LO[0]);
+    case 34:
+        GET_REGL(env->active_tc.HI[0]);
+    case 35:
+        GET_REGL(env->CP0_BadVAddr);
+    case 36:
+        GET_REGL((int32_t)env->CP0_Cause);
+    case 37:
+        GET_REGL(env->active_tc.PC | !!(env->hflags & MIPS_HFLAG_M16));
+    case 72:
+        GET_REGL(0); /* fp */
+    case 89:
+        GET_REGL((int32_t)env->CP0_PRid);
     }
     if (n >= 73 && n <= 88) {
-	/* 16 embedded regs.  */
-	GET_REGL(0);
+        /* 16 embedded regs.  */
+        GET_REGL(0);
     }
 
     return 0;
 }
 
 /* convert MIPS rounding mode in FCR31 to IEEE library */
-static unsigned int ieee_rm[] =
-  {
+static unsigned int ieee_rm[] = {
     float_round_nearest_even,
     float_round_to_zero,
     float_round_up,
     float_round_down
-  };
+};
 #define RESTORE_ROUNDING_MODE \
-    set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], &env->active_fpu.fp_status)
+    set_float_rounding_mode(ieee_rm[env->active_fpu.fcr31 & 3], \
+                            &env->active_fpu.fp_status)
 
 static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
 {
@@ -1124,10 +1229,11 @@ static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
     if (env->CP0_Config1 & (1 << CP0C1_FP)
             && n >= 38 && n < 73) {
         if (n < 70) {
-            if (env->CP0_Status & (1 << CP0St_FR))
-              env->active_fpu.fpr[n - 38].d = tmp;
-            else
-              env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
+            if (env->CP0_Status & (1 << CP0St_FR)) {
+                env->active_fpu.fpr[n - 38].d = tmp;
+            } else {
+                env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
+            }
         }
         switch (n) {
         case 70:
@@ -1135,16 +1241,28 @@ static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
             /* set rounding mode */
             RESTORE_ROUNDING_MODE;
             break;
-        case 71: env->active_fpu.fcr0 = tmp; break;
+        case 71:
+            env->active_fpu.fcr0 = tmp;
+            break;
         }
         return sizeof(target_ulong);
     }
     switch (n) {
-    case 32: env->CP0_Status = tmp; break;
-    case 33: env->active_tc.LO[0] = tmp; break;
-    case 34: env->active_tc.HI[0] = tmp; break;
-    case 35: env->CP0_BadVAddr = tmp; break;
-    case 36: env->CP0_Cause = tmp; break;
+    case 32:
+        env->CP0_Status = tmp;
+        break;
+    case 33:
+        env->active_tc.LO[0] = tmp;
+        break;
+    case 34:
+        env->active_tc.HI[0] = tmp;
+        break;
+    case 35:
+        env->CP0_BadVAddr = tmp;
+        break;
+    case 36:
+        env->CP0_Cause = tmp;
+        break;
     case 37:
         env->active_tc.PC = tmp & ~(target_ulong)1;
         if (tmp & 1) {
@@ -1153,12 +1271,14 @@ static int cpu_gdb_write_register(CPUMIPSState *env, uint8_t *mem_buf, int n)
             env->hflags &= ~(MIPS_HFLAG_M16);
         }
         break;
-    case 72: /* fp, ignored */ break;
-    default: 
-	if (n > 89)
-	    return 0;
-	/* Other registers are readonly.  Ignore writes.  */
-	break;
+    case 72: /* fp, ignored */
+        break;
+    default:
+        if (n > 89) {
+            return 0;
+        }
+        /* Other registers are readonly.  Ignore writes.  */
+        break;
     }
 
     return sizeof(target_ulong);
@@ -1340,7 +1460,8 @@ static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
     case 51 ... 58:
         env->gregs[n - (51 - 16)] = ldl_p(mem_buf);
         break;
-    default: return 0;
+    default:
+        return 0;
     }
 
     return 4;
@@ -1352,9 +1473,9 @@ static int cpu_gdb_write_register(CPUSH4State *env, uint8_t *mem_buf, int n)
 static int cpu_gdb_read_register(CPUMBState *env, uint8_t *mem_buf, int n)
 {
     if (n < 32) {
-	GET_REG32(env->regs[n]);
+        GET_REG32(env->regs[n]);
     } else {
-	GET_REG32(env->sregs[n - 32]);
+        GET_REG32(env->sregs[n - 32]);
     }
     return 0;
 }
@@ -1363,15 +1484,16 @@ static int cpu_gdb_write_register(CPUMBState *env, uint8_t *mem_buf, int n)
 {
     uint32_t tmp;
 
-    if (n > NUM_CORE_REGS)
-	return 0;
+    if (n > NUM_CORE_REGS) {
+        return 0;
+    }
 
     tmp = ldl_p(mem_buf);
 
     if (n < 32) {
-	env->regs[n] = tmp;
+        env->regs[n] = tmp;
     } else {
-	env->sregs[n - 32] = tmp;
+        env->sregs[n - 32] = tmp;
     }
     return 4;
 }
@@ -1416,27 +1538,34 @@ static int cpu_gdb_read_register(CPUCRISState *env, uint8_t *mem_buf, int n)
 {
     uint8_t srs;
 
-    if (env->pregs[PR_VR] < 32)
+    if (env->pregs[PR_VR] < 32) {
         return read_register_crisv10(env, mem_buf, n);
+    }
 
     srs = env->pregs[PR_SRS];
     if (n < 16) {
-	GET_REG32(env->regs[n]);
+        GET_REG32(env->regs[n]);
     }
 
     if (n >= 21 && n < 32) {
-	GET_REG32(env->pregs[n - 16]);
+        GET_REG32(env->pregs[n - 16]);
     }
     if (n >= 33 && n < 49) {
-	GET_REG32(env->sregs[srs][n - 33]);
+        GET_REG32(env->sregs[srs][n - 33]);
     }
     switch (n) {
-    case 16: GET_REG8(env->pregs[0]);
-    case 17: GET_REG8(env->pregs[1]);
-    case 18: GET_REG32(env->pregs[2]);
-    case 19: GET_REG8(srs);
-    case 20: GET_REG16(env->pregs[4]);
-    case 32: GET_REG32(env->pc);
+    case 16:
+        GET_REG8(env->pregs[0]);
+    case 17:
+        GET_REG8(env->pregs[1]);
+    case 18:
+        GET_REG32(env->pregs[2]);
+    case 19:
+        GET_REG8(srs);
+    case 20:
+        GET_REG16(env->pregs[4]);
+    case 32:
+        GET_REG32(env->pc);
     }
 
     return 0;
@@ -1446,27 +1575,36 @@ static int cpu_gdb_write_register(CPUCRISState *env, uint8_t *mem_buf, int n)
 {
     uint32_t tmp;
 
-    if (n > 49)
-	return 0;
+    if (n > 49) {
+        return 0;
+    }
 
     tmp = ldl_p(mem_buf);
 
     if (n < 16) {
-	env->regs[n] = tmp;
+        env->regs[n] = tmp;
     }
 
     if (n >= 21 && n < 32) {
-	env->pregs[n - 16] = tmp;
+        env->pregs[n - 16] = tmp;
     }
 
     /* FIXME: Should support function regs be writable?  */
     switch (n) {
-    case 16: return 1;
-    case 17: return 1;
-    case 18: env->pregs[PR_PID] = tmp; break;
-    case 19: return 1;
-    case 20: return 2;
-    case 32: env->pc = tmp; break;
+    case 16:
+        return 1;
+    case 17:
+        return 1;
+    case 18:
+        env->pregs[PR_PID] = tmp;
+        break;
+    case 19:
+        return 1;
+    case 20:
+        return 2;
+    case 32:
+        env->pc = tmp;
+        break;
     }
 
     return 4;
@@ -1731,7 +1869,7 @@ static int cpu_gdb_read_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
 
     default:
         qemu_log("%s from reg %d of unsupported type %d\n",
-                __func__, n, reg->type);
+                 __func__, n, reg->type);
         return 0;
     }
 }
@@ -1775,7 +1913,7 @@ static int cpu_gdb_write_register(CPUXtensaState *env, uint8_t *mem_buf, int n)
 
     default:
         qemu_log("%s to reg %d of unsupported type %d\n",
-                __func__, n, reg->type);
+                 __func__, n, reg->type);
         return 0;
     }
 
commit 67cce5617ee968946fc6402f02743fffaa4a1a02
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 7 01:47:51 2013 +0200

    target-xtensa: Introduce XtensaCPU subclasses
    
    Register a CPU type per core registered. Save the XtensaConfig in
    XtensaCPUClass and copy it from there to CPUXtensaState, to avoid
    touching every env->config access for now.
    
    Prepares for storing per-class GDB register count.
    
    Acked-by: Max Filippov <jcmvbkbc at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index b9896f2..1b9479e 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -45,6 +45,7 @@
  * XtensaCPUClass:
  * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
+ * @config: The CPU core configuration.
  *
  * An Xtensa CPU model.
  */
@@ -55,6 +56,8 @@ typedef struct XtensaCPUClass {
 
     DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
+
+    const XtensaConfig *config;
 } XtensaCPUClass;
 
 /**
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index d2bcfc6..5a39971 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -64,6 +64,25 @@ static void xtensa_cpu_reset(CPUState *s)
     reset_mmu(env);
 }
 
+static ObjectClass *xtensa_cpu_class_by_name(const char *cpu_model)
+{
+    ObjectClass *oc;
+    char *typename;
+
+    if (cpu_model == NULL) {
+        return NULL;
+    }
+
+    typename = g_strdup_printf("%s-" TYPE_XTENSA_CPU, cpu_model);
+    oc = object_class_by_name(typename);
+    g_free(typename);
+    if (oc == NULL || !object_class_dynamic_cast(oc, TYPE_XTENSA_CPU) ||
+        object_class_is_abstract(oc)) {
+        return NULL;
+    }
+    return oc;
+}
+
 static void xtensa_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(dev);
@@ -75,10 +94,12 @@ static void xtensa_cpu_initfn(Object *obj)
 {
     CPUState *cs = CPU(obj);
     XtensaCPU *cpu = XTENSA_CPU(obj);
+    XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(obj);
     CPUXtensaState *env = &cpu->env;
     static bool tcg_inited;
 
     cs->env_ptr = env;
+    env->config = xcc->config;
     cpu_exec_init(env);
 
     if (tcg_enabled() && !tcg_inited) {
@@ -105,6 +126,7 @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     xcc->parent_reset = cc->reset;
     cc->reset = xtensa_cpu_reset;
 
+    cc->class_by_name = xtensa_cpu_class_by_name;
     cc->do_interrupt = xtensa_cpu_do_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
@@ -119,7 +141,7 @@ static const TypeInfo xtensa_cpu_type_info = {
     .parent = TYPE_CPU,
     .instance_size = sizeof(XtensaCPU),
     .instance_init = xtensa_cpu_initfn,
-    .abstract = false,
+    .abstract = true,
     .class_size = sizeof(XtensaCPUClass),
     .class_init = xtensa_cpu_class_init,
 };
diff --git a/target-xtensa/helper.c b/target-xtensa/helper.c
index de6cc3b..e309879 100644
--- a/target-xtensa/helper.c
+++ b/target-xtensa/helper.c
@@ -35,10 +35,27 @@
 
 static struct XtensaConfigList *xtensa_cores;
 
+static void xtensa_core_class_init(ObjectClass *oc, void *data)
+{
+    XtensaCPUClass *xcc = XTENSA_CPU_CLASS(oc);
+    const XtensaConfig *config = data;
+
+    xcc->config = config;
+}
+
 void xtensa_register_core(XtensaConfigList *node)
 {
+    TypeInfo type = {
+        .parent = TYPE_XTENSA_CPU,
+        .class_init = xtensa_core_class_init,
+        .class_data = (void *)node->config,
+    };
+
     node->next = xtensa_cores;
     xtensa_cores = node;
+    type.name = g_strdup_printf("%s-" TYPE_XTENSA_CPU, node->config->name);
+    type_register(&type);
+    g_free((gpointer)type.name);
 }
 
 static uint32_t check_hw_breakpoints(CPUXtensaState *env)
@@ -72,24 +89,17 @@ void xtensa_breakpoint_handler(CPUXtensaState *env)
 
 XtensaCPU *cpu_xtensa_init(const char *cpu_model)
 {
+    ObjectClass *oc;
     XtensaCPU *cpu;
     CPUXtensaState *env;
-    const XtensaConfig *config = NULL;
-    XtensaConfigList *core = xtensa_cores;
-
-    for (; core; core = core->next)
-        if (strcmp(core->config->name, cpu_model) == 0) {
-            config = core->config;
-            break;
-        }
 
-    if (config == NULL) {
+    oc = cpu_class_by_name(TYPE_XTENSA_CPU, cpu_model);
+    if (oc == NULL) {
         return NULL;
     }
 
-    cpu = XTENSA_CPU(object_new(TYPE_XTENSA_CPU));
+    cpu = XTENSA_CPU(object_new(object_class_get_name(oc)));
     env = &cpu->env;
-    env->config = config;
 
     xtensa_irq_init(env);
 
commit 9282b73a4078f10b5d1c96707aeed213eedbc8e1
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Fri Jul 26 17:48:06 2013 +0200

    target-s390x: Fix CPUState rework fallout
    
    Commit f17ec444c3d39f76bcd8b71c2c05d5754bfe333e
    exec: Change cpu_memory_rw_debug() argument to CPUState
    
    missed to update s390x KVM code, breaking the build.
    
    Let's fix it up.
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 60e94f8..85f0112 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -345,12 +345,10 @@ void *kvm_arch_ram_alloc(ram_addr_t size)
 
 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 {
-    S390CPU *cpu = S390_CPU(cs);
-    CPUS390XState *env = &cpu->env;
     static const uint8_t diag_501[] = {0x83, 0x24, 0x05, 0x01};
 
-    if (cpu_memory_rw_debug(env, bp->pc, (uint8_t *)&bp->saved_insn, 4, 0) ||
-        cpu_memory_rw_debug(env, bp->pc, (uint8_t *)diag_501, 4, 1)) {
+    if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 0) ||
+        cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)diag_501, 4, 1)) {
         return -EINVAL;
     }
     return 0;
@@ -358,16 +356,14 @@ int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 
 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 {
-    S390CPU *cpu = S390_CPU(cs);
-    CPUS390XState *env = &cpu->env;
     uint8_t t[4];
     static const uint8_t diag_501[] = {0x83, 0x24, 0x05, 0x01};
 
-    if (cpu_memory_rw_debug(env, bp->pc, t, 4, 0)) {
+    if (cpu_memory_rw_debug(cs, bp->pc, t, 4, 0)) {
         return -EINVAL;
     } else if (memcmp(t, diag_501, 4)) {
         return -EINVAL;
-    } else if (cpu_memory_rw_debug(env, bp->pc, (uint8_t *)&bp->saved_insn, 1, 1)) {
+    } else if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 1)) {
         return -EINVAL;
     }
 
commit 38e478eccfb1ace415914a331c8e1b16ae64b57f
Author: Stefan Weil <sw at weilnetz.de>
Date:   Thu Jul 25 20:50:21 2013 +0200

    kvm: Change prototype of kvm_update_guest_debug()
    
    Passing a CPUState pointer instead of a CPUArchState pointer eliminates
    the last target dependent data type in sysemu/kvm.h.
    
    It also simplifies the code.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/exec.c b/exec.c
index 3ba9525..c4f2894 100644
--- a/exec.c
+++ b/exec.c
@@ -590,15 +590,14 @@ void cpu_breakpoint_remove_all(CPUArchState *env, int mask)
 void cpu_single_step(CPUState *cpu, int enabled)
 {
 #if defined(TARGET_HAS_ICE)
-    CPUArchState *env = cpu->env_ptr;
-
     if (cpu->singlestep_enabled != enabled) {
         cpu->singlestep_enabled = enabled;
         if (kvm_enabled()) {
-            kvm_update_guest_debug(env, 0);
+            kvm_update_guest_debug(cpu, 0);
         } else {
             /* must flush all the translated code to avoid inconsistencies */
             /* XXX: only flush what is necessary */
+            CPUArchState *env = cpu->env_ptr;
             tb_flush(env);
         }
     }
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index f8ac448..de74411 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -174,7 +174,7 @@ int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
 int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type);
 void kvm_remove_all_breakpoints(CPUState *cpu);
-int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap);
+int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap);
 #ifndef _WIN32
 int kvm_set_signal_mask(CPUState *cpu, const sigset_t *sigset);
 #endif
diff --git a/kvm-all.c b/kvm-all.c
index 4fb4ccb..716860f 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1883,9 +1883,8 @@ static void kvm_invoke_set_guest_debug(void *data)
                                    &dbg_data->dbg);
 }
 
-int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
+int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_set_guest_debug_data data;
 
     data.dbg.control = reinject_trap;
@@ -1935,9 +1934,7 @@ int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
     }
 
     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
-        CPUArchState *env = cpu->env_ptr;
-
-        err = kvm_update_guest_debug(env, 0);
+        err = kvm_update_guest_debug(cpu, 0);
         if (err) {
             return err;
         }
@@ -1977,9 +1974,7 @@ int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
     }
 
     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
-        CPUArchState *env = cpu->env_ptr;
-
-        err = kvm_update_guest_debug(env, 0);
+        err = kvm_update_guest_debug(cpu, 0);
         if (err) {
             return err;
         }
@@ -2007,15 +2002,13 @@ void kvm_remove_all_breakpoints(CPUState *cpu)
     kvm_arch_remove_all_hw_breakpoints();
 
     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
-        CPUArchState *env = cpu->env_ptr;
-
-        kvm_update_guest_debug(env, 0);
+        kvm_update_guest_debug(cpu, 0);
     }
 }
 
 #else /* !KVM_CAP_SET_GUEST_DEBUG */
 
-int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
+int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
 {
     return -EINVAL;
 }
diff --git a/kvm-stub.c b/kvm-stub.c
index 7b2233a..771360b 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -78,7 +78,7 @@ void kvm_setup_guest_memory(void *start, size_t size)
 {
 }
 
-int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
+int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
 {
     return -ENOSYS;
 }
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 3c9d10a..376fc70 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -1618,7 +1618,7 @@ static int kvm_guest_debug_workarounds(X86CPU *cpu)
      */
     if (reinject_trap ||
         (!kvm_has_robust_singlestep() && cs->singlestep_enabled)) {
-        ret = kvm_update_guest_debug(env, reinject_trap);
+        ret = kvm_update_guest_debug(cs, reinject_trap);
     }
     return ret;
 }
commit 0ac46af39ee84461782b6f096ba1a165c7b0e503
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:42:25 2013 +0200

    linux-user: Avoid redundant ENV_GET_CPU()
    
    This fixes a mismerge in 874ec3c5b3821bb964f9f37b2f930f2a9ce51652.
    
    Acked-by: Riku Voipio <riku.voipio at iki.fi>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/linux-user/main.c b/linux-user/main.c
index 5dc0947..5309117 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3637,7 +3637,7 @@ int main(int argc, char **argv, char **envp)
         exit(1);
     }
     cpu = ENV_GET_CPU(env);
-    cpu_reset(ENV_GET_CPU(env));
+    cpu_reset(cpu);
 
     thread_cpu = cpu;
 
commit e3409362bd64731e042c9d001e43cc1d13d2df5d
Author: Ian Main <imain at redhat.com>
Date:   Fri Jul 26 11:39:05 2013 -0700

    Add tests for sync modes 'TOP' and 'NONE'
    
    This patch adds tests for sync modes top and none.  Test for 'TOP'
    is separated out as it requires a backing file.  Also added a test
    for invalid format.
    
    Signed-off-by: Ian Main <imain at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/055 b/tests/qemu-iotests/055
index c66f8db..44bb025 100755
--- a/tests/qemu-iotests/055
+++ b/tests/qemu-iotests/055
@@ -97,6 +97,12 @@ class TestSingleDrive(iotests.QMPTestCase):
                              target=target_img, sync='full', mode='existing')
         self.assert_qmp(result, 'error/class', 'GenericError')
 
+    def test_invalid_format(self):
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             target=target_img, sync='full',
+                             format='spaghetti-noodles')
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
     def test_device_not_found(self):
         result = self.vm.qmp('drive-backup', device='nonexistent',
                              target=target_img, sync='full')
diff --git a/tests/qemu-iotests/055.out b/tests/qemu-iotests/055.out
index fa16b5c..6323079 100644
--- a/tests/qemu-iotests/055.out
+++ b/tests/qemu-iotests/055.out
@@ -1,5 +1,5 @@
-.............
+..............
 ----------------------------------------------------------------------
-Ran 13 tests
+Ran 14 tests
 
 OK
diff --git a/tests/qemu-iotests/056 b/tests/qemu-iotests/056
new file mode 100755
index 0000000..6389342
--- /dev/null
+++ b/tests/qemu-iotests/056
@@ -0,0 +1,94 @@
+#!/usr/bin/env python
+#
+# Tests for drive-backup
+#
+# Copyright (C) 2013 Red Hat, Inc.
+#
+# Based on 041.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import time
+import os
+import iotests
+from iotests import qemu_img, qemu_io, create_image
+
+backing_img = os.path.join(iotests.test_dir, 'backing.img')
+test_img = os.path.join(iotests.test_dir, 'test.img')
+target_img = os.path.join(iotests.test_dir, 'target.img')
+
+class TestSyncModesNoneAndTop(iotests.QMPTestCase):
+    image_len = 64 * 1024 * 1024 # MB
+
+    def setUp(self):
+        create_image(backing_img, TestSyncModesNoneAndTop.image_len)
+        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_io('-c', 'write -P0x41 0 512', test_img)
+        qemu_io('-c', 'write -P0xd5 1M 32k', test_img)
+        qemu_io('-c', 'write -P0xdc 32M 124k', test_img)
+        qemu_io('-c', 'write -P0xdc 67043328 64k', test_img)
+        self.vm = iotests.VM().add_drive(test_img)
+        self.vm.launch()
+
+    def tearDown(self):
+        self.vm.shutdown()
+        os.remove(test_img)
+        os.remove(backing_img)
+        try:
+            os.remove(target_img)
+        except OSError:
+            pass
+
+    def test_complete_top(self):
+        self.assert_no_active_block_jobs()
+        result = self.vm.qmp('drive-backup', device='drive0', sync='top',
+                             format=iotests.imgfmt, target=target_img)
+        self.assert_qmp(result, 'return', {})
+
+        # Custom completed check as we are not copying all data.
+        completed = False
+        while not completed:
+            for event in self.vm.get_qmp_events(wait=True):
+                if event['event'] == 'BLOCK_JOB_COMPLETED':
+                    self.assert_qmp(event, 'data/device', 'drive0')
+                    self.assert_qmp_absent(event, 'data/error')
+                    completed = True
+
+        self.assert_no_active_block_jobs()
+        self.vm.shutdown()
+        self.assertTrue(iotests.compare_images(test_img, target_img),
+                        'target image does not match source after backup')
+
+    def test_cancel_sync_none(self):
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             sync='none', target=target_img)
+        self.assert_qmp(result, 'return', {})
+        time.sleep(1)
+        self.vm.hmp_qemu_io('drive0', 'write -P0x5e 0 512')
+        self.vm.hmp_qemu_io('drive0', 'aio_flush')
+        # Verify that the original contents exist in the target image.
+
+        event = self.cancel_and_wait()
+        self.assert_qmp(event, 'data/type', 'backup')
+
+        self.vm.shutdown()
+        time.sleep(1)
+        self.assertEqual(-1, qemu_io('-c', 'read -P0x41 0 512', target_img).find("verification failed"))
+
+
+if __name__ == '__main__':
+    iotests.main(supported_fmts=['qcow2', 'qed'])
diff --git a/tests/qemu-iotests/056.out b/tests/qemu-iotests/056.out
new file mode 100644
index 0000000..fbc63e6
--- /dev/null
+++ b/tests/qemu-iotests/056.out
@@ -0,0 +1,5 @@
+..
+----------------------------------------------------------------------
+Ran 2 tests
+
+OK
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index fdc6ed1..b1d03c7 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -62,3 +62,4 @@
 053 rw auto
 054 rw auto
 055 rw auto
+056 rw auto backing
diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
index b028a89..33ad0ec 100644
--- a/tests/qemu-iotests/iotests.py
+++ b/tests/qemu-iotests/iotests.py
@@ -95,6 +95,11 @@ class VM(object):
         self._num_drives += 1
         return self
 
+    def hmp_qemu_io(self, drive, cmd):
+        '''Write to a given drive using an HMP command'''
+        return self.qmp('human-monitor-command',
+                        command_line='qemu-io %s "%s"' % (drive, cmd))
+
     def add_fd(self, fd, fdset, opaque, opts=''):
         '''Pass a file descriptor to the VM'''
         options = ['fd=%d' % fd,
commit fc5d3f843250c9d3bfa2bcfdb7369f4753a49f0e
Author: Ian Main <imain at redhat.com>
Date:   Fri Jul 26 11:39:04 2013 -0700

    Implement sync modes for drive-backup.
    
    This patch adds sync-modes to the drive-backup interface and
    implements the FULL, NONE and TOP modes of synchronization.
    
    FULL performs as before copying the entire contents of the drive
    while preserving the point-in-time using CoW.
    NONE only copies new writes to the target drive.
    TOP copies changes to the topmost drive image and preserves the
    point-in-time using CoW.
    
    For sync mode TOP are creating a new target image using the same backing
    file as the original disk image.  Then any new data that has been laid
    on top of it since creation is copied in the main backup_run() loop.
    There is an extra check in the 'TOP' case so that we don't bother to copy
    all the data of the backing file as it already exists in the target.
    This is where the bdrv_co_is_allocated() is used to determine if the
    data exists in the topmost layer or below.
    
    Also any new data being written is intercepted via the write_notifier
    hook which ends up calling backup_do_cow() to copy old data out before
    it gets overwritten.
    
    For mode 'NONE' we create the new target image and only copy in the
    original data from the disk image starting from the time the call was
    made.  This preserves the point in time data by only copying the parts
    that are *going to change* to the target image.  This way we can
    reconstruct the final image by checking to see if the given block exists
    in the new target image first, and if it does not, you can get it from
    the original image.  This is basically an optimization allowing you to
    do point-in-time snapshots with low overhead vs the 'FULL' version.
    
    Since there is no old data to copy out the loop in backup_run() for the
    NONE case just calls qemu_coroutine_yield() which only wakes up after
    an event (usually cancel in this case).  The rest is handled by the
    before_write notifier which again calls backup_do_cow() to write out
    the old data so it can be preserved.
    
    Signed-off-by: Ian Main <imain at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/backup.c b/block/backup.c
index 16105d4..6ae8a05 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -37,6 +37,7 @@ typedef struct CowRequest {
 typedef struct BackupBlockJob {
     BlockJob common;
     BlockDriverState *target;
+    MirrorSyncMode sync_mode;
     RateLimit limit;
     BlockdevOnError on_source_error;
     BlockdevOnError on_target_error;
@@ -247,40 +248,83 @@ static void coroutine_fn backup_run(void *opaque)
 
     bdrv_add_before_write_notifier(bs, &before_write);
 
-    for (; start < end; start++) {
-        bool error_is_read;
-
-        if (block_job_is_cancelled(&job->common)) {
-            break;
+    if (job->sync_mode == MIRROR_SYNC_MODE_NONE) {
+        while (!block_job_is_cancelled(&job->common)) {
+            /* Yield until the job is cancelled.  We just let our before_write
+             * notify callback service CoW requests. */
+            job->common.busy = false;
+            qemu_coroutine_yield();
+            job->common.busy = true;
         }
+    } else {
+        /* Both FULL and TOP SYNC_MODE's require copying.. */
+        for (; start < end; start++) {
+            bool error_is_read;
 
-        /* we need to yield so that qemu_aio_flush() returns.
-         * (without, VM does not reboot)
-         */
-        if (job->common.speed) {
-            uint64_t delay_ns = ratelimit_calculate_delay(
-                &job->limit, job->sectors_read);
-            job->sectors_read = 0;
-            block_job_sleep_ns(&job->common, rt_clock, delay_ns);
-        } else {
-            block_job_sleep_ns(&job->common, rt_clock, 0);
-        }
+            if (block_job_is_cancelled(&job->common)) {
+                break;
+            }
 
-        if (block_job_is_cancelled(&job->common)) {
-            break;
-        }
+            /* we need to yield so that qemu_aio_flush() returns.
+             * (without, VM does not reboot)
+             */
+            if (job->common.speed) {
+                uint64_t delay_ns = ratelimit_calculate_delay(
+                        &job->limit, job->sectors_read);
+                job->sectors_read = 0;
+                block_job_sleep_ns(&job->common, rt_clock, delay_ns);
+            } else {
+                block_job_sleep_ns(&job->common, rt_clock, 0);
+            }
 
-        ret = backup_do_cow(bs, start * BACKUP_SECTORS_PER_CLUSTER,
-                            BACKUP_SECTORS_PER_CLUSTER, &error_is_read);
-        if (ret < 0) {
-            /* Depending on error action, fail now or retry cluster */
-            BlockErrorAction action =
-                backup_error_action(job, error_is_read, -ret);
-            if (action == BDRV_ACTION_REPORT) {
+            if (block_job_is_cancelled(&job->common)) {
                 break;
-            } else {
-                start--;
-                continue;
+            }
+
+            if (job->sync_mode == MIRROR_SYNC_MODE_TOP) {
+                int i, n;
+                int alloced = 0;
+
+                /* Check to see if these blocks are already in the
+                 * backing file. */
+
+                for (i = 0; i < BACKUP_SECTORS_PER_CLUSTER;) {
+                    /* bdrv_co_is_allocated() only returns true/false based
+                     * on the first set of sectors it comes accross that
+                     * are are all in the same state.
+                     * For that reason we must verify each sector in the
+                     * backup cluster length.  We end up copying more than
+                     * needed but at some point that is always the case. */
+                    alloced =
+                        bdrv_co_is_allocated(bs,
+                                start * BACKUP_SECTORS_PER_CLUSTER + i,
+                                BACKUP_SECTORS_PER_CLUSTER - i, &n);
+                    i += n;
+
+                    if (alloced == 1) {
+                        break;
+                    }
+                }
+
+                /* If the above loop never found any sectors that are in
+                 * the topmost image, skip this backup. */
+                if (alloced == 0) {
+                    continue;
+                }
+            }
+            /* FULL sync mode we copy the whole drive. */
+            ret = backup_do_cow(bs, start * BACKUP_SECTORS_PER_CLUSTER,
+                    BACKUP_SECTORS_PER_CLUSTER, &error_is_read);
+            if (ret < 0) {
+                /* Depending on error action, fail now or retry cluster */
+                BlockErrorAction action =
+                    backup_error_action(job, error_is_read, -ret);
+                if (action == BDRV_ACTION_REPORT) {
+                    break;
+                } else {
+                    start--;
+                    continue;
+                }
             }
         }
     }
@@ -300,7 +344,7 @@ static void coroutine_fn backup_run(void *opaque)
 }
 
 void backup_start(BlockDriverState *bs, BlockDriverState *target,
-                  int64_t speed,
+                  int64_t speed, MirrorSyncMode sync_mode,
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
                   BlockDriverCompletionFunc *cb, void *opaque,
@@ -335,6 +379,7 @@ void backup_start(BlockDriverState *bs, BlockDriverState *target,
     job->on_source_error = on_source_error;
     job->on_target_error = on_target_error;
     job->target = target;
+    job->sync_mode = sync_mode;
     job->common.len = len;
     job->common.co = qemu_coroutine_create(backup_run);
     qemu_coroutine_enter(job->common.co, job);
diff --git a/blockdev.c b/blockdev.c
index ef55b1a..4534864 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1489,16 +1489,13 @@ void qmp_drive_backup(const char *device, const char *target,
 {
     BlockDriverState *bs;
     BlockDriverState *target_bs;
+    BlockDriverState *source = NULL;
     BlockDriver *drv = NULL;
     Error *local_err = NULL;
     int flags;
     int64_t size;
     int ret;
 
-    if (sync != MIRROR_SYNC_MODE_FULL) {
-        error_setg(errp, "only sync mode 'full' is currently supported");
-        return;
-    }
     if (!has_speed) {
         speed = 0;
     }
@@ -1541,6 +1538,18 @@ void qmp_drive_backup(const char *device, const char *target,
 
     flags = bs->open_flags | BDRV_O_RDWR;
 
+    /* See if we have a backing HD we can use to create our new image
+     * on top of. */
+    if (sync == MIRROR_SYNC_MODE_TOP) {
+        source = bs->backing_hd;
+        if (!source) {
+            sync = MIRROR_SYNC_MODE_FULL;
+        }
+    }
+    if (sync == MIRROR_SYNC_MODE_NONE) {
+        source = bs;
+    }
+
     size = bdrv_getlength(bs);
     if (size < 0) {
         error_setg_errno(errp, -size, "bdrv_getlength failed");
@@ -1549,8 +1558,14 @@ void qmp_drive_backup(const char *device, const char *target,
 
     if (mode != NEW_IMAGE_MODE_EXISTING) {
         assert(format && drv);
-        bdrv_img_create(target, format,
-                        NULL, NULL, NULL, size, flags, &local_err, false);
+        if (source) {
+            bdrv_img_create(target, format, source->filename,
+                            source->drv->format_name, NULL,
+                            size, flags, &local_err, false);
+        } else {
+            bdrv_img_create(target, format, NULL, NULL, NULL,
+                            size, flags, &local_err, false);
+        }
     }
 
     if (error_is_set(&local_err)) {
@@ -1566,7 +1581,7 @@ void qmp_drive_backup(const char *device, const char *target,
         return;
     }
 
-    backup_start(bs, target_bs, speed, on_source_error, on_target_error,
+    backup_start(bs, target_bs, speed, sync, on_source_error, on_target_error,
                  block_job_cb, bs, &local_err);
     if (local_err != NULL) {
         bdrv_delete(target_bs);
diff --git a/include/block/block_int.h b/include/block/block_int.h
index c6ac871..e45f2a0 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -404,6 +404,7 @@ void mirror_start(BlockDriverState *bs, BlockDriverState *target,
  * @bs: Block device to operate on.
  * @target: Block device to write to.
  * @speed: The maximum speed, in bytes per second, or 0 for unlimited.
+ * @sync_mode: What parts of the disk image should be copied to the destination.
  * @on_source_error: The action to take upon error reading from the source.
  * @on_target_error: The action to take upon error writing to the target.
  * @cb: Completion function for the job.
@@ -413,7 +414,8 @@ void mirror_start(BlockDriverState *bs, BlockDriverState *target,
  * until the job is cancelled or manually completed.
  */
 void backup_start(BlockDriverState *bs, BlockDriverState *target,
-                  int64_t speed, BlockdevOnError on_source_error,
+                  int64_t speed, MirrorSyncMode sync_mode,
+                  BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
                   BlockDriverCompletionFunc *cb, void *opaque,
                   Error **errp);
diff --git a/qmp-commands.hx b/qmp-commands.hx
index 65a9e26..2e59b0d 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -960,6 +960,7 @@ Arguments:
 
 Example:
 -> { "execute": "drive-backup", "arguments": { "device": "drive0",
+                                               "sync": "full",
                                                "target": "backup.img" } }
 <- { "return": {} }
 EQMP
commit f660dc6a2e97756596b2e79ce6127a3034f2308b
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Jul 8 17:11:58 2013 +0200

    Implement qdict_flatten()
    
    qdict_flatten(): For each nested QDict with key x, all fields with key y
    are moved to this QDict and their key is renamed to "x.y". This operation
    is applied recursively for nested QDicts.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/include/qapi/qmp/qdict.h b/include/qapi/qmp/qdict.h
index 685b2e3..d6855d1 100644
--- a/include/qapi/qmp/qdict.h
+++ b/include/qapi/qmp/qdict.h
@@ -65,5 +65,6 @@ int qdict_get_try_bool(const QDict *qdict, const char *key, int def_value);
 const char *qdict_get_try_str(const QDict *qdict, const char *key);
 
 QDict *qdict_clone_shallow(const QDict *src);
+void qdict_flatten(QDict *qdict);
 
 #endif /* QDICT_H */
diff --git a/qobject/qdict.c b/qobject/qdict.c
index ed381f9..472f106 100644
--- a/qobject/qdict.c
+++ b/qobject/qdict.c
@@ -476,3 +476,54 @@ static void qdict_destroy_obj(QObject *obj)
 
     g_free(qdict);
 }
+
+static void qdict_do_flatten(QDict *qdict, QDict *target, const char *prefix)
+{
+    QObject *value;
+    const QDictEntry *entry, *next;
+    const char *new_key;
+    bool delete;
+
+    entry = qdict_first(qdict);
+
+    while (entry != NULL) {
+
+        next = qdict_next(qdict, entry);
+        value = qdict_entry_value(entry);
+        new_key = NULL;
+        delete = false;
+
+        if (prefix) {
+            qobject_incref(value);
+            new_key = g_strdup_printf("%s.%s", prefix, entry->key);
+            qdict_put_obj(target, new_key, value);
+            delete = true;
+        }
+
+        if (qobject_type(value) == QTYPE_QDICT) {
+            qdict_do_flatten(qobject_to_qdict(value), target,
+                             new_key ? new_key : entry->key);
+            delete = true;
+        }
+
+        if (delete) {
+            qdict_del(qdict, entry->key);
+
+            /* Restart loop after modifying the iterated QDict */
+            entry = qdict_first(qdict);
+            continue;
+        }
+
+        entry = next;
+    }
+}
+
+/**
+ * qdict_flatten(): For each nested QDict with key x, all fields with key y
+ * are moved to this QDict and their key is renamed to "x.y". This operation
+ * is applied recursively for nested QDicts.
+ */
+void qdict_flatten(QDict *qdict)
+{
+    qdict_do_flatten(qdict, qdict, NULL);
+}
commit 29c4e2b50d95f4a15c3dd62b39f3402f05a34907
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Thu Jul 18 16:31:25 2013 +0200

    blockdev: Split up 'cache' option
    
    The old 'cache' option really encodes three different boolean flags into
    a cache mode name, without providing all combinations. Make them three
    separate options instead and translate the old option to the new ones
    for drive_init().
    
    The specific boolean options take precedence if the old cache option is
    specified as well, so the following options are equivalent:
    
    -drive file=x,cache=none,cache.no-flush=true
    -drive file=x,cache.writeback=true,cache.direct=true,cache.no-flush=true
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 3b05e29..ef55b1a 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -452,12 +452,15 @@ static DriveInfo *blockdev_init(QemuOpts *all_opts,
         }
     }
 
-    bdrv_flags |= BDRV_O_CACHE_WB;
-    if ((buf = qemu_opt_get(opts, "cache")) != NULL) {
-        if (bdrv_parse_cache_flags(buf, &bdrv_flags) != 0) {
-            error_report("invalid cache option");
-            return NULL;
-        }
+    bdrv_flags = 0;
+    if (qemu_opt_get_bool(opts, "cache.writeback", true)) {
+        bdrv_flags |= BDRV_O_CACHE_WB;
+    }
+    if (qemu_opt_get_bool(opts, "cache.direct", false)) {
+        bdrv_flags |= BDRV_O_NOCACHE;
+    }
+    if (qemu_opt_get_bool(opts, "cache.no-flush", true)) {
+        bdrv_flags |= BDRV_O_NO_FLUSH;
     }
 
 #ifdef CONFIG_LINUX_AIO
@@ -740,6 +743,8 @@ static void qemu_opt_rename(QemuOpts *opts, const char *from, const char *to)
 
 DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
 {
+    const char *value;
+
     /* Change legacy command line options into QMP ones */
     qemu_opt_rename(all_opts, "iops", "throttling.iops-total");
     qemu_opt_rename(all_opts, "iops_rd", "throttling.iops-read");
@@ -751,6 +756,31 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
 
     qemu_opt_rename(all_opts, "readonly", "read-only");
 
+    value = qemu_opt_get(all_opts, "cache");
+    if (value) {
+        int flags = 0;
+
+        if (bdrv_parse_cache_flags(value, &flags) != 0) {
+            error_report("invalid cache option");
+            return NULL;
+        }
+
+        /* Specific options take precedence */
+        if (!qemu_opt_get(all_opts, "cache.writeback")) {
+            qemu_opt_set_bool(all_opts, "cache.writeback",
+                              !!(flags & BDRV_O_CACHE_WB));
+        }
+        if (!qemu_opt_get(all_opts, "cache.direct")) {
+            qemu_opt_set_bool(all_opts, "cache.direct",
+                              !!(flags & BDRV_O_NOCACHE));
+        }
+        if (!qemu_opt_get(all_opts, "cache.no-flush")) {
+            qemu_opt_set_bool(all_opts, "cache.no-flush",
+                              !!(flags & BDRV_O_NO_FLUSH));
+        }
+        qemu_opt_unset(all_opts, "cache");
+    }
+
     return blockdev_init(all_opts, block_default_type);
 }
 
@@ -1850,10 +1880,17 @@ QemuOptsList qemu_common_drive_opts = {
             .type = QEMU_OPT_STRING,
             .help = "discard operation (ignore/off, unmap/on)",
         },{
-            .name = "cache",
-            .type = QEMU_OPT_STRING,
-            .help = "host cache usage (none, writeback, writethrough, "
-                    "directsync, unsafe)",
+            .name = "cache.writeback",
+            .type = QEMU_OPT_BOOL,
+            .help = "enables writeback mode for any caches",
+        },{
+            .name = "cache.direct",
+            .type = QEMU_OPT_BOOL,
+            .help = "enables use of O_DIRECT (bypass the host page cache)",
+        },{
+            .name = "cache.no-flush",
+            .type = QEMU_OPT_BOOL,
+            .help = "ignore any flush requests for the device",
         },{
             .name = "aio",
             .type = QEMU_OPT_STRING,
commit 0f227a947004aa9043d4386f4a47d6739499b88f
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Jul 19 20:07:29 2013 +0200

    blockdev: Rename 'readonly' option to 'read-only'
    
    Option name cleanup before it becomes a QMP API.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 5403188..3b05e29 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -378,7 +378,7 @@ static DriveInfo *blockdev_init(QemuOpts *all_opts,
     secs  = qemu_opt_get_number(opts, "secs", 0);
 
     snapshot = qemu_opt_get_bool(opts, "snapshot", 0);
-    ro = qemu_opt_get_bool(opts, "readonly", 0);
+    ro = qemu_opt_get_bool(opts, "read-only", 0);
     copy_on_read = qemu_opt_get_bool(opts, "copy-on-read", false);
 
     file = qemu_opt_get(opts, "file");
@@ -684,7 +684,7 @@ static DriveInfo *blockdev_init(QemuOpts *all_opts,
     } else if (ro == 1) {
         if (type != IF_SCSI && type != IF_VIRTIO && type != IF_FLOPPY &&
             type != IF_NONE && type != IF_PFLASH) {
-            error_report("readonly not supported by this bus type");
+            error_report("read-only not supported by this bus type");
             goto err;
         }
     }
@@ -692,7 +692,7 @@ static DriveInfo *blockdev_init(QemuOpts *all_opts,
     bdrv_flags |= ro ? 0 : BDRV_O_RDWR;
 
     if (ro && copy_on_read) {
-        error_report("warning: disabling copy_on_read on readonly drive");
+        error_report("warning: disabling copy_on_read on read-only drive");
     }
 
     QINCREF(bs_opts);
@@ -749,6 +749,8 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
     qemu_opt_rename(all_opts, "bps_rd", "throttling.bps-read");
     qemu_opt_rename(all_opts, "bps_wr", "throttling.bps-write");
 
+    qemu_opt_rename(all_opts, "readonly", "read-only");
+
     return blockdev_init(all_opts, block_default_type);
 }
 
@@ -1877,7 +1879,7 @@ QemuOptsList qemu_common_drive_opts = {
             .type = QEMU_OPT_STRING,
             .help = "pci address (virtio only)",
         },{
-            .name = "readonly",
+            .name = "read-only",
             .type = QEMU_OPT_BOOL,
             .help = "open drive file as read-only",
         },{
diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index c676538..9588d0c 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -137,7 +137,7 @@ QEMU 1.5.50 monitor - type 'help' for more information
 (qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=ide,readonly=on
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,if=ide,readonly=on: readonly not supported by this bus type
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,if=ide,readonly=on: read-only not supported by this bus type
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=virtio,readonly=on
 QEMU 1.5.50 monitor - type 'help' for more information
commit 64aa99d3e0333dea73d7505190659a02ca909292
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jul 17 14:45:34 2013 +0200

    qcow2: Use dashes instead of underscores in options
    
    This is what QMP wants to use. The options haven't been enabled in any
    release yet, so we're still free to change them.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/qcow2.c b/block/qcow2.c
index 0eceefe..3376901 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -291,7 +291,7 @@ static QemuOptsList qcow2_runtime_opts = {
     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
     .desc = {
         {
-            .name = "lazy_refcounts",
+            .name = QCOW2_OPT_LAZY_REFCOUNTS,
             .type = QEMU_OPT_BOOL,
             .help = "Postpone refcount updates",
         },
diff --git a/block/qcow2.h b/block/qcow2.h
index 3b2d5cd..dba9771 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -59,10 +59,10 @@
 #define DEFAULT_CLUSTER_SIZE 65536
 
 
-#define QCOW2_OPT_LAZY_REFCOUNTS "lazy_refcounts"
-#define QCOW2_OPT_DISCARD_REQUEST "pass_discard_request"
-#define QCOW2_OPT_DISCARD_SNAPSHOT "pass_discard_snapshot"
-#define QCOW2_OPT_DISCARD_OTHER "pass_discard_other"
+#define QCOW2_OPT_LAZY_REFCOUNTS "lazy-refcounts"
+#define QCOW2_OPT_DISCARD_REQUEST "pass-discard-request"
+#define QCOW2_OPT_DISCARD_SNAPSHOT "pass-discard-snapshot"
+#define QCOW2_OPT_DISCARD_OTHER "pass-discard-other"
 
 typedef struct QCowHeader {
     uint32_t magic;
diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
index 1cf8bf7..1f39c6a 100755
--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
@@ -72,11 +72,11 @@ echo
 echo === Enable and disable lazy refcounting on the command line, plus some invalid values ===
 echo
 
-run_qemu -drive file=$TEST_IMG,format=qcow2,lazy_refcounts=on
-run_qemu -drive file=$TEST_IMG,format=qcow2,lazy_refcounts=off
-run_qemu -drive file=$TEST_IMG,format=qcow2,lazy_refcounts=
-run_qemu -drive file=$TEST_IMG,format=qcow2,lazy_refcounts=42
-run_qemu -drive file=$TEST_IMG,format=qcow2,lazy_refcounts=foo
+run_qemu -drive file=$TEST_IMG,format=qcow2,lazy-refcounts=on
+run_qemu -drive file=$TEST_IMG,format=qcow2,lazy-refcounts=off
+run_qemu -drive file=$TEST_IMG,format=qcow2,lazy-refcounts=
+run_qemu -drive file=$TEST_IMG,format=qcow2,lazy-refcounts=42
+run_qemu -drive file=$TEST_IMG,format=qcow2,lazy-refcounts=foo
 
 
 echo
@@ -85,8 +85,8 @@ echo
 
 _make_test_img -ocompat=0.10 $size
 
-run_qemu -drive file=$TEST_IMG,format=qcow2,lazy_refcounts=on
-run_qemu -drive file=$TEST_IMG,format=qcow2,lazy_refcounts=off
+run_qemu -drive file=$TEST_IMG,format=qcow2,lazy-refcounts=on
+run_qemu -drive file=$TEST_IMG,format=qcow2,lazy-refcounts=off
 
 echo
 echo === No medium ===
diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index 95ff245..c676538 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -22,35 +22,35 @@ QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,unknown_opt=foo: could not
 
 === Enable and disable lazy refcounting on the command line, plus some invalid values ===
 
-Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=on
+Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=on
 QEMU 1.5.50 monitor - type 'help' for more information
 (qemu) qququiquit
 
-Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=off
+Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=off
 QEMU 1.5.50 monitor - type 'help' for more information
 (qemu) qququiquit
 
-Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=: Parameter 'lazy_refcounts' expects 'on' or 'off'
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=: could not open disk image TEST_DIR/t.qcow2: Invalid argument
+Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=: Parameter 'lazy-refcounts' expects 'on' or 'off'
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=: could not open disk image TEST_DIR/t.qcow2: Invalid argument
 
-Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=42
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=42: Parameter 'lazy_refcounts' expects 'on' or 'off'
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=42: could not open disk image TEST_DIR/t.qcow2: Invalid argument
+Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=42
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=42: Parameter 'lazy-refcounts' expects 'on' or 'off'
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=42: could not open disk image TEST_DIR/t.qcow2: Invalid argument
 
-Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=foo
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=foo: Parameter 'lazy_refcounts' expects 'on' or 'off'
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=foo: could not open disk image TEST_DIR/t.qcow2: Invalid argument
+Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=foo
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=foo: Parameter 'lazy-refcounts' expects 'on' or 'off'
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=foo: could not open disk image TEST_DIR/t.qcow2: Invalid argument
 
 
 === With version 2 images enabling lazy refcounts must fail ===
 
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 
-Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=on
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=on: Lazy refcounts require a qcow2 image with at least qemu 1.1 compatibility level
-QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=on: could not open disk image TEST_DIR/t.qcow2: Invalid argument
+Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=on
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=on: Lazy refcounts require a qcow2 image with at least qemu 1.1 compatibility level
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=on: could not open disk image TEST_DIR/t.qcow2: Invalid argument
 
-Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=off
+Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy-refcounts=off
 QEMU 1.5.50 monitor - type 'help' for more information
 (qemu) qququiquit
 
commit 57975222b6a928dd4a4a8a7b37093cc8ecba5045
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jul 17 14:41:54 2013 +0200

    blockdev: Rename I/O throttling options for QMP
    
    In QMP, we want to use dashes instead of underscores in QMP argument
    names, and use nested options for throttling.
    
    The new option names affect the command line as well, but for
    compatibility drive_init() will convert the old option names before
    calling into the code that will be shared between -drive and
    blockdev-add.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 8ff8ed3..5403188 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -312,7 +312,8 @@ static bool do_check_io_limits(BlockIOLimit *io_limits, Error **errp)
     return true;
 }
 
-DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
+static DriveInfo *blockdev_init(QemuOpts *all_opts,
+                                BlockInterfaceType block_default_type)
 {
     const char *buf;
     const char *file = NULL;
@@ -485,17 +486,17 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
 
     /* disk I/O throttling */
     io_limits.bps[BLOCK_IO_LIMIT_TOTAL]  =
-                           qemu_opt_get_number(opts, "bps", 0);
+        qemu_opt_get_number(opts, "throttling.bps-total", 0);
     io_limits.bps[BLOCK_IO_LIMIT_READ]   =
-                           qemu_opt_get_number(opts, "bps_rd", 0);
+        qemu_opt_get_number(opts, "throttling.bps-read", 0);
     io_limits.bps[BLOCK_IO_LIMIT_WRITE]  =
-                           qemu_opt_get_number(opts, "bps_wr", 0);
+        qemu_opt_get_number(opts, "throttling.bps-write", 0);
     io_limits.iops[BLOCK_IO_LIMIT_TOTAL] =
-                           qemu_opt_get_number(opts, "iops", 0);
+        qemu_opt_get_number(opts, "throttling.iops-total", 0);
     io_limits.iops[BLOCK_IO_LIMIT_READ]  =
-                           qemu_opt_get_number(opts, "iops_rd", 0);
+        qemu_opt_get_number(opts, "throttling.iops-read", 0);
     io_limits.iops[BLOCK_IO_LIMIT_WRITE] =
-                           qemu_opt_get_number(opts, "iops_wr", 0);
+        qemu_opt_get_number(opts, "throttling.iops-write", 0);
 
     if (!do_check_io_limits(&io_limits, &error)) {
         error_report("%s", error_get_pretty(error));
@@ -726,6 +727,31 @@ err:
     return NULL;
 }
 
+static void qemu_opt_rename(QemuOpts *opts, const char *from, const char *to)
+{
+    const char *value;
+
+    value = qemu_opt_get(opts, from);
+    if (value) {
+        qemu_opt_set(opts, to, value);
+        qemu_opt_unset(opts, from);
+    }
+}
+
+DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
+{
+    /* Change legacy command line options into QMP ones */
+    qemu_opt_rename(all_opts, "iops", "throttling.iops-total");
+    qemu_opt_rename(all_opts, "iops_rd", "throttling.iops-read");
+    qemu_opt_rename(all_opts, "iops_wr", "throttling.iops-write");
+
+    qemu_opt_rename(all_opts, "bps", "throttling.bps-total");
+    qemu_opt_rename(all_opts, "bps_rd", "throttling.bps-read");
+    qemu_opt_rename(all_opts, "bps_wr", "throttling.bps-write");
+
+    return blockdev_init(all_opts, block_default_type);
+}
+
 void do_commit(Monitor *mon, const QDict *qdict)
 {
     const char *device = qdict_get_str(qdict, "device");
@@ -1855,27 +1881,27 @@ QemuOptsList qemu_common_drive_opts = {
             .type = QEMU_OPT_BOOL,
             .help = "open drive file as read-only",
         },{
-            .name = "iops",
+            .name = "throttling.iops-total",
             .type = QEMU_OPT_NUMBER,
             .help = "limit total I/O operations per second",
         },{
-            .name = "iops_rd",
+            .name = "throttling.iops-read",
             .type = QEMU_OPT_NUMBER,
             .help = "limit read operations per second",
         },{
-            .name = "iops_wr",
+            .name = "throttling.iops-write",
             .type = QEMU_OPT_NUMBER,
             .help = "limit write operations per second",
         },{
-            .name = "bps",
+            .name = "throttling.bps-total",
             .type = QEMU_OPT_NUMBER,
             .help = "limit total bytes per second",
         },{
-            .name = "bps_rd",
+            .name = "throttling.bps-read",
             .type = QEMU_OPT_NUMBER,
             .help = "limit read bytes per second",
         },{
-            .name = "bps_wr",
+            .name = "throttling.bps-write",
             .type = QEMU_OPT_NUMBER,
             .help = "limit write bytes per second",
         },{
commit 0dd6c5266313c861cf36476da86599d368ec41fc
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jul 17 14:40:37 2013 +0200

    QemuOpts: Add qemu_opt_unset()
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/include/qemu/option.h b/include/qemu/option.h
index a83c700..13f5e72 100644
--- a/include/qemu/option.h
+++ b/include/qemu/option.h
@@ -120,6 +120,7 @@ bool qemu_opt_has_help_opt(QemuOpts *opts);
 bool qemu_opt_get_bool(QemuOpts *opts, const char *name, bool defval);
 uint64_t qemu_opt_get_number(QemuOpts *opts, const char *name, uint64_t defval);
 uint64_t qemu_opt_get_size(QemuOpts *opts, const char *name, uint64_t defval);
+int qemu_opt_unset(QemuOpts *opts, const char *name);
 int qemu_opt_set(QemuOpts *opts, const char *name, const char *value);
 void qemu_opt_set_err(QemuOpts *opts, const char *name, const char *value,
                       Error **errp);
diff --git a/util/qemu-option.c b/util/qemu-option.c
index e0ef426..5d686c8 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -593,6 +593,20 @@ static const QemuOptDesc *find_desc_by_name(const QemuOptDesc *desc,
     return NULL;
 }
 
+int qemu_opt_unset(QemuOpts *opts, const char *name)
+{
+    QemuOpt *opt = qemu_opt_find(opts, name);
+
+    assert(opts_accepts_any(opts));
+
+    if (opt == NULL) {
+        return -1;
+    } else {
+        qemu_opt_del(opt);
+        return 0;
+    }
+}
+
 static void opt_set(QemuOpts *opts, const char *name, const char *value,
                     bool prepend, Error **errp)
 {
commit 74fe54f2a1b5c4f4498a8fe521e1dfc936656cd4
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 9 11:09:02 2013 +0200

    block: Allow "driver" option on the top level
    
    This is traditionally -drive format=..., which is now translated into
    the new driver option. This gives us a more consistent way to select the
    driver of BlockDriverStates that can be used in QMP context, too.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block.c b/block.c
index 6cd39fa..c77cfd1 100644
--- a/block.c
+++ b/block.c
@@ -970,6 +970,7 @@ int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
     char tmp_filename[PATH_MAX + 1];
     BlockDriverState *file = NULL;
     QDict *file_options = NULL;
+    const char *drvname;
 
     /* NULL means an empty set of options */
     if (options == NULL) {
@@ -1059,6 +1060,12 @@ int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
     }
 
     /* Find the right image format driver */
+    drvname = qdict_get_try_str(options, "driver");
+    if (drvname) {
+        drv = bdrv_find_whitelisted_format(drvname, !(flags & BDRV_O_RDWR));
+        qdict_del(options, "driver");
+    }
+
     if (!drv) {
         ret = find_image_format(file, filename, &drv);
     }
diff --git a/blockdev.c b/blockdev.c
index c5abd65..8ff8ed3 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -322,7 +322,6 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
     enum { MEDIA_DISK, MEDIA_CDROM } media;
     int bus_id, unit_id;
     int cyls, heads, secs, translation;
-    BlockDriver *drv = NULL;
     int max_devs;
     int index;
     int ro = 0;
@@ -338,6 +337,7 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
     QemuOpts *opts;
     QDict *bs_opts;
     const char *id;
+    bool has_driver_specific_opts;
 
     translation = BIOS_ATA_TRANSLATION_AUTO;
     media = MEDIA_DISK;
@@ -365,6 +365,8 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
         qdict_del(bs_opts, "id");
     }
 
+    has_driver_specific_opts = !!qdict_size(bs_opts);
+
     /* extract parameters */
     bus_id  = qemu_opt_get_number(opts, "bus", 0);
     unit_id = qemu_opt_get_number(opts, "unit", -1);
@@ -477,11 +479,8 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
             error_printf("\n");
             return NULL;
         }
-        drv = bdrv_find_whitelisted_format(buf, ro);
-        if (!drv) {
-            error_report("'%s' invalid format", buf);
-            return NULL;
-        }
+
+        qdict_put(bs_opts, "driver", qstring_from_str(buf));
     }
 
     /* disk I/O throttling */
@@ -658,7 +657,7 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
         abort();
     }
     if (!file || !*file) {
-        if (qdict_size(bs_opts)) {
+        if (has_driver_specific_opts) {
             file = NULL;
         } else {
             return dinfo;
@@ -695,13 +694,13 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
         error_report("warning: disabling copy_on_read on readonly drive");
     }
 
-    ret = bdrv_open(dinfo->bdrv, file, bs_opts, bdrv_flags, drv);
-    bs_opts = NULL;
+    QINCREF(bs_opts);
+    ret = bdrv_open(dinfo->bdrv, file, bs_opts, bdrv_flags, NULL);
 
     if (ret < 0) {
         if (ret == -EMEDIUMTYPE) {
             error_report("could not open disk image %s: not in %s format",
-                         file ?: dinfo->id, drv->format_name);
+                         file ?: dinfo->id, qdict_get_str(bs_opts, "driver"));
         } else {
             error_report("could not open disk image %s: %s",
                          file ?: dinfo->id, strerror(-ret));
@@ -712,6 +711,7 @@ DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
     if (bdrv_key_required(dinfo->bdrv))
         autostart = 0;
 
+    QDECREF(bs_opts);
     qemu_opts_del(opts);
 
     return dinfo;
commit 69dd62dfd60631ba69201d8a197fde1ece4b4df3
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Jul 8 16:14:21 2013 +0200

    qapi: Anonymous unions
    
    The discriminator for anonymous unions is the data type. This allows to
    have a union type that allows both of these:
    
        { 'file': 'my_existing_block_device_id' }
        { 'file': { 'filename': '/tmp/mydisk.qcow2', 'read-only': true } }
    
    Unions like this are specified in the schema with an empty dict as
    discriminator. For this example you could take:
    
        { 'union': 'BlockRef',
          'discriminator': {},
          'data': { 'definition': 'BlockOptions',
                    'reference': 'str' } }
        { 'type': 'ExampleObject',
          'data: { 'file': 'BlockRef' } }
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/docs/qapi-code-gen.txt b/docs/qapi-code-gen.txt
index 11f19cf..0ce045c 100644
--- a/docs/qapi-code-gen.txt
+++ b/docs/qapi-code-gen.txt
@@ -125,6 +125,31 @@ Resulting in this JSON object:
    "lazy-refcounts": true }
 
 
+A special type of unions are anonymous unions. They don't form a dictionary in
+the wire format but allow the direct use of different types in their place. As
+they aren't structured, they don't have any explicit discriminator but use
+the (QObject) data type of their value as an implicit discriminator. This means
+that they are restricted to using only one discriminator value per QObject
+type. For example, you cannot have two different complex types in an anonymous
+union, or two different integer types.
+
+Anonymous unions are declared using an empty dictionary as their discriminator.
+The discriminator values never appear on the wire, they are only used in the
+generated C code. Anonymous unions cannot have a base type.
+
+ { 'union': 'BlockRef',
+   'discriminator': {},
+   'data': { 'definition': 'BlockdevOptions',
+             'reference': 'str' } }
+
+This example allows using both of the following example objects:
+
+ { "file": "my_existing_block_device_id" }
+ { "file": { "driver": "file",
+             "readonly": false,
+             'filename': "/tmp/mydisk.qcow2" } }
+
+
 === Commands ===
 
 Commands are defined by using a list containing three members.  The first
diff --git a/include/qapi/qmp/qobject.h b/include/qapi/qmp/qobject.h
index 9124649..d0bbc7c 100644
--- a/include/qapi/qmp/qobject.h
+++ b/include/qapi/qmp/qobject.h
@@ -44,6 +44,7 @@ typedef enum {
     QTYPE_QFLOAT,
     QTYPE_QBOOL,
     QTYPE_QERROR,
+    QTYPE_MAX,
 } qtype_code;
 
 struct QObject;
diff --git a/include/qapi/visitor-impl.h b/include/qapi/visitor-impl.h
index 5c1297f..f3fa420 100644
--- a/include/qapi/visitor-impl.h
+++ b/include/qapi/visitor-impl.h
@@ -32,6 +32,8 @@ struct Visitor
 
     void (*type_enum)(Visitor *v, int *obj, const char *strings[],
                       const char *kind, const char *name, Error **errp);
+    void (*get_next_type)(Visitor *v, int *kind, const int *qobjects,
+                          const char *name, Error **errp);
 
     void (*type_int)(Visitor *v, int64_t *obj, const char *name, Error **errp);
     void (*type_bool)(Visitor *v, bool *obj, const char *name, Error **errp);
diff --git a/include/qapi/visitor.h b/include/qapi/visitor.h
index bd24f85..48a2a2e 100644
--- a/include/qapi/visitor.h
+++ b/include/qapi/visitor.h
@@ -13,6 +13,7 @@
 #ifndef QAPI_VISITOR_CORE_H
 #define QAPI_VISITOR_CORE_H
 
+#include "qapi/qmp/qobject.h"
 #include "qapi/error.h"
 #include <stdlib.h>
 
@@ -42,6 +43,8 @@ void visit_end_list(Visitor *v, Error **errp);
 void visit_start_optional(Visitor *v, bool *present, const char *name,
                           Error **errp);
 void visit_end_optional(Visitor *v, Error **errp);
+void visit_get_next_type(Visitor *v, int *obj, const int *qtypes,
+                         const char *name, Error **errp);
 void visit_type_enum(Visitor *v, int *obj, const char *strings[],
                      const char *kind, const char *name, Error **errp);
 void visit_type_int(Visitor *v, int64_t *obj, const char *name, Error **errp);
diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c
index 9b4d51b..d6a4012 100644
--- a/qapi/qapi-visit-core.c
+++ b/qapi/qapi-visit-core.c
@@ -12,6 +12,7 @@
  */
 
 #include "qemu-common.h"
+#include "qapi/qmp/qobject.h"
 #include "qapi/qmp/qerror.h"
 #include "qapi/visitor.h"
 #include "qapi/visitor-impl.h"
@@ -98,6 +99,14 @@ void visit_end_optional(Visitor *v, Error **errp)
     }
 }
 
+void visit_get_next_type(Visitor *v, int *obj, const int *qtypes,
+                         const char *name, Error **errp)
+{
+    if (!error_is_set(errp) && v->get_next_type) {
+        v->get_next_type(v, obj, qtypes, name, errp);
+    }
+}
+
 void visit_type_enum(Visitor *v, int *obj, const char *strings[],
                      const char *kind, const char *name, Error **errp)
 {
diff --git a/qapi/qmp-input-visitor.c b/qapi/qmp-input-visitor.c
index 70864a1..bf42c04 100644
--- a/qapi/qmp-input-visitor.c
+++ b/qapi/qmp-input-visitor.c
@@ -208,6 +208,19 @@ static void qmp_input_end_list(Visitor *v, Error **errp)
     qmp_input_pop(qiv, errp);
 }
 
+static void qmp_input_get_next_type(Visitor *v, int *kind, const int *qobjects,
+                                    const char *name, Error **errp)
+{
+    QmpInputVisitor *qiv = to_qiv(v);
+    QObject *qobj = qmp_input_get_object(qiv, name, false);
+
+    if (!qobj) {
+        error_set(errp, QERR_MISSING_PARAMETER, name ? name : "null");
+        return;
+    }
+    *kind = qobjects[qobject_type(qobj)];
+}
+
 static void qmp_input_type_int(Visitor *v, int64_t *obj, const char *name,
                                Error **errp)
 {
@@ -317,6 +330,7 @@ QmpInputVisitor *qmp_input_visitor_new(QObject *obj)
     v->visitor.type_str = qmp_input_type_str;
     v->visitor.type_number = qmp_input_type_number;
     v->visitor.start_optional = qmp_input_start_optional;
+    v->visitor.get_next_type = qmp_input_get_next_type;
 
     qmp_input_push(v, obj, NULL);
     qobject_incref(obj);
diff --git a/qobject/qjson.c b/qobject/qjson.c
index 19085a1..6cf2511 100644
--- a/qobject/qjson.c
+++ b/qobject/qjson.c
@@ -260,6 +260,8 @@ static void to_json(const QObject *obj, QString *str, int pretty, int indent)
         /* XXX: should QError be emitted? */
     case QTYPE_NONE:
         break;
+    case QTYPE_MAX:
+        abort();
     }
 }
 
diff --git a/scripts/qapi-types.py b/scripts/qapi-types.py
index 84d46fb..5ee46ea 100644
--- a/scripts/qapi-types.py
+++ b/scripts/qapi-types.py
@@ -150,6 +150,40 @@ typedef enum %(name)s
 
     return lookup_decl + enum_decl
 
+def generate_anon_union_qtypes(expr):
+
+    name = expr['union']
+    members = expr['data']
+
+    ret = mcgen('''
+const int %(name)s_qtypes[QTYPE_MAX] = {
+''',
+    name=name)
+
+    for key in members:
+        qapi_type = members[key]
+        if builtin_type_qtypes.has_key(qapi_type):
+            qtype = builtin_type_qtypes[qapi_type]
+        elif find_struct(qapi_type):
+            qtype = "QTYPE_QDICT"
+        elif find_union(qapi_type):
+            qtype = "QTYPE_QDICT"
+        else:
+            assert False, "Invalid anonymous union member"
+
+        ret += mcgen('''
+    [ %(qtype)s ] = %(abbrev)s_KIND_%(enum)s,
+''',
+        qtype = qtype,
+        abbrev = de_camel_case(name).upper(),
+        enum = c_fun(de_camel_case(key),False).upper())
+
+    ret += mcgen('''
+};
+''')
+    return ret
+
+
 def generate_union(expr):
 
     name = expr['union']
@@ -190,6 +224,12 @@ struct %(name)s
     ret += mcgen('''
 };
 ''')
+    if discriminator == {}:
+        ret += mcgen('''
+extern const int %(name)s_qtypes[];
+''',
+            name=name)
+
 
     return ret
 
@@ -342,6 +382,8 @@ for expr in exprs:
         ret += generate_fwd_struct(expr['union'], expr['data']) + "\n"
         ret += generate_enum('%sKind' % expr['union'], expr['data'].keys())
         fdef.write(generate_enum_lookup('%sKind' % expr['union'], expr['data'].keys()))
+        if expr.get('discriminator') == {}:
+            fdef.write(generate_anon_union_qtypes(expr))
     else:
         continue
     fdecl.write(ret)
diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py
index 87d5f15..597cca4 100644
--- a/scripts/qapi-visit.py
+++ b/scripts/qapi-visit.py
@@ -176,6 +176,49 @@ void visit_type_%(name)s(Visitor *m, %(name)s * obj, const char *name, Error **e
 ''',
                  name=name)
 
+def generate_visit_anon_union(name, members):
+    ret = mcgen('''
+
+void visit_type_%(name)s(Visitor *m, %(name)s ** obj, const char *name, Error **errp)
+{
+    Error *err = NULL;
+
+    if (!error_is_set(errp)) {
+        visit_start_implicit_struct(m, (void**) obj, sizeof(%(name)s), &err);
+        visit_get_next_type(m, (int*) &(*obj)->kind, %(name)s_qtypes, name, &err);
+        switch ((*obj)->kind) {
+''',
+    name=name)
+
+    for key in members:
+        assert (members[key] in builtin_types
+            or find_struct(members[key])
+            or find_union(members[key])), "Invalid anonymous union member"
+
+        ret += mcgen('''
+        case %(abbrev)s_KIND_%(enum)s:
+            visit_type_%(c_type)s(m, &(*obj)->%(c_name)s, name, &err);
+            break;
+''',
+                abbrev = de_camel_case(name).upper(),
+                enum = c_fun(de_camel_case(key),False).upper(),
+                c_type = type_name(members[key]),
+                c_name = c_fun(key))
+
+    ret += mcgen('''
+        default:
+            abort();
+        }
+        error_propagate(errp, err);
+        err = NULL;
+        visit_end_implicit_struct(m, &err);
+    }
+}
+''')
+
+    return ret
+
+
 def generate_visit_union(expr):
 
     name = expr['union']
@@ -184,6 +227,10 @@ def generate_visit_union(expr):
     base = expr.get('base')
     discriminator = expr.get('discriminator')
 
+    if discriminator == {}:
+        assert not base
+        return generate_visit_anon_union(name, members)
+
     ret = generate_visit_enum('%sKind' % name, members.keys())
 
     if base:
diff --git a/scripts/qapi.py b/scripts/qapi.py
index 3a54c7f..38c808e 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -17,6 +17,21 @@ builtin_types = [
     'uint8', 'uint16', 'uint32', 'uint64'
 ]
 
+builtin_type_qtypes = {
+    'str':      'QTYPE_QSTRING',
+    'int':      'QTYPE_QINT',
+    'number':   'QTYPE_QFLOAT',
+    'bool':     'QTYPE_QBOOL',
+    'int8':     'QTYPE_QINT',
+    'int16':    'QTYPE_QINT',
+    'int32':    'QTYPE_QINT',
+    'int64':    'QTYPE_QINT',
+    'uint8':    'QTYPE_QINT',
+    'uint16':   'QTYPE_QINT',
+    'uint32':   'QTYPE_QINT',
+    'uint64':   'QTYPE_QINT',
+}
+
 def tokenize(data):
     while len(data):
         ch = data[0]
commit ea66c6d8819c8fc5f73a28554992be64e5399fed
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 16 10:49:41 2013 +0200

    qapi.py: Maintain a list of union types
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index baf1321..3a54c7f 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -105,6 +105,7 @@ def parse_schema(fp):
         if expr_eval.has_key('enum'):
             add_enum(expr_eval['enum'])
         elif expr_eval.has_key('union'):
+            add_union(expr_eval)
             add_enum('%sKind' % expr_eval['union'])
         elif expr_eval.has_key('type'):
             add_struct(expr_eval)
@@ -188,6 +189,7 @@ def type_name(name):
 
 enum_types = []
 struct_types = []
+union_types = []
 
 def add_struct(definition):
     global struct_types
@@ -200,6 +202,17 @@ def find_struct(name):
             return struct
     return None
 
+def add_union(definition):
+    global union_types
+    union_types.append(definition)
+
+def find_union(name):
+    global union_types
+    for union in union_types:
+        if union['union'] == name:
+            return union
+    return None
+
 def add_enum(name):
     global enum_types
     enum_types.append(name)
commit e8316d7e8e8339a9ea593ba821a0aad26908c0d5
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Jul 8 11:33:07 2013 +0200

    qapi: Add consume argument to qmp_input_get_object()
    
    This allows to just look at the next element without actually consuming
    it.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/qapi/qmp-input-visitor.c b/qapi/qmp-input-visitor.c
index 59c5cac..70864a1 100644
--- a/qapi/qmp-input-visitor.c
+++ b/qapi/qmp-input-visitor.c
@@ -41,13 +41,14 @@ static QmpInputVisitor *to_qiv(Visitor *v)
 }
 
 static QObject *qmp_input_get_object(QmpInputVisitor *qiv,
-                                     const char *name)
+                                     const char *name,
+                                     bool consume)
 {
     QObject *qobj = qiv->stack[qiv->nb_stack - 1].obj;
 
     if (qobj) {
         if (name && qobject_type(qobj) == QTYPE_QDICT) {
-            if (qiv->stack[qiv->nb_stack - 1].h) {
+            if (qiv->stack[qiv->nb_stack - 1].h && consume) {
                 g_hash_table_remove(qiv->stack[qiv->nb_stack - 1].h, name);
             }
             return qdict_get(qobject_to_qdict(qobj), name);
@@ -117,7 +118,7 @@ static void qmp_input_start_struct(Visitor *v, void **obj, const char *kind,
                                    const char *name, size_t size, Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
-    QObject *qobj = qmp_input_get_object(qiv, name);
+    QObject *qobj = qmp_input_get_object(qiv, name, true);
     Error *err = NULL;
 
     if (!qobj || qobject_type(qobj) != QTYPE_QDICT) {
@@ -159,7 +160,7 @@ static void qmp_input_end_implicit_struct(Visitor *v, Error **errp)
 static void qmp_input_start_list(Visitor *v, const char *name, Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
-    QObject *qobj = qmp_input_get_object(qiv, name);
+    QObject *qobj = qmp_input_get_object(qiv, name, true);
 
     if (!qobj || qobject_type(qobj) != QTYPE_QLIST) {
         error_set(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : "null",
@@ -211,7 +212,7 @@ static void qmp_input_type_int(Visitor *v, int64_t *obj, const char *name,
                                Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
-    QObject *qobj = qmp_input_get_object(qiv, name);
+    QObject *qobj = qmp_input_get_object(qiv, name, true);
 
     if (!qobj || qobject_type(qobj) != QTYPE_QINT) {
         error_set(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : "null",
@@ -226,7 +227,7 @@ static void qmp_input_type_bool(Visitor *v, bool *obj, const char *name,
                                 Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
-    QObject *qobj = qmp_input_get_object(qiv, name);
+    QObject *qobj = qmp_input_get_object(qiv, name, true);
 
     if (!qobj || qobject_type(qobj) != QTYPE_QBOOL) {
         error_set(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : "null",
@@ -241,7 +242,7 @@ static void qmp_input_type_str(Visitor *v, char **obj, const char *name,
                                Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
-    QObject *qobj = qmp_input_get_object(qiv, name);
+    QObject *qobj = qmp_input_get_object(qiv, name, true);
 
     if (!qobj || qobject_type(qobj) != QTYPE_QSTRING) {
         error_set(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : "null",
@@ -256,7 +257,7 @@ static void qmp_input_type_number(Visitor *v, double *obj, const char *name,
                                   Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
-    QObject *qobj = qmp_input_get_object(qiv, name);
+    QObject *qobj = qmp_input_get_object(qiv, name, true);
 
     if (!qobj || (qobject_type(qobj) != QTYPE_QFLOAT &&
         qobject_type(qobj) != QTYPE_QINT)) {
@@ -276,7 +277,7 @@ static void qmp_input_start_optional(Visitor *v, bool *present,
                                      const char *name, Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
-    QObject *qobj = qmp_input_get_object(qiv, name);
+    QObject *qobj = qmp_input_get_object(qiv, name, true);
 
     if (!qobj) {
         *present = false;
commit 50f2bdc75c5ee00617ad874c9ceac2cea660aa1e
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jul 3 15:58:57 2013 +0200

    qapi: Flat unions with arbitrary discriminator
    
    Instead of the rather verbose syntax that distinguishes base and
    subclass fields...
    
      { "type": "file",
        "read-only": true,
        "data": {
            "filename": "test"
        } }
    
    ...we can now have both in the same namespace, allowing a more direct
    mapping of the command line, and moving fields between the common base
    and subclasses without breaking the API:
    
      { "driver": "file",
        "read-only": true,
        "filename": "test" }
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/docs/qapi-code-gen.txt b/docs/qapi-code-gen.txt
index f6f8d33..11f19cf 100644
--- a/docs/qapi-code-gen.txt
+++ b/docs/qapi-code-gen.txt
@@ -103,6 +103,28 @@ And it looks like this on the wire:
    "data" : { "backing-file": "/some/place/my-image",
               "lazy-refcounts": true } }
 
+
+Flat union types avoid the nesting on the wire. They are used whenever a
+specific field of the base type is declared as the discriminator ('type' is
+then no longer generated). The discriminator must always be a string field.
+The above example can then be modified as follows:
+
+ { 'type': 'BlockdevCommonOptions',
+   'data': { 'driver': 'str', 'readonly': 'bool' } }
+ { 'union': 'BlockdevOptions',
+   'base': 'BlockdevCommonOptions',
+   'discriminator': 'driver',
+   'data': { 'raw': 'RawOptions',
+             'qcow2': 'Qcow2Options' } }
+
+Resulting in this JSON object:
+
+ { "driver": "qcow2",
+   "readonly": false,
+   "backing-file": "/some/place/my-image",
+   "lazy-refcounts": true }
+
+
 === Commands ===
 
 Commands are defined by using a list containing three members.  The first
diff --git a/scripts/qapi-types.py b/scripts/qapi-types.py
index 07bd311..84d46fb 100644
--- a/scripts/qapi-types.py
+++ b/scripts/qapi-types.py
@@ -154,7 +154,9 @@ def generate_union(expr):
 
     name = expr['union']
     typeinfo = expr['data']
+
     base = expr.get('base')
+    discriminator = expr.get('discriminator')
 
     ret = mcgen('''
 struct %(name)s
@@ -177,8 +179,13 @@ struct %(name)s
 ''')
 
     if base:
-        struct = find_struct(base)
-        ret += generate_struct_fields(struct['data'])
+        base_fields = find_struct(base)['data']
+        if discriminator:
+            base_fields = base_fields.copy()
+            del base_fields[discriminator]
+        ret += generate_struct_fields(base_fields)
+    else:
+        assert not discriminator
 
     ret += mcgen('''
 };
diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py
index db6fa44..87d5f15 100644
--- a/scripts/qapi-visit.py
+++ b/scripts/qapi-visit.py
@@ -17,8 +17,30 @@ import os
 import getopt
 import errno
 
-def generate_visit_struct_fields(field_prefix, members):
+def generate_visit_struct_fields(name, field_prefix, fn_prefix, members):
+    substructs = []
     ret = ''
+    full_name = name if not fn_prefix else "%s_%s" % (name, fn_prefix)
+
+    for argname, argentry, optional, structured in parse_args(members):
+        if structured:
+            if not fn_prefix:
+                nested_fn_prefix = argname
+            else:
+                nested_fn_prefix = "%s_%s" % (fn_prefix, argname)
+
+            nested_field_prefix = "%s%s." % (field_prefix, argname)
+            ret += generate_visit_struct_fields(name, nested_field_prefix,
+                                                nested_fn_prefix, argentry)
+
+    ret += mcgen('''
+
+static void visit_type_%(full_name)s_fields(Visitor *m, %(name)s ** obj, Error **errp)
+{
+    Error *err = NULL;
+''',
+        name=name, full_name=full_name)
+    push_indent()
 
     for argname, argentry, optional, structured in parse_args(members):
         if optional:
@@ -31,7 +53,7 @@ if (obj && (*obj)->%(prefix)shas_%(c_name)s) {
             push_indent()
 
         if structured:
-            ret += generate_visit_struct_body(field_prefix + argname, argname, argentry)
+            ret += generate_visit_struct_body(full_name, argname, argentry)
         else:
             ret += mcgen('''
 visit_type_%(type)s(m, obj ? &(*obj)->%(c_prefix)s%(c_name)s : NULL, "%(name)s", &err);
@@ -47,6 +69,12 @@ visit_type_%(type)s(m, obj ? &(*obj)->%(c_prefix)s%(c_name)s : NULL, "%(name)s",
 visit_end_optional(m, &err);
 ''')
 
+    pop_indent()
+    ret += mcgen('''
+
+    error_propagate(errp, err);
+}
+''')
     return ret
 
 
@@ -56,8 +84,9 @@ if (!error_is_set(errp)) {
 ''')
     push_indent()
 
+    full_name = name if not field_prefix else "%s_%s" % (field_prefix, name)
+
     if len(field_prefix):
-        field_prefix = field_prefix + "."
         ret += mcgen('''
 Error **errp = &err; /* from outer scope */
 Error *err = NULL;
@@ -74,20 +103,14 @@ visit_start_struct(m, (void **)obj, "%(name)s", name, sizeof(%(name)s), &err);
     ret += mcgen('''
 if (!err) {
     if (!obj || *obj) {
-''')
-    push_indent()
-    push_indent()
-
-    ret += generate_visit_struct_fields(field_prefix, members)
-    pop_indent()
-    ret += mcgen('''
-    error_propagate(errp, err);
-    err = NULL;
-}
-''')
+        visit_type_%(name)s_fields(m, obj, &err);
+        error_propagate(errp, err);
+        err = NULL;
+    }
+''',
+        name=full_name)
 
     pop_indent()
-    pop_indent()
     ret += mcgen('''
         /* Always call end_struct if start_struct succeeded.  */
         visit_end_struct(m, &err);
@@ -98,7 +121,9 @@ if (!err) {
     return ret
 
 def generate_visit_struct(name, members):
-    ret = mcgen('''
+    ret = generate_visit_struct_fields(name, "", "", members)
+
+    ret += mcgen('''
 
 void visit_type_%(name)s(Visitor *m, %(name)s ** obj, const char *name, Error **errp)
 {
@@ -157,9 +182,17 @@ def generate_visit_union(expr):
     members = expr['data']
 
     base = expr.get('base')
+    discriminator = expr.get('discriminator')
 
     ret = generate_visit_enum('%sKind' % name, members.keys())
 
+    if base:
+        base_fields = find_struct(base)['data']
+        if discriminator:
+            base_fields = base_fields.copy()
+            del base_fields[discriminator]
+        ret += generate_visit_struct_fields(name, "", "", base_fields)
+
     ret += mcgen('''
 
 void visit_type_%(name)s(Visitor *m, %(name)s ** obj, const char *name, Error **errp)
@@ -179,23 +212,34 @@ void visit_type_%(name)s(Visitor *m, %(name)s ** obj, const char *name, Error **
     push_indent()
 
     if base:
-        struct = find_struct(base)
-        push_indent()
-        ret += generate_visit_struct_fields("", struct['data'])
-        pop_indent()
+        ret += mcgen('''
+    visit_type_%(name)s_fields(m, obj, &err);
+''',
+            name=name)
 
     pop_indent()
     ret += mcgen('''
-        visit_type_%(name)sKind(m, &(*obj)->kind, "type", &err);
+        visit_type_%(name)sKind(m, &(*obj)->kind, "%(type)s", &err);
         if (!err) {
             switch ((*obj)->kind) {
 ''',
-                 name=name)
+                 name=name, type="type" if not discriminator else discriminator)
 
     for key in members:
+        if not discriminator:
+            fmt = 'visit_type_%(c_type)s(m, &(*obj)->%(c_name)s, "data", &err);'
+        else:
+            fmt = '''visit_start_implicit_struct(m, (void**) &(*obj)->%(c_name)s, sizeof(%(c_type)s), &err);
+                if (!err) {
+                    visit_type_%(c_type)s_fields(m, &(*obj)->%(c_name)s, &err);
+                    error_propagate(errp, err);
+                    err = NULL;
+                    visit_end_implicit_struct(m, &err);
+                }'''
+
         ret += mcgen('''
             case %(abbrev)s_KIND_%(enum)s:
-                visit_type_%(c_type)s(m, &(*obj)->%(c_name)s, "data", &err);
+                ''' + fmt + '''
                 break;
 ''',
                 abbrev = de_camel_case(name).upper(),
commit 761d524dbcc5bb41213dd0f238f43c273bc2b077
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jul 3 15:52:42 2013 +0200

    qapi: Add visitor for implicit structs
    
    These can be used when an embedded struct is parsed and members not
    belonging to the struct may be present in the input (e.g. parsing a
    flat namespace QMP union, where fields from both the base and one
    of the alternative types are mixed in the JSON object)
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/include/qapi/visitor-impl.h b/include/qapi/visitor-impl.h
index 5159964..5c1297f 100644
--- a/include/qapi/visitor-impl.h
+++ b/include/qapi/visitor-impl.h
@@ -22,6 +22,10 @@ struct Visitor
                          const char *name, size_t size, Error **errp);
     void (*end_struct)(Visitor *v, Error **errp);
 
+    void (*start_implicit_struct)(Visitor *v, void **obj, size_t size,
+                                  Error **errp);
+    void (*end_implicit_struct)(Visitor *v, Error **errp);
+
     void (*start_list)(Visitor *v, const char *name, Error **errp);
     GenericList *(*next_list)(Visitor *v, GenericList **list, Error **errp);
     void (*end_list)(Visitor *v, Error **errp);
diff --git a/include/qapi/visitor.h b/include/qapi/visitor.h
index 28c21d8..bd24f85 100644
--- a/include/qapi/visitor.h
+++ b/include/qapi/visitor.h
@@ -33,6 +33,9 @@ void visit_end_handle(Visitor *v, Error **errp);
 void visit_start_struct(Visitor *v, void **obj, const char *kind,
                         const char *name, size_t size, Error **errp);
 void visit_end_struct(Visitor *v, Error **errp);
+void visit_start_implicit_struct(Visitor *v, void **obj, size_t size,
+                                 Error **errp);
+void visit_end_implicit_struct(Visitor *v, Error **errp);
 void visit_start_list(Visitor *v, const char *name, Error **errp);
 GenericList *visit_next_list(Visitor *v, GenericList **list, Error **errp);
 void visit_end_list(Visitor *v, Error **errp);
diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c
index 401ee6e..9b4d51b 100644
--- a/qapi/qapi-visit-core.c
+++ b/qapi/qapi-visit-core.c
@@ -45,6 +45,22 @@ void visit_end_struct(Visitor *v, Error **errp)
     v->end_struct(v, errp);
 }
 
+void visit_start_implicit_struct(Visitor *v, void **obj, size_t size,
+                                 Error **errp)
+{
+    if (!error_is_set(errp) && v->start_implicit_struct) {
+        v->start_implicit_struct(v, obj, size, errp);
+    }
+}
+
+void visit_end_implicit_struct(Visitor *v, Error **errp)
+{
+    assert(!error_is_set(errp));
+    if (v->end_implicit_struct) {
+        v->end_implicit_struct(v, errp);
+    }
+}
+
 void visit_start_list(Visitor *v, const char *name, Error **errp)
 {
     if (!error_is_set(errp)) {
diff --git a/qapi/qmp-input-visitor.c b/qapi/qmp-input-visitor.c
index 67fb127..59c5cac 100644
--- a/qapi/qmp-input-visitor.c
+++ b/qapi/qmp-input-visitor.c
@@ -144,6 +144,18 @@ static void qmp_input_end_struct(Visitor *v, Error **errp)
     qmp_input_pop(qiv, errp);
 }
 
+static void qmp_input_start_implicit_struct(Visitor *v, void **obj,
+                                            size_t size, Error **errp)
+{
+    if (obj) {
+        *obj = g_malloc0(size);
+    }
+}
+
+static void qmp_input_end_implicit_struct(Visitor *v, Error **errp)
+{
+}
+
 static void qmp_input_start_list(Visitor *v, const char *name, Error **errp)
 {
     QmpInputVisitor *qiv = to_qiv(v);
@@ -293,6 +305,8 @@ QmpInputVisitor *qmp_input_visitor_new(QObject *obj)
 
     v->visitor.start_struct = qmp_input_start_struct;
     v->visitor.end_struct = qmp_input_end_struct;
+    v->visitor.start_implicit_struct = qmp_input_start_implicit_struct;
+    v->visitor.end_implicit_struct = qmp_input_end_implicit_struct;
     v->visitor.start_list = qmp_input_start_list;
     v->visitor.next_list = qmp_input_next_list;
     v->visitor.end_list = qmp_input_end_list;
commit 51631493e4876081ae27078b50bd95bd4418bf37
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 16 13:17:27 2013 +0200

    docs: Document QAPI union types
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/docs/qapi-code-gen.txt b/docs/qapi-code-gen.txt
index cccb11e..f6f8d33 100644
--- a/docs/qapi-code-gen.txt
+++ b/docs/qapi-code-gen.txt
@@ -34,9 +34,15 @@ OrderedDicts so that ordering is preserved.
 There are two basic syntaxes used, type definitions and command definitions.
 
 The first syntax defines a type and is represented by a dictionary.  There are
-two kinds of types that are supported: complex user-defined types, and enums.
+three kinds of user-defined types that are supported: complex types,
+enumeration types and union types.
 
-A complex type is a dictionary containing a single key who's value is a
+Generally speaking, types definitions should always use CamelCase for the type
+names. Command names should be all lower case with words separated by a hyphen.
+
+=== Complex types ===
+
+A complex type is a dictionary containing a single key whose value is a
 dictionary.  This corresponds to a struct in C or an Object in JSON.  An
 example of a complex type is:
 
@@ -47,13 +53,57 @@ The use of '*' as a prefix to the name means the member is optional.  Optional
 members should always be added to the end of the dictionary to preserve
 backwards compatibility.
 
-An enumeration type is a dictionary containing a single key who's value is a
+=== Enumeration types ===
+
+An enumeration type is a dictionary containing a single key whose value is a
 list of strings.  An example enumeration is:
 
  { 'enum': 'MyEnum', 'data': [ 'value1', 'value2', 'value3' ] }
 
-Generally speaking, complex types and enums should always use CamelCase for
-the type names.
+=== Union types ===
+
+Union types are used to let the user choose between several different data
+types.  A union type is defined using a dictionary as explained in the
+following paragraphs.
+
+
+A simple union type defines a mapping from discriminator values to data types
+like in this example:
+
+ { 'type': 'FileOptions', 'data': { 'filename': 'str' } }
+ { 'type': 'Qcow2Options',
+   'data': { 'backing-file': 'str', 'lazy-refcounts': 'bool' } }
+
+ { 'union': 'BlockdevOptions',
+   'data': { 'file': 'FileOptions',
+             'qcow2': 'Qcow2Options' } }
+
+In the QMP wire format, a simple union is represented by a dictionary that
+contains the 'type' field as a discriminator, and a 'data' field that is of the
+specified data type corresponding to the discriminator value:
+
+ { "type": "qcow2", "data" : { "backing-file": "/some/place/my-image",
+                               "lazy-refcounts": true } }
+
+
+A union definition can specify a complex type as its base. In this case, the
+fields of the complex type are included as top-level fields of the union
+dictionary in the QMP wire format. An example definition is:
+
+ { 'type': 'BlockdevCommonOptions', 'data': { 'readonly': 'bool' } }
+ { 'union': 'BlockdevOptions',
+   'base': 'BlockdevCommonOptions',
+   'data': { 'raw': 'RawOptions',
+             'qcow2': 'Qcow2Options' } }
+
+And it looks like this on the wire:
+
+ { "type": "qcow2",
+   "readonly": false,
+   "data" : { "backing-file": "/some/place/my-image",
+              "lazy-refcounts": true } }
+
+=== Commands ===
 
 Commands are defined by using a list containing three members.  The first
 member is the command name, the second member is a dictionary containing
@@ -65,8 +115,6 @@ An example command is:
    'data': { 'arg1': 'str', '*arg2': 'str' },
    'returns': 'str' }
 
-Command names should be all lower case with words separated by a hyphen.
-
 
 == Code generation ==
 
commit 0aef92b90d24858eea1ebd52a51bc31563f1fb52
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 2 16:20:04 2013 +0200

    qapi-visit.py: Implement 'base' for unions
    
    This implements the visitor part of base types for unions. Parsed into
    QMP, this example schema definition...
    
        { 'type': 'BlockOptionsBase', 'data': { 'read-only': 'bool' } }
        { 'type': 'BlockOptionsQcow2, 'data': { 'lazy-refcounts': 'bool' } }
    
        { 'union': 'BlockOptions',
          'base': 'BlockOptionsBase',
          'data': {
              'raw': 'BlockOptionsRaw'
              'qcow2': 'BlockOptionsQcow2'
          } }
    
    ...would describe the following JSON object:
    
        { "type": "qcow2",
          "read-only": true,
          "data": { "lazy-refcounts": false } }
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py
index a337d80..db6fa44 100644
--- a/scripts/qapi-visit.py
+++ b/scripts/qapi-visit.py
@@ -151,7 +151,13 @@ void visit_type_%(name)s(Visitor *m, %(name)s * obj, const char *name, Error **e
 ''',
                  name=name)
 
-def generate_visit_union(name, members):
+def generate_visit_union(expr):
+
+    name = expr['union']
+    members = expr['data']
+
+    base = expr.get('base')
+
     ret = generate_visit_enum('%sKind' % name, members.keys())
 
     ret += mcgen('''
@@ -164,14 +170,28 @@ void visit_type_%(name)s(Visitor *m, %(name)s ** obj, const char *name, Error **
         visit_start_struct(m, (void **)obj, "%(name)s", name, sizeof(%(name)s), &err);
         if (!err) {
             if (obj && *obj) {
-                visit_type_%(name)sKind(m, &(*obj)->kind, "type", &err);
-                if (!err) {
-                    switch ((*obj)->kind) {
 ''',
                  name=name)
 
+
     push_indent()
     push_indent()
+    push_indent()
+
+    if base:
+        struct = find_struct(base)
+        push_indent()
+        ret += generate_visit_struct_fields("", struct['data'])
+        pop_indent()
+
+    pop_indent()
+    ret += mcgen('''
+        visit_type_%(name)sKind(m, &(*obj)->kind, "type", &err);
+        if (!err) {
+            switch ((*obj)->kind) {
+''',
+                 name=name)
+
     for key in members:
         ret += mcgen('''
             case %(abbrev)s_KIND_%(enum)s:
@@ -368,7 +388,7 @@ for expr in exprs:
         ret = generate_declaration(expr['type'], expr['data'])
         fdecl.write(ret)
     elif expr.has_key('union'):
-        ret = generate_visit_union(expr['union'], expr['data'])
+        ret = generate_visit_union(expr)
         ret += generate_visit_list(expr['union'], expr['data'])
         fdef.write(ret)
 
commit d131c897f3dea8b76d7a487af0f7f5f11d0500a3
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 2 16:18:35 2013 +0200

    qapi-visit.py: Split off generate_visit_struct_fields()
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py
index 6cac05a..a337d80 100644
--- a/scripts/qapi-visit.py
+++ b/scripts/qapi-visit.py
@@ -17,34 +17,9 @@ import os
 import getopt
 import errno
 
-def generate_visit_struct_body(field_prefix, name, members):
-    ret = mcgen('''
-if (!error_is_set(errp)) {
-''')
-    push_indent()
-
-    if len(field_prefix):
-        field_prefix = field_prefix + "."
-        ret += mcgen('''
-Error **errp = &err; /* from outer scope */
-Error *err = NULL;
-visit_start_struct(m, NULL, "", "%(name)s", 0, &err);
-''',
-                name=name)
-    else:
-        ret += mcgen('''
-Error *err = NULL;
-visit_start_struct(m, (void **)obj, "%(name)s", name, sizeof(%(name)s), &err);
-''',
-                name=name)
+def generate_visit_struct_fields(field_prefix, members):
+    ret = ''
 
-    ret += mcgen('''
-if (!err) {
-    if (!obj || *obj) {
-''')
-
-    push_indent()
-    push_indent()
     for argname, argentry, optional, structured in parse_args(members):
         if optional:
             ret += mcgen('''
@@ -72,9 +47,40 @@ visit_type_%(type)s(m, obj ? &(*obj)->%(c_prefix)s%(c_name)s : NULL, "%(name)s",
 visit_end_optional(m, &err);
 ''')
 
-    pop_indent()
+    return ret
+
+
+def generate_visit_struct_body(field_prefix, name, members):
+    ret = mcgen('''
+if (!error_is_set(errp)) {
+''')
+    push_indent()
+
+    if len(field_prefix):
+        field_prefix = field_prefix + "."
+        ret += mcgen('''
+Error **errp = &err; /* from outer scope */
+Error *err = NULL;
+visit_start_struct(m, NULL, "", "%(name)s", 0, &err);
+''',
+                name=name)
+    else:
+        ret += mcgen('''
+Error *err = NULL;
+visit_start_struct(m, (void **)obj, "%(name)s", name, sizeof(%(name)s), &err);
+''',
+                name=name)
+
     ret += mcgen('''
+if (!err) {
+    if (!obj || *obj) {
+''')
+    push_indent()
+    push_indent()
 
+    ret += generate_visit_struct_fields(field_prefix, members)
+    pop_indent()
+    ret += mcgen('''
     error_propagate(errp, err);
     err = NULL;
 }
commit e2503f5e213e30e3e9a397d454a35c10b5bdc899
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 2 12:18:47 2013 +0200

    qapi-types.py: Implement 'base' for unions
    
    The new 'base' key in a union definition refers to a struct type, which
    is inlined into the union definition and can represent fields common to
    all kinds.
    
    For example the following schema definition...
    
        { 'type': 'BlockOptionsBase', 'data': { 'read-only': 'bool' } }
    
        { 'union': 'BlockOptions',
          'base': 'BlockOptionsBase',
          'data': {
              'raw': 'BlockOptionsRaw'
              'qcow2': 'BlockOptionsQcow2'
          } }
    
    ...would result in this generated C struct:
    
        struct BlockOptions
        {
            BlockOptionsKind kind;
            union {
                void *data;
                BlockOptionsRaw * raw;
                BlockOptionsQcow2 * qcow2;
            };
            bool read_only;
        };
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/scripts/qapi-types.py b/scripts/qapi-types.py
index ddcfed9..07bd311 100644
--- a/scripts/qapi-types.py
+++ b/scripts/qapi-types.py
@@ -150,7 +150,12 @@ typedef enum %(name)s
 
     return lookup_decl + enum_decl
 
-def generate_union(name, typeinfo):
+def generate_union(expr):
+
+    name = expr['union']
+    typeinfo = expr['data']
+    base = expr.get('base')
+
     ret = mcgen('''
 struct %(name)s
 {
@@ -169,6 +174,13 @@ struct %(name)s
 
     ret += mcgen('''
     };
+''')
+
+    if base:
+        struct = find_struct(base)
+        ret += generate_struct_fields(struct['data'])
+
+    ret += mcgen('''
 };
 ''')
 
@@ -352,7 +364,7 @@ for expr in exprs:
         ret += generate_type_cleanup_decl(expr['type'])
         fdef.write(generate_type_cleanup(expr['type']) + "\n")
     elif expr.has_key('union'):
-        ret += generate_union(expr['union'], expr['data'])
+        ret += generate_union(expr)
         ret += generate_type_cleanup_decl(expr['union'] + "List")
         fdef.write(generate_type_cleanup(expr['union'] + "List") + "\n")
         ret += generate_type_cleanup_decl(expr['union'])
commit f0ef1cf4d6c996d90df6e4a32a82423d180f3e4d
Merge: b142d79 f290e49
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jul 26 13:04:21 2013 -0500

    Merge remote-tracking branch 'rth/tcg-next' into staging
    
    # By Claudio Fontana (1) and others
    # Via Richard Henderson
    * rth/tcg-next:
      tcg: Remove temp_buf
      tcg/aarch64: Implement tlb lookup fast path
      tcg/aarch64: implement ldst 12bit scaled uimm offset
    
    Message-id: 1373919944-8521-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit b142d79328cd0a0556634b0eeb891a15bfd5a00c
Merge: 003e26b 9b146e9
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jul 26 13:04:07 2013 -0500

    Merge remote-tracking branch 'jliu/or32' into staging
    
    # By Jia Liu
    # Via Jia Liu
    * jliu/or32:
      target-openrisc: Free typename in openrisc_cpu_class_by_name
      hw/openrisc: Use stderr output instead of qemu_log
      hw/openrisc: Indent typo
    
    Message-id: 1374576458-22808-1-git-send-email-proljc at gmail.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 003e26bc9f7c4f5cd90e046ae112c1d09363b8d1
Merge: d1ed9f4 340d51d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 25 15:58:29 2013 -0500

    Merge remote-tracking branch 'mdroth/qga-pull-2013-7-25' into staging
    
    # By Laszlo Ersek
    # Via Michael Roth
    * mdroth/qga-pull-2013-7-25:
      qga: escape cmdline args when registering win32 service (CVE-2013-2231)
      ga_install_service(): nest error paths more idiomatically
      qga/service-win32.c: diagnostic output should go to stderr
    
    Message-id: 1374784644-29078-1-git-send-email-mdroth at linux.vnet.ibm.com

commit d1ed9f412d866106e6370e9a8b23d79baa750b61
Merge: 874ec3c 41b8280
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 25 15:56:36 2013 -0500

    Merge remote-tracking branch 'kraxel/seabios-1.7.3' into staging
    
    # By Gerd Hoffmann
    # Via Gerd Hoffmann
    * kraxel/seabios-1.7.3:
      seabios: update to 1.7.3
    
    Message-id: 1374673573-25074-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 874ec3c5b3821bb964f9f37b2f930f2a9ce51652
Merge: d2f5ea9 a033381
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 25 15:56:06 2013 -0500

    Merge remote-tracking branch 'riku/linux-user-for-upstream' into staging
    
    * riku/linux-user-for-upstream: (21 commits)
      linux-user: Handle compressed ISA encodings when processing MIPS exceptions
      linux-user: Unlock mmap_lock when resuming guest from page_unprotect
      linux-user: Reset copied CPUs in cpu_copy() always
      linux-user: Fix epoll on ARM hosts
      linux-user: fix segmentation fault passing with h2g(x) != x
      linux-user: Fix pipe syscall return for SPARC
      linux-user: Fix target_stat and target_stat64 for OpenRISC
      linux-user: Avoid conditional cpu_reset()
      configure: Make NPTL non-optional
      linux-user: Enable NPTL for x86-64
      linux-user: Add i386 TLS setter
      linux-user: Clean up handling of clone() argument order
      linux-user: Add missing 'break' in i386 get_thread_area syscall
      linux-user: Enable NPTL for m68k
      linux-user: Enable NPTL for SPARC targets
      linux-user: Enable NPTL for OpenRISC
      linux-user: Move includes of target-specific headers to end of qemu.h
      configure: Enable threading for unicore32-linux-user
      configure: Enable threading on all ppc and mips linux-user targets
      configure: Don't say target_nptl="no" if there is no linux-user target
      ...
    
    Conflicts:
    	linux-user/main.c
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --cc configure
index 877a821,9d9088e..3d83e16
--- a/configure
+++ b/configure
@@@ -1100,11 -1090,7 +1095,9 @@@ echo "  --enable-bluez           enabl
  echo "  --disable-slirp          disable SLIRP userspace network connectivity"
  echo "  --disable-kvm            disable KVM acceleration support"
  echo "  --enable-kvm             enable KVM acceleration support"
 +echo "  --disable-rdma           disable RDMA-based migration support"
 +echo "  --enable-rdma            enable RDMA-based migration support"
  echo "  --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)"
- echo "  --disable-nptl           disable usermode NPTL support"
- echo "  --enable-nptl            enable usermode NPTL support"
  echo "  --enable-system          enable all system emulation targets"
  echo "  --disable-system         disable all system emulation targets"
  echo "  --enable-user            enable supported user emulation targets"
diff --cc linux-user/main.c
index f6a3aad,441e31d..5dc0947
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@@ -3639,12 -3634,9 +3636,10 @@@ int main(int argc, char **argv, char **
          fprintf(stderr, "Unable to find CPU definition\n");
          exit(1);
      }
 +    cpu = ENV_GET_CPU(env);
- #if defined(TARGET_SPARC) || defined(TARGET_PPC)
-     cpu_reset(cpu);
- #endif
+     cpu_reset(ENV_GET_CPU(env));
  
 -    thread_cpu = ENV_GET_CPU(env);
 +    thread_cpu = cpu;
  
      if (getenv("QEMU_STRACE")) {
          do_strace = 1;
commit 340d51df5592c5c11fc3885f7bdedbe581b87366
Author: Laszlo Ersek <lersek at redhat.com>
Date:   Wed Jul 3 15:14:10 2013 +0200

    qga: escape cmdline args when registering win32 service (CVE-2013-2231)
    
    Reported-by: Lev Veyde <lveyde at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/qga/service-win32.c b/qga/service-win32.c
index 1cf81fc..aef41f0 100644
--- a/qga/service-win32.c
+++ b/qga/service-win32.c
@@ -35,6 +35,68 @@ static int printf_win_error(const char *text)
     return n;
 }
 
+/* Windows command line escaping. Based on
+ * <http://blogs.msdn.com/b/oldnewthing/archive/2010/09/17/10063629.aspx> and
+ * <http://msdn.microsoft.com/en-us/library/windows/desktop/17w5ykft%28v=vs.85%29.aspx>.
+ *
+ * The caller is responsible for initializing @buffer; prior contents are lost.
+ */
+static const char *win_escape_arg(const char *to_escape, GString *buffer)
+{
+    size_t backslash_count;
+    const char *c;
+
+    /* open with a double quote */
+    g_string_assign(buffer, "\"");
+
+    backslash_count = 0;
+    for (c = to_escape; *c != '\0'; ++c) {
+        switch (*c) {
+        case '\\':
+            /* The meaning depends on the first non-backslash character coming
+             * up.
+             */
+            ++backslash_count;
+            break;
+
+        case '"':
+            /* We must escape each pending backslash, then escape the double
+             * quote. This creates a case of "odd number of backslashes [...]
+             * followed by a double quotation mark".
+             */
+            while (backslash_count) {
+                --backslash_count;
+                g_string_append(buffer, "\\\\");
+            }
+            g_string_append(buffer, "\\\"");
+            break;
+
+        default:
+            /* Any pending backslashes are without special meaning, flush them.
+             * "Backslashes are interpreted literally, unless they immediately
+             * precede a double quotation mark."
+             */
+            while (backslash_count) {
+                --backslash_count;
+                g_string_append_c(buffer, '\\');
+            }
+            g_string_append_c(buffer, *c);
+        }
+    }
+
+    /* We're about to close with a double quote in string delimiter role.
+     * Double all pending backslashes, creating a case of "even number of
+     * backslashes [...] followed by a double quotation mark".
+     */
+    while (backslash_count) {
+        --backslash_count;
+        g_string_append(buffer, "\\\\");
+    }
+    g_string_append_c(buffer, '"');
+
+    return buffer->str;
+}
+
 int ga_install_service(const char *path, const char *logfile,
                        const char *state_dir)
 {
@@ -42,6 +104,7 @@ int ga_install_service(const char *path, const char *logfile,
     SC_HANDLE manager;
     SC_HANDLE service;
     TCHAR module_fname[MAX_PATH];
+    GString *esc;
     GString *cmdline;
     SERVICE_DESCRIPTION desc = { (char *)QGA_SERVICE_DESCRIPTION };
 
@@ -50,17 +113,22 @@ int ga_install_service(const char *path, const char *logfile,
         return EXIT_FAILURE;
     }
 
-    cmdline = g_string_new(module_fname);
-    g_string_append(cmdline, " -d");
+    esc     = g_string_new("");
+    cmdline = g_string_new("");
+
+    g_string_append_printf(cmdline, "%s -d",
+                           win_escape_arg(module_fname, esc));
 
     if (path) {
-        g_string_append_printf(cmdline, " -p %s", path);
+        g_string_append_printf(cmdline, " -p %s", win_escape_arg(path, esc));
     }
     if (logfile) {
-        g_string_append_printf(cmdline, " -l %s -v", logfile);
+        g_string_append_printf(cmdline, " -l %s -v",
+                               win_escape_arg(logfile, esc));
     }
     if (state_dir) {
-        g_string_append_printf(cmdline, " -t %s", state_dir);
+        g_string_append_printf(cmdline, " -t %s",
+                               win_escape_arg(state_dir, esc));
     }
 
     g_debug("service's cmdline: %s", cmdline->str);
@@ -89,6 +157,7 @@ out_manager:
 
 out_strings:
     g_string_free(cmdline, TRUE);
+    g_string_free(esc, TRUE);
     return ret;
 }
 
commit 108365fdb0042454413d2610ffe7194003ba4ae9
Author: Laszlo Ersek <lersek at redhat.com>
Date:   Wed Jul 3 15:14:09 2013 +0200

    ga_install_service(): nest error paths more idiomatically
    
    Acked-by: Michael Roth <mdroth at linux.vnet.ibm.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/qga/service-win32.c b/qga/service-win32.c
index 6de8be4..1cf81fc 100644
--- a/qga/service-win32.c
+++ b/qga/service-win32.c
@@ -38,10 +38,12 @@ static int printf_win_error(const char *text)
 int ga_install_service(const char *path, const char *logfile,
                        const char *state_dir)
 {
+    int ret = EXIT_FAILURE;
     SC_HANDLE manager;
     SC_HANDLE service;
     TCHAR module_fname[MAX_PATH];
     GString *cmdline;
+    SERVICE_DESCRIPTION desc = { (char *)QGA_SERVICE_DESCRIPTION };
 
     if (GetModuleFileName(NULL, module_fname, MAX_PATH) == 0) {
         printf_win_error("No full path to service's executable");
@@ -66,28 +68,28 @@ int ga_install_service(const char *path, const char *logfile,
     manager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
     if (manager == NULL) {
         printf_win_error("No handle to service control manager");
-        g_string_free(cmdline, TRUE);
-        return EXIT_FAILURE;
+        goto out_strings;
     }
 
     service = CreateService(manager, QGA_SERVICE_NAME, QGA_SERVICE_DISPLAY_NAME,
         SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS, SERVICE_AUTO_START,
         SERVICE_ERROR_NORMAL, cmdline->str, NULL, NULL, NULL, NULL, NULL);
-
-    if (service) {
-        SERVICE_DESCRIPTION desc = { (char *)QGA_SERVICE_DESCRIPTION };
-        ChangeServiceConfig2(service, SERVICE_CONFIG_DESCRIPTION, &desc);
-
-        fprintf(stderr, "Service was installed successfully.\n");
-    } else {
+    if (service == NULL) {
         printf_win_error("Failed to install service");
+        goto out_manager;
     }
 
+    ChangeServiceConfig2(service, SERVICE_CONFIG_DESCRIPTION, &desc);
+    fprintf(stderr, "Service was installed successfully.\n");
+    ret = EXIT_SUCCESS;
     CloseServiceHandle(service);
+
+out_manager:
     CloseServiceHandle(manager);
 
+out_strings:
     g_string_free(cmdline, TRUE);
-    return (service == NULL);
+    return ret;
 }
 
 int ga_uninstall_service(void)
commit febf1c49be1bd80d7c95653fc0caa87d250b2c72
Author: Laszlo Ersek <lersek at redhat.com>
Date:   Wed Jul 3 15:14:08 2013 +0200

    qga/service-win32.c: diagnostic output should go to stderr
    
    Acked-by: Michael Roth <mdroth at linux.vnet.ibm.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/qga/service-win32.c b/qga/service-win32.c
index 02926ab..6de8be4 100644
--- a/qga/service-win32.c
+++ b/qga/service-win32.c
@@ -29,7 +29,7 @@ static int printf_win_error(const char *text)
         MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
         (char *)&message, 0,
         NULL);
-    n = printf("%s. (Error: %d) %s", text, (int)err, message);
+    n = fprintf(stderr, "%s. (Error: %d) %s", text, (int)err, message);
     LocalFree(message);
 
     return n;
@@ -78,7 +78,7 @@ int ga_install_service(const char *path, const char *logfile,
         SERVICE_DESCRIPTION desc = { (char *)QGA_SERVICE_DESCRIPTION };
         ChangeServiceConfig2(service, SERVICE_CONFIG_DESCRIPTION, &desc);
 
-        printf("Service was installed successfully.\n");
+        fprintf(stderr, "Service was installed successfully.\n");
     } else {
         printf_win_error("Failed to install service");
     }
@@ -111,7 +111,7 @@ int ga_uninstall_service(void)
     if (DeleteService(service) == FALSE) {
         printf_win_error("Failed to delete service");
     } else {
-        printf("Service was deleted successfully.\n");
+        fprintf(stderr, "Service was deleted successfully.\n");
     }
 
     CloseServiceHandle(service);
commit d2f5ea9704af781d4cf14e4be08bb4e37a180260
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:38 2013 +0200

    pc-testdev: add I/O port to test memory.c auto split/combine
    
    The ports at 0xe8..0xeb have impl.min/max_access_size == 1, so
    that memory accesses are split and combined by the memory core.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-29-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index ad1aa66..5867c70 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -49,6 +49,7 @@ typedef struct PCTestdev {
     ISADevice parent_obj;
 
     MemoryRegion ioport;
+    MemoryRegion ioport_byte;
     MemoryRegion flush;
     MemoryRegion irq;
     MemoryRegion iomem;
@@ -102,6 +103,16 @@ static const MemoryRegionOps test_ioport_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
+static const MemoryRegionOps test_ioport_byte_ops = {
+    .read = test_ioport_read,
+    .write = test_ioport_write,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 1,
+    .impl.max_access_size = 1,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
 static void test_flush_page(void *opaque, hwaddr addr, uint64_t data,
                             unsigned len)
 {
@@ -156,6 +167,9 @@ static void testdev_realizefn(DeviceState *d, Error **errp)
 
     memory_region_init_io(&dev->ioport, OBJECT(dev), &test_ioport_ops, dev,
                           "pc-testdev-ioport", 4);
+    memory_region_init_io(&dev->ioport_byte, OBJECT(dev),
+                          &test_ioport_byte_ops, dev,
+                          "pc-testdev-ioport-byte", 4);
     memory_region_init_io(&dev->flush, OBJECT(dev), &test_flush_ops, dev,
                           "pc-testdev-flush-page", 4);
     memory_region_init_io(&dev->irq, OBJECT(dev), &test_irq_ops, dev,
@@ -165,6 +179,7 @@ static void testdev_realizefn(DeviceState *d, Error **errp)
 
     memory_region_add_subregion(io,  0xe0,       &dev->ioport);
     memory_region_add_subregion(io,  0xe4,       &dev->flush);
+    memory_region_add_subregion(io,  0xe8,       &dev->ioport_byte);
     memory_region_add_subregion(io,  0x2000,     &dev->irq);
     memory_region_add_subregion(mem, 0xff000000, &dev->iomem);
 }
diff --git a/tests/endianness-test.c b/tests/endianness-test.c
index ca66645..feb32a8 100644
--- a/tests/endianness-test.c
+++ b/tests/endianness-test.c
@@ -190,6 +190,100 @@ static void test_endianness(gconstpointer data)
     g_free(args);
 }
 
+static void test_endianness_split(gconstpointer data)
+{
+    const TestCase *test = data;
+    char *args;
+
+    args = g_strdup_printf("-display none -M %s%s%s -device pc-testdev",
+                           test->machine,
+                           test->superio ? " -device " : "",
+                           test->superio ?: "");
+    qtest_start(args);
+    isa_outl(test, 0xe8, 0x87654321);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654321);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4321);
+
+    isa_outw(test, 0xea, 0x8866);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x88664321);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8866);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4321);
+
+    isa_outw(test, 0xe8, 0x4422);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x88664422);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8866);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4422);
+
+    isa_outb(test, 0xeb, 0x87);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87664422);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8766);
+
+    isa_outb(test, 0xea, 0x65);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654422);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4422);
+
+    isa_outb(test, 0xe9, 0x43);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654322);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4322);
+
+    isa_outb(test, 0xe8, 0x21);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654321);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4321);
+    qtest_quit(global_qtest);
+    g_free(args);
+}
+
+static void test_endianness_combine(gconstpointer data)
+{
+    const TestCase *test = data;
+    char *args;
+
+    args = g_strdup_printf("-display none -M %s%s%s -device pc-testdev",
+                           test->machine,
+                           test->superio ? " -device " : "",
+                           test->superio ?: "");
+    qtest_start(args);
+    isa_outl(test, 0xe0, 0x87654321);
+    g_assert_cmphex(isa_inl(test, 0xe8), ==, 0x87654321);
+    g_assert_cmphex(isa_inw(test, 0xea), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe8), ==, 0x4321);
+
+    isa_outw(test, 0xe2, 0x8866);
+    g_assert_cmphex(isa_inl(test, 0xe8), ==, 0x88664321);
+    g_assert_cmphex(isa_inw(test, 0xea), ==, 0x8866);
+    g_assert_cmphex(isa_inw(test, 0xe8), ==, 0x4321);
+
+    isa_outw(test, 0xe0, 0x4422);
+    g_assert_cmphex(isa_inl(test, 0xe8), ==, 0x88664422);
+    g_assert_cmphex(isa_inw(test, 0xea), ==, 0x8866);
+    g_assert_cmphex(isa_inw(test, 0xe8), ==, 0x4422);
+
+    isa_outb(test, 0xe3, 0x87);
+    g_assert_cmphex(isa_inl(test, 0xe8), ==, 0x87664422);
+    g_assert_cmphex(isa_inw(test, 0xea), ==, 0x8766);
+
+    isa_outb(test, 0xe2, 0x65);
+    g_assert_cmphex(isa_inl(test, 0xe8), ==, 0x87654422);
+    g_assert_cmphex(isa_inw(test, 0xea), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe8), ==, 0x4422);
+
+    isa_outb(test, 0xe1, 0x43);
+    g_assert_cmphex(isa_inl(test, 0xe8), ==, 0x87654322);
+    g_assert_cmphex(isa_inw(test, 0xea), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe8), ==, 0x4322);
+
+    isa_outb(test, 0xe0, 0x21);
+    g_assert_cmphex(isa_inl(test, 0xe8), ==, 0x87654321);
+    g_assert_cmphex(isa_inw(test, 0xea), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe8), ==, 0x4321);
+    qtest_quit(global_qtest);
+    g_free(args);
+}
+
 int main(int argc, char **argv)
 {
     const char *arch = qtest_get_arch();
@@ -206,6 +300,14 @@ int main(int argc, char **argv)
         path = g_strdup_printf("/%s/endianness/%s",
                                arch, test_cases[i].machine);
         g_test_add_data_func(path, &test_cases[i], test_endianness);
+
+        path = g_strdup_printf("/%s/endianness/split/%s",
+                               arch, test_cases[i].machine);
+        g_test_add_data_func(path, &test_cases[i], test_endianness_split);
+
+        path = g_strdup_printf("/%s/endianness/combine/%s",
+                               arch, test_cases[i].machine);
+        g_test_add_data_func(path, &test_cases[i], test_endianness_combine);
     }
 
     ret = g_test_run();
commit e7342aa39b3193473ded24cbf2233930665796e9
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:37 2013 +0200

    memory: check memory region endianness, not target's
    
    When combining multiple accesses into a single value, we need to do so
    in the device's desired endianness.  The target endianness does not have
    any influence.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-28-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/memory.c b/memory.c
index 8bb61f2..1494e95 100644
--- a/memory.c
+++ b/memory.c
@@ -339,6 +339,15 @@ static void flatview_simplify(FlatView *view)
     }
 }
 
+static bool memory_region_big_endian(MemoryRegion *mr)
+{
+#ifdef TARGET_WORDS_BIGENDIAN
+    return mr->ops->endianness != DEVICE_LITTLE_ENDIAN;
+#else
+    return mr->ops->endianness == DEVICE_BIG_ENDIAN;
+#endif
+}
+
 static bool memory_region_wrong_endianness(MemoryRegion *mr)
 {
 #ifdef TARGET_WORDS_BIGENDIAN
@@ -454,13 +463,15 @@ static void access_with_adjusted_size(hwaddr addr,
     /* FIXME: support unaligned access? */
     access_size = MAX(MIN(size, access_size_max), access_size_min);
     access_mask = -1ULL >> (64 - access_size * 8);
-    for (i = 0; i < size; i += access_size) {
-#ifdef TARGET_WORDS_BIGENDIAN
-        access(mr, addr + i, value, access_size,
-               (size - access_size - i) * 8, access_mask);
-#else
-        access(mr, addr + i, value, access_size, i * 8, access_mask);
-#endif
+    if (memory_region_big_endian(mr)) {
+        for (i = 0; i < size; i += access_size) {
+            access(mr, addr + i, value, access_size,
+                   (size - access_size - i) * 8, access_mask);
+        }
+    } else {
+        for (i = 0; i < size; i += access_size) {
+            access(mr, addr + i, value, access_size, i * 8, access_mask);
+        }
     }
 }
 
commit 547e9201c52629eef71b0eb8cb48dacc50bcf759
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:36 2013 +0200

    memory: pass MemoryRegion to access_with_adjusted_size
    
    The accessors all use a MemoryRegion opaque value.  Avoid going
    uselessly through void*.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-27-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/memory.c b/memory.c
index 73fce9f..8bb61f2 100644
--- a/memory.c
+++ b/memory.c
@@ -369,28 +369,26 @@ static void adjust_endianness(MemoryRegion *mr, uint64_t *data, unsigned size)
     }
 }
 
-static void memory_region_oldmmio_read_accessor(void *opaque,
+static void memory_region_oldmmio_read_accessor(MemoryRegion *mr,
                                                 hwaddr addr,
                                                 uint64_t *value,
                                                 unsigned size,
                                                 unsigned shift,
                                                 uint64_t mask)
 {
-    MemoryRegion *mr = opaque;
     uint64_t tmp;
 
     tmp = mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr);
     *value |= (tmp & mask) << shift;
 }
 
-static void memory_region_read_accessor(void *opaque,
+static void memory_region_read_accessor(MemoryRegion *mr,
                                         hwaddr addr,
                                         uint64_t *value,
                                         unsigned size,
                                         unsigned shift,
                                         uint64_t mask)
 {
-    MemoryRegion *mr = opaque;
     uint64_t tmp;
 
     if (mr->flush_coalesced_mmio) {
@@ -400,28 +398,26 @@ static void memory_region_read_accessor(void *opaque,
     *value |= (tmp & mask) << shift;
 }
 
-static void memory_region_oldmmio_write_accessor(void *opaque,
+static void memory_region_oldmmio_write_accessor(MemoryRegion *mr,
                                                  hwaddr addr,
                                                  uint64_t *value,
                                                  unsigned size,
                                                  unsigned shift,
                                                  uint64_t mask)
 {
-    MemoryRegion *mr = opaque;
     uint64_t tmp;
 
     tmp = (*value >> shift) & mask;
     mr->ops->old_mmio.write[ctz32(size)](mr->opaque, addr, tmp);
 }
 
-static void memory_region_write_accessor(void *opaque,
+static void memory_region_write_accessor(MemoryRegion *mr,
                                          hwaddr addr,
                                          uint64_t *value,
                                          unsigned size,
                                          unsigned shift,
                                          uint64_t mask)
 {
-    MemoryRegion *mr = opaque;
     uint64_t tmp;
 
     if (mr->flush_coalesced_mmio) {
@@ -436,13 +432,13 @@ static void access_with_adjusted_size(hwaddr addr,
                                       unsigned size,
                                       unsigned access_size_min,
                                       unsigned access_size_max,
-                                      void (*access)(void *opaque,
+                                      void (*access)(MemoryRegion *mr,
                                                      hwaddr addr,
                                                      uint64_t *value,
                                                      unsigned size,
                                                      unsigned shift,
                                                      uint64_t mask),
-                                      void *opaque)
+                                      MemoryRegion *mr)
 {
     uint64_t access_mask;
     unsigned access_size;
@@ -460,10 +456,10 @@ static void access_with_adjusted_size(hwaddr addr,
     access_mask = -1ULL >> (64 - access_size * 8);
     for (i = 0; i < size; i += access_size) {
 #ifdef TARGET_WORDS_BIGENDIAN
-        access(opaque, addr + i, value, access_size,
+        access(mr, addr + i, value, access_size,
                (size - access_size - i) * 8, access_mask);
 #else
-        access(opaque, addr + i, value, access_size, i * 8, access_mask);
+        access(mr, addr + i, value, access_size, i * 8, access_mask);
 #endif
     }
 }
commit e11ef3d184c88a316f48ba2472dcb2937d9fa24b
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:35 2013 +0200

    memory: move functions around
    
    Prepare for next patch, no semantic change.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-26-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/memory.c b/memory.c
index 01846c9..73fce9f 100644
--- a/memory.c
+++ b/memory.c
@@ -339,6 +339,36 @@ static void flatview_simplify(FlatView *view)
     }
 }
 
+static bool memory_region_wrong_endianness(MemoryRegion *mr)
+{
+#ifdef TARGET_WORDS_BIGENDIAN
+    return mr->ops->endianness == DEVICE_LITTLE_ENDIAN;
+#else
+    return mr->ops->endianness == DEVICE_BIG_ENDIAN;
+#endif
+}
+
+static void adjust_endianness(MemoryRegion *mr, uint64_t *data, unsigned size)
+{
+    if (memory_region_wrong_endianness(mr)) {
+        switch (size) {
+        case 1:
+            break;
+        case 2:
+            *data = bswap16(*data);
+            break;
+        case 4:
+            *data = bswap32(*data);
+            break;
+        case 8:
+            *data = bswap64(*data);
+            break;
+        default:
+            abort();
+        }
+    }
+}
+
 static void memory_region_oldmmio_read_accessor(void *opaque,
                                                 hwaddr addr,
                                                 uint64_t *value,
@@ -786,15 +816,6 @@ static void memory_region_destructor_rom_device(MemoryRegion *mr)
     qemu_ram_free(mr->ram_addr & TARGET_PAGE_MASK);
 }
 
-static bool memory_region_wrong_endianness(MemoryRegion *mr)
-{
-#ifdef TARGET_WORDS_BIGENDIAN
-    return mr->ops->endianness == DEVICE_LITTLE_ENDIAN;
-#else
-    return mr->ops->endianness == DEVICE_BIG_ENDIAN;
-#endif
-}
-
 void memory_region_init(MemoryRegion *mr,
                         Object *owner,
                         const char *name,
@@ -921,27 +942,6 @@ static uint64_t memory_region_dispatch_read1(MemoryRegion *mr,
     return data;
 }
 
-static void adjust_endianness(MemoryRegion *mr, uint64_t *data, unsigned size)
-{
-    if (memory_region_wrong_endianness(mr)) {
-        switch (size) {
-        case 1:
-            break;
-        case 2:
-            *data = bswap16(*data);
-            break;
-        case 4:
-            *data = bswap32(*data);
-            break;
-        case 8:
-            *data = bswap64(*data);
-            break;
-        default:
-            abort();
-        }
-    }
-}
-
 static bool memory_region_dispatch_read(MemoryRegion *mr,
                                         hwaddr addr,
                                         uint64_t *pval,
commit 8fefa31be98ada3677add2008732d0b1a17ed28d
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:34 2013 +0200

    qtest: add test for ISA I/O space endianness
    
    This writes a register and reads its 1/2/4 byte parts.  Masking
    is done in the device model.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-25-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/Makefile b/tests/Makefile
index 6c34eec..cdbb79e 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -53,7 +53,8 @@ check-block-$(CONFIG_POSIX) += tests/qemu-iotests-quick.sh
 
 # All QTests for now are POSIX-only, but the dependencies are
 # really in libqtest, not in the testcases themselves.
-check-qtest-i386-y = tests/fdc-test$(EXESUF)
+check-qtest-i386-y = tests/endianness-test$(EXESUF)
+check-qtest-i386-y += tests/fdc-test$(EXESUF)
 gcov-files-i386-y = hw/fdc.c
 check-qtest-i386-y += tests/ide-test$(EXESUF)
 check-qtest-i386-y += tests/hd-geo-test$(EXESUF)
@@ -65,8 +66,16 @@ check-qtest-i386-y += tests/fw_cfg-test$(EXESUF)
 check-qtest-x86_64-y = $(check-qtest-i386-y)
 gcov-files-i386-y += i386-softmmu/hw/mc146818rtc.c
 gcov-files-x86_64-y = $(subst i386-softmmu/,x86_64-softmmu/,$(gcov-files-i386-y))
+check-qtest-mips-y = tests/endianness-test$(EXESUF)
+check-qtest-mips64-y = tests/endianness-test$(EXESUF)
+check-qtest-mips64el-y = tests/endianness-test$(EXESUF)
+check-qtest-ppc-y = tests/endianness-test$(EXESUF)
+check-qtest-ppc64-y = tests/endianness-test$(EXESUF)
+check-qtest-sh4-y = tests/endianness-test$(EXESUF)
+check-qtest-sh4eb-y = tests/endianness-test$(EXESUF)
+check-qtest-sparc64-y = tests/endianness-test$(EXESUF)
 #check-qtest-sparc-y = tests/m48t59-test$(EXESUF)
-#check-qtest-sparc64-y = tests/m48t59-test$(EXESUF)
+#check-qtest-sparc64-y += tests/m48t59-test$(EXESUF)
 gcov-files-sparc-y += hw/m48t59.c
 gcov-files-sparc64-y += hw/m48t59.c
 check-qtest-arm-y = tests/tmp105-test$(EXESUF)
@@ -136,6 +145,7 @@ libqos-omap-obj-y = $(libqos-obj-y) tests/libqos/i2c-omap.o
 
 tests/rtc-test$(EXESUF): tests/rtc-test.o
 tests/m48t59-test$(EXESUF): tests/m48t59-test.o
+tests/endianness-test$(EXESUF): tests/endianness-test.o
 tests/fdc-test$(EXESUF): tests/fdc-test.o
 tests/ide-test$(EXESUF): tests/ide-test.o $(libqos-pc-obj-y)
 tests/hd-geo-test$(EXESUF): tests/hd-geo-test.o
diff --git a/tests/endianness-test.c b/tests/endianness-test.c
new file mode 100644
index 0000000..ca66645
--- /dev/null
+++ b/tests/endianness-test.c
@@ -0,0 +1,214 @@
+/*
+ * QTest testcase for ISA endianness
+ *
+ * Copyright Red Hat, Inc. 2012
+ *
+ * Authors:
+ *  Paolo Bonzini <pbonzini at redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+#include "libqtest.h"
+
+#include <glib.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "qemu/bswap.h"
+
+typedef struct TestCase TestCase;
+struct TestCase {
+    const char *arch;
+    const char *machine;
+    uint64_t isa_base;
+    bool bswap;
+    const char *superio;
+};
+
+static const TestCase test_cases[] = {
+    { "i386", "pc", -1 },
+    { "mips", "magnum", 0x90000000, .bswap = true },
+    { "mips", "pica61", 0x90000000, .bswap = true },
+    { "mips", "mips", 0x14000000, .bswap = true },
+    { "mips", "malta", 0x10000000, .bswap = true },
+    { "mips64", "magnum", 0x90000000, .bswap = true },
+    { "mips64", "pica61", 0x90000000, .bswap = true },
+    { "mips64", "mips", 0x14000000, .bswap = true },
+    { "mips64", "malta", 0x10000000, .bswap = true },
+    { "mips64el", "fulong2e", 0x1fd00000 },
+    { "ppc", "g3beige", 0xfe000000, .bswap = true, .superio = "i82378" },
+    { "ppc", "prep", 0x80000000, .bswap = true },
+    { "ppc", "bamboo", 0xe8000000, .bswap = true, .superio = "i82378" },
+    { "ppc64", "mac99", 0xf2000000, .bswap = true, .superio = "i82378" },
+    { "ppc64", "pseries", 0x10080000000, .bswap = true, .superio = "i82378" },
+    { "sh4", "r2d", 0xfe240000, .superio = "i82378" },
+    { "sh4eb", "r2d", 0xfe240000, .bswap = true, .superio = "i82378" },
+    { "sparc64", "sun4u", 0x1fe02000000LL, .bswap = true },
+    { "x86_64", "pc", -1 },
+    {}
+};
+
+static uint8_t isa_inb(const TestCase *test, uint16_t addr)
+{
+    uint8_t value;
+    if (test->isa_base == -1) {
+        value = inb(addr);
+    } else {
+        value = readb(test->isa_base + addr);
+    }
+    return value;
+}
+
+static uint16_t isa_inw(const TestCase *test, uint16_t addr)
+{
+    uint16_t value;
+    if (test->isa_base == -1) {
+        value = inw(addr);
+    } else {
+        value = readw(test->isa_base + addr);
+    }
+    return test->bswap ? bswap16(value) : value;
+}
+
+static uint32_t isa_inl(const TestCase *test, uint16_t addr)
+{
+    uint32_t value;
+    if (test->isa_base == -1) {
+        value = inl(addr);
+    } else {
+        value = readl(test->isa_base + addr);
+    }
+    return test->bswap ? bswap32(value) : value;
+}
+
+static void isa_outb(const TestCase *test, uint16_t addr, uint8_t value)
+{
+    if (test->isa_base == -1) {
+        outb(addr, value);
+    } else {
+        writeb(test->isa_base + addr, value);
+    }
+}
+
+static void isa_outw(const TestCase *test, uint16_t addr, uint16_t value)
+{
+    value = test->bswap ? bswap16(value) : value;
+    if (test->isa_base == -1) {
+        outw(addr, value);
+    } else {
+        writew(test->isa_base + addr, value);
+    }
+}
+
+static void isa_outl(const TestCase *test, uint16_t addr, uint32_t value)
+{
+    value = test->bswap ? bswap32(value) : value;
+    if (test->isa_base == -1) {
+        outl(addr, value);
+    } else {
+        writel(test->isa_base + addr, value);
+    }
+}
+
+
+static void test_endianness(gconstpointer data)
+{
+    const TestCase *test = data;
+    char *args;
+
+    args = g_strdup_printf("-display none -M %s%s%s -device pc-testdev",
+                           test->machine,
+                           test->superio ? " -device " : "",
+                           test->superio ?: "");
+    qtest_start(args);
+    isa_outl(test, 0xe0, 0x87654321);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654321);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4321);
+    g_assert_cmphex(isa_inb(test, 0xe3), ==, 0x87);
+    g_assert_cmphex(isa_inb(test, 0xe2), ==, 0x65);
+    g_assert_cmphex(isa_inb(test, 0xe1), ==, 0x43);
+    g_assert_cmphex(isa_inb(test, 0xe0), ==, 0x21);
+
+    isa_outw(test, 0xe2, 0x8866);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x88664321);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8866);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4321);
+    g_assert_cmphex(isa_inb(test, 0xe3), ==, 0x88);
+    g_assert_cmphex(isa_inb(test, 0xe2), ==, 0x66);
+    g_assert_cmphex(isa_inb(test, 0xe1), ==, 0x43);
+    g_assert_cmphex(isa_inb(test, 0xe0), ==, 0x21);
+
+    isa_outw(test, 0xe0, 0x4422);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x88664422);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8866);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4422);
+    g_assert_cmphex(isa_inb(test, 0xe3), ==, 0x88);
+    g_assert_cmphex(isa_inb(test, 0xe2), ==, 0x66);
+    g_assert_cmphex(isa_inb(test, 0xe1), ==, 0x44);
+    g_assert_cmphex(isa_inb(test, 0xe0), ==, 0x22);
+
+    isa_outb(test, 0xe3, 0x87);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87664422);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8766);
+    g_assert_cmphex(isa_inb(test, 0xe3), ==, 0x87);
+    g_assert_cmphex(isa_inb(test, 0xe2), ==, 0x66);
+    g_assert_cmphex(isa_inb(test, 0xe1), ==, 0x44);
+    g_assert_cmphex(isa_inb(test, 0xe0), ==, 0x22);
+
+    isa_outb(test, 0xe2, 0x65);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654422);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4422);
+    g_assert_cmphex(isa_inb(test, 0xe3), ==, 0x87);
+    g_assert_cmphex(isa_inb(test, 0xe2), ==, 0x65);
+    g_assert_cmphex(isa_inb(test, 0xe1), ==, 0x44);
+    g_assert_cmphex(isa_inb(test, 0xe0), ==, 0x22);
+
+    isa_outb(test, 0xe1, 0x43);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654322);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4322);
+    g_assert_cmphex(isa_inb(test, 0xe3), ==, 0x87);
+    g_assert_cmphex(isa_inb(test, 0xe2), ==, 0x65);
+    g_assert_cmphex(isa_inb(test, 0xe1), ==, 0x43);
+    g_assert_cmphex(isa_inb(test, 0xe0), ==, 0x22);
+
+    isa_outb(test, 0xe0, 0x21);
+    g_assert_cmphex(isa_inl(test, 0xe0), ==, 0x87654321);
+    g_assert_cmphex(isa_inw(test, 0xe2), ==, 0x8765);
+    g_assert_cmphex(isa_inw(test, 0xe0), ==, 0x4321);
+    g_assert_cmphex(isa_inb(test, 0xe3), ==, 0x87);
+    g_assert_cmphex(isa_inb(test, 0xe2), ==, 0x65);
+    g_assert_cmphex(isa_inb(test, 0xe1), ==, 0x43);
+    g_assert_cmphex(isa_inb(test, 0xe0), ==, 0x21);
+    qtest_quit(global_qtest);
+    g_free(args);
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+    int ret;
+    int i;
+
+    g_test_init(&argc, &argv, NULL);
+
+    for (i = 0; test_cases[i].arch; i++) {
+        gchar *path;
+        if (strcmp(test_cases[i].arch, arch) != 0) {
+            continue;
+        }
+        path = g_strdup_printf("/%s/endianness/%s",
+                               arch, test_cases[i].machine);
+        g_test_add_data_func(path, &test_cases[i], test_endianness);
+    }
+
+    ret = g_test_run();
+
+    return ret;
+}
commit 9c9984242ce46ccf8636f5c19e81d794e84aa0c7
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:33 2013 +0200

    default-configs/ppc64: add all components of i82378 SuperIO chip used by prep
    
    The device provides an ISA bus so that pseries can also run the
    endianness test.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-24-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/default-configs/ppc64-softmmu.mak b/default-configs/ppc64-softmmu.mak
index 0164443..7831c2b 100644
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -48,5 +48,11 @@ CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 # For pSeries
 CONFIG_XICS=$(CONFIG_PSERIES)
 # For PReP
+CONFIG_I82378=y
+CONFIG_I8259=y
+CONFIG_I8254=y
+CONFIG_PCSPK=y
+CONFIG_I82374=y
+CONFIG_I8257=y
 CONFIG_MC146818RTC=y
 CONFIG_ISA_TESTDEV=y
commit 85d3846a397e8fa95de0a84479007172e6d30668
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:32 2013 +0200

    default-configs: add SuperIO to SH4
    
    The device provides an ISA bus to run the endianness test on.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-23-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/default-configs/sh4-softmmu.mak b/default-configs/sh4-softmmu.mak
index bea21ac..8e00390 100644
--- a/default-configs/sh4-softmmu.mak
+++ b/default-configs/sh4-softmmu.mak
@@ -9,3 +9,10 @@ CONFIG_SH4=y
 CONFIG_IDE_MMIO=y
 CONFIG_SM501=y
 CONFIG_ISA_TESTDEV=y
+CONFIG_I82378=y
+CONFIG_I8259=y
+CONFIG_I8254=y
+CONFIG_PCSPK=y
+CONFIG_I82374=y
+CONFIG_I8257=y
+CONFIG_MC146818RTC=y
diff --git a/default-configs/sh4eb-softmmu.mak b/default-configs/sh4eb-softmmu.mak
index 2fd973e..efdd058 100644
--- a/default-configs/sh4eb-softmmu.mak
+++ b/default-configs/sh4eb-softmmu.mak
@@ -9,3 +9,10 @@ CONFIG_SH4=y
 CONFIG_IDE_MMIO=y
 CONFIG_SM501=y
 CONFIG_ISA_TESTDEV=y
+CONFIG_I82378=y
+CONFIG_I8259=y
+CONFIG_I8254=y
+CONFIG_PCSPK=y
+CONFIG_I82374=y
+CONFIG_I8257=y
+CONFIG_MC146818RTC=y
commit be6d08be25d38185ab7de02fab1b2ac74991741b
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:31 2013 +0200

    default-configs: add test device to all machines supporting ISA
    
    This will let these machines run an endianness test for ISA
    I/O port space.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-22-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/default-configs/alpha-softmmu.mak b/default-configs/alpha-softmmu.mak
index 18e5337..bc07600 100644
--- a/default-configs/alpha-softmmu.mak
+++ b/default-configs/alpha-softmmu.mak
@@ -14,3 +14,4 @@ CONFIG_VMWARE_VGA=y
 CONFIG_IDE_CMD646=y
 CONFIG_I8259=y
 CONFIG_MC146818RTC=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/mips-softmmu.mak b/default-configs/mips-softmmu.mak
index 6cdca11..926709a 100644
--- a/default-configs/mips-softmmu.mak
+++ b/default-configs/mips-softmmu.mak
@@ -33,3 +33,4 @@ CONFIG_I8259=y
 CONFIG_JAZZ_LED=y
 CONFIG_MC146818RTC=y
 CONFIG_VT82C686=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/mips64-softmmu.mak b/default-configs/mips64-softmmu.mak
index 8997854..0ef3f09 100644
--- a/default-configs/mips64-softmmu.mak
+++ b/default-configs/mips64-softmmu.mak
@@ -33,3 +33,4 @@ CONFIG_I8259=y
 CONFIG_JAZZ_LED=y
 CONFIG_MC146818RTC=y
 CONFIG_VT82C686=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/mips64el-softmmu.mak b/default-configs/mips64el-softmmu.mak
index f18f3fc..6089318 100644
--- a/default-configs/mips64el-softmmu.mak
+++ b/default-configs/mips64el-softmmu.mak
@@ -35,3 +35,4 @@ CONFIG_I8259=y
 CONFIG_JAZZ_LED=y
 CONFIG_MC146818RTC=y
 CONFIG_VT82C686=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/mipsel-softmmu.mak b/default-configs/mipsel-softmmu.mak
index 6281f48..cd59e24 100644
--- a/default-configs/mipsel-softmmu.mak
+++ b/default-configs/mipsel-softmmu.mak
@@ -33,3 +33,4 @@ CONFIG_I8259=y
 CONFIG_JAZZ_LED=y
 CONFIG_MC146818RTC=y
 CONFIG_VT82C686=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/ppc-softmmu.mak b/default-configs/ppc-softmmu.mak
index 73e4cc5..eac0b28 100644
--- a/default-configs/ppc-softmmu.mak
+++ b/default-configs/ppc-softmmu.mak
@@ -46,3 +46,4 @@ CONFIG_E500=y
 CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 # For PReP
 CONFIG_MC146818RTC=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/ppc64-softmmu.mak b/default-configs/ppc64-softmmu.mak
index 6d1933b..0164443 100644
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -49,3 +49,4 @@ CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 CONFIG_XICS=$(CONFIG_PSERIES)
 # For PReP
 CONFIG_MC146818RTC=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/ppcemb-softmmu.mak b/default-configs/ppcemb-softmmu.mak
index e3b5e50..86080a7 100644
--- a/default-configs/ppcemb-softmmu.mak
+++ b/default-configs/ppcemb-softmmu.mak
@@ -41,3 +41,4 @@ CONFIG_E500=y
 CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 # For PReP
 CONFIG_MC146818RTC=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/sh4-softmmu.mak b/default-configs/sh4-softmmu.mak
index ef963ee..bea21ac 100644
--- a/default-configs/sh4-softmmu.mak
+++ b/default-configs/sh4-softmmu.mak
@@ -8,3 +8,4 @@ CONFIG_PFLASH_CFI02=y
 CONFIG_SH4=y
 CONFIG_IDE_MMIO=y
 CONFIG_SM501=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/sh4eb-softmmu.mak b/default-configs/sh4eb-softmmu.mak
index e744486..2fd973e 100644
--- a/default-configs/sh4eb-softmmu.mak
+++ b/default-configs/sh4eb-softmmu.mak
@@ -8,3 +8,4 @@ CONFIG_PFLASH_CFI02=y
 CONFIG_SH4=y
 CONFIG_IDE_MMIO=y
 CONFIG_SM501=y
+CONFIG_ISA_TESTDEV=y
diff --git a/default-configs/sparc64-softmmu.mak b/default-configs/sparc64-softmmu.mak
index 9b08ee8..299c97b 100644
--- a/default-configs/sparc64-softmmu.mak
+++ b/default-configs/sparc64-softmmu.mak
@@ -15,3 +15,4 @@ CONFIG_IDE_ISA=y
 CONFIG_IDE_CMD646=y
 CONFIG_PCI_APB=y
 CONFIG_MC146818RTC=y
+CONFIG_ISA_TESTDEV=y
commit 2b8fbcd87007a170a9778ec6645c06f543977067
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:30 2013 +0200

    sparc64: unbreak
    
    ... by making apb a subclass of TYPE_PCI_HOST_BRIDGE.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-21-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index 208ac85..3756ce9 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -70,9 +70,14 @@ do { printf("APB: " fmt , ## __VA_ARGS__); } while (0)
 #define MAX_IVEC 0x40
 #define NO_IRQ_REQUEST (MAX_IVEC + 1)
 
+#define TYPE_APB "pbm"
+
+#define APB_DEVICE(obj) \
+    OBJECT_CHECK(APBState, (obj), TYPE_APB)
+
 typedef struct APBState {
-    SysBusDevice busdev;
-    PCIBus      *bus;
+    PCIHostState parent_obj;
+
     MemoryRegion apb_config;
     MemoryRegion pci_config;
     MemoryRegion pci_mmio;
@@ -284,10 +289,11 @@ static void apb_pci_config_write(void *opaque, hwaddr addr,
                                  uint64_t val, unsigned size)
 {
     APBState *s = opaque;
+    PCIHostState *phb = PCI_HOST_BRIDGE(s);
 
     val = qemu_bswap_len(val, size);
     APB_DPRINTF("%s: addr " TARGET_FMT_plx " val %" PRIx64 "\n", __func__, addr, val);
-    pci_data_write(s->bus, addr, val, size);
+    pci_data_write(phb->bus, addr, val, size);
 }
 
 static uint64_t apb_pci_config_read(void *opaque, hwaddr addr,
@@ -295,8 +301,9 @@ static uint64_t apb_pci_config_read(void *opaque, hwaddr addr,
 {
     uint32_t ret;
     APBState *s = opaque;
+    PCIHostState *phb = PCI_HOST_BRIDGE(s);
 
-    ret = pci_data_read(s->bus, addr, size);
+    ret = pci_data_read(phb->bus, addr, size);
     ret = qemu_bswap_len(ret, size);
     APB_DPRINTF("%s: addr " TARGET_FMT_plx " -> %x\n", __func__, addr, ret);
     return ret;
@@ -381,12 +388,13 @@ PCIBus *pci_apb_init(hwaddr special_base,
 {
     DeviceState *dev;
     SysBusDevice *s;
+    PCIHostState *phb;
     APBState *d;
     PCIDevice *pci_dev;
     PCIBridge *br;
 
     /* Ultrasparc PBM main bus */
-    dev = qdev_create(NULL, "pbm");
+    dev = qdev_create(NULL, TYPE_APB);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
     /* apb_config */
@@ -395,24 +403,25 @@ PCIBus *pci_apb_init(hwaddr special_base,
     sysbus_mmio_map(s, 1, special_base + 0x1000000ULL);
     /* pci_ioport */
     sysbus_mmio_map(s, 2, special_base + 0x2000000ULL);
-    d = FROM_SYSBUS(APBState, s);
+    d = APB_DEVICE(dev);
 
     memory_region_init(&d->pci_mmio, OBJECT(s), "pci-mmio", 0x100000000ULL);
     memory_region_add_subregion(get_system_memory(), mem_base, &d->pci_mmio);
 
-    d->bus = pci_register_bus(&d->busdev.qdev, "pci",
-                              pci_apb_set_irq, pci_pbm_map_irq, d,
-                              &d->pci_mmio,
-                              get_system_io(),
-                              0, 32, TYPE_PCI_BUS);
+    phb = PCI_HOST_BRIDGE(dev);
+    phb->bus = pci_register_bus(DEVICE(phb), "pci",
+                                pci_apb_set_irq, pci_pbm_map_irq, d,
+                                &d->pci_mmio,
+                                get_system_io(),
+                                0, 32, TYPE_PCI_BUS);
 
     *pbm_irqs = d->pbm_irqs;
     d->ivec_irqs = ivec_irqs;
 
-    pci_create_simple(d->bus, 0, "pbm-pci");
+    pci_create_simple(phb->bus, 0, "pbm-pci");
 
     /* APB secondary busses */
-    pci_dev = pci_create_multifunction(d->bus, PCI_DEVFN(1, 0), true,
+    pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 0), true,
                                    "pbm-bridge");
     br = DO_UPCAST(PCIBridge, dev, pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 1",
@@ -420,7 +429,7 @@ PCIBus *pci_apb_init(hwaddr special_base,
     qdev_init_nofail(&pci_dev->qdev);
     *bus2 = pci_bridge_get_sec_bus(br);
 
-    pci_dev = pci_create_multifunction(d->bus, PCI_DEVFN(1, 1), true,
+    pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 1), true,
                                    "pbm-bridge");
     br = DO_UPCAST(PCIBridge, dev, pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 2",
@@ -428,13 +437,13 @@ PCIBus *pci_apb_init(hwaddr special_base,
     qdev_init_nofail(&pci_dev->qdev);
     *bus3 = pci_bridge_get_sec_bus(br);
 
-    return d->bus;
+    return phb->bus;
 }
 
 static void pci_pbm_reset(DeviceState *d)
 {
     unsigned int i;
-    APBState *s = container_of(d, APBState, busdev.qdev);
+    APBState *s = APB_DEVICE(d);
 
     for (i = 0; i < 8; i++) {
         s->pci_irq_map[i] &= PBM_PCI_IMR_MASK;
@@ -463,7 +472,7 @@ static int pci_pbm_init_device(SysBusDevice *dev)
     APBState *s;
     unsigned int i;
 
-    s = FROM_SYSBUS(APBState, dev);
+    s = APB_DEVICE(dev);
     for (i = 0; i < 8; i++) {
         s->pci_irq_map[i] = (0x1f << 6) | (i << 2);
     }
@@ -531,8 +540,8 @@ static void pbm_host_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pbm_host_info = {
-    .name          = "pbm",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .name          = TYPE_APB,
+    .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(APBState),
     .class_init    = pbm_host_class_init,
 };
commit b23ea25f5098f576d10a8833bc60b8f8394f9b0b
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:29 2013 +0200

    sh4: unbreak r2d
    
    ... by making sh_pci a subclass of TYPE_PCI_HOST_BRIDGE.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-20-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/sh4/sh_pci.c b/hw/sh4/sh_pci.c
index 53e9eb8..e81176a 100644
--- a/hw/sh4/sh_pci.c
+++ b/hw/sh4/sh_pci.c
@@ -28,9 +28,14 @@
 #include "qemu/bswap.h"
 #include "exec/address-spaces.h"
 
+#define TYPE_SH_PCI_HOST_BRIDGE "sh_pci"
+
+#define SH_PCI_HOST_BRIDGE(obj) \
+    OBJECT_CHECK(SHPCIState, (obj), TYPE_SH_PCI_HOST_BRIDGE)
+
 typedef struct SHPCIState {
-    SysBusDevice busdev;
-    PCIBus *bus;
+    PCIHostState parent_obj;
+
     PCIDevice *dev;
     qemu_irq irq[4];
     MemoryRegion memconfig_p4;
@@ -45,6 +50,8 @@ static void sh_pci_reg_write (void *p, hwaddr addr, uint64_t val,
                               unsigned size)
 {
     SHPCIState *pcic = p;
+    PCIHostState *phb = PCI_HOST_BRIDGE(pcic);
+
     switch(addr) {
     case 0 ... 0xfc:
         cpu_to_le32w((uint32_t*)(pcic->dev->config + addr), val);
@@ -64,7 +71,7 @@ static void sh_pci_reg_write (void *p, hwaddr addr, uint64_t val,
         }
         break;
     case 0x220:
-        pci_data_write(pcic->bus, pcic->par, val, 4);
+        pci_data_write(phb->bus, pcic->par, val, 4);
         break;
     }
 }
@@ -73,6 +80,8 @@ static uint64_t sh_pci_reg_read (void *p, hwaddr addr,
                                  unsigned size)
 {
     SHPCIState *pcic = p;
+    PCIHostState *phb = PCI_HOST_BRIDGE(pcic);
+
     switch(addr) {
     case 0 ... 0xfc:
         return le32_to_cpup((uint32_t*)(pcic->dev->config + addr));
@@ -83,7 +92,7 @@ static uint64_t sh_pci_reg_read (void *p, hwaddr addr,
     case 0x1c8:
         return pcic->iobr;
     case 0x220:
-        return pci_data_read(pcic->bus, pcic->par, 4);
+        return pci_data_read(phb->bus, pcic->par, 4);
     }
     return 0;
 }
@@ -112,19 +121,21 @@ static void sh_pci_set_irq(void *opaque, int irq_num, int level)
 
 static int sh_pci_device_init(SysBusDevice *dev)
 {
+    PCIHostState *phb;
     SHPCIState *s;
     int i;
 
-    s = FROM_SYSBUS(SHPCIState, dev);
+    s = SH_PCI_HOST_BRIDGE(dev);
+    phb = PCI_HOST_BRIDGE(s);
     for (i = 0; i < 4; i++) {
         sysbus_init_irq(dev, &s->irq[i]);
     }
-    s->bus = pci_register_bus(&s->busdev.qdev, "pci",
-                              sh_pci_set_irq, sh_pci_map_irq,
-                              s->irq,
-                              get_system_memory(),
-                              get_system_io(),
-                              PCI_DEVFN(0, 0), 4, TYPE_PCI_BUS);
+    phb->bus = pci_register_bus(DEVICE(dev), "pci",
+                                sh_pci_set_irq, sh_pci_map_irq,
+                                s->irq,
+                                get_system_memory(),
+                                get_system_io(),
+                                PCI_DEVFN(0, 0), 4, TYPE_PCI_BUS);
     memory_region_init_io(&s->memconfig_p4, OBJECT(s), &sh_pci_reg_ops, s,
                           "sh_pci", 0x224);
     memory_region_init_alias(&s->memconfig_a7, OBJECT(s), "sh_pci.2",
@@ -136,7 +147,7 @@ static int sh_pci_device_init(SysBusDevice *dev)
     s->iobr = 0xfe240000;
     memory_region_add_subregion(get_system_memory(), s->iobr, &s->isa);
 
-    s->dev = pci_create_simple(s->bus, PCI_DEVFN(0, 0), "sh_pci_host");
+    s->dev = pci_create_simple(phb->bus, PCI_DEVFN(0, 0), "sh_pci_host");
     return 0;
 }
 
@@ -172,8 +183,8 @@ static void sh_pci_device_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sh_pci_device_info = {
-    .name          = "sh_pci",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .name          = TYPE_SH_PCI_HOST_BRIDGE,
+    .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(SHPCIState),
     .class_init    = sh_pci_device_class_init,
 };
commit b332d24a8e1290954029814d09156b06ede358e2
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:28 2013 +0200

    mips: degrade BIOS error to warning
    
    No free MIPS BIOS is available, so it makes little sense to quit.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-19-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index 9e305d2..a7e9dcf 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -333,8 +333,7 @@ static void mips_fulong2e_init(QEMUMachineInitArgs *args)
         }
 
         if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {
-            fprintf(stderr, "qemu: Could not load MIPS bios '%s'\n", bios_name);
-            exit(1);
+            fprintf(stderr, "qemu: Warning, could not load MIPS bios '%s'\n", bios_name);
         }
     }
 
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 2c4acb9..d6e0860 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -177,9 +177,8 @@ static void mips_jazz_init(MemoryRegion *address_space,
         bios_size = -1;
     }
     if (bios_size < 0 || bios_size > MAGNUM_BIOS_SIZE) {
-        fprintf(stderr, "qemu: Could not load MIPS bios '%s'\n",
+        fprintf(stderr, "qemu: Warning, could not load MIPS bios '%s'\n",
                 bios_name);
-        exit(1);
     }
 
     /* Init CPU internal devices */
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index de87241..dad58c0 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -908,9 +908,8 @@ void mips_malta_init(QEMUMachineInitArgs *args)
             }
             if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {
                 fprintf(stderr,
-                        "qemu: Could not load MIPS bios '%s', and no -kernel argument was specified\n",
+                        "qemu: Warning, could not load MIPS bios '%s', and no -kernel argument was specified\n",
                         bios_name);
-                exit(1);
             }
         }
         /* In little endian mode the 32bit words in the bios are swapped,
diff --git a/hw/mips/mips_mipssim.c b/hw/mips/mips_mipssim.c
index e4a11c8..e8802c1 100644
--- a/hw/mips/mips_mipssim.c
+++ b/hw/mips/mips_mipssim.c
@@ -192,9 +192,8 @@ mips_mipssim_init(QEMUMachineInitArgs *args)
     if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {
         /* Bail out if we have neither a kernel image nor boot vector code. */
         fprintf(stderr,
-                "qemu: Could not load MIPS bios '%s', and no -kernel argument was specified\n",
+                "qemu: Warning, could not load MIPS bios '%s', and no -kernel argument was specified\n",
                 filename);
-        exit(1);
     } else {
         /* We have a boot vector start address. */
         env->active_tc.PC = (target_long)(int32_t)0xbfc00000;
commit 504054357b7e491e0bc354ee5c8061071e51fc61
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:27 2013 +0200

    pc-testdev: remove useless cpu_to_le64/le64_to_cpu
    
    So far the device was only used on little-endian machines.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-18-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index 6588ea2..ad1aa66 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -129,7 +129,6 @@ static uint64_t test_iomem_read(void *opaque, hwaddr addr, unsigned len)
     PCTestdev *dev = opaque;
     uint64_t ret = 0;
     memcpy(&ret, &dev->iomem_buf[addr], len);
-    ret = le64_to_cpu(ret);
 
     return ret;
 }
@@ -138,7 +137,6 @@ static void test_iomem_write(void *opaque, hwaddr addr, uint64_t val,
                              unsigned len)
 {
     PCTestdev *dev = opaque;
-    val = cpu_to_le64(val);
     memcpy(&dev->iomem_buf[addr], &val, len);
     dev->iomem_buf[addr] = val;
 }
commit b7faba71635cc4b16bb1472614aa497554797af6
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:26 2013 +0200

    pc-testdev: support 8 and 16-bit accesses to 0xe0
    
    This will let us use the testdev to test endianness.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-17-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index 699a16f..6588ea2 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -80,13 +80,20 @@ static void test_ioport_write(void *opaque, hwaddr addr, uint64_t data,
                               unsigned len)
 {
     PCTestdev *dev = opaque;
-    dev->ioport_data = data;
+    int bits = len * 8;
+    int start_bit = (addr & 3) * 8;
+    uint32_t mask = ((uint32_t)-1 >> (32 - bits)) << start_bit;
+    dev->ioport_data &= ~mask;
+    dev->ioport_data |= data << start_bit;
 }
 
 static uint64_t test_ioport_read(void *opaque, hwaddr addr, unsigned len)
 {
     PCTestdev *dev = opaque;
-    return dev->ioport_data;
+    int bits = len * 8;
+    int start_bit = (addr & 3) * 8;
+    uint32_t mask = ((uint32_t)-1 >> (32 - bits)) << start_bit;
+    return (dev->ioport_data & mask) >> start_bit;
 }
 
 static const MemoryRegionOps test_ioport_ops = {
commit f36a6382b8fb9677fd542b9c59b1ea1ad40ee9cf
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:25 2013 +0200

    Revert "ioport: remove LITTLE_ENDIAN mark for portio"
    
    This reverts commit c3cb8e77804313e1be99b5f28a34a346736707a5.
    
    The scenario where I/O ports are accessed with DEVICE_LITTLE_ENDIAN
    endianness now works and will soon be unit tested.  Since the PortioList
    indirection assumes little endian, define portio_ops the same way.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-16-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ioport.c b/ioport.c
index 89b17d6..79b7f1a 100644
--- a/ioport.c
+++ b/ioport.c
@@ -183,6 +183,7 @@ static void portio_write(void *opaque, hwaddr addr, uint64_t data,
 static const MemoryRegionOps portio_ops = {
     .read = portio_read,
     .write = portio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
     .valid.unaligned = true,
     .impl.unaligned = true,
 };
commit 61fcb628627ea464dc1954f615ae13edfefd284f
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:24 2013 +0200

    isa_mmio: delete
    
    It is not used anymore.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-15-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/default-configs/mips-softmmu.mak b/default-configs/mips-softmmu.mak
index b443702..6cdca11 100644
--- a/default-configs/mips-softmmu.mak
+++ b/default-configs/mips-softmmu.mak
@@ -3,7 +3,6 @@
 include pci.mak
 include sound.mak
 include usb.mak
-CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
 CONFIG_VGA_PCI=y
diff --git a/default-configs/mips64-softmmu.mak b/default-configs/mips64-softmmu.mak
index d638957..8997854 100644
--- a/default-configs/mips64-softmmu.mak
+++ b/default-configs/mips64-softmmu.mak
@@ -3,7 +3,6 @@
 include pci.mak
 include sound.mak
 include usb.mak
-CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
 CONFIG_VGA_PCI=y
diff --git a/default-configs/mips64el-softmmu.mak b/default-configs/mips64el-softmmu.mak
index c9be3f4..f18f3fc 100644
--- a/default-configs/mips64el-softmmu.mak
+++ b/default-configs/mips64el-softmmu.mak
@@ -3,7 +3,6 @@
 include pci.mak
 include sound.mak
 include usb.mak
-CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
 CONFIG_VGA_PCI=y
diff --git a/default-configs/mipsel-softmmu.mak b/default-configs/mipsel-softmmu.mak
index 4f4a449..6281f48 100644
--- a/default-configs/mipsel-softmmu.mak
+++ b/default-configs/mipsel-softmmu.mak
@@ -3,7 +3,6 @@
 include pci.mak
 include sound.mak
 include usb.mak
-CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
 CONFIG_VGA_PCI=y
diff --git a/default-configs/sh4-softmmu.mak b/default-configs/sh4-softmmu.mak
index f6bf62d..ef963ee 100644
--- a/default-configs/sh4-softmmu.mak
+++ b/default-configs/sh4-softmmu.mak
@@ -5,7 +5,6 @@ include usb.mak
 CONFIG_SERIAL=y
 CONFIG_PTIMER=y
 CONFIG_PFLASH_CFI02=y
-CONFIG_ISA_MMIO=y
 CONFIG_SH4=y
 CONFIG_IDE_MMIO=y
 CONFIG_SM501=y
diff --git a/default-configs/sh4eb-softmmu.mak b/default-configs/sh4eb-softmmu.mak
index c1d513d..e744486 100644
--- a/default-configs/sh4eb-softmmu.mak
+++ b/default-configs/sh4eb-softmmu.mak
@@ -5,7 +5,6 @@ include usb.mak
 CONFIG_SERIAL=y
 CONFIG_PTIMER=y
 CONFIG_PFLASH_CFI02=y
-CONFIG_ISA_MMIO=y
 CONFIG_SH4=y
 CONFIG_IDE_MMIO=y
 CONFIG_SM501=y
diff --git a/hw/isa/Makefile.objs b/hw/isa/Makefile.objs
index 193746a..9164556 100644
--- a/hw/isa/Makefile.objs
+++ b/hw/isa/Makefile.objs
@@ -1,7 +1,6 @@
 common-obj-y += isa-bus.o
 common-obj-$(CONFIG_APM) += apm.o
 common-obj-$(CONFIG_I82378) += i82378.o
-common-obj-$(CONFIG_ISA_MMIO) += isa_mmio.o
 common-obj-$(CONFIG_PC87312) += pc87312.o
 common-obj-$(CONFIG_PIIX4) += piix4.o
 common-obj-$(CONFIG_VT82C686) += vt82c686.o
diff --git a/hw/isa/isa_mmio.c b/hw/isa/isa_mmio.c
deleted file mode 100644
index 00ae8eb..0000000
--- a/hw/isa/isa_mmio.c
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Memory mapped access to ISA IO space.
- *
- * Copyright (c) 2006 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "hw/hw.h"
-#include "hw/isa/isa.h"
-#include "exec/address-spaces.h"
-
-static void isa_mmio_writeb (void *opaque, hwaddr addr,
-                                  uint32_t val)
-{
-    cpu_outb(addr & IOPORTS_MASK, val);
-}
-
-static void isa_mmio_writew(void *opaque, hwaddr addr,
-                               uint32_t val)
-{
-    cpu_outw(addr & IOPORTS_MASK, val);
-}
-
-static void isa_mmio_writel(void *opaque, hwaddr addr,
-                               uint32_t val)
-{
-    cpu_outl(addr & IOPORTS_MASK, val);
-}
-
-static uint32_t isa_mmio_readb (void *opaque, hwaddr addr)
-{
-    return cpu_inb(addr & IOPORTS_MASK);
-}
-
-static uint32_t isa_mmio_readw(void *opaque, hwaddr addr)
-{
-    return cpu_inw(addr & IOPORTS_MASK);
-}
-
-static uint32_t isa_mmio_readl(void *opaque, hwaddr addr)
-{
-    return cpu_inl(addr & IOPORTS_MASK);
-}
-
-static const MemoryRegionOps isa_mmio_ops = {
-    .old_mmio = {
-        .write = { isa_mmio_writeb, isa_mmio_writew, isa_mmio_writel },
-        .read = { isa_mmio_readb, isa_mmio_readw, isa_mmio_readl, },
-    },
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-void isa_mmio_setup(MemoryRegion *mr, hwaddr size)
-{
-    memory_region_init_io(mr, NULL, &isa_mmio_ops, NULL, "isa-mmio", size);
-}
-
-void isa_mmio_init(hwaddr base, hwaddr size)
-{
-    MemoryRegion *mr = g_malloc(sizeof(*mr));
-
-    isa_mmio_setup(mr, size);
-    memory_region_add_subregion(get_system_memory(), base, mr);
-}
diff --git a/include/hw/isa/isa.h b/include/hw/isa/isa.h
index e1bf96c..495bcf3 100644
--- a/include/hw/isa/isa.h
+++ b/include/hw/isa/isa.h
@@ -92,9 +92,6 @@ static inline ISABus *isa_bus_from_device(ISADevice *d)
 
 extern hwaddr isa_mem_base;
 
-void isa_mmio_setup(MemoryRegion *mr, hwaddr size);
-void isa_mmio_init(hwaddr base, hwaddr size);
-
 /* dma.c */
 int DMA_get_channel_mode (int nchan);
 int DMA_read_memory (int nchan, void *buf, int pos, int size);
commit 0a70e094cd05c35dddfe471fd96266d02ac0dade
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:23 2013 +0200

    ebus: do not use isa_mmio
    
    This is untested, because ebus does not have a libqos module.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-14-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 564c195..34a5e73 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -605,9 +605,11 @@ pci_ebus_init1(PCIDevice *pci_dev)
     pci_dev->config[0x09] = 0x00; // programming i/f
     pci_dev->config[0x0D] = 0x0a; // latency_timer
 
-    isa_mmio_setup(&s->bar0, 0x1000000);
+    memory_region_init_alias(&s->bar0, OBJECT(s), "bar0", get_system_io(),
+                             0, 0x1000000);
     pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar0);
-    isa_mmio_setup(&s->bar1, 0x800000);
+    memory_region_init_alias(&s->bar1, OBJECT(s), "bar1", get_system_io(),
+                             0, 0x800000);
     pci_register_bar(pci_dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar1);
     return 0;
 }
commit 5519ad0c245860526e8d269e1cd20fe239447736
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:22 2013 +0200

    sparc64: remove indirection for I/O port access
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-13-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index 06ace08..208ac85 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -302,56 +302,6 @@ static uint64_t apb_pci_config_read(void *opaque, hwaddr addr,
     return ret;
 }
 
-static void pci_apb_iowriteb (void *opaque, hwaddr addr,
-                                  uint32_t val)
-{
-    cpu_outb(addr & IOPORTS_MASK, val);
-}
-
-static void pci_apb_iowritew (void *opaque, hwaddr addr,
-                                  uint32_t val)
-{
-    cpu_outw(addr & IOPORTS_MASK, bswap16(val));
-}
-
-static void pci_apb_iowritel (void *opaque, hwaddr addr,
-                                uint32_t val)
-{
-    cpu_outl(addr & IOPORTS_MASK, bswap32(val));
-}
-
-static uint32_t pci_apb_ioreadb (void *opaque, hwaddr addr)
-{
-    uint32_t val;
-
-    val = cpu_inb(addr & IOPORTS_MASK);
-    return val;
-}
-
-static uint32_t pci_apb_ioreadw (void *opaque, hwaddr addr)
-{
-    uint32_t val;
-
-    val = bswap16(cpu_inw(addr & IOPORTS_MASK));
-    return val;
-}
-
-static uint32_t pci_apb_ioreadl (void *opaque, hwaddr addr)
-{
-    uint32_t val;
-
-    val = bswap32(cpu_inl(addr & IOPORTS_MASK));
-    return val;
-}
-
-static const MemoryRegionOps pci_ioport_ops = {
-    .old_mmio = {
-        .read = { pci_apb_ioreadb, pci_apb_ioreadw, pci_apb_ioreadl },
-        .write = { pci_apb_iowriteb, pci_apb_iowritew, pci_apb_iowritel, },
-    },
-    .endianness = DEVICE_NATIVE_ENDIAN,
-};
-
 /* The APB host has an IRQ line for each IRQ line of each slot.  */
 static int pci_apb_map_irq(PCIDevice *pci_dev, int irq_num)
 {
@@ -536,8 +486,8 @@ static int pci_pbm_init_device(SysBusDevice *dev)
     sysbus_init_mmio(dev, &s->pci_config);
 
     /* pci_ioport */
-    memory_region_init_io(&s->pci_ioport, OBJECT(s), &pci_ioport_ops, s,
-                          "apb-pci-ioport", 0x10000);
+    memory_region_init_alias(&s->pci_ioport, OBJECT(s), "apb-pci-ioport",
+                             get_system_io(), 0, 0x10000);
     /* at region 2 */
     sysbus_init_mmio(dev, &s->pci_ioport);
 
commit e37b80faa60c81e958d560c937e5f29b13977627
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:21 2013 +0200

    mips_fulong2e: do not use isa_mmio
    
    This board is little-endian, but still isa_mmio should die. :)
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-12-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 592d666..5086d42 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -210,14 +210,8 @@ typedef struct PCIBonitoState
     MemoryRegion iomem;
     MemoryRegion iomem_ldma;
     MemoryRegion iomem_cop;
-
-    hwaddr bonito_pciio_start;
-    hwaddr bonito_pciio_length;
-    int bonito_pciio_handle;
-
-    hwaddr bonito_localio_start;
-    hwaddr bonito_localio_length;
-    int bonito_localio_handle;
+    MemoryRegion bonito_pciio;
+    MemoryRegion bonito_localio;
 
 } PCIBonitoState;
 
@@ -750,15 +744,16 @@ static int bonito_initfn(PCIDevice *dev)
     sysbus_mmio_map(sysbus, 4, 0xbfe00300);
 
     /* Map PCI IO Space  0x1fd0 0000 - 0x1fd1 0000 */
-    s->bonito_pciio_start = BONITO_PCIIO_BASE;
-    s->bonito_pciio_length = BONITO_PCIIO_SIZE;
-    isa_mem_base = s->bonito_pciio_start;
-    isa_mmio_init(s->bonito_pciio_start, s->bonito_pciio_length);
+    memory_region_init_alias(&s->bonito_pciio, OBJECT(s), "isa_mmio",
+                             get_system_io(), 0, BONITO_PCIIO_SIZE);
+    sysbus_init_mmio(sysbus, &s->bonito_pciio);
+    sysbus_mmio_map(sysbus, 5, BONITO_PCIIO_BASE);
 
     /* add pci local io mapping */
-    s->bonito_localio_start = BONITO_DEV_BASE;
-    s->bonito_localio_length = BONITO_DEV_SIZE;
-    isa_mmio_init(s->bonito_localio_start, s->bonito_localio_length);
+    memory_region_init_alias(&s->bonito_localio, OBJECT(s), "isa_mmio",
+                             get_system_io(), 0, BONITO_DEV_SIZE);
+    sysbus_init_mmio(sysbus, &s->bonito_localio);
+    sysbus_mmio_map(sysbus, 6, BONITO_DEV_BASE);
 
     /* set the default value of north bridge pci config */
     pci_set_word(dev->config + PCI_COMMAND, 0x0000);
commit bdb75c79878c7a23a7891124d50483329dd8924d
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:20 2013 +0200

    mipssim: do not use isa_mmio
    
    Untested, this board does not support PCI so it cannot run endianness-test.
    It should fix endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-11-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/mips/mips_mipssim.c b/hw/mips/mips_mipssim.c
index a10cf13..e4a11c8 100644
--- a/hw/mips/mips_mipssim.c
+++ b/hw/mips/mips_mipssim.c
@@ -140,6 +140,7 @@ mips_mipssim_init(QEMUMachineInitArgs *args)
     const char *initrd_filename = args->initrd_filename;
     char *filename;
     MemoryRegion *address_space_mem = get_system_memory();
+    MemoryRegion *isa = g_new(MemoryRegion, 1);
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *bios = g_new(MemoryRegion, 1);
     MIPSCPU *cpu;
@@ -212,7 +213,9 @@ mips_mipssim_init(QEMUMachineInitArgs *args)
     cpu_mips_clock_init(env);
 
     /* Register 64 KB of ISA IO space at 0x1fd00000. */
-    isa_mmio_init(0x1fd00000, 0x00010000);
+    memory_region_init_alias(isa, NULL, "isa_mmio",
+                             get_system_io(), 0, 0x00010000);
+    memory_region_add_subregion(get_system_memory(), 0x1fd00000, isa);
 
     /* A single 16450 sits at offset 0x3f8. It is attached to
        MIPS CPU INT2, which is interrupt 4. */
commit 685015021774e98b87ed48ac2c55dfd3917fd820
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:19 2013 +0200

    ppc440_bamboo: do not use isa_mmio
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-10-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index 5b039ab..369ab9e 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -164,6 +164,7 @@ static void bamboo_init(QEMUMachineInitArgs *args)
     const char *initrd_filename = args->initrd_filename;
     unsigned int pci_irq_nrs[4] = { 28, 27, 26, 25 };
     MemoryRegion *address_space_mem = get_system_memory();
+    MemoryRegion *isa = g_new(MemoryRegion, 1);
     MemoryRegion *ram_memories
         = g_malloc(PPC440EP_SDRAM_NR_BANKS * sizeof(*ram_memories));
     hwaddr ram_bases[PPC440EP_SDRAM_NR_BANKS];
@@ -225,7 +226,9 @@ static void bamboo_init(QEMUMachineInitArgs *args)
         exit(1);
     }
 
-    isa_mmio_init(PPC440EP_PCI_IO, PPC440EP_PCI_IOLEN);
+    memory_region_init_alias(isa, NULL, "isa_mmio",
+                             get_system_io(), 0, PPC440EP_PCI_IOLEN);
+    memory_region_add_subregion(get_system_memory(), PPC440EP_PCI_IO, isa);
 
     if (serial_hds[0] != NULL) {
         serial_mm_init(address_space_mem, 0xef600300, 0, pic[0],
commit ee77854fa52b8cc7c9a0d318be467a5b5741bc04
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:18 2013 +0200

    mips_malta: do not use isa_mmio
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-9-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/mips/gt64xxx_pci.c b/hw/mips/gt64xxx_pci.c
index 5843417..3da2e67 100644
--- a/hw/mips/gt64xxx_pci.c
+++ b/hw/mips/gt64xxx_pci.c
@@ -304,7 +304,8 @@ static void gt64120_pci_mapping(GT64120State *s)
       s->PCI0IO_length = ((s->regs[GT_PCI0IOHD] + 1) - (s->regs[GT_PCI0IOLD] & 0x7f)) << 21;
       isa_mem_base = s->PCI0IO_start;
       if (s->PCI0IO_length) {
-          isa_mmio_setup(&s->PCI0IO_mem, s->PCI0IO_length);
+          memory_region_init_alias(&s->PCI0IO_mem, OBJECT(s), "isa_mmio",
+                                   get_system_io(), 0, s->PCI0IO_length);
           memory_region_add_subregion(get_system_memory(), s->PCI0IO_start,
                                       &s->PCI0IO_mem);
       }
commit 3959496874e7d1ee84e3428ddf1a10dfef972c1d
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:17 2013 +0200

    mips_r4k: do not use isa_mmio
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-8-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index 22beb0a..4bc2e3f 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -164,6 +164,7 @@ void mips_r4k_init(QEMUMachineInitArgs *args)
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *bios;
     MemoryRegion *iomem = g_new(MemoryRegion, 1);
+    MemoryRegion *isa = g_new(MemoryRegion, 1);
     int bios_size;
     MIPSCPU *cpu;
     CPUMIPSState *env;
@@ -273,7 +274,10 @@ void mips_r4k_init(QEMUMachineInitArgs *args)
     rtc_init(isa_bus, 2000, NULL);
 
     /* Register 64 KB of ISA IO space at 0x14000000 */
-    isa_mmio_init(0x14000000, 0x00010000);
+    memory_region_init_alias(isa, NULL, "isa_mmio",
+                             get_system_io(), 0, 0x00010000);
+    memory_region_add_subregion(get_system_memory(), 0x14000000, isa);
+
     isa_mem_base = 0x10000000;
 
     pit = pit_init(isa_bus, 0x40, 0, NULL);
commit f51100cc51f29b51aeafb5b56518a75e76e53024
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:16 2013 +0200

    mips_jazz: do not use isa_mmio
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-7-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 31e138b..2c4acb9 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -119,6 +119,7 @@ static void mips_jazz_init(MemoryRegion *address_space,
     qemu_irq *rc4030, *i8259;
     rc4030_dma *dmas;
     void* rc4030_opaque;
+    MemoryRegion *isa = g_new(MemoryRegion, 1);
     MemoryRegion *rtc = g_new(MemoryRegion, 1);
     MemoryRegion *i8042 = g_new(MemoryRegion, 1);
     MemoryRegion *dma_dummy = g_new(MemoryRegion, 1);
@@ -201,7 +202,9 @@ static void mips_jazz_init(MemoryRegion *address_space,
     pcspk_init(isa_bus, pit);
 
     /* ISA IO space at 0x90000000 */
-    isa_mmio_init(0x90000000, 0x01000000);
+    memory_region_init_alias(isa, NULL, "isa_mmio",
+                             get_system_io(), 0, 0x01000000);
+    memory_region_add_subregion(address_space, 0x90000000, isa);
     isa_mem_base = 0x11000000;
 
     /* Video card */
commit 921f8040d39a5f34d4b6bfd6e547c4cfcd3c1992
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:15 2013 +0200

    prep: fix I/O port endianness
    
    Do not swap endianness here, it will happen during cpu_{in,out}{b,w,l}.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-6-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 19f2442..7e04b1a 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -410,7 +410,7 @@ static const MemoryRegionOps PPC_prep_io_ops = {
         .read = { PPC_prep_io_readb, PPC_prep_io_readw, PPC_prep_io_readl },
         .write = { PPC_prep_io_writeb, PPC_prep_io_writew, PPC_prep_io_writel },
     },
-    .endianness = DEVICE_LITTLE_ENDIAN,
+    .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
 #define NVRAM_SIZE        0x2000
commit 66aab867cedd2a2d81b4d64eff7c3e0f6f272bbf
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Mon Jul 22 15:54:14 2013 +0200

    spapr_pci: remove indirection for I/O port access
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-5-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 318bc9d..c880a75 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -440,43 +440,6 @@ static void pci_spapr_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(spapr_phb_lsi_qirq(phb, irq_num), level);
 }
 
-static uint64_t spapr_io_read(void *opaque, hwaddr addr,
-                              unsigned size)
-{
-    switch (size) {
-    case 1:
-        return cpu_inb(addr);
-    case 2:
-        return cpu_inw(addr);
-    case 4:
-        return cpu_inl(addr);
-    }
-    g_assert_not_reached();
-}
-
-static void spapr_io_write(void *opaque, hwaddr addr,
-                           uint64_t data, unsigned size)
-{
-    switch (size) {
-    case 1:
-        cpu_outb(addr, data);
-        return;
-    case 2:
-        cpu_outw(addr, data);
-        return;
-    case 4:
-        cpu_outl(addr, data);
-        return;
-    }
-    g_assert_not_reached();
-}
-
-static const MemoryRegionOps spapr_io_ops = {
-    .endianness = DEVICE_LITTLE_ENDIAN,
-    .read = spapr_io_read,
-    .write = spapr_io_write
-};
-
 /*
  * MSI/MSIX memory region implementation.
  * The handler handles both MSI and MSIX.
@@ -605,8 +568,8 @@ static int spapr_phb_init(SysBusDevice *s)
     memory_region_add_subregion(get_system_io(), 0, &sphb->iospace);
 
     sprintf(namebuf, "%s.io-alias", sphb->dtbusname);
-    memory_region_init_io(&sphb->iowindow, OBJECT(sphb), &spapr_io_ops, sphb,
-                          namebuf, SPAPR_PCI_IO_WIN_SIZE);
+    memory_region_init_alias(&sphb->iowindow, OBJECT(sphb), namebuf,
+                             get_system_io(), 0, SPAPR_PCI_IO_WIN_SIZE);
     memory_region_add_subregion(get_system_memory(), sphb->io_win_addr,
                                 &sphb->iowindow);
 
commit 2b1096e02d32e4c3b5a51e767836d9511132a928
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:13 2013 +0200

    ppc_newworld: do not use isa_mmio
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-4-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index fe80348..7ef806e 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -152,6 +152,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     CPUPPCState *env = NULL;
     char *filename;
     qemu_irq *pic, **openpic_irqs;
+    MemoryRegion *isa = g_new(MemoryRegion, 1);
     MemoryRegion *unin_memory = g_new(MemoryRegion, 1);
     MemoryRegion *unin2_memory = g_new(MemoryRegion, 1);
     int linux_boot, i, j, k;
@@ -288,7 +289,9 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     }
 
     /* Register 8 MB of ISA IO space */
-    isa_mmio_init(0xf2000000, 0x00800000);
+    memory_region_init_alias(isa, NULL, "isa_mmio",
+                             get_system_io(), 0, 0x00800000);
+    memory_region_add_subregion(get_system_memory(), 0xf2000000, isa);
 
     /* UniN init: XXX should be a real device */
     memory_region_init_io(unin_memory, NULL, &unin_ops, token, "unin", 0x1000);
commit 7d52857ea5677c1b013a289e2e44db24961a59b0
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:12 2013 +0200

    ppc_oldworld: do not use isa_mmio
    
    This fixes endianness bugs in I/O port access.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-3-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 8b8c6b9..42bb9d5 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -87,6 +87,7 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
     int linux_boot, i;
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *bios = g_new(MemoryRegion, 1);
+    MemoryRegion *isa = g_new(MemoryRegion, 1);
     uint32_t kernel_base, initrd_base, cmdline_base = 0;
     int32_t kernel_size, initrd_size;
     PCIBus *pci_bus;
@@ -225,7 +226,9 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
     }
 
     /* Register 2 MB of ISA IO space */
-    isa_mmio_init(0xfe000000, 0x00200000);
+    memory_region_init_alias(isa, NULL, "isa_mmio",
+                             get_system_io(), 0, 0x00200000);
+    memory_region_add_subregion(sysmem, 0xfe000000, isa);
 
     /* XXX: we register only 1 output pin for heathrow PIC */
     heathrow_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
commit 4759ab6b2d1b99714bb12409a6021e7a9d0bd473
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 22 15:54:11 2013 +0200

    sh4: do not use isa_mmio
    
    This fixes endianness bugs in I/O port access (for sh4eb).
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374501278-31549-2-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/sh4/sh_pci.c b/hw/sh4/sh_pci.c
index c33a72f..53e9eb8 100644
--- a/hw/sh4/sh_pci.c
+++ b/hw/sh4/sh_pci.c
@@ -129,7 +129,8 @@ static int sh_pci_device_init(SysBusDevice *dev)
                           "sh_pci", 0x224);
     memory_region_init_alias(&s->memconfig_a7, OBJECT(s), "sh_pci.2",
                              &s->memconfig_p4, 0, 0x224);
-    isa_mmio_setup(&s->isa, 0x40000);
+    memory_region_init_alias(&s->isa, OBJECT(s), "sh_pci.isa",
+                             get_system_io(), 0, 0x40000);
     sysbus_init_mmio(dev, &s->memconfig_p4);
     sysbus_init_mmio(dev, &s->memconfig_a7);
     s->iobr = 0xfe240000;
commit 41b8280a1c089f621f94db4fad7a37c6080430b3
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Wed Jul 24 15:32:31 2013 +0200

    seabios: update to 1.7.3
    
    Changes summary (git shortlog rel-1.7.2.2..rel-1.7.3):
    
    Alex Williamson (4):
          seabios q35: Enable all PIRQn IRQs at startup
          seabios q35: Add new PCI slot to irq routing function
          seabios: Add a dummy PCI slot to irq mapping function
          pciinit: Enable default VGA device
    
    Asias He (2):
          virtio-scsi: Set _DRIVER_OK flag before scsi target scanning
          virtio-scsi: Pack struct virtio_scsi_{req_cmd,resp_cmd}
    
    Avik Sil (1):
          USB-EHCI: Fix null pointer assignment
    
    Christian Gmeiner (5):
          geodevga: fix errors in geode_fp_* functions
          geodevga: move framebuffer setup
          geodevga: move output setup to own function
          geodevga: add debug to msr functions
          geodevga: fix wrong define name
    
    David Woodhouse (26):
          Add macros for pushing and popping struct bregs
          Clean up #if in pirtable.c. CONFIG_PIRTABLE can't be set if CONFIG_COREBOOT is
          post: Export functions which will be used individually by CSM
          Export callrom() for CSM to use
          Export copy_smbios() from biostables.c
          Import LegacyBios.h from OVMF
          Complete and checksum EFI_COMPATIBILITY16_TABLE at build time
          Add pic_save_mask() and pic_restore_mask() functions
          Add CSM support
          Add README.CSM
          Add find_pmtimer() function
          Enable PMTIMER for CSM build
          Fix rom_reserve()/rom_confirm() for CSM oprom dispatch
          Don't calibrate TSC if PMTIMER is already set up
          Move find_pmtimer() to ACPI table setup where it logically belongs
          Use find_pmtimer() after copying Xen ACPI tables
          Use find_pmtimer() after copying coreboot ACPI tables
          Unify return path for CSM to go via csm_return()
          Make CONFIG_OPTIONROMS_DEPLOYED depend on CONFIG_QEMU
          Implement !CONFIG_OPTIONROMS support for CSM
          Implement !CONFIG_BOOT for CSM
          Enable VGA output when settings bochs-specific mode
          Disable CONFIG_THREAD_OPTIONROMS for CSM build
          Fix return type of le64_to_cpu() and be64_to_cpu()
          Rename find_pmtimer() to find_acpi_features()
          Add acpi_reboot() reset method using RESET_REG
    
    Gerd Hoffmann (3):
          config: allow DEBUG_IO for !QEMU
          coreboot: add qemu detection
          tweak coreboot qemu detection
    
    Hu Tao (1):
          Add pvpanic device driver
    
    Kevin O'Connor (99):
          pmm: Use 'struct segoff_s' in pmm header.
          Minor: Update README - variable changes are now reset on soft-reboots.
          Normalize POST initialization function name suffixes.
          POST: Reorganize post init functions for better grouping and reusability.
          Fix rebase error in commit 8a0a972f that broke LOWMEM variables.
          Support calling a function other than maininit() from reloc_preinit().
          Ensure exported symbols are visible in the final link
          POST: Move QEMU specific ramsize and BIOS table setup to paravirt.c.
          POST: Reorganize post entry and "preinit" functions.
          POST: Move cpu caching and dma setup to platform_hardware_setup().
          Undo incorrect assumptions about Xen in commit 6ca0460f.
          Determine century during init and store in VARLOW mem during runtime.
          No need to check both CONFIG_THREADS and CONFIG_THREAD_OPTIONROMS.
          Add runningOnQEMU() and runningOnXen() for runtime platform detection.
          Consistently use CONFIG_COREBOOT, CONFIG_QEMU, and runningOnXen().
          Convert kvm_para_available() to runningOnKVM().
          Minor - move definitions to paravirt.c from paravirt.h.
          Only perform SMP setup on QEMU.
          Start device_hardware_setup in mainint even with CONFIG_THREAD_OPTIONROMS.
          The mathcp setup touches the PIC and thus move to the "setup" phase.
          Update tools/acpi_extract.py to handle iasl 20130117 release.
          Support skipping content when reading from QEMU fw_cfg romfile entries.
          Convert fw_cfg ACPI entries into romfile entries.
          Convert fw_cfg SMBIOS entries into romfile entries.
          Convert basic integer fw_cfg entries into romfile entries.
          Convert fw_cfg NUMA entries into a romfile entry.
          Process fw_cfg e820 entries during the fw_cfg setup stage.
          Integrate qemu_cfg_preinit() into qemu_romfile_init().
          Group QEMU platform setup together and move to paravirt.c.
          vgabios: Bochs/QEMU vgabios support should depend on CONFIG_QEMU.
          Warn on unaligned PCI ROM structure in option roms.
          Fix Makefile - don't reference "out/" directly, instead use "$(OUT)".
          build: Don't require $(OUT) to be a sub-directory of the main directory.
          Rename rom_get_top() to rom_get_max().
          Report on f-segment UMB ram also.
          Clarify build generated "zone low" values.
          Verify CC is valid during build tests.
          Disable handle_post() on CSM builds.
          Remove unnecessary "export" declarations from assembler functions.
          Minor assembler enhancements to __csm_return.
          Introduce VARFSEG for variables that will reside in the f-segment.
          Convert VAR16VISIBLE, VAR16EXPORT, and VAR32VISIBLE to VARFSEG.
          Don't relocate "varlow" variable references at runtime.
          Move malloc's ZoneFSeg and ZoneLow setup to malloc_init.
          Calculate "RamSize" needed by 16bit interface dynamically.
          Eliminate separate BiosTableSpace[] space for f-segment allocations.
          Use CONFIG_ prefix for Kconfig variables; use BUILD_ for others.
          Try to detect an unsuccessful hard-reboot to prevent soft-reboot loops.
          Minor - fix confusing final_sec32low_start name in layoutrom.py.
          Minor - introduce numeric defines for the IVT offset of hw irqs.
          Separate out 16bit PCI-BIOS entry point from regular int 0x1a entry point.
          Support using the "extra stack" for all 16bit irq entry points.
          Minor - improve comments and grouping of handle_08().
          floppy: Introduce 'struct floppy_pio_s' for floppy PIO ops.
          floppy: Cleanup floppy irq wait handling.
          floppy: Clean up Check Interrupt Status code.
          floppy: Move recalibration and results parsing to floppy_cmd().
          floppy: Improve floppy_pio() error checking.
          floppy: Implement media format sensing.
          floppy: Actually do controller reset in floppy_reset().
          Minor - note that passing QEMU config via cmos is deprecated.
          Cache boot-fail-wait to avoid romfile access after POST.
          Rename src/ssdt-susp.dsl to src/ssdt-misc.dsl.
          acpi: Eliminate BDAT parameter passing to DSDT code.
          Add additional dependency checks to Makefile.
          Don't use __FILE__ in virtio-ring.c.
          shadow: Don't use PCIDevices list in make_bios_readonly().
          smm: Don't use PCIDevices list in smm_setup().
          Add VARVERIFY32INIT attribute for variables only available during "init".
          Use VARVERIFY32INIT on global variables that point to "tmp" memory.
          vgabios: Fix stdvga_perform_gray_scale_summing().
          vgabios: Fix cirrus memory clear on mode switch.
          Minor - add missing newline to floppy debug statement.
          Fix bug in NUMA node setup - don't create SRAT if NUMA not present.
          Update README - copy *.aml files for QEMU.
          Add dependencies to vgafixup.py and buildversion.sh scripts.
          Set ZF prior to keyboard read call in check_for_keystroke().
          mptable: Don't describe pci-to-pci bridges.
          mptable: Use same PCI irqs as ACPI code.
          Cleanup QEMU_CFG_NUMA fw_cfg processing - split into two romfile entries.
          Use container_of on romfile entries.
          acpi: Move ACPI table definitions from acpi.c to acpi.h.
          acpi: Remove dead code with descriptions of bit flags.
          acpi: Use cpu_to_leXX() consistently.
          Minor - explicitly close files in buildrom.py.
          Minor - move "tracked memory alloc" code in pmm.c.
          Introduce and convert pmm code to use standard list helpers.
          Minor - relocate code in stacks.c to keep low-level thread code together.
          Introduce helper function have_threads() in stacks.c.
          Convert stacks.c to use standard list manipulation code.
          Convert boot.c to use standard list manipulation code.
          Convert pciinit.c to use standard list manipulation code.
          Convert PCIDevices list to use standard list manipultion code.
          Revert "Convert pciinit.c to use standard list manipulation code."
          Fix error in hlist_for_each_entry_safe macro.
          Convert pciinit.c to use standard list manipulation code.
          make qemu_cfg_init depend on QEMU_HARDWARE instead of QEMU
          Another fix for hlist_for_each_entry_safe.
          Minor - remove debugging dprintf added to pciinit.c.
    
    Laszlo Ersek (1):
          Enable VGA output when setting Cirrus-specific mode
    
    Michael S. Tsirkin (1):
          acpi: make default DSDT optional
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/pc-bios/acpi-dsdt.aml b/pc-bios/acpi-dsdt.aml
index 75dfd1e..48dbe32 100644
Binary files a/pc-bios/acpi-dsdt.aml and b/pc-bios/acpi-dsdt.aml differ
diff --git a/pc-bios/bios.bin b/pc-bios/bios.bin
index c2a19b8..cccc487 100644
Binary files a/pc-bios/bios.bin and b/pc-bios/bios.bin differ
diff --git a/pc-bios/q35-acpi-dsdt.aml b/pc-bios/q35-acpi-dsdt.aml
index cf7b085..91ab67c 100644
Binary files a/pc-bios/q35-acpi-dsdt.aml and b/pc-bios/q35-acpi-dsdt.aml differ
diff --git a/roms/seabios b/roms/seabios
index d4f7d90..c02c219 160000
--- a/roms/seabios
+++ b/roms/seabios
@@ -1 +1 @@
-Subproject commit d4f7d90f47462b4e8836899adc5060fbde5253e9
+Subproject commit c02c219cd79299a0a153ecf862f0e301a057f2cb
commit 0cd8eaa011eac66e45ce51cab4a857b175152625
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Jul 5 22:55:44 2013 +0200

    po/Makefile: Use macro quiet-command for nice looking messages
    
    Suppress also the "... done" message from msgmerge.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/po/Makefile b/po/Makefile
index a6ab482..705166e 100644
--- a/po/Makefile
+++ b/po/Makefile
@@ -5,6 +5,7 @@
 SRC_PATH=..
 
 -include ../config-host.mak
+include $(SRC_PATH)/rules.mak
 
 PO_PATH=$(SRC_PATH)/po
 
@@ -33,16 +34,16 @@ install: $(OBJS)
 	done
 
 %.mo: %.po
-	@msgfmt -o $@ $<
+	$(call quiet-command, msgfmt -o $@ $<, "  GEN   $@")
 
 $(PO_PATH)/messages.po: $(SRC_PATH)/ui/gtk.c
-	@cd $(SRC_PATH) && \
+	$(call quiet-command, cd $(SRC_PATH) && \
 	 (xgettext -o - --from-code=UTF-8 --foreign-user \
 	    --package-name=QEMU --package-version=$(VERSION) \
 	    --msgid-bugs-address=qemu-devel at nongnu.org -k_ -C ui/gtk.c | \
-	  sed -e s/CHARSET/UTF-8/) >$@
+	  sed -e s/CHARSET/UTF-8/) >$@, "  GEN   $@")
 
 $(PO_PATH)/%.po: $(PO_PATH)/messages.po
-	@msgmerge $@ $< > $@.bak && mv $@.bak $@
+	$(call quiet-command, msgmerge -q $@ $< > $@.bak && mv $@.bak $@, "  GEN   $@")
 
 .PHONY: clean all
commit 1fa449231832d0fb7f20a3d7ecd06190ce906529
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Jul 5 22:55:43 2013 +0200

    po/Makefile: Fix generation of messages.po
    
    * Tell xgettext that we use UTF-8 encoding (this is currently optional).
    
    * Set charset=UTF-8 in messages.po. This avoids warnings from msgmerge:
      warning: Charset "CHARSET" is not a portable encoding name.
    
    * Use filename relative to root directory (ui/gtk.c instead of ../ui/gtk.c
      or $(SRC_PATH)/ui/gtk.c) for comments in *.po files.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/po/Makefile b/po/Makefile
index 0e345b0..a6ab482 100644
--- a/po/Makefile
+++ b/po/Makefile
@@ -36,7 +36,11 @@ install: $(OBJS)
 	@msgfmt -o $@ $<
 
 $(PO_PATH)/messages.po: $(SRC_PATH)/ui/gtk.c
-	@xgettext -o $@ --foreign-user --package-name=QEMU --package-version=$(VERSION) --msgid-bugs-address=qemu-devel at nongnu.org -k_ -C $<
+	@cd $(SRC_PATH) && \
+	 (xgettext -o - --from-code=UTF-8 --foreign-user \
+	    --package-name=QEMU --package-version=$(VERSION) \
+	    --msgid-bugs-address=qemu-devel at nongnu.org -k_ -C ui/gtk.c | \
+	  sed -e s/CHARSET/UTF-8/) >$@
 
 $(PO_PATH)/%.po: $(PO_PATH)/messages.po
 	@msgmerge $@ $< > $@.bak && mv $@.bak $@
commit 00134a62039a12822cda91310131cc050f78cf9b
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Jul 5 22:55:42 2013 +0200

    po/Makefile: Fix *.mo generation for out-of-tree builds (regression)
    
    Commit f84756554e32d97db3aa949db1dd58c7eea62375 added a wildcard search
    for *.po files. This search found no files for out of tree builds, so
    those builds no longer created and installed *.mo files.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/po/Makefile b/po/Makefile
index 2c5b202..0e345b0 100644
--- a/po/Makefile
+++ b/po/Makefile
@@ -1,15 +1,18 @@
 # This makefile is very special as it's meant to build as part of the build
 # process and also within the source tree to update the translation files.
 
-VERSION=$(shell cat ../VERSION)
-SRCS=$(filter-out messages.po,$(wildcard *.po))
-OBJS=$(patsubst %.po,%.mo,$(SRCS))
-
+# Set SRC_PATH for in-tree builds without configuration.
 SRC_PATH=..
 
 -include ../config-host.mak
 
-vpath %.po $(SRC_PATH)/po
+PO_PATH=$(SRC_PATH)/po
+
+VERSION=$(shell cat $(SRC_PATH)/VERSION)
+SRCS=$(filter-out $(PO_PATH)/messages.po,$(wildcard $(PO_PATH)/*.po))
+OBJS=$(patsubst $(PO_PATH)/%.po,%.mo,$(SRCS))
+
+vpath %.po $(PO_PATH)
 
 all:
 	@echo "Use 'make update' to update translation files or use 'make build'"
@@ -30,12 +33,12 @@ install: $(OBJS)
 	done
 
 %.mo: %.po
-	@msgfmt -o $@ $(SRC_PATH)/po/`basename $@ .mo`.po
+	@msgfmt -o $@ $<
 
-messages.po: $(SRC_PATH)/ui/gtk.c
+$(PO_PATH)/messages.po: $(SRC_PATH)/ui/gtk.c
 	@xgettext -o $@ --foreign-user --package-name=QEMU --package-version=$(VERSION) --msgid-bugs-address=qemu-devel at nongnu.org -k_ -C $<
 
-%.po: messages.po
+$(PO_PATH)/%.po: $(PO_PATH)/messages.po
 	@msgmerge $@ $< > $@.bak && mv $@.bak $@
 
 .PHONY: clean all
commit 18e12d49edd4417a93f875e122652bd22aabad79
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Jul 5 22:55:41 2013 +0200

    po/Makefile: Fix and improve help message
    
    The help message contains single quotes which got lost in the output.
    Fix also a typo and use two instead of three lines.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/po/Makefile b/po/Makefile
index 60ccd7d..2c5b202 100644
--- a/po/Makefile
+++ b/po/Makefile
@@ -12,9 +12,8 @@ SRC_PATH=..
 vpath %.po $(SRC_PATH)/po
 
 all:
-	@echo Use 'make update' to update translation files
-	@echo or us 'make build' or 'make install' to build and install
-	@echo the translation files
+	@echo "Use 'make update' to update translation files or use 'make build'"
+	@echo "or 'make install' to build and install the translation files."
 
 update: $(SRCS)
 
commit f03d07d4683b2e8325a7cb60b4e14b977b1a869c
Merge: 3988982 9781c37
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Jul 23 10:57:23 2013 -0500

    Merge remote-tracking branch 'quintela/migration.next' into staging
    
    # By Michael R. Hines (8) and others
    # Via Juan Quintela
    * quintela/migration.next:
      migration: add autoconvergence documentation
      Fix real mode guest segments dpl value in savevm
      Fix real mode guest migration
      rdma: account for the time spent in MIG_STATE_SETUP through QMP
      rdma: introduce MIG_STATE_NONE and change MIG_STATE_SETUP state transition
      rdma: allow state transitions between other states besides ACTIVE
      rdma: send pc.ram
      rdma: core logic
      rdma: introduce ram_handle_compressed()
      rdma: bugfix: ram_control_save_page()
      rdma: update documentation to reflect new unpin support
    
    Message-id: 1374590725-14144-1-git-send-email-quintela at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 3988982c82ad4173dea376fea30e5432d36146db
Merge: 931f0ad 6f152e9
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Jul 23 10:57:04 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into staging
    
    QOM CPUState refactorings
    
    * Fix NULL pointer dereference in gdbstub
    * Introduce vaddr type
    * Introduce CPUClass::set_pc()
    * Introduce CPUClass::synchronize_from_tb()
    * Introduce CPUClass::get_phys_page_debug()
    * Introduce CPUClass::memory_rw_debug()
    * Move singlestep_enabled and gdb_regs fields out of CPU_COMMON
    * Adopt CPUState in more APIs
    * Propagate CPUState in gdbstub
    
    # gpg: Signature made Mon 22 Jul 2013 07:50:17 PM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Andreas Färber (21) and others
    # Via Andreas Färber
    * afaerber/tags/qom-cpu-for-anthony: (24 commits)
      linux-user: Use X86CPU property to retrieve CPUID family
      gdbstub: Change gdb_register_coprocessor() argument to CPUState
      cpu: Move gdb_regs field from CPU_COMMON to CPUState
      gdbstub: Change GDBState::{c,g}_cpu and find_cpu() to CPUState
      cpu: Introduce CPUClass::memory_rw_debug() for target_memory_rw_debug()
      exec: Change cpu_memory_rw_debug() argument to CPUState
      cpu: Turn cpu_get_phys_page_debug() into a CPUClass hook
      gdbstub: Change gdb_{read,write}_register() argument to CPUState
      gdbstub: Change gdb_handlesig() argument to CPUState
      gdbstub: Change syscall callback argument to CPUState
      kvm: Change kvm_{insert,remove}_breakpoint() argument to CPUState
      cpu: Change cpu_single_step() argument to CPUState
      gdbstub: Update gdb_handlesig() and gdb_signalled() Coding Style
      cpu: Move singlestep_enabled field from CPU_COMMON to CPUState
      target-alpha: Copy implver to DisasContext
      target-alpha: Copy singlestep_enabled to DisasContext
      cpu: Introduce CPUClass::synchronize_from_tb() for cpu_pc_from_tb()
      target-unicore32: Implement CPUClass::set_pc()
      target-moxie: Implement CPUClass::set_pc()
      target-m68k: Implement CPUClass::set_pc()
      ...

commit 931f0adf64261bf7eb3efaafb4430c04a6a3e6f6
Merge: 3464700 52785d9
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Jul 23 10:56:55 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-devices-for-anthony' into staging
    
    QOM device refactorings
    
    * Avoid TYPE_* in VMStateDescription name
    * Replace some DO_UPCAST()s and FROM_SYSBUS()s with QOM casts
    * Limit legacy SCSI command line handling to non-hotplugged devices
    * Replace some SysBusDeviceClass::init with DeviceClass::realize
    
    # gpg: Signature made Mon 22 Jul 2013 06:31:42 PM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Hu Tao (26) and others
    # Via Andreas Färber
    * afaerber/tags/qom-devices-for-anthony: (55 commits)
      isa-bus: Drop isabus_bridge_init() since it does nothing
      ioapic: Use QOM realize for ioapic
      kvmvapic: Use QOM realize
      kvm/clock: Use QOM realize for kvmclock
      hpet: Use QOM realize for hpet
      scsi: Improve error propagation for scsi_bus_legacy_handle_cmdline()
      megasas: Legacy command line handling fix
      scsi/esp: Use QOM realize for scsi esp
      fw_cfg: Use QOM realize for fw_cfg
      ahci: Use QOM realize for ahci
      pflash_cfi02: Use QOM realize for pflash_cfi02
      pflash_cfi01: Use QOM realize for pflash_cfi01
      fdc: Improve error propagation for QOM realize
      fdc: Use QOM realize for fdc
      kvm/clock: QOM'ify some more
      hpet: QOM'ify some more
      scsi/esp: QOM'ify some more
      fwcfg: QOM'ify some more
      ahci: QOM'ify some more
      pflash-cfi02: QOM'ify some more
      ...

commit a033381758841837edaf307e20edf019c5900609
Author: Kwok Cheung Yeung <kcy at codesourcery.com>
Date:   Fri Jul 19 09:21:44 2013 -0700

    linux-user: Handle compressed ISA encodings when processing MIPS exceptions
    
    Decode trap instructions during the handling of an EXCP_BREAK or EXCP_TRAP
    according to the current ISA mode.
    
    Signed-off-by: Kwok Cheung Yeung <kcy at codesourcery.com>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/main.c b/linux-user/main.c
index 547884c..441e31d 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -2310,7 +2310,31 @@ done_syscall:
                 abi_ulong trap_instr;
                 unsigned int code;
 
-                ret = get_user_ual(trap_instr, env->active_tc.PC);
+                if (env->hflags & MIPS_HFLAG_M16) {
+                    if (env->insn_flags & ASE_MICROMIPS) {
+                        /* microMIPS mode */
+                        abi_ulong instr[2];
+
+                        ret = get_user_u16(instr[0], env->active_tc.PC) ||
+                              get_user_u16(instr[1], env->active_tc.PC + 2);
+
+                        trap_instr = (instr[0] << 16) | instr[1];
+                    } else {
+                        /* MIPS16e mode */
+                        ret = get_user_u16(trap_instr, env->active_tc.PC);
+                        if (ret != 0) {
+                            goto error;
+                        }
+                        code = (trap_instr >> 6) & 0x3f;
+                        if (do_break(env, &info, code) != 0) {
+                            goto error;
+                        }
+                        break;
+                    }
+                } else {
+                    ret = get_user_ual(trap_instr, env->active_tc.PC);
+                }
+
                 if (ret != 0) {
                     goto error;
                 }
@@ -2334,14 +2358,30 @@ done_syscall:
                 abi_ulong trap_instr;
                 unsigned int code = 0;
 
-                ret = get_user_ual(trap_instr, env->active_tc.PC);
+                if (env->hflags & MIPS_HFLAG_M16) {
+                    /* microMIPS mode */
+                    abi_ulong instr[2];
+
+                    ret = get_user_u16(instr[0], env->active_tc.PC) ||
+                          get_user_u16(instr[1], env->active_tc.PC + 2);
+
+                    trap_instr = (instr[0] << 16) | instr[1];
+                } else {
+                    ret = get_user_ual(trap_instr, env->active_tc.PC);
+                }
+
                 if (ret != 0) {
                     goto error;
                 }
 
                 /* The immediate versions don't provide a code.  */
                 if (!(trap_instr & 0xFC000000)) {
-                    code = ((trap_instr >> 6) & ((1 << 10) - 1));
+                    if (env->hflags & MIPS_HFLAG_M16) {
+                        /* microMIPS mode */
+                        code = ((trap_instr >> 12) & ((1 << 4) - 1));
+                    } else {
+                        code = ((trap_instr >> 6) & ((1 << 10) - 1));
+                    }
                 }
 
                 if (do_break(env, &info, code) != 0) {
commit d02532f08e207419e412ea7cd4eb8b36f04f426d
Author: Alexander Graf <agraf at suse.de>
Date:   Sat Jul 6 14:17:57 2013 +0200

    linux-user: Unlock mmap_lock when resuming guest from page_unprotect
    
    The page_unprotect() function is running everything locked. Before every
    potential exit path of the function mmap_unlock() gets called to make sure
    we don't leak the lock.
    
    However, the function calls tb_invalidate_phys_page() which again can
    exit a signal through longjmp, leaving our mmap_unlock() attempts in vain.
    
    Add a hint to tb_invalidate_phys_page() that we need to unlock before we
    can leave back into guest context, so that we don't leak the lock.
    
    This fixes 16-bit i386 wine programs running in linux-user for me.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/translate-all.c b/translate-all.c
index e8683d2..3b5fc7c 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -1148,7 +1148,8 @@ void tb_invalidate_phys_page_fast(tb_page_addr_t start, int len)
 
 #if !defined(CONFIG_SOFTMMU)
 static void tb_invalidate_phys_page(tb_page_addr_t addr,
-                                    uintptr_t pc, void *puc)
+                                    uintptr_t pc, void *puc,
+                                    bool locked)
 {
     TranslationBlock *tb;
     PageDesc *p;
@@ -1206,6 +1207,9 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr,
            itself */
         cpu->current_tb = NULL;
         tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
+        if (locked) {
+            mmap_unlock();
+        }
         cpu_resume_from_signal(env, puc);
     }
 #endif
@@ -1723,7 +1727,7 @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
         if (!(p->flags & PAGE_WRITE) &&
             (flags & PAGE_WRITE) &&
             p->first_tb) {
-            tb_invalidate_phys_page(addr, 0, NULL);
+            tb_invalidate_phys_page(addr, 0, NULL, false);
         }
         p->flags = flags;
     }
@@ -1818,7 +1822,7 @@ int page_unprotect(target_ulong address, uintptr_t pc, void *puc)
 
             /* and since the content will be modified, we must invalidate
                the corresponding translated code. */
-            tb_invalidate_phys_page(addr, pc, puc);
+            tb_invalidate_phys_page(addr, pc, puc, true);
 #ifdef DEBUG_TB_CHECK
             tb_invalidate_check(addr);
 #endif
commit b24c882b9435d0745679a96571027a2c92065e4f
Author: Alexander Graf <agraf at suse.de>
Date:   Sat Jul 6 14:17:51 2013 +0200

    linux-user: Reset copied CPUs in cpu_copy() always
    
    When a new thread gets created, we need to reset non arch specific state to
    get the new CPU into clean state.
    
    However this reset should happen before the arch specific CPU contents get
    copied over. Otherwise we end up having clean reset state in our newly created
    thread.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/exec.c b/exec.c
index c8658c6..2426bf7 100644
--- a/exec.c
+++ b/exec.c
@@ -642,6 +642,10 @@ CPUArchState *cpu_copy(CPUArchState *env)
     CPUWatchpoint *wp;
 #endif
 
+    /* Reset non arch specific state */
+    cpu_reset(ENV_GET_CPU(new_env));
+
+    /* Copy arch specific state into the new CPU */
     memcpy(new_env, env, sizeof(CPUArchState));
 
     /* Clone all break/watchpoints.
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index a797afc..3f6db4b 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4293,9 +4293,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
         init_task_state(ts);
         /* we create a new CPU instance. */
         new_env = cpu_copy(env);
-#if defined(TARGET_I386) || defined(TARGET_SPARC) || defined(TARGET_PPC)
-        cpu_reset(ENV_GET_CPU(new_env));
-#endif
         /* Init regs that differ from the parent.  */
         cpu_clone_regs(new_env, newsp);
         new_env->opaque = ts;
commit ddaa7e5a2ad0ef20fd3d1cc44a9ade75e5eabcfc
Author: Alexander Graf <agraf at suse.de>
Date:   Sat Jul 6 14:17:53 2013 +0200

    linux-user: Fix epoll on ARM hosts
    
    The epoll emulation uses data structures without packing them, so the
    compiler might choose to add padding inside.
    
    This patch makes the most offending one (target_epoll_event) a packed
    structure to make sure we don't pad it by accident. ARM would pad it,
    so declare the padding mandatory for ARM targets.
    
    This fixes i386-on-ARM epoll emulation for me.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index cb6341f..086fbff 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -2459,8 +2459,11 @@ typedef union target_epoll_data {
 
 struct target_epoll_event {
     uint32_t events;
+#ifdef TARGET_ARM
+    uint32_t __pad;
+#endif
     target_epoll_data_t data;
-};
+} QEMU_PACKED;
 #endif
 struct target_rlimit64 {
     uint64_t rlim_cur;
commit 732f9e89a1c737f738c445ff24929a1bc137d1a9
Author: Alexander Graf <agraf at suse.de>
Date:   Sat Jul 6 14:17:49 2013 +0200

    linux-user: fix segmentation fault passing with h2g(x) != x
    
    When forwarding a segmentation fault into the guest process, we were passing
    the host's address directly into the guest process's signal descriptor.
    
    That obviously confused the guest process, since it didn't know what to make
    of the (usually 32-bit truncated) address. Passing in h2g(address) makes the
    guest process a lot happier.
    
    To make the code more obvious, introduce a h2g_nocheck() macro that does the
    same as h2g(), but allows us to convert addresses that may be outside of guest
    mapped range into the guest's view of address space.
    
    This fixes java running in arm-linux-user for me.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 5084202..f1cde97 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -209,11 +209,15 @@ extern unsigned long reserved_va;
 })
 #endif
 
-#define h2g(x) ({ \
+#define h2g_nocheck(x) ({ \
     unsigned long __ret = (unsigned long)(x) - GUEST_BASE; \
+    (abi_ulong)__ret; \
+})
+
+#define h2g(x) ({ \
     /* Check if given address fits target address space */ \
     assert(h2g_valid(x)); \
-    (abi_ulong)__ret; \
+    h2g_nocheck(x); \
 })
 
 #define saddr(x) g2h(x)
diff --git a/user-exec.c b/user-exec.c
index d45ca8e..82bfa66 100644
--- a/user-exec.c
+++ b/user-exec.c
@@ -95,6 +95,10 @@ static inline int handle_cpu_signal(uintptr_t pc, unsigned long address,
         return 1;
     }
 
+    /* Convert forcefully to guest address space, invalid addresses
+       are still valid segv ones */
+    address = h2g_nocheck(address);
+
     env = current_cpu->env_ptr;
     /* see if it is an MMU fault */
     ret = cpu_handle_mmu_fault(env, address, is_write, MMU_USER_IDX);
commit 82f05b69e6b701157b4a2e7d76ae6cf5542d66c9
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Sat Jul 6 17:39:48 2013 +0100

    linux-user: Fix pipe syscall return for SPARC
    
    SPARC is one of the CPUs which has a funny syscall ABI for the
    pipe syscall; add it to the set of special cases in do_pipe().
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 5bd57d0..a797afc 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -1032,6 +1032,9 @@ static abi_long do_pipe(void *cpu_env, abi_ulong pipedes,
 #elif defined(TARGET_SH4)
         ((CPUSH4State*)cpu_env)->gregs[1] = host_pipe[1];
         return host_pipe[0];
+#elif defined(TARGET_SPARC)
+        ((CPUSPARCState*)cpu_env)->regwptr[1] = host_pipe[1];
+        return host_pipe[0];
 #endif
     }
 
commit c7819dfbd22be6a3711f11056f33300e881563d5
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Sat Jul 6 21:44:53 2013 +0100

    linux-user: Fix target_stat and target_stat64 for OpenRISC
    
    OpenRISC uses the asm-generic versions of target_stat and
    target_stat64, but it was incorrectly using the x86/ARM/etc version
    due to a misplaced defined(TARGET_OPENRISC).  The previously unused
    OpenRISC section of the ifdef ladder also defined an incorrect
    target_stat and omitted the target_stat64 definition.  Fix
    target_stat, provide target_stat64, and add a comment noting that
    these are the asm-generic versions for the benefit of future ports.
    
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 92c01a9..cb6341f 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1138,8 +1138,7 @@ struct target_winsize {
 #endif
 
 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || defined(TARGET_ARM) \
-    || defined(TARGET_CRIS) || defined(TARGET_UNICORE32) \
-    || defined(TARGET_OPENRISC)
+    || defined(TARGET_CRIS) || defined(TARGET_UNICORE32)
 struct target_stat {
 	unsigned short st_dev;
 	unsigned short __pad1;
@@ -1837,29 +1836,55 @@ struct target_stat {
     abi_ulong  __unused[3];
 };
 #elif defined(TARGET_OPENRISC)
+
+/* These are the asm-generic versions of the stat and stat64 structures */
+
 struct target_stat {
     abi_ulong st_dev;
     abi_ulong st_ino;
-    abi_ulong st_nlink;
-
     unsigned int st_mode;
+    unsigned int st_nlink;
     unsigned int st_uid;
     unsigned int st_gid;
-    unsigned int __pad0;
     abi_ulong st_rdev;
+    abi_ulong __pad1;
     abi_long st_size;
-    abi_long st_blksize;
-    abi_long st_blocks;    /* Number 512-byte blocks allocated. */
-
-    abi_ulong target_st_atime;
+    int st_blksize;
+    int __pad2;
+    abi_long st_blocks;
+    abi_long target_st_atime;
     abi_ulong target_st_atime_nsec;
-    abi_ulong target_st_mtime;
+    abi_long target_st_mtime;
     abi_ulong target_st_mtime_nsec;
-    abi_ulong target_st_ctime;
+    abi_long target_st_ctime;
     abi_ulong target_st_ctime_nsec;
+    unsigned int __unused4;
+    unsigned int __unused5;
+};
 
-    abi_long __unused[3];
+struct target_stat64 {
+    uint64_t st_dev;
+    uint64_t st_ino;
+    unsigned int st_mode;
+    unsigned int st_nlink;
+    unsigned int st_uid;
+    unsigned int st_gid;
+    uint64_t st_rdev;
+    uint64_t __pad1;
+    int64_t st_size;
+    int st_blksize;
+    int __pad2;
+    int64_t st_blocks;
+    int target_st_atime;
+    unsigned int target_st_atime_nsec;
+    int target_st_mtime;
+    unsigned int target_st_mtime_nsec;
+    int target_st_ctime;
+    unsigned int target_st_ctime_nsec;
+    unsigned int __unused4;
+    unsigned int __unused5;
 };
+
 #else
 #error unsupported CPU
 #endif
commit 9781c3716a4b529a2af64502926a57c11e69e6ca
Author: Juan Quintela <quintela at redhat.com>
Date:   Tue Jul 23 15:21:09 2013 +0200

    migration: add autoconvergence documentation
    
    This hunk got lost during merge.  It is documentation.
    
    Spotted-by: Peter Lieven <lieven-lists at dlhnet.de>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index 465b480..f82d829 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -626,6 +626,9 @@
 #          to enable the capability on the source VM. The feature is disabled by
 #          default. (since 1.6)
 #
+# @auto-converge: If enabled, QEMU will automatically throttle down the guest
+#          to speed up convergence of RAM migration. (since 1.6)
+#
 # Since: 1.2
 ##
 { 'enum': 'MigrationCapability',
commit 3e47c249b93d5cc1e0f9404dbe243682598ba8fb
Author: Orit Wasserman <owasserm at redhat.com>
Date:   Mon Jul 22 20:29:42 2013 +0300

    Fix real mode guest segments dpl value in savevm
    
    Older KVM version put invalid value in the segments registers dpl field for
    real mode guests (0x3).
    This breaks migration from those hosts to hosts with unrestricted guest support.
    We detect it by checking CS dpl value for real mode guest and fix the dpl values
    of all the segment registers.
    
    Signed-off-by: Orit Wasserman <owasserm at redhat.com>
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/target-i386/machine.c b/target-i386/machine.c
index af4c167..f9ec581 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -252,6 +252,24 @@ static void cpu_pre_save(void *opaque)
     }
 
     env->fpregs_format_vmstate = 0;
+
+    /*
+     * Real mode guest segments register DPL should be zero.
+     * Older KVM version were setting it wrongly.
+     * Fixing it will allow live migration to host with unrestricted guest
+     * support (otherwise the migration will fail with invalid guest state
+     * error).
+     */
+    if (!(env->cr[0] & CR0_PE_MASK) &&
+        (env->segs[R_CS].flags >> DESC_DPL_SHIFT & 3) != 0) {
+        env->segs[R_CS].flags &= ~(env->segs[R_CS].flags & DESC_DPL_MASK);
+        env->segs[R_DS].flags &= ~(env->segs[R_DS].flags & DESC_DPL_MASK);
+        env->segs[R_ES].flags &= ~(env->segs[R_ES].flags & DESC_DPL_MASK);
+        env->segs[R_FS].flags &= ~(env->segs[R_FS].flags & DESC_DPL_MASK);
+        env->segs[R_GS].flags &= ~(env->segs[R_GS].flags & DESC_DPL_MASK);
+        env->segs[R_SS].flags &= ~(env->segs[R_SS].flags & DESC_DPL_MASK);
+    }
+
 }
 
 static int cpu_post_load(void *opaque, int version_id)
commit 444ba6797ef6ef331fe9fd34309b1ec59caaede3
Author: Orit Wasserman <owasserm at redhat.com>
Date:   Mon Jul 22 20:29:41 2013 +0300

    Fix real mode guest migration
    
    Older KVM versions save CS dpl value to an invalid value for real mode guests
    (0x3). This patch detect this situation when loading CPU state and set all the
    segments dpl to zero.
    This will allow migration from older KVM on host without unrestricted guest
    to hosts with restricted guest support.
    For example migration from a Penryn host (with kernel 2.6.32) to
    a Westmere host (for real mode guest) will fail with "kvm: unhandled exit 80000021".
    
    Signed-off-by: Orit Wasserman <owasserm at redhat.com>
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/target-i386/machine.c b/target-i386/machine.c
index 3659db9..af4c167 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -260,6 +260,24 @@ static int cpu_post_load(void *opaque, int version_id)
     CPUX86State *env = &cpu->env;
     int i;
 
+    /*
+     * Real mode guest segments register DPL should be zero.
+     * Older KVM version were setting it wrongly.
+     * Fixing it will allow live migration from such host that don't have
+     * restricted guest support to a host with unrestricted guest support
+     * (otherwise the migration will fail with invalid guest state
+     * error).
+     */
+    if (!(env->cr[0] & CR0_PE_MASK) &&
+        (env->segs[R_CS].flags >> DESC_DPL_SHIFT & 3) != 0) {
+        env->segs[R_CS].flags &= ~(env->segs[R_CS].flags & DESC_DPL_MASK);
+        env->segs[R_DS].flags &= ~(env->segs[R_DS].flags & DESC_DPL_MASK);
+        env->segs[R_ES].flags &= ~(env->segs[R_ES].flags & DESC_DPL_MASK);
+        env->segs[R_FS].flags &= ~(env->segs[R_FS].flags & DESC_DPL_MASK);
+        env->segs[R_GS].flags &= ~(env->segs[R_GS].flags & DESC_DPL_MASK);
+        env->segs[R_SS].flags &= ~(env->segs[R_SS].flags & DESC_DPL_MASK);
+    }
+
     /* XXX: restore FPU round state */
     env->fpstt = (env->fpus_vmstate >> 11) & 7;
     env->fpus = env->fpus_vmstate & ~0x3800;
commit ed4fbd10823a7b0dbded6b481a68973e47f7e14d
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:58 2013 -0400

    rdma: account for the time spent in MIG_STATE_SETUP through QMP
    
    Using the previous patches, we're now able to timestamp the SETUP
    state. Once we have this time, let the user know about it in the
    schema.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/hmp.c b/hmp.c
index dc4d8d4..c45514b 100644
--- a/hmp.c
+++ b/hmp.c
@@ -164,6 +164,10 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
             monitor_printf(mon, "downtime: %" PRIu64 " milliseconds\n",
                            info->downtime);
         }
+        if (info->has_setup_time) {
+            monitor_printf(mon, "setup: %" PRIu64 " milliseconds\n",
+                           info->setup_time);
+        }
     }
 
     if (info->has_ram) {
diff --git a/include/migration/migration.h b/include/migration/migration.h
index 13a9629..08c772d 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -49,6 +49,7 @@ struct MigrationState
     int64_t dirty_bytes_rate;
     bool enabled_capabilities[MIGRATION_CAPABILITY_MAX];
     int64_t xbzrle_cache_size;
+    int64_t setup_time;
 };
 
 void process_incoming_migration(QEMUFile *f);
diff --git a/migration.c b/migration.c
index 636f7db..e12e784 100644
--- a/migration.c
+++ b/migration.c
@@ -191,6 +191,7 @@ MigrationInfo *qmp_query_migrate(Error **errp)
     case MIG_STATE_SETUP:
         info->has_status = true;
         info->status = g_strdup("setup");
+        info->has_total_time = false;
         break;
     case MIG_STATE_ACTIVE:
         info->has_status = true;
@@ -200,6 +201,8 @@ MigrationInfo *qmp_query_migrate(Error **errp)
             - s->total_time;
         info->has_expected_downtime = true;
         info->expected_downtime = s->expected_downtime;
+        info->has_setup_time = true;
+        info->setup_time = s->setup_time;
 
         info->has_ram = true;
         info->ram = g_malloc0(sizeof(*info->ram));
@@ -231,6 +234,8 @@ MigrationInfo *qmp_query_migrate(Error **errp)
         info->total_time = s->total_time;
         info->has_downtime = true;
         info->downtime = s->downtime;
+        info->has_setup_time = true;
+        info->setup_time = s->setup_time;
 
         info->has_ram = true;
         info->ram = g_malloc0(sizeof(*info->ram));
@@ -539,6 +544,7 @@ static void *migration_thread(void *opaque)
 {
     MigrationState *s = opaque;
     int64_t initial_time = qemu_get_clock_ms(rt_clock);
+    int64_t setup_start = qemu_get_clock_ms(host_clock);
     int64_t initial_bytes = 0;
     int64_t max_size = 0;
     int64_t start_time = initial_time;
@@ -547,8 +553,11 @@ static void *migration_thread(void *opaque)
     DPRINTF("beginning savevm\n");
     qemu_savevm_state_begin(s->file, &s->params);
 
+    s->setup_time = qemu_get_clock_ms(host_clock) - setup_start;
     migrate_set_state(s, MIG_STATE_SETUP, MIG_STATE_ACTIVE);
 
+    DPRINTF("setup complete\n");
+
     while (s->state == MIG_STATE_ACTIVE) {
         int64_t current_time;
         uint64_t pending_size;
diff --git a/qapi-schema.json b/qapi-schema.json
index 592bb9c..465b480 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -578,6 +578,12 @@
 #        expected downtime in milliseconds for the guest in last walk
 #        of the dirty bitmap. (since 1.3)
 #
+# @setup-time: #optional amount of setup time in milliseconds _before_ the
+#        iterations begin but _after_ the QMP command is issued. This is designed
+#        to provide an accounting of any activities (such as RDMA pinning) which
+#        may be expensive, but do not actually occur during the iterative
+#        migration rounds themselves. (since 1.6)
+#
 # Since: 0.14.0
 ##
 { 'type': 'MigrationInfo',
@@ -586,7 +592,8 @@
            '*xbzrle-cache': 'XBZRLECacheStats',
            '*total-time': 'int',
            '*expected-downtime': 'int',
-           '*downtime': 'int'} }
+           '*downtime': 'int',
+           '*setup-time': 'int'} }
 
 ##
 # @query-migrate
commit 29ae8a4133082e16970c9d4be09f4b6a15034617
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:57 2013 -0400

    rdma: introduce MIG_STATE_NONE and change MIG_STATE_SETUP state transition
    
    As described in the previous patch, until now, the MIG_STATE_SETUP
    state was not really a 'formal' state. It has been used as a 'zero' state
    (what we're calling 'NONE' here) and QEMU has been unconditionally transitioning
    into this state when the QMP migration command was called. Instead we want to
    introduce MIG_STATE_NONE, which is our starting state in the state machine, and
    then immediately transition into the MIG_STATE_SETUP state when the QMP migrate
    command is issued.
    
    In order to do this, we must delay the transition into MIG_STATE_ACTIVE until
    later in the migration_thread(). This is done to be able to timestamp the amount of
    time spent in the SETUP state for proper accounting to the user during
    an RDMA migration.
    
    Furthermore, the management software, until now, has never been aware of the
    existence of the SETUP state whatsoever. This must change, because, timing of this
    state implies that the state actually exists.
    
    These two patches cannot be separated because the 'query_migrate' QMP
    switch statement needs to know how to handle this new state transition.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/migration.c b/migration.c
index fcdcf61..636f7db 100644
--- a/migration.c
+++ b/migration.c
@@ -36,7 +36,8 @@
 #endif
 
 enum {
-    MIG_STATE_ERROR,
+    MIG_STATE_ERROR = -1,
+    MIG_STATE_NONE,
     MIG_STATE_SETUP,
     MIG_STATE_CANCELLED,
     MIG_STATE_ACTIVE,
@@ -63,7 +64,7 @@ static NotifierList migration_state_notifiers =
 MigrationState *migrate_get_current(void)
 {
     static MigrationState current_migration = {
-        .state = MIG_STATE_SETUP,
+        .state = MIG_STATE_NONE,
         .bandwidth_limit = MAX_THROTTLE,
         .xbzrle_cache_size = DEFAULT_MIGRATE_CACHE_SIZE,
         .mbps = -1,
@@ -184,9 +185,13 @@ MigrationInfo *qmp_query_migrate(Error **errp)
     MigrationState *s = migrate_get_current();
 
     switch (s->state) {
-    case MIG_STATE_SETUP:
+    case MIG_STATE_NONE:
         /* no migration has happened ever */
         break;
+    case MIG_STATE_SETUP:
+        info->has_status = true;
+        info->status = g_strdup("setup");
+        break;
     case MIG_STATE_ACTIVE:
         info->has_status = true;
         info->status = g_strdup("active");
@@ -257,7 +262,7 @@ void qmp_migrate_set_capabilities(MigrationCapabilityStatusList *params,
     MigrationState *s = migrate_get_current();
     MigrationCapabilityStatusList *cap;
 
-    if (s->state == MIG_STATE_ACTIVE) {
+    if (s->state == MIG_STATE_ACTIVE || s->state == MIG_STATE_SETUP) {
         error_set(errp, QERR_MIGRATION_ACTIVE);
         return;
     }
@@ -392,7 +397,7 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
     params.blk = blk;
     params.shared = inc;
 
-    if (s->state == MIG_STATE_ACTIVE) {
+    if (s->state == MIG_STATE_ACTIVE || s->state == MIG_STATE_SETUP) {
         error_set(errp, QERR_MIGRATION_ACTIVE);
         return;
     }
@@ -542,6 +547,8 @@ static void *migration_thread(void *opaque)
     DPRINTF("beginning savevm\n");
     qemu_savevm_state_begin(s->file, &s->params);
 
+    migrate_set_state(s, MIG_STATE_SETUP, MIG_STATE_ACTIVE);
+
     while (s->state == MIG_STATE_ACTIVE) {
         int64_t current_time;
         uint64_t pending_size;
@@ -632,8 +639,8 @@ static void *migration_thread(void *opaque)
 
 void migrate_fd_connect(MigrationState *s)
 {
-    s->state = MIG_STATE_ACTIVE;
-    trace_migrate_set_state(MIG_STATE_ACTIVE);
+    s->state = MIG_STATE_SETUP;
+    trace_migrate_set_state(MIG_STATE_SETUP);
 
     /* This is a best 1st approximation. ns to ms */
     s->expected_downtime = max_downtime/1000000;
commit d58f574bf39796ed2396dfd1e308352fbb03f944
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:56 2013 -0400

    rdma: allow state transitions between other states besides ACTIVE
    
    This patch is in preparation for the next ones: Until now the MIG_STATE_SETUP
    state was not really a 'formal' state. It has been used as a 'zero' state
    and QEMU has been unconditionally transitioning into this state when
    the QMP migrate command was called. In preparation for timing this state,
    we have to make this state a a 'real' state which actually gets transitioned
    from later in the migration_thread() from SETUP => ACTIVE, rather than just
    automatically dropping into this state at the beginninig of the migration.
    
    This means that the state transition function (migration_finish_set_state())
    needs to be capable of transitioning from valid states _other_ than just
    MIG_STATE_ACTIVE.
    
    The function is in fact already capable of doing that, but was not allowing the
    old state to be a parameter specified as an input.
    
    This patch fixes that and only makes the transition if the current state
    matches the old state that the caller intended to transition from.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/migration.c b/migration.c
index 261975d..fcdcf61 100644
--- a/migration.c
+++ b/migration.c
@@ -295,9 +295,9 @@ static void migrate_fd_cleanup(void *opaque)
     notifier_list_notify(&migration_state_notifiers, s);
 }
 
-static void migrate_finish_set_state(MigrationState *s, int new_state)
+static void migrate_set_state(MigrationState *s, int old_state, int new_state)
 {
-    if (atomic_cmpxchg(&s->state, MIG_STATE_ACTIVE, new_state) == new_state) {
+    if (atomic_cmpxchg(&s->state, old_state, new_state) == new_state) {
         trace_migrate_set_state(new_state);
     }
 }
@@ -315,7 +315,7 @@ static void migrate_fd_cancel(MigrationState *s)
 {
     DPRINTF("cancelling migration\n");
 
-    migrate_finish_set_state(s, MIG_STATE_CANCELLED);
+    migrate_set_state(s, s->state, MIG_STATE_CANCELLED);
 }
 
 void add_migration_state_change_notifier(Notifier *notify)
@@ -569,19 +569,19 @@ static void *migration_thread(void *opaque)
                 qemu_mutex_unlock_iothread();
 
                 if (ret < 0) {
-                    migrate_finish_set_state(s, MIG_STATE_ERROR);
+                    migrate_set_state(s, MIG_STATE_ACTIVE, MIG_STATE_ERROR);
                     break;
                 }
 
                 if (!qemu_file_get_error(s->file)) {
-                    migrate_finish_set_state(s, MIG_STATE_COMPLETED);
+                    migrate_set_state(s, MIG_STATE_ACTIVE, MIG_STATE_COMPLETED);
                     break;
                 }
             }
         }
 
         if (qemu_file_get_error(s->file)) {
-            migrate_finish_set_state(s, MIG_STATE_ERROR);
+            migrate_set_state(s, MIG_STATE_ACTIVE, MIG_STATE_ERROR);
             break;
         }
         current_time = qemu_get_clock_ms(rt_clock);
commit 9b146e9a28bbd9567f5ac6a8e2bcb543aa3b9392
Author: Jia Liu <proljc at gmail.com>
Date:   Tue Jul 23 18:32:30 2013 +0800

    target-openrisc: Free typename in openrisc_cpu_class_by_name
    
    We should free typename here.
    
    Signed-off-by: Jia Liu <proljc at gmail.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index 6d40f1b..e348df0 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -99,6 +99,7 @@ static ObjectClass *openrisc_cpu_class_by_name(const char *cpu_model)
 
     typename = g_strdup_printf("%s-" TYPE_OPENRISC_CPU, cpu_model);
     oc = object_class_by_name(typename);
+    g_free(typename);
     if (oc != NULL && (!object_class_dynamic_cast(oc, TYPE_OPENRISC_CPU) ||
                        object_class_is_abstract(oc))) {
         return NULL;
commit 4284c0517b12f03da59250a23ee7e9c3581e89c4
Author: Jia Liu <proljc at gmail.com>
Date:   Tue Jul 23 18:31:24 2013 +0800

    hw/openrisc: Use stderr output instead of qemu_log
    
    We should use stderr output instead of qemu_log in order to output ErrMsg
    onto the screen.
    
    Signed-off-by: Jia Liu <proljc at gmail.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 250f5b5..a08f27c 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -82,7 +82,7 @@ static void cpu_openrisc_load_kernel(ram_addr_t ram_size,
         }
 
         if (kernel_size < 0) {
-            qemu_log("QEMU: couldn't load the kernel '%s'\n",
+            fprintf(stderr, "QEMU: couldn't load the kernel '%s'\n",
                     kernel_filename);
             exit(1);
         }
@@ -107,7 +107,7 @@ static void openrisc_sim_init(QEMUMachineInitArgs *args)
     for (n = 0; n < smp_cpus; n++) {
         cpu = cpu_openrisc_init(cpu_model);
         if (cpu == NULL) {
-            qemu_log("Unable to find CPU definition!\n");
+            fprintf(stderr, "Unable to find CPU definition!\n");
             exit(1);
         }
         qemu_register_reset(main_cpu_reset, cpu);
commit 68f1282882fe3b43b4bc323e03545dc019e2d19a
Author: Jia Liu <proljc at gmail.com>
Date:   Tue Jul 23 18:30:09 2013 +0800

    hw/openrisc: Indent typo
    
    Indent typo.
    
    Signed-off-by: Jia Liu <proljc at gmail.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 924438b..250f5b5 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -96,7 +96,7 @@ static void openrisc_sim_init(QEMUMachineInitArgs *args)
     ram_addr_t ram_size = args->ram_size;
     const char *cpu_model = args->cpu_model;
     const char *kernel_filename = args->kernel_filename;
-   OpenRISCCPU *cpu = NULL;
+    OpenRISCCPU *cpu = NULL;
     MemoryRegion *ram;
     int n;
 
commit 0033b8b42a1cc2a9350619ea19e11954b12fb819
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:55 2013 -0400

    rdma: send pc.ram
    
    This takes advantages of the previous patches:
    
    1. use the new QEMUFileOps hook 'save_page'
    
    2. call out to the right accessor methods to invoke
       the iteration hooks defined in QEMUFileOps
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index 09a7125..68a7ab7 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -118,6 +118,7 @@ static void check_guest_throttling(void);
 #define RAM_SAVE_FLAG_EOS      0x10
 #define RAM_SAVE_FLAG_CONTINUE 0x20
 #define RAM_SAVE_FLAG_XBZRLE   0x40
+/* 0x80 is reserved in migration.h start with 0x100 next */
 
 
 static struct defconfig_file {
@@ -475,6 +476,7 @@ static int ram_save_block(QEMUFile *f, bool last_stage)
                 ram_bulk_stage = false;
             }
         } else {
+            int ret;
             uint8_t *p;
             int cont = (block == last_sent_block) ?
                 RAM_SAVE_FLAG_CONTINUE : 0;
@@ -483,7 +485,18 @@ static int ram_save_block(QEMUFile *f, bool last_stage)
 
             /* In doubt sent page as normal */
             bytes_sent = -1;
-            if (is_zero_page(p)) {
+            ret = ram_control_save_page(f, block->offset,
+                               offset, TARGET_PAGE_SIZE, &bytes_sent);
+
+            if (ret != RAM_SAVE_CONTROL_NOT_SUPP) {
+                if (ret != RAM_SAVE_CONTROL_DELAYED) {
+                    if (bytes_sent > 0) {
+                        acct_info.norm_pages++;
+                    } else if (bytes_sent == 0) {
+                        acct_info.dup_pages++;
+                    }
+                }
+            } else if (is_zero_page(p)) {
                 acct_info.dup_pages++;
                 bytes_sent = save_block_hdr(f, block, offset, cont,
                                             RAM_SAVE_FLAG_COMPRESS);
@@ -635,6 +648,10 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
     }
 
     qemu_mutex_unlock_ramlist();
+
+    ram_control_before_iterate(f, RAM_CONTROL_SETUP);
+    ram_control_after_iterate(f, RAM_CONTROL_SETUP);
+
     qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
 
     return 0;
@@ -653,6 +670,8 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
         reset_ram_globals();
     }
 
+    ram_control_before_iterate(f, RAM_CONTROL_ROUND);
+
     t0 = qemu_get_clock_ns(rt_clock);
     i = 0;
     while ((ret = qemu_file_rate_limit(f)) == 0) {
@@ -684,6 +703,12 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
 
     qemu_mutex_unlock_ramlist();
 
+    /*
+     * Must occur before EOS (or any QEMUFile operation)
+     * because of RDMA protocol.
+     */
+    ram_control_after_iterate(f, RAM_CONTROL_ROUND);
+
     if (ret < 0) {
         bytes_transferred += total_sent;
         return ret;
@@ -701,6 +726,8 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
     qemu_mutex_lock_ramlist();
     migration_bitmap_sync();
 
+    ram_control_before_iterate(f, RAM_CONTROL_FINISH);
+
     /* try transferring iterative blocks of memory */
 
     /* flush all remaining blocks regardless of rate limiting */
@@ -714,6 +741,8 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
         }
         bytes_transferred += bytes_sent;
     }
+
+    ram_control_after_iterate(f, RAM_CONTROL_FINISH);
     migration_end();
 
     qemu_mutex_unlock_ramlist();
@@ -917,6 +946,8 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
                 ret = -EINVAL;
                 goto done;
             }
+        } else if (flags & RAM_SAVE_FLAG_HOOK) {
+            ram_control_load_hook(f, flags);
         }
         error = qemu_file_get_error(f);
         if (error) {
commit 2da776db4846eadcb808598a5d3484d149773c05
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:54 2013 -0400

    rdma: core logic
    
    Code that does need to be visible is kept
    well contained inside this file and this is the only
    new additional file to the entire patch.
    
    This file includes the entire protocol and interfaces
    required to perform RDMA migration.
    
    Also, the configure and Makefile modifications to link
    this file are included.
    
    Full documentation is in docs/rdma.txt
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/Makefile.objs b/Makefile.objs
index 5b288ba..9928542 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -51,6 +51,7 @@ common-obj-$(CONFIG_POSIX) += os-posix.o
 common-obj-$(CONFIG_LINUX) += fsdev/
 
 common-obj-y += migration.o migration-tcp.o
+common-obj-$(CONFIG_RDMA) += migration-rdma.o
 common-obj-y += qemu-char.o #aio.o
 common-obj-y += block-migration.o
 common-obj-y += page_cache.o xbzrle.o
diff --git a/configure b/configure
index 7c45db2..877a821 100755
--- a/configure
+++ b/configure
@@ -180,6 +180,7 @@ xfs=""
 vhost_net="no"
 vhost_scsi="no"
 kvm="no"
+rdma=""
 gprof="no"
 debug_tcg="no"
 debug="no"
@@ -937,6 +938,10 @@ for opt do
   ;;
   --enable-gtk) gtk="yes"
   ;;
+  --enable-rdma) rdma="yes"
+  ;;
+  --disable-rdma) rdma="no"
+  ;;
   --with-gtkabi=*) gtkabi="$optarg"
   ;;
   --enable-tpm) tpm="yes"
@@ -1095,6 +1100,8 @@ echo "  --enable-bluez           enable bluez stack connectivity"
 echo "  --disable-slirp          disable SLIRP userspace network connectivity"
 echo "  --disable-kvm            disable KVM acceleration support"
 echo "  --enable-kvm             enable KVM acceleration support"
+echo "  --disable-rdma           disable RDMA-based migration support"
+echo "  --enable-rdma            enable RDMA-based migration support"
 echo "  --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)"
 echo "  --disable-nptl           disable usermode NPTL support"
 echo "  --enable-nptl            enable usermode NPTL support"
@@ -1802,6 +1809,30 @@ EOF
 fi
 
 ##########################################
+# RDMA needs OpenFabrics libraries
+if test "$rdma" != "no" ; then
+  cat > $TMPC <<EOF
+#include <rdma/rdma_cma.h>
+int main(void) { return 0; }
+EOF
+  rdma_libs="-lrdmacm -libverbs"
+  if compile_prog "" "$rdma_libs" ; then
+    rdma="yes"
+    libs_softmmu="$libs_softmmu $rdma_libs"
+  else
+    if test "$rdma" = "yes" ; then
+        error_exit \
+            " OpenFabrics librdmacm/libibverbs not present." \
+            " Your options:" \
+            "  (1) Fast: Install infiniband packages from your distro." \
+            "  (2) Cleanest: Install libraries from www.openfabrics.org" \
+            "  (3) Also: Install softiwarp if you don't have RDMA hardware"
+    fi
+    rdma="no"
+  fi
+fi
+
+##########################################
 # VNC TLS/WS detection
 if test "$vnc" = "yes" -a \( "$vnc_tls" != "no" -o "$vnc_ws" != "no" \) ; then
   cat > $TMPC <<EOF
@@ -3558,6 +3589,7 @@ echo "Linux AIO support $linux_aio"
 echo "ATTR/XATTR support $attr"
 echo "Install blobs     $blobs"
 echo "KVM support       $kvm"
+echo "RDMA support      $rdma"
 echo "TCG interpreter   $tcg_interpreter"
 echo "fdt support       $fdt"
 echo "preadv support    $preadv"
@@ -4046,6 +4078,10 @@ if test "$trace_default" = "yes"; then
   echo "CONFIG_TRACE_DEFAULT=y" >> $config_host_mak
 fi
 
+if test "$rdma" = "yes" ; then
+  echo "CONFIG_RDMA=y" >> $config_host_mak
+fi
+
 if test "$tcg_interpreter" = "yes"; then
   QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/tci $QEMU_INCLUDES"
 elif test "$ARCH" = "sparc64" ; then
@@ -4485,6 +4521,10 @@ if [ "$pixman" = "internal" ]; then
   echo "config-host.h: subdir-pixman" >> $config_host_mak
 fi
 
+if test "$rdma" = "yes" ; then
+echo "CONFIG_RDMA=y" >> $config_host_mak
+fi
+
 if [ "$dtc_internal" = "yes" ]; then
   echo "config-host.h: subdir-dtc" >> $config_host_mak
 fi
diff --git a/include/migration/migration.h b/include/migration/migration.h
index 90b5021..13a9629 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -77,6 +77,10 @@ void fd_start_incoming_migration(const char *path, Error **errp);
 
 void fd_start_outgoing_migration(MigrationState *s, const char *fdname, Error **errp);
 
+void rdma_start_outgoing_migration(void *opaque, const char *host_port, Error **errp);
+
+void rdma_start_incoming_migration(const char *host_port, Error **errp);
+
 void migrate_fd_error(MigrationState *s);
 
 void migrate_fd_connect(MigrationState *s);
diff --git a/migration-rdma.c b/migration-rdma.c
new file mode 100644
index 0000000..d044830
--- /dev/null
+++ b/migration-rdma.c
@@ -0,0 +1,3249 @@
+/*
+ * RDMA protocol and interfaces
+ *
+ * Copyright IBM, Corp. 2010-2013
+ *
+ * Authors:
+ *  Michael R. Hines <mrhines at us.ibm.com>
+ *  Jiuxing Liu <jl at us.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ *
+ */
+#include "qemu-common.h"
+#include "migration/migration.h"
+#include "migration/qemu-file.h"
+#include "exec/cpu-common.h"
+#include "qemu/main-loop.h"
+#include "qemu/sockets.h"
+#include "qemu/bitmap.h"
+#include "block/coroutine.h"
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+#include <arpa/inet.h>
+#include <string.h>
+#include <rdma/rdma_cma.h>
+
+#define DEBUG_RDMA
+//#define DEBUG_RDMA_VERBOSE
+//#define DEBUG_RDMA_REALLY_VERBOSE
+
+#ifdef DEBUG_RDMA
+#define DPRINTF(fmt, ...) \
+    do { printf("rdma: " fmt, ## __VA_ARGS__); } while (0)
+#else
+#define DPRINTF(fmt, ...) \
+    do { } while (0)
+#endif
+
+#ifdef DEBUG_RDMA_VERBOSE
+#define DDPRINTF(fmt, ...) \
+    do { printf("rdma: " fmt, ## __VA_ARGS__); } while (0)
+#else
+#define DDPRINTF(fmt, ...) \
+    do { } while (0)
+#endif
+
+#ifdef DEBUG_RDMA_REALLY_VERBOSE
+#define DDDPRINTF(fmt, ...) \
+    do { printf("rdma: " fmt, ## __VA_ARGS__); } while (0)
+#else
+#define DDDPRINTF(fmt, ...) \
+    do { } while (0)
+#endif
+
+/*
+ * Print and error on both the Monitor and the Log file.
+ */
+#define ERROR(errp, fmt, ...) \
+    do { \
+        fprintf(stderr, "RDMA ERROR: " fmt, ## __VA_ARGS__); \
+        if (errp && (*(errp) == NULL)) { \
+            error_setg(errp, "RDMA ERROR: " fmt, ## __VA_ARGS__); \
+        } \
+    } while (0)
+
+#define RDMA_RESOLVE_TIMEOUT_MS 10000
+
+/* Do not merge data if larger than this. */
+#define RDMA_MERGE_MAX (2 * 1024 * 1024)
+#define RDMA_SIGNALED_SEND_MAX (RDMA_MERGE_MAX / 4096)
+
+#define RDMA_REG_CHUNK_SHIFT 20 /* 1 MB */
+
+/*
+ * This is only for non-live state being migrated.
+ * Instead of RDMA_WRITE messages, we use RDMA_SEND
+ * messages for that state, which requires a different
+ * delivery design than main memory.
+ */
+#define RDMA_SEND_INCREMENT 32768
+
+/*
+ * Maximum size infiniband SEND message
+ */
+#define RDMA_CONTROL_MAX_BUFFER (512 * 1024)
+#define RDMA_CONTROL_MAX_COMMANDS_PER_MESSAGE 4096
+
+#define RDMA_CONTROL_VERSION_CURRENT 1
+/*
+ * Capabilities for negotiation.
+ */
+#define RDMA_CAPABILITY_PIN_ALL 0x01
+
+/*
+ * Add the other flags above to this list of known capabilities
+ * as they are introduced.
+ */
+static uint32_t known_capabilities = RDMA_CAPABILITY_PIN_ALL;
+
+#define CHECK_ERROR_STATE() \
+    do { \
+        if (rdma->error_state) { \
+            if (!rdma->error_reported) { \
+                fprintf(stderr, "RDMA is in an error state waiting migration" \
+                                " to abort!\n"); \
+                rdma->error_reported = 1; \
+            } \
+            return rdma->error_state; \
+        } \
+    } while (0);
+
+/*
+ * A work request ID is 64-bits and we split up these bits
+ * into 3 parts:
+ *
+ * bits 0-15 : type of control message, 2^16
+ * bits 16-29: ram block index, 2^14
+ * bits 30-63: ram block chunk number, 2^34
+ *
+ * The last two bit ranges are only used for RDMA writes,
+ * in order to track their completion and potentially
+ * also track unregistration status of the message.
+ */
+#define RDMA_WRID_TYPE_SHIFT  0UL
+#define RDMA_WRID_BLOCK_SHIFT 16UL
+#define RDMA_WRID_CHUNK_SHIFT 30UL
+
+#define RDMA_WRID_TYPE_MASK \
+    ((1UL << RDMA_WRID_BLOCK_SHIFT) - 1UL)
+
+#define RDMA_WRID_BLOCK_MASK \
+    (~RDMA_WRID_TYPE_MASK & ((1UL << RDMA_WRID_CHUNK_SHIFT) - 1UL))
+
+#define RDMA_WRID_CHUNK_MASK (~RDMA_WRID_BLOCK_MASK & ~RDMA_WRID_TYPE_MASK)
+
+/*
+ * RDMA migration protocol:
+ * 1. RDMA Writes (data messages, i.e. RAM)
+ * 2. IB Send/Recv (control channel messages)
+ */
+enum {
+    RDMA_WRID_NONE = 0,
+    RDMA_WRID_RDMA_WRITE = 1,
+    RDMA_WRID_SEND_CONTROL = 2000,
+    RDMA_WRID_RECV_CONTROL = 4000,
+};
+
+const char *wrid_desc[] = {
+    [RDMA_WRID_NONE] = "NONE",
+    [RDMA_WRID_RDMA_WRITE] = "WRITE RDMA",
+    [RDMA_WRID_SEND_CONTROL] = "CONTROL SEND",
+    [RDMA_WRID_RECV_CONTROL] = "CONTROL RECV",
+};
+
+/*
+ * Work request IDs for IB SEND messages only (not RDMA writes).
+ * This is used by the migration protocol to transmit
+ * control messages (such as device state and registration commands)
+ *
+ * We could use more WRs, but we have enough for now.
+ */
+enum {
+    RDMA_WRID_READY = 0,
+    RDMA_WRID_DATA,
+    RDMA_WRID_CONTROL,
+    RDMA_WRID_MAX,
+};
+
+/*
+ * SEND/RECV IB Control Messages.
+ */
+enum {
+    RDMA_CONTROL_NONE = 0,
+    RDMA_CONTROL_ERROR,
+    RDMA_CONTROL_READY,               /* ready to receive */
+    RDMA_CONTROL_QEMU_FILE,           /* QEMUFile-transmitted bytes */
+    RDMA_CONTROL_RAM_BLOCKS_REQUEST,  /* RAMBlock synchronization */
+    RDMA_CONTROL_RAM_BLOCKS_RESULT,   /* RAMBlock synchronization */
+    RDMA_CONTROL_COMPRESS,            /* page contains repeat values */
+    RDMA_CONTROL_REGISTER_REQUEST,    /* dynamic page registration */
+    RDMA_CONTROL_REGISTER_RESULT,     /* key to use after registration */
+    RDMA_CONTROL_REGISTER_FINISHED,   /* current iteration finished */
+    RDMA_CONTROL_UNREGISTER_REQUEST,  /* dynamic UN-registration */
+    RDMA_CONTROL_UNREGISTER_FINISHED, /* unpinning finished */
+};
+
+const char *control_desc[] = {
+    [RDMA_CONTROL_NONE] = "NONE",
+    [RDMA_CONTROL_ERROR] = "ERROR",
+    [RDMA_CONTROL_READY] = "READY",
+    [RDMA_CONTROL_QEMU_FILE] = "QEMU FILE",
+    [RDMA_CONTROL_RAM_BLOCKS_REQUEST] = "RAM BLOCKS REQUEST",
+    [RDMA_CONTROL_RAM_BLOCKS_RESULT] = "RAM BLOCKS RESULT",
+    [RDMA_CONTROL_COMPRESS] = "COMPRESS",
+    [RDMA_CONTROL_REGISTER_REQUEST] = "REGISTER REQUEST",
+    [RDMA_CONTROL_REGISTER_RESULT] = "REGISTER RESULT",
+    [RDMA_CONTROL_REGISTER_FINISHED] = "REGISTER FINISHED",
+    [RDMA_CONTROL_UNREGISTER_REQUEST] = "UNREGISTER REQUEST",
+    [RDMA_CONTROL_UNREGISTER_FINISHED] = "UNREGISTER FINISHED",
+};
+
+/*
+ * Memory and MR structures used to represent an IB Send/Recv work request.
+ * This is *not* used for RDMA writes, only IB Send/Recv.
+ */
+typedef struct {
+    uint8_t  control[RDMA_CONTROL_MAX_BUFFER]; /* actual buffer to register */
+    struct   ibv_mr *control_mr;               /* registration metadata */
+    size_t   control_len;                      /* length of the message */
+    uint8_t *control_curr;                     /* start of unconsumed bytes */
+} RDMAWorkRequestData;
+
+/*
+ * Negotiate RDMA capabilities during connection-setup time.
+ */
+typedef struct {
+    uint32_t version;
+    uint32_t flags;
+} RDMACapabilities;
+
+static void caps_to_network(RDMACapabilities *cap)
+{
+    cap->version = htonl(cap->version);
+    cap->flags = htonl(cap->flags);
+}
+
+static void network_to_caps(RDMACapabilities *cap)
+{
+    cap->version = ntohl(cap->version);
+    cap->flags = ntohl(cap->flags);
+}
+
+/*
+ * Representation of a RAMBlock from an RDMA perspective.
+ * This is not transmitted, only local.
+ * This and subsequent structures cannot be linked lists
+ * because we're using a single IB message to transmit
+ * the information. It's small anyway, so a list is overkill.
+ */
+typedef struct RDMALocalBlock {
+    uint8_t  *local_host_addr; /* local virtual address */
+    uint64_t remote_host_addr; /* remote virtual address */
+    uint64_t offset;
+    uint64_t length;
+    struct   ibv_mr **pmr;     /* MRs for chunk-level registration */
+    struct   ibv_mr *mr;       /* MR for non-chunk-level registration */
+    uint32_t *remote_keys;     /* rkeys for chunk-level registration */
+    uint32_t remote_rkey;      /* rkeys for non-chunk-level registration */
+    int      index;            /* which block are we */
+    bool     is_ram_block;
+    int      nb_chunks;
+    unsigned long *transit_bitmap;
+    unsigned long *unregister_bitmap;
+} RDMALocalBlock;
+
+/*
+ * Also represents a RAMblock, but only on the dest.
+ * This gets transmitted by the dest during connection-time
+ * to the source VM and then is used to populate the
+ * corresponding RDMALocalBlock with
+ * the information needed to perform the actual RDMA.
+ */
+typedef struct QEMU_PACKED RDMARemoteBlock {
+    uint64_t remote_host_addr;
+    uint64_t offset;
+    uint64_t length;
+    uint32_t remote_rkey;
+    uint32_t padding;
+} RDMARemoteBlock;
+
+static uint64_t htonll(uint64_t v)
+{
+    union { uint32_t lv[2]; uint64_t llv; } u;
+    u.lv[0] = htonl(v >> 32);
+    u.lv[1] = htonl(v & 0xFFFFFFFFULL);
+    return u.llv;
+}
+
+static uint64_t ntohll(uint64_t v) {
+    union { uint32_t lv[2]; uint64_t llv; } u;
+    u.llv = v;
+    return ((uint64_t)ntohl(u.lv[0]) << 32) | (uint64_t) ntohl(u.lv[1]);
+}
+
+static void remote_block_to_network(RDMARemoteBlock *rb)
+{
+    rb->remote_host_addr = htonll(rb->remote_host_addr);
+    rb->offset = htonll(rb->offset);
+    rb->length = htonll(rb->length);
+    rb->remote_rkey = htonl(rb->remote_rkey);
+}
+
+static void network_to_remote_block(RDMARemoteBlock *rb)
+{
+    rb->remote_host_addr = ntohll(rb->remote_host_addr);
+    rb->offset = ntohll(rb->offset);
+    rb->length = ntohll(rb->length);
+    rb->remote_rkey = ntohl(rb->remote_rkey);
+}
+
+/*
+ * Virtual address of the above structures used for transmitting
+ * the RAMBlock descriptions at connection-time.
+ * This structure is *not* transmitted.
+ */
+typedef struct RDMALocalBlocks {
+    int nb_blocks;
+    bool     init;             /* main memory init complete */
+    RDMALocalBlock *block;
+} RDMALocalBlocks;
+
+/*
+ * Main data structure for RDMA state.
+ * While there is only one copy of this structure being allocated right now,
+ * this is the place where one would start if you wanted to consider
+ * having more than one RDMA connection open at the same time.
+ */
+typedef struct RDMAContext {
+    char *host;
+    int port;
+
+    RDMAWorkRequestData wr_data[RDMA_WRID_MAX + 1];
+
+    /*
+     * This is used by *_exchange_send() to figure out whether or not
+     * the initial "READY" message has already been received or not.
+     * This is because other functions may potentially poll() and detect
+     * the READY message before send() does, in which case we need to
+     * know if it completed.
+     */
+    int control_ready_expected;
+
+    /* number of outstanding writes */
+    int nb_sent;
+
+    /* store info about current buffer so that we can
+       merge it with future sends */
+    uint64_t current_addr;
+    uint64_t current_length;
+    /* index of ram block the current buffer belongs to */
+    int current_index;
+    /* index of the chunk in the current ram block */
+    int current_chunk;
+
+    bool pin_all;
+
+    /*
+     * infiniband-specific variables for opening the device
+     * and maintaining connection state and so forth.
+     *
+     * cm_id also has ibv_context, rdma_event_channel, and ibv_qp in
+     * cm_id->verbs, cm_id->channel, and cm_id->qp.
+     */
+    struct rdma_cm_id *cm_id;               /* connection manager ID */
+    struct rdma_cm_id *listen_id;
+
+    struct ibv_context          *verbs;
+    struct rdma_event_channel   *channel;
+    struct ibv_qp *qp;                      /* queue pair */
+    struct ibv_comp_channel *comp_channel;  /* completion channel */
+    struct ibv_pd *pd;                      /* protection domain */
+    struct ibv_cq *cq;                      /* completion queue */
+
+    /*
+     * If a previous write failed (perhaps because of a failed
+     * memory registration, then do not attempt any future work
+     * and remember the error state.
+     */
+    int error_state;
+    int error_reported;
+
+    /*
+     * Description of ram blocks used throughout the code.
+     */
+    RDMALocalBlocks local_ram_blocks;
+    RDMARemoteBlock *block;
+
+    /*
+     * Migration on *destination* started.
+     * Then use coroutine yield function.
+     * Source runs in a thread, so we don't care.
+     */
+    int migration_started_on_destination;
+
+    int total_registrations;
+    int total_writes;
+
+    int unregister_current, unregister_next;
+    uint64_t unregistrations[RDMA_SIGNALED_SEND_MAX];
+
+    GHashTable *blockmap;
+} RDMAContext;
+
+/*
+ * Interface to the rest of the migration call stack.
+ */
+typedef struct QEMUFileRDMA {
+    RDMAContext *rdma;
+    size_t len;
+    void *file;
+} QEMUFileRDMA;
+
+/*
+ * Main structure for IB Send/Recv control messages.
+ * This gets prepended at the beginning of every Send/Recv.
+ */
+typedef struct QEMU_PACKED {
+    uint32_t len;     /* Total length of data portion */
+    uint32_t type;    /* which control command to perform */
+    uint32_t repeat;  /* number of commands in data portion of same type */
+    uint32_t padding;
+} RDMAControlHeader;
+
+static void control_to_network(RDMAControlHeader *control)
+{
+    control->type = htonl(control->type);
+    control->len = htonl(control->len);
+    control->repeat = htonl(control->repeat);
+}
+
+static void network_to_control(RDMAControlHeader *control)
+{
+    control->type = ntohl(control->type);
+    control->len = ntohl(control->len);
+    control->repeat = ntohl(control->repeat);
+}
+
+/*
+ * Register a single Chunk.
+ * Information sent by the source VM to inform the dest
+ * to register an single chunk of memory before we can perform
+ * the actual RDMA operation.
+ */
+typedef struct QEMU_PACKED {
+    union QEMU_PACKED {
+        uint64_t current_addr;  /* offset into the ramblock of the chunk */
+        uint64_t chunk;         /* chunk to lookup if unregistering */
+    } key;
+    uint32_t current_index; /* which ramblock the chunk belongs to */
+    uint32_t padding;
+    uint64_t chunks;            /* how many sequential chunks to register */
+} RDMARegister;
+
+static void register_to_network(RDMARegister *reg)
+{
+    reg->key.current_addr = htonll(reg->key.current_addr);
+    reg->current_index = htonl(reg->current_index);
+    reg->chunks = htonll(reg->chunks);
+}
+
+static void network_to_register(RDMARegister *reg)
+{
+    reg->key.current_addr = ntohll(reg->key.current_addr);
+    reg->current_index = ntohl(reg->current_index);
+    reg->chunks = ntohll(reg->chunks);
+}
+
+typedef struct QEMU_PACKED {
+    uint32_t value;     /* if zero, we will madvise() */
+    uint32_t block_idx; /* which ram block index */
+    uint64_t offset;    /* where in the remote ramblock this chunk */
+    uint64_t length;    /* length of the chunk */
+} RDMACompress;
+
+static void compress_to_network(RDMACompress *comp)
+{
+    comp->value = htonl(comp->value);
+    comp->block_idx = htonl(comp->block_idx);
+    comp->offset = htonll(comp->offset);
+    comp->length = htonll(comp->length);
+}
+
+static void network_to_compress(RDMACompress *comp)
+{
+    comp->value = ntohl(comp->value);
+    comp->block_idx = ntohl(comp->block_idx);
+    comp->offset = ntohll(comp->offset);
+    comp->length = ntohll(comp->length);
+}
+
+/*
+ * The result of the dest's memory registration produces an "rkey"
+ * which the source VM must reference in order to perform
+ * the RDMA operation.
+ */
+typedef struct QEMU_PACKED {
+    uint32_t rkey;
+    uint32_t padding;
+    uint64_t host_addr;
+} RDMARegisterResult;
+
+static void result_to_network(RDMARegisterResult *result)
+{
+    result->rkey = htonl(result->rkey);
+    result->host_addr = htonll(result->host_addr);
+};
+
+static void network_to_result(RDMARegisterResult *result)
+{
+    result->rkey = ntohl(result->rkey);
+    result->host_addr = ntohll(result->host_addr);
+};
+
+const char *print_wrid(int wrid);
+static int qemu_rdma_exchange_send(RDMAContext *rdma, RDMAControlHeader *head,
+                                   uint8_t *data, RDMAControlHeader *resp,
+                                   int *resp_idx,
+                                   int (*callback)(RDMAContext *rdma));
+
+static inline uint64_t ram_chunk_index(uint8_t *start, uint8_t *host)
+{
+    return ((uintptr_t) host - (uintptr_t) start) >> RDMA_REG_CHUNK_SHIFT;
+}
+
+static inline uint8_t *ram_chunk_start(RDMALocalBlock *rdma_ram_block,
+                                       uint64_t i)
+{
+    return (uint8_t *) (((uintptr_t) rdma_ram_block->local_host_addr)
+                                    + (i << RDMA_REG_CHUNK_SHIFT));
+}
+
+static inline uint8_t *ram_chunk_end(RDMALocalBlock *rdma_ram_block, uint64_t i)
+{
+    uint8_t *result = ram_chunk_start(rdma_ram_block, i) +
+                                         (1UL << RDMA_REG_CHUNK_SHIFT);
+
+    if (result > (rdma_ram_block->local_host_addr + rdma_ram_block->length)) {
+        result = rdma_ram_block->local_host_addr + rdma_ram_block->length;
+    }
+
+    return result;
+}
+
+static int __qemu_rdma_add_block(RDMAContext *rdma, void *host_addr,
+                         ram_addr_t block_offset, uint64_t length)
+{
+    RDMALocalBlocks *local = &rdma->local_ram_blocks;
+    RDMALocalBlock *block = g_hash_table_lookup(rdma->blockmap,
+        (void *) block_offset);
+    RDMALocalBlock *old = local->block;
+
+    assert(block == NULL);
+
+    local->block = g_malloc0(sizeof(RDMALocalBlock) * (local->nb_blocks + 1));
+
+    if (local->nb_blocks) {
+        int x;
+
+        for (x = 0; x < local->nb_blocks; x++) {
+            g_hash_table_remove(rdma->blockmap, (void *)old[x].offset);
+            g_hash_table_insert(rdma->blockmap, (void *)old[x].offset,
+                                                &local->block[x]);
+        }
+        memcpy(local->block, old, sizeof(RDMALocalBlock) * local->nb_blocks);
+        g_free(old);
+    }
+
+    block = &local->block[local->nb_blocks];
+
+    block->local_host_addr = host_addr;
+    block->offset = block_offset;
+    block->length = length;
+    block->index = local->nb_blocks;
+    block->nb_chunks = ram_chunk_index(host_addr, host_addr + length) + 1UL;
+    block->transit_bitmap = bitmap_new(block->nb_chunks);
+    bitmap_clear(block->transit_bitmap, 0, block->nb_chunks);
+    block->unregister_bitmap = bitmap_new(block->nb_chunks);
+    bitmap_clear(block->unregister_bitmap, 0, block->nb_chunks);
+    block->remote_keys = g_malloc0(block->nb_chunks * sizeof(uint32_t));
+
+    block->is_ram_block = local->init ? false : true;
+
+    g_hash_table_insert(rdma->blockmap, (void *) block_offset, block);
+
+    DDPRINTF("Added Block: %d, addr: %" PRIu64 ", offset: %" PRIu64
+           " length: %" PRIu64 " end: %" PRIu64 " bits %" PRIu64 " chunks %d\n",
+            local->nb_blocks, (uint64_t) block->local_host_addr, block->offset,
+            block->length, (uint64_t) (block->local_host_addr + block->length),
+                BITS_TO_LONGS(block->nb_chunks) *
+                    sizeof(unsigned long) * 8, block->nb_chunks);
+
+    local->nb_blocks++;
+
+    return 0;
+}
+
+/*
+ * Memory regions need to be registered with the device and queue pairs setup
+ * in advanced before the migration starts. This tells us where the RAM blocks
+ * are so that we can register them individually.
+ */
+static void qemu_rdma_init_one_block(void *host_addr,
+    ram_addr_t block_offset, ram_addr_t length, void *opaque)
+{
+    __qemu_rdma_add_block(opaque, host_addr, block_offset, length);
+}
+
+/*
+ * Identify the RAMBlocks and their quantity. They will be references to
+ * identify chunk boundaries inside each RAMBlock and also be referenced
+ * during dynamic page registration.
+ */
+static int qemu_rdma_init_ram_blocks(RDMAContext *rdma)
+{
+    RDMALocalBlocks *local = &rdma->local_ram_blocks;
+
+    assert(rdma->blockmap == NULL);
+    rdma->blockmap = g_hash_table_new(g_direct_hash, g_direct_equal);
+    memset(local, 0, sizeof *local);
+    qemu_ram_foreach_block(qemu_rdma_init_one_block, rdma);
+    DPRINTF("Allocated %d local ram block structures\n", local->nb_blocks);
+    rdma->block = (RDMARemoteBlock *) g_malloc0(sizeof(RDMARemoteBlock) *
+                        rdma->local_ram_blocks.nb_blocks);
+    local->init = true;
+    return 0;
+}
+
+static int __qemu_rdma_delete_block(RDMAContext *rdma, ram_addr_t block_offset)
+{
+    RDMALocalBlocks *local = &rdma->local_ram_blocks;
+    RDMALocalBlock *block = g_hash_table_lookup(rdma->blockmap,
+        (void *) block_offset);
+    RDMALocalBlock *old = local->block;
+    int x;
+
+    assert(block);
+
+    if (block->pmr) {
+        int j;
+
+        for (j = 0; j < block->nb_chunks; j++) {
+            if (!block->pmr[j]) {
+                continue;
+            }
+            ibv_dereg_mr(block->pmr[j]);
+            rdma->total_registrations--;
+        }
+        g_free(block->pmr);
+        block->pmr = NULL;
+    }
+
+    if (block->mr) {
+        ibv_dereg_mr(block->mr);
+        rdma->total_registrations--;
+        block->mr = NULL;
+    }
+
+    g_free(block->transit_bitmap);
+    block->transit_bitmap = NULL;
+
+    g_free(block->unregister_bitmap);
+    block->unregister_bitmap = NULL;
+
+    g_free(block->remote_keys);
+    block->remote_keys = NULL;
+
+    for (x = 0; x < local->nb_blocks; x++) {
+        g_hash_table_remove(rdma->blockmap, (void *)old[x].offset);
+    }
+
+    if (local->nb_blocks > 1) {
+
+        local->block = g_malloc0(sizeof(RDMALocalBlock) *
+                                    (local->nb_blocks - 1));
+
+        if (block->index) {
+            memcpy(local->block, old, sizeof(RDMALocalBlock) * block->index);
+        }
+
+        if (block->index < (local->nb_blocks - 1)) {
+            memcpy(local->block + block->index, old + (block->index + 1),
+                sizeof(RDMALocalBlock) *
+                    (local->nb_blocks - (block->index + 1)));
+        }
+    } else {
+        assert(block == local->block);
+        local->block = NULL;
+    }
+
+    DDPRINTF("Deleted Block: %d, addr: %" PRIu64 ", offset: %" PRIu64
+           " length: %" PRIu64 " end: %" PRIu64 " bits %" PRIu64 " chunks %d\n",
+            local->nb_blocks, (uint64_t) block->local_host_addr, block->offset,
+            block->length, (uint64_t) (block->local_host_addr + block->length),
+                BITS_TO_LONGS(block->nb_chunks) *
+                    sizeof(unsigned long) * 8, block->nb_chunks);
+
+    g_free(old);
+
+    local->nb_blocks--;
+
+    if (local->nb_blocks) {
+        for (x = 0; x < local->nb_blocks; x++) {
+            g_hash_table_insert(rdma->blockmap, (void *)local->block[x].offset,
+                                                &local->block[x]);
+        }
+    }
+
+    return 0;
+}
+
+/*
+ * Put in the log file which RDMA device was opened and the details
+ * associated with that device.
+ */
+static void qemu_rdma_dump_id(const char *who, struct ibv_context *verbs)
+{
+    printf("%s RDMA Device opened: kernel name %s "
+           "uverbs device name %s, "
+           "infiniband_verbs class device path %s,"
+           " infiniband class device path %s\n",
+                who,
+                verbs->device->name,
+                verbs->device->dev_name,
+                verbs->device->dev_path,
+                verbs->device->ibdev_path);
+}
+
+/*
+ * Put in the log file the RDMA gid addressing information,
+ * useful for folks who have trouble understanding the
+ * RDMA device hierarchy in the kernel.
+ */
+static void qemu_rdma_dump_gid(const char *who, struct rdma_cm_id *id)
+{
+    char sgid[33];
+    char dgid[33];
+    inet_ntop(AF_INET6, &id->route.addr.addr.ibaddr.sgid, sgid, sizeof sgid);
+    inet_ntop(AF_INET6, &id->route.addr.addr.ibaddr.dgid, dgid, sizeof dgid);
+    DPRINTF("%s Source GID: %s, Dest GID: %s\n", who, sgid, dgid);
+}
+
+/*
+ * Figure out which RDMA device corresponds to the requested IP hostname
+ * Also create the initial connection manager identifiers for opening
+ * the connection.
+ */
+static int qemu_rdma_resolve_host(RDMAContext *rdma, Error **errp)
+{
+    int ret;
+    struct addrinfo *res;
+    char port_str[16];
+    struct rdma_cm_event *cm_event;
+    char ip[40] = "unknown";
+
+    if (rdma->host == NULL || !strcmp(rdma->host, "")) {
+        ERROR(errp, "RDMA hostname has not been set\n");
+        return -1;
+    }
+
+    /* create CM channel */
+    rdma->channel = rdma_create_event_channel();
+    if (!rdma->channel) {
+        ERROR(errp, "could not create CM channel\n");
+        return -1;
+    }
+
+    /* create CM id */
+    ret = rdma_create_id(rdma->channel, &rdma->cm_id, NULL, RDMA_PS_TCP);
+    if (ret) {
+        ERROR(errp, "could not create channel id\n");
+        goto err_resolve_create_id;
+    }
+
+    snprintf(port_str, 16, "%d", rdma->port);
+    port_str[15] = '\0';
+
+    ret = getaddrinfo(rdma->host, port_str, NULL, &res);
+    if (ret < 0) {
+        ERROR(errp, "could not getaddrinfo address %s\n", rdma->host);
+        goto err_resolve_get_addr;
+    }
+
+    inet_ntop(AF_INET, &((struct sockaddr_in *) res->ai_addr)->sin_addr,
+                                ip, sizeof ip);
+    DPRINTF("%s => %s\n", rdma->host, ip);
+
+    /* resolve the first address */
+    ret = rdma_resolve_addr(rdma->cm_id, NULL, res->ai_addr,
+            RDMA_RESOLVE_TIMEOUT_MS);
+    if (ret) {
+        ERROR(errp, "could not resolve address %s\n", rdma->host);
+        goto err_resolve_get_addr;
+    }
+
+    qemu_rdma_dump_gid("source_resolve_addr", rdma->cm_id);
+
+    ret = rdma_get_cm_event(rdma->channel, &cm_event);
+    if (ret) {
+        ERROR(errp, "could not perform event_addr_resolved\n");
+        goto err_resolve_get_addr;
+    }
+
+    if (cm_event->event != RDMA_CM_EVENT_ADDR_RESOLVED) {
+        ERROR(errp, "result not equal to event_addr_resolved %s\n",
+                rdma_event_str(cm_event->event));
+        perror("rdma_resolve_addr");
+        goto err_resolve_get_addr;
+    }
+    rdma_ack_cm_event(cm_event);
+
+    /* resolve route */
+    ret = rdma_resolve_route(rdma->cm_id, RDMA_RESOLVE_TIMEOUT_MS);
+    if (ret) {
+        ERROR(errp, "could not resolve rdma route\n");
+        goto err_resolve_get_addr;
+    }
+
+    ret = rdma_get_cm_event(rdma->channel, &cm_event);
+    if (ret) {
+        ERROR(errp, "could not perform event_route_resolved\n");
+        goto err_resolve_get_addr;
+    }
+    if (cm_event->event != RDMA_CM_EVENT_ROUTE_RESOLVED) {
+        ERROR(errp, "result not equal to event_route_resolved: %s\n",
+                        rdma_event_str(cm_event->event));
+        rdma_ack_cm_event(cm_event);
+        goto err_resolve_get_addr;
+    }
+    rdma_ack_cm_event(cm_event);
+    rdma->verbs = rdma->cm_id->verbs;
+    qemu_rdma_dump_id("source_resolve_host", rdma->cm_id->verbs);
+    qemu_rdma_dump_gid("source_resolve_host", rdma->cm_id);
+    return 0;
+
+err_resolve_get_addr:
+    rdma_destroy_id(rdma->cm_id);
+    rdma->cm_id = NULL;
+err_resolve_create_id:
+    rdma_destroy_event_channel(rdma->channel);
+    rdma->channel = NULL;
+
+    return -1;
+}
+
+/*
+ * Create protection domain and completion queues
+ */
+static int qemu_rdma_alloc_pd_cq(RDMAContext *rdma)
+{
+    /* allocate pd */
+    rdma->pd = ibv_alloc_pd(rdma->verbs);
+    if (!rdma->pd) {
+        fprintf(stderr, "failed to allocate protection domain\n");
+        return -1;
+    }
+
+    /* create completion channel */
+    rdma->comp_channel = ibv_create_comp_channel(rdma->verbs);
+    if (!rdma->comp_channel) {
+        fprintf(stderr, "failed to allocate completion channel\n");
+        goto err_alloc_pd_cq;
+    }
+
+    /*
+     * Completion queue can be filled by both read and write work requests,
+     * so must reflect the sum of both possible queue sizes.
+     */
+    rdma->cq = ibv_create_cq(rdma->verbs, (RDMA_SIGNALED_SEND_MAX * 3),
+            NULL, rdma->comp_channel, 0);
+    if (!rdma->cq) {
+        fprintf(stderr, "failed to allocate completion queue\n");
+        goto err_alloc_pd_cq;
+    }
+
+    return 0;
+
+err_alloc_pd_cq:
+    if (rdma->pd) {
+        ibv_dealloc_pd(rdma->pd);
+    }
+    if (rdma->comp_channel) {
+        ibv_destroy_comp_channel(rdma->comp_channel);
+    }
+    rdma->pd = NULL;
+    rdma->comp_channel = NULL;
+    return -1;
+
+}
+
+/*
+ * Create queue pairs.
+ */
+static int qemu_rdma_alloc_qp(RDMAContext *rdma)
+{
+    struct ibv_qp_init_attr attr = { 0 };
+    int ret;
+
+    attr.cap.max_send_wr = RDMA_SIGNALED_SEND_MAX;
+    attr.cap.max_recv_wr = 3;
+    attr.cap.max_send_sge = 1;
+    attr.cap.max_recv_sge = 1;
+    attr.send_cq = rdma->cq;
+    attr.recv_cq = rdma->cq;
+    attr.qp_type = IBV_QPT_RC;
+
+    ret = rdma_create_qp(rdma->cm_id, rdma->pd, &attr);
+    if (ret) {
+        return -1;
+    }
+
+    rdma->qp = rdma->cm_id->qp;
+    return 0;
+}
+
+static int qemu_rdma_reg_whole_ram_blocks(RDMAContext *rdma)
+{
+    int i;
+    RDMALocalBlocks *local = &rdma->local_ram_blocks;
+
+    for (i = 0; i < local->nb_blocks; i++) {
+        local->block[i].mr =
+            ibv_reg_mr(rdma->pd,
+                    local->block[i].local_host_addr,
+                    local->block[i].length,
+                    IBV_ACCESS_LOCAL_WRITE |
+                    IBV_ACCESS_REMOTE_WRITE
+                    );
+        if (!local->block[i].mr) {
+            perror("Failed to register local dest ram block!\n");
+            break;
+        }
+        rdma->total_registrations++;
+    }
+
+    if (i >= local->nb_blocks) {
+        return 0;
+    }
+
+    for (i--; i >= 0; i--) {
+        ibv_dereg_mr(local->block[i].mr);
+        rdma->total_registrations--;
+    }
+
+    return -1;
+
+}
+
+/*
+ * Find the ram block that corresponds to the page requested to be
+ * transmitted by QEMU.
+ *
+ * Once the block is found, also identify which 'chunk' within that
+ * block that the page belongs to.
+ *
+ * This search cannot fail or the migration will fail.
+ */
+static int qemu_rdma_search_ram_block(RDMAContext *rdma,
+                                      uint64_t block_offset,
+                                      uint64_t offset,
+                                      uint64_t length,
+                                      uint64_t *block_index,
+                                      uint64_t *chunk_index)
+{
+    uint64_t current_addr = block_offset + offset;
+    RDMALocalBlock *block = g_hash_table_lookup(rdma->blockmap,
+                                                (void *) block_offset);
+    assert(block);
+    assert(current_addr >= block->offset);
+    assert((current_addr + length) <= (block->offset + block->length));
+
+    *block_index = block->index;
+    *chunk_index = ram_chunk_index(block->local_host_addr,
+                block->local_host_addr + (current_addr - block->offset));
+
+    return 0;
+}
+
+/*
+ * Register a chunk with IB. If the chunk was already registered
+ * previously, then skip.
+ *
+ * Also return the keys associated with the registration needed
+ * to perform the actual RDMA operation.
+ */
+static int qemu_rdma_register_and_get_keys(RDMAContext *rdma,
+        RDMALocalBlock *block, uint8_t *host_addr,
+        uint32_t *lkey, uint32_t *rkey, int chunk,
+        uint8_t *chunk_start, uint8_t *chunk_end)
+{
+    if (block->mr) {
+        if (lkey) {
+            *lkey = block->mr->lkey;
+        }
+        if (rkey) {
+            *rkey = block->mr->rkey;
+        }
+        return 0;
+    }
+
+    /* allocate memory to store chunk MRs */
+    if (!block->pmr) {
+        block->pmr = g_malloc0(block->nb_chunks * sizeof(struct ibv_mr *));
+        if (!block->pmr) {
+            return -1;
+        }
+    }
+
+    /*
+     * If 'rkey', then we're the destination, so grant access to the source.
+     *
+     * If 'lkey', then we're the source VM, so grant access only to ourselves.
+     */
+    if (!block->pmr[chunk]) {
+        uint64_t len = chunk_end - chunk_start;
+
+        DDPRINTF("Registering %" PRIu64 " bytes @ %p\n",
+                 len, chunk_start);
+
+        block->pmr[chunk] = ibv_reg_mr(rdma->pd,
+                chunk_start, len,
+                (rkey ? (IBV_ACCESS_LOCAL_WRITE |
+                        IBV_ACCESS_REMOTE_WRITE) : 0));
+
+        if (!block->pmr[chunk]) {
+            perror("Failed to register chunk!");
+            fprintf(stderr, "Chunk details: block: %d chunk index %d"
+                            " start %" PRIu64 " end %" PRIu64 " host %" PRIu64
+                            " local %" PRIu64 " registrations: %d\n",
+                            block->index, chunk, (uint64_t) chunk_start,
+                            (uint64_t) chunk_end, (uint64_t) host_addr,
+                            (uint64_t) block->local_host_addr,
+                            rdma->total_registrations);
+            return -1;
+        }
+        rdma->total_registrations++;
+    }
+
+    if (lkey) {
+        *lkey = block->pmr[chunk]->lkey;
+    }
+    if (rkey) {
+        *rkey = block->pmr[chunk]->rkey;
+    }
+    return 0;
+}
+
+/*
+ * Register (at connection time) the memory used for control
+ * channel messages.
+ */
+static int qemu_rdma_reg_control(RDMAContext *rdma, int idx)
+{
+    rdma->wr_data[idx].control_mr = ibv_reg_mr(rdma->pd,
+            rdma->wr_data[idx].control, RDMA_CONTROL_MAX_BUFFER,
+            IBV_ACCESS_LOCAL_WRITE | IBV_ACCESS_REMOTE_WRITE);
+    if (rdma->wr_data[idx].control_mr) {
+        rdma->total_registrations++;
+        return 0;
+    }
+    fprintf(stderr, "qemu_rdma_reg_control failed!\n");
+    return -1;
+}
+
+const char *print_wrid(int wrid)
+{
+    if (wrid >= RDMA_WRID_RECV_CONTROL) {
+        return wrid_desc[RDMA_WRID_RECV_CONTROL];
+    }
+    return wrid_desc[wrid];
+}
+
+/*
+ * RDMA requires memory registration (mlock/pinning), but this is not good for
+ * overcommitment.
+ *
+ * In preparation for the future where LRU information or workload-specific
+ * writable writable working set memory access behavior is available to QEMU
+ * it would be nice to have in place the ability to UN-register/UN-pin
+ * particular memory regions from the RDMA hardware when it is determine that
+ * those regions of memory will likely not be accessed again in the near future.
+ *
+ * While we do not yet have such information right now, the following
+ * compile-time option allows us to perform a non-optimized version of this
+ * behavior.
+ *
+ * By uncommenting this option, you will cause *all* RDMA transfers to be
+ * unregistered immediately after the transfer completes on both sides of the
+ * connection. This has no effect in 'rdma-pin-all' mode, only regular mode.
+ *
+ * This will have a terrible impact on migration performance, so until future
+ * workload information or LRU information is available, do not attempt to use
+ * this feature except for basic testing.
+ */
+//#define RDMA_UNREGISTRATION_EXAMPLE
+
+/*
+ * Perform a non-optimized memory unregistration after every transfer
+ * for demonsration purposes, only if pin-all is not requested.
+ *
+ * Potential optimizations:
+ * 1. Start a new thread to run this function continuously
+        - for bit clearing
+        - and for receipt of unregister messages
+ * 2. Use an LRU.
+ * 3. Use workload hints.
+ */
+static int qemu_rdma_unregister_waiting(RDMAContext *rdma)
+{
+    while (rdma->unregistrations[rdma->unregister_current]) {
+        int ret;
+        uint64_t wr_id = rdma->unregistrations[rdma->unregister_current];
+        uint64_t chunk =
+            (wr_id & RDMA_WRID_CHUNK_MASK) >> RDMA_WRID_CHUNK_SHIFT;
+        uint64_t index =
+            (wr_id & RDMA_WRID_BLOCK_MASK) >> RDMA_WRID_BLOCK_SHIFT;
+        RDMALocalBlock *block =
+            &(rdma->local_ram_blocks.block[index]);
+        RDMARegister reg = { .current_index = index };
+        RDMAControlHeader resp = { .type = RDMA_CONTROL_UNREGISTER_FINISHED,
+                                 };
+        RDMAControlHeader head = { .len = sizeof(RDMARegister),
+                                   .type = RDMA_CONTROL_UNREGISTER_REQUEST,
+                                   .repeat = 1,
+                                 };
+
+        DDPRINTF("Processing unregister for chunk: %" PRIu64
+                 " at position %d\n", chunk, rdma->unregister_current);
+
+        rdma->unregistrations[rdma->unregister_current] = 0;
+        rdma->unregister_current++;
+
+        if (rdma->unregister_current == RDMA_SIGNALED_SEND_MAX) {
+            rdma->unregister_current = 0;
+        }
+
+
+        /*
+         * Unregistration is speculative (because migration is single-threaded
+         * and we cannot break the protocol's inifinband message ordering).
+         * Thus, if the memory is currently being used for transmission,
+         * then abort the attempt to unregister and try again
+         * later the next time a completion is received for this memory.
+         */
+        clear_bit(chunk, block->unregister_bitmap);
+
+        if (test_bit(chunk, block->transit_bitmap)) {
+            DDPRINTF("Cannot unregister inflight chunk: %" PRIu64 "\n", chunk);
+            continue;
+        }
+
+        DDPRINTF("Sending unregister for chunk: %" PRIu64 "\n", chunk);
+
+        ret = ibv_dereg_mr(block->pmr[chunk]);
+        block->pmr[chunk] = NULL;
+        block->remote_keys[chunk] = 0;
+
+        if (ret != 0) {
+            perror("unregistration chunk failed");
+            return -ret;
+        }
+        rdma->total_registrations--;
+
+        reg.key.chunk = chunk;
+        register_to_network(&reg);
+        ret = qemu_rdma_exchange_send(rdma, &head, (uint8_t *) &reg,
+                                &resp, NULL, NULL);
+        if (ret < 0) {
+            return ret;
+        }
+
+        DDPRINTF("Unregister for chunk: %" PRIu64 " complete.\n", chunk);
+    }
+
+    return 0;
+}
+
+static uint64_t qemu_rdma_make_wrid(uint64_t wr_id, uint64_t index,
+                                         uint64_t chunk)
+{
+    uint64_t result = wr_id & RDMA_WRID_TYPE_MASK;
+
+    result |= (index << RDMA_WRID_BLOCK_SHIFT);
+    result |= (chunk << RDMA_WRID_CHUNK_SHIFT);
+
+    return result;
+}
+
+/*
+ * Set bit for unregistration in the next iteration.
+ * We cannot transmit right here, but will unpin later.
+ */
+static void qemu_rdma_signal_unregister(RDMAContext *rdma, uint64_t index,
+                                        uint64_t chunk, uint64_t wr_id)
+{
+    if (rdma->unregistrations[rdma->unregister_next] != 0) {
+        fprintf(stderr, "rdma migration: queue is full!\n");
+    } else {
+        RDMALocalBlock *block = &(rdma->local_ram_blocks.block[index]);
+
+        if (!test_and_set_bit(chunk, block->unregister_bitmap)) {
+            DDPRINTF("Appending unregister chunk %" PRIu64
+                    " at position %d\n", chunk, rdma->unregister_next);
+
+            rdma->unregistrations[rdma->unregister_next++] =
+                    qemu_rdma_make_wrid(wr_id, index, chunk);
+
+            if (rdma->unregister_next == RDMA_SIGNALED_SEND_MAX) {
+                rdma->unregister_next = 0;
+            }
+        } else {
+            DDPRINTF("Unregister chunk %" PRIu64 " already in queue.\n",
+                    chunk);
+        }
+    }
+}
+
+/*
+ * Consult the connection manager to see a work request
+ * (of any kind) has completed.
+ * Return the work request ID that completed.
+ */
+static uint64_t qemu_rdma_poll(RDMAContext *rdma, uint64_t *wr_id_out)
+{
+    int ret;
+    struct ibv_wc wc;
+    uint64_t wr_id;
+
+    ret = ibv_poll_cq(rdma->cq, 1, &wc);
+
+    if (!ret) {
+        *wr_id_out = RDMA_WRID_NONE;
+        return 0;
+    }
+
+    if (ret < 0) {
+        fprintf(stderr, "ibv_poll_cq return %d!\n", ret);
+        return ret;
+    }
+
+    wr_id = wc.wr_id & RDMA_WRID_TYPE_MASK;
+
+    if (wc.status != IBV_WC_SUCCESS) {
+        fprintf(stderr, "ibv_poll_cq wc.status=%d %s!\n",
+                        wc.status, ibv_wc_status_str(wc.status));
+        fprintf(stderr, "ibv_poll_cq wrid=%s!\n", wrid_desc[wr_id]);
+
+        return -1;
+    }
+
+    if (rdma->control_ready_expected &&
+        (wr_id >= RDMA_WRID_RECV_CONTROL)) {
+        DDDPRINTF("completion %s #%" PRId64 " received (%" PRId64 ")"
+                  " left %d\n", wrid_desc[RDMA_WRID_RECV_CONTROL],
+                  wr_id - RDMA_WRID_RECV_CONTROL, wr_id, rdma->nb_sent);
+        rdma->control_ready_expected = 0;
+    }
+
+    if (wr_id == RDMA_WRID_RDMA_WRITE) {
+        uint64_t chunk =
+            (wc.wr_id & RDMA_WRID_CHUNK_MASK) >> RDMA_WRID_CHUNK_SHIFT;
+        uint64_t index =
+            (wc.wr_id & RDMA_WRID_BLOCK_MASK) >> RDMA_WRID_BLOCK_SHIFT;
+        RDMALocalBlock *block = &(rdma->local_ram_blocks.block[index]);
+
+        DDDPRINTF("completions %s (%" PRId64 ") left %d, "
+                 "block %" PRIu64 ", chunk: %" PRIu64 " %p %p\n",
+                 print_wrid(wr_id), wr_id, rdma->nb_sent, index, chunk,
+                 block->local_host_addr, (void *)block->remote_host_addr);
+
+        clear_bit(chunk, block->transit_bitmap);
+
+        if (rdma->nb_sent > 0) {
+            rdma->nb_sent--;
+        }
+
+        if (!rdma->pin_all) {
+            /*
+             * FYI: If one wanted to signal a specific chunk to be unregistered
+             * using LRU or workload-specific information, this is the function
+             * you would call to do so. That chunk would then get asynchronously
+             * unregistered later.
+             */
+#ifdef RDMA_UNREGISTRATION_EXAMPLE
+            qemu_rdma_signal_unregister(rdma, index, chunk, wc.wr_id);
+#endif
+        }
+    } else {
+        DDDPRINTF("other completion %s (%" PRId64 ") received left %d\n",
+            print_wrid(wr_id), wr_id, rdma->nb_sent);
+    }
+
+    *wr_id_out = wc.wr_id;
+
+    return  0;
+}
+
+/*
+ * Block until the next work request has completed.
+ *
+ * First poll to see if a work request has already completed,
+ * otherwise block.
+ *
+ * If we encounter completed work requests for IDs other than
+ * the one we're interested in, then that's generally an error.
+ *
+ * The only exception is actual RDMA Write completions. These
+ * completions only need to be recorded, but do not actually
+ * need further processing.
+ */
+static int qemu_rdma_block_for_wrid(RDMAContext *rdma, int wrid_requested)
+{
+    int num_cq_events = 0, ret = 0;
+    struct ibv_cq *cq;
+    void *cq_ctx;
+    uint64_t wr_id = RDMA_WRID_NONE, wr_id_in;
+
+    if (ibv_req_notify_cq(rdma->cq, 0)) {
+        return -1;
+    }
+    /* poll cq first */
+    while (wr_id != wrid_requested) {
+        ret = qemu_rdma_poll(rdma, &wr_id_in);
+        if (ret < 0) {
+            return ret;
+        }
+
+        wr_id = wr_id_in & RDMA_WRID_TYPE_MASK;
+
+        if (wr_id == RDMA_WRID_NONE) {
+            break;
+        }
+        if (wr_id != wrid_requested) {
+            DDDPRINTF("A Wanted wrid %s (%d) but got %s (%" PRIu64 ")\n",
+                print_wrid(wrid_requested),
+                wrid_requested, print_wrid(wr_id), wr_id);
+        }
+    }
+
+    if (wr_id == wrid_requested) {
+        return 0;
+    }
+
+    while (1) {
+        /*
+         * Coroutine doesn't start until process_incoming_migration()
+         * so don't yield unless we know we're running inside of a coroutine.
+         */
+        if (rdma->migration_started_on_destination) {
+            yield_until_fd_readable(rdma->comp_channel->fd);
+        }
+
+        if (ibv_get_cq_event(rdma->comp_channel, &cq, &cq_ctx)) {
+            perror("ibv_get_cq_event");
+            goto err_block_for_wrid;
+        }
+
+        num_cq_events++;
+
+        if (ibv_req_notify_cq(cq, 0)) {
+            goto err_block_for_wrid;
+        }
+
+        while (wr_id != wrid_requested) {
+            ret = qemu_rdma_poll(rdma, &wr_id_in);
+            if (ret < 0) {
+                goto err_block_for_wrid;
+            }
+
+            wr_id = wr_id_in & RDMA_WRID_TYPE_MASK;
+
+            if (wr_id == RDMA_WRID_NONE) {
+                break;
+            }
+            if (wr_id != wrid_requested) {
+                DDDPRINTF("B Wanted wrid %s (%d) but got %s (%" PRIu64 ")\n",
+                    print_wrid(wrid_requested), wrid_requested,
+                    print_wrid(wr_id), wr_id);
+            }
+        }
+
+        if (wr_id == wrid_requested) {
+            goto success_block_for_wrid;
+        }
+    }
+
+success_block_for_wrid:
+    if (num_cq_events) {
+        ibv_ack_cq_events(cq, num_cq_events);
+    }
+    return 0;
+
+err_block_for_wrid:
+    if (num_cq_events) {
+        ibv_ack_cq_events(cq, num_cq_events);
+    }
+    return ret;
+}
+
+/*
+ * Post a SEND message work request for the control channel
+ * containing some data and block until the post completes.
+ */
+static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
+                                       RDMAControlHeader *head)
+{
+    int ret = 0;
+    RDMAWorkRequestData *wr = &rdma->wr_data[RDMA_WRID_MAX];
+    struct ibv_send_wr *bad_wr;
+    struct ibv_sge sge = {
+                           .addr = (uint64_t)(wr->control),
+                           .length = head->len + sizeof(RDMAControlHeader),
+                           .lkey = wr->control_mr->lkey,
+                         };
+    struct ibv_send_wr send_wr = {
+                                   .wr_id = RDMA_WRID_SEND_CONTROL,
+                                   .opcode = IBV_WR_SEND,
+                                   .send_flags = IBV_SEND_SIGNALED,
+                                   .sg_list = &sge,
+                                   .num_sge = 1,
+                                };
+
+    DDDPRINTF("CONTROL: sending %s..\n", control_desc[head->type]);
+
+    /*
+     * We don't actually need to do a memcpy() in here if we used
+     * the "sge" properly, but since we're only sending control messages
+     * (not RAM in a performance-critical path), then its OK for now.
+     *
+     * The copy makes the RDMAControlHeader simpler to manipulate
+     * for the time being.
+     */
+    memcpy(wr->control, head, sizeof(RDMAControlHeader));
+    control_to_network((void *) wr->control);
+
+    if (buf) {
+        memcpy(wr->control + sizeof(RDMAControlHeader), buf, head->len);
+    }
+
+
+    if (ibv_post_send(rdma->qp, &send_wr, &bad_wr)) {
+        return -1;
+    }
+
+    if (ret < 0) {
+        fprintf(stderr, "Failed to use post IB SEND for control!\n");
+        return ret;
+    }
+
+    ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_SEND_CONTROL);
+    if (ret < 0) {
+        fprintf(stderr, "rdma migration: send polling control error!\n");
+    }
+
+    return ret;
+}
+
+/*
+ * Post a RECV work request in anticipation of some future receipt
+ * of data on the control channel.
+ */
+static int qemu_rdma_post_recv_control(RDMAContext *rdma, int idx)
+{
+    struct ibv_recv_wr *bad_wr;
+    struct ibv_sge sge = {
+                            .addr = (uint64_t)(rdma->wr_data[idx].control),
+                            .length = RDMA_CONTROL_MAX_BUFFER,
+                            .lkey = rdma->wr_data[idx].control_mr->lkey,
+                         };
+
+    struct ibv_recv_wr recv_wr = {
+                                    .wr_id = RDMA_WRID_RECV_CONTROL + idx,
+                                    .sg_list = &sge,
+                                    .num_sge = 1,
+                                 };
+
+
+    if (ibv_post_recv(rdma->qp, &recv_wr, &bad_wr)) {
+        return -1;
+    }
+
+    return 0;
+}
+
+/*
+ * Block and wait for a RECV control channel message to arrive.
+ */
+static int qemu_rdma_exchange_get_response(RDMAContext *rdma,
+                RDMAControlHeader *head, int expecting, int idx)
+{
+    int ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RECV_CONTROL + idx);
+
+    if (ret < 0) {
+        fprintf(stderr, "rdma migration: recv polling control error!\n");
+        return ret;
+    }
+
+    network_to_control((void *) rdma->wr_data[idx].control);
+    memcpy(head, rdma->wr_data[idx].control, sizeof(RDMAControlHeader));
+
+    DDDPRINTF("CONTROL: %s receiving...\n", control_desc[expecting]);
+
+    if (expecting == RDMA_CONTROL_NONE) {
+        DDDPRINTF("Surprise: got %s (%d)\n",
+                  control_desc[head->type], head->type);
+    } else if (head->type != expecting || head->type == RDMA_CONTROL_ERROR) {
+        fprintf(stderr, "Was expecting a %s (%d) control message"
+                ", but got: %s (%d), length: %d\n",
+                control_desc[expecting], expecting,
+                control_desc[head->type], head->type, head->len);
+        return -EIO;
+    }
+
+    return 0;
+}
+
+/*
+ * When a RECV work request has completed, the work request's
+ * buffer is pointed at the header.
+ *
+ * This will advance the pointer to the data portion
+ * of the control message of the work request's buffer that
+ * was populated after the work request finished.
+ */
+static void qemu_rdma_move_header(RDMAContext *rdma, int idx,
+                                  RDMAControlHeader *head)
+{
+    rdma->wr_data[idx].control_len = head->len;
+    rdma->wr_data[idx].control_curr =
+        rdma->wr_data[idx].control + sizeof(RDMAControlHeader);
+}
+
+/*
+ * This is an 'atomic' high-level operation to deliver a single, unified
+ * control-channel message.
+ *
+ * Additionally, if the user is expecting some kind of reply to this message,
+ * they can request a 'resp' response message be filled in by posting an
+ * additional work request on behalf of the user and waiting for an additional
+ * completion.
+ *
+ * The extra (optional) response is used during registration to us from having
+ * to perform an *additional* exchange of message just to provide a response by
+ * instead piggy-backing on the acknowledgement.
+ */
+static int qemu_rdma_exchange_send(RDMAContext *rdma, RDMAControlHeader *head,
+                                   uint8_t *data, RDMAControlHeader *resp,
+                                   int *resp_idx,
+                                   int (*callback)(RDMAContext *rdma))
+{
+    int ret = 0;
+
+    /*
+     * Wait until the dest is ready before attempting to deliver the message
+     * by waiting for a READY message.
+     */
+    if (rdma->control_ready_expected) {
+        RDMAControlHeader resp;
+        ret = qemu_rdma_exchange_get_response(rdma,
+                                    &resp, RDMA_CONTROL_READY, RDMA_WRID_READY);
+        if (ret < 0) {
+            return ret;
+        }
+    }
+
+    /*
+     * If the user is expecting a response, post a WR in anticipation of it.
+     */
+    if (resp) {
+        ret = qemu_rdma_post_recv_control(rdma, RDMA_WRID_DATA);
+        if (ret) {
+            fprintf(stderr, "rdma migration: error posting"
+                    " extra control recv for anticipated result!");
+            return ret;
+        }
+    }
+
+    /*
+     * Post a WR to replace the one we just consumed for the READY message.
+     */
+    ret = qemu_rdma_post_recv_control(rdma, RDMA_WRID_READY);
+    if (ret) {
+        fprintf(stderr, "rdma migration: error posting first control recv!");
+        return ret;
+    }
+
+    /*
+     * Deliver the control message that was requested.
+     */
+    ret = qemu_rdma_post_send_control(rdma, data, head);
+
+    if (ret < 0) {
+        fprintf(stderr, "Failed to send control buffer!\n");
+        return ret;
+    }
+
+    /*
+     * If we're expecting a response, block and wait for it.
+     */
+    if (resp) {
+        if (callback) {
+            DDPRINTF("Issuing callback before receiving response...\n");
+            ret = callback(rdma);
+            if (ret < 0) {
+                return ret;
+            }
+        }
+
+        DDPRINTF("Waiting for response %s\n", control_desc[resp->type]);
+        ret = qemu_rdma_exchange_get_response(rdma, resp,
+                                              resp->type, RDMA_WRID_DATA);
+
+        if (ret < 0) {
+            return ret;
+        }
+
+        qemu_rdma_move_header(rdma, RDMA_WRID_DATA, resp);
+        if (resp_idx) {
+            *resp_idx = RDMA_WRID_DATA;
+        }
+        DDPRINTF("Response %s received.\n", control_desc[resp->type]);
+    }
+
+    rdma->control_ready_expected = 1;
+
+    return 0;
+}
+
+/*
+ * This is an 'atomic' high-level operation to receive a single, unified
+ * control-channel message.
+ */
+static int qemu_rdma_exchange_recv(RDMAContext *rdma, RDMAControlHeader *head,
+                                int expecting)
+{
+    RDMAControlHeader ready = {
+                                .len = 0,
+                                .type = RDMA_CONTROL_READY,
+                                .repeat = 1,
+                              };
+    int ret;
+
+    /*
+     * Inform the source that we're ready to receive a message.
+     */
+    ret = qemu_rdma_post_send_control(rdma, NULL, &ready);
+
+    if (ret < 0) {
+        fprintf(stderr, "Failed to send control buffer!\n");
+        return ret;
+    }
+
+    /*
+     * Block and wait for the message.
+     */
+    ret = qemu_rdma_exchange_get_response(rdma, head,
+                                          expecting, RDMA_WRID_READY);
+
+    if (ret < 0) {
+        return ret;
+    }
+
+    qemu_rdma_move_header(rdma, RDMA_WRID_READY, head);
+
+    /*
+     * Post a new RECV work request to replace the one we just consumed.
+     */
+    ret = qemu_rdma_post_recv_control(rdma, RDMA_WRID_READY);
+    if (ret) {
+        fprintf(stderr, "rdma migration: error posting second control recv!");
+        return ret;
+    }
+
+    return 0;
+}
+
+/*
+ * Write an actual chunk of memory using RDMA.
+ *
+ * If we're using dynamic registration on the dest-side, we have to
+ * send a registration command first.
+ */
+static int qemu_rdma_write_one(QEMUFile *f, RDMAContext *rdma,
+                               int current_index, uint64_t current_addr,
+                               uint64_t length)
+{
+    struct ibv_sge sge;
+    struct ibv_send_wr send_wr = { 0 };
+    struct ibv_send_wr *bad_wr;
+    int reg_result_idx, ret, count = 0;
+    uint64_t chunk, chunks;
+    uint8_t *chunk_start, *chunk_end;
+    RDMALocalBlock *block = &(rdma->local_ram_blocks.block[current_index]);
+    RDMARegister reg;
+    RDMARegisterResult *reg_result;
+    RDMAControlHeader resp = { .type = RDMA_CONTROL_REGISTER_RESULT };
+    RDMAControlHeader head = { .len = sizeof(RDMARegister),
+                               .type = RDMA_CONTROL_REGISTER_REQUEST,
+                               .repeat = 1,
+                             };
+
+retry:
+    sge.addr = (uint64_t)(block->local_host_addr +
+                            (current_addr - block->offset));
+    sge.length = length;
+
+    chunk = ram_chunk_index(block->local_host_addr, (uint8_t *) sge.addr);
+    chunk_start = ram_chunk_start(block, chunk);
+
+    if (block->is_ram_block) {
+        chunks = length / (1UL << RDMA_REG_CHUNK_SHIFT);
+
+        if (chunks && ((length % (1UL << RDMA_REG_CHUNK_SHIFT)) == 0)) {
+            chunks--;
+        }
+    } else {
+        chunks = block->length / (1UL << RDMA_REG_CHUNK_SHIFT);
+
+        if (chunks && ((block->length % (1UL << RDMA_REG_CHUNK_SHIFT)) == 0)) {
+            chunks--;
+        }
+    }
+
+    DDPRINTF("Writing %" PRIu64 " chunks, (%" PRIu64 " MB)\n",
+        chunks + 1, (chunks + 1) * (1UL << RDMA_REG_CHUNK_SHIFT) / 1024 / 1024);
+
+    chunk_end = ram_chunk_end(block, chunk + chunks);
+
+    if (!rdma->pin_all) {
+#ifdef RDMA_UNREGISTRATION_EXAMPLE
+        qemu_rdma_unregister_waiting(rdma);
+#endif
+    }
+
+    while (test_bit(chunk, block->transit_bitmap)) {
+        (void)count;
+        DDPRINTF("(%d) Not clobbering: block: %d chunk %" PRIu64
+                " current %" PRIu64 " len %" PRIu64 " %d %d\n",
+                count++, current_index, chunk,
+                sge.addr, length, rdma->nb_sent, block->nb_chunks);
+
+        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE);
+
+        if (ret < 0) {
+            fprintf(stderr, "Failed to Wait for previous write to complete "
+                    "block %d chunk %" PRIu64
+                    " current %" PRIu64 " len %" PRIu64 " %d\n",
+                    current_index, chunk, sge.addr, length, rdma->nb_sent);
+            return ret;
+        }
+    }
+
+    if (!rdma->pin_all || !block->is_ram_block) {
+        if (!block->remote_keys[chunk]) {
+            /*
+             * This chunk has not yet been registered, so first check to see
+             * if the entire chunk is zero. If so, tell the other size to
+             * memset() + madvise() the entire chunk without RDMA.
+             */
+
+            if (can_use_buffer_find_nonzero_offset((void *)sge.addr, length)
+                   && buffer_find_nonzero_offset((void *)sge.addr,
+                                                    length) == length) {
+                RDMACompress comp = {
+                                        .offset = current_addr,
+                                        .value = 0,
+                                        .block_idx = current_index,
+                                        .length = length,
+                                    };
+
+                head.len = sizeof(comp);
+                head.type = RDMA_CONTROL_COMPRESS;
+
+                DDPRINTF("Entire chunk is zero, sending compress: %"
+                    PRIu64 " for %d "
+                    "bytes, index: %d, offset: %" PRId64 "...\n",
+                    chunk, sge.length, current_index, current_addr);
+
+                compress_to_network(&comp);
+                ret = qemu_rdma_exchange_send(rdma, &head,
+                                (uint8_t *) &comp, NULL, NULL, NULL);
+
+                if (ret < 0) {
+                    return -EIO;
+                }
+
+                acct_update_position(f, sge.length, true);
+
+                return 1;
+            }
+
+            /*
+             * Otherwise, tell other side to register.
+             */
+            reg.current_index = current_index;
+            if (block->is_ram_block) {
+                reg.key.current_addr = current_addr;
+            } else {
+                reg.key.chunk = chunk;
+            }
+            reg.chunks = chunks;
+
+            DDPRINTF("Sending registration request chunk %" PRIu64 " for %d "
+                    "bytes, index: %d, offset: %" PRId64 "...\n",
+                    chunk, sge.length, current_index, current_addr);
+
+            register_to_network(&reg);
+            ret = qemu_rdma_exchange_send(rdma, &head, (uint8_t *) &reg,
+                                    &resp, &reg_result_idx, NULL);
+            if (ret < 0) {
+                return ret;
+            }
+
+            /* try to overlap this single registration with the one we sent. */
+            if (qemu_rdma_register_and_get_keys(rdma, block,
+                                                (uint8_t *) sge.addr,
+                                                &sge.lkey, NULL, chunk,
+                                                chunk_start, chunk_end)) {
+                fprintf(stderr, "cannot get lkey!\n");
+                return -EINVAL;
+            }
+
+            reg_result = (RDMARegisterResult *)
+                    rdma->wr_data[reg_result_idx].control_curr;
+
+            network_to_result(reg_result);
+
+            DDPRINTF("Received registration result:"
+                    " my key: %x their key %x, chunk %" PRIu64 "\n",
+                    block->remote_keys[chunk], reg_result->rkey, chunk);
+
+            block->remote_keys[chunk] = reg_result->rkey;
+            block->remote_host_addr = reg_result->host_addr;
+        } else {
+            /* already registered before */
+            if (qemu_rdma_register_and_get_keys(rdma, block,
+                                                (uint8_t *)sge.addr,
+                                                &sge.lkey, NULL, chunk,
+                                                chunk_start, chunk_end)) {
+                fprintf(stderr, "cannot get lkey!\n");
+                return -EINVAL;
+            }
+        }
+
+        send_wr.wr.rdma.rkey = block->remote_keys[chunk];
+    } else {
+        send_wr.wr.rdma.rkey = block->remote_rkey;
+
+        if (qemu_rdma_register_and_get_keys(rdma, block, (uint8_t *)sge.addr,
+                                                     &sge.lkey, NULL, chunk,
+                                                     chunk_start, chunk_end)) {
+            fprintf(stderr, "cannot get lkey!\n");
+            return -EINVAL;
+        }
+    }
+
+    /*
+     * Encode the ram block index and chunk within this wrid.
+     * We will use this information at the time of completion
+     * to figure out which bitmap to check against and then which
+     * chunk in the bitmap to look for.
+     */
+    send_wr.wr_id = qemu_rdma_make_wrid(RDMA_WRID_RDMA_WRITE,
+                                        current_index, chunk);
+
+    send_wr.opcode = IBV_WR_RDMA_WRITE;
+    send_wr.send_flags = IBV_SEND_SIGNALED;
+    send_wr.sg_list = &sge;
+    send_wr.num_sge = 1;
+    send_wr.wr.rdma.remote_addr = block->remote_host_addr +
+                                (current_addr - block->offset);
+
+    DDDPRINTF("Posting chunk: %" PRIu64 ", addr: %lx"
+              " remote: %lx, bytes %" PRIu32 "\n",
+              chunk, sge.addr, send_wr.wr.rdma.remote_addr,
+              sge.length);
+
+    /*
+     * ibv_post_send() does not return negative error numbers,
+     * per the specification they are positive - no idea why.
+     */
+    ret = ibv_post_send(rdma->qp, &send_wr, &bad_wr);
+
+    if (ret == ENOMEM) {
+        DDPRINTF("send queue is full. wait a little....\n");
+        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE);
+        if (ret < 0) {
+            fprintf(stderr, "rdma migration: failed to make "
+                            "room in full send queue! %d\n", ret);
+            return ret;
+        }
+
+        goto retry;
+
+    } else if (ret > 0) {
+        perror("rdma migration: post rdma write failed");
+        return -ret;
+    }
+
+    set_bit(chunk, block->transit_bitmap);
+    acct_update_position(f, sge.length, false);
+    rdma->total_writes++;
+
+    return 0;
+}
+
+/*
+ * Push out any unwritten RDMA operations.
+ *
+ * We support sending out multiple chunks at the same time.
+ * Not all of them need to get signaled in the completion queue.
+ */
+static int qemu_rdma_write_flush(QEMUFile *f, RDMAContext *rdma)
+{
+    int ret;
+
+    if (!rdma->current_length) {
+        return 0;
+    }
+
+    ret = qemu_rdma_write_one(f, rdma,
+            rdma->current_index, rdma->current_addr, rdma->current_length);
+
+    if (ret < 0) {
+        return ret;
+    }
+
+    if (ret == 0) {
+        rdma->nb_sent++;
+        DDDPRINTF("sent total: %d\n", rdma->nb_sent);
+    }
+
+    rdma->current_length = 0;
+    rdma->current_addr = 0;
+
+    return 0;
+}
+
+static inline int qemu_rdma_buffer_mergable(RDMAContext *rdma,
+                    uint64_t offset, uint64_t len)
+{
+    RDMALocalBlock *block =
+        &(rdma->local_ram_blocks.block[rdma->current_index]);
+    uint8_t *host_addr = block->local_host_addr + (offset - block->offset);
+    uint8_t *chunk_end = ram_chunk_end(block, rdma->current_chunk);
+
+    if (rdma->current_length == 0) {
+        return 0;
+    }
+
+    /*
+     * Only merge into chunk sequentially.
+     */
+    if (offset != (rdma->current_addr + rdma->current_length)) {
+        return 0;
+    }
+
+    if (rdma->current_index < 0) {
+        return 0;
+    }
+
+    if (offset < block->offset) {
+        return 0;
+    }
+
+    if ((offset + len) > (block->offset + block->length)) {
+        return 0;
+    }
+
+    if (rdma->current_chunk < 0) {
+        return 0;
+    }
+
+    if ((host_addr + len) > chunk_end) {
+        return 0;
+    }
+
+    return 1;
+}
+
+/*
+ * We're not actually writing here, but doing three things:
+ *
+ * 1. Identify the chunk the buffer belongs to.
+ * 2. If the chunk is full or the buffer doesn't belong to the current
+ *    chunk, then start a new chunk and flush() the old chunk.
+ * 3. To keep the hardware busy, we also group chunks into batches
+ *    and only require that a batch gets acknowledged in the completion
+ *    qeueue instead of each individual chunk.
+ */
+static int qemu_rdma_write(QEMUFile *f, RDMAContext *rdma,
+                           uint64_t block_offset, uint64_t offset,
+                           uint64_t len)
+{
+    uint64_t current_addr = block_offset + offset;
+    uint64_t index = rdma->current_index;
+    uint64_t chunk = rdma->current_chunk;
+    int ret;
+
+    /* If we cannot merge it, we flush the current buffer first. */
+    if (!qemu_rdma_buffer_mergable(rdma, current_addr, len)) {
+        ret = qemu_rdma_write_flush(f, rdma);
+        if (ret) {
+            return ret;
+        }
+        rdma->current_length = 0;
+        rdma->current_addr = current_addr;
+
+        ret = qemu_rdma_search_ram_block(rdma, block_offset,
+                                         offset, len, &index, &chunk);
+        if (ret) {
+            fprintf(stderr, "ram block search failed\n");
+            return ret;
+        }
+        rdma->current_index = index;
+        rdma->current_chunk = chunk;
+    }
+
+    /* merge it */
+    rdma->current_length += len;
+
+    /* flush it if buffer is too large */
+    if (rdma->current_length >= RDMA_MERGE_MAX) {
+        return qemu_rdma_write_flush(f, rdma);
+    }
+
+    return 0;
+}
+
+static void qemu_rdma_cleanup(RDMAContext *rdma)
+{
+    struct rdma_cm_event *cm_event;
+    int ret, idx;
+
+    if (rdma->cm_id) {
+        if (rdma->error_state) {
+            RDMAControlHeader head = { .len = 0,
+                                       .type = RDMA_CONTROL_ERROR,
+                                       .repeat = 1,
+                                     };
+            fprintf(stderr, "Early error. Sending error.\n");
+            qemu_rdma_post_send_control(rdma, NULL, &head);
+        }
+
+        ret = rdma_disconnect(rdma->cm_id);
+        if (!ret) {
+            DDPRINTF("waiting for disconnect\n");
+            ret = rdma_get_cm_event(rdma->channel, &cm_event);
+            if (!ret) {
+                rdma_ack_cm_event(cm_event);
+            }
+        }
+        DDPRINTF("Disconnected.\n");
+        rdma->cm_id = NULL;
+    }
+
+    g_free(rdma->block);
+    rdma->block = NULL;
+
+    for (idx = 0; idx <= RDMA_WRID_MAX; idx++) {
+        if (rdma->wr_data[idx].control_mr) {
+            rdma->total_registrations--;
+            ibv_dereg_mr(rdma->wr_data[idx].control_mr);
+        }
+        rdma->wr_data[idx].control_mr = NULL;
+    }
+
+    if (rdma->local_ram_blocks.block) {
+        while (rdma->local_ram_blocks.nb_blocks) {
+            __qemu_rdma_delete_block(rdma,
+                    rdma->local_ram_blocks.block->offset);
+        }
+    }
+
+    if (rdma->qp) {
+        ibv_destroy_qp(rdma->qp);
+        rdma->qp = NULL;
+    }
+    if (rdma->cq) {
+        ibv_destroy_cq(rdma->cq);
+        rdma->cq = NULL;
+    }
+    if (rdma->comp_channel) {
+        ibv_destroy_comp_channel(rdma->comp_channel);
+        rdma->comp_channel = NULL;
+    }
+    if (rdma->pd) {
+        ibv_dealloc_pd(rdma->pd);
+        rdma->pd = NULL;
+    }
+    if (rdma->listen_id) {
+        rdma_destroy_id(rdma->listen_id);
+        rdma->listen_id = NULL;
+    }
+    if (rdma->cm_id) {
+        rdma_destroy_id(rdma->cm_id);
+        rdma->cm_id = NULL;
+    }
+    if (rdma->channel) {
+        rdma_destroy_event_channel(rdma->channel);
+        rdma->channel = NULL;
+    }
+}
+
+
+static int qemu_rdma_source_init(RDMAContext *rdma, Error **errp, bool pin_all)
+{
+    int ret, idx;
+    Error *local_err = NULL, **temp = &local_err;
+
+    /*
+     * Will be validated against destination's actual capabilities
+     * after the connect() completes.
+     */
+    rdma->pin_all = pin_all;
+
+    ret = qemu_rdma_resolve_host(rdma, temp);
+    if (ret) {
+        goto err_rdma_source_init;
+    }
+
+    ret = qemu_rdma_alloc_pd_cq(rdma);
+    if (ret) {
+        ERROR(temp, "rdma migration: error allocating pd and cq! Your mlock()"
+                    " limits may be too low. Please check $ ulimit -a # and "
+                    "search for 'ulimit -l' in the output\n");
+        goto err_rdma_source_init;
+    }
+
+    ret = qemu_rdma_alloc_qp(rdma);
+    if (ret) {
+        ERROR(temp, "rdma migration: error allocating qp!\n");
+        goto err_rdma_source_init;
+    }
+
+    ret = qemu_rdma_init_ram_blocks(rdma);
+    if (ret) {
+        ERROR(temp, "rdma migration: error initializing ram blocks!\n");
+        goto err_rdma_source_init;
+    }
+
+    for (idx = 0; idx <= RDMA_WRID_MAX; idx++) {
+        ret = qemu_rdma_reg_control(rdma, idx);
+        if (ret) {
+            ERROR(temp, "rdma migration: error registering %d control!\n",
+                                                            idx);
+            goto err_rdma_source_init;
+        }
+    }
+
+    return 0;
+
+err_rdma_source_init:
+    error_propagate(errp, local_err);
+    qemu_rdma_cleanup(rdma);
+    return -1;
+}
+
+static int qemu_rdma_connect(RDMAContext *rdma, Error **errp)
+{
+    RDMACapabilities cap = {
+                                .version = RDMA_CONTROL_VERSION_CURRENT,
+                                .flags = 0,
+                           };
+    struct rdma_conn_param conn_param = { .initiator_depth = 2,
+                                          .retry_count = 5,
+                                          .private_data = &cap,
+                                          .private_data_len = sizeof(cap),
+                                        };
+    struct rdma_cm_event *cm_event;
+    int ret;
+
+    /*
+     * Only negotiate the capability with destination if the user
+     * on the source first requested the capability.
+     */
+    if (rdma->pin_all) {
+        DPRINTF("Server pin-all memory requested.\n");
+        cap.flags |= RDMA_CAPABILITY_PIN_ALL;
+    }
+
+    caps_to_network(&cap);
+
+    ret = rdma_connect(rdma->cm_id, &conn_param);
+    if (ret) {
+        perror("rdma_connect");
+        ERROR(errp, "connecting to destination!\n");
+        rdma_destroy_id(rdma->cm_id);
+        rdma->cm_id = NULL;
+        goto err_rdma_source_connect;
+    }
+
+    ret = rdma_get_cm_event(rdma->channel, &cm_event);
+    if (ret) {
+        perror("rdma_get_cm_event after rdma_connect");
+        ERROR(errp, "connecting to destination!\n");
+        rdma_ack_cm_event(cm_event);
+        rdma_destroy_id(rdma->cm_id);
+        rdma->cm_id = NULL;
+        goto err_rdma_source_connect;
+    }
+
+    if (cm_event->event != RDMA_CM_EVENT_ESTABLISHED) {
+        perror("rdma_get_cm_event != EVENT_ESTABLISHED after rdma_connect");
+        ERROR(errp, "connecting to destination!\n");
+        rdma_ack_cm_event(cm_event);
+        rdma_destroy_id(rdma->cm_id);
+        rdma->cm_id = NULL;
+        goto err_rdma_source_connect;
+    }
+
+    memcpy(&cap, cm_event->param.conn.private_data, sizeof(cap));
+    network_to_caps(&cap);
+
+    /*
+     * Verify that the *requested* capabilities are supported by the destination
+     * and disable them otherwise.
+     */
+    if (rdma->pin_all && !(cap.flags & RDMA_CAPABILITY_PIN_ALL)) {
+        ERROR(errp, "Server cannot support pinning all memory. "
+                        "Will register memory dynamically.\n");
+        rdma->pin_all = false;
+    }
+
+    DPRINTF("Pin all memory: %s\n", rdma->pin_all ? "enabled" : "disabled");
+
+    rdma_ack_cm_event(cm_event);
+
+    ret = qemu_rdma_post_recv_control(rdma, 0);
+    if (ret) {
+        ERROR(errp, "posting second control recv!\n");
+        goto err_rdma_source_connect;
+    }
+
+    rdma->control_ready_expected = 1;
+    rdma->nb_sent = 0;
+    return 0;
+
+err_rdma_source_connect:
+    qemu_rdma_cleanup(rdma);
+    return -1;
+}
+
+static int qemu_rdma_dest_init(RDMAContext *rdma, Error **errp)
+{
+    int ret = -EINVAL, idx;
+    struct sockaddr_in sin;
+    struct rdma_cm_id *listen_id;
+    char ip[40] = "unknown";
+
+    for (idx = 0; idx <= RDMA_WRID_MAX; idx++) {
+        rdma->wr_data[idx].control_len = 0;
+        rdma->wr_data[idx].control_curr = NULL;
+    }
+
+    if (rdma->host == NULL) {
+        ERROR(errp, "RDMA host is not set!\n");
+        rdma->error_state = -EINVAL;
+        return -1;
+    }
+    /* create CM channel */
+    rdma->channel = rdma_create_event_channel();
+    if (!rdma->channel) {
+        ERROR(errp, "could not create rdma event channel\n");
+        rdma->error_state = -EINVAL;
+        return -1;
+    }
+
+    /* create CM id */
+    ret = rdma_create_id(rdma->channel, &listen_id, NULL, RDMA_PS_TCP);
+    if (ret) {
+        ERROR(errp, "could not create cm_id!\n");
+        goto err_dest_init_create_listen_id;
+    }
+
+    memset(&sin, 0, sizeof(sin));
+    sin.sin_family = AF_INET;
+    sin.sin_port = htons(rdma->port);
+
+    if (rdma->host && strcmp("", rdma->host)) {
+        struct hostent *dest_addr;
+        dest_addr = gethostbyname(rdma->host);
+        if (!dest_addr) {
+            ERROR(errp, "migration could not gethostbyname!\n");
+            ret = -EINVAL;
+            goto err_dest_init_bind_addr;
+        }
+        memcpy(&sin.sin_addr.s_addr, dest_addr->h_addr,
+                dest_addr->h_length);
+        inet_ntop(AF_INET, dest_addr->h_addr, ip, sizeof ip);
+    } else {
+        sin.sin_addr.s_addr = INADDR_ANY;
+    }
+
+    DPRINTF("%s => %s\n", rdma->host, ip);
+
+    ret = rdma_bind_addr(listen_id, (struct sockaddr *)&sin);
+    if (ret) {
+        ERROR(errp, "Error: could not rdma_bind_addr!\n");
+        goto err_dest_init_bind_addr;
+    }
+
+    rdma->listen_id = listen_id;
+    qemu_rdma_dump_gid("dest_init", listen_id);
+    return 0;
+
+err_dest_init_bind_addr:
+    rdma_destroy_id(listen_id);
+err_dest_init_create_listen_id:
+    rdma_destroy_event_channel(rdma->channel);
+    rdma->channel = NULL;
+    rdma->error_state = ret;
+    return ret;
+
+}
+
+static void *qemu_rdma_data_init(const char *host_port, Error **errp)
+{
+    RDMAContext *rdma = NULL;
+    InetSocketAddress *addr;
+
+    if (host_port) {
+        rdma = g_malloc0(sizeof(RDMAContext));
+        memset(rdma, 0, sizeof(RDMAContext));
+        rdma->current_index = -1;
+        rdma->current_chunk = -1;
+
+        addr = inet_parse(host_port, NULL);
+        if (addr != NULL) {
+            rdma->port = atoi(addr->port);
+            rdma->host = g_strdup(addr->host);
+        } else {
+            ERROR(errp, "bad RDMA migration address '%s'", host_port);
+            g_free(rdma);
+            return NULL;
+        }
+    }
+
+    return rdma;
+}
+
+/*
+ * QEMUFile interface to the control channel.
+ * SEND messages for control only.
+ * pc.ram is handled with regular RDMA messages.
+ */
+static int qemu_rdma_put_buffer(void *opaque, const uint8_t *buf,
+                                int64_t pos, int size)
+{
+    QEMUFileRDMA *r = opaque;
+    QEMUFile *f = r->file;
+    RDMAContext *rdma = r->rdma;
+    size_t remaining = size;
+    uint8_t * data = (void *) buf;
+    int ret;
+
+    CHECK_ERROR_STATE();
+
+    /*
+     * Push out any writes that
+     * we're queued up for pc.ram.
+     */
+    ret = qemu_rdma_write_flush(f, rdma);
+    if (ret < 0) {
+        rdma->error_state = ret;
+        return ret;
+    }
+
+    while (remaining) {
+        RDMAControlHeader head;
+
+        r->len = MIN(remaining, RDMA_SEND_INCREMENT);
+        remaining -= r->len;
+
+        head.len = r->len;
+        head.type = RDMA_CONTROL_QEMU_FILE;
+
+        ret = qemu_rdma_exchange_send(rdma, &head, data, NULL, NULL, NULL);
+
+        if (ret < 0) {
+            rdma->error_state = ret;
+            return ret;
+        }
+
+        data += r->len;
+    }
+
+    return size;
+}
+
+static size_t qemu_rdma_fill(RDMAContext *rdma, uint8_t *buf,
+                             int size, int idx)
+{
+    size_t len = 0;
+
+    if (rdma->wr_data[idx].control_len) {
+        DDDPRINTF("RDMA %" PRId64 " of %d bytes already in buffer\n",
+                    rdma->wr_data[idx].control_len, size);
+
+        len = MIN(size, rdma->wr_data[idx].control_len);
+        memcpy(buf, rdma->wr_data[idx].control_curr, len);
+        rdma->wr_data[idx].control_curr += len;
+        rdma->wr_data[idx].control_len -= len;
+    }
+
+    return len;
+}
+
+/*
+ * QEMUFile interface to the control channel.
+ * RDMA links don't use bytestreams, so we have to
+ * return bytes to QEMUFile opportunistically.
+ */
+static int qemu_rdma_get_buffer(void *opaque, uint8_t *buf,
+                                int64_t pos, int size)
+{
+    QEMUFileRDMA *r = opaque;
+    RDMAContext *rdma = r->rdma;
+    RDMAControlHeader head;
+    int ret = 0;
+
+    CHECK_ERROR_STATE();
+
+    /*
+     * First, we hold on to the last SEND message we
+     * were given and dish out the bytes until we run
+     * out of bytes.
+     */
+    r->len = qemu_rdma_fill(r->rdma, buf, size, 0);
+    if (r->len) {
+        return r->len;
+    }
+
+    /*
+     * Once we run out, we block and wait for another
+     * SEND message to arrive.
+     */
+    ret = qemu_rdma_exchange_recv(rdma, &head, RDMA_CONTROL_QEMU_FILE);
+
+    if (ret < 0) {
+        rdma->error_state = ret;
+        return ret;
+    }
+
+    /*
+     * SEND was received with new bytes, now try again.
+     */
+    return qemu_rdma_fill(r->rdma, buf, size, 0);
+}
+
+/*
+ * Block until all the outstanding chunks have been delivered by the hardware.
+ */
+static int qemu_rdma_drain_cq(QEMUFile *f, RDMAContext *rdma)
+{
+    int ret;
+
+    if (qemu_rdma_write_flush(f, rdma) < 0) {
+        return -EIO;
+    }
+
+    while (rdma->nb_sent) {
+        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE);
+        if (ret < 0) {
+            fprintf(stderr, "rdma migration: complete polling error!\n");
+            return -EIO;
+        }
+    }
+
+    qemu_rdma_unregister_waiting(rdma);
+
+    return 0;
+}
+
+static int qemu_rdma_close(void *opaque)
+{
+    DPRINTF("Shutting down connection.\n");
+    QEMUFileRDMA *r = opaque;
+    if (r->rdma) {
+        qemu_rdma_cleanup(r->rdma);
+        g_free(r->rdma);
+    }
+    g_free(r);
+    return 0;
+}
+
+/*
+ * Parameters:
+ *    @offset == 0 :
+ *        This means that 'block_offset' is a full virtual address that does not
+ *        belong to a RAMBlock of the virtual machine and instead
+ *        represents a private malloc'd memory area that the caller wishes to
+ *        transfer.
+ *
+ *    @offset != 0 :
+ *        Offset is an offset to be added to block_offset and used
+ *        to also lookup the corresponding RAMBlock.
+ *
+ *    @size > 0 :
+ *        Initiate an transfer this size.
+ *
+ *    @size == 0 :
+ *        A 'hint' or 'advice' that means that we wish to speculatively
+ *        and asynchronously unregister this memory. In this case, there is no
+ *        gaurantee that the unregister will actually happen, for example,
+ *        if the memory is being actively transmitted. Additionally, the memory
+ *        may be re-registered at any future time if a write within the same
+ *        chunk was requested again, even if you attempted to unregister it
+ *        here.
+ *
+ *    @size < 0 : TODO, not yet supported
+ *        Unregister the memory NOW. This means that the caller does not
+ *        expect there to be any future RDMA transfers and we just want to clean
+ *        things up. This is used in case the upper layer owns the memory and
+ *        cannot wait for qemu_fclose() to occur.
+ *
+ *    @bytes_sent : User-specificed pointer to indicate how many bytes were
+ *                  sent. Usually, this will not be more than a few bytes of
+ *                  the protocol because most transfers are sent asynchronously.
+ */
+static size_t qemu_rdma_save_page(QEMUFile *f, void *opaque,
+                                  ram_addr_t block_offset, ram_addr_t offset,
+                                  size_t size, int *bytes_sent)
+{
+    QEMUFileRDMA *rfile = opaque;
+    RDMAContext *rdma = rfile->rdma;
+    int ret;
+
+    CHECK_ERROR_STATE();
+
+    qemu_fflush(f);
+
+    if (size > 0) {
+        /*
+         * Add this page to the current 'chunk'. If the chunk
+         * is full, or the page doen't belong to the current chunk,
+         * an actual RDMA write will occur and a new chunk will be formed.
+         */
+        ret = qemu_rdma_write(f, rdma, block_offset, offset, size);
+        if (ret < 0) {
+            fprintf(stderr, "rdma migration: write error! %d\n", ret);
+            goto err;
+        }
+
+        /*
+         * We always return 1 bytes because the RDMA
+         * protocol is completely asynchronous. We do not yet know
+         * whether an  identified chunk is zero or not because we're
+         * waiting for other pages to potentially be merged with
+         * the current chunk. So, we have to call qemu_update_position()
+         * later on when the actual write occurs.
+         */
+        if (bytes_sent) {
+            *bytes_sent = 1;
+        }
+    } else {
+        uint64_t index, chunk;
+
+        /* TODO: Change QEMUFileOps prototype to be signed: size_t => long
+        if (size < 0) {
+            ret = qemu_rdma_drain_cq(f, rdma);
+            if (ret < 0) {
+                fprintf(stderr, "rdma: failed to synchronously drain"
+                                " completion queue before unregistration.\n");
+                goto err;
+            }
+        }
+        */
+
+        ret = qemu_rdma_search_ram_block(rdma, block_offset,
+                                         offset, size, &index, &chunk);
+
+        if (ret) {
+            fprintf(stderr, "ram block search failed\n");
+            goto err;
+        }
+
+        qemu_rdma_signal_unregister(rdma, index, chunk, 0);
+
+        /*
+         * TODO: Synchronous, gauranteed unregistration (should not occur during
+         * fast-path). Otherwise, unregisters will process on the next call to
+         * qemu_rdma_drain_cq()
+        if (size < 0) {
+            qemu_rdma_unregister_waiting(rdma);
+        }
+        */
+    }
+
+    /*
+     * Drain the Completion Queue if possible, but do not block,
+     * just poll.
+     *
+     * If nothing to poll, the end of the iteration will do this
+     * again to make sure we don't overflow the request queue.
+     */
+    while (1) {
+        uint64_t wr_id, wr_id_in;
+        int ret = qemu_rdma_poll(rdma, &wr_id_in);
+        if (ret < 0) {
+            fprintf(stderr, "rdma migration: polling error! %d\n", ret);
+            goto err;
+        }
+
+        wr_id = wr_id_in & RDMA_WRID_TYPE_MASK;
+
+        if (wr_id == RDMA_WRID_NONE) {
+            break;
+        }
+    }
+
+    return RAM_SAVE_CONTROL_DELAYED;
+err:
+    rdma->error_state = ret;
+    return ret;
+}
+
+static int qemu_rdma_accept(RDMAContext *rdma)
+{
+    RDMACapabilities cap;
+    struct rdma_conn_param conn_param = {
+                                            .responder_resources = 2,
+                                            .private_data = &cap,
+                                            .private_data_len = sizeof(cap),
+                                         };
+    struct rdma_cm_event *cm_event;
+    struct ibv_context *verbs;
+    int ret = -EINVAL;
+    int idx;
+
+    ret = rdma_get_cm_event(rdma->channel, &cm_event);
+    if (ret) {
+        goto err_rdma_dest_wait;
+    }
+
+    if (cm_event->event != RDMA_CM_EVENT_CONNECT_REQUEST) {
+        rdma_ack_cm_event(cm_event);
+        goto err_rdma_dest_wait;
+    }
+
+    memcpy(&cap, cm_event->param.conn.private_data, sizeof(cap));
+
+    network_to_caps(&cap);
+
+    if (cap.version < 1 || cap.version > RDMA_CONTROL_VERSION_CURRENT) {
+            fprintf(stderr, "Unknown source RDMA version: %d, bailing...\n",
+                            cap.version);
+            rdma_ack_cm_event(cm_event);
+            goto err_rdma_dest_wait;
+    }
+
+    /*
+     * Respond with only the capabilities this version of QEMU knows about.
+     */
+    cap.flags &= known_capabilities;
+
+    /*
+     * Enable the ones that we do know about.
+     * Add other checks here as new ones are introduced.
+     */
+    if (cap.flags & RDMA_CAPABILITY_PIN_ALL) {
+        rdma->pin_all = true;
+    }
+
+    rdma->cm_id = cm_event->id;
+    verbs = cm_event->id->verbs;
+
+    rdma_ack_cm_event(cm_event);
+
+    DPRINTF("Memory pin all: %s\n", rdma->pin_all ? "enabled" : "disabled");
+
+    caps_to_network(&cap);
+
+    DPRINTF("verbs context after listen: %p\n", verbs);
+
+    if (!rdma->verbs) {
+        rdma->verbs = verbs;
+    } else if (rdma->verbs != verbs) {
+            fprintf(stderr, "ibv context not matching %p, %p!\n",
+                    rdma->verbs, verbs);
+            goto err_rdma_dest_wait;
+    }
+
+    qemu_rdma_dump_id("dest_init", verbs);
+
+    ret = qemu_rdma_alloc_pd_cq(rdma);
+    if (ret) {
+        fprintf(stderr, "rdma migration: error allocating pd and cq!\n");
+        goto err_rdma_dest_wait;
+    }
+
+    ret = qemu_rdma_alloc_qp(rdma);
+    if (ret) {
+        fprintf(stderr, "rdma migration: error allocating qp!\n");
+        goto err_rdma_dest_wait;
+    }
+
+    ret = qemu_rdma_init_ram_blocks(rdma);
+    if (ret) {
+        fprintf(stderr, "rdma migration: error initializing ram blocks!\n");
+        goto err_rdma_dest_wait;
+    }
+
+    for (idx = 0; idx <= RDMA_WRID_MAX; idx++) {
+        ret = qemu_rdma_reg_control(rdma, idx);
+        if (ret) {
+            fprintf(stderr, "rdma: error registering %d control!\n", idx);
+            goto err_rdma_dest_wait;
+        }
+    }
+
+    qemu_set_fd_handler2(rdma->channel->fd, NULL, NULL, NULL, NULL);
+
+    ret = rdma_accept(rdma->cm_id, &conn_param);
+    if (ret) {
+        fprintf(stderr, "rdma_accept returns %d!\n", ret);
+        goto err_rdma_dest_wait;
+    }
+
+    ret = rdma_get_cm_event(rdma->channel, &cm_event);
+    if (ret) {
+        fprintf(stderr, "rdma_accept get_cm_event failed %d!\n", ret);
+        goto err_rdma_dest_wait;
+    }
+
+    if (cm_event->event != RDMA_CM_EVENT_ESTABLISHED) {
+        fprintf(stderr, "rdma_accept not event established!\n");
+        rdma_ack_cm_event(cm_event);
+        goto err_rdma_dest_wait;
+    }
+
+    rdma_ack_cm_event(cm_event);
+
+    ret = qemu_rdma_post_recv_control(rdma, 0);
+    if (ret) {
+        fprintf(stderr, "rdma migration: error posting second control recv!\n");
+        goto err_rdma_dest_wait;
+    }
+
+    qemu_rdma_dump_gid("dest_connect", rdma->cm_id);
+
+    return 0;
+
+err_rdma_dest_wait:
+    rdma->error_state = ret;
+    qemu_rdma_cleanup(rdma);
+    return ret;
+}
+
+/*
+ * During each iteration of the migration, we listen for instructions
+ * by the source VM to perform dynamic page registrations before they
+ * can perform RDMA operations.
+ *
+ * We respond with the 'rkey'.
+ *
+ * Keep doing this until the source tells us to stop.
+ */
+static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque,
+                                         uint64_t flags)
+{
+    RDMAControlHeader reg_resp = { .len = sizeof(RDMARegisterResult),
+                               .type = RDMA_CONTROL_REGISTER_RESULT,
+                               .repeat = 0,
+                             };
+    RDMAControlHeader unreg_resp = { .len = 0,
+                               .type = RDMA_CONTROL_UNREGISTER_FINISHED,
+                               .repeat = 0,
+                             };
+    RDMAControlHeader blocks = { .type = RDMA_CONTROL_RAM_BLOCKS_RESULT,
+                                 .repeat = 1 };
+    QEMUFileRDMA *rfile = opaque;
+    RDMAContext *rdma = rfile->rdma;
+    RDMALocalBlocks *local = &rdma->local_ram_blocks;
+    RDMAControlHeader head;
+    RDMARegister *reg, *registers;
+    RDMACompress *comp;
+    RDMARegisterResult *reg_result;
+    static RDMARegisterResult results[RDMA_CONTROL_MAX_COMMANDS_PER_MESSAGE];
+    RDMALocalBlock *block;
+    void *host_addr;
+    int ret = 0;
+    int idx = 0;
+    int count = 0;
+    int i = 0;
+
+    CHECK_ERROR_STATE();
+
+    do {
+        DDDPRINTF("Waiting for next request %" PRIu64 "...\n", flags);
+
+        ret = qemu_rdma_exchange_recv(rdma, &head, RDMA_CONTROL_NONE);
+
+        if (ret < 0) {
+            break;
+        }
+
+        if (head.repeat > RDMA_CONTROL_MAX_COMMANDS_PER_MESSAGE) {
+            fprintf(stderr, "rdma: Too many requests in this message (%d)."
+                            "Bailing.\n", head.repeat);
+            ret = -EIO;
+            break;
+        }
+
+        switch (head.type) {
+        case RDMA_CONTROL_COMPRESS:
+            comp = (RDMACompress *) rdma->wr_data[idx].control_curr;
+            network_to_compress(comp);
+
+            DDPRINTF("Zapping zero chunk: %" PRId64
+                    " bytes, index %d, offset %" PRId64 "\n",
+                    comp->length, comp->block_idx, comp->offset);
+            block = &(rdma->local_ram_blocks.block[comp->block_idx]);
+
+            host_addr = block->local_host_addr +
+                            (comp->offset - block->offset);
+
+            ram_handle_compressed(host_addr, comp->value, comp->length);
+            break;
+
+        case RDMA_CONTROL_REGISTER_FINISHED:
+            DDDPRINTF("Current registrations complete.\n");
+            goto out;
+
+        case RDMA_CONTROL_RAM_BLOCKS_REQUEST:
+            DPRINTF("Initial setup info requested.\n");
+
+            if (rdma->pin_all) {
+                ret = qemu_rdma_reg_whole_ram_blocks(rdma);
+                if (ret) {
+                    fprintf(stderr, "rdma migration: error dest "
+                                    "registering ram blocks!\n");
+                    goto out;
+                }
+            }
+
+            /*
+             * Dest uses this to prepare to transmit the RAMBlock descriptions
+             * to the source VM after connection setup.
+             * Both sides use the "remote" structure to communicate and update
+             * their "local" descriptions with what was sent.
+             */
+            for (i = 0; i < local->nb_blocks; i++) {
+                rdma->block[i].remote_host_addr =
+                    (uint64_t)(local->block[i].local_host_addr);
+
+                if (rdma->pin_all) {
+                    rdma->block[i].remote_rkey = local->block[i].mr->rkey;
+                }
+
+                rdma->block[i].offset = local->block[i].offset;
+                rdma->block[i].length = local->block[i].length;
+
+                remote_block_to_network(&rdma->block[i]);
+            }
+
+            blocks.len = rdma->local_ram_blocks.nb_blocks
+                                                * sizeof(RDMARemoteBlock);
+
+
+            ret = qemu_rdma_post_send_control(rdma,
+                                        (uint8_t *) rdma->block, &blocks);
+
+            if (ret < 0) {
+                fprintf(stderr, "rdma migration: error sending remote info!\n");
+                goto out;
+            }
+
+            break;
+        case RDMA_CONTROL_REGISTER_REQUEST:
+            DDPRINTF("There are %d registration requests\n", head.repeat);
+
+            reg_resp.repeat = head.repeat;
+            registers = (RDMARegister *) rdma->wr_data[idx].control_curr;
+
+            for (count = 0; count < head.repeat; count++) {
+                uint64_t chunk;
+                uint8_t *chunk_start, *chunk_end;
+
+                reg = &registers[count];
+                network_to_register(reg);
+
+                reg_result = &results[count];
+
+                DDPRINTF("Registration request (%d): index %d, current_addr %"
+                         PRIu64 " chunks: %" PRIu64 "\n", count,
+                         reg->current_index, reg->key.current_addr, reg->chunks);
+
+                block = &(rdma->local_ram_blocks.block[reg->current_index]);
+                if (block->is_ram_block) {
+                    host_addr = (block->local_host_addr +
+                                (reg->key.current_addr - block->offset));
+                    chunk = ram_chunk_index(block->local_host_addr,
+                                            (uint8_t *) host_addr);
+                } else {
+                    chunk = reg->key.chunk;
+                    host_addr = block->local_host_addr +
+                        (reg->key.chunk * (1UL << RDMA_REG_CHUNK_SHIFT));
+                }
+                chunk_start = ram_chunk_start(block, chunk);
+                chunk_end = ram_chunk_end(block, chunk + reg->chunks);
+                if (qemu_rdma_register_and_get_keys(rdma, block,
+                            (uint8_t *)host_addr, NULL, &reg_result->rkey,
+                            chunk, chunk_start, chunk_end)) {
+                    fprintf(stderr, "cannot get rkey!\n");
+                    ret = -EINVAL;
+                    goto out;
+                }
+
+                reg_result->host_addr = (uint64_t) block->local_host_addr;
+
+                DDPRINTF("Registered rkey for this request: %x\n",
+                                reg_result->rkey);
+
+                result_to_network(reg_result);
+            }
+
+            ret = qemu_rdma_post_send_control(rdma,
+                            (uint8_t *) results, &reg_resp);
+
+            if (ret < 0) {
+                fprintf(stderr, "Failed to send control buffer!\n");
+                goto out;
+            }
+            break;
+        case RDMA_CONTROL_UNREGISTER_REQUEST:
+            DDPRINTF("There are %d unregistration requests\n", head.repeat);
+            unreg_resp.repeat = head.repeat;
+            registers = (RDMARegister *) rdma->wr_data[idx].control_curr;
+
+            for (count = 0; count < head.repeat; count++) {
+                reg = &registers[count];
+                network_to_register(reg);
+
+                DDPRINTF("Unregistration request (%d): "
+                         " index %d, chunk %" PRIu64 "\n",
+                         count, reg->current_index, reg->key.chunk);
+
+                block = &(rdma->local_ram_blocks.block[reg->current_index]);
+
+                ret = ibv_dereg_mr(block->pmr[reg->key.chunk]);
+                block->pmr[reg->key.chunk] = NULL;
+
+                if (ret != 0) {
+                    perror("rdma unregistration chunk failed");
+                    ret = -ret;
+                    goto out;
+                }
+
+                rdma->total_registrations--;
+
+                DDPRINTF("Unregistered chunk %" PRIu64 " successfully.\n",
+                            reg->key.chunk);
+            }
+
+            ret = qemu_rdma_post_send_control(rdma, NULL, &unreg_resp);
+
+            if (ret < 0) {
+                fprintf(stderr, "Failed to send control buffer!\n");
+                goto out;
+            }
+            break;
+        case RDMA_CONTROL_REGISTER_RESULT:
+            fprintf(stderr, "Invalid RESULT message at dest.\n");
+            ret = -EIO;
+            goto out;
+        default:
+            fprintf(stderr, "Unknown control message %s\n",
+                                control_desc[head.type]);
+            ret = -EIO;
+            goto out;
+        }
+    } while (1);
+out:
+    if (ret < 0) {
+        rdma->error_state = ret;
+    }
+    return ret;
+}
+
+static int qemu_rdma_registration_start(QEMUFile *f, void *opaque,
+                                        uint64_t flags)
+{
+    QEMUFileRDMA *rfile = opaque;
+    RDMAContext *rdma = rfile->rdma;
+
+    CHECK_ERROR_STATE();
+
+    DDDPRINTF("start section: %" PRIu64 "\n", flags);
+    qemu_put_be64(f, RAM_SAVE_FLAG_HOOK);
+    qemu_fflush(f);
+
+    return 0;
+}
+
+/*
+ * Inform dest that dynamic registrations are done for now.
+ * First, flush writes, if any.
+ */
+static int qemu_rdma_registration_stop(QEMUFile *f, void *opaque,
+                                       uint64_t flags)
+{
+    Error *local_err = NULL, **errp = &local_err;
+    QEMUFileRDMA *rfile = opaque;
+    RDMAContext *rdma = rfile->rdma;
+    RDMAControlHeader head = { .len = 0, .repeat = 1 };
+    int ret = 0;
+
+    CHECK_ERROR_STATE();
+
+    qemu_fflush(f);
+    ret = qemu_rdma_drain_cq(f, rdma);
+
+    if (ret < 0) {
+        goto err;
+    }
+
+    if (flags == RAM_CONTROL_SETUP) {
+        RDMAControlHeader resp = {.type = RDMA_CONTROL_RAM_BLOCKS_RESULT };
+        RDMALocalBlocks *local = &rdma->local_ram_blocks;
+        int reg_result_idx, i, j, nb_remote_blocks;
+
+        head.type = RDMA_CONTROL_RAM_BLOCKS_REQUEST;
+        DPRINTF("Sending registration setup for ram blocks...\n");
+
+        /*
+         * Make sure that we parallelize the pinning on both sides.
+         * For very large guests, doing this serially takes a really
+         * long time, so we have to 'interleave' the pinning locally
+         * with the control messages by performing the pinning on this
+         * side before we receive the control response from the other
+         * side that the pinning has completed.
+         */
+        ret = qemu_rdma_exchange_send(rdma, &head, NULL, &resp,
+                    &reg_result_idx, rdma->pin_all ?
+                    qemu_rdma_reg_whole_ram_blocks : NULL);
+        if (ret < 0) {
+            ERROR(errp, "receiving remote info!\n");
+            return ret;
+        }
+
+        qemu_rdma_move_header(rdma, reg_result_idx, &resp);
+        memcpy(rdma->block,
+            rdma->wr_data[reg_result_idx].control_curr, resp.len);
+
+        nb_remote_blocks = resp.len / sizeof(RDMARemoteBlock);
+
+        /*
+         * The protocol uses two different sets of rkeys (mutually exclusive):
+         * 1. One key to represent the virtual address of the entire ram block.
+         *    (dynamic chunk registration disabled - pin everything with one rkey.)
+         * 2. One to represent individual chunks within a ram block.
+         *    (dynamic chunk registration enabled - pin individual chunks.)
+         *
+         * Once the capability is successfully negotiated, the destination transmits
+         * the keys to use (or sends them later) including the virtual addresses
+         * and then propagates the remote ram block descriptions to his local copy.
+         */
+
+        if (local->nb_blocks != nb_remote_blocks) {
+            ERROR(errp, "ram blocks mismatch #1! "
+                        "Your QEMU command line parameters are probably "
+                        "not identical on both the source and destination.\n");
+            return -EINVAL;
+        }
+
+        for (i = 0; i < nb_remote_blocks; i++) {
+            network_to_remote_block(&rdma->block[i]);
+
+            /* search local ram blocks */
+            for (j = 0; j < local->nb_blocks; j++) {
+                if (rdma->block[i].offset != local->block[j].offset) {
+                    continue;
+                }
+
+                if (rdma->block[i].length != local->block[j].length) {
+                    ERROR(errp, "ram blocks mismatch #2! "
+                        "Your QEMU command line parameters are probably "
+                        "not identical on both the source and destination.\n");
+                    return -EINVAL;
+                }
+                local->block[j].remote_host_addr =
+                        rdma->block[i].remote_host_addr;
+                local->block[j].remote_rkey = rdma->block[i].remote_rkey;
+                break;
+            }
+
+            if (j >= local->nb_blocks) {
+                ERROR(errp, "ram blocks mismatch #3! "
+                        "Your QEMU command line parameters are probably "
+                        "not identical on both the source and destination.\n");
+                return -EINVAL;
+            }
+        }
+    }
+
+    DDDPRINTF("Sending registration finish %" PRIu64 "...\n", flags);
+
+    head.type = RDMA_CONTROL_REGISTER_FINISHED;
+    ret = qemu_rdma_exchange_send(rdma, &head, NULL, NULL, NULL, NULL);
+
+    if (ret < 0) {
+        goto err;
+    }
+
+    return 0;
+err:
+    rdma->error_state = ret;
+    return ret;
+}
+
+static int qemu_rdma_get_fd(void *opaque)
+{
+    QEMUFileRDMA *rfile = opaque;
+    RDMAContext *rdma = rfile->rdma;
+
+    return rdma->comp_channel->fd;
+}
+
+const QEMUFileOps rdma_read_ops = {
+    .get_buffer    = qemu_rdma_get_buffer,
+    .get_fd        = qemu_rdma_get_fd,
+    .close         = qemu_rdma_close,
+    .hook_ram_load = qemu_rdma_registration_handle,
+};
+
+const QEMUFileOps rdma_write_ops = {
+    .put_buffer         = qemu_rdma_put_buffer,
+    .close              = qemu_rdma_close,
+    .before_ram_iterate = qemu_rdma_registration_start,
+    .after_ram_iterate  = qemu_rdma_registration_stop,
+    .save_page          = qemu_rdma_save_page,
+};
+
+static void *qemu_fopen_rdma(RDMAContext *rdma, const char *mode)
+{
+    QEMUFileRDMA *r = g_malloc0(sizeof(QEMUFileRDMA));
+
+    if (qemu_file_mode_is_not_valid(mode)) {
+        return NULL;
+    }
+
+    r->rdma = rdma;
+
+    if (mode[0] == 'w') {
+        r->file = qemu_fopen_ops(r, &rdma_write_ops);
+    } else {
+        r->file = qemu_fopen_ops(r, &rdma_read_ops);
+    }
+
+    return r->file;
+}
+
+static void rdma_accept_incoming_migration(void *opaque)
+{
+    RDMAContext *rdma = opaque;
+    int ret;
+    QEMUFile *f;
+    Error *local_err = NULL, **errp = &local_err;
+
+    DPRINTF("Accepting rdma connection...\n");
+    ret = qemu_rdma_accept(rdma);
+
+    if (ret) {
+        ERROR(errp, "RDMA Migration initialization failed!\n");
+        return;
+    }
+
+    DPRINTF("Accepted migration\n");
+
+    f = qemu_fopen_rdma(rdma, "rb");
+    if (f == NULL) {
+        ERROR(errp, "could not qemu_fopen_rdma!\n");
+        qemu_rdma_cleanup(rdma);
+        return;
+    }
+
+    rdma->migration_started_on_destination = 1;
+    process_incoming_migration(f);
+}
+
+void rdma_start_incoming_migration(const char *host_port, Error **errp)
+{
+    int ret;
+    RDMAContext *rdma;
+    Error *local_err = NULL;
+
+    DPRINTF("Starting RDMA-based incoming migration\n");
+    rdma = qemu_rdma_data_init(host_port, &local_err);
+
+    if (rdma == NULL) {
+        goto err;
+    }
+
+    ret = qemu_rdma_dest_init(rdma, &local_err);
+
+    if (ret) {
+        goto err;
+    }
+
+    DPRINTF("qemu_rdma_dest_init success\n");
+
+    ret = rdma_listen(rdma->listen_id, 5);
+
+    if (ret) {
+        ERROR(errp, "listening on socket!\n");
+        goto err;
+    }
+
+    DPRINTF("rdma_listen success\n");
+
+    qemu_set_fd_handler2(rdma->channel->fd, NULL,
+                         rdma_accept_incoming_migration, NULL,
+                            (void *)(intptr_t) rdma);
+    return;
+err:
+    error_propagate(errp, local_err);
+    g_free(rdma);
+}
+
+void rdma_start_outgoing_migration(void *opaque,
+                            const char *host_port, Error **errp)
+{
+    MigrationState *s = opaque;
+    Error *local_err = NULL, **temp = &local_err;
+    RDMAContext *rdma = qemu_rdma_data_init(host_port, &local_err);
+    int ret = 0;
+
+    if (rdma == NULL) {
+        ERROR(temp, "Failed to initialize RDMA data structures! %d\n", ret);
+        goto err;
+    }
+
+    ret = qemu_rdma_source_init(rdma, &local_err,
+        s->enabled_capabilities[MIGRATION_CAPABILITY_X_RDMA_PIN_ALL]);
+
+    if (ret) {
+        goto err;
+    }
+
+    DPRINTF("qemu_rdma_source_init success\n");
+    ret = qemu_rdma_connect(rdma, &local_err);
+
+    if (ret) {
+        goto err;
+    }
+
+    DPRINTF("qemu_rdma_source_connect success\n");
+
+    s->file = qemu_fopen_rdma(rdma, "wb");
+    migrate_fd_connect(s);
+    return;
+err:
+    error_propagate(errp, local_err);
+    g_free(rdma);
+    migrate_fd_error(s);
+}
diff --git a/migration.c b/migration.c
index a9c0421..261975d 100644
--- a/migration.c
+++ b/migration.c
@@ -78,6 +78,10 @@ void qemu_start_incoming_migration(const char *uri, Error **errp)
 
     if (strstart(uri, "tcp:", &p))
         tcp_start_incoming_migration(p, errp);
+#ifdef CONFIG_RDMA
+    else if (strstart(uri, "x-rdma:", &p))
+        rdma_start_incoming_migration(p, errp);
+#endif
 #if !defined(WIN32)
     else if (strstart(uri, "exec:", &p))
         exec_start_incoming_migration(p, errp);
@@ -406,6 +410,10 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
 
     if (strstart(uri, "tcp:", &p)) {
         tcp_start_outgoing_migration(s, p, &local_err);
+#ifdef CONFIG_RDMA
+    } else if (strstart(uri, "x-rdma:", &p)) {
+        rdma_start_outgoing_migration(s, p, &local_err);
+#endif
 #if !defined(WIN32)
     } else if (strstart(uri, "exec:", &p)) {
         exec_start_outgoing_migration(s, p, &local_err);
commit 44c3b58cf9b2c91a38363f0b45d20f3f40b8f2b3
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:53 2013 -0400

    rdma: introduce ram_handle_compressed()
    
    This gives RDMA shared access to madvise() on the destination side
    when an entire chunk is found to be zero.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index e9dd96f..09a7125 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -808,6 +808,24 @@ static inline void *host_from_stream_offset(QEMUFile *f,
     return NULL;
 }
 
+/*
+ * If a page (or a whole RDMA chunk) has been
+ * determined to be zero, then zap it.
+ */
+void ram_handle_compressed(void *host, uint8_t ch, uint64_t size)
+{
+    if (ch != 0 || !is_zero_page(host)) {
+        memset(host, ch, size);
+#ifndef _WIN32
+        if (ch == 0 &&
+            (!kvm_enabled() || kvm_has_sync_mmu()) &&
+            getpagesize() <= TARGET_PAGE_SIZE) {
+            qemu_madvise(host, TARGET_PAGE_SIZE, QEMU_MADV_DONTNEED);
+        }
+#endif
+    }
+}
+
 static int ram_load(QEMUFile *f, void *opaque, int version_id)
 {
     ram_addr_t addr;
@@ -879,16 +897,7 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
             }
 
             ch = qemu_get_byte(f);
-            if (ch != 0 || !is_zero_page(host)) {
-                memset(host, ch, TARGET_PAGE_SIZE);
-#ifndef _WIN32
-                if (ch == 0 &&
-                    (!kvm_enabled() || kvm_has_sync_mmu()) &&
-                    getpagesize() <= TARGET_PAGE_SIZE) {
-                    qemu_madvise(host, TARGET_PAGE_SIZE, QEMU_MADV_DONTNEED);
-                }
-#endif
-            }
+            ram_handle_compressed(host, ch, TARGET_PAGE_SIZE);
         } else if (flags & RAM_SAVE_FLAG_PAGE) {
             void *host;
 
diff --git a/include/migration/migration.h b/include/migration/migration.h
index 701709a..90b5021 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -109,6 +109,8 @@ uint64_t xbzrle_mig_pages_transferred(void);
 uint64_t xbzrle_mig_pages_overflow(void);
 uint64_t xbzrle_mig_pages_cache_miss(void);
 
+void ram_handle_compressed(void *host, uint8_t ch, uint64_t size);
+
 /**
  * @migrate_add_blocker - prevent migration from proceeding
  *
commit de7b685c9e1cf606e37e7116e4c4f03a6ae2d14f
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:52 2013 -0400

    rdma: bugfix: ram_control_save_page()
    
    We were not checking for a valid 'bytes_sent' pointer before accessing it.
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/savevm.c b/savevm.c
index e0491e7..03fc4d9 100644
--- a/savevm.c
+++ b/savevm.c
@@ -662,7 +662,7 @@ size_t ram_control_save_page(QEMUFile *f, ram_addr_t block_offset,
                                     offset, size, bytes_sent);
 
         if (ret != RAM_SAVE_CONTROL_DELAYED) {
-            if (*bytes_sent > 0) {
+            if (bytes_sent && *bytes_sent > 0) {
                 qemu_update_position(f, *bytes_sent);
             } else if (ret < 0) {
                 qemu_file_set_error(f, ret);
commit a5f56b906e0d7975b87dc3d3c5bfe5a75a4028d2
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Mon Jul 22 10:01:51 2013 -0400

    rdma: update documentation to reflect new unpin support
    
    As requested, the protocol now includes memory unpinning support.
    This has been implemented in a non-optimized manner, in such a way
    that one could devise an LRU or other workload-specific information
    on top of the basic mechanism to influence the way unpinning happens
    during runtime.
    
    The feature is not yet user-facing, and is thus can only be enabled
    at compile-time.
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/docs/rdma.txt b/docs/rdma.txt
index 45a4b1d..45d1c8a 100644
--- a/docs/rdma.txt
+++ b/docs/rdma.txt
@@ -35,7 +35,7 @@ memory tracked during each live migration iteration round cannot keep pace
 with the rate of dirty memory produced by the workload.
 
 RDMA currently comes in two flavors: both Ethernet based (RoCE, or RDMA
-over Convered Ethernet) as well as Infiniband-based. This implementation of
+over Converged Ethernet) as well as Infiniband-based. This implementation of
 migration using RDMA is capable of using both technologies because of
 the use of the OpenFabrics OFED software stack that abstracts out the
 programming model irrespective of the underlying hardware.
@@ -188,9 +188,9 @@ header portion and a data portion (but together are transmitted
 as a single SEND message).
 
 Header:
-    * Length  (of the data portion, uint32, network byte order)
-    * Type    (what command to perform, uint32, network byte order)
-    * Repeat  (Number of commands in data portion, same type only)
+    * Length               (of the data portion, uint32, network byte order)
+    * Type                 (what command to perform, uint32, network byte order)
+    * Repeat               (Number of commands in data portion, same type only)
 
 The 'Repeat' field is here to support future multiple page registrations
 in a single message without any need to change the protocol itself
@@ -202,17 +202,19 @@ The maximum number of repeats is hard-coded to 4096. This is a conservative
 limit based on the maximum size of a SEND message along with emperical
 observations on the maximum future benefit of simultaneous page registrations.
 
-The 'type' field has 10 different command values:
-    1. Unused
-    2. Error              (sent to the source during bad things)
-    3. Ready              (control-channel is available)
-    4. QEMU File          (for sending non-live device state)
-    5. RAM Blocks request (used right after connection setup)
-    6. RAM Blocks result  (used right after connection setup)
-    7. Compress page      (zap zero page and skip registration)
-    8. Register request   (dynamic chunk registration)
-    9. Register result    ('rkey' to be used by sender)
-    10. Register finished  (registration for current iteration finished)
+The 'type' field has 12 different command values:
+     1. Unused
+     2. Error                      (sent to the source during bad things)
+     3. Ready                      (control-channel is available)
+     4. QEMU File                  (for sending non-live device state)
+     5. RAM Blocks request         (used right after connection setup)
+     6. RAM Blocks result          (used right after connection setup)
+     7. Compress page              (zap zero page and skip registration)
+     8. Register request           (dynamic chunk registration)
+     9. Register result            ('rkey' to be used by sender)
+    10. Register finished          (registration for current iteration finished)
+    11. Unregister request         (unpin previously registered memory)
+    12. Unregister finished        (confirmation that unpin completed)
 
 A single control message, as hinted above, can contain within the data
 portion an array of many commands of the same type. If there is more than
@@ -243,7 +245,7 @@ qemu_rdma_exchange_send(header, data, optional response header & data):
    from the receiver to tell us that the receiver
    is *ready* for us to transmit some new bytes.
 2. Optionally: if we are expecting a response from the command
-   (that we have no yet transmitted), let's post an RQ
+   (that we have not yet transmitted), let's post an RQ
    work request to receive that data a few moments later.
 3. When the READY arrives, librdmacm will
    unblock us and we immediately post a RQ work request
@@ -293,8 +295,10 @@ librdmacm provides the user with a 'private data' area to be exchanged
 at connection-setup time before any infiniband traffic is generated.
 
 Header:
-    * Version (protocol version validated before send/recv occurs), uint32, network byte order
-    * Flags   (bitwise OR of each capability), uint32, network byte order
+    * Version (protocol version validated before send/recv occurs),
+                                               uint32, network byte order
+    * Flags   (bitwise OR of each capability),
+                                               uint32, network byte order
 
 There is no data portion of this header right now, so there is
 no length field. The maximum size of the 'private data' section
@@ -313,7 +317,7 @@ If the version is invalid, we throw an error.
 If the version is new, we only negotiate the capabilities that the
 requested version is able to perform and ignore the rest.
 
-Currently there is only *one* capability in Version #1: dynamic page registration
+Currently there is only one capability in Version #1: dynamic page registration
 
 Finally: Negotiation happens with the Flags field: If the primary-VM
 sets a flag, but the destination does not support this capability, it
@@ -326,8 +330,8 @@ QEMUFileRDMA Interface:
 
 QEMUFileRDMA introduces a couple of new functions:
 
-1. qemu_rdma_get_buffer()  (QEMUFileOps rdma_read_ops)
-2. qemu_rdma_put_buffer()  (QEMUFileOps rdma_write_ops)
+1. qemu_rdma_get_buffer()               (QEMUFileOps rdma_read_ops)
+2. qemu_rdma_put_buffer()               (QEMUFileOps rdma_write_ops)
 
 These two functions are very short and simply use the protocol
 describe above to deliver bytes without changing the upper-level
@@ -413,3 +417,8 @@ TODO:
    the use of KSM and ballooning while using RDMA.
 4. Also, some form of balloon-device usage tracking would also
    help alleviate some issues.
+5. Move UNREGISTER requests to a separate thread.
+6. Use LRU to provide more fine-grained direction of UNREGISTER
+   requests for unpinning memory in an overcommitted environment.
+7. Expose UNREGISTER support to the user by way of workload-specific
+   hints about application behavior.
commit 6f152e9bc80aed81ea89aa8ad345cd71326b71fb
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri May 18 00:01:58 2012 +0200

    linux-user: Use X86CPU property to retrieve CPUID family
    
    Avoids duplicating the calculation.
    
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/linux-user/cpu-uname.c b/linux-user/cpu-uname.c
index 59cd647..cc713e6 100644
--- a/linux-user/cpu-uname.c
+++ b/linux-user/cpu-uname.c
@@ -55,12 +55,14 @@ const char *cpu_to_uname_machine(void *cpu_env)
     return "x86-64";
 #elif defined(TARGET_I386)
     /* see arch/x86/kernel/cpu/bugs.c: check_bugs(), 386, 486, 586, 686 */
-    uint32_t cpuid_version = ((CPUX86State *)cpu_env)->cpuid_version;
-    int family = ((cpuid_version >> 8) & 0x0f) + ((cpuid_version >> 20) & 0xff);
-    if (family == 4)
+    CPUState *cpu = ENV_GET_CPU((CPUX86State *)cpu_env);
+    int family = object_property_get_int(OBJECT(cpu), "family", NULL);
+    if (family == 4) {
         return "i486";
-    if (family == 5)
+    }
+    if (family == 5) {
         return "i586";
+    }
     return "i686";
 #else
     /* default is #define-d in each arch/ subdir */
commit 22169d415a1d1706f66a4fd50a3573d3f296b24f
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 28 21:27:39 2013 +0200

    gdbstub: Change gdb_register_coprocessor() argument to CPUState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index e58d06e..35ca7c2 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1906,11 +1906,10 @@ static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
    gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
  */
 
-void gdb_register_coprocessor(CPUArchState * env,
-                             gdb_reg_cb get_reg, gdb_reg_cb set_reg,
-                             int num_regs, const char *xml, int g_pos)
+void gdb_register_coprocessor(CPUState *cpu,
+                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
+                              int num_regs, const char *xml, int g_pos)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     GDBRegisterState *s;
     GDBRegisterState **p;
     static int last_reg = NUM_CORE_REGS;
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 0f1ad9a..1bd00ae 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -26,7 +26,7 @@ void gdbserver_fork(CPUArchState *);
 #endif
 /* Get or set a register.  Returns the size of the register.  */
 typedef int (*gdb_reg_cb)(CPUArchState *env, uint8_t *buf, int reg);
-void gdb_register_coprocessor(CPUArchState *env,
+void gdb_register_coprocessor(CPUState *cpu,
                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
                               int num_regs, const char *xml, int g_pos);
 
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 9105ad9..b0c3ca1 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1513,16 +1513,17 @@ ARMCPU *cpu_arm_init(const char *cpu_model)
 
 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
 {
+    CPUState *cs = CPU(cpu);
     CPUARMState *env = &cpu->env;
 
     if (arm_feature(env, ARM_FEATURE_NEON)) {
-        gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
+        gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  51, "arm-neon.xml", 0);
     } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
-        gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
+        gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  35, "arm-vfp3.xml", 0);
     } else if (arm_feature(env, ARM_FEATURE_VFP)) {
-        gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
+        gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  19, "arm-vfp.xml", 0);
     }
 }
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index dcadfab..00a7a08 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -121,10 +121,11 @@ M68kCPU *cpu_m68k_init(const char *cpu_model)
 
 void m68k_cpu_init_gdb(M68kCPU *cpu)
 {
+    CPUState *cs = CPU(cpu);
     CPUM68KState *env = &cpu->env;
 
     if (m68k_feature(env, M68K_FEATURE_CF_FPU)) {
-        gdb_register_coprocessor(env, fpu_gdb_get_reg, fpu_gdb_set_reg,
+        gdb_register_coprocessor(cs, fpu_gdb_get_reg, fpu_gdb_set_reg,
                                  11, "cf-fp.xml", 18);
     }
     /* TODO: Add [E]MAC registers.  */
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 0fc9014..0b0844f 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7804,8 +7804,8 @@ static int ppc_fixup_cpu(PowerPCCPU *cpu)
 
 static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     PowerPCCPU *cpu = POWERPC_CPU(dev);
-    CPUPPCState *env = &cpu->env;
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
     Error *local_err = NULL;
 #if !defined(CONFIG_USER_ONLY)
@@ -7849,15 +7849,15 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
     init_ppc_proc(cpu);
 
     if (pcc->insns_flags & PPC_FLOAT) {
-        gdb_register_coprocessor(env, gdb_get_float_reg, gdb_set_float_reg,
+        gdb_register_coprocessor(cs, gdb_get_float_reg, gdb_set_float_reg,
                                  33, "power-fpu.xml", 0);
     }
     if (pcc->insns_flags & PPC_ALTIVEC) {
-        gdb_register_coprocessor(env, gdb_get_avr_reg, gdb_set_avr_reg,
+        gdb_register_coprocessor(cs, gdb_get_avr_reg, gdb_set_avr_reg,
                                  34, "power-altivec.xml", 0);
     }
     if (pcc->insns_flags & PPC_SPE) {
-        gdb_register_coprocessor(env, gdb_get_spe_reg, gdb_set_spe_reg,
+        gdb_register_coprocessor(cs, gdb_get_spe_reg, gdb_set_spe_reg,
                                  34, "power-spe.xml", 0);
     }
 
@@ -7865,6 +7865,7 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
 
 #if defined(PPC_DUMP_CPU)
     {
+        CPUPPCState *env = &cpu->env;
         const char *mmu_model, *excp_model, *bus_model;
         switch (env->mmu_model) {
         case POWERPC_MMU_32B:
@@ -8016,10 +8017,10 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
             printf("                        none\n");
         printf("    Time-base/decrementer clock source: %s\n",
                env->flags & POWERPC_FLAG_RTC_CLK ? "RTC clock" : "bus clock");
+        dump_ppc_insns(env);
+        dump_ppc_sprs(env);
+        fflush(stdout);
     }
-    dump_ppc_insns(env);
-    dump_ppc_sprs(env);
-    fflush(stdout);
 #endif
 }
 
commit eac8b355f0015e44addce3e92030365b16d9da61
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 28 21:11:37 2013 +0200

    cpu: Move gdb_regs field from CPU_COMMON to CPUState
    
    Prepares for changing gdb_register_coprocessor() argument to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index ee31603..e58d06e 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1840,7 +1840,7 @@ static const char *get_feature_xml(const char *p, const char **newp)
         /* Generate the XML description for this CPU.  */
         if (!target_xml[0]) {
             GDBRegisterState *r;
-            CPUArchState *env = first_cpu->env_ptr;
+            CPUState *cpu = first_cpu;
 
             snprintf(target_xml, sizeof(target_xml),
                      "<?xml version=\"1.0\"?>"
@@ -1849,7 +1849,7 @@ static const char *get_feature_xml(const char *p, const char **newp)
                      "<xi:include href=\"%s\"/>",
                      GDB_CORE_XML);
 
-            for (r = env->gdb_regs; r; r = r->next) {
+            for (r = cpu->gdb_regs; r; r = r->next) {
                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
                 pstrcat(target_xml, sizeof(target_xml), r->xml);
                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
@@ -1875,7 +1875,7 @@ static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
     if (reg < NUM_CORE_REGS)
         return cpu_gdb_read_register(env, mem_buf, reg);
 
-    for (r = env->gdb_regs; r; r = r->next) {
+    for (r = cpu->gdb_regs; r; r = r->next) {
         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
             return r->get_reg(env, mem_buf, reg - r->base_reg);
         }
@@ -1891,7 +1891,7 @@ static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
     if (reg < NUM_CORE_REGS)
         return cpu_gdb_write_register(env, mem_buf, reg);
 
-    for (r = env->gdb_regs; r; r = r->next) {
+    for (r = cpu->gdb_regs; r; r = r->next) {
         if (r->base_reg <= reg && reg < r->base_reg + r->num_regs) {
             return r->set_reg(env, mem_buf, reg - r->base_reg);
         }
@@ -1910,11 +1910,12 @@ void gdb_register_coprocessor(CPUArchState * env,
                              gdb_reg_cb get_reg, gdb_reg_cb set_reg,
                              int num_regs, const char *xml, int g_pos)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     GDBRegisterState *s;
     GDBRegisterState **p;
     static int last_reg = NUM_CORE_REGS;
 
-    p = &env->gdb_regs;
+    p = &cpu->gdb_regs;
     while (*p) {
         /* Check for duplicates.  */
         if (strcmp((*p)->xml, xml) == 0)
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 12b1ca7..b5b93db 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -174,8 +174,6 @@ typedef struct CPUWatchpoint {
     QTAILQ_HEAD(watchpoints_head, CPUWatchpoint) watchpoints;            \
     CPUWatchpoint *watchpoint_hit;                                      \
                                                                         \
-    struct GDBRegisterState *gdb_regs;                                  \
-                                                                        \
     /* Core interrupt code */                                           \
     sigjmp_buf jmp_env;                                                 \
     int exception_index;                                                \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index f71ec2d..daf1835 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -141,6 +141,7 @@ struct kvm_run;
  * @singlestep_enabled: Flags for single-stepping.
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
+ * @gdb_regs: Additional GDB registers.
  * @next_cpu: Next CPU sharing TB cache.
  * @kvm_fd: vCPU file descriptor for KVM.
  *
@@ -175,6 +176,7 @@ struct CPUState {
 
     void *env_ptr; /* CPUArchState */
     struct TranslationBlock *current_tb;
+    struct GDBRegisterState *gdb_regs;
     CPUState *next_cpu;
 
     int kvm_fd;
commit 2e0f2cfba6c2169c07358e473841ec211009dd3c
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 27 19:19:39 2013 +0200

    gdbstub: Change GDBState::{c,g}_cpu and find_cpu() to CPUState
    
    Use CPUState::env_ptr where still needed.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 9e017ed..ee31603 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -288,8 +288,8 @@ enum RSState {
     RS_CHKSUM2,
 };
 typedef struct GDBState {
-    CPUArchState *c_cpu; /* current CPU for step/continue ops */
-    CPUArchState *g_cpu; /* current CPU for other ops */
+    CPUState *c_cpu; /* current CPU for step/continue ops */
+    CPUState *g_cpu; /* current CPU for other ops */
     CPUState *query_cpu; /* for q{f|s}ThreadInfo */
     enum RSState state; /* parsing state */
     char line_buf[MAX_PACKET_LENGTH];
@@ -1958,8 +1958,7 @@ static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
     int err = 0;
 
     if (kvm_enabled()) {
-        return kvm_insert_breakpoint(ENV_GET_CPU(gdbserver_state->c_cpu),
-                                     addr, len, type);
+        return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
     }
 
     switch (type) {
@@ -1997,8 +1996,7 @@ static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
     int err = 0;
 
     if (kvm_enabled()) {
-        return kvm_remove_breakpoint(ENV_GET_CPU(gdbserver_state->c_cpu),
-                                     addr, len, type);
+        return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
     }
 
     switch (type) {
@@ -2034,7 +2032,7 @@ static void gdb_breakpoint_remove_all(void)
     CPUArchState *env;
 
     if (kvm_enabled()) {
-        kvm_remove_all_breakpoints(ENV_GET_CPU(gdbserver_state->c_cpu));
+        kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
         return;
     }
 
@@ -2049,7 +2047,7 @@ static void gdb_breakpoint_remove_all(void)
 
 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 {
-    CPUState *cpu = ENV_GET_CPU(s->c_cpu);
+    CPUState *cpu = s->c_cpu;
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
     cpu_synchronize_state(cpu);
@@ -2058,13 +2056,13 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
     }
 }
 
-static CPUArchState *find_cpu(uint32_t thread_id)
+static CPUState *find_cpu(uint32_t thread_id)
 {
     CPUState *cpu;
 
     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         if (cpu_index(cpu) == thread_id) {
-            return cpu->env_ptr;
+            return cpu;
         }
     }
 
@@ -2073,7 +2071,10 @@ static CPUArchState *find_cpu(uint32_t thread_id)
 
 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 {
+#ifdef TARGET_XTENSA
     CPUArchState *env;
+#endif
+    CPUState *cpu;
     const char *p;
     uint32_t thread;
     int ch, reg_size, type, res;
@@ -2091,7 +2092,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
     case '?':
         /* TODO: Make this return the correct value for user-mode.  */
         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
-                 cpu_index(ENV_GET_CPU(s->c_cpu)));
+                 cpu_index(s->c_cpu));
         put_packet(s, buf);
         /* Remove all the breakpoints when this query is issued,
          * because gdb is doing and initial connect and the state
@@ -2153,15 +2154,15 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             }
             if (res) {
                 if (res_thread != -1 && res_thread != 0) {
-                    env = find_cpu(res_thread);
-                    if (env == NULL) {
+                    cpu = find_cpu(res_thread);
+                    if (cpu == NULL) {
                         put_packet(s, "E22");
                         break;
                     }
-                    s->c_cpu = env;
+                    s->c_cpu = cpu;
                 }
                 if (res == 's') {
-                    cpu_single_step(ENV_GET_CPU(s->c_cpu), sstep_flags);
+                    cpu_single_step(s->c_cpu, sstep_flags);
                 }
                 s->signal = res_signal;
                 gdb_continue(s);
@@ -2189,7 +2190,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             addr = strtoull(p, (char **)&p, 16);
             gdb_set_cpu_pc(s, addr);
         }
-        cpu_single_step(ENV_GET_CPU(s->c_cpu), sstep_flags);
+        cpu_single_step(s->c_cpu, sstep_flags);
         gdb_continue(s);
 	return RS_IDLE;
     case 'F':
@@ -2208,7 +2209,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
                 p++;
             type = *p;
             if (s->current_syscall_cb) {
-                s->current_syscall_cb(ENV_GET_CPU(s->c_cpu), ret, err);
+                s->current_syscall_cb(s->c_cpu, ret, err);
                 s->current_syscall_cb = NULL;
             }
             if (type == 'C') {
@@ -2219,26 +2220,28 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         }
         break;
     case 'g':
-        cpu_synchronize_state(ENV_GET_CPU(s->g_cpu));
-        env = s->g_cpu;
+        cpu_synchronize_state(s->g_cpu);
+#ifdef TARGET_XTENSA
+        env = s->g_cpu->env_ptr;
+#endif
         len = 0;
         for (addr = 0; addr < num_g_regs; addr++) {
-            reg_size = gdb_read_register(ENV_GET_CPU(s->g_cpu),
-                                         mem_buf + len, addr);
+            reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
             len += reg_size;
         }
         memtohex(buf, mem_buf, len);
         put_packet(s, buf);
         break;
     case 'G':
-        cpu_synchronize_state(ENV_GET_CPU(s->g_cpu));
-        env = s->g_cpu;
+        cpu_synchronize_state(s->g_cpu);
+#ifdef TARGET_XTENSA
+        env = s->g_cpu->env_ptr;
+#endif
         registers = mem_buf;
         len = strlen(p) / 2;
         hextomem((uint8_t *)registers, p, len);
         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
-            reg_size = gdb_write_register(ENV_GET_CPU(s->g_cpu), registers,
-                                          addr);
+            reg_size = gdb_write_register(s->g_cpu, registers, addr);
             len -= reg_size;
             registers += reg_size;
         }
@@ -2249,8 +2252,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         if (*p == ',')
             p++;
         len = strtoull(p, NULL, 16);
-        if (target_memory_rw_debug(ENV_GET_CPU(s->g_cpu), addr, mem_buf, len,
-                                   false) != 0) {
+        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
             put_packet (s, "E14");
         } else {
             memtohex(buf, mem_buf, len);
@@ -2265,7 +2267,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         if (*p == ':')
             p++;
         hextomem(mem_buf, p, len);
-        if (target_memory_rw_debug(ENV_GET_CPU(s->g_cpu), addr, mem_buf, len,
+        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
                                    true) != 0) {
             put_packet(s, "E14");
         } else {
@@ -2279,7 +2281,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         if (!gdb_has_xml)
             goto unknown_command;
         addr = strtoull(p, (char **)&p, 16);
-        reg_size = gdb_read_register(ENV_GET_CPU(s->g_cpu), mem_buf, addr);
+        reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
         if (reg_size) {
             memtohex(buf, mem_buf, reg_size);
             put_packet(s, buf);
@@ -2295,7 +2297,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             p++;
         reg_size = strlen(p) / 2;
         hextomem(mem_buf, p, reg_size);
-        gdb_write_register(ENV_GET_CPU(s->g_cpu), mem_buf, addr);
+        gdb_write_register(s->g_cpu, mem_buf, addr);
         put_packet(s, "OK");
         break;
     case 'Z':
@@ -2325,18 +2327,18 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             put_packet(s, "OK");
             break;
         }
-        env = find_cpu(thread);
-        if (env == NULL) {
+        cpu = find_cpu(thread);
+        if (cpu == NULL) {
             put_packet(s, "E22");
             break;
         }
         switch (type) {
         case 'c':
-            s->c_cpu = env;
+            s->c_cpu = cpu;
             put_packet(s, "OK");
             break;
         case 'g':
-            s->g_cpu = env;
+            s->g_cpu = cpu;
             put_packet(s, "OK");
             break;
         default:
@@ -2346,9 +2348,9 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         break;
     case 'T':
         thread = strtoull(p, (char **)&p, 16);
-        env = find_cpu(thread);
+        cpu = find_cpu(thread);
 
-        if (env != NULL) {
+        if (cpu != NULL) {
             put_packet(s, "OK");
         } else {
             put_packet(s, "E22");
@@ -2398,9 +2400,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             break;
         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
             thread = strtoull(p+16, (char **)&p, 16);
-            env = find_cpu(thread);
-            if (env != NULL) {
-                CPUState *cpu = ENV_GET_CPU(env);
+            cpu = find_cpu(thread);
+            if (cpu != NULL) {
                 cpu_synchronize_state(cpu);
                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
                                "CPU#%d [%s]", cpu->cpu_index,
@@ -2412,7 +2413,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         }
 #ifdef CONFIG_USER_ONLY
         else if (strncmp(p, "Offsets", 7) == 0) {
-            TaskState *ts = s->c_cpu->opaque;
+            CPUArchState *env = s->c_cpu->env_ptr;
+            TaskState *ts = env->opaque;
 
             snprintf(buf, sizeof(buf),
                      "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
@@ -2502,18 +2504,16 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
 
 void gdb_set_stop_cpu(CPUState *cpu)
 {
-    CPUArchState *env = cpu->env_ptr;
-
-    gdbserver_state->c_cpu = env;
-    gdbserver_state->g_cpu = env;
+    gdbserver_state->c_cpu = cpu;
+    gdbserver_state->g_cpu = cpu;
 }
 
 #ifndef CONFIG_USER_ONLY
 static void gdb_vm_state_change(void *opaque, int running, RunState state)
 {
     GDBState *s = gdbserver_state;
-    CPUArchState *env = s->c_cpu;
-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUArchState *env = s->c_cpu->env_ptr;
+    CPUState *cpu = s->c_cpu;
     char buf[256];
     const char *type;
     int ret;
@@ -2643,7 +2643,7 @@ void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
     va_end(va);
 #ifdef CONFIG_USER_ONLY
     put_packet(s, s->syscall_buf);
-    gdb_handlesig(ENV_GET_CPU(s->c_cpu), 0);
+    gdb_handlesig(s->c_cpu, 0);
 #else
     /* In this case wait to send the syscall packet until notification that
        the CPU has stopped.  This must be done because if the packet is sent
@@ -2651,7 +2651,7 @@ void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
        is still in the running state, which can cause packets to be dropped
        and state transition 'T' packets to be sent while the syscall is still
        being processed.  */
-    cpu_exit(ENV_GET_CPU(s->c_cpu));
+    cpu_exit(s->c_cpu);
 #endif
 }
 
@@ -2860,8 +2860,8 @@ static void gdb_accept(void)
     socket_set_nodelay(fd);
 
     s = g_malloc0(sizeof(GDBState));
-    s->c_cpu = first_cpu->env_ptr;
-    s->g_cpu = first_cpu->env_ptr;
+    s->c_cpu = first_cpu;
+    s->g_cpu = first_cpu;
     s->fd = fd;
     gdb_has_xml = 0;
 
@@ -3045,8 +3045,8 @@ int gdbserver_start(const char *device)
         mon_chr = s->mon_chr;
         memset(s, 0, sizeof(GDBState));
     }
-    s->c_cpu = first_cpu->env_ptr;
-    s->g_cpu = first_cpu->env_ptr;
+    s->c_cpu = first_cpu;
+    s->g_cpu = first_cpu;
     s->chr = chr;
     s->state = chr ? RS_IDLE : RS_INACTIVE;
     s->mon_chr = mon_chr;
commit f3659eee05793aede68b1791465fb2b0767bc1f2
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 27 19:09:09 2013 +0200

    cpu: Introduce CPUClass::memory_rw_debug() for target_memory_rw_debug()
    
    Make inline target_memory_rw_debug() always available and change its
    argument to CPUState. Let it check if CPUClass::memory_rw_debug provides
    a specialized callback and fall back to cpu_memory_rw_debug() otherwise.
    
    The only overriding implementation is for 32-bit sparc.
    
    This prepares for changing GDBState::g_cpu to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 6cefb17..9e017ed 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -42,15 +42,16 @@
 #include "sysemu/kvm.h"
 #include "qemu/bitops.h"
 
-#ifndef TARGET_CPU_MEMORY_RW_DEBUG
-static inline int target_memory_rw_debug(CPUArchState *env, target_ulong addr,
-                                         uint8_t *buf, int len, int is_write)
+static inline int target_memory_rw_debug(CPUState *cpu, target_ulong addr,
+                                         uint8_t *buf, int len, bool is_write)
 {
-    return cpu_memory_rw_debug(ENV_GET_CPU(env), addr, buf, len, is_write);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (cc->memory_rw_debug) {
+        return cc->memory_rw_debug(cpu, addr, buf, len, is_write);
+    }
+    return cpu_memory_rw_debug(cpu, addr, buf, len, is_write);
 }
-#else
-/* target_memory_rw_debug() defined in cpu.h */
-#endif
 
 enum {
     GDB_SIGNAL_0 = 0,
@@ -2248,7 +2249,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         if (*p == ',')
             p++;
         len = strtoull(p, NULL, 16);
-        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 0) != 0) {
+        if (target_memory_rw_debug(ENV_GET_CPU(s->g_cpu), addr, mem_buf, len,
+                                   false) != 0) {
             put_packet (s, "E14");
         } else {
             memtohex(buf, mem_buf, len);
@@ -2263,7 +2265,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         if (*p == ':')
             p++;
         hextomem(mem_buf, p, len);
-        if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, 1) != 0) {
+        if (target_memory_rw_debug(ENV_GET_CPU(s->g_cpu), addr, mem_buf, len,
+                                   true) != 0) {
             put_packet(s, "E14");
         } else {
             put_packet(s, "OK");
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 6366646..f71ec2d 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -70,6 +70,7 @@ struct TranslationBlock;
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @do_interrupt: Callback for interrupt handling.
  * @do_unassigned_access: Callback for unassigned access handling.
+ * @memory_rw_debug: Callback for GDB memory access.
  * @dump_state: Callback for dumping state.
  * @dump_statistics: Callback for dumping statistics.
  * @get_arch_id: Callback for getting architecture-dependent CPU ID.
@@ -94,6 +95,8 @@ typedef struct CPUClass {
     int reset_dump_flags;
     void (*do_interrupt)(CPUState *cpu);
     CPUUnassignedAccess do_unassigned_access;
+    int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
+                           uint8_t *buf, int len, bool is_write);
     void (*dump_state)(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                        int flags);
     void (*dump_statistics)(CPUState *cpu, FILE *f,
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 12494cc..d1d0339 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -782,6 +782,9 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = sparc_cpu_do_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
+#if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
+    cc->memory_rw_debug = sparc_cpu_memory_rw_debug;
+#endif
     cc->set_pc = sparc_cpu_set_pc;
     cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
 #ifndef CONFIG_USER_ONLY
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 0f35a22..41194ec 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -526,9 +526,8 @@ target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev);
 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUSPARCState *env);
 
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
-int target_memory_rw_debug(CPUSPARCState *env, target_ulong addr,
-                           uint8_t *buf, int len, int is_write);
-#define TARGET_CPU_MEMORY_RW_DEBUG
+int sparc_cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
+                              uint8_t *buf, int len, bool is_write);
 #endif
 
 
diff --git a/target-sparc/mmu_helper.c b/target-sparc/mmu_helper.c
index 45d08e4..ef12a0a 100644
--- a/target-sparc/mmu_helper.c
+++ b/target-sparc/mmu_helper.c
@@ -353,10 +353,12 @@ void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUSPARCState *env)
  * reads (and only reads) in stack frames as if windows were flushed. We assume
  * that the sparc ABI is followed.
  */
-int target_memory_rw_debug(CPUSPARCState *env, target_ulong addr,
-                           uint8_t *buf, int len, int is_write)
+int sparc_cpu_memory_rw_debug(CPUState *cs, vaddr address,
+                              uint8_t *buf, int len, bool is_write)
 {
-    CPUState *cs = CPU(sparc_env_get_cpu(env));
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    CPUSPARCState *env = &cpu->env;
+    target_ulong addr = address;
     int i;
     int len1;
     int cwp = env->cwp;
commit f17ec444c3d39f76bcd8b71c2c05d5754bfe333e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jun 29 19:40:58 2013 +0200

    exec: Change cpu_memory_rw_debug() argument to CPUState
    
    Propagate X86CPU in kvmvapic for simplicity.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 4549b7a..ca6b886 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1285,7 +1285,6 @@ void qmp_memsave(int64_t addr, int64_t size, const char *filename,
 {
     FILE *f;
     uint32_t l;
-    CPUArchState *env;
     CPUState *cpu;
     uint8_t buf[1024];
 
@@ -1299,7 +1298,6 @@ void qmp_memsave(int64_t addr, int64_t size, const char *filename,
                   "a CPU number");
         return;
     }
-    env = cpu->env_ptr;
 
     f = fopen(filename, "wb");
     if (!f) {
@@ -1311,7 +1309,7 @@ void qmp_memsave(int64_t addr, int64_t size, const char *filename,
         l = sizeof(buf);
         if (l > size)
             l = size;
-        cpu_memory_rw_debug(env, addr, buf, l, 0);
+        cpu_memory_rw_debug(cpu, addr, buf, l, 0);
         if (fwrite(buf, 1, l, f) != l) {
             error_set(errp, QERR_IO_ERROR);
             goto exit;
diff --git a/disas.c b/disas.c
index e51127e..71007fb 100644
--- a/disas.c
+++ b/disas.c
@@ -39,7 +39,7 @@ target_read_memory (bfd_vma memaddr,
 {
     CPUDebug *s = container_of(info, CPUDebug, info);
 
-    cpu_memory_rw_debug(s->env, memaddr, myaddr, length, 0);
+    cpu_memory_rw_debug(ENV_GET_CPU(s->env), memaddr, myaddr, length, 0);
     return 0;
 }
 
@@ -392,7 +392,7 @@ monitor_read_memory (bfd_vma memaddr, bfd_byte *myaddr, int length,
     if (monitor_disas_is_physical) {
         cpu_physical_memory_read(memaddr, myaddr, length);
     } else {
-        cpu_memory_rw_debug(s->env, memaddr,myaddr, length, 0);
+        cpu_memory_rw_debug(ENV_GET_CPU(s->env), memaddr, myaddr, length, 0);
     }
     return 0;
 }
diff --git a/exec.c b/exec.c
index a491af7..7997002 100644
--- a/exec.c
+++ b/exec.c
@@ -1835,7 +1835,7 @@ MemoryRegion *get_system_io(void)
 
 /* physical memory access (slow version, mainly for debug) */
 #if defined(CONFIG_USER_ONLY)
-int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
+int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                         uint8_t *buf, int len, int is_write)
 {
     int l, flags;
@@ -2606,7 +2606,7 @@ void stq_be_phys(hwaddr addr, uint64_t val)
 }
 
 /* virtual memory access for debug (includes writing to ROM) */
-int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
+int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                         uint8_t *buf, int len, int is_write)
 {
     int l;
@@ -2615,7 +2615,7 @@ int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
 
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
-        phys_addr = cpu_get_phys_page_debug(ENV_GET_CPU(env), page);
+        phys_addr = cpu_get_phys_page_debug(cpu, page);
         /* if no physical page mapped, return an error */
         if (phys_addr == -1)
             return -1;
diff --git a/gdbstub.c b/gdbstub.c
index 848754d..6cefb17 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -46,7 +46,7 @@
 static inline int target_memory_rw_debug(CPUArchState *env, target_ulong addr,
                                          uint8_t *buf, int len, int is_write)
 {
-    return cpu_memory_rw_debug(env, addr, buf, len, is_write);
+    return cpu_memory_rw_debug(ENV_GET_CPU(env), addr, buf, len, is_write);
 }
 #else
 /* target_memory_rw_debug() defined in cpu.h */
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 224601f..035d0fe 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -188,9 +188,10 @@ static bool opcode_matches(uint8_t *opcode, const TPRInstruction *instr)
          modrm_reg(opcode[1]) == instr->modrm_reg);
 }
 
-static int evaluate_tpr_instruction(VAPICROMState *s, CPUX86State *env,
+static int evaluate_tpr_instruction(VAPICROMState *s, X86CPU *cpu,
                                     target_ulong *pip, TPRAccess access)
 {
+    CPUState *cs = CPU(cpu);
     const TPRInstruction *instr;
     target_ulong ip = *pip;
     uint8_t opcode[2];
@@ -211,7 +212,7 @@ static int evaluate_tpr_instruction(VAPICROMState *s, CPUX86State *env,
      * RSP, used by the patched instruction, is zero, so the guest gets a
      * double fault and dies.
      */
-    if (env->regs[R_ESP] == 0) {
+    if (cpu->env.regs[R_ESP] == 0) {
         return -1;
     }
 
@@ -226,7 +227,7 @@ static int evaluate_tpr_instruction(VAPICROMState *s, CPUX86State *env,
             if (instr->access != access) {
                 continue;
             }
-            if (cpu_memory_rw_debug(env, ip - instr->length, opcode,
+            if (cpu_memory_rw_debug(cs, ip - instr->length, opcode,
                                     sizeof(opcode), 0) < 0) {
                 return -1;
             }
@@ -237,7 +238,7 @@ static int evaluate_tpr_instruction(VAPICROMState *s, CPUX86State *env,
         }
         return -1;
     } else {
-        if (cpu_memory_rw_debug(env, ip, opcode, sizeof(opcode), 0) < 0) {
+        if (cpu_memory_rw_debug(cs, ip, opcode, sizeof(opcode), 0) < 0) {
             return -1;
         }
         for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) {
@@ -254,7 +255,7 @@ instruction_ok:
      * Grab the virtual TPR address from the instruction
      * and update the cached values.
      */
-    if (cpu_memory_rw_debug(env, ip + instr->addr_offset,
+    if (cpu_memory_rw_debug(cs, ip + instr->addr_offset,
                             (void *)&real_tpr_addr,
                             sizeof(real_tpr_addr), 0) < 0) {
         return -1;
@@ -334,8 +335,9 @@ static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong i
  * cannot be accessed or is considered invalid. This also ensures that we are
  * not patching the wrong guest.
  */
-static int get_kpcr_number(CPUX86State *env)
+static int get_kpcr_number(X86CPU *cpu)
 {
+    CPUX86State *env = &cpu->env;
     struct kpcr {
         uint8_t  fill1[0x1c];
         uint32_t self;
@@ -343,7 +345,7 @@ static int get_kpcr_number(CPUX86State *env)
         uint8_t  number;
     } QEMU_PACKED kpcr;
 
-    if (cpu_memory_rw_debug(env, env->segs[R_FS].base,
+    if (cpu_memory_rw_debug(CPU(cpu), env->segs[R_FS].base,
                             (void *)&kpcr, sizeof(kpcr), 0) < 0 ||
         kpcr.self != env->segs[R_FS].base) {
         return -1;
@@ -351,9 +353,9 @@ static int get_kpcr_number(CPUX86State *env)
     return kpcr.number;
 }
 
-static int vapic_enable(VAPICROMState *s, CPUX86State *env)
+static int vapic_enable(VAPICROMState *s, X86CPU *cpu)
 {
-    int cpu_number = get_kpcr_number(env);
+    int cpu_number = get_kpcr_number(cpu);
     hwaddr vapic_paddr;
     static const uint8_t enabled = 1;
 
@@ -364,26 +366,26 @@ static int vapic_enable(VAPICROMState *s, CPUX86State *env)
         (((hwaddr)cpu_number) << VAPIC_CPU_SHIFT);
     cpu_physical_memory_rw(vapic_paddr + offsetof(VAPICState, enabled),
                            (void *)&enabled, sizeof(enabled), 1);
-    apic_enable_vapic(env->apic_state, vapic_paddr);
+    apic_enable_vapic(cpu->env.apic_state, vapic_paddr);
 
     s->state = VAPIC_ACTIVE;
 
     return 0;
 }
 
-static void patch_byte(CPUX86State *env, target_ulong addr, uint8_t byte)
+static void patch_byte(X86CPU *cpu, target_ulong addr, uint8_t byte)
 {
-    cpu_memory_rw_debug(env, addr, &byte, 1, 1);
+    cpu_memory_rw_debug(CPU(cpu), addr, &byte, 1, 1);
 }
 
-static void patch_call(VAPICROMState *s, CPUX86State *env, target_ulong ip,
+static void patch_call(VAPICROMState *s, X86CPU *cpu, target_ulong ip,
                        uint32_t target)
 {
     uint32_t offset;
 
     offset = cpu_to_le32(target - ip - 5);
-    patch_byte(env, ip, 0xe8); /* call near */
-    cpu_memory_rw_debug(env, ip + 1, (void *)&offset, sizeof(offset), 1);
+    patch_byte(cpu, ip, 0xe8); /* call near */
+    cpu_memory_rw_debug(CPU(cpu), ip + 1, (void *)&offset, sizeof(offset), 1);
 }
 
 static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
@@ -411,32 +413,32 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
 
     pause_all_vcpus();
 
-    cpu_memory_rw_debug(env, ip, opcode, sizeof(opcode), 0);
+    cpu_memory_rw_debug(cs, ip, opcode, sizeof(opcode), 0);
 
     switch (opcode[0]) {
     case 0x89: /* mov r32 to r/m32 */
-        patch_byte(env, ip, 0x50 + modrm_reg(opcode[1]));  /* push reg */
-        patch_call(s, env, ip + 1, handlers->set_tpr);
+        patch_byte(cpu, ip, 0x50 + modrm_reg(opcode[1]));  /* push reg */
+        patch_call(s, cpu, ip + 1, handlers->set_tpr);
         break;
     case 0x8b: /* mov r/m32 to r32 */
-        patch_byte(env, ip, 0x90);
-        patch_call(s, env, ip + 1, handlers->get_tpr[modrm_reg(opcode[1])]);
+        patch_byte(cpu, ip, 0x90);
+        patch_call(s, cpu, ip + 1, handlers->get_tpr[modrm_reg(opcode[1])]);
         break;
     case 0xa1: /* mov abs to eax */
-        patch_call(s, env, ip, handlers->get_tpr[0]);
+        patch_call(s, cpu, ip, handlers->get_tpr[0]);
         break;
     case 0xa3: /* mov eax to abs */
-        patch_call(s, env, ip, handlers->set_tpr_eax);
+        patch_call(s, cpu, ip, handlers->set_tpr_eax);
         break;
     case 0xc7: /* mov imm32, r/m32 (c7/0) */
-        patch_byte(env, ip, 0x68);  /* push imm32 */
-        cpu_memory_rw_debug(env, ip + 6, (void *)&imm32, sizeof(imm32), 0);
-        cpu_memory_rw_debug(env, ip + 1, (void *)&imm32, sizeof(imm32), 1);
-        patch_call(s, env, ip + 5, handlers->set_tpr);
+        patch_byte(cpu, ip, 0x68);  /* push imm32 */
+        cpu_memory_rw_debug(cs, ip + 6, (void *)&imm32, sizeof(imm32), 0);
+        cpu_memory_rw_debug(cs, ip + 1, (void *)&imm32, sizeof(imm32), 1);
+        patch_call(s, cpu, ip + 5, handlers->set_tpr);
         break;
     case 0xff: /* push r/m32 */
-        patch_byte(env, ip, 0x50); /* push eax */
-        patch_call(s, env, ip + 1, handlers->get_tpr_stack);
+        patch_byte(cpu, ip, 0x50); /* push eax */
+        patch_call(s, cpu, ip + 1, handlers->get_tpr_stack);
         break;
     default:
         abort();
@@ -460,16 +462,16 @@ void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
 
     cpu_synchronize_state(cs);
 
-    if (evaluate_tpr_instruction(s, env, &ip, access) < 0) {
+    if (evaluate_tpr_instruction(s, cpu, &ip, access) < 0) {
         if (s->state == VAPIC_ACTIVE) {
-            vapic_enable(s, env);
+            vapic_enable(s, cpu);
         }
         return;
     }
     if (update_rom_mapping(s, env, ip) < 0) {
         return;
     }
-    if (vapic_enable(s, env) < 0) {
+    if (vapic_enable(s, cpu) < 0) {
         return;
     }
     patch_instruction(s, cpu, ip);
@@ -669,8 +671,8 @@ static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
              * accurate.
              */
             pause_all_vcpus();
-            patch_byte(env, env->eip - 2, 0x66);
-            patch_byte(env, env->eip - 1, 0x90);
+            patch_byte(cpu, env->eip - 2, 0x66);
+            patch_byte(cpu, env->eip - 1, 0x90);
             resume_all_vcpus();
         }
 
@@ -683,7 +685,7 @@ static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
         if (find_real_tpr_addr(s, env) < 0) {
             break;
         }
-        vapic_enable(s, env);
+        vapic_enable(s, cpu);
         break;
     default:
     case 4:
@@ -725,7 +727,7 @@ static void do_vapic_enable(void *data)
     VAPICROMState *s = data;
     X86CPU *cpu = X86_CPU(first_cpu);
 
-    vapic_enable(s, &cpu->env);
+    vapic_enable(s, cpu);
 }
 
 static int vapic_post_load(void *opaque, int version_id)
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index ef16cbd..f2800ec 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -22,6 +22,7 @@
 #include "qemu-common.h"
 #include "exec/cpu-common.h"
 #include "qemu/thread.h"
+#include "qom/cpu.h"
 
 /* some important defines:
  *
@@ -483,7 +484,7 @@ void qemu_mutex_lock_ramlist(void);
 void qemu_mutex_unlock_ramlist(void);
 #endif /* !CONFIG_USER_ONLY */
 
-int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
+int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
                         uint8_t *buf, int len, int is_write);
 
 #endif /* CPU_ALL_H */
diff --git a/include/exec/softmmu-semi.h b/include/exec/softmmu-semi.h
index 93798b9..8401f7d 100644
--- a/include/exec/softmmu-semi.h
+++ b/include/exec/softmmu-semi.h
@@ -13,14 +13,14 @@ static inline uint32_t softmmu_tget32(CPUArchState *env, uint32_t addr)
 {
     uint32_t val;
 
-    cpu_memory_rw_debug(env, addr, (uint8_t *)&val, 4, 0);
+    cpu_memory_rw_debug(ENV_GET_CPU(env), addr, (uint8_t *)&val, 4, 0);
     return tswap32(val);
 }
 static inline uint32_t softmmu_tget8(CPUArchState *env, uint32_t addr)
 {
     uint8_t val;
 
-    cpu_memory_rw_debug(env, addr, &val, 1, 0);
+    cpu_memory_rw_debug(ENV_GET_CPU(env), addr, &val, 1, 0);
     return val;
 }
 
@@ -31,7 +31,7 @@ static inline uint32_t softmmu_tget8(CPUArchState *env, uint32_t addr)
 static inline void softmmu_tput32(CPUArchState *env, uint32_t addr, uint32_t val)
 {
     val = tswap32(val);
-    cpu_memory_rw_debug(env, addr, (uint8_t *)&val, 4, 1);
+    cpu_memory_rw_debug(ENV_GET_CPU(env), addr, (uint8_t *)&val, 4, 1);
 }
 #define put_user_u32(arg, p) ({ softmmu_tput32(env, p, arg) ; 0; })
 #define put_user_ual(arg, p) put_user_u32(arg, p)
@@ -42,8 +42,9 @@ static void *softmmu_lock_user(CPUArchState *env, uint32_t addr, uint32_t len,
     uint8_t *p;
     /* TODO: Make this something that isn't fixed size.  */
     p = malloc(len);
-    if (p && copy)
-        cpu_memory_rw_debug(env, addr, p, len, 0);
+    if (p && copy) {
+        cpu_memory_rw_debug(ENV_GET_CPU(env), addr, p, len, 0);
+    }
     return p;
 }
 #define lock_user(type, p, len, copy) softmmu_lock_user(env, p, len, copy)
@@ -58,7 +59,7 @@ static char *softmmu_lock_user_string(CPUArchState *env, uint32_t addr)
         return NULL;
     }
     do {
-        cpu_memory_rw_debug(env, addr, &c, 1, 0);
+        cpu_memory_rw_debug(ENV_GET_CPU(env), addr, &c, 1, 0);
         addr++;
         *(p++) = c;
     } while (c);
@@ -68,8 +69,9 @@ static char *softmmu_lock_user_string(CPUArchState *env, uint32_t addr)
 static void softmmu_unlock_user(CPUArchState *env, void *p, target_ulong addr,
                                 target_ulong len)
 {
-    if (len)
-        cpu_memory_rw_debug(env, addr, p, len, 1);
+    if (len) {
+        cpu_memory_rw_debug(ENV_GET_CPU(env), addr, p, len, 1);
+    }
     free(p);
 }
 #define unlock_user(s, args, len) softmmu_unlock_user(env, s, args, len)
diff --git a/monitor.c b/monitor.c
index 6db2ba4..5dc0aa9 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1164,7 +1164,7 @@ static void memory_dump(Monitor *mon, int count, int format, int wsize,
             cpu_physical_memory_read(addr, buf, l);
         } else {
             env = mon_get_cpu();
-            if (cpu_memory_rw_debug(env, addr, buf, l, 0) < 0) {
+            if (cpu_memory_rw_debug(ENV_GET_CPU(env), addr, buf, l, 0) < 0) {
                 monitor_printf(mon, " Cannot access memory\n");
                 break;
             }
diff --git a/target-arm/arm-semi.c b/target-arm/arm-semi.c
index 4ecea65..ee469c4 100644
--- a/target-arm/arm-semi.c
+++ b/target-arm/arm-semi.c
@@ -161,7 +161,7 @@ static void arm_semi_flen_cb(CPUState *cs, target_ulong ret, target_ulong err)
     /* The size is always stored in big-endian order, extract
        the value. We assume the size always fit in 32 bits.  */
     uint32_t size;
-    cpu_memory_rw_debug(env, env->regs[13]-64+32, (uint8_t *)&size, 4, 0);
+    cpu_memory_rw_debug(cs, env->regs[13]-64+32, (uint8_t *)&size, 4, 0);
     env->regs[0] = be32_to_cpu(size);
 #ifdef CONFIG_USER_ONLY
     ((TaskState *)env->opaque)->swi_errno = err;
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 2745292..bf3e2ac 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -363,7 +363,7 @@ void x86_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
 
         cpu_fprintf(f, "Code=");
         for (i = 0; i < DUMP_CODE_BYTES_TOTAL; i++) {
-            if (cpu_memory_rw_debug(env, base - offs + i, &code, 1, 0) == 0) {
+            if (cpu_memory_rw_debug(cs, base - offs + i, &code, 1, 0) == 0) {
                 snprintf(codestr, sizeof(codestr), "%02x", code);
             } else {
                 snprintf(codestr, sizeof(codestr), "??");
@@ -1260,6 +1260,8 @@ int cpu_x86_get_descr_debug(CPUX86State *env, unsigned int selector,
                             target_ulong *base, unsigned int *limit,
                             unsigned int *flags)
 {
+    X86CPU *cpu = x86_env_get_cpu(env);
+    CPUState *cs = CPU(cpu);
     SegmentCache *dt;
     target_ulong ptr;
     uint32_t e1, e2;
@@ -1272,8 +1274,8 @@ int cpu_x86_get_descr_debug(CPUX86State *env, unsigned int selector,
     index = selector & ~7;
     ptr = dt->base + index;
     if ((index + 7) > dt->limit
-        || cpu_memory_rw_debug(env, ptr, (uint8_t *)&e1, sizeof(e1), 0) != 0
-        || cpu_memory_rw_debug(env, ptr+4, (uint8_t *)&e2, sizeof(e2), 0) != 0)
+        || cpu_memory_rw_debug(cs, ptr, (uint8_t *)&e1, sizeof(e1), 0) != 0
+        || cpu_memory_rw_debug(cs, ptr+4, (uint8_t *)&e2, sizeof(e2), 0) != 0)
         return 0;
 
     *base = ((e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000));
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 5138882..3c9d10a 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -1932,25 +1932,23 @@ static int kvm_handle_tpr_access(X86CPU *cpu)
     return 1;
 }
 
-int kvm_arch_insert_sw_breakpoint(CPUState *cpu, struct kvm_sw_breakpoint *bp)
+int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 {
-    CPUX86State *env = &X86_CPU(cpu)->env;
     static const uint8_t int3 = 0xcc;
 
-    if (cpu_memory_rw_debug(env, bp->pc, (uint8_t *)&bp->saved_insn, 1, 0) ||
-        cpu_memory_rw_debug(env, bp->pc, (uint8_t *)&int3, 1, 1)) {
+    if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 0) ||
+        cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&int3, 1, 1)) {
         return -EINVAL;
     }
     return 0;
 }
 
-int kvm_arch_remove_sw_breakpoint(CPUState *cpu, struct kvm_sw_breakpoint *bp)
+int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 {
-    CPUX86State *env = &X86_CPU(cpu)->env;
     uint8_t int3;
 
-    if (cpu_memory_rw_debug(env, bp->pc, &int3, 1, 0) || int3 != 0xcc ||
-        cpu_memory_rw_debug(env, bp->pc, (uint8_t *)&bp->saved_insn, 1, 1)) {
+    if (cpu_memory_rw_debug(cs, bp->pc, &int3, 1, 0) || int3 != 0xcc ||
+        cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 1)) {
         return -EINVAL;
     }
     return 0;
diff --git a/target-sparc/mmu_helper.c b/target-sparc/mmu_helper.c
index 846d129..45d08e4 100644
--- a/target-sparc/mmu_helper.c
+++ b/target-sparc/mmu_helper.c
@@ -356,6 +356,7 @@ void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUSPARCState *env)
 int target_memory_rw_debug(CPUSPARCState *env, target_ulong addr,
                            uint8_t *buf, int len, int is_write)
 {
+    CPUState *cs = CPU(sparc_env_get_cpu(env));
     int i;
     int len1;
     int cwp = env->cwp;
@@ -390,7 +391,7 @@ int target_memory_rw_debug(CPUSPARCState *env, target_ulong addr,
             /* Handle access before this window.  */
             if (addr < fp) {
                 len1 = fp - addr;
-                if (cpu_memory_rw_debug(env, addr, buf, len1, is_write) != 0) {
+                if (cpu_memory_rw_debug(cs, addr, buf, len1, is_write) != 0) {
                     return -1;
                 }
                 addr += len1;
@@ -426,7 +427,7 @@ int target_memory_rw_debug(CPUSPARCState *env, target_ulong addr,
             }
         }
     }
-    return cpu_memory_rw_debug(env, addr, buf, len, is_write);
+    return cpu_memory_rw_debug(cs, addr, buf, len, is_write);
 }
 
 #else /* !TARGET_SPARC64 */
diff --git a/target-xtensa/xtensa-semi.c b/target-xtensa/xtensa-semi.c
index d9dd222..424253d 100644
--- a/target-xtensa/xtensa-semi.c
+++ b/target-xtensa/xtensa-semi.c
@@ -204,8 +204,8 @@ void HELPER(simcall)(CPUXtensaState *env)
             int i;
 
             for (i = 0; i < ARRAY_SIZE(name); ++i) {
-                rc = cpu_memory_rw_debug(
-                        env, regs[3] + i, (uint8_t *)name + i, 1, 0);
+                rc = cpu_memory_rw_debug(cs, regs[3] + i,
+                                         (uint8_t *)name + i, 1, 0);
                 if (rc != 0 || name[i] == 0) {
                     break;
                 }
@@ -249,7 +249,7 @@ void HELPER(simcall)(CPUXtensaState *env)
             FD_SET(fd, &fdset);
 
             if (target_tv) {
-                cpu_memory_rw_debug(env, target_tv,
+                cpu_memory_rw_debug(cs, target_tv,
                         (uint8_t *)target_tvv, sizeof(target_tvv), 0);
                 tv.tv_sec = (int32_t)tswap32(target_tvv[0]);
                 tv.tv_usec = (int32_t)tswap32(target_tvv[1]);
@@ -284,8 +284,8 @@ void HELPER(simcall)(CPUXtensaState *env)
             };
 
             argv.argptr[0] = tswap32(regs[3] + offsetof(struct Argv, text));
-            cpu_memory_rw_debug(
-                    env, regs[3], (uint8_t *)&argv, sizeof(argv), 1);
+            cpu_memory_rw_debug(cs,
+                                regs[3], (uint8_t *)&argv, sizeof(argv), 1);
         }
         break;
 
commit 00b941e581b5c42645f836ef530705bb76a3e6bb
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jun 29 18:55:54 2013 +0200

    cpu: Turn cpu_get_phys_page_debug() into a CPUClass hook
    
    Change breakpoint_invalidate() argument to CPUState alongside.
    
    Since all targets now assign a softmmu-only field, we can drop helpers
    cpu_class_set_{do_unassigned_access,vmsd}() and device_class_set_vmsd().
    
    Prepares for changing cpu_memory_rw_debug() argument to CPUState.
    
    Acked-by: Max Filippov <jcmvbkbc at gmail.com> (for xtensa)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/exec.c b/exec.c
index 9cd936c..a491af7 100644
--- a/exec.c
+++ b/exec.c
@@ -415,14 +415,14 @@ void cpu_exec_init(CPUArchState *env)
 
 #if defined(TARGET_HAS_ICE)
 #if defined(CONFIG_USER_ONLY)
-static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)
+static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
 {
     tb_invalidate_phys_page_range(pc, pc + 1, 0);
 }
 #else
-static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)
+static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
 {
-    tb_invalidate_phys_addr(cpu_get_phys_page_debug(env, pc) |
+    tb_invalidate_phys_addr(cpu_get_phys_page_debug(cpu, pc) |
             (pc & ~TARGET_PAGE_MASK));
 }
 #endif
@@ -525,15 +525,17 @@ int cpu_breakpoint_insert(CPUArchState *env, target_ulong pc, int flags,
     bp->flags = flags;
 
     /* keep all GDB-injected breakpoints in front */
-    if (flags & BP_GDB)
+    if (flags & BP_GDB) {
         QTAILQ_INSERT_HEAD(&env->breakpoints, bp, entry);
-    else
+    } else {
         QTAILQ_INSERT_TAIL(&env->breakpoints, bp, entry);
+    }
 
-    breakpoint_invalidate(env, pc);
+    breakpoint_invalidate(ENV_GET_CPU(env), pc);
 
-    if (breakpoint)
+    if (breakpoint) {
         *breakpoint = bp;
+    }
     return 0;
 #else
     return -ENOSYS;
@@ -564,7 +566,7 @@ void cpu_breakpoint_remove_by_ref(CPUArchState *env, CPUBreakpoint *breakpoint)
 #if defined(TARGET_HAS_ICE)
     QTAILQ_REMOVE(&env->breakpoints, breakpoint, entry);
 
-    breakpoint_invalidate(env, breakpoint->pc);
+    breakpoint_invalidate(ENV_GET_CPU(env), breakpoint->pc);
 
     g_free(breakpoint);
 #endif
@@ -2613,7 +2615,7 @@ int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
 
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
-        phys_addr = cpu_get_phys_page_debug(env, page);
+        phys_addr = cpu_get_phys_page_debug(ENV_GET_CPU(env), page);
         /* if no physical page mapped, return an error */
         if (phys_addr == -1)
             return -1;
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index ccd089a..224601f 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -146,6 +146,7 @@ static void update_guest_rom_state(VAPICROMState *s)
 
 static int find_real_tpr_addr(VAPICROMState *s, CPUX86State *env)
 {
+    CPUState *cs = CPU(x86_env_get_cpu(env));
     hwaddr paddr;
     target_ulong addr;
 
@@ -158,7 +159,7 @@ static int find_real_tpr_addr(VAPICROMState *s, CPUX86State *env)
      * virtual address space for the APIC mapping.
      */
     for (addr = 0xfffff000; addr >= 0x80000000; addr -= TARGET_PAGE_SIZE) {
-        paddr = cpu_get_phys_page_debug(env, addr);
+        paddr = cpu_get_phys_page_debug(cs, addr);
         if (paddr != APIC_DEFAULT_ADDRESS) {
             continue;
         }
@@ -271,6 +272,7 @@ instruction_ok:
 
 static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong ip)
 {
+    CPUState *cs = CPU(x86_env_get_cpu(env));
     hwaddr paddr;
     uint32_t rom_state_vaddr;
     uint32_t pos, patch, offset;
@@ -287,7 +289,7 @@ static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong i
 
     /* find out virtual address of the ROM */
     rom_state_vaddr = s->rom_state_paddr + (ip & 0xf0000000);
-    paddr = cpu_get_phys_page_debug(env, rom_state_vaddr);
+    paddr = cpu_get_phys_page_debug(cs, rom_state_vaddr);
     if (paddr == -1) {
         return -1;
     }
diff --git a/hw/xtensa/xtensa_lx60.c b/hw/xtensa/xtensa_lx60.c
index 075daf1..1138666 100644
--- a/hw/xtensa/xtensa_lx60.c
+++ b/hw/xtensa/xtensa_lx60.c
@@ -144,9 +144,11 @@ static void lx60_net_init(MemoryRegion *address_space,
     memory_region_add_subregion(address_space, buffers, ram);
 }
 
-static uint64_t translate_phys_addr(void *env, uint64_t addr)
+static uint64_t translate_phys_addr(void *opaque, uint64_t addr)
 {
-    return cpu_get_phys_page_debug(env, addr);
+    XtensaCPU *cpu = opaque;
+
+    return cpu_get_phys_page_debug(CPU(cpu), addr);
 }
 
 static void lx60_reset(void *opaque)
@@ -252,7 +254,7 @@ static void lx_init(const LxBoardDesc *board, QEMUMachineInitArgs *args)
         }
         uint64_t elf_entry;
         uint64_t elf_lowaddr;
-        int success = load_elf(kernel_filename, translate_phys_addr, env,
+        int success = load_elf(kernel_filename, translate_phys_addr, cpu,
                 &elf_entry, &elf_lowaddr, NULL, be, ELF_MACHINE, 0);
         if (success > 0) {
             env->pc = elf_entry;
diff --git a/hw/xtensa/xtensa_sim.c b/hw/xtensa/xtensa_sim.c
index a88707e..ea91162 100644
--- a/hw/xtensa/xtensa_sim.c
+++ b/hw/xtensa/xtensa_sim.c
@@ -32,9 +32,11 @@
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
 
-static uint64_t translate_phys_addr(void *env, uint64_t addr)
+static uint64_t translate_phys_addr(void *opaque, uint64_t addr)
 {
-    return cpu_get_phys_page_debug(env, addr);
+    XtensaCPU *cpu = opaque;
+
+    return cpu_get_phys_page_debug(CPU(cpu), addr);
 }
 
 static void sim_reset(void *opaque)
@@ -88,10 +90,10 @@ static void xtensa_sim_init(QEMUMachineInitArgs *args)
         uint64_t elf_entry;
         uint64_t elf_lowaddr;
 #ifdef TARGET_WORDS_BIGENDIAN
-        int success = load_elf(kernel_filename, translate_phys_addr, env,
+        int success = load_elf(kernel_filename, translate_phys_addr, cpu,
                 &elf_entry, &elf_lowaddr, NULL, 1, ELF_MACHINE, 0);
 #else
-        int success = load_elf(kernel_filename, translate_phys_addr, env,
+        int success = load_elf(kernel_filename, translate_phys_addr, cpu,
                 &elf_entry, &elf_lowaddr, NULL, 0, ELF_MACHINE, 0);
 #endif
         if (success > 0) {
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index b48db03..ef16cbd 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -430,11 +430,6 @@ void cpu_watchpoint_remove_all(CPUArchState *env, int mask);
 
 #if !defined(CONFIG_USER_ONLY)
 
-/* Return the physical page corresponding to a virtual one. Use it
-   only for debugging because no protection checks are done. Return -1
-   if no page found. */
-hwaddr cpu_get_phys_page_debug(CPUArchState *env, target_ulong addr);
-
 /* memory API */
 
 extern ram_addr_t ram_size;
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 43a52e4..6366646 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -78,6 +78,7 @@ struct TranslationBlock;
  * @set_pc: Callback for setting the Program Counter register.
  * @synchronize_from_tb: Callback for synchronizing state from a TCG
  * #TranslationBlock.
+ * @get_phys_page_debug: Callback for obtaining a physical address.
  * @vmsd: State description for migration.
  *
  * Represents a CPU family or model.
@@ -103,6 +104,7 @@ typedef struct CPUClass {
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
     void (*synchronize_from_tb)(CPUState *cpu, struct TranslationBlock *tb);
+    hwaddr (*get_phys_page_debug)(CPUState *cpu, vaddr addr);
 
     const struct VMStateDescription *vmsd;
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
@@ -280,6 +282,25 @@ void cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
 void cpu_dump_statistics(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
 
+#ifndef CONFIG_USER_ONLY
+/**
+ * cpu_get_phys_page_debug:
+ * @cpu: The CPU to obtain the physical page address for.
+ * @addr: The virtual address.
+ *
+ * Obtains the physical page corresponding to a virtual one.
+ * Use it only for debugging because no protection checks are done.
+ *
+ * Returns: Corresponding physical page address or -1 if no page found.
+ */
+static inline hwaddr cpu_get_phys_page_debug(CPUState *cpu, vaddr addr)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    return cc->get_phys_page_debug(cpu, addr);
+}
+#endif
+
 /**
  * cpu_reset:
  * @cpu: The CPU whose state is to be reset.
@@ -298,59 +319,6 @@ void cpu_reset(CPUState *cpu);
 ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model);
 
 /**
- * cpu_class_set_vmsd:
- * @cc: CPU class
- * @value: Value to set. Unused for %CONFIG_USER_ONLY.
- *
- * Sets #VMStateDescription for @cc.
- *
- * The @value argument is intentionally discarded for the non-softmmu targets
- * to avoid linker errors or excessive preprocessor usage. If this behavior
- * is undesired, you should assign #CPUClass.vmsd directly instead.
- */
-#ifndef CONFIG_USER_ONLY
-static inline void cpu_class_set_vmsd(CPUClass *cc,
-                                      const struct VMStateDescription *value)
-{
-    cc->vmsd = value;
-}
-#else
-#define cpu_class_set_vmsd(cc, value) ((cc)->vmsd = NULL)
-#endif
-
-#ifndef CONFIG_USER_ONLY
-static inline void cpu_class_set_do_unassigned_access(CPUClass *cc,
-                                                      CPUUnassignedAccess value)
-{
-    cc->do_unassigned_access = value;
-}
-#else
-#define cpu_class_set_do_unassigned_access(cc, value) \
-    ((cc)->do_unassigned_access = NULL)
-#endif
-
-/**
- * device_class_set_vmsd:
- * @dc: Device class
- * @value: Value to set. Unused for %CONFIG_USER_ONLY.
- *
- * Sets #VMStateDescription for @dc.
- *
- * The @value argument is intentionally discarded for the non-softmmu targets
- * to avoid linker errors or excessive preprocessor usage. If this behavior
- * is undesired, you should assign #DeviceClass.vmsd directly instead.
- */
-#ifndef CONFIG_USER_ONLY
-static inline void device_class_set_vmsd(DeviceClass *dc,
-                                         const struct VMStateDescription *value)
-{
-    dc->vmsd = value;
-}
-#else
-#define device_class_set_vmsd(dc, value) ((dc)->vmsd = NULL)
-#endif
-
-/**
  * qemu_cpu_has_work:
  * @cpu: The vCPU to check.
  *
diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index 60125b1..b2eeba3 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -81,5 +81,6 @@ extern const struct VMStateDescription vmstate_alpha_cpu;
 void alpha_cpu_do_interrupt(CPUState *cpu);
 void alpha_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
                           int flags);
+hwaddr alpha_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 09bb7a8..c8c8c2c 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -270,9 +270,12 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->do_interrupt = alpha_cpu_do_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
-    cpu_class_set_do_unassigned_access(cc, alpha_cpu_unassigned_access);
     cc->set_pc = alpha_cpu_set_pc;
-    device_class_set_vmsd(dc, &vmstate_alpha_cpu);
+#ifndef CONFIG_USER_ONLY
+    cc->do_unassigned_access = alpha_cpu_unassigned_access;
+    cc->get_phys_page_debug = alpha_cpu_get_phys_page_debug;
+    dc->vmsd = &vmstate_alpha_cpu;
+#endif
 }
 
 static const TypeInfo alpha_cpu_type_info = {
diff --git a/target-alpha/helper.c b/target-alpha/helper.c
index ff57dd6..fc61bb0 100644
--- a/target-alpha/helper.c
+++ b/target-alpha/helper.c
@@ -315,12 +315,13 @@ static int get_physical_address(CPUAlphaState *env, target_ulong addr,
     return ret;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUAlphaState *env, target_ulong addr)
+hwaddr alpha_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    AlphaCPU *cpu = ALPHA_CPU(cs);
     target_ulong phys;
     int prot, fail;
 
-    fail = get_physical_address(env, addr, 0, 0, &phys, &prot);
+    fail = get_physical_address(&cpu->env, addr, 0, 0, &phys, &prot);
     return (fail >= 0 ? -1 : phys);
 }
 
diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 48ba605..02162c9 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -147,4 +147,6 @@ void arm_v7m_cpu_do_interrupt(CPUState *cpu);
 void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
                         int flags);
 
+hwaddr arm_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+
 #endif
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 082bc12..d3906a4 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -824,7 +824,10 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = arm_cpu_do_interrupt;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
-    cpu_class_set_vmsd(cc, &vmstate_arm_cpu);
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = arm_cpu_get_phys_page_debug;
+    cc->vmsd = &vmstate_arm_cpu;
+#endif
 }
 
 static void cpu_register(const ARMCPUInfo *info)
diff --git a/target-arm/helper.c b/target-arm/helper.c
index aeae024..9105ad9 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -2762,17 +2762,19 @@ int cpu_arm_handle_mmu_fault (CPUARMState *env, target_ulong address,
     return 1;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUARMState *env, target_ulong addr)
+hwaddr arm_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    ARMCPU *cpu = ARM_CPU(cs);
     hwaddr phys_addr;
     target_ulong page_size;
     int prot;
     int ret;
 
-    ret = get_phys_addr(env, addr, 0, 0, &phys_addr, &prot, &page_size);
+    ret = get_phys_addr(&cpu->env, addr, 0, 0, &phys_addr, &prot, &page_size);
 
-    if (ret != 0)
+    if (ret != 0) {
         return -1;
+    }
 
     return phys_addr;
 }
diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index af7d14d..d7baf07 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -79,4 +79,6 @@ void crisv10_cpu_do_interrupt(CPUState *cpu);
 void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
 
+hwaddr cris_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+
 #endif
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index b72fd98..ba095e7 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -255,6 +255,9 @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = cris_cpu_do_interrupt;
     cc->dump_state = cris_cpu_dump_state;
     cc->set_pc = cris_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = cris_cpu_get_phys_page_debug;
+#endif
 }
 
 static const TypeInfo cris_cpu_type_info = {
diff --git a/target-cris/helper.c b/target-cris/helper.c
index aba7537..d274b38 100644
--- a/target-cris/helper.c
+++ b/target-cris/helper.c
@@ -255,16 +255,17 @@ void cris_cpu_do_interrupt(CPUState *cs)
           env->pregs[PR_ERP]);
 }
 
-hwaddr cpu_get_phys_page_debug(CPUCRISState * env, target_ulong addr)
+hwaddr cris_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    CRISCPU *cpu = CRIS_CPU(cs);
     uint32_t phy = addr;
     struct cris_mmu_result res;
     int miss;
 
-    miss = cris_mmu_translate(&res, env, addr, 0, 0, 1);
+    miss = cris_mmu_translate(&res, &cpu->env, addr, 0, 0, 1);
     /* If D TLB misses, try I TLB.  */
     if (miss) {
-        miss = cris_mmu_translate(&res, env, addr, 2, 0, 1);
+        miss = cris_mmu_translate(&res, &cpu->env, addr, 2, 0, 1);
     }
 
     if (!miss) {
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 7e55e5f..d928562 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -104,4 +104,6 @@ void x86_cpu_get_memory_mapping(CPUState *cpu, MemoryMappingList *list,
 void x86_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
                         int flags);
 
+hwaddr x86_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+
 #endif
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index b57ea4b..cd350cb 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2542,12 +2542,13 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->get_paging_enabled = x86_cpu_get_paging_enabled;
 #ifndef CONFIG_USER_ONLY
     cc->get_memory_mapping = x86_cpu_get_memory_mapping;
+    cc->get_phys_page_debug = x86_cpu_get_phys_page_debug;
     cc->write_elf64_note = x86_cpu_write_elf64_note;
     cc->write_elf64_qemunote = x86_cpu_write_elf64_qemunote;
     cc->write_elf32_note = x86_cpu_write_elf32_note;
     cc->write_elf32_qemunote = x86_cpu_write_elf32_qemunote;
+    cc->vmsd = &vmstate_x86_cpu;
 #endif
-    cpu_class_set_vmsd(cc, &vmstate_x86_cpu);
 }
 
 static const TypeInfo x86_cpu_type_info = {
diff --git a/target-i386/helper.c b/target-i386/helper.c
index d6f43d7..2745292 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -884,8 +884,10 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
     return 1;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUX86State *env, target_ulong addr)
+hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
     target_ulong pde_addr, pte_addr;
     uint64_t pte;
     hwaddr paddr;
diff --git a/target-lm32/cpu-qom.h b/target-lm32/cpu-qom.h
index e3bb619..9e27329 100644
--- a/target-lm32/cpu-qom.h
+++ b/target-lm32/cpu-qom.h
@@ -78,5 +78,6 @@ extern const struct VMStateDescription vmstate_lm32_cpu;
 void lm32_cpu_do_interrupt(CPUState *cpu);
 void lm32_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
+hwaddr lm32_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 8aa28b5..ce55e48 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -87,7 +87,10 @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = lm32_cpu_do_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
     cc->set_pc = lm32_cpu_set_pc;
-    cpu_class_set_vmsd(cc, &vmstate_lm32_cpu);
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
+    cc->vmsd = &vmstate_lm32_cpu;
+#endif
 }
 
 static const TypeInfo lm32_cpu_type_info = {
diff --git a/target-lm32/helper.c b/target-lm32/helper.c
index 615b44e..15bc615 100644
--- a/target-lm32/helper.c
+++ b/target-lm32/helper.c
@@ -37,10 +37,12 @@ int cpu_lm32_handle_mmu_fault(CPULM32State *env, target_ulong address, int rw,
     return 0;
 }
 
-hwaddr cpu_get_phys_page_debug(CPULM32State *env, target_ulong addr)
+hwaddr lm32_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    LM32CPU *cpu = LM32_CPU(cs);
+
     addr &= TARGET_PAGE_MASK;
-    if (env->flags & LM32_FLAG_IGNORE_MSB) {
+    if (cpu->env.flags & LM32_FLAG_IGNORE_MSB) {
         return addr & 0x7fffffff;
     } else {
         return addr;
diff --git a/target-m68k/cpu-qom.h b/target-m68k/cpu-qom.h
index 858bf30..7115707 100644
--- a/target-m68k/cpu-qom.h
+++ b/target-m68k/cpu-qom.h
@@ -73,5 +73,6 @@ static inline M68kCPU *m68k_env_get_cpu(CPUM68KState *env)
 void m68k_cpu_do_interrupt(CPUState *cpu);
 void m68k_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
+hwaddr m68k_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 43011e7..988f476 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -190,6 +190,9 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->do_interrupt = m68k_cpu_do_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = m68k_cpu_get_phys_page_debug;
+#endif
     dc->vmsd = &vmstate_m68k_cpu;
 }
 
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 54fa419..dcadfab 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -290,7 +290,7 @@ int cpu_m68k_handle_mmu_fault (CPUM68KState *env, target_ulong address, int rw,
 /* MMU */
 
 /* TODO: This will need fixing once the MMU is implemented.  */
-hwaddr cpu_get_phys_page_debug(CPUM68KState *env, target_ulong addr)
+hwaddr m68k_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
     return addr;
 }
diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index ec2b989..1318a36 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -74,5 +74,6 @@ static inline MicroBlazeCPU *mb_env_get_cpu(CPUMBState *env)
 void mb_cpu_do_interrupt(CPUState *cs);
 void mb_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                        int flags);
+hwaddr mb_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 0a9bcfa..9f10c8c 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -140,8 +140,11 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = mb_cpu_do_interrupt;
     cc->dump_state = mb_cpu_dump_state;
-    cpu_class_set_do_unassigned_access(cc, mb_cpu_unassigned_access);
     cc->set_pc = mb_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+    cc->do_unassigned_access = mb_cpu_unassigned_access;
+    cc->get_phys_page_debug = mb_cpu_get_phys_page_debug;
+#endif
     dc->vmsd = &vmstate_mb_cpu;
     dc->props = mb_properties;
 }
diff --git a/target-microblaze/helper.c b/target-microblaze/helper.c
index c6c96d4..4fa9ce9 100644
--- a/target-microblaze/helper.c
+++ b/target-microblaze/helper.c
@@ -265,8 +265,10 @@ void mb_cpu_do_interrupt(CPUState *cs)
     }
 }
 
-hwaddr cpu_get_phys_page_debug(CPUMBState * env, target_ulong addr)
+hwaddr mb_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+    CPUMBState *env = &cpu->env;
     target_ulong vaddr, paddr = 0;
     struct microblaze_mmu_lookup lu;
     unsigned int hit;
diff --git a/target-mips/cpu-qom.h b/target-mips/cpu-qom.h
index 654744a..7c8e616 100644
--- a/target-mips/cpu-qom.h
+++ b/target-mips/cpu-qom.h
@@ -77,5 +77,6 @@ static inline MIPSCPU *mips_env_get_cpu(CPUMIPSState *env)
 void mips_cpu_do_interrupt(CPUState *cpu);
 void mips_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
+hwaddr mips_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 1581cd9..4834c86 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -98,9 +98,12 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
 
     cc->do_interrupt = mips_cpu_do_interrupt;
     cc->dump_state = mips_cpu_dump_state;
-    cpu_class_set_do_unassigned_access(cc, mips_cpu_unassigned_access);
     cc->set_pc = mips_cpu_set_pc;
     cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
+#ifndef CONFIG_USER_ONLY
+    cc->do_unassigned_access = mips_cpu_unassigned_access;
+    cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
+#endif
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target-mips/helper.c b/target-mips/helper.c
index 6983b92..6feef7b 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -254,13 +254,16 @@ static void raise_mmu_exception(CPUMIPSState *env, target_ulong address,
 }
 
 #if !defined(CONFIG_USER_ONLY)
-hwaddr cpu_get_phys_page_debug(CPUMIPSState *env, target_ulong addr)
+hwaddr mips_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    MIPSCPU *cpu = MIPS_CPU(cs);
     hwaddr phys_addr;
     int prot;
 
-    if (get_physical_address(env, &phys_addr, &prot, addr, 0, ACCESS_INT) != 0)
+    if (get_physical_address(&cpu->env, &phys_addr, &prot, addr, 0,
+                             ACCESS_INT) != 0) {
         return -1;
+    }
     return phys_addr;
 }
 #endif
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 91f6197..6550be5 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -101,7 +101,10 @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
     cc->set_pc = moxie_cpu_set_pc;
-    cpu_class_set_vmsd(cc, &vmstate_moxie_cpu);
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = moxie_cpu_get_phys_page_debug;
+    cc->vmsd = &vmstate_moxie_cpu;
+#endif
 }
 
 static void moxielite_initfn(Object *obj)
diff --git a/target-moxie/cpu.h b/target-moxie/cpu.h
index d5030a4..5ce14b5 100644
--- a/target-moxie/cpu.h
+++ b/target-moxie/cpu.h
@@ -118,6 +118,7 @@ int cpu_moxie_exec(CPUMoxieState *s);
 void moxie_cpu_do_interrupt(CPUState *cs);
 void moxie_cpu_dump_state(CPUState *cpu, FILE *f,
                           fprintf_function cpu_fprintf, int flags);
+hwaddr moxie_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 void moxie_translate_init(void);
 int cpu_moxie_signal_handler(int host_signum, void *pinfo,
                              void *puc);
diff --git a/target-moxie/helper.c b/target-moxie/helper.c
index ea0788f..b12e4ff 100644
--- a/target-moxie/helper.c
+++ b/target-moxie/helper.c
@@ -118,11 +118,6 @@ int cpu_moxie_handle_mmu_fault(CPUMoxieState *env, target_ulong address,
     return 1;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
-{
-    return addr;
-}
-
 #else /* !CONFIG_USER_ONLY */
 
 int cpu_moxie_handle_mmu_fault(CPUMoxieState *env, target_ulong address,
@@ -162,12 +157,14 @@ void moxie_cpu_do_interrupt(CPUState *cs)
     }
 }
 
-hwaddr cpu_get_phys_page_debug(CPUMoxieState *env, target_ulong addr)
+hwaddr moxie_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    MoxieCPU *cpu = MOXIE_CPU(cs);
     uint32_t phy = addr;
     MoxieMMUResult res;
     int miss;
-    miss = moxie_mmu_translate(&res, env, addr, 0, 0);
+
+    miss = moxie_mmu_translate(&res, &cpu->env, addr, 0, 0);
     if (!miss) {
         phy = res.phy;
     }
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index 27ee9f4..3da5a7a 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -154,7 +154,10 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = openrisc_cpu_do_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
-    device_class_set_vmsd(dc, &vmstate_openrisc_cpu);
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = openrisc_cpu_get_phys_page_debug;
+    dc->vmsd = &vmstate_openrisc_cpu;
+#endif
 }
 
 static void cpu_register(const OpenRISCCPUInfo *info)
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index 82bfd03..3ddb767 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -349,6 +349,7 @@ int cpu_openrisc_exec(CPUOpenRISCState *s);
 void openrisc_cpu_do_interrupt(CPUState *cpu);
 void openrisc_cpu_dump_state(CPUState *cpu, FILE *f,
                              fprintf_function cpu_fprintf, int flags);
+hwaddr openrisc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 void openrisc_translate_init(void);
 int cpu_openrisc_handle_mmu_fault(CPUOpenRISCState *env,
                                   target_ulong address,
diff --git a/target-openrisc/mmu.c b/target-openrisc/mmu.c
index d354e1f..57f5616 100644
--- a/target-openrisc/mmu.c
+++ b/target-openrisc/mmu.c
@@ -219,12 +219,11 @@ int cpu_openrisc_handle_mmu_fault(CPUOpenRISCState *env,
 #endif
 
 #ifndef CONFIG_USER_ONLY
-hwaddr cpu_get_phys_page_debug(CPUOpenRISCState *env,
-                                           target_ulong addr)
+hwaddr openrisc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
     hwaddr phys_addr;
     int prot;
-    OpenRISCCPU *cpu = openrisc_env_get_cpu(env);
 
     if (cpu_openrisc_get_phys_addr(cpu, &phys_addr, &prot, addr, 0)) {
         return -1;
diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index 7132599..3341c51 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -105,5 +105,6 @@ void ppc_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                         int flags);
 void ppc_cpu_dump_statistics(CPUState *cpu, FILE *f,
                              fprintf_function cpu_fprintf, int flags);
+hwaddr ppc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index 77102c4..5dd4e05 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -1409,8 +1409,10 @@ static int get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
     return ret;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
+hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    CPUPPCState *env = &cpu->env;
     mmu_ctx_t ctx;
 
     switch (env->mmu_model) {
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 9ed7736..0fc9014 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8457,6 +8457,9 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
     cc->set_pc = ppc_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
+#endif
 }
 
 static const TypeInfo ppc_cpu_type_info = {
diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index 4c091e3..a4fe8fb 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -74,5 +74,6 @@ static inline S390CPU *s390_env_get_cpu(CPUS390XState *env)
 void s390_cpu_do_interrupt(CPUState *cpu);
 void s390_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
+hwaddr s390_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index fe3cd8e..cb89d1a 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -173,6 +173,9 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = s390_cpu_do_interrupt;
     cc->dump_state = s390_cpu_dump_state;
     cc->set_pc = s390_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = s390_cpu_get_phys_page_debug;
+#endif
     dc->vmsd = &vmstate_s390_cpu;
 }
 
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index b425054..61abfd7 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -417,9 +417,10 @@ int cpu_s390x_handle_mmu_fault(CPUS390XState *env, target_ulong orig_vaddr,
     return 0;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUS390XState *env,
-                                           target_ulong vaddr)
+hwaddr s390_cpu_get_phys_page_debug(CPUState *cs, vaddr vaddr)
 {
+    S390CPU *cpu = S390_CPU(cs);
+    CPUS390XState *env = &cpu->env;
     target_ulong raddr;
     int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
     int old_exc = env->exception_index;
diff --git a/target-sh4/cpu-qom.h b/target-sh4/cpu-qom.h
index c229a9a..7c9160b 100644
--- a/target-sh4/cpu-qom.h
+++ b/target-sh4/cpu-qom.h
@@ -86,5 +86,6 @@ static inline SuperHCPU *sh_env_get_cpu(CPUSH4State *env)
 void superh_cpu_do_interrupt(CPUState *cpu);
 void superh_cpu_dump_state(CPUState *cpu, FILE *f,
                            fprintf_function cpu_fprintf, int flags);
+hwaddr superh_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 03dedc1..51a7757 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -286,6 +286,9 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;
+#endif
     dc->vmsd = &vmstate_sh_cpu;
 }
 
diff --git a/target-sh4/helper.c b/target-sh4/helper.c
index cb6a2d2..9ac2825 100644
--- a/target-sh4/helper.c
+++ b/target-sh4/helper.c
@@ -508,12 +508,13 @@ int cpu_sh4_handle_mmu_fault(CPUSH4State * env, target_ulong address, int rw,
     return 0;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUSH4State * env, target_ulong addr)
+hwaddr superh_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    SuperHCPU *cpu = SUPERH_CPU(cs);
     target_ulong physical;
     int prot;
 
-    get_physical_address(env, &physical, &prot, addr, 0, 0);
+    get_physical_address(&cpu->env, &physical, &prot, addr, 0, 0);
     return physical;
 }
 
diff --git a/target-sparc/cpu-qom.h b/target-sparc/cpu-qom.h
index 033a5b5..39d975b 100644
--- a/target-sparc/cpu-qom.h
+++ b/target-sparc/cpu-qom.h
@@ -78,5 +78,6 @@ static inline SPARCCPU *sparc_env_get_cpu(CPUSPARCState *env)
 void sparc_cpu_do_interrupt(CPUState *cpu);
 void sparc_cpu_dump_state(CPUState *cpu, FILE *f,
                           fprintf_function cpu_fprintf, int flags);
+hwaddr sparc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index a2deba5..12494cc 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -782,9 +782,12 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = sparc_cpu_do_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
-    cpu_class_set_do_unassigned_access(cc, sparc_cpu_unassigned_access);
     cc->set_pc = sparc_cpu_set_pc;
     cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
+#ifndef CONFIG_USER_ONLY
+    cc->do_unassigned_access = sparc_cpu_unassigned_access;
+    cc->get_phys_page_debug = sparc_cpu_get_phys_page_debug;
+#endif
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target-sparc/mmu_helper.c b/target-sparc/mmu_helper.c
index 740cbe8..846d129 100644
--- a/target-sparc/mmu_helper.c
+++ b/target-sparc/mmu_helper.c
@@ -310,6 +310,7 @@ target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev)
 
 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUSPARCState *env)
 {
+    CPUState *cs = CPU(sparc_env_get_cpu(env));
     target_ulong va, va1, va2;
     unsigned int n, m, o;
     hwaddr pde_ptr, pa;
@@ -322,20 +323,20 @@ void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUSPARCState *env)
     for (n = 0, va = 0; n < 256; n++, va += 16 * 1024 * 1024) {
         pde = mmu_probe(env, va, 2);
         if (pde) {
-            pa = cpu_get_phys_page_debug(env, va);
+            pa = cpu_get_phys_page_debug(cs, va);
             (*cpu_fprintf)(f, "VA: " TARGET_FMT_lx ", PA: " TARGET_FMT_plx
                            " PDE: " TARGET_FMT_lx "\n", va, pa, pde);
             for (m = 0, va1 = va; m < 64; m++, va1 += 256 * 1024) {
                 pde = mmu_probe(env, va1, 1);
                 if (pde) {
-                    pa = cpu_get_phys_page_debug(env, va1);
+                    pa = cpu_get_phys_page_debug(cs, va1);
                     (*cpu_fprintf)(f, " VA: " TARGET_FMT_lx ", PA: "
                                    TARGET_FMT_plx " PDE: " TARGET_FMT_lx "\n",
                                    va1, pa, pde);
                     for (o = 0, va2 = va1; o < 64; o++, va2 += 4 * 1024) {
                         pde = mmu_probe(env, va2, 0);
                         if (pde) {
-                            pa = cpu_get_phys_page_debug(env, va2);
+                            pa = cpu_get_phys_page_debug(cs, va2);
                             (*cpu_fprintf)(f, "  VA: " TARGET_FMT_lx ", PA: "
                                            TARGET_FMT_plx " PTE: "
                                            TARGET_FMT_lx "\n",
@@ -833,8 +834,10 @@ hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr,
 }
 #endif
 
-hwaddr cpu_get_phys_page_debug(CPUSPARCState *env, target_ulong addr)
+hwaddr sparc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    CPUSPARCState *env = &cpu->env;
     hwaddr phys_addr;
     int mmu_idx = cpu_mmu_index(env);
     MemoryRegionSection section;
diff --git a/target-unicore32/cpu-qom.h b/target-unicore32/cpu-qom.h
index 350d480..f727760 100644
--- a/target-unicore32/cpu-qom.h
+++ b/target-unicore32/cpu-qom.h
@@ -63,5 +63,6 @@ static inline UniCore32CPU *uc32_env_get_cpu(CPUUniCore32State *env)
 void uc32_cpu_do_interrupt(CPUState *cpu);
 void uc32_cpu_dump_state(CPUState *cpu, FILE *f,
                          fprintf_function cpu_fprintf, int flags);
+hwaddr uc32_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 79f2292..46813e5 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -139,6 +139,9 @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = uc32_cpu_do_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
     cc->set_pc = uc32_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = uc32_cpu_get_phys_page_debug;
+#endif
     dc->vmsd = &vmstate_uc32_cpu;
 }
 
diff --git a/target-unicore32/softmmu.c b/target-unicore32/softmmu.c
index eadaeb1..1e13a85 100644
--- a/target-unicore32/softmmu.c
+++ b/target-unicore32/softmmu.c
@@ -261,9 +261,10 @@ int uc32_cpu_handle_mmu_fault(CPUUniCore32State *env, target_ulong address,
     return ret;
 }
 
-hwaddr cpu_get_phys_page_debug(CPUUniCore32State *env,
-        target_ulong addr)
+hwaddr uc32_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
-    cpu_abort(env, "%s not supported yet\n", __func__);
+    UniCore32CPU *cpu = UNICORE32_CPU(cs);
+
+    cpu_abort(&cpu->env, "%s not supported yet\n", __func__);
     return addr;
 }
diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index 31e7498..b9896f2 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -83,5 +83,6 @@ static inline XtensaCPU *xtensa_env_get_cpu(const CPUXtensaState *env)
 void xtensa_cpu_do_interrupt(CPUState *cpu);
 void xtensa_cpu_dump_state(CPUState *cpu, FILE *f,
                            fprintf_function cpu_fprintf, int flags);
+hwaddr xtensa_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index e3d742a..d2bcfc6 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -108,6 +108,9 @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = xtensa_cpu_do_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+    cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;
+#endif
     dc->vmsd = &vmstate_xtensa_cpu;
 }
 
diff --git a/target-xtensa/helper.c b/target-xtensa/helper.c
index 6f613c66..de6cc3b 100644
--- a/target-xtensa/helper.c
+++ b/target-xtensa/helper.c
@@ -108,17 +108,18 @@ void xtensa_cpu_list(FILE *f, fprintf_function cpu_fprintf)
     }
 }
 
-hwaddr cpu_get_phys_page_debug(CPUXtensaState *env, target_ulong addr)
+hwaddr xtensa_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
+    XtensaCPU *cpu = XTENSA_CPU(cs);
     uint32_t paddr;
     uint32_t page_size;
     unsigned access;
 
-    if (xtensa_get_physical_addr(env, false, addr, 0, 0,
+    if (xtensa_get_physical_addr(&cpu->env, false, addr, 0, 0,
                 &paddr, &page_size, &access) == 0) {
         return paddr;
     }
-    if (xtensa_get_physical_addr(env, false, addr, 2, 0,
+    if (xtensa_get_physical_addr(&cpu->env, false, addr, 2, 0,
                 &paddr, &page_size, &access) == 0) {
         return paddr;
     }
diff --git a/target-xtensa/xtensa-semi.c b/target-xtensa/xtensa-semi.c
index 5fe0361..d9dd222 100644
--- a/target-xtensa/xtensa-semi.c
+++ b/target-xtensa/xtensa-semi.c
@@ -152,6 +152,7 @@ static uint32_t errno_h2g(int host_errno)
 
 void HELPER(simcall)(CPUXtensaState *env)
 {
+    CPUState *cs = CPU(xtensa_env_get_cpu(env));
     uint32_t *regs = env->regs;
 
     switch (regs[2]) {
@@ -169,8 +170,7 @@ void HELPER(simcall)(CPUXtensaState *env)
             uint32_t len = regs[5];
 
             while (len > 0) {
-                hwaddr paddr =
-                    cpu_get_phys_page_debug(env, vaddr);
+                hwaddr paddr = cpu_get_phys_page_debug(cs, vaddr);
                 uint32_t page_left =
                     TARGET_PAGE_SIZE - (vaddr & (TARGET_PAGE_SIZE - 1));
                 uint32_t io_sz = page_left < len ? page_left : len;
commit 385b9f0e4d8c60037c937edd7a3735fff7570429
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 27 18:25:36 2013 +0200

    gdbstub: Change gdb_{read,write}_register() argument to CPUState
    
    Use CPUState::env_ptr for now.
    
    Prepares for changing GDBState::g_cpu to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index b65682f..848754d 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1866,8 +1866,9 @@ static const char *get_feature_xml(const char *p, const char **newp)
 }
 #endif
 
-static int gdb_read_register(CPUArchState *env, uint8_t *mem_buf, int reg)
+static int gdb_read_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 {
+    CPUArchState *env = cpu->env_ptr;
     GDBRegisterState *r;
 
     if (reg < NUM_CORE_REGS)
@@ -1881,8 +1882,9 @@ static int gdb_read_register(CPUArchState *env, uint8_t *mem_buf, int reg)
     return 0;
 }
 
-static int gdb_write_register(CPUArchState *env, uint8_t *mem_buf, int reg)
+static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 {
+    CPUArchState *env = cpu->env_ptr;
     GDBRegisterState *r;
 
     if (reg < NUM_CORE_REGS)
@@ -2220,7 +2222,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         env = s->g_cpu;
         len = 0;
         for (addr = 0; addr < num_g_regs; addr++) {
-            reg_size = gdb_read_register(s->g_cpu, mem_buf + len, addr);
+            reg_size = gdb_read_register(ENV_GET_CPU(s->g_cpu),
+                                         mem_buf + len, addr);
             len += reg_size;
         }
         memtohex(buf, mem_buf, len);
@@ -2233,7 +2236,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         len = strlen(p) / 2;
         hextomem((uint8_t *)registers, p, len);
         for (addr = 0; addr < num_g_regs && len > 0; addr++) {
-            reg_size = gdb_write_register(s->g_cpu, registers, addr);
+            reg_size = gdb_write_register(ENV_GET_CPU(s->g_cpu), registers,
+                                          addr);
             len -= reg_size;
             registers += reg_size;
         }
@@ -2272,7 +2276,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         if (!gdb_has_xml)
             goto unknown_command;
         addr = strtoull(p, (char **)&p, 16);
-        reg_size = gdb_read_register(s->g_cpu, mem_buf, addr);
+        reg_size = gdb_read_register(ENV_GET_CPU(s->g_cpu), mem_buf, addr);
         if (reg_size) {
             memtohex(buf, mem_buf, reg_size);
             put_packet(s, buf);
@@ -2288,7 +2292,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             p++;
         reg_size = strlen(p) / 2;
         hextomem(mem_buf, p, reg_size);
-        gdb_write_register(s->g_cpu, mem_buf, addr);
+        gdb_write_register(ENV_GET_CPU(s->g_cpu), mem_buf, addr);
         put_packet(s, "OK");
         break;
     case 'Z':
commit db6b81d43693cec86d62df79dd7402fc045427ed
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 27 19:49:31 2013 +0200

    gdbstub: Change gdb_handlesig() argument to CPUState
    
    Prepares for changing GDBState::c_cpu to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 1e92552..f9246aa 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -643,7 +643,7 @@ void cpu_loop(CPUSPARCState *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
 #if 0
                 if (sig)
                   {
@@ -738,6 +738,7 @@ int main(int argc, char **argv)
     struct image_info info1, *info = &info1;
     TaskState ts1, *ts = &ts1;
     CPUArchState *env;
+    CPUState *cpu;
     int optind;
     const char *r;
     int gdbstub_port = 0;
@@ -912,10 +913,11 @@ int main(int argc, char **argv)
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
+    cpu = ENV_GET_CPU(env);
 #if defined(TARGET_SPARC) || defined(TARGET_PPC)
-    cpu_reset(ENV_GET_CPU(env));
+    cpu_reset(cpu);
 #endif
-    thread_cpu = ENV_GET_CPU(env);
+    thread_cpu = cpu;
 
     if (getenv("QEMU_STRACE")) {
         do_strace = 1;
@@ -1134,7 +1136,7 @@ int main(int argc, char **argv)
 
     if (gdbstub_port) {
         gdbserver_start (gdbstub_port);
-        gdb_handlesig(env, 0);
+        gdb_handlesig(cpu, 0);
     }
     cpu_loop(env);
     /* never exits */
diff --git a/gdbstub.c b/gdbstub.c
index bb44ef2..b65682f 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2636,7 +2636,7 @@ void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
     va_end(va);
 #ifdef CONFIG_USER_ONLY
     put_packet(s, s->syscall_buf);
-    gdb_handlesig(s->c_cpu, 0);
+    gdb_handlesig(ENV_GET_CPU(s->c_cpu), 0);
 #else
     /* In this case wait to send the syscall packet until notification that
        the CPU has stopped.  This must be done because if the packet is sent
@@ -2765,9 +2765,9 @@ gdb_queuesig (void)
 }
 
 int
-gdb_handlesig(CPUArchState *env, int sig)
+gdb_handlesig(CPUState *cpu, int sig)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUArchState *env = cpu->env_ptr;
     GDBState *s;
     char buf[256];
     int n;
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index de0f4fb..0f1ad9a 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -20,7 +20,7 @@ void gdb_set_stop_cpu(CPUState *cpu);
 void gdb_exit(CPUArchState *, int);
 #ifdef CONFIG_USER_ONLY
 int gdb_queuesig (void);
-int gdb_handlesig (CPUArchState *, int);
+int gdb_handlesig(CPUState *, int);
 void gdb_signalled(CPUArchState *, int);
 void gdbserver_fork(CPUArchState *);
 #endif
diff --git a/linux-user/main.c b/linux-user/main.c
index 99c3b3f..f6a3aad 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -312,6 +312,7 @@ static void set_idt(int n, unsigned int dpl)
 
 void cpu_loop(CPUX86State *env)
 {
+    CPUState *cs = CPU(x86_env_get_cpu(env));
     int trapnr;
     abi_ulong pc;
     target_siginfo_t info;
@@ -443,7 +444,7 @@ void cpu_loop(CPUX86State *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -875,7 +876,7 @@ void cpu_loop(CPUARMState *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -966,7 +967,7 @@ void cpu_loop(CPUUniCore32State *env)
             {
                 int sig;
 
-                sig = gdb_handlesig(env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig) {
                     info.si_signo = sig;
                     info.si_errno = 0;
@@ -1233,7 +1234,7 @@ void cpu_loop (CPUSPARCState *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -1764,7 +1765,7 @@ void cpu_loop(CPUPPCState *env)
             {
                 int sig;
 
-                sig = gdb_handlesig(env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig) {
                     info.si_signo = sig;
                     info.si_errno = 0;
@@ -2315,7 +2316,7 @@ done_syscall:
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -2475,7 +2476,7 @@ void cpu_loop(CPUOpenRISCState *env)
             break;
         }
         if (gdbsig) {
-            gdb_handlesig(env, gdbsig);
+            gdb_handlesig(cs, gdbsig);
             if (gdbsig != TARGET_SIGTRAP) {
                 exit(1);
             }
@@ -2518,7 +2519,7 @@ void cpu_loop(CPUSH4State *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -2586,7 +2587,7 @@ void cpu_loop(CPUCRISState *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -2686,7 +2687,7 @@ void cpu_loop(CPUMBState *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -2779,7 +2780,7 @@ void cpu_loop(CPUM68KState *env)
             {
                 int sig;
 
-                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
                 if (sig)
                   {
                     info.si_signo = sig;
@@ -3006,7 +3007,7 @@ void cpu_loop(CPUAlphaState *env)
             }
             break;
         case EXCP_DEBUG:
-            info.si_signo = gdb_handlesig (env, TARGET_SIGTRAP);
+            info.si_signo = gdb_handlesig(cs, TARGET_SIGTRAP);
             if (info.si_signo) {
                 env->lock_addr = -1;
                 info.si_errno = 0;
@@ -3059,7 +3060,7 @@ void cpu_loop(CPUS390XState *env)
             break;
 
         case EXCP_DEBUG:
-            sig = gdb_handlesig(env, TARGET_SIGTRAP);
+            sig = gdb_handlesig(cs, TARGET_SIGTRAP);
             if (sig) {
                 n = TARGET_TRAP_BRKPT;
                 goto do_signal_pc;
@@ -3541,6 +3542,7 @@ int main(int argc, char **argv, char **envp)
     struct linux_binprm bprm;
     TaskState *ts;
     CPUArchState *env;
+    CPUState *cpu;
     int optind;
     char **target_environ, **wrk;
     char **target_argv;
@@ -3637,11 +3639,12 @@ int main(int argc, char **argv, char **envp)
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
+    cpu = ENV_GET_CPU(env);
 #if defined(TARGET_SPARC) || defined(TARGET_PPC)
-    cpu_reset(ENV_GET_CPU(env));
+    cpu_reset(cpu);
 #endif
 
-    thread_cpu = ENV_GET_CPU(env);
+    thread_cpu = cpu;
 
     if (getenv("QEMU_STRACE")) {
         do_strace = 1;
@@ -4076,7 +4079,7 @@ int main(int argc, char **argv, char **envp)
                     gdbstub_port);
             exit(1);
         }
-        gdb_handlesig(env, 0);
+        gdb_handlesig(cpu, 0);
     }
     cpu_loop(env);
     /* never exits */
diff --git a/linux-user/signal.c b/linux-user/signal.c
index d0727be..a5e8906 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -5386,6 +5386,7 @@ long do_rt_sigreturn(CPUArchState *env)
 
 void process_pending_signals(CPUArchState *cpu_env)
 {
+    CPUState *cpu = ENV_GET_CPU(cpu_env);
     int sig;
     abi_ulong handler;
     sigset_t set, old_set;
@@ -5419,7 +5420,7 @@ void process_pending_signals(CPUArchState *cpu_env)
     if (!k->first)
         k->pending = 0;
 
-    sig = gdb_handlesig (cpu_env, sig);
+    sig = gdb_handlesig(cpu, sig);
     if (!sig) {
         sa = NULL;
         handler = TARGET_SIG_IGN;
commit 9e0c5422cfbed78990e2edc9d68928647829f5ac
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 27 17:45:01 2013 +0200

    gdbstub: Change syscall callback argument to CPUState
    
    Callback implementations were specific to arm and m68k, so can easily
    cast to ARMCPU and M68kCPU respectively.
    
    Prepares for changing GDBState::c_cpu to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index b5e6778..bb44ef2 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2205,7 +2205,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
                 p++;
             type = *p;
             if (s->current_syscall_cb) {
-                s->current_syscall_cb(s->c_cpu, ret, err);
+                s->current_syscall_cb(ENV_GET_CPU(s->c_cpu), ret, err);
                 s->current_syscall_cb = NULL;
             }
             if (type == 'C') {
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index ded4160..de0f4fb 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -11,7 +11,7 @@
 #define GDB_WATCHPOINT_ACCESS    4
 
 #ifdef NEED_CPU_H
-typedef void (*gdb_syscall_complete_cb)(CPUArchState *env,
+typedef void (*gdb_syscall_complete_cb)(CPUState *cpu,
                                         target_ulong ret, target_ulong err);
 
 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...);
diff --git a/target-arm/arm-semi.c b/target-arm/arm-semi.c
index 5f01bca..4ecea65 100644
--- a/target-arm/arm-semi.c
+++ b/target-arm/arm-semi.c
@@ -122,8 +122,10 @@ static target_ulong arm_semi_syscall_len;
 static target_ulong syscall_err;
 #endif
 
-static void arm_semi_cb(CPUARMState *env, target_ulong ret, target_ulong err)
+static void arm_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
 {
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
 #ifdef CONFIG_USER_ONLY
     TaskState *ts = env->opaque;
 #endif
@@ -152,8 +154,10 @@ static void arm_semi_cb(CPUARMState *env, target_ulong ret, target_ulong err)
     }
 }
 
-static void arm_semi_flen_cb(CPUARMState *env, target_ulong ret, target_ulong err)
+static void arm_semi_flen_cb(CPUState *cs, target_ulong ret, target_ulong err)
 {
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
     /* The size is always stored in big-endian order, extract
        the value. We assume the size always fit in 32 bits.  */
     uint32_t size;
diff --git a/target-m68k/m68k-semi.c b/target-m68k/m68k-semi.c
index 239fadb..94c4983 100644
--- a/target-m68k/m68k-semi.c
+++ b/target-m68k/m68k-semi.c
@@ -161,8 +161,11 @@ static void m68k_semi_return_u64(CPUM68KState *env, uint64_t ret, uint32_t err)
 
 static int m68k_semi_is_fseek;
 
-static void m68k_semi_cb(CPUM68KState *env, target_ulong ret, target_ulong err)
+static void m68k_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
 {
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
+
     if (m68k_semi_is_fseek) {
         /* FIXME: We've already lost the high bits of the fseek
            return value.  */
commit 6227881415e0e0117d56aef90cf6e72f24187ec1
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 27 17:12:06 2013 +0200

    kvm: Change kvm_{insert,remove}_breakpoint() argument to CPUState
    
    CPUArchState is no longer directly used since converting CPU loops to
    CPUState.
    
    Prepares for changing GDBState::c_cpu to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 8e23509..b5e6778 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1954,8 +1954,10 @@ static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
     CPUArchState *env;
     int err = 0;
 
-    if (kvm_enabled())
-        return kvm_insert_breakpoint(gdbserver_state->c_cpu, addr, len, type);
+    if (kvm_enabled()) {
+        return kvm_insert_breakpoint(ENV_GET_CPU(gdbserver_state->c_cpu),
+                                     addr, len, type);
+    }
 
     switch (type) {
     case GDB_BREAKPOINT_SW:
@@ -1991,8 +1993,10 @@ static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
     CPUArchState *env;
     int err = 0;
 
-    if (kvm_enabled())
-        return kvm_remove_breakpoint(gdbserver_state->c_cpu, addr, len, type);
+    if (kvm_enabled()) {
+        return kvm_remove_breakpoint(ENV_GET_CPU(gdbserver_state->c_cpu),
+                                     addr, len, type);
+    }
 
     switch (type) {
     case GDB_BREAKPOINT_SW:
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 1e08a85..f8ac448 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -169,9 +169,9 @@ void *kvm_arch_ram_alloc(ram_addr_t size);
 void kvm_setup_guest_memory(void *start, size_t size);
 void kvm_flush_coalesced_mmio_buffer(void);
 
-int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type);
-int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type);
 void kvm_remove_all_breakpoints(CPUState *cpu);
 int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap);
diff --git a/kvm-all.c b/kvm-all.c
index a210389..4fb4ccb 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1900,10 +1900,9 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
     return data.err;
 }
 
-int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_sw_breakpoint *bp;
     int err;
 
@@ -1946,10 +1945,9 @@ int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
     return 0;
 }
 
-int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_sw_breakpoint *bp;
     int err;
 
@@ -2022,13 +2020,13 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
     return -EINVAL;
 }
 
-int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
 }
 
-int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
diff --git a/kvm-stub.c b/kvm-stub.c
index 370c837..7b2233a 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -83,13 +83,13 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
     return -ENOSYS;
 }
 
-int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
 }
 
-int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
+int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
commit 3825b28ff128e2bd3cb0a338c21923c926b1f38b
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Jun 24 18:41:06 2013 +0200

    cpu: Change cpu_single_step() argument to CPUState
    
    Use CPUState::env_ptr for now.
    
    Needed for GdbState::c_cpu.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/exec.c b/exec.c
index 30b676d..9cd936c 100644
--- a/exec.c
+++ b/exec.c
@@ -585,10 +585,10 @@ void cpu_breakpoint_remove_all(CPUArchState *env, int mask)
 
 /* enable or disable single step mode. EXCP_DEBUG is returned by the
    CPU loop after each instruction */
-void cpu_single_step(CPUArchState *env, int enabled)
+void cpu_single_step(CPUState *cpu, int enabled)
 {
 #if defined(TARGET_HAS_ICE)
-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUArchState *env = cpu->env_ptr;
 
     if (cpu->singlestep_enabled != enabled) {
         cpu->singlestep_enabled = enabled;
diff --git a/gdbstub.c b/gdbstub.c
index 6ddff91..8e23509 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2154,7 +2154,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
                     s->c_cpu = env;
                 }
                 if (res == 's') {
-                    cpu_single_step(s->c_cpu, sstep_flags);
+                    cpu_single_step(ENV_GET_CPU(s->c_cpu), sstep_flags);
                 }
                 s->signal = res_signal;
                 gdb_continue(s);
@@ -2182,7 +2182,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             addr = strtoull(p, (char **)&p, 16);
             gdb_set_cpu_pc(s, addr);
         }
-        cpu_single_step(s->c_cpu, sstep_flags);
+        cpu_single_step(ENV_GET_CPU(s->c_cpu), sstep_flags);
         gdb_continue(s);
 	return RS_IDLE;
     case 'F':
@@ -2570,7 +2570,7 @@ send_packet:
     put_packet(s, buf);
 
     /* disable single step if it was enabled */
-    cpu_single_step(env, 0);
+    cpu_single_step(cpu, 0);
 }
 #endif
 
@@ -2763,6 +2763,7 @@ gdb_queuesig (void)
 int
 gdb_handlesig(CPUArchState *env, int sig)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     GDBState *s;
     char buf[256];
     int n;
@@ -2773,7 +2774,7 @@ gdb_handlesig(CPUArchState *env, int sig)
     }
 
     /* disable single step if it was enabled */
-    cpu_single_step(env, 0);
+    cpu_single_step(cpu, 0);
     tb_flush(env);
 
     if (sig != 0) {
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 5084202..b48db03 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -428,12 +428,6 @@ int cpu_watchpoint_remove(CPUArchState *env, target_ulong addr,
 void cpu_watchpoint_remove_by_ref(CPUArchState *env, CPUWatchpoint *watchpoint);
 void cpu_watchpoint_remove_all(CPUArchState *env, int mask);
 
-#define SSTEP_ENABLE  0x1  /* Enable simulated HW single stepping */
-#define SSTEP_NOIRQ   0x2  /* Do not use IRQ while single stepping */
-#define SSTEP_NOTIMER 0x4  /* Do not Timers while single stepping */
-
-void cpu_single_step(CPUArchState *env, int enabled);
-
 #if !defined(CONFIG_USER_ONLY)
 
 /* Return the physical page corresponding to a virtual one. Use it
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 94302a4..43a52e4 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -510,6 +510,19 @@ void cpu_resume(CPUState *cpu);
  */
 void qemu_init_vcpu(CPUState *cpu);
 
+#define SSTEP_ENABLE  0x1  /* Enable simulated HW single stepping */
+#define SSTEP_NOIRQ   0x2  /* Do not use IRQ while single stepping */
+#define SSTEP_NOTIMER 0x4  /* Do not Timers while single stepping */
+
+/**
+ * cpu_single_step:
+ * @cpu: CPU to the flags for.
+ * @enabled: Flags to enable.
+ *
+ * Enables or disables single-stepping for @cpu.
+ */
+void cpu_single_step(CPUState *cpu, int enabled);
+
 #ifdef CONFIG_SOFTMMU
 extern const struct VMStateDescription vmstate_cpu_common;
 #else
commit 5ca666c765e9e92217a87669365b212abae6f9ce
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Jun 24 19:20:57 2013 +0200

    gdbstub: Update gdb_handlesig() and gdb_signalled() Coding Style
    
    In particular reindent to 4 instead of 2 spaces.
    
    Prepares for changing cpu_single_step() argument in gdb_handlesig().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 55d4756..6ddff91 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2761,66 +2761,66 @@ gdb_queuesig (void)
 }
 
 int
-gdb_handlesig (CPUArchState *env, int sig)
+gdb_handlesig(CPUArchState *env, int sig)
 {
-  GDBState *s;
-  char buf[256];
-  int n;
+    GDBState *s;
+    char buf[256];
+    int n;
 
-  s = gdbserver_state;
-  if (gdbserver_fd < 0 || s->fd < 0)
-    return sig;
+    s = gdbserver_state;
+    if (gdbserver_fd < 0 || s->fd < 0) {
+        return sig;
+    }
 
-  /* disable single step if it was enabled */
-  cpu_single_step(env, 0);
-  tb_flush(env);
+    /* disable single step if it was enabled */
+    cpu_single_step(env, 0);
+    tb_flush(env);
 
-  if (sig != 0)
-    {
-      snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb (sig));
-      put_packet(s, buf);
-    }
-  /* put_packet() might have detected that the peer terminated the 
-     connection.  */
-  if (s->fd < 0)
-      return sig;
-
-  sig = 0;
-  s->state = RS_IDLE;
-  s->running_state = 0;
-  while (s->running_state == 0) {
-      n = read (s->fd, buf, 256);
-      if (n > 0)
-        {
-          int i;
+    if (sig != 0) {
+        snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));
+        put_packet(s, buf);
+    }
+    /* put_packet() might have detected that the peer terminated the
+       connection.  */
+    if (s->fd < 0) {
+        return sig;
+    }
 
-          for (i = 0; i < n; i++)
-            gdb_read_byte (s, buf[i]);
-        }
-      else if (n == 0 || errno != EAGAIN)
-        {
-          /* XXX: Connection closed.  Should probably wait for another
-             connection before continuing.  */
-          return sig;
+    sig = 0;
+    s->state = RS_IDLE;
+    s->running_state = 0;
+    while (s->running_state == 0) {
+        n = read(s->fd, buf, 256);
+        if (n > 0) {
+            int i;
+
+            for (i = 0; i < n; i++) {
+                gdb_read_byte(s, buf[i]);
+            }
+        } else if (n == 0 || errno != EAGAIN) {
+            /* XXX: Connection closed.  Should probably wait for another
+               connection before continuing.  */
+            return sig;
         }
-  }
-  sig = s->signal;
-  s->signal = 0;
-  return sig;
+    }
+    sig = s->signal;
+    s->signal = 0;
+    return sig;
 }
 
 /* Tell the remote gdb that the process has exited due to SIG.  */
 void gdb_signalled(CPUArchState *env, int sig)
 {
-  GDBState *s;
-  char buf[4];
+    GDBState *s;
+    char buf[4];
 
-  s = gdbserver_state;
-  if (gdbserver_fd < 0 || s->fd < 0)
-    return;
+    s = gdbserver_state;
+    if (gdbserver_fd < 0 || s->fd < 0) {
+        return;
+    }
 
-  snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb (sig));
-  put_packet(s, buf);
+    snprintf(buf, sizeof(buf), "X%02x", target_signal_to_gdb(sig));
+    put_packet(s, buf);
 }
 
 static void gdb_accept(void)
commit ed2803da58355413447f8c7c681a76873168114f
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 20:20:45 2013 +0200

    cpu: Move singlestep_enabled field from CPU_COMMON to CPUState
    
    Prepares for changing cpu_single_step() argument to CPUState.
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpu-exec.c b/cpu-exec.c
index 3fccb86..301be28 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -297,7 +297,7 @@ int cpu_exec(CPUArchState *env)
             for(;;) {
                 interrupt_request = cpu->interrupt_request;
                 if (unlikely(interrupt_request)) {
-                    if (unlikely(env->singlestep_enabled & SSTEP_NOIRQ)) {
+                    if (unlikely(cpu->singlestep_enabled & SSTEP_NOIRQ)) {
                         /* Mask out external interrupts for this step. */
                         interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK;
                     }
diff --git a/cpus.c b/cpus.c
index 2509eb5..4549b7a 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1186,7 +1186,7 @@ static void tcg_exec_all(void)
         CPUArchState *env = cpu->env_ptr;
 
         qemu_clock_enable(vm_clock,
-                          (env->singlestep_enabled & SSTEP_NOTIMER) == 0);
+                          (cpu->singlestep_enabled & SSTEP_NOTIMER) == 0);
 
         if (cpu_can_run(cpu)) {
             r = tcg_cpu_exec(env);
diff --git a/exec.c b/exec.c
index c8658c6..30b676d 100644
--- a/exec.c
+++ b/exec.c
@@ -588,11 +588,13 @@ void cpu_breakpoint_remove_all(CPUArchState *env, int mask)
 void cpu_single_step(CPUArchState *env, int enabled)
 {
 #if defined(TARGET_HAS_ICE)
-    if (env->singlestep_enabled != enabled) {
-        env->singlestep_enabled = enabled;
-        if (kvm_enabled())
+    CPUState *cpu = ENV_GET_CPU(env);
+
+    if (cpu->singlestep_enabled != enabled) {
+        cpu->singlestep_enabled = enabled;
+        if (kvm_enabled()) {
             kvm_update_guest_debug(env, 0);
-        else {
+        } else {
             /* must flush all the translated code to avoid inconsistencies */
             /* XXX: only flush what is necessary */
             tb_flush(env);
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 39094b3..12b1ca7 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -170,7 +170,6 @@ typedef struct CPUWatchpoint {
     /* from this point: preserved by CPU reset */                       \
     /* ice debug support */                                             \
     QTAILQ_HEAD(breakpoints_head, CPUBreakpoint) breakpoints;            \
-    int singlestep_enabled;                                             \
                                                                         \
     QTAILQ_HEAD(watchpoints_head, CPUWatchpoint) watchpoints;            \
     CPUWatchpoint *watchpoint_hit;                                      \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 4e5ec77..94302a4 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -133,6 +133,7 @@ struct kvm_run;
  * @stopped: Indicates the CPU has been artificially stopped.
  * @tcg_exit_req: Set to force TCG to stop executing linked TBs for this
  *           CPU and return to its top level loop.
+ * @singlestep_enabled: Flags for single-stepping.
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
  * @next_cpu: Next CPU sharing TB cache.
@@ -165,6 +166,7 @@ struct CPUState {
     volatile sig_atomic_t exit_request;
     volatile sig_atomic_t tcg_exit_req;
     uint32_t interrupt_request;
+    int singlestep_enabled;
 
     void *env_ptr; /* CPUArchState */
     struct TranslationBlock *current_tb;
diff --git a/kvm-all.c b/kvm-all.c
index 232c39a..a210389 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1890,7 +1890,7 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
 
     data.dbg.control = reinject_trap;
 
-    if (env->singlestep_enabled) {
+    if (cpu->singlestep_enabled) {
         data.dbg.control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_SINGLESTEP;
     }
     kvm_arch_update_guest_debug(cpu, &data.dbg);
diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index c298c06..0efd559 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -3388,6 +3388,7 @@ static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
                                                   TranslationBlock *tb,
                                                   bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUAlphaState *env = &cpu->env;
     DisasContext ctx, *ctxp = &ctx;
     target_ulong pc_start;
@@ -3406,7 +3407,7 @@ static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
     ctx.pc = pc_start;
     ctx.mem_idx = cpu_mmu_index(env);
     ctx.implver = env->implver;
-    ctx.singlestep_enabled = env->singlestep_enabled;
+    ctx.singlestep_enabled = cs->singlestep_enabled;
 
     /* ??? Every TB begins with unset rounding mode, to be initialized on
        the first fp insn of the TB.  Alternately we could define a proper
diff --git a/target-arm/translate.c b/target-arm/translate.c
index 7b50c8c..6db4c50 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -9911,6 +9911,7 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu,
                                                   TranslationBlock *tb,
                                                   bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUARMState *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     CPUBreakpoint *bp;
@@ -9930,7 +9931,7 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu,
 
     dc->is_jmp = DISAS_NEXT;
     dc->pc = pc_start;
-    dc->singlestep_enabled = env->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->condjmp = 0;
     dc->thumb = ARM_TBFLAG_THUMB(tb->flags);
     dc->bswap_code = ARM_TBFLAG_BSWAP_CODE(tb->flags);
@@ -10080,7 +10081,7 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu,
          * ensures prefetch aborts occur at the right place.  */
         num_insns ++;
     } while (!dc->is_jmp && tcg_ctx.gen_opc_ptr < gen_opc_end &&
-             !env->singlestep_enabled &&
+             !cs->singlestep_enabled &&
              !singlestep &&
              dc->pc < next_page_start &&
              num_insns < max_insns);
@@ -10097,7 +10098,7 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu,
     /* At this stage dc->condjmp will only be set when the skipped
        instruction was a conditional branch or trap, and the PC has
        already been written.  */
-    if (unlikely(env->singlestep_enabled)) {
+    if (unlikely(cs->singlestep_enabled)) {
         /* Make sure the pc is updated, and raise a debug exception.  */
         if (dc->condjmp) {
             gen_set_condexec(dc);
diff --git a/target-cris/translate.c b/target-cris/translate.c
index 1de9743..2a4beeb 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3165,6 +3165,7 @@ static inline void
 gen_intermediate_code_internal(CRISCPU *cpu, TranslationBlock *tb,
                                bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUCRISState *env = &cpu->env;
     uint16_t *gen_opc_end;
     uint32_t pc_start;
@@ -3197,7 +3198,7 @@ gen_intermediate_code_internal(CRISCPU *cpu, TranslationBlock *tb,
     dc->is_jmp = DISAS_NEXT;
     dc->ppc = pc_start;
     dc->pc = pc_start;
-    dc->singlestep_enabled = env->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->flags_uptodate = 1;
     dc->flagx_known = 1;
     dc->flags_x = tb->flags & X_FLAG;
@@ -3337,7 +3338,7 @@ gen_intermediate_code_internal(CRISCPU *cpu, TranslationBlock *tb,
 
         /* If we are rexecuting a branch due to exceptions on
            delay slots dont break.  */
-        if (!(tb->pc & 1) && env->singlestep_enabled) {
+        if (!(tb->pc & 1) && cs->singlestep_enabled) {
             break;
         }
     } while (!dc->is_jmp && !dc->cpustate_changed
@@ -3370,7 +3371,7 @@ gen_intermediate_code_internal(CRISCPU *cpu, TranslationBlock *tb,
 
     cris_evaluate_flags(dc);
 
-    if (unlikely(env->singlestep_enabled)) {
+    if (unlikely(cs->singlestep_enabled)) {
         if (dc->is_jmp == DISAS_NEXT) {
             tcg_gen_movi_tl(env_pc, npc);
         }
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 8315489..5138882 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -1594,6 +1594,7 @@ static int kvm_get_vcpu_events(X86CPU *cpu)
 
 static int kvm_guest_debug_workarounds(X86CPU *cpu)
 {
+    CPUState *cs = CPU(cpu);
     CPUX86State *env = &cpu->env;
     int ret = 0;
     unsigned long reinject_trap = 0;
@@ -1616,7 +1617,7 @@ static int kvm_guest_debug_workarounds(X86CPU *cpu)
      * reinject them via SET_GUEST_DEBUG.
      */
     if (reinject_trap ||
-        (!kvm_has_robust_singlestep() && env->singlestep_enabled)) {
+        (!kvm_has_robust_singlestep() && cs->singlestep_enabled)) {
         ret = kvm_update_guest_debug(env, reinject_trap);
     }
     return ret;
@@ -2042,13 +2043,14 @@ static CPUWatchpoint hw_watchpoint;
 static int kvm_handle_debug(X86CPU *cpu,
                             struct kvm_debug_exit_arch *arch_info)
 {
+    CPUState *cs = CPU(cpu);
     CPUX86State *env = &cpu->env;
     int ret = 0;
     int n;
 
     if (arch_info->exception == 1) {
         if (arch_info->dr6 & (1 << 14)) {
-            if (env->singlestep_enabled) {
+            if (cs->singlestep_enabled) {
                 ret = EXCP_DEBUG;
             }
         } else {
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 6550c27..065a9d3 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -8255,6 +8255,7 @@ static inline void gen_intermediate_code_internal(X86CPU *cpu,
                                                   TranslationBlock *tb,
                                                   bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUX86State *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     target_ulong pc_ptr;
@@ -8281,7 +8282,7 @@ static inline void gen_intermediate_code_internal(X86CPU *cpu,
     dc->cpl = (flags >> HF_CPL_SHIFT) & 3;
     dc->iopl = (flags >> IOPL_SHIFT) & 3;
     dc->tf = (flags >> TF_SHIFT) & 1;
-    dc->singlestep_enabled = env->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->cc_op = CC_OP_DYNAMIC;
     dc->cc_op_dirty = false;
     dc->cs_base = cs_base;
@@ -8302,7 +8303,7 @@ static inline void gen_intermediate_code_internal(X86CPU *cpu,
     dc->code64 = (flags >> HF_CS64_SHIFT) & 1;
 #endif
     dc->flags = flags;
-    dc->jmp_opt = !(dc->tf || env->singlestep_enabled ||
+    dc->jmp_opt = !(dc->tf || cs->singlestep_enabled ||
                     (flags & HF_INHIBIT_IRQ_MASK)
 #ifndef CONFIG_SOFTMMU
                     || (flags & HF_SOFTMMU_MASK)
diff --git a/target-lm32/translate.c b/target-lm32/translate.c
index ed12f50..1247287 100644
--- a/target-lm32/translate.c
+++ b/target-lm32/translate.c
@@ -1015,6 +1015,7 @@ static inline
 void gen_intermediate_code_internal(LM32CPU *cpu,
                                     TranslationBlock *tb, bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPULM32State *env = &cpu->env;
     struct DisasContext ctx, *dc = &ctx;
     uint16_t *gen_opc_end;
@@ -1032,7 +1033,7 @@ void gen_intermediate_code_internal(LM32CPU *cpu,
 
     dc->is_jmp = DISAS_NEXT;
     dc->pc = pc_start;
-    dc->singlestep_enabled = env->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->nr_nops = 0;
 
     if (pc_start & 3) {
@@ -1077,7 +1078,7 @@ void gen_intermediate_code_internal(LM32CPU *cpu,
 
     } while (!dc->is_jmp
          && tcg_ctx.gen_opc_ptr < gen_opc_end
-         && !env->singlestep_enabled
+         && !cs->singlestep_enabled
          && !singlestep
          && (dc->pc < next_page_start)
          && num_insns < max_insns);
@@ -1086,7 +1087,7 @@ void gen_intermediate_code_internal(LM32CPU *cpu,
         gen_io_end();
     }
 
-    if (unlikely(env->singlestep_enabled)) {
+    if (unlikely(cs->singlestep_enabled)) {
         if (dc->is_jmp == DISAS_NEXT) {
             tcg_gen_movi_tl(cpu_pc, dc->pc);
         }
diff --git a/target-m68k/translate.c b/target-m68k/translate.c
index 2d73af5..d562eeb 100644
--- a/target-m68k/translate.c
+++ b/target-m68k/translate.c
@@ -2974,6 +2974,7 @@ static inline void
 gen_intermediate_code_internal(M68kCPU *cpu, TranslationBlock *tb,
                                bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUM68KState *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     uint16_t *gen_opc_end;
@@ -2995,7 +2996,7 @@ gen_intermediate_code_internal(M68kCPU *cpu, TranslationBlock *tb,
     dc->is_jmp = DISAS_NEXT;
     dc->pc = pc_start;
     dc->cc_op = CC_OP_DYNAMIC;
-    dc->singlestep_enabled = env->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->fpcr = env->fpcr;
     dc->user = (env->sr & SR_S) == 0;
     dc->is_mem = 0;
@@ -3038,14 +3039,14 @@ gen_intermediate_code_internal(M68kCPU *cpu, TranslationBlock *tb,
 	disas_m68k_insn(env, dc);
         num_insns++;
     } while (!dc->is_jmp && tcg_ctx.gen_opc_ptr < gen_opc_end &&
-             !env->singlestep_enabled &&
+             !cs->singlestep_enabled &&
              !singlestep &&
              (pc_offset) < (TARGET_PAGE_SIZE - 32) &&
              num_insns < max_insns);
 
     if (tb->cflags & CF_LAST_IO)
         gen_io_end();
-    if (unlikely(env->singlestep_enabled)) {
+    if (unlikely(cs->singlestep_enabled)) {
         /* Make sure the pc is updated, and raise a debug exception.  */
         if (!dc->is_jmp) {
             gen_flush_cc_op(dc);
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index eba255b..cd43577 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1741,6 +1741,7 @@ static inline void
 gen_intermediate_code_internal(MicroBlazeCPU *cpu, TranslationBlock *tb,
                                bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUMBState *env = &cpu->env;
     uint16_t *gen_opc_end;
     uint32_t pc_start;
@@ -1766,7 +1767,7 @@ gen_intermediate_code_internal(MicroBlazeCPU *cpu, TranslationBlock *tb,
         dc->jmp = JMP_INDIRECT;
     }
     dc->pc = pc_start;
-    dc->singlestep_enabled = env->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->cpustate_changed = 0;
     dc->abort_at_next_insn = 0;
     dc->nr_nops = 0;
@@ -1859,8 +1860,9 @@ gen_intermediate_code_internal(MicroBlazeCPU *cpu, TranslationBlock *tb,
                 break;
             }
         }
-        if (env->singlestep_enabled)
+        if (cs->singlestep_enabled) {
             break;
+        }
     } while (!dc->is_jmp && !dc->cpustate_changed
          && tcg_ctx.gen_opc_ptr < gen_opc_end
                  && !singlestep
@@ -1887,7 +1889,7 @@ gen_intermediate_code_internal(MicroBlazeCPU *cpu, TranslationBlock *tb,
     }
     t_sync_flags(dc);
 
-    if (unlikely(env->singlestep_enabled)) {
+    if (unlikely(cs->singlestep_enabled)) {
         TCGv_i32 tmp = tcg_const_i32(EXCP_DEBUG);
 
         if (dc->is_jmp != DISAS_JUMP) {
diff --git a/target-mips/translate.c b/target-mips/translate.c
index 8246c20..877f8df 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -15543,6 +15543,7 @@ static inline void
 gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
                                bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUMIPSState *env = &cpu->env;
     DisasContext ctx;
     target_ulong pc_start;
@@ -15561,7 +15562,7 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
     ctx.pc = pc_start;
     ctx.saved_pc = -1;
-    ctx.singlestep_enabled = env->singlestep_enabled;
+    ctx.singlestep_enabled = cs->singlestep_enabled;
     ctx.insn_flags = env->insn_flags;
     ctx.tb = tb;
     ctx.bstate = BS_NONE;
@@ -15637,8 +15638,9 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
            This is what GDB expects and is consistent with what the
            hardware does (e.g. if a delay slot instruction faults, the
            reported PC is the PC of the branch).  */
-        if (env->singlestep_enabled && (ctx.hflags & MIPS_HFLAG_BMASK) == 0)
+        if (cs->singlestep_enabled && (ctx.hflags & MIPS_HFLAG_BMASK) == 0) {
             break;
+        }
 
         if ((ctx.pc & (TARGET_PAGE_SIZE - 1)) == 0)
             break;
@@ -15653,9 +15655,10 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
         if (singlestep)
             break;
     }
-    if (tb->cflags & CF_LAST_IO)
+    if (tb->cflags & CF_LAST_IO) {
         gen_io_end();
-    if (env->singlestep_enabled && ctx.bstate != BS_BRANCH) {
+    }
+    if (cs->singlestep_enabled && ctx.bstate != BS_BRANCH) {
         save_cpu_state(&ctx, ctx.bstate == BS_NONE);
         gen_helper_0e0i(raise_exception, EXCP_DEBUG);
     } else {
diff --git a/target-moxie/translate.c b/target-moxie/translate.c
index 664d359..8cc0bb7 100644
--- a/target-moxie/translate.c
+++ b/target-moxie/translate.c
@@ -824,6 +824,7 @@ static inline void
 gen_intermediate_code_internal(MoxieCPU *cpu, TranslationBlock *tb,
                                bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     DisasContext ctx;
     target_ulong pc_start;
     uint16_t *gen_opc_end;
@@ -871,7 +872,7 @@ gen_intermediate_code_internal(MoxieCPU *cpu, TranslationBlock *tb,
         ctx.pc += decode_opc(cpu, &ctx);
         num_insns++;
 
-        if (env->singlestep_enabled) {
+        if (cs->singlestep_enabled) {
             break;
         }
 
@@ -880,7 +881,7 @@ gen_intermediate_code_internal(MoxieCPU *cpu, TranslationBlock *tb,
         }
     } while (ctx.bstate == BS_NONE && tcg_ctx.gen_opc_ptr < gen_opc_end);
 
-    if (env->singlestep_enabled) {
+    if (cs->singlestep_enabled) {
         tcg_gen_movi_tl(cpu_pc, ctx.pc);
         gen_helper_debug(cpu_env);
     } else {
diff --git a/target-openrisc/translate.c b/target-openrisc/translate.c
index f222834..a6050ba 100644
--- a/target-openrisc/translate.c
+++ b/target-openrisc/translate.c
@@ -1662,6 +1662,7 @@ static inline void gen_intermediate_code_internal(OpenRISCCPU *cpu,
                                                   TranslationBlock *tb,
                                                   int search_pc)
 {
+    CPUState *cs = CPU(cpu);
     struct DisasContext ctx, *dc = &ctx;
     uint16_t *gen_opc_end;
     uint32_t pc_start;
@@ -1681,7 +1682,7 @@ static inline void gen_intermediate_code_internal(OpenRISCCPU *cpu,
     dc->mem_idx = cpu_mmu_index(&cpu->env);
     dc->synced_flags = dc->tb_flags = tb->flags;
     dc->delayed_branch = !!(dc->tb_flags & D_FLAG);
-    dc->singlestep_enabled = cpu->env.singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
         qemu_log("-----------------------------------------\n");
         log_cpu_state(CPU(cpu), 0);
@@ -1743,7 +1744,7 @@ static inline void gen_intermediate_code_internal(OpenRISCCPU *cpu,
         }
     } while (!dc->is_jmp
              && tcg_ctx.gen_opc_ptr < gen_opc_end
-             && !cpu->env.singlestep_enabled
+             && !cs->singlestep_enabled
              && !singlestep
              && (dc->pc < next_page_start)
              && num_insns < max_insns);
@@ -1755,7 +1756,7 @@ static inline void gen_intermediate_code_internal(OpenRISCCPU *cpu,
         dc->is_jmp = DISAS_UPDATE;
         tcg_gen_movi_tl(cpu_pc, dc->pc);
     }
-    if (unlikely(cpu->env.singlestep_enabled)) {
+    if (unlikely(cs->singlestep_enabled)) {
         if (dc->is_jmp == DISAS_NEXT) {
             tcg_gen_movi_tl(cpu_pc, dc->pc);
         }
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index eb96272..f07d70d 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -9730,6 +9730,7 @@ static inline void gen_intermediate_code_internal(PowerPCCPU *cpu,
                                                   TranslationBlock *tb,
                                                   bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
     DisasContext ctx, *ctxp = &ctx;
     opc_handler_t **table, *handler;
@@ -9770,8 +9771,9 @@ static inline void gen_intermediate_code_internal(PowerPCCPU *cpu,
         ctx.singlestep_enabled = 0;
     if ((env->flags & POWERPC_FLAG_BE) && msr_be)
         ctx.singlestep_enabled |= CPU_BRANCH_STEP;
-    if (unlikely(env->singlestep_enabled))
+    if (unlikely(cs->singlestep_enabled)) {
         ctx.singlestep_enabled |= GDBSTUB_SINGLE_STEP;
+    }
 #if defined (DO_SINGLE_STEP) && 0
     /* Single step trace mode */
     msr_se = 1;
@@ -9873,7 +9875,7 @@ static inline void gen_intermediate_code_internal(PowerPCCPU *cpu,
                      ctx.exception != POWERPC_EXCP_BRANCH)) {
             gen_exception(ctxp, POWERPC_EXCP_TRACE);
         } else if (unlikely(((ctx.nip & (TARGET_PAGE_SIZE - 1)) == 0) ||
-                            (env->singlestep_enabled) ||
+                            (cs->singlestep_enabled) ||
                             singlestep ||
                             num_insns >= max_insns)) {
             /* if we reach a page boundary or are single stepping, stop
@@ -9887,7 +9889,7 @@ static inline void gen_intermediate_code_internal(PowerPCCPU *cpu,
     if (ctx.exception == POWERPC_EXCP_NONE) {
         gen_goto_tb(&ctx, 0, ctx.nip);
     } else if (ctx.exception != POWERPC_EXCP_BRANCH) {
-        if (unlikely(env->singlestep_enabled)) {
+        if (unlikely(cs->singlestep_enabled)) {
             gen_debug_exception(ctxp);
         }
         /* Generate the return instruction */
diff --git a/target-s390x/translate.c b/target-s390x/translate.c
index cba7b87..1fb76c5 100644
--- a/target-s390x/translate.c
+++ b/target-s390x/translate.c
@@ -4740,6 +4740,7 @@ static inline void gen_intermediate_code_internal(S390CPU *cpu,
                                                   TranslationBlock *tb,
                                                   bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUS390XState *env = &cpu->env;
     DisasContext dc;
     target_ulong pc_start;
@@ -4761,7 +4762,7 @@ static inline void gen_intermediate_code_internal(S390CPU *cpu,
     dc.tb = tb;
     dc.pc = pc_start;
     dc.cc_op = CC_OP_DYNAMIC;
-    do_debug = dc.singlestep_enabled = env->singlestep_enabled;
+    do_debug = dc.singlestep_enabled = cs->singlestep_enabled;
 
     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
 
@@ -4818,7 +4819,7 @@ static inline void gen_intermediate_code_internal(S390CPU *cpu,
                 || tcg_ctx.gen_opc_ptr >= gen_opc_end
                 || num_insns >= max_insns
                 || singlestep
-                || env->singlestep_enabled)) {
+                || cs->singlestep_enabled)) {
             status = EXIT_PC_STALE;
         }
     } while (status == NO_EXIT);
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 2fbe668..59f3d47 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -1849,6 +1849,7 @@ static inline void
 gen_intermediate_code_internal(SuperHCPU *cpu, TranslationBlock *tb,
                                bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUSH4State *env = &cpu->env;
     DisasContext ctx;
     target_ulong pc_start;
@@ -1868,7 +1869,7 @@ gen_intermediate_code_internal(SuperHCPU *cpu, TranslationBlock *tb,
        so assume it is a dynamic branch.  */
     ctx.delayed_pc = -1; /* use delayed pc from env pointer */
     ctx.tb = tb;
-    ctx.singlestep_enabled = env->singlestep_enabled;
+    ctx.singlestep_enabled = cs->singlestep_enabled;
     ctx.features = env->features;
     ctx.has_movcal = (ctx.flags & TB_FLAG_PENDING_MOVCA);
 
@@ -1914,8 +1915,9 @@ gen_intermediate_code_internal(SuperHCPU *cpu, TranslationBlock *tb,
 	ctx.pc += 2;
 	if ((ctx.pc & (TARGET_PAGE_SIZE - 1)) == 0)
 	    break;
-	if (env->singlestep_enabled)
+        if (cs->singlestep_enabled) {
 	    break;
+        }
         if (num_insns >= max_insns)
             break;
         if (singlestep)
@@ -1923,7 +1925,7 @@ gen_intermediate_code_internal(SuperHCPU *cpu, TranslationBlock *tb,
     }
     if (tb->cflags & CF_LAST_IO)
         gen_io_end();
-    if (env->singlestep_enabled) {
+    if (cs->singlestep_enabled) {
         tcg_gen_movi_i32(cpu_pc, ctx.pc);
         gen_helper_debug(cpu_env);
     } else {
diff --git a/target-sparc/translate.c b/target-sparc/translate.c
index 5e771e5..093e0e2 100644
--- a/target-sparc/translate.c
+++ b/target-sparc/translate.c
@@ -5223,6 +5223,7 @@ static inline void gen_intermediate_code_internal(SPARCCPU *cpu,
                                                   TranslationBlock *tb,
                                                   bool spc)
 {
+    CPUState *cs = CPU(cpu);
     CPUSPARCState *env = &cpu->env;
     target_ulong pc_start, last_pc;
     uint16_t *gen_opc_end;
@@ -5244,7 +5245,7 @@ static inline void gen_intermediate_code_internal(SPARCCPU *cpu,
     dc->def = env->def;
     dc->fpu_enabled = tb_fpu_enabled(tb->flags);
     dc->address_mask_32bit = tb_am_enabled(tb->flags);
-    dc->singlestep = (env->singlestep_enabled || singlestep);
+    dc->singlestep = (cs->singlestep_enabled || singlestep);
     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
 
     num_insns = 0;
diff --git a/target-unicore32/translate.c b/target-unicore32/translate.c
index d85185d..68be1c6 100644
--- a/target-unicore32/translate.c
+++ b/target-unicore32/translate.c
@@ -1879,6 +1879,7 @@ static void disas_uc32_insn(CPUUniCore32State *env, DisasContext *s)
 static inline void gen_intermediate_code_internal(UniCore32CPU *cpu,
         TranslationBlock *tb, bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUUniCore32State *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     CPUBreakpoint *bp;
@@ -1900,7 +1901,7 @@ static inline void gen_intermediate_code_internal(UniCore32CPU *cpu,
 
     dc->is_jmp = DISAS_NEXT;
     dc->pc = pc_start;
-    dc->singlestep_enabled = env->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->condjmp = 0;
     cpu_F0s = tcg_temp_new_i32();
     cpu_F1s = tcg_temp_new_i32();
@@ -1971,7 +1972,7 @@ static inline void gen_intermediate_code_internal(UniCore32CPU *cpu,
          * ensures prefetch aborts occur at the right place.  */
         num_insns++;
     } while (!dc->is_jmp && tcg_ctx.gen_opc_ptr < gen_opc_end &&
-             !env->singlestep_enabled &&
+             !cs->singlestep_enabled &&
              !singlestep &&
              dc->pc < next_page_start &&
              num_insns < max_insns);
@@ -1988,7 +1989,7 @@ static inline void gen_intermediate_code_internal(UniCore32CPU *cpu,
     /* At this stage dc->condjmp will only be set when the skipped
        instruction was a conditional branch or trap, and the PC has
        already been written.  */
-    if (unlikely(env->singlestep_enabled)) {
+    if (unlikely(cs->singlestep_enabled)) {
         /* Make sure the pc is updated, and raise a debug exception.  */
         if (dc->condjmp) {
             if (dc->is_jmp == DISAS_SYSCALL) {
diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
index e4cf828..e692329 100644
--- a/target-xtensa/translate.c
+++ b/target-xtensa/translate.c
@@ -2879,6 +2879,7 @@ static inline
 void gen_intermediate_code_internal(XtensaCPU *cpu,
                                     TranslationBlock *tb, bool search_pc)
 {
+    CPUState *cs = CPU(cpu);
     CPUXtensaState *env = &cpu->env;
     DisasContext dc;
     int insn_count = 0;
@@ -2894,7 +2895,7 @@ void gen_intermediate_code_internal(XtensaCPU *cpu,
     }
 
     dc.config = env->config;
-    dc.singlestep_enabled = env->singlestep_enabled;
+    dc.singlestep_enabled = cs->singlestep_enabled;
     dc.tb = tb;
     dc.pc = pc_start;
     dc.ring = tb->flags & XTENSA_TBFLAG_RING_MASK;
@@ -2917,7 +2918,7 @@ void gen_intermediate_code_internal(XtensaCPU *cpu,
 
     gen_tb_start();
 
-    if (env->singlestep_enabled && env->exception_taken) {
+    if (cs->singlestep_enabled && env->exception_taken) {
         env->exception_taken = 0;
         tcg_gen_movi_i32(cpu_pc, dc.pc);
         gen_exception(&dc, EXCP_DEBUG);
@@ -2970,7 +2971,7 @@ void gen_intermediate_code_internal(XtensaCPU *cpu,
         if (dc.icount) {
             tcg_gen_mov_i32(cpu_SR[ICOUNT], dc.next_icount);
         }
-        if (env->singlestep_enabled) {
+        if (cs->singlestep_enabled) {
             tcg_gen_movi_i32(cpu_pc, dc.pc);
             gen_exception(&dc, EXCP_DEBUG);
             break;
commit 801c4c287b7d85fe8447900f78a9a6ab89d00271
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Jul 1 13:19:30 2013 -0700

    target-alpha: Copy implver to DisasContext
    
    Which allows removing env from DisasContext.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index 6a1aad6..c298c06 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -38,7 +38,6 @@
 typedef struct DisasContext DisasContext;
 struct DisasContext {
     struct TranslationBlock *tb;
-    CPUAlphaState *env;
     uint64_t pc;
     int mem_idx;
 
@@ -47,6 +46,9 @@ struct DisasContext {
     /* Current flush-to-zero setting for this TB.  */
     int tb_ftz;
 
+    /* implver value for this CPU.  */
+    int implver;
+
     bool singlestep_enabled;
 };
 
@@ -2250,8 +2252,9 @@ static ExitStatus translate_one(DisasContext *ctx, uint32_t insn)
             break;
         case 0x6C:
             /* IMPLVER */
-            if (rc != 31)
-                tcg_gen_movi_i64(cpu_ir[rc], ctx->env->implver);
+            if (rc != 31) {
+                tcg_gen_movi_i64(cpu_ir[rc], ctx->implver);
+            }
             break;
         default:
             goto invalid_opc;
@@ -3400,9 +3403,9 @@ static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
 
     ctx.tb = tb;
-    ctx.env = env;
     ctx.pc = pc_start;
     ctx.mem_idx = cpu_mmu_index(env);
+    ctx.implver = env->implver;
     ctx.singlestep_enabled = env->singlestep_enabled;
 
     /* ??? Every TB begins with unset rounding mode, to be initialized on
commit ca6862a67f3c03e5efe26cf45b54c6176e4db5c3
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Jul 1 13:19:29 2013 -0700

    target-alpha: Copy singlestep_enabled to DisasContext
    
    Prepare for removing env from DisasContext.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index 5558b72..6a1aad6 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -46,6 +46,8 @@ struct DisasContext {
     int tb_rm;
     /* Current flush-to-zero setting for this TB.  */
     int tb_ftz;
+
+    bool singlestep_enabled;
 };
 
 /* Return values from translate_one, indicating the state of the TB.
@@ -380,7 +382,7 @@ static int use_goto_tb(DisasContext *ctx, uint64_t dest)
     /* Check for the dest on the same page as the start of the TB.  We
        also want to suppress goto_tb in the case of single-steping and IO.  */
     return (((ctx->tb->pc ^ dest) & TARGET_PAGE_MASK) == 0
-            && !ctx->env->singlestep_enabled
+            && !ctx->singlestep_enabled
             && !(ctx->tb->cflags & CF_LAST_IO));
 }
 
@@ -3401,6 +3403,7 @@ static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
     ctx.env = env;
     ctx.pc = pc_start;
     ctx.mem_idx = cpu_mmu_index(env);
+    ctx.singlestep_enabled = env->singlestep_enabled;
 
     /* ??? Every TB begins with unset rounding mode, to be initialized on
        the first fp insn of the TB.  Alternately we could define a proper
@@ -3457,7 +3460,7 @@ static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
                 || tcg_ctx.gen_opc_ptr >= gen_opc_end
                 || num_insns >= max_insns
                 || singlestep
-                || env->singlestep_enabled)) {
+                || ctx.singlestep_enabled)) {
             ret = EXIT_PC_STALE;
         }
     } while (ret == NO_EXIT);
@@ -3474,7 +3477,7 @@ static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
         tcg_gen_movi_i64(cpu_pc, ctx.pc);
         /* FALLTHRU */
     case EXIT_PC_UPDATED:
-        if (env->singlestep_enabled) {
+        if (ctx.singlestep_enabled) {
             gen_excp_1(EXCP_DEBUG, 0);
         } else {
             tcg_gen_exit_tb(0);
commit bdf7ae5bbdb3f050d97862b2ba0261fa902ebc53
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 28 19:31:32 2013 +0200

    cpu: Introduce CPUClass::synchronize_from_tb() for cpu_pc_from_tb()
    
    Where no extra implementation is needed, fall back to CPUClass::set_pc().
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpu-exec.c b/cpu-exec.c
index 6c784a7..3fccb86 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -59,8 +59,14 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, uint8_t *tb_ptr)
          * counter hit zero); we must restore the guest PC to the address
          * of the start of the TB.
          */
+        CPUClass *cc = CPU_GET_CLASS(cpu);
         TranslationBlock *tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
-        cpu_pc_from_tb(env, tb);
+        if (cc->synchronize_from_tb) {
+            cc->synchronize_from_tb(cpu, tb);
+        } else {
+            assert(cc->set_pc);
+            cc->set_pc(cpu, tb->pc);
+        }
     }
     if ((next_tb & TB_EXIT_MASK) == TB_EXIT_REQUESTED) {
         /* We were asked to stop executing TBs (probably a pending
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 4620fee..4e5ec77 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -60,6 +60,8 @@ typedef void (*CPUUnassignedAccess)(CPUState *cpu, hwaddr addr,
                                     bool is_write, bool is_exec, int opaque,
                                     unsigned size);
 
+struct TranslationBlock;
+
 /**
  * CPUClass:
  * @class_by_name: Callback to map -cpu command line model name to an
@@ -74,6 +76,8 @@ typedef void (*CPUUnassignedAccess)(CPUState *cpu, hwaddr addr,
  * @get_paging_enabled: Callback for inquiring whether paging is enabled.
  * @get_memory_mapping: Callback for obtaining the memory mappings.
  * @set_pc: Callback for setting the Program Counter register.
+ * @synchronize_from_tb: Callback for synchronizing state from a TCG
+ * #TranslationBlock.
  * @vmsd: State description for migration.
  *
  * Represents a CPU family or model.
@@ -98,6 +102,7 @@ typedef struct CPUClass {
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
     void (*set_pc)(CPUState *cpu, vaddr value);
+    void (*synchronize_from_tb)(CPUState *cpu, struct TranslationBlock *tb);
 
     const struct VMStateDescription *vmsd;
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
diff --git a/target-alpha/cpu.h b/target-alpha/cpu.h
index 066f032..c85dc6e 100644
--- a/target-alpha/cpu.h
+++ b/target-alpha/cpu.h
@@ -515,9 +515,4 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUAlphaState *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-}
-
 #endif /* !defined (__CPU_ALPHA_H__) */
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index c798b27..b2dc494 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -797,11 +797,6 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUARMState *env, TranslationBlock *tb)
-{
-    env->regs[15] = tb->pc;
-}
-
 /* Load an instruction and return it in the standard little-endian order */
 static inline uint32_t arm_ldl_code(CPUARMState *env, uint32_t addr,
                                     bool do_swap)
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index c12a8ca..4b9fc4c 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -279,8 +279,4 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUCRISState *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-}
 #endif
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 67b095d..b57ea4b 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2513,6 +2513,13 @@ static void x86_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.eip = value;
 }
 
+static void x86_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
+{
+    X86CPU *cpu = X86_CPU(cs);
+
+    cpu->env.eip = tb->pc - tb->cs_base;
+}
+
 static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
@@ -2530,6 +2537,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = x86_cpu_do_interrupt;
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
+    cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
     cc->get_arch_id = x86_cpu_get_arch_id;
     cc->get_paging_enabled = x86_cpu_get_paging_enabled;
 #ifndef CONFIG_USER_ONLY
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 2d005b3..cedefdc 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1148,11 +1148,6 @@ static inline bool cpu_has_work(CPUState *cs)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUX86State *env, TranslationBlock *tb)
-{
-    env->eip = tb->pc - tb->cs_base;
-}
-
 static inline void cpu_get_tb_cpu_state(CPUX86State *env, target_ulong *pc,
                                         target_ulong *cs_base, int *flags)
 {
diff --git a/target-lm32/cpu.h b/target-lm32/cpu.h
index 856bdc7..dbfe043 100644
--- a/target-lm32/cpu.h
+++ b/target-lm32/cpu.h
@@ -232,9 +232,4 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPULM32State *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-}
-
 #endif
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index 9fdf89e..cfd6846 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -260,9 +260,4 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUM68KState *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-}
-
 #endif
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 6c35475..7508cf5 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -365,9 +365,4 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUMBState *env, TranslationBlock *tb)
-{
-    env->sregs[SR_PC] = tb->pc;
-}
-
 #endif
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 6ec3d25..1581cd9 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -35,6 +35,16 @@ static void mips_cpu_set_pc(CPUState *cs, vaddr value)
     }
 }
 
+static void mips_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
+{
+    MIPSCPU *cpu = MIPS_CPU(cs);
+    CPUMIPSState *env = &cpu->env;
+
+    env->active_tc.PC = tb->pc;
+    env->hflags &= ~MIPS_HFLAG_BMASK;
+    env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
+}
+
 /* CPUClass::reset() */
 static void mips_cpu_reset(CPUState *s)
 {
@@ -90,6 +100,7 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->dump_state = mips_cpu_dump_state;
     cpu_class_set_do_unassigned_access(cc, mips_cpu_unassigned_access);
     cc->set_pc = mips_cpu_set_pc;
+    cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 7ffd2e3..a29c82f 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -732,13 +732,6 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUMIPSState *env, TranslationBlock *tb)
-{
-    env->active_tc.PC = tb->pc;
-    env->hflags &= ~MIPS_HFLAG_BMASK;
-    env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
-}
-
 static inline void compute_hflags(CPUMIPSState *env)
 {
     env->hflags &= ~(MIPS_HFLAG_COP1X | MIPS_HFLAG_64 | MIPS_HFLAG_CP0 |
diff --git a/target-moxie/cpu.h b/target-moxie/cpu.h
index 72d02c2..d5030a4 100644
--- a/target-moxie/cpu.h
+++ b/target-moxie/cpu.h
@@ -143,11 +143,6 @@ static inline int cpu_mmu_index(CPUMoxieState *env)
 #include "exec/cpu-all.h"
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUMoxieState *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-}
-
 static inline void cpu_get_tb_cpu_state(CPUMoxieState *env, target_ulong *pc,
                                         target_ulong *cs_base, int *flags)
 {
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index 0aff8f2..82bfd03 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -428,9 +428,4 @@ static inline target_ulong cpu_get_pc(CPUOpenRISCState *env)
     return env->pc;
 }
 
-static inline void cpu_pc_from_tb(CPUOpenRISCState *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-}
-
 #endif /* CPU_OPENRISC_H */
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 7a7b1bf..6f51e1f 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -2144,11 +2144,6 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUPPCState *env, TranslationBlock *tb)
-{
-    env->nip = tb->pc;
-}
-
 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env);
 
 #endif /* !defined (__CPU_PPC_H__) */
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 6462688..65bef86 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -1041,11 +1041,6 @@ static inline bool cpu_has_work(CPUState *cpu)
         (env->psw.mask & PSW_MASK_EXT);
 }
 
-static inline void cpu_pc_from_tb(CPUS390XState *env, TranslationBlock* tb)
-{
-    env->psw.addr = tb->pc;
-}
-
 /* fpu_helper.c */
 uint32_t set_cc_nz_f32(float32 v);
 uint32_t set_cc_nz_f64(float64 v);
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index facbd18..03dedc1 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -31,6 +31,14 @@ static void superh_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.pc = value;
 }
 
+static void superh_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
+{
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+
+    cpu->env.pc = tb->pc;
+    cpu->env.flags = tb->flags;
+}
+
 /* CPUClass::reset() */
 static void superh_cpu_reset(CPUState *s)
 {
@@ -277,6 +285,7 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = superh_cpu_do_interrupt;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
+    cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;
     dc->vmsd = &vmstate_sh_cpu;
 }
 
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index c8df18b..276d295 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -359,10 +359,4 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUSH4State *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-    env->flags = tb->flags;
-}
-
 #endif				/* _CPU_SH4_H */
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 88582c6..a2deba5 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -731,6 +731,14 @@ static void sparc_cpu_set_pc(CPUState *cs, vaddr value)
     cpu->env.npc = value + 4;
 }
 
+static void sparc_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
+{
+    SPARCCPU *cpu = SPARC_CPU(cs);
+
+    cpu->env.pc = tb->pc;
+    cpu->env.npc = tb->cs_base;
+}
+
 static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(dev);
@@ -776,6 +784,7 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->dump_state = sparc_cpu_dump_state;
     cpu_class_set_do_unassigned_access(cc, sparc_cpu_unassigned_access);
     cc->set_pc = sparc_cpu_set_pc;
+    cc->synchronize_from_tb = sparc_cpu_synchronize_from_tb;
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 41b014a..0f35a22 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -759,10 +759,4 @@ static inline bool cpu_has_work(CPUState *cpu)
 
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUSPARCState *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-    env->npc = tb->cs_base;
-}
-
 #endif
diff --git a/target-unicore32/cpu.h b/target-unicore32/cpu.h
index d4be525..967511e 100644
--- a/target-unicore32/cpu.h
+++ b/target-unicore32/cpu.h
@@ -146,11 +146,6 @@ static inline int cpu_mmu_index(CPUUniCore32State *env)
 #include "cpu-qom.h"
 #include "exec/exec-all.h"
 
-static inline void cpu_pc_from_tb(CPUUniCore32State *env, TranslationBlock *tb)
-{
-    env->regs[31] = tb->pc;
-}
-
 static inline void cpu_get_tb_cpu_state(CPUUniCore32State *env, target_ulong *pc,
                                         target_ulong *cs_base, int *flags)
 {
diff --git a/target-xtensa/cpu.h b/target-xtensa/cpu.h
index 6c9fc35..a8f02f6 100644
--- a/target-xtensa/cpu.h
+++ b/target-xtensa/cpu.h
@@ -522,9 +522,4 @@ static inline int cpu_has_work(CPUState *cpu)
     return env->pending_irq_level;
 }
 
-static inline void cpu_pc_from_tb(CPUXtensaState *env, TranslationBlock *tb)
-{
-    env->pc = tb->pc;
-}
-
 #endif
commit b42eab27beaefd5c9bf9353383d6403e0628c014
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 28 19:41:07 2013 +0200

    target-unicore32: Implement CPUClass::set_pc()
    
    This adds support for GDB's c addr (Continue) and s addr (Single Step).
    
    Prepares for dropping cpu_pc_from_tb().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 6572f01..79f2292 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -16,6 +16,13 @@
 #include "qemu-common.h"
 #include "migration/vmstate.h"
 
+static void uc32_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    UniCore32CPU *cpu = UNICORE32_CPU(cs);
+
+    cpu->env.regs[31] = value;
+}
+
 static inline void set_feature(CPUUniCore32State *env, int feature)
 {
     env->features |= feature;
@@ -131,6 +138,7 @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->do_interrupt = uc32_cpu_do_interrupt;
     cc->dump_state = uc32_cpu_dump_state;
+    cc->set_pc = uc32_cpu_set_pc;
     dc->vmsd = &vmstate_uc32_cpu;
 }
 
commit a10b978c4246bf9af0e34505aba500d3e7f6c6c4
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 28 20:43:26 2013 +0200

    target-moxie: Implement CPUClass::set_pc()
    
    This adds support for GDB's c addr (Continue) and s addr (Single Step).
    
    Prepares for dropping cpu_pc_from_tb().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 92ca594..91f6197 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -22,6 +22,13 @@
 #include "migration/vmstate.h"
 #include "machine.h"
 
+static void moxie_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    MoxieCPU *cpu = MOXIE_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 static void moxie_cpu_reset(CPUState *s)
 {
     MoxieCPU *cpu = MOXIE_CPU(s);
@@ -93,6 +100,7 @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = moxie_cpu_do_interrupt;
     cc->dump_state = moxie_cpu_dump_state;
+    cc->set_pc = moxie_cpu_set_pc;
     cpu_class_set_vmsd(cc, &vmstate_moxie_cpu);
 }
 
commit e700604df024ec5028f476b133ca337c4d7ee518
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 28 20:35:01 2013 +0200

    target-m68k: Implement CPUClass::set_pc()
    
    This adds support for GDB's c addr (Continue) and s addr (Single Step).
    
    Prepares for dropping cpu_pc_from_tb().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 1b6ef66..43011e7 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -23,6 +23,13 @@
 #include "migration/vmstate.h"
 
 
+static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    M68kCPU *cpu = M68K_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 static void m68k_set_feature(CPUM68KState *env, int feature)
 {
     env->features |= (1u << feature);
@@ -182,6 +189,7 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->do_interrupt = m68k_cpu_do_interrupt;
     cc->dump_state = m68k_cpu_dump_state;
+    cc->set_pc = m68k_cpu_set_pc;
     dc->vmsd = &vmstate_m68k_cpu;
 }
 
commit f45748f10eda61d6262153fadf3910cb63e17ecd
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 19:09:18 2013 +0200

    cpu: Introduce CPUClass::set_pc() for gdb_set_cpu_pc()
    
    This moves setting the Program Counter from gdbstub into target code.
    Use vaddr type as upper-bound replacement for target_ulong.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index bdba19b..55d4756 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2042,40 +2042,13 @@ static void gdb_breakpoint_remove_all(void)
 
 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 {
-    cpu_synchronize_state(ENV_GET_CPU(s->c_cpu));
-#if defined(TARGET_I386)
-    s->c_cpu->eip = pc;
-#elif defined (TARGET_PPC)
-    s->c_cpu->nip = pc;
-#elif defined (TARGET_SPARC)
-    s->c_cpu->pc = pc;
-    s->c_cpu->npc = pc + 4;
-#elif defined (TARGET_ARM)
-    s->c_cpu->regs[15] = pc;
-#elif defined (TARGET_SH4)
-    s->c_cpu->pc = pc;
-#elif defined (TARGET_MIPS)
-    s->c_cpu->active_tc.PC = pc & ~(target_ulong)1;
-    if (pc & 1) {
-        s->c_cpu->hflags |= MIPS_HFLAG_M16;
-    } else {
-        s->c_cpu->hflags &= ~(MIPS_HFLAG_M16);
+    CPUState *cpu = ENV_GET_CPU(s->c_cpu);
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    cpu_synchronize_state(cpu);
+    if (cc->set_pc) {
+        cc->set_pc(cpu, pc);
     }
-#elif defined (TARGET_MICROBLAZE)
-    s->c_cpu->sregs[SR_PC] = pc;
-#elif defined(TARGET_OPENRISC)
-    s->c_cpu->pc = pc;
-#elif defined (TARGET_CRIS)
-    s->c_cpu->pc = pc;
-#elif defined (TARGET_ALPHA)
-    s->c_cpu->pc = pc;
-#elif defined (TARGET_S390X)
-    s->c_cpu->psw.addr = pc;
-#elif defined (TARGET_LM32)
-    s->c_cpu->pc = pc;
-#elif defined(TARGET_XTENSA)
-    s->c_cpu->pc = pc;
-#endif
 }
 
 static CPUArchState *find_cpu(uint32_t thread_id)
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 829fd45..4620fee 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -73,6 +73,7 @@ typedef void (*CPUUnassignedAccess)(CPUState *cpu, hwaddr addr,
  * @get_arch_id: Callback for getting architecture-dependent CPU ID.
  * @get_paging_enabled: Callback for inquiring whether paging is enabled.
  * @get_memory_mapping: Callback for obtaining the memory mappings.
+ * @set_pc: Callback for setting the Program Counter register.
  * @vmsd: State description for migration.
  *
  * Represents a CPU family or model.
@@ -96,6 +97,7 @@ typedef struct CPUClass {
     bool (*get_paging_enabled)(const CPUState *cpu);
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
                                Error **errp);
+    void (*set_pc)(CPUState *cpu, vaddr value);
 
     const struct VMStateDescription *vmsd;
     int (*write_elf64_note)(WriteCoreDumpFunction f, CPUState *cpu,
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 2670805..09bb7a8 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -24,6 +24,13 @@
 #include "migration/vmstate.h"
 
 
+static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    AlphaCPU *cpu = ALPHA_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 static void alpha_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     AlphaCPUClass *acc = ALPHA_CPU_GET_CLASS(dev);
@@ -264,6 +271,7 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = alpha_cpu_do_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
     cpu_class_set_do_unassigned_access(cc, alpha_cpu_unassigned_access);
+    cc->set_pc = alpha_cpu_set_pc;
     device_class_set_vmsd(dc, &vmstate_alpha_cpu);
 }
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 9f1696f..082bc12 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -25,6 +25,13 @@
 #endif
 #include "sysemu/sysemu.h"
 
+static void arm_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+
+    cpu->env.regs[15] = value;
+}
+
 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
 {
     /* Reset a single ARMCPRegInfo register */
@@ -816,6 +823,7 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = arm_cpu_class_by_name;
     cc->do_interrupt = arm_cpu_do_interrupt;
     cc->dump_state = arm_cpu_dump_state;
+    cc->set_pc = arm_cpu_set_pc;
     cpu_class_set_vmsd(cc, &vmstate_arm_cpu);
 }
 
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 2abb57f..b72fd98 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -26,6 +26,13 @@
 #include "mmu.h"
 
 
+static void cris_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    CRISCPU *cpu = CRIS_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 /* CPUClass::reset() */
 static void cris_cpu_reset(CPUState *s)
 {
@@ -247,6 +254,7 @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = cris_cpu_class_by_name;
     cc->do_interrupt = cris_cpu_do_interrupt;
     cc->dump_state = cris_cpu_dump_state;
+    cc->set_pc = cris_cpu_set_pc;
 }
 
 static const TypeInfo cris_cpu_type_info = {
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index e3f75a8..67b095d 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2506,6 +2506,13 @@ static bool x86_cpu_get_paging_enabled(const CPUState *cs)
     return cpu->env.cr[0] & CR0_PG_MASK;
 }
 
+static void x86_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    X86CPU *cpu = X86_CPU(cs);
+
+    cpu->env.eip = value;
+}
+
 static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
@@ -2522,6 +2529,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = x86_cpu_do_interrupt;
     cc->dump_state = x86_cpu_dump_state;
+    cc->set_pc = x86_cpu_set_pc;
     cc->get_arch_id = x86_cpu_get_arch_id;
     cc->get_paging_enabled = x86_cpu_get_paging_enabled;
 #ifndef CONFIG_USER_ONLY
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 04327ac..8aa28b5 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -22,6 +22,13 @@
 #include "qemu-common.h"
 
 
+static void lm32_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    LM32CPU *cpu = LM32_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 /* CPUClass::reset() */
 static void lm32_cpu_reset(CPUState *s)
 {
@@ -79,6 +86,7 @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = lm32_cpu_do_interrupt;
     cc->dump_state = lm32_cpu_dump_state;
+    cc->set_pc = lm32_cpu_set_pc;
     cpu_class_set_vmsd(cc, &vmstate_lm32_cpu);
 }
 
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index dce1c7e..0a9bcfa 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -26,6 +26,13 @@
 #include "migration/vmstate.h"
 
 
+static void mb_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+
+    cpu->env.sregs[SR_PC] = value;
+}
+
 /* CPUClass::reset() */
 static void mb_cpu_reset(CPUState *s)
 {
@@ -134,6 +141,7 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = mb_cpu_do_interrupt;
     cc->dump_state = mb_cpu_dump_state;
     cpu_class_set_do_unassigned_access(cc, mb_cpu_unassigned_access);
+    cc->set_pc = mb_cpu_set_pc;
     dc->vmsd = &vmstate_mb_cpu;
     dc->props = mb_properties;
 }
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 60a3faf..6ec3d25 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -22,6 +22,19 @@
 #include "qemu-common.h"
 
 
+static void mips_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    MIPSCPU *cpu = MIPS_CPU(cs);
+    CPUMIPSState *env = &cpu->env;
+
+    env->active_tc.PC = value & ~(target_ulong)1;
+    if (value & 1) {
+        env->hflags |= MIPS_HFLAG_M16;
+    } else {
+        env->hflags &= ~(MIPS_HFLAG_M16);
+    }
+}
+
 /* CPUClass::reset() */
 static void mips_cpu_reset(CPUState *s)
 {
@@ -76,6 +89,7 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->do_interrupt = mips_cpu_do_interrupt;
     cc->dump_state = mips_cpu_dump_state;
     cpu_class_set_do_unassigned_access(cc, mips_cpu_unassigned_access);
+    cc->set_pc = mips_cpu_set_pc;
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index 6d40f1b..27ee9f4 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -20,6 +20,13 @@
 #include "cpu.h"
 #include "qemu-common.h"
 
+static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 /* CPUClass::reset() */
 static void openrisc_cpu_reset(CPUState *s)
 {
@@ -146,6 +153,7 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->do_interrupt = openrisc_cpu_do_interrupt;
     cc->dump_state = openrisc_cpu_dump_state;
+    cc->set_pc = openrisc_cpu_set_pc;
     device_class_set_vmsd(dc, &vmstate_openrisc_cpu);
 }
 
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 79bfcd8..9ed7736 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8322,6 +8322,13 @@ CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
     return cpu_list;
 }
 
+static void ppc_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+
+    cpu->env.nip = value;
+}
+
 /* CPUClass::reset() */
 static void ppc_cpu_reset(CPUState *s)
 {
@@ -8449,6 +8456,7 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = ppc_cpu_do_interrupt;
     cc->dump_state = ppc_cpu_dump_state;
     cc->dump_statistics = ppc_cpu_dump_statistics;
+    cc->set_pc = ppc_cpu_set_pc;
 }
 
 static const TypeInfo ppc_cpu_type_info = {
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 1ef2fc0..fe3cd8e 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -58,6 +58,13 @@ CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
 }
 #endif
 
+static void s390_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    S390CPU *cpu = S390_CPU(cs);
+
+    cpu->env.psw.addr = value;
+}
+
 /* CPUClass::reset() */
 static void s390_cpu_reset(CPUState *s)
 {
@@ -165,6 +172,7 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = s390_cpu_do_interrupt;
     cc->dump_state = s390_cpu_dump_state;
+    cc->set_pc = s390_cpu_set_pc;
     dc->vmsd = &vmstate_s390_cpu;
 }
 
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 03487eb..facbd18 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -24,6 +24,13 @@
 #include "migration/vmstate.h"
 
 
+static void superh_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 /* CPUClass::reset() */
 static void superh_cpu_reset(CPUState *s)
 {
@@ -269,6 +276,7 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = superh_cpu_class_by_name;
     cc->do_interrupt = superh_cpu_do_interrupt;
     cc->dump_state = superh_cpu_dump_state;
+    cc->set_pc = superh_cpu_set_pc;
     dc->vmsd = &vmstate_sh_cpu;
 }
 
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 87c3a50..88582c6 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -723,6 +723,14 @@ void sparc_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
     cpu_fprintf(f, "\n");
 }
 
+static void sparc_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    SPARCCPU *cpu = SPARC_CPU(cs);
+
+    cpu->env.pc = value;
+    cpu->env.npc = value + 4;
+}
+
 static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(dev);
@@ -767,6 +775,7 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->do_interrupt = sparc_cpu_do_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
     cpu_class_set_do_unassigned_access(cc, sparc_cpu_unassigned_access);
+    cc->set_pc = sparc_cpu_set_pc;
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index 0488984..e3d742a 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -33,6 +33,13 @@
 #include "migration/vmstate.h"
 
 
+static void xtensa_cpu_set_pc(CPUState *cs, vaddr value)
+{
+    XtensaCPU *cpu = XTENSA_CPU(cs);
+
+    cpu->env.pc = value;
+}
+
 /* CPUClass::reset() */
 static void xtensa_cpu_reset(CPUState *s)
 {
@@ -100,6 +107,7 @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = xtensa_cpu_do_interrupt;
     cc->dump_state = xtensa_cpu_dump_state;
+    cc->set_pc = xtensa_cpu_set_pc;
     dc->vmsd = &vmstate_xtensa_cpu;
 }
 
commit 2be8d4509896116dae7b3b9dffc0fccef480126d
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 22 18:34:35 2013 +0200

    HACKING: Document vaddr type usage
    
    Also extend documentation of target_ulong and abi_ulong.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/HACKING b/HACKING
index e73ac79..12fbc8a 100644
--- a/HACKING
+++ b/HACKING
@@ -40,8 +40,23 @@ speaking, the size of guest memory can always fit into ram_addr_t but
 it would not be correct to store an actual guest physical address in a
 ram_addr_t.
 
-Use target_ulong (or abi_ulong) for CPU virtual addresses, however
-devices should not need to use target_ulong.
+For CPU virtual addresses there are several possible types.
+vaddr is the best type to use to hold a CPU virtual address in
+target-independent code. It is guaranteed to be large enough to hold a
+virtual address for any target, and it does not change size from target
+to target. It is always unsigned.
+target_ulong is a type the size of a virtual address on the CPU; this means
+it may be 32 or 64 bits depending on which target is being built. It should
+therefore be used only in target-specific code, and in some
+performance-critical built-per-target core code such as the TLB code.
+There is also a signed version, target_long.
+abi_ulong is for the *-user targets, and represents a type the size of
+'void *' in that target's ABI. (This may not be the same as the size of a
+full CPU virtual address in the case of target ABIs which use 32 bit pointers
+on 64 bit CPUs, like sparc32plus.) Definitions of structures that must match
+the target's ABI must use this type for anything that on the target is defined
+to be an 'unsigned long' or a pointer type.
+There is also a signed version, abi_long.
 
 Of course, take all of the above with a grain of salt.  If you're about
 to use some system interface that requires a type like size_t, pid_t or
commit 577f42c0e11a5bfb462ff3a217701cd5c4356fb4
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 6 03:14:52 2013 +0200

    cpu: Introduce vaddr type
    
    vaddr is to target_ulong what uintmax_t is to unsigned int.
    
    Its purpose is to allow turning per-target functions with target_ulong
    arguments into CPUClass hooks.
    
    Suggested-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index dfd81a1..829fd45 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -30,6 +30,18 @@
 typedef int (*WriteCoreDumpFunction)(void *buf, size_t size, void *opaque);
 
 /**
+ * vaddr:
+ * Type wide enough to contain any #target_ulong virtual address.
+ */
+typedef uint64_t vaddr;
+#define VADDR_PRId PRId64
+#define VADDR_PRIu PRIu64
+#define VADDR_PRIo PRIo64
+#define VADDR_PRIx PRIx64
+#define VADDR_PRIX PRIX64
+#define VADDR_MAX UINT64_MAX
+
+/**
  * SECTION:cpu
  * @section_id: QEMU-cpu
  * @title: CPU Class
commit 52f34623b499cb0273118b1f637c2c6ebaf5d5a1
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 27 13:44:40 2013 +0200

    gdbstub: Change GDBState::query_cpu to CPUState
    
    Since first_cpu/next_cpu are CPUState, CPUArchState is no longer needed.
    
    This resolves a NULL pointer dereference of query_cpu, introduced
    with commit 182735efaf956ccab50b6d74a4fed163e0f35660 and reported by
    TeLeMan and Max Filippov.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 0ee82a9..bdba19b 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -289,7 +289,7 @@ enum RSState {
 typedef struct GDBState {
     CPUArchState *c_cpu; /* current CPU for step/continue ops */
     CPUArchState *g_cpu; /* current CPU for other ops */
-    CPUArchState *query_cpu; /* for q{f|s}ThreadInfo */
+    CPUState *query_cpu; /* for q{f|s}ThreadInfo */
     enum RSState state; /* parsing state */
     char line_buf[MAX_PACKET_LENGTH];
     int line_buf_index;
@@ -2401,15 +2401,14 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             put_packet(s, "QC1");
             break;
         } else if (strcmp(p,"fThreadInfo") == 0) {
-            s->query_cpu = first_cpu->env_ptr;
+            s->query_cpu = first_cpu;
             goto report_cpuinfo;
         } else if (strcmp(p,"sThreadInfo") == 0) {
         report_cpuinfo:
             if (s->query_cpu) {
-                snprintf(buf, sizeof(buf), "m%x",
-                         cpu_index(ENV_GET_CPU(s->query_cpu)));
+                snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
                 put_packet(s, buf);
-                s->query_cpu = ENV_GET_CPU(s->query_cpu)->next_cpu->env_ptr;
+                s->query_cpu = s->query_cpu->next_cpu;
             } else
                 put_packet(s, "l");
             break;
commit 52785d99513e4f5d8c3d94f4362ff54aba88f33c
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:42 2013 +0800

    isa-bus: Drop isabus_bridge_init() since it does nothing
    
    This works since commit 4ce5dae88ecf2bafa0cd663de7e923728b1b3672.
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Edited]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/isa/isa-bus.c b/hw/isa/isa-bus.c
index cfd610c..9e104eb 100644
--- a/hw/isa/isa-bus.c
+++ b/hw/isa/isa-bus.c
@@ -192,18 +192,10 @@ static void isabus_dev_print(Monitor *mon, DeviceState *dev, int indent)
     }
 }
 
-static int isabus_bridge_init(SysBusDevice *dev)
-{
-    /* nothing */
-    return 0;
-}
-
 static void isabus_bridge_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = isabus_bridge_init;
     dc->fw_name = "isa";
     dc->no_user = 1;
 }
commit f5ba752371b2fc493fdef05cb7e3141161fd1fab
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:41 2013 +0800

    ioapic: Use QOM realize for ioapic
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Tweaked error message]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/ioapic_common.c b/hw/intc/ioapic_common.c
index 5c5bb3c..6b705c1 100644
--- a/hw/intc/ioapic_common.c
+++ b/hw/intc/ioapic_common.c
@@ -57,23 +57,22 @@ static int ioapic_dispatch_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static int ioapic_init_common(SysBusDevice *dev)
+static void ioapic_common_realize(DeviceState *dev, Error **errp)
 {
     IOAPICCommonState *s = IOAPIC_COMMON(dev);
     IOAPICCommonClass *info;
     static int ioapic_no;
 
     if (ioapic_no >= MAX_IOAPICS) {
-        return -1;
+        error_setg(errp, "Only %d ioapics allowed", MAX_IOAPICS);
+        return;
     }
 
     info = IOAPIC_COMMON_GET_CLASS(s);
     info->init(s, ioapic_no);
 
-    sysbus_init_mmio(&s->busdev, &s->io_memory);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->io_memory);
     ioapic_no++;
-
-    return 0;
 }
 
 static const VMStateDescription vmstate_ioapic_common = {
@@ -95,10 +94,9 @@ static const VMStateDescription vmstate_ioapic_common = {
 
 static void ioapic_common_class_init(ObjectClass *klass, void *data)
 {
-    SysBusDeviceClass *sc = SYS_BUS_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    sc->init = ioapic_init_common;
+    dc->realize = ioapic_common_realize;
     dc->vmsd = &vmstate_ioapic_common;
     dc->no_user = 1;
 }
commit c118d44b6a6977e4019fe1da82f5c333dbbedcfa
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:40 2013 +0800

    kvmvapic: Use QOM realize
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed variable]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index ccd089a..365b219 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -703,19 +703,18 @@ static const MemoryRegionOps vapic_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int vapic_init(SysBusDevice *dev)
+static void vapic_realize(DeviceState *dev, Error **errp)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     VAPICROMState *s = VAPIC(dev);
 
     memory_region_init_io(&s->io, OBJECT(s), &vapic_ops, s, "kvmvapic", 2);
-    sysbus_add_io(dev, VAPIC_IO_PORT, &s->io);
-    sysbus_init_ioports(dev, VAPIC_IO_PORT, 2);
+    sysbus_add_io(sbd, VAPIC_IO_PORT, &s->io);
+    sysbus_init_ioports(sbd, VAPIC_IO_PORT, 2);
 
     option_rom[nb_option_roms].name = "kvmvapic.bin";
     option_rom[nb_option_roms].bootindex = -1;
     nb_option_roms++;
-
-    return 0;
 }
 
 static void do_vapic_enable(void *data)
@@ -812,13 +811,12 @@ static const VMStateDescription vmstate_vapic = {
 
 static void vapic_class_init(ObjectClass *klass, void *data)
 {
-    SysBusDeviceClass *sc = SYS_BUS_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->no_user = 1;
     dc->reset   = vapic_reset;
     dc->vmsd    = &vmstate_vapic;
-    sc->init    = vapic_init;
+    dc->realize = vapic_realize;
 }
 
 static const TypeInfo vapic_type = {
commit 913bc63844395f07e317dbc1a5b38612cc75ebec
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:39 2013 +0800

    kvm/clock: Use QOM realize for kvmclock
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
index 6265458..e89e2f7 100644
--- a/hw/i386/kvm/clock.c
+++ b/hw/i386/kvm/clock.c
@@ -91,12 +91,11 @@ static void kvmclock_vm_state_change(void *opaque, int running,
     }
 }
 
-static int kvmclock_init(SysBusDevice *dev)
+static void kvmclock_realize(DeviceState *dev, Error **errp)
 {
     KVMClockState *s = KVM_CLOCK(dev);
 
     qemu_add_vm_change_state_handler(kvmclock_vm_state_change, s);
-    return 0;
 }
 
 static const VMStateDescription kvmclock_vmsd = {
@@ -113,9 +112,8 @@ static const VMStateDescription kvmclock_vmsd = {
 static void kvmclock_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = kvmclock_init;
+    dc->realize = kvmclock_realize;
     dc->no_user = 1;
     dc->vmsd = &kvmclock_vmsd;
 }
commit 726887ef44d5a822cd76e4fedd269b038869b698
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:37 2013 +0800

    hpet: Use QOM realize for hpet
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Avoided SYS_BUS_DEVICE() in loop]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 228598f..648b383 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -686,8 +686,19 @@ static void hpet_handle_legacy_irq(void *opaque, int n, int level)
     }
 }
 
-static int hpet_init(SysBusDevice *dev)
+static void hpet_init(Object *obj)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    HPETState *s = HPET(obj);
+
+    /* HPET Area */
+    memory_region_init_io(&s->iomem, obj, &hpet_ram_ops, s, "hpet", 0x400);
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static void hpet_realize(DeviceState *dev, Error **errp)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     HPETState *s = HPET(dev);
     int i;
     HPETTimer *timer;
@@ -698,14 +709,14 @@ static int hpet_init(SysBusDevice *dev)
     }
 
     if (hpet_cfg.count == 8) {
-        fprintf(stderr, "Only 8 instances of HPET is allowed\n");
-        return -1;
+        error_setg(errp, "Only 8 instances of HPET is allowed");
+        return;
     }
 
     s->hpet_id = hpet_cfg.count++;
 
     for (i = 0; i < HPET_NUM_IRQ_ROUTES; i++) {
-        sysbus_init_irq(dev, &s->irqs[i]);
+        sysbus_init_irq(sbd, &s->irqs[i]);
     }
 
     if (s->num_timers < HPET_MIN_TIMERS) {
@@ -725,13 +736,8 @@ static int hpet_init(SysBusDevice *dev)
     s->capability |= (s->num_timers - 1) << HPET_ID_NUM_TIM_SHIFT;
     s->capability |= ((HPET_CLK_PERIOD) << 32);
 
-    qdev_init_gpio_in(&dev->qdev, hpet_handle_legacy_irq, 2);
-    qdev_init_gpio_out(&dev->qdev, &s->pit_enabled, 1);
-
-    /* HPET Area */
-    memory_region_init_io(&s->iomem, OBJECT(s), &hpet_ram_ops, s, "hpet", 0x400);
-    sysbus_init_mmio(dev, &s->iomem);
-    return 0;
+    qdev_init_gpio_in(dev, hpet_handle_legacy_irq, 2);
+    qdev_init_gpio_out(dev, &s->pit_enabled, 1);
 }
 
 static Property hpet_device_properties[] = {
@@ -743,9 +749,8 @@ static Property hpet_device_properties[] = {
 static void hpet_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = hpet_init;
+    dc->realize = hpet_realize;
     dc->no_user = 1;
     dc->reset = hpet_reset;
     dc->vmsd = &vmstate_hpet;
@@ -756,6 +761,7 @@ static const TypeInfo hpet_device_info = {
     .name          = TYPE_HPET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(HPETState),
+    .instance_init = hpet_init,
     .class_init    = hpet_device_class_init,
 };
 
commit caad4eb345dc5119d326b8af08452cc0f90f8548
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 21 12:16:34 2013 +0200

    scsi: Improve error propagation for scsi_bus_legacy_handle_cmdline()
    
    Let scsi_bus_legacy_add_drive() and scsi_bus_legacy_handle_cmdline()
    return an Error**. Prepare qdev initfns for QOM realize error model.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index 8077289..619fe47 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -127,7 +127,7 @@ static int scsi_hot_add(Monitor *mon, DeviceState *adapter,
     dinfo->unit = qemu_opt_get_number(dinfo->opts, "unit", -1);
     dinfo->bus = scsibus->busnr;
     scsidev = scsi_bus_legacy_add_drive(scsibus, dinfo->bdrv, dinfo->unit,
-                                        false, -1, NULL);
+                                        false, -1, NULL, NULL);
     if (!scsidev) {
         return -1;
     }
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 6cdfd53..2ac21d4 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -346,6 +346,7 @@ static int esp_pci_scsi_init(PCIDevice *dev)
     DeviceState *d = DEVICE(dev);
     ESPState *s = &pci->esp;
     uint8_t *pci_conf;
+    Error *err = NULL;
 
     pci_conf = dev->config;
 
@@ -364,7 +365,11 @@ static int esp_pci_scsi_init(PCIDevice *dev)
 
     scsi_bus_new(&s->bus, d, &esp_pci_scsi_info, NULL);
     if (!d->hotplugged) {
-        return scsi_bus_legacy_handle_cmdline(&s->bus);
+        scsi_bus_legacy_handle_cmdline(&s->bus, &err);
+        if (err != NULL) {
+            error_free(err);
+            return -1;
+        }
     }
     return 0;
 }
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index c24b632..94639b8 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -676,6 +676,7 @@ static void sysbus_esp_realize(DeviceState *dev, Error **errp)
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     SysBusESPState *sysbus = ESP(dev);
     ESPState *s = &sysbus->esp;
+    Error *err = NULL;
 
     sysbus_init_irq(sbd, &s->irq);
     assert(sysbus->it_shift != -1);
@@ -688,8 +689,9 @@ static void sysbus_esp_realize(DeviceState *dev, Error **errp)
     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
 
     scsi_bus_new(&s->bus, dev, &esp_scsi_info, NULL);
-    if (scsi_bus_legacy_handle_cmdline(&s->bus) < 0) {
-        error_setg(errp, "Handling legacy SCSI command line failed");
+    scsi_bus_legacy_handle_cmdline(&s->bus, &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
         return;
     }
 }
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index e11224f..776e31a 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2096,6 +2096,7 @@ static int lsi_scsi_init(PCIDevice *dev)
     LSIState *s = LSI53C895A(dev);
     DeviceState *d = DEVICE(dev);
     uint8_t *pci_conf;
+    Error *err = NULL;
 
     pci_conf = dev->config;
 
@@ -2118,7 +2119,11 @@ static int lsi_scsi_init(PCIDevice *dev)
 
     scsi_bus_new(&s->bus, d, &lsi_scsi_info, NULL);
     if (!d->hotplugged) {
-        return scsi_bus_legacy_handle_cmdline(&s->bus);
+        scsi_bus_legacy_handle_cmdline(&s->bus, &err);
+        if (err != NULL) {
+            error_free(err);
+            return -1;
+        }
     }
     return 0;
 }
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 2ae4346..eb52164 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2102,6 +2102,7 @@ static int megasas_scsi_init(PCIDevice *dev)
     MegasasState *s = MEGASAS(dev);
     uint8_t *pci_conf;
     int i, bar_type;
+    Error *err = NULL;
 
     pci_conf = dev->config;
 
@@ -2172,7 +2173,11 @@ static int megasas_scsi_init(PCIDevice *dev)
 
     scsi_bus_new(&s->bus, DEVICE(dev), &megasas_scsi_info, NULL);
     if (!d->hotplugged) {
-        return scsi_bus_legacy_handle_cmdline(&s->bus);
+        scsi_bus_legacy_handle_cmdline(&s->bus, &err);
+        if (err != NULL) {
+            error_free(err);
+            return -1;
+        }
     }
     return 0;
 }
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index a92b7c1..b5a863a 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -209,10 +209,11 @@ static int scsi_qdev_exit(DeviceState *qdev)
 /* handle legacy '-drive if=scsi,...' cmd line args */
 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
                                       int unit, bool removable, int bootindex,
-                                      const char *serial)
+                                      const char *serial, Error **errp)
 {
     const char *driver;
     DeviceState *dev;
+    Error *err = NULL;
 
     driver = bdrv_is_sg(bdrv) ? "scsi-generic" : "scsi-disk";
     dev = qdev_create(&bus->qbus, driver);
@@ -227,19 +228,25 @@ SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
         qdev_prop_set_string(dev, "serial", serial);
     }
     if (qdev_prop_set_drive(dev, "drive", bdrv) < 0) {
+        error_setg(errp, "Setting drive property failed");
         qdev_free(dev);
         return NULL;
     }
-    if (qdev_init(dev) < 0)
+    object_property_set_bool(OBJECT(dev), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        qdev_free(dev);
         return NULL;
+    }
     return SCSI_DEVICE(dev);
 }
 
-int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
+void scsi_bus_legacy_handle_cmdline(SCSIBus *bus, Error **errp)
 {
     Location loc;
     DriveInfo *dinfo;
-    int res = 0, unit;
+    int unit;
+    Error *err = NULL;
 
     loc_push_none(&loc);
     for (unit = 0; unit <= bus->info->max_target; unit++) {
@@ -248,13 +255,14 @@ int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
             continue;
         }
         qemu_opts_loc_restore(dinfo->opts);
-        if (!scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false, -1, NULL)) {
-            res = -1;
+        scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false, -1, NULL,
+                                  &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
             break;
         }
     }
     loc_pop(&loc);
-    return res;
 }
 
 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf)
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index e8978bf..55b44b9 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -912,12 +912,17 @@ static void spapr_vscsi_reset(VIOsPAPRDevice *dev)
 static int spapr_vscsi_init(VIOsPAPRDevice *dev)
 {
     VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(dev);
+    Error *err = NULL;
 
     dev->crq.SendFunc = vscsi_do_crq;
 
     scsi_bus_new(&s->bus, &dev->qdev, &vscsi_scsi_info, NULL);
     if (!dev->qdev.hotplugged) {
-        scsi_bus_legacy_handle_cmdline(&s->bus);
+        scsi_bus_legacy_handle_cmdline(&s->bus, &err);
+        if (err != NULL) {
+            error_free(err);
+            return -1;
+        }
     }
 
     return 0;
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 712f0ad..42cb73b 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -619,6 +619,7 @@ static int virtio_scsi_device_init(VirtIODevice *vdev)
     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
     static int virtio_scsi_id;
+    Error *err = NULL;
     int ret;
 
     ret = virtio_scsi_common_init(vs);
@@ -629,7 +630,11 @@ static int virtio_scsi_device_init(VirtIODevice *vdev)
     scsi_bus_new(&s->bus, qdev, &virtio_scsi_scsi_info, vdev->bus_name);
 
     if (!qdev->hotplugged) {
-        scsi_bus_legacy_handle_cmdline(&s->bus);
+        scsi_bus_legacy_handle_cmdline(&s->bus, &err);
+        if (err != NULL) {
+            error_free(err);
+            return -1;
+        }
     }
 
     register_savevm(qdev, "virtio-scsi", virtio_scsi_id++, 1,
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index fe914ab..1954811 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -595,6 +595,7 @@ static int usb_msd_initfn_storage(USBDevice *dev)
     MSDState *s = DO_UPCAST(MSDState, dev, dev);
     BlockDriverState *bs = s->conf.bs;
     SCSIDevice *scsi_dev;
+    Error *err = NULL;
 
     if (!bs) {
         error_report("drive property not set");
@@ -619,7 +620,8 @@ static int usb_msd_initfn_storage(USBDevice *dev)
     usb_desc_init(dev);
     scsi_bus_new(&s->bus, &s->dev.qdev, &usb_msd_scsi_info_storage, NULL);
     scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0, !!s->removable,
-                                            s->conf.bootindex, dev->serial);
+                                         s->conf.bootindex, dev->serial,
+                                         &err);
     if (!scsi_dev) {
         return -1;
     }
diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
index 9786e00..8786531 100644
--- a/include/hw/scsi/scsi.h
+++ b/include/hw/scsi/scsi.h
@@ -162,8 +162,8 @@ static inline SCSIBus *scsi_bus_from_device(SCSIDevice *d)
 
 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
                                       int unit, bool removable, int bootindex,
-                                      const char *serial);
-int scsi_bus_legacy_handle_cmdline(SCSIBus *bus);
+                                      const char *serial, Error **errp);
+void scsi_bus_legacy_handle_cmdline(SCSIBus *bus, Error **errp);
 
 /*
  * Predefined sense codes
commit 22d6aa03fd87ba5f219d26bc1810646d0f95842a
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jul 21 12:20:15 2013 +0200

    megasas: Legacy command line handling fix
    
    Only apply legacy command line handling when the device has not been
    hot-plugged. Propagate failure of legacy command line handling.
    
    Cc: qemu-stable at nongnu.org
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 55d5b73..2ae4346 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2098,6 +2098,7 @@ static const struct SCSIBusInfo megasas_scsi_info = {
 
 static int megasas_scsi_init(PCIDevice *dev)
 {
+    DeviceState *d = DEVICE(dev);
     MegasasState *s = MEGASAS(dev);
     uint8_t *pci_conf;
     int i, bar_type;
@@ -2170,7 +2171,9 @@ static int megasas_scsi_init(PCIDevice *dev)
     }
 
     scsi_bus_new(&s->bus, DEVICE(dev), &megasas_scsi_info, NULL);
-    scsi_bus_legacy_handle_cmdline(&s->bus);
+    if (!d->hotplugged) {
+        return scsi_bus_legacy_handle_cmdline(&s->bus);
+    }
     return 0;
 }
 
commit b09318cac65df015b9b0990791f02b894cc57d33
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:35 2013 +0800

    scsi/esp: Use QOM realize for scsi esp
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Drop sysbus_esp_init()]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 1a2d72c..c24b632 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -671,23 +671,27 @@ static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
     }
 }
 
-static int sysbus_esp_init(SysBusDevice *dev)
+static void sysbus_esp_realize(DeviceState *dev, Error **errp)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     SysBusESPState *sysbus = ESP(dev);
     ESPState *s = &sysbus->esp;
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     assert(sysbus->it_shift != -1);
 
     s->chip_id = TCHI_FAS100A;
     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
                           sysbus, "esp", ESP_REGS << sysbus->it_shift);
-    sysbus_init_mmio(dev, &sysbus->iomem);
+    sysbus_init_mmio(sbd, &sysbus->iomem);
 
-    qdev_init_gpio_in(&dev->qdev, sysbus_esp_gpio_demux, 2);
+    qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
 
-    scsi_bus_new(&s->bus, &dev->qdev, &esp_scsi_info, NULL);
-    return scsi_bus_legacy_handle_cmdline(&s->bus);
+    scsi_bus_new(&s->bus, dev, &esp_scsi_info, NULL);
+    if (scsi_bus_legacy_handle_cmdline(&s->bus) < 0) {
+        error_setg(errp, "Handling legacy SCSI command line failed");
+        return;
+    }
 }
 
 static void sysbus_esp_hard_reset(DeviceState *dev)
@@ -710,9 +714,8 @@ static const VMStateDescription vmstate_sysbus_esp_scsi = {
 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = sysbus_esp_init;
+    dc->realize = sysbus_esp_realize;
     dc->reset = sysbus_esp_hard_reset;
     dc->vmsd = &vmstate_sysbus_esp_scsi;
 }
commit 563839557c05f6f946bedebc381406b146af61f6
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:33 2013 +0800

    fw_cfg: Use QOM realize for fw_cfg
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Moved sysbus_init_mmio() to instance_init, renamed variable]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index 8e39111..0a35015 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -526,31 +526,38 @@ FWCfgState *fw_cfg_init(uint32_t ctl_port, uint32_t data_port,
     return s;
 }
 
-static int fw_cfg_init1(SysBusDevice *dev)
+static void fw_cfg_initfn(Object *obj)
 {
-    FWCfgState *s = FW_CFG(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    FWCfgState *s = FW_CFG(obj);
 
     memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops, s,
                           "fwcfg.ctl", FW_CFG_SIZE);
-    sysbus_init_mmio(dev, &s->ctl_iomem);
+    sysbus_init_mmio(sbd, &s->ctl_iomem);
     memory_region_init_io(&s->data_iomem, OBJECT(s), &fw_cfg_data_mem_ops, s,
                           "fwcfg.data", FW_CFG_DATA_SIZE);
-    sysbus_init_mmio(dev, &s->data_iomem);
+    sysbus_init_mmio(sbd, &s->data_iomem);
     /* In case ctl and data overlap: */
     memory_region_init_io(&s->comb_iomem, OBJECT(s), &fw_cfg_comb_mem_ops, s,
                           "fwcfg", FW_CFG_SIZE);
+}
+
+static void fw_cfg_realize(DeviceState *dev, Error **errp)
+{
+    FWCfgState *s = FW_CFG(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
 
     if (s->ctl_iobase + 1 == s->data_iobase) {
-        sysbus_add_io(dev, s->ctl_iobase, &s->comb_iomem);
+        sysbus_add_io(sbd, s->ctl_iobase, &s->comb_iomem);
     } else {
         if (s->ctl_iobase) {
-            sysbus_add_io(dev, s->ctl_iobase, &s->ctl_iomem);
+            sysbus_add_io(sbd, s->ctl_iobase, &s->ctl_iomem);
         }
         if (s->data_iobase) {
-            sysbus_add_io(dev, s->data_iobase, &s->data_iomem);
+            sysbus_add_io(sbd, s->data_iobase, &s->data_iomem);
         }
     }
-    return 0;
 }
 
 static Property fw_cfg_properties[] = {
@@ -567,9 +574,8 @@ FWCfgState *fw_cfg_find(void)
 static void fw_cfg_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = fw_cfg_init1;
+    dc->realize = fw_cfg_realize;
     dc->no_user = 1;
     dc->reset = fw_cfg_reset;
     dc->vmsd = &vmstate_fw_cfg;
@@ -580,6 +586,7 @@ static const TypeInfo fw_cfg_info = {
     .name          = TYPE_FW_CFG,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(FWCfgState),
+    .instance_init = fw_cfg_initfn,
     .class_init    = fw_cfg_class_init,
 };
 
commit 7acb423fcfd8fbf75f672de70ab945a24cc31ef5
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:31 2013 +0800

    ahci: Use QOM realize for ahci
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Avoided repeated SYS_BUS_DEVICE() casts]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index d76e6eb..419adde 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1314,14 +1314,15 @@ static void sysbus_ahci_reset(DeviceState *dev)
     ahci_reset(&s->ahci);
 }
 
-static int sysbus_ahci_init(SysBusDevice *dev)
+static void sysbus_ahci_realize(DeviceState *dev, Error **errp)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     SysbusAHCIState *s = SYSBUS_AHCI(dev);
-    ahci_init(&s->ahci, DEVICE(dev), NULL, s->num_ports);
 
-    sysbus_init_mmio(dev, &s->ahci.mem);
-    sysbus_init_irq(dev, &s->ahci.irq);
-    return 0;
+    ahci_init(&s->ahci, dev, NULL, s->num_ports);
+
+    sysbus_init_mmio(sbd, &s->ahci.mem);
+    sysbus_init_irq(sbd, &s->ahci.irq);
 }
 
 static Property sysbus_ahci_properties[] = {
@@ -1331,10 +1332,9 @@ static Property sysbus_ahci_properties[] = {
 
 static void sysbus_ahci_class_init(ObjectClass *klass, void *data)
 {
-    SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    sbc->init = sysbus_ahci_init;
+    dc->realize = sysbus_ahci_realize;
     dc->vmsd = &vmstate_sysbus_ahci;
     dc->props = sysbus_ahci_properties;
     dc->reset = sysbus_ahci_reset;
commit da3bd64234dc6c77091a0fb8a2612668dbaffd37
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:29 2013 +0800

    pflash_cfi02: Use QOM realize for pflash_cfi02
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index d8381dd..9fc02e3 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -592,7 +592,7 @@ static const MemoryRegionOps pflash_cfi02_ops_le = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pflash_cfi02_init(SysBusDevice *dev)
+static void pflash_cfi02_realize(DeviceState *dev, Error **errp)
 {
     pflash_t *pfl = CFI_PFLASH02(dev);
     uint32_t chip_len;
@@ -616,14 +616,16 @@ static int pflash_cfi02_init(SysBusDevice *dev)
         /* read the initial flash content */
         ret = bdrv_read(pfl->bs, 0, pfl->storage, chip_len >> 9);
         if (ret < 0) {
-            g_free(pfl);
-            return 1;
+            vmstate_unregister_ram(&pfl->orig_mem, DEVICE(pfl));
+            memory_region_destroy(&pfl->orig_mem);
+            error_setg(errp, "failed to read the initial flash content");
+            return;
         }
     }
 
     pflash_setup_mappings(pfl);
     pfl->rom_mode = 1;
-    sysbus_init_mmio(dev, &pfl->mem);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
 
     if (pfl->bs) {
         pfl->ro = bdrv_is_read_only(pfl->bs);
@@ -712,8 +714,6 @@ static int pflash_cfi02_init(SysBusDevice *dev)
 
     pfl->cfi_table[0x3b] = 0x00;
     pfl->cfi_table[0x3c] = 0x00;
-
-    return 0;
 }
 
 static Property pflash_cfi02_properties[] = {
@@ -736,9 +736,8 @@ static Property pflash_cfi02_properties[] = {
 static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pflash_cfi02_init;
+    dc->realize = pflash_cfi02_realize;
     dc->props = pflash_cfi02_properties;
 }
 
commit e40b5f3e0efe49ec138ea5e3710f6dd6527e5f49
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:27 2013 +0800

    pflash_cfi01: Use QOM realize for pflash_cfi01
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed argument]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index bfcccdd..2bcd731 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -569,7 +569,7 @@ static const MemoryRegionOps pflash_cfi01_ops_le = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pflash_cfi01_init(SysBusDevice *dev)
+static void pflash_cfi01_realize(DeviceState *dev, Error **errp)
 {
     pflash_t *pfl = CFI_PFLASH01(dev);
     uint64_t total_len;
@@ -590,7 +590,7 @@ static int pflash_cfi01_init(SysBusDevice *dev)
         pfl->name, total_len);
     vmstate_register_ram(&pfl->mem, DEVICE(pfl));
     pfl->storage = memory_region_get_ram_ptr(&pfl->mem);
-    sysbus_init_mmio(dev, &pfl->mem);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &pfl->mem);
 
     if (pfl->bs) {
         /* read the initial flash content */
@@ -599,7 +599,8 @@ static int pflash_cfi01_init(SysBusDevice *dev)
         if (ret < 0) {
             vmstate_unregister_ram(&pfl->mem, DEVICE(pfl));
             memory_region_destroy(&pfl->mem);
-            return 1;
+            error_setg(errp, "failed to read the initial flash content");
+            return;
         }
     }
 
@@ -696,8 +697,6 @@ static int pflash_cfi01_init(SysBusDevice *dev)
     pfl->cfi_table[0x3c] = 0x00;
 
     pfl->cfi_table[0x3f] = 0x01; /* Number of protection fields */
-
-    return 0;
 }
 
 static Property pflash_cfi01_properties[] = {
@@ -717,9 +716,8 @@ static Property pflash_cfi01_properties[] = {
 static void pflash_cfi01_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pflash_cfi01_init;
+    dc->realize = pflash_cfi01_realize;
     dc->props = pflash_cfi01_properties;
     dc->vmsd = &vmstate_pflash;
 }
commit a3ef7a61e3706ba81e31a8092b966d6aeae5333e
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 17 14:14:41 2013 +0200

    fdc: Improve error propagation for QOM realize
    
    Rename fdctrl_init_common() to fdctrl_realize_common() and let
    fdctrl_connect_drives() propagate an Error through it.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 9a983fb..d32f6ba 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -1997,7 +1997,7 @@ static const BlockDevOps fdctrl_block_ops = {
 };
 
 /* Init functions */
-static int fdctrl_connect_drives(FDCtrl *fdctrl)
+static void fdctrl_connect_drives(FDCtrl *fdctrl, Error **errp)
 {
     unsigned int i;
     FDrive *drive;
@@ -2008,12 +2008,12 @@ static int fdctrl_connect_drives(FDCtrl *fdctrl)
 
         if (drive->bs) {
             if (bdrv_get_on_error(drive->bs, 0) != BLOCKDEV_ON_ERROR_ENOSPC) {
-                error_report("fdc doesn't support drive option werror");
-                return -1;
+                error_setg(errp, "fdc doesn't support drive option werror");
+                return;
             }
             if (bdrv_get_on_error(drive->bs, 1) != BLOCKDEV_ON_ERROR_REPORT) {
-                error_report("fdc doesn't support drive option rerror");
-                return -1;
+                error_setg(errp, "fdc doesn't support drive option rerror");
+                return;
             }
         }
 
@@ -2023,7 +2023,6 @@ static int fdctrl_connect_drives(FDCtrl *fdctrl)
             bdrv_set_dev_ops(drive->bs, &fdctrl_block_ops, drive);
         }
     }
-    return 0;
 }
 
 ISADevice *fdctrl_init_isa(ISABus *bus, DriveInfo **fds)
@@ -2089,7 +2088,7 @@ void sun4m_fdctrl_init(qemu_irq irq, hwaddr io_base,
     *fdc_tc = qdev_get_gpio_in(dev, 0);
 }
 
-static int fdctrl_init_common(FDCtrl *fdctrl)
+static void fdctrl_realize_common(FDCtrl *fdctrl, Error **errp)
 {
     int i, j;
     static int command_tables_inited = 0;
@@ -2110,15 +2109,16 @@ static int fdctrl_init_common(FDCtrl *fdctrl)
     fdctrl->fifo = qemu_memalign(512, FD_SECTOR_LEN);
     fdctrl->fifo_size = 512;
     fdctrl->result_timer = qemu_new_timer_ns(vm_clock,
-                                          fdctrl_result_timer, fdctrl);
+                                             fdctrl_result_timer, fdctrl);
 
     fdctrl->version = 0x90; /* Intel 82078 controller */
     fdctrl->config = FD_CONFIG_EIS | FD_CONFIG_EFIFO; /* Implicit seek, polling & FIFO enabled */
     fdctrl->num_floppies = MAX_FD;
 
-    if (fdctrl->dma_chann != -1)
+    if (fdctrl->dma_chann != -1) {
         DMA_register_channel(fdctrl->dma_chann, &fdctrl_transfer_handler, fdctrl);
-    return fdctrl_connect_drives(fdctrl);
+    }
+    fdctrl_connect_drives(fdctrl, errp);
 }
 
 static const MemoryRegionPortio fdc_portio_list[] = {
@@ -2132,7 +2132,7 @@ static void isabus_fdc_realize(DeviceState *dev, Error **errp)
     ISADevice *isadev = ISA_DEVICE(dev);
     FDCtrlISABus *isa = ISA_FDC(dev);
     FDCtrl *fdctrl = &isa->state;
-    int ret;
+    Error *err = NULL;
 
     isa_register_portio_list(isadev, isa->iobase, fdc_portio_list, fdctrl,
                              "fdc");
@@ -2141,9 +2141,9 @@ static void isabus_fdc_realize(DeviceState *dev, Error **errp)
     fdctrl->dma_chann = isa->dma;
 
     qdev_set_legacy_instance_id(dev, isa->iobase, 2);
-    ret = fdctrl_init_common(fdctrl);
-    if (ret < 0) {
-        error_setg(errp, "Floppy init failed.");
+    fdctrl_realize_common(fdctrl, &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
         return;
     }
 
@@ -2165,6 +2165,7 @@ static void sysbus_fdc_realize(DeviceState *dev, Error **errp)
     FDCtrlSysBus *sys = SYSBUS_FDC(dev);
     FDCtrl *fdctrl = &sys->state;
     SysBusDevice *b = SYS_BUS_DEVICE(dev);
+    Error *err = NULL;
 
     sysbus_init_mmio(b, &fdctrl->iomem);
     sysbus_init_irq(b, &fdctrl->irq);
@@ -2172,8 +2173,9 @@ static void sysbus_fdc_realize(DeviceState *dev, Error **errp)
     fdctrl->dma_chann = -1;
 
     qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    if (fdctrl_init_common(fdctrl) < 0) {
-        error_setg(errp, "Floppy init failed.");
+    fdctrl_realize_common(fdctrl, &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
         return;
     }
 }
@@ -2192,6 +2194,7 @@ static void sun4m_fdc_realize(DeviceState *dev, Error **errp)
     FDCtrlSysBus *sys = SYSBUS_FDC(dev);
     FDCtrl *fdctrl = &sys->state;
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    Error *err = NULL;
 
     sysbus_init_mmio(sbd, &fdctrl->iomem);
     sysbus_init_irq(sbd, &fdctrl->irq);
@@ -2199,8 +2202,9 @@ static void sun4m_fdc_realize(DeviceState *dev, Error **errp)
 
     fdctrl->sun4m = 1;
     qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    if (fdctrl_init_common(fdctrl) < 0) {
-        error_setg(errp, "Floppy init failed.");
+    fdctrl_realize_common(fdctrl, &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
         return;
     }
 }
commit 940194c2369e50d91d1abf6f36d43853eea5e539
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:25 2013 +0800

    fdc: Use QOM realize for fdc
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed SysBusDevice variable]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index e5242bf..9a983fb 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -2151,39 +2151,58 @@ static void isabus_fdc_realize(DeviceState *dev, Error **errp)
     add_boot_device_path(isa->bootindexB, dev, "/floppy at 1");
 }
 
-static int sysbus_fdc_init1(SysBusDevice *dev)
+static void sysbus_fdc_initfn(Object *obj)
 {
-    FDCtrlSysBus *sys = SYSBUS_FDC(dev);
+    FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
-    int ret;
 
-    memory_region_init_io(&fdctrl->iomem, OBJECT(sys), &fdctrl_mem_ops, fdctrl,
+    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_ops, fdctrl,
                           "fdc", 0x08);
-    sysbus_init_mmio(dev, &fdctrl->iomem);
-    sysbus_init_irq(dev, &fdctrl->irq);
-    qdev_init_gpio_in(DEVICE(dev), fdctrl_handle_tc, 1);
+}
+
+static void sysbus_fdc_realize(DeviceState *dev, Error **errp)
+{
+    FDCtrlSysBus *sys = SYSBUS_FDC(dev);
+    FDCtrl *fdctrl = &sys->state;
+    SysBusDevice *b = SYS_BUS_DEVICE(dev);
+
+    sysbus_init_mmio(b, &fdctrl->iomem);
+    sysbus_init_irq(b, &fdctrl->irq);
+    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
     fdctrl->dma_chann = -1;
 
-    qdev_set_legacy_instance_id(DEVICE(dev), 0 /* io */, 2); /* FIXME */
-    ret = fdctrl_init_common(fdctrl);
+    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
+    if (fdctrl_init_common(fdctrl) < 0) {
+        error_setg(errp, "Floppy init failed.");
+        return;
+    }
+}
 
-    return ret;
+static void sun4m_fdc_initfn(Object *obj)
+{
+    FDCtrlSysBus *sys = SYSBUS_FDC(obj);
+    FDCtrl *fdctrl = &sys->state;
+
+    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_strict_ops,
+                          fdctrl, "fdctrl", 0x08);
 }
 
-static int sun4m_fdc_init1(SysBusDevice *dev)
+static void sun4m_fdc_realize(DeviceState *dev, Error **errp)
 {
     FDCtrlSysBus *sys = SYSBUS_FDC(dev);
     FDCtrl *fdctrl = &sys->state;
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    memory_region_init_io(&fdctrl->iomem, OBJECT(dev), &fdctrl_mem_strict_ops,
-                          fdctrl, "fdctrl", 0x08);
-    sysbus_init_mmio(dev, &fdctrl->iomem);
-    sysbus_init_irq(dev, &fdctrl->irq);
-    qdev_init_gpio_in(DEVICE(dev), fdctrl_handle_tc, 1);
+    sysbus_init_mmio(sbd, &fdctrl->iomem);
+    sysbus_init_irq(sbd, &fdctrl->irq);
+    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
 
     fdctrl->sun4m = 1;
-    qdev_set_legacy_instance_id(DEVICE(dev), 0 /* io */, 2); /* FIXME */
-    return fdctrl_init_common(fdctrl);
+    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
+    if (fdctrl_init_common(fdctrl) < 0) {
+        error_setg(errp, "Floppy init failed.");
+        return;
+    }
 }
 
 FDriveType isa_fdc_get_drive_type(ISADevice *fdc, int i)
@@ -2254,9 +2273,8 @@ static Property sysbus_fdc_properties[] = {
 static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = sysbus_fdc_init1;
+    dc->realize = sysbus_fdc_realize;
     dc->reset = fdctrl_external_reset_sysbus;
     dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sysbus_fdc_properties;
@@ -2266,6 +2284,7 @@ static const TypeInfo sysbus_fdc_info = {
     .name          = TYPE_SYSBUS_FDC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(FDCtrlSysBus),
+    .instance_init = sysbus_fdc_initfn,
     .class_init    = sysbus_fdc_class_init,
 };
 
@@ -2277,9 +2296,8 @@ static Property sun4m_fdc_properties[] = {
 static void sun4m_fdc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = sun4m_fdc_init1;
+    dc->realize = sun4m_fdc_realize;
     dc->reset = fdctrl_external_reset_sysbus;
     dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sun4m_fdc_properties;
@@ -2289,6 +2307,7 @@ static const TypeInfo sun4m_fdc_info = {
     .name          = "SUNW,fdtwo",
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(FDCtrlSysBus),
+    .instance_init = sun4m_fdc_initfn,
     .class_init    = sun4m_fdc_class_init,
 };
 
commit 98bdc0d7ff93f2ab39c0634c744cc7f4a8ac7399
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:38 2013 +0800

    kvm/clock: QOM'ify some more
    
    Introduce type constant and avoid FROM_SYSBUS().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
index 1022d67..6265458 100644
--- a/hw/i386/kvm/clock.c
+++ b/hw/i386/kvm/clock.c
@@ -22,8 +22,14 @@
 #include <linux/kvm.h>
 #include <linux/kvm_para.h>
 
+#define TYPE_KVM_CLOCK "kvmclock"
+#define KVM_CLOCK(obj) OBJECT_CHECK(KVMClockState, (obj), TYPE_KVM_CLOCK)
+
 typedef struct KVMClockState {
+    /*< private >*/
     SysBusDevice busdev;
+    /*< public >*/
+
     uint64_t clock;
     bool clock_valid;
 } KVMClockState;
@@ -87,7 +93,7 @@ static void kvmclock_vm_state_change(void *opaque, int running,
 
 static int kvmclock_init(SysBusDevice *dev)
 {
-    KVMClockState *s = FROM_SYSBUS(KVMClockState, dev);
+    KVMClockState *s = KVM_CLOCK(dev);
 
     qemu_add_vm_change_state_handler(kvmclock_vm_state_change, s);
     return 0;
@@ -115,7 +121,7 @@ static void kvmclock_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo kvmclock_info = {
-    .name          = "kvmclock",
+    .name          = TYPE_KVM_CLOCK,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(KVMClockState),
     .class_init    = kvmclock_class_init,
@@ -129,7 +135,7 @@ void kvmclock_create(void)
     if (kvm_enabled() &&
         cpu->env.features[FEAT_KVM] & ((1ULL << KVM_FEATURE_CLOCKSOURCE) |
                                        (1ULL << KVM_FEATURE_CLOCKSOURCE2))) {
-        sysbus_create_simple("kvmclock", -1, NULL);
+        sysbus_create_simple(TYPE_KVM_CLOCK, -1, NULL);
     }
 }
 
commit 02f9a6f5da74251e1e5685ae57643d45c3fb6c30
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:36 2013 +0800

    hpet: QOM'ify some more
    
    Introduce type constant, avoid FROM_SYSBUS().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field and renamed variable]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 90bd584..228598f 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -42,6 +42,9 @@
 
 #define HPET_MSI_SUPPORT        0
 
+#define TYPE_HPET "hpet"
+#define HPET(obj) OBJECT_CHECK(HPETState, (obj), TYPE_HPET)
+
 struct HPETState;
 typedef struct HPETTimer {  /* timers */
     uint8_t tn;             /*timer number*/
@@ -59,7 +62,10 @@ typedef struct HPETTimer {  /* timers */
 } HPETTimer;
 
 typedef struct HPETState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint64_t hpet_offset;
     qemu_irq irqs[HPET_NUM_IRQ_ROUTES];
@@ -634,7 +640,8 @@ static const MemoryRegionOps hpet_ram_ops = {
 
 static void hpet_reset(DeviceState *d)
 {
-    HPETState *s = FROM_SYSBUS(HPETState, SYS_BUS_DEVICE(d));
+    HPETState *s = HPET(d);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(d);
     int i;
 
     for (i = 0; i < s->num_timers; i++) {
@@ -657,7 +664,7 @@ static void hpet_reset(DeviceState *d)
     s->hpet_offset = 0ULL;
     s->config = 0ULL;
     hpet_cfg.hpet[s->hpet_id].event_timer_block_id = (uint32_t)s->capability;
-    hpet_cfg.hpet[s->hpet_id].address = SYS_BUS_DEVICE(d)->mmio[0].addr;
+    hpet_cfg.hpet[s->hpet_id].address = sbd->mmio[0].addr;
 
     /* to document that the RTC lowers its output on reset as well */
     s->rtc_irq_level = 0;
@@ -665,7 +672,7 @@ static void hpet_reset(DeviceState *d)
 
 static void hpet_handle_legacy_irq(void *opaque, int n, int level)
 {
-    HPETState *s = FROM_SYSBUS(HPETState, opaque);
+    HPETState *s = HPET(opaque);
 
     if (n == HPET_LEGACY_PIT_INT) {
         if (!hpet_in_legacy_mode(s)) {
@@ -681,7 +688,7 @@ static void hpet_handle_legacy_irq(void *opaque, int n, int level)
 
 static int hpet_init(SysBusDevice *dev)
 {
-    HPETState *s = FROM_SYSBUS(HPETState, dev);
+    HPETState *s = HPET(dev);
     int i;
     HPETTimer *timer;
 
@@ -746,7 +753,7 @@ static void hpet_device_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo hpet_device_info = {
-    .name          = "hpet",
+    .name          = TYPE_HPET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(HPETState),
     .class_init    = hpet_device_class_init,
commit a71c7ec529adcd36fed5bb570a167ae2f9771750
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:34 2013 +0800

    scsi/esp: QOM'ify some more
    
    Introduce type constant and avoid DO_UPCAST().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index c6166c5..1a2d72c 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -578,8 +578,14 @@ const VMStateDescription vmstate_esp = {
     }
 };
 
+#define TYPE_ESP "esp"
+#define ESP(obj) OBJECT_CHECK(SysBusESPState, (obj), TYPE_ESP)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t it_shift;
     ESPState esp;
@@ -623,8 +629,8 @@ void esp_init(hwaddr espaddr, int it_shift,
     SysBusESPState *sysbus;
     ESPState *esp;
 
-    dev = qdev_create(NULL, "esp");
-    sysbus = DO_UPCAST(SysBusESPState, busdev.qdev, dev);
+    dev = qdev_create(NULL, TYPE_ESP);
+    sysbus = ESP(dev);
     esp = &sysbus->esp;
     esp->dma_memory_read = dma_memory_read;
     esp->dma_memory_write = dma_memory_write;
@@ -652,8 +658,7 @@ static const struct SCSIBusInfo esp_scsi_info = {
 
 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
 {
-    DeviceState *d = opaque;
-    SysBusESPState *sysbus = container_of(d, SysBusESPState, busdev.qdev);
+    SysBusESPState *sysbus = ESP(opaque);
     ESPState *s = &sysbus->esp;
 
     switch (irq) {
@@ -668,7 +673,7 @@ static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
 
 static int sysbus_esp_init(SysBusDevice *dev)
 {
-    SysBusESPState *sysbus = FROM_SYSBUS(SysBusESPState, dev);
+    SysBusESPState *sysbus = ESP(dev);
     ESPState *s = &sysbus->esp;
 
     sysbus_init_irq(dev, &s->irq);
@@ -687,7 +692,7 @@ static int sysbus_esp_init(SysBusDevice *dev)
 
 static void sysbus_esp_hard_reset(DeviceState *dev)
 {
-    SysBusESPState *sysbus = DO_UPCAST(SysBusESPState, busdev.qdev, dev);
+    SysBusESPState *sysbus = ESP(dev);
     esp_hard_reset(&sysbus->esp);
 }
 
@@ -713,7 +718,7 @@ static void sysbus_esp_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sysbus_esp_info = {
-    .name          = "esp",
+    .name          = TYPE_ESP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysBusESPState),
     .class_init    = sysbus_esp_class_init,
commit 2ce92a1102be22e2bb82267351834713b8c31542
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:32 2013 +0800

    fwcfg: QOM'ify some more
    
    Use type constant if possible and avoid DO_UPCAST().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index e455282..8e39111 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -35,6 +35,7 @@
 #define TYPE_FW_CFG "fw_cfg"
 #define FW_CFG_NAME "fw_cfg"
 #define FW_CFG_PATH "/machine/" FW_CFG_NAME
+#define FW_CFG(obj) OBJECT_CHECK(FWCfgState, (obj), TYPE_FW_CFG)
 
 typedef struct FWCfgEntry {
     uint32_t len;
@@ -44,7 +45,10 @@ typedef struct FWCfgEntry {
 } FWCfgEntry;
 
 struct FWCfgState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion ctl_iomem, data_iomem, comb_iomem;
     uint32_t ctl_iobase, data_iobase;
     FWCfgEntry entries[2][FW_CFG_MAX_ENTRY];
@@ -326,7 +330,7 @@ static const MemoryRegionOps fw_cfg_comb_mem_ops = {
 
 static void fw_cfg_reset(DeviceState *d)
 {
-    FWCfgState *s = DO_UPCAST(FWCfgState, busdev.qdev, d);
+    FWCfgState *s = FW_CFG(d);
 
     fw_cfg_select(s, 0);
 }
@@ -489,12 +493,12 @@ FWCfgState *fw_cfg_init(uint32_t ctl_port, uint32_t data_port,
     SysBusDevice *d;
     FWCfgState *s;
 
-    dev = qdev_create(NULL, "fw_cfg");
+    dev = qdev_create(NULL, TYPE_FW_CFG);
     qdev_prop_set_uint32(dev, "ctl_iobase", ctl_port);
     qdev_prop_set_uint32(dev, "data_iobase", data_port);
     d = SYS_BUS_DEVICE(dev);
 
-    s = DO_UPCAST(FWCfgState, busdev.qdev, dev);
+    s = FW_CFG(dev);
 
     assert(!object_resolve_path(FW_CFG_PATH, NULL));
 
@@ -524,7 +528,7 @@ FWCfgState *fw_cfg_init(uint32_t ctl_port, uint32_t data_port,
 
 static int fw_cfg_init1(SysBusDevice *dev)
 {
-    FWCfgState *s = FROM_SYSBUS(FWCfgState, dev);
+    FWCfgState *s = FW_CFG(dev);
 
     memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops, s,
                           "fwcfg.ctl", FW_CFG_SIZE);
@@ -557,8 +561,7 @@ static Property fw_cfg_properties[] = {
 
 FWCfgState *fw_cfg_find(void)
 {
-    return OBJECT_CHECK(FWCfgState, object_resolve_path(FW_CFG_PATH, NULL),
-                        TYPE_FW_CFG);
+    return FW_CFG(object_resolve_path(FW_CFG_PATH, NULL));
 }
 
 static void fw_cfg_class_init(ObjectClass *klass, void *data)
commit b3b162c3cfb88a57390fef581c1be99648d6d8ab
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:30 2013 +0800

    ahci: QOM'ify some more
    
    Introduce type constant and avoid DO_UPCAST().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index f295732..d76e6eb 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1286,8 +1286,14 @@ const VMStateDescription vmstate_ahci = {
     },
 };
 
+#define TYPE_SYSBUS_AHCI "sysbus-ahci"
+#define SYSBUS_AHCI(obj) OBJECT_CHECK(SysbusAHCIState, (obj), TYPE_SYSBUS_AHCI)
+
 typedef struct SysbusAHCIState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     AHCIState ahci;
     uint32_t num_ports;
 } SysbusAHCIState;
@@ -1303,15 +1309,15 @@ static const VMStateDescription vmstate_sysbus_ahci = {
 
 static void sysbus_ahci_reset(DeviceState *dev)
 {
-    SysbusAHCIState *s = DO_UPCAST(SysbusAHCIState, busdev.qdev, dev);
+    SysbusAHCIState *s = SYSBUS_AHCI(dev);
 
     ahci_reset(&s->ahci);
 }
 
 static int sysbus_ahci_init(SysBusDevice *dev)
 {
-    SysbusAHCIState *s = FROM_SYSBUS(SysbusAHCIState, dev);
-    ahci_init(&s->ahci, &dev->qdev, NULL, s->num_ports);
+    SysbusAHCIState *s = SYSBUS_AHCI(dev);
+    ahci_init(&s->ahci, DEVICE(dev), NULL, s->num_ports);
 
     sysbus_init_mmio(dev, &s->ahci.mem);
     sysbus_init_irq(dev, &s->ahci.irq);
@@ -1335,7 +1341,7 @@ static void sysbus_ahci_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sysbus_ahci_info = {
-    .name          = "sysbus-ahci",
+    .name          = TYPE_SYSBUS_AHCI,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysbusAHCIState),
     .class_init    = sysbus_ahci_class_init,
commit 3509c396d2894b4dc40a2e33d7c2f795508d7328
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:28 2013 +0800

    pflash-cfi02: QOM'ify some more
    
    Introduce type constant and replace FROM_SYSBUS().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index d6cd3da..d8381dd 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -55,8 +55,14 @@ do {                                                       \
 
 #define PFLASH_LAZY_ROMD_THRESHOLD 42
 
+#define TYPE_CFI_PFLASH02 "cfi.pflash02"
+#define CFI_PFLASH02(obj) OBJECT_CHECK(pflash_t, (obj), TYPE_CFI_PFLASH02)
+
 struct pflash_t {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     BlockDriverState *bs;
     uint32_t sector_len;
     uint32_t nb_blocs;
@@ -588,7 +594,7 @@ static const MemoryRegionOps pflash_cfi02_ops_le = {
 
 static int pflash_cfi02_init(SysBusDevice *dev)
 {
-    pflash_t *pfl = FROM_SYSBUS(typeof(*pfl), dev);
+    pflash_t *pfl = CFI_PFLASH02(dev);
     uint32_t chip_len;
     int ret;
 
@@ -737,7 +743,7 @@ static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pflash_cfi02_info = {
-    .name           = "cfi.pflash02",
+    .name           = TYPE_CFI_PFLASH02,
     .parent         = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(struct pflash_t),
     .class_init     = pflash_cfi02_class_init,
@@ -760,10 +766,7 @@ pflash_t *pflash_cfi02_register(hwaddr base,
                                 uint16_t unlock_addr0, uint16_t unlock_addr1,
                                 int be)
 {
-    DeviceState *dev = qdev_create(NULL, "cfi.pflash02");
-    SysBusDevice *busdev = SYS_BUS_DEVICE(dev);
-    pflash_t *pfl = (pflash_t *)object_dynamic_cast(OBJECT(dev),
-                                                    "cfi.pflash02");
+    DeviceState *dev = qdev_create(NULL, TYPE_CFI_PFLASH02);
 
     if (bs && qdev_prop_set_drive(dev, "drive", bs)) {
         abort();
@@ -782,6 +785,6 @@ pflash_t *pflash_cfi02_register(hwaddr base,
     qdev_prop_set_string(dev, "name", name);
     qdev_init_nofail(dev);
 
-    sysbus_mmio_map(busdev, 0, base);
-    return pfl;
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+    return CFI_PFLASH02(dev);
 }
commit f1b44f0e4191547888ff9750988a4f3e7ca9c60e
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:26 2013 +0800

    pflash-cfi01: QOM'ify some more
    
    Introduce type constant and replace FROM_SYSBUS().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 6898a25..bfcccdd 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -60,8 +60,14 @@ do {                                                        \
 #define DPRINTF(fmt, ...) do { } while (0)
 #endif
 
+#define TYPE_CFI_PFLASH01 "cfi.pflash01"
+#define CFI_PFLASH01(obj) OBJECT_CHECK(pflash_t, (obj), TYPE_CFI_PFLASH01)
+
 struct pflash_t {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     BlockDriverState *bs;
     uint32_t nb_blocs;
     uint64_t sector_len;
@@ -565,7 +571,7 @@ static const MemoryRegionOps pflash_cfi01_ops_le = {
 
 static int pflash_cfi01_init(SysBusDevice *dev)
 {
-    pflash_t *pfl = FROM_SYSBUS(typeof(*pfl), dev);
+    pflash_t *pfl = CFI_PFLASH01(dev);
     uint64_t total_len;
     int ret;
 
@@ -720,7 +726,7 @@ static void pflash_cfi01_class_init(ObjectClass *klass, void *data)
 
 
 static const TypeInfo pflash_cfi01_info = {
-    .name           = "cfi.pflash01",
+    .name           = TYPE_CFI_PFLASH01,
     .parent         = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(struct pflash_t),
     .class_init     = pflash_cfi01_class_init,
@@ -741,10 +747,7 @@ pflash_t *pflash_cfi01_register(hwaddr base,
                                 uint16_t id0, uint16_t id1,
                                 uint16_t id2, uint16_t id3, int be)
 {
-    DeviceState *dev = qdev_create(NULL, "cfi.pflash01");
-    SysBusDevice *busdev = SYS_BUS_DEVICE(dev);
-    pflash_t *pfl = (pflash_t *)object_dynamic_cast(OBJECT(dev),
-                                                    "cfi.pflash01");
+    DeviceState *dev = qdev_create(NULL, TYPE_CFI_PFLASH01);
 
     if (bs && qdev_prop_set_drive(dev, "drive", bs)) {
         abort();
@@ -760,8 +763,8 @@ pflash_t *pflash_cfi01_register(hwaddr base,
     qdev_prop_set_string(dev, "name", name);
     qdev_init_nofail(dev);
 
-    sysbus_mmio_map(busdev, 0, base);
-    return pfl;
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+    return CFI_PFLASH01(dev);
 }
 
 MemoryRegion *pflash_cfi01_get_memory(pflash_t *fl)
commit dd3be7420774f7dc8f37a96ca24d07f0b6f31b3b
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:24 2013 +0800

    fdc: QOM'ify some more
    
    Introduce type constant and avoid DO_UPCAST(), container_of(),
    and use DEVICE() to avoid accessing parent qdev directly.
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Renamed parent field and avoided repeated SYS_BUS_DEVICE() casts]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index cdc00e5..e5242bf 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -544,8 +544,14 @@ struct FDCtrl {
     uint8_t timer1;
 };
 
+#define TYPE_SYSBUS_FDC "sysbus-fdc"
+#define SYSBUS_FDC(obj) OBJECT_CHECK(FDCtrlSysBus, (obj), TYPE_SYSBUS_FDC)
+
 typedef struct FDCtrlSysBus {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     struct FDCtrl state;
 } FDCtrlSysBus;
 
@@ -773,7 +779,7 @@ static const VMStateDescription vmstate_fdc = {
 
 static void fdctrl_external_reset_sysbus(DeviceState *d)
 {
-    FDCtrlSysBus *sys = container_of(d, FDCtrlSysBus, busdev.qdev);
+    FDCtrlSysBus *sys = SYSBUS_FDC(d);
     FDCtrl *s = &sys->state;
 
     fdctrl_reset(s, 0);
@@ -2047,10 +2053,11 @@ void fdctrl_init_sysbus(qemu_irq irq, int dma_chann,
 {
     FDCtrl *fdctrl;
     DeviceState *dev;
+    SysBusDevice *sbd;
     FDCtrlSysBus *sys;
 
-    dev = qdev_create(NULL, "sysbus-fdc");
-    sys = DO_UPCAST(FDCtrlSysBus, busdev.qdev, dev);
+    dev = qdev_create(NULL, TYPE_SYSBUS_FDC);
+    sys = SYSBUS_FDC(dev);
     fdctrl = &sys->state;
     fdctrl->dma_chann = dma_chann; /* FIXME */
     if (fds[0]) {
@@ -2060,8 +2067,9 @@ void fdctrl_init_sysbus(qemu_irq irq, int dma_chann,
         qdev_prop_set_drive_nofail(dev, "driveB", fds[1]->bdrv);
     }
     qdev_init_nofail(dev);
-    sysbus_connect_irq(&sys->busdev, 0, irq);
-    sysbus_mmio_map(&sys->busdev, 0, mmio_base);
+    sbd = SYS_BUS_DEVICE(dev);
+    sysbus_connect_irq(sbd, 0, irq);
+    sysbus_mmio_map(sbd, 0, mmio_base);
 }
 
 void sun4m_fdctrl_init(qemu_irq irq, hwaddr io_base,
@@ -2075,9 +2083,9 @@ void sun4m_fdctrl_init(qemu_irq irq, hwaddr io_base,
         qdev_prop_set_drive_nofail(dev, "drive", fds[0]->bdrv);
     }
     qdev_init_nofail(dev);
-    sys = DO_UPCAST(FDCtrlSysBus, busdev.qdev, dev);
-    sysbus_connect_irq(&sys->busdev, 0, irq);
-    sysbus_mmio_map(&sys->busdev, 0, io_base);
+    sys = SYSBUS_FDC(dev);
+    sysbus_connect_irq(SYS_BUS_DEVICE(sys), 0, irq);
+    sysbus_mmio_map(SYS_BUS_DEVICE(sys), 0, io_base);
     *fdc_tc = qdev_get_gpio_in(dev, 0);
 }
 
@@ -2145,7 +2153,7 @@ static void isabus_fdc_realize(DeviceState *dev, Error **errp)
 
 static int sysbus_fdc_init1(SysBusDevice *dev)
 {
-    FDCtrlSysBus *sys = DO_UPCAST(FDCtrlSysBus, busdev, dev);
+    FDCtrlSysBus *sys = SYSBUS_FDC(dev);
     FDCtrl *fdctrl = &sys->state;
     int ret;
 
@@ -2153,10 +2161,10 @@ static int sysbus_fdc_init1(SysBusDevice *dev)
                           "fdc", 0x08);
     sysbus_init_mmio(dev, &fdctrl->iomem);
     sysbus_init_irq(dev, &fdctrl->irq);
-    qdev_init_gpio_in(&dev->qdev, fdctrl_handle_tc, 1);
+    qdev_init_gpio_in(DEVICE(dev), fdctrl_handle_tc, 1);
     fdctrl->dma_chann = -1;
 
-    qdev_set_legacy_instance_id(&dev->qdev, 0 /* io */, 2); /* FIXME */
+    qdev_set_legacy_instance_id(DEVICE(dev), 0 /* io */, 2); /* FIXME */
     ret = fdctrl_init_common(fdctrl);
 
     return ret;
@@ -2164,16 +2172,17 @@ static int sysbus_fdc_init1(SysBusDevice *dev)
 
 static int sun4m_fdc_init1(SysBusDevice *dev)
 {
-    FDCtrl *fdctrl = &(FROM_SYSBUS(FDCtrlSysBus, dev)->state);
+    FDCtrlSysBus *sys = SYSBUS_FDC(dev);
+    FDCtrl *fdctrl = &sys->state;
 
     memory_region_init_io(&fdctrl->iomem, OBJECT(dev), &fdctrl_mem_strict_ops,
                           fdctrl, "fdctrl", 0x08);
     sysbus_init_mmio(dev, &fdctrl->iomem);
     sysbus_init_irq(dev, &fdctrl->irq);
-    qdev_init_gpio_in(&dev->qdev, fdctrl_handle_tc, 1);
+    qdev_init_gpio_in(DEVICE(dev), fdctrl_handle_tc, 1);
 
     fdctrl->sun4m = 1;
-    qdev_set_legacy_instance_id(&dev->qdev, 0 /* io */, 2); /* FIXME */
+    qdev_set_legacy_instance_id(DEVICE(dev), 0 /* io */, 2); /* FIXME */
     return fdctrl_init_common(fdctrl);
 }
 
@@ -2254,7 +2263,7 @@ static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sysbus_fdc_info = {
-    .name          = "sysbus-fdc",
+    .name          = TYPE_SYSBUS_FDC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(FDCtrlSysBus),
     .class_init    = sysbus_fdc_class_init,
commit 62d92e432f586b2bb99d7824f684df4ebd412ea1
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:23 2013 +0800

    q35: Use QOM realize for q35 host bridge
    
    And split off MemoryRegion initialization into instance_init.
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 86dd298..6b1b3b7 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -34,31 +34,27 @@
  * Q35 host
  */
 
-static int q35_host_init(SysBusDevice *dev)
+static void q35_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
     Q35PCIHost *s = Q35_HOST_DEVICE(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    memory_region_init_io(&pci->conf_mem, OBJECT(pci), &pci_host_conf_le_ops, pci,
-                          "pci-conf-idx", 4);
-    sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_ADDR, &pci->conf_mem);
-    sysbus_init_ioports(dev, MCH_HOST_BRIDGE_CONFIG_ADDR, 4);
+    sysbus_add_io(sbd, MCH_HOST_BRIDGE_CONFIG_ADDR, &pci->conf_mem);
+    sysbus_init_ioports(sbd, MCH_HOST_BRIDGE_CONFIG_ADDR, 4);
 
-    memory_region_init_io(&pci->data_mem, OBJECT(pci), &pci_host_data_le_ops, pci,
-                          "pci-conf-data", 4);
-    sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_DATA, &pci->data_mem);
-    sysbus_init_ioports(dev, MCH_HOST_BRIDGE_CONFIG_DATA, 4);
+    sysbus_add_io(sbd, MCH_HOST_BRIDGE_CONFIG_DATA, &pci->data_mem);
+    sysbus_init_ioports(sbd, MCH_HOST_BRIDGE_CONFIG_DATA, 4);
 
     if (pcie_host_init(PCIE_HOST_BRIDGE(s)) < 0) {
-        return -1;
+        error_setg(errp, "failed to initialize pcie host");
+        return;
     }
     pci->bus = pci_bus_new(DEVICE(s), "pcie.0",
                            s->mch.pci_address_space, s->mch.address_space_io,
                            0, TYPE_PCIE_BUS);
     qdev_set_parent_bus(DEVICE(&s->mch), BUS(pci->bus));
     qdev_init_nofail(DEVICE(&s->mch));
-
-    return 0;
 }
 
 static const char *q35_host_root_bus_path(PCIHostState *host_bridge,
@@ -77,11 +73,10 @@ static Property mch_props[] = {
 static void q35_host_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
 
     hc->root_bus_path = q35_host_root_bus_path;
-    k->init = q35_host_init;
+    dc->realize = q35_host_realize;
     dc->props = mch_props;
     dc->fw_name = "pci";
 }
@@ -89,6 +84,12 @@ static void q35_host_class_init(ObjectClass *klass, void *data)
 static void q35_host_initfn(Object *obj)
 {
     Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+    PCIHostState *phb = PCI_HOST_BRIDGE(obj);
+
+    memory_region_init_io(&phb->conf_mem, obj, &pci_host_conf_le_ops, phb,
+                          "pci-conf-idx", 4);
+    memory_region_init_io(&phb->data_mem, obj, &pci_host_data_le_ops, phb,
+                          "pci-conf-data", 4);
 
     object_initialize(&s->mch, TYPE_MCH_PCI_DEVICE);
     object_property_add_child(OBJECT(s), "mch", OBJECT(&s->mch), NULL);
commit ce88812f576a0d5b172f99b253bcdc1dc37f86f2
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:22 2013 +0800

    q35: Use type-safe cast instead of direct access of parent dev
    
    And remove variables if possible.
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Converted remaining access and renamed to parent_obj]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 6f10246..0b1d2e3 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -60,6 +60,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     const char *boot_device = args->boot_device;
     ram_addr_t below_4g_mem_size, above_4g_mem_size;
     Q35PCIHost *q35_host;
+    PCIHostState *phb;
     PCIBus *host_bus;
     PCIDevice *lpc;
     BusState *idebus[MAX_SATA_PORTS];
@@ -139,7 +140,8 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     q35_host->mch.guest_info = guest_info;
     /* pci */
     qdev_init_nofail(DEVICE(q35_host));
-    host_bus = q35_host->host.pci.bus;
+    phb = PCI_HOST_BRIDGE(q35_host);
+    host_bus = phb->bus;
     /* create ISA bus */
     lpc = pci_create_simple_multifunction(host_bus, PCI_DEVFN(ICH9_LPC_DEV,
                                           ICH9_LPC_FUNC), true,
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 8c3ee53..86dd298 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -36,28 +36,26 @@
 
 static int q35_host_init(SysBusDevice *dev)
 {
-    PCIBus *b;
-    PCIHostState *pci = FROM_SYSBUS(PCIHostState, dev);
-    Q35PCIHost *s = Q35_HOST_DEVICE(&dev->qdev);
+    PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+    Q35PCIHost *s = Q35_HOST_DEVICE(dev);
 
     memory_region_init_io(&pci->conf_mem, OBJECT(pci), &pci_host_conf_le_ops, pci,
                           "pci-conf-idx", 4);
     sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_ADDR, &pci->conf_mem);
-    sysbus_init_ioports(&pci->busdev, MCH_HOST_BRIDGE_CONFIG_ADDR, 4);
+    sysbus_init_ioports(dev, MCH_HOST_BRIDGE_CONFIG_ADDR, 4);
 
     memory_region_init_io(&pci->data_mem, OBJECT(pci), &pci_host_data_le_ops, pci,
                           "pci-conf-data", 4);
     sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_DATA, &pci->data_mem);
-    sysbus_init_ioports(&pci->busdev, MCH_HOST_BRIDGE_CONFIG_DATA, 4);
+    sysbus_init_ioports(dev, MCH_HOST_BRIDGE_CONFIG_DATA, 4);
 
-    if (pcie_host_init(&s->host) < 0) {
+    if (pcie_host_init(PCIE_HOST_BRIDGE(s)) < 0) {
         return -1;
     }
-    b = pci_bus_new(&s->host.pci.busdev.qdev, "pcie.0",
-                    s->mch.pci_address_space, s->mch.address_space_io,
-                    0, TYPE_PCIE_BUS);
-    s->host.pci.bus = b;
-    qdev_set_parent_bus(DEVICE(&s->mch), BUS(b));
+    pci->bus = pci_bus_new(DEVICE(s), "pcie.0",
+                           s->mch.pci_address_space, s->mch.address_space_io,
+                           0, TYPE_PCIE_BUS);
+    qdev_set_parent_bus(DEVICE(&s->mch), BUS(pci->bus));
     qdev_init_nofail(DEVICE(&s->mch));
 
     return 0;
@@ -71,7 +69,7 @@ static const char *q35_host_root_bus_path(PCIHostState *host_bridge,
 }
 
 static Property mch_props[] = {
-    DEFINE_PROP_UINT64("MCFG", Q35PCIHost, host.base_addr,
+    DEFINE_PROP_UINT64("MCFG", Q35PCIHost, parent_obj.base_addr,
                         MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT),
     DEFINE_PROP_END_OF_LIST(),
 };
@@ -113,10 +111,9 @@ static const TypeInfo q35_host_info = {
 /* PCIe MMCFG */
 static void mch_update_pciexbar(MCHPCIState *mch)
 {
-    PCIDevice *pci_dev = &mch->d;
-    BusState *bus = qdev_get_parent_bus(&pci_dev->qdev);
-    DeviceState *qdev = bus->parent;
-    Q35PCIHost *s = Q35_HOST_DEVICE(qdev);
+    PCIDevice *pci_dev = PCI_DEVICE(mch);
+    BusState *bus = qdev_get_parent_bus(DEVICE(mch));
+    PCIExpressHost *pehb = PCIE_HOST_BRIDGE(bus->parent);
 
     uint64_t pciexbar;
     int enable;
@@ -148,18 +145,19 @@ static void mch_update_pciexbar(MCHPCIState *mch)
         break;
     }
     addr = pciexbar & addr_mask;
-    pcie_host_mmcfg_update(&s->host, enable, addr, length);
+    pcie_host_mmcfg_update(pehb, enable, addr, length);
 }
 
 /* PAM */
 static void mch_update_pam(MCHPCIState *mch)
 {
+    PCIDevice *pd = PCI_DEVICE(mch);
     int i;
 
     memory_region_transaction_begin();
     for (i = 0; i < 13; i++) {
         pam_update(&mch->pam_regions[i], i,
-                   mch->d.config[MCH_HOST_BRIDGE_PAM0 + ((i + 1) / 2)]);
+                   pd->config[MCH_HOST_BRIDGE_PAM0 + ((i + 1) / 2)]);
     }
     memory_region_transaction_commit();
 }
@@ -167,8 +165,10 @@ static void mch_update_pam(MCHPCIState *mch)
 /* SMRAM */
 static void mch_update_smram(MCHPCIState *mch)
 {
+    PCIDevice *pd = PCI_DEVICE(mch);
+
     memory_region_transaction_begin();
-    smram_update(&mch->smram_region, mch->d.config[MCH_HOST_BRDIGE_SMRAM],
+    smram_update(&mch->smram_region, pd->config[MCH_HOST_BRDIGE_SMRAM],
                     mch->smm_enabled);
     memory_region_transaction_commit();
 }
@@ -176,9 +176,10 @@ static void mch_update_smram(MCHPCIState *mch)
 static void mch_set_smm(int smm, void *arg)
 {
     MCHPCIState *mch = arg;
+    PCIDevice *pd = PCI_DEVICE(mch);
 
     memory_region_transaction_begin();
-    smram_set_smm(&mch->smm_enabled, smm, mch->d.config[MCH_HOST_BRDIGE_SMRAM],
+    smram_set_smm(&mch->smm_enabled, smm, pd->config[MCH_HOST_BRDIGE_SMRAM],
                     &mch->smram_region);
     memory_region_transaction_commit();
 }
@@ -228,7 +229,7 @@ static const VMStateDescription vmstate_mch = {
     .minimum_version_id_old = 1,
     .post_load = mch_post_load,
     .fields = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(d, MCHPCIState),
+        VMSTATE_PCI_DEVICE(parent_obj, MCHPCIState),
         VMSTATE_UINT8(smm_enabled, MCHPCIState),
         VMSTATE_END_OF_LIST()
     }
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index b083831..3cb631e 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -43,7 +43,10 @@
      OBJECT_CHECK(MCHPCIState, (obj), TYPE_MCH_PCI_DEVICE)
 
 typedef struct MCHPCIState {
-    PCIDevice d;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion *ram_memory;
     MemoryRegion *pci_address_space;
     MemoryRegion *system_memory;
@@ -59,7 +62,10 @@ typedef struct MCHPCIState {
 } MCHPCIState;
 
 typedef struct Q35PCIHost {
-    PCIExpressHost host;
+    /*< private >*/
+    PCIExpressHost parent_obj;
+    /*< public >*/
+
     MCHPCIState mch;
 } Q35PCIHost;
 
commit a3560fbf012e19c5c9b495cc0d90f2dd4491e09f
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:20 2013 +0800

    i440fx-pcihost: Use QOM realize for i440fx-pcihost
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 541c8b7..3908860 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -203,21 +203,26 @@ static const VMStateDescription vmstate_i440fx = {
     }
 };
 
-static int i440fx_pcihost_initfn(SysBusDevice *dev)
+static void i440fx_pcihost_initfn(Object *obj)
 {
-    PCIHostState *s = PCI_HOST_BRIDGE(dev);
+    PCIHostState *s = PCI_HOST_BRIDGE(obj);
 
-    memory_region_init_io(&s->conf_mem, OBJECT(dev), &pci_host_conf_le_ops, s,
+    memory_region_init_io(&s->conf_mem, obj, &pci_host_conf_le_ops, s,
                           "pci-conf-idx", 4);
-    sysbus_add_io(dev, 0xcf8, &s->conf_mem);
-    sysbus_init_ioports(&s->busdev, 0xcf8, 4);
-
-    memory_region_init_io(&s->data_mem, OBJECT(dev), &pci_host_data_le_ops, s,
+    memory_region_init_io(&s->data_mem, obj, &pci_host_data_le_ops, s,
                           "pci-conf-data", 4);
-    sysbus_add_io(dev, 0xcfc, &s->data_mem);
-    sysbus_init_ioports(&s->busdev, 0xcfc, 4);
+}
 
-    return 0;
+static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
+{
+    PCIHostState *s = PCI_HOST_BRIDGE(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+    sysbus_add_io(sbd, 0xcf8, &s->conf_mem);
+    sysbus_init_ioports(sbd, 0xcf8, 4);
+
+    sysbus_add_io(sbd, 0xcfc, &s->data_mem);
+    sysbus_init_ioports(sbd, 0xcfc, 4);
 }
 
 static int i440fx_initfn(PCIDevice *dev)
@@ -647,11 +652,10 @@ static const char *i440fx_pcihost_root_bus_path(PCIHostState *host_bridge,
 static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
 
     hc->root_bus_path = i440fx_pcihost_root_bus_path;
-    k->init = i440fx_pcihost_initfn;
+    dc->realize = i440fx_pcihost_realize;
     dc->fw_name = "pci";
     dc->no_user = 1;
 }
@@ -660,6 +664,7 @@ static const TypeInfo i440fx_pcihost_info = {
     .name          = "i440FX-pcihost",
     .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(I440FXState),
+    .instance_init = i440fx_pcihost_initfn,
     .class_init    = i440fx_pcihost_class_init,
 };
 
commit 2aedfa464909c887564c65fb3a51c020d71e0b78
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:21 2013 +0800

    i440fx: Use type-safe cast instead of direct access of parent dev
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Converted remaining accesses and renamed to parent_obj]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 870e388..541c8b7 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -87,7 +87,10 @@ typedef struct PIIX3State {
     OBJECT_CHECK(PCII440FXState, (obj), TYPE_I440FX_PCI_DEVICE)
 
 struct PCII440FXState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion *system_memory;
     MemoryRegion *pci_address_space;
     MemoryRegion *ram_memory;
@@ -121,22 +124,24 @@ static int pci_slot_get_pirq(PCIDevice *pci_dev, int pci_intx)
 static void i440fx_update_memory_mappings(PCII440FXState *d)
 {
     int i;
+    PCIDevice *pd = PCI_DEVICE(d);
 
     memory_region_transaction_begin();
     for (i = 0; i < 13; i++) {
         pam_update(&d->pam_regions[i], i,
-                   d->dev.config[I440FX_PAM + ((i + 1) / 2)]);
+                   pd->config[I440FX_PAM + ((i + 1) / 2)]);
     }
-    smram_update(&d->smram_region, d->dev.config[I440FX_SMRAM], d->smm_enabled);
+    smram_update(&d->smram_region, pd->config[I440FX_SMRAM], d->smm_enabled);
     memory_region_transaction_commit();
 }
 
 static void i440fx_set_smm(int val, void *arg)
 {
     PCII440FXState *d = arg;
+    PCIDevice *pd = PCI_DEVICE(d);
 
     memory_region_transaction_begin();
-    smram_set_smm(&d->smm_enabled, val, d->dev.config[I440FX_SMRAM],
+    smram_set_smm(&d->smm_enabled, val, pd->config[I440FX_SMRAM],
                   &d->smram_region);
     memory_region_transaction_commit();
 }
@@ -158,9 +163,10 @@ static void i440fx_write_config(PCIDevice *dev,
 static int i440fx_load_old(QEMUFile* f, void *opaque, int version_id)
 {
     PCII440FXState *d = opaque;
+    PCIDevice *pd = PCI_DEVICE(d);
     int ret, i;
 
-    ret = pci_device_load(&d->dev, f);
+    ret = pci_device_load(pd, f);
     if (ret < 0)
         return ret;
     i440fx_update_memory_mappings(d);
@@ -191,7 +197,7 @@ static const VMStateDescription vmstate_i440fx = {
     .load_state_old = i440fx_load_old,
     .post_load = i440fx_post_load,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, PCII440FXState),
+        VMSTATE_PCI_DEVICE(parent_obj, PCII440FXState),
         VMSTATE_UINT8(smm_enabled, PCII440FXState),
         VMSTATE_END_OF_LIST()
     }
@@ -218,7 +224,7 @@ static int i440fx_initfn(PCIDevice *dev)
 {
     PCII440FXState *d = I440FX_PCI_DEVICE(dev);
 
-    d->dev.config[I440FX_SMRAM] = 0x02;
+    dev->config[I440FX_SMRAM] = 0x02;
 
     cpu_smm_register(&i440fx_set_smm, d);
     return 0;
@@ -305,9 +311,10 @@ static PCIBus *i440fx_common_init(const char *device_name,
     *piix3_devfn = piix3->dev.devfn;
 
     ram_size = ram_size / 8 / 1024 / 1024;
-    if (ram_size > 255)
+    if (ram_size > 255) {
         ram_size = 255;
-    (*pi440fx_state)->dev.config[0x57]=ram_size;
+    }
+    d->config[0x57] = ram_size;
 
     i440fx_update_memory_mappings(f);
 
commit 457215ec6a3acc020d357b958eb513ef944abc93
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:19 2013 +0800

    ohci: Use QOM realize for OHCI
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 7da2564..2bab8ff 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1888,17 +1888,16 @@ typedef struct {
     dma_addr_t dma_offset;
 } OHCISysBusState;
 
-static int ohci_init_pxa(SysBusDevice *dev)
+static void ohci_realize_pxa(DeviceState *dev, Error **errp)
 {
     OHCISysBusState *s = SYSBUS_OHCI(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
     /* Cannot fail as we pass NULL for masterbus */
-    usb_ohci_init(&s->ohci, DEVICE(dev), s->num_ports, s->dma_offset, NULL, 0,
+    usb_ohci_init(&s->ohci, dev, s->num_ports, s->dma_offset, NULL, 0,
                   &address_space_memory);
-    sysbus_init_irq(dev, &s->ohci.irq);
-    sysbus_init_mmio(dev, &s->ohci.mem);
-
-    return 0;
+    sysbus_init_irq(sbd, &s->ohci.irq);
+    sysbus_init_mmio(sbd, &s->ohci.mem);
 }
 
 static Property ohci_pci_properties[] = {
@@ -1938,9 +1937,8 @@ static Property ohci_sysbus_properties[] = {
 static void ohci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
 
-    sbc->init = ohci_init_pxa;
+    dc->realize = ohci_realize_pxa;
     dc->desc = "OHCI USB Controller";
     dc->props = ohci_sysbus_properties;
 }
commit 1aa0c0c748ad05cde80b4d6f2907a70bc4089883
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:18 2013 +0800

    ohci: QOM'ify some more
    
    Introduce type constant and avoid DO_UPCAST().
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Avoid remaining OHCIPCIState::pci_dev uses, rename parent fields]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index a096ecf..7da2564 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1843,35 +1843,46 @@ static int usb_ohci_init(OHCIState *ohci, DeviceState *dev,
     return 0;
 }
 
+#define TYPE_PCI_OHCI "pci-ohci"
+#define PCI_OHCI(obj) OBJECT_CHECK(OHCIPCIState, (obj), TYPE_PCI_OHCI)
+
 typedef struct {
-    PCIDevice pci_dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     OHCIState state;
     char *masterbus;
     uint32_t num_ports;
     uint32_t firstport;
 } OHCIPCIState;
 
-static int usb_ohci_initfn_pci(struct PCIDevice *dev)
+static int usb_ohci_initfn_pci(PCIDevice *dev)
 {
-    OHCIPCIState *ohci = DO_UPCAST(OHCIPCIState, pci_dev, dev);
+    OHCIPCIState *ohci = PCI_OHCI(dev);
 
-    ohci->pci_dev.config[PCI_CLASS_PROG] = 0x10; /* OHCI */
-    ohci->pci_dev.config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
+    dev->config[PCI_CLASS_PROG] = 0x10; /* OHCI */
+    dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
 
-    if (usb_ohci_init(&ohci->state, &dev->qdev, ohci->num_ports, 0,
+    if (usb_ohci_init(&ohci->state, DEVICE(dev), ohci->num_ports, 0,
                       ohci->masterbus, ohci->firstport,
                       pci_get_address_space(dev)) != 0) {
         return -1;
     }
-    ohci->state.irq = ohci->pci_dev.irq[0];
+    ohci->state.irq = dev->irq[0];
 
-    /* TODO: avoid cast below by using dev */
-    pci_register_bar(&ohci->pci_dev, 0, 0, &ohci->state.mem);
+    pci_register_bar(dev, 0, 0, &ohci->state.mem);
     return 0;
 }
 
+#define TYPE_SYSBUS_OHCI "sysbus-ohci"
+#define SYSBUS_OHCI(obj) OBJECT_CHECK(OHCISysBusState, (obj), TYPE_SYSBUS_OHCI)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     OHCIState ohci;
     uint32_t num_ports;
     dma_addr_t dma_offset;
@@ -1879,10 +1890,10 @@ typedef struct {
 
 static int ohci_init_pxa(SysBusDevice *dev)
 {
-    OHCISysBusState *s = FROM_SYSBUS(OHCISysBusState, dev);
+    OHCISysBusState *s = SYSBUS_OHCI(dev);
 
     /* Cannot fail as we pass NULL for masterbus */
-    usb_ohci_init(&s->ohci, &dev->qdev, s->num_ports, s->dma_offset, NULL, 0,
+    usb_ohci_init(&s->ohci, DEVICE(dev), s->num_ports, s->dma_offset, NULL, 0,
                   &address_space_memory);
     sysbus_init_irq(dev, &s->ohci.irq);
     sysbus_init_mmio(dev, &s->ohci.mem);
@@ -1912,7 +1923,7 @@ static void ohci_pci_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ohci_pci_info = {
-    .name          = "pci-ohci",
+    .name          = TYPE_PCI_OHCI,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(OHCIPCIState),
     .class_init    = ohci_pci_class_init,
@@ -1935,7 +1946,7 @@ static void ohci_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ohci_sysbus_info = {
-    .name          = "sysbus-ohci",
+    .name          = TYPE_SYSBUS_OHCI,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OHCISysBusState),
     .class_init    = ohci_sysbus_class_init,
commit ce7243986fe69be831ec893127282fa5a045c985
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jul 1 18:18:17 2013 +0800

    sysbus: Document SysBusDeviceClass::init and realize semantics
    
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Syntax and wording changes]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 7c2e316..8c17165 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -23,8 +23,20 @@ typedef struct SysBusDevice SysBusDevice;
 #define SYS_BUS_DEVICE_GET_CLASS(obj) \
      OBJECT_GET_CLASS(SysBusDeviceClass, (obj), TYPE_SYS_BUS_DEVICE)
 
+/**
+ * SysBusDeviceClass:
+ * @init: Callback function invoked when the #DeviceState.realized property
+ * is changed to %true. Deprecated, new types inheriting directly from
+ * TYPE_SYS_BUS_DEVICE should use #DeviceClass.realize instead, new leaf
+ * types should consult their respective parent type.
+ *
+ * SysBusDeviceClass is not overriding #DeviceClass.realize, so derived
+ * classes overriding it are not required to invoke its implementation.
+ */
 typedef struct SysBusDeviceClass {
+    /*< private >*/
     DeviceClass parent_class;
+    /*< public >*/
 
     int (*init)(SysBusDevice *dev);
 } SysBusDeviceClass;
commit dc4aa51ba8bbef7edf4a104a5a6029a76a68600e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 15:20:05 2013 +0200

    xen/xen_platform: QOM parent field cleanup
    
    Replace direct uses of PCIXenPlatformState::pci_dev field with QOM casts
    and rename it to parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index 52a7279..6a8ba7e 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -49,7 +49,10 @@
 #define PFFLAG_ROM_LOCK 1 /* Sets whether ROM memory area is RW or RO */
 
 typedef struct PCIXenPlatformState {
-    PCIDevice  pci_dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion fixed_io;
     MemoryRegion bar;
     MemoryRegion mmio_bar;
@@ -121,7 +124,8 @@ static void platform_fixed_ioport_writew(void *opaque, uint32_t addr, uint32_t v
     PCIXenPlatformState *s = opaque;
 
     switch (addr) {
-    case 0:
+    case 0: {
+        PCIDevice *pci_dev = PCI_DEVICE(s);
         /* Unplug devices.  Value is a bitmask of which devices to
            unplug, with bit 0 the IDE devices, bit 1 the network
            devices, and bit 2 the non-primary-master IDE devices. */
@@ -129,16 +133,17 @@ static void platform_fixed_ioport_writew(void *opaque, uint32_t addr, uint32_t v
             DPRINTF("unplug disks\n");
             bdrv_drain_all();
             bdrv_flush_all();
-            pci_unplug_disks(s->pci_dev.bus);
+            pci_unplug_disks(pci_dev->bus);
         }
         if (val & UNPLUG_ALL_NICS) {
             DPRINTF("unplug nics\n");
-            pci_unplug_nics(s->pci_dev.bus);
+            pci_unplug_nics(pci_dev->bus);
         }
         if (val & UNPLUG_AUX_IDE_DISKS) {
             DPRINTF("unplug auxiliary disks not supported\n");
         }
         break;
+    }
     case 2:
         switch (val) {
         case 1:
@@ -372,7 +377,7 @@ static const VMStateDescription vmstate_xen_platform = {
     .minimum_version_id_old = 4,
     .post_load = xen_platform_post_load,
     .fields = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(pci_dev, PCIXenPlatformState),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIXenPlatformState),
         VMSTATE_UINT8(flags, PCIXenPlatformState),
         VMSTATE_END_OF_LIST()
     }
@@ -383,7 +388,7 @@ static int xen_platform_initfn(PCIDevice *dev)
     PCIXenPlatformState *d = XEN_PLATFORM(dev);
     uint8_t *pci_conf;
 
-    pci_conf = d->pci_dev.config;
+    pci_conf = dev->config;
 
     pci_set_word(pci_conf + PCI_COMMAND, PCI_COMMAND_IO | PCI_COMMAND_MEMORY);
 
@@ -392,11 +397,11 @@ static int xen_platform_initfn(PCIDevice *dev)
     pci_conf[PCI_INTERRUPT_PIN] = 1;
 
     platform_ioport_bar_setup(d);
-    pci_register_bar(&d->pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &d->bar);
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &d->bar);
 
     /* reserve 16MB mmio address for share memory*/
     platform_mmio_setup(d);
-    pci_register_bar(&d->pci_dev, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
+    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
                      &d->mmio_bar);
 
     platform_fixed_ioport_init(d);
commit 51a3fe996ba20eca0abfad2b783f27967d759d28
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 17:00:14 2013 +1000

    xen/xen_platform: QOM casting sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    [AF: Dropped opaque casts]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index 15d7cf0..52a7279 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -62,6 +62,10 @@ typedef struct PCIXenPlatformState {
     int log_buffer_off;
 } PCIXenPlatformState;
 
+#define TYPE_XEN_PLATFORM "xen-platform"
+#define XEN_PLATFORM(obj) \
+    OBJECT_CHECK(PCIXenPlatformState, (obj), TYPE_XEN_PLATFORM)
+
 #define XEN_PLATFORM_IOPORT 0x10
 
 /* Send bytes to syslog */
@@ -88,7 +92,7 @@ static void unplug_nic(PCIBus *b, PCIDevice *d, void *o)
     if (pci_get_word(d->config + PCI_CLASS_DEVICE) ==
             PCI_CLASS_NETWORK_ETHERNET
             && strcmp(d->name, "xen-pci-passthrough") != 0) {
-        qdev_free(&d->qdev);
+        qdev_free(DEVICE(d));
     }
 }
 
@@ -103,7 +107,7 @@ static void unplug_disks(PCIBus *b, PCIDevice *d, void *o)
     if (pci_get_word(d->config + PCI_CLASS_DEVICE) ==
             PCI_CLASS_STORAGE_IDE
             && strcmp(d->name, "xen-pci-passthrough") != 0) {
-        qdev_unplug(&(d->qdev), NULL);
+        qdev_unplug(DEVICE(d), NULL);
     }
 }
 
@@ -376,7 +380,7 @@ static const VMStateDescription vmstate_xen_platform = {
 
 static int xen_platform_initfn(PCIDevice *dev)
 {
-    PCIXenPlatformState *d = DO_UPCAST(PCIXenPlatformState, pci_dev, dev);
+    PCIXenPlatformState *d = XEN_PLATFORM(dev);
     uint8_t *pci_conf;
 
     pci_conf = d->pci_dev.config;
@@ -402,7 +406,7 @@ static int xen_platform_initfn(PCIDevice *dev)
 
 static void platform_reset(DeviceState *dev)
 {
-    PCIXenPlatformState *s = DO_UPCAST(PCIXenPlatformState, pci_dev.qdev, dev);
+    PCIXenPlatformState *s = XEN_PLATFORM(dev);
 
     platform_fixed_ioport_reset(s);
 }
@@ -425,7 +429,7 @@ static void xen_platform_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xen_platform_info = {
-    .name          = "xen-platform",
+    .name          = TYPE_XEN_PLATFORM,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIXenPlatformState),
     .class_init    = xen_platform_class_init,
commit b7578eaadd71fd7a9101875a32d64a52149d78e5
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 15:15:15 2013 +0200

    misc/ivshmem: QOM parent field cleanup
    
    Replace direct uses of IVShmemState::dev with QOM casts and rename it to
    parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 5df29c1..4a74856 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -63,7 +63,10 @@ typedef struct EventfdEntry {
 } EventfdEntry;
 
 typedef struct IVShmemState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     uint32_t intrmask;
     uint32_t intrstatus;
     uint32_t doorbell;
@@ -120,6 +123,7 @@ static inline bool is_power_of_two(uint64_t x) {
 /* accessing registers - based on rtl8139 */
 static void ivshmem_update_irq(IVShmemState *s, int val)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     int isr;
     isr = (s->intrstatus & s->intrmask) & 0xffffffff;
 
@@ -129,7 +133,7 @@ static void ivshmem_update_irq(IVShmemState *s, int val)
            isr ? 1 : 0, s->intrstatus, s->intrmask);
     }
 
-    qemu_set_irq(s->dev.irq[0], (isr != 0));
+    qemu_set_irq(d->irq[0], (isr != 0));
 }
 
 static void ivshmem_IntrMask_write(IVShmemState *s, uint32_t val)
@@ -300,7 +304,7 @@ static CharDriverState* create_eventfd_chr_device(void * opaque, EventNotifier *
 
     /* if MSI is supported we need multiple interrupts */
     if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
-        s->eventfd_table[vector].pdev = &s->dev;
+        s->eventfd_table[vector].pdev = PCI_DEVICE(s);
         s->eventfd_table[vector].vector = vector;
 
         qemu_chr_add_handlers(chr, ivshmem_can_receive, fake_irqfd,
@@ -349,7 +353,7 @@ static void create_shared_memory_BAR(IVShmemState *s, int fd) {
     memory_region_add_subregion(&s->bar, 0, &s->ivshmem);
 
     /* region for shared memory */
-    pci_register_bar(&s->dev, 2, s->ivshmem_attr, &s->bar);
+    pci_register_bar(PCI_DEVICE(s), 2, s->ivshmem_attr, &s->bar);
 }
 
 static void ivshmem_add_eventfd(IVShmemState *s, int posn, int i)
@@ -525,14 +529,15 @@ static void ivshmem_read(void *opaque, const uint8_t * buf, int flags)
  * we just enable all vectors on init and after reset. */
 static void ivshmem_use_msix(IVShmemState * s)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     int i;
 
-    if (!msix_present(&s->dev)) {
+    if (!msix_present(d)) {
         return;
     }
 
     for (i = 0; i < s->vectors; i++) {
-        msix_vector_use(&s->dev, i);
+        msix_vector_use(d, i);
     }
 }
 
@@ -573,7 +578,7 @@ static uint64_t ivshmem_get_size(IVShmemState * s) {
 
 static void ivshmem_setup_msi(IVShmemState * s)
 {
-    if (msix_init_exclusive_bar(&s->dev, s->vectors, 1)) {
+    if (msix_init_exclusive_bar(PCI_DEVICE(s), s->vectors, 1)) {
         IVSHMEM_DPRINTF("msix initialization failed\n");
         exit(1);
     }
@@ -589,12 +594,13 @@ static void ivshmem_setup_msi(IVShmemState * s)
 static void ivshmem_save(QEMUFile* f, void *opaque)
 {
     IVShmemState *proxy = opaque;
+    PCIDevice *pci_dev = PCI_DEVICE(proxy);
 
     IVSHMEM_DPRINTF("ivshmem_save\n");
-    pci_device_save(&proxy->dev, f);
+    pci_device_save(pci_dev, f);
 
     if (ivshmem_has_feature(proxy, IVSHMEM_MSI)) {
-        msix_save(&proxy->dev, f);
+        msix_save(pci_dev, f);
     } else {
         qemu_put_be32(f, proxy->intrstatus);
         qemu_put_be32(f, proxy->intrmask);
@@ -607,6 +613,7 @@ static int ivshmem_load(QEMUFile* f, void *opaque, int version_id)
     IVSHMEM_DPRINTF("ivshmem_load\n");
 
     IVShmemState *proxy = opaque;
+    PCIDevice *pci_dev = PCI_DEVICE(proxy);
     int ret;
 
     if (version_id > 0) {
@@ -618,13 +625,13 @@ static int ivshmem_load(QEMUFile* f, void *opaque, int version_id)
         return -EINVAL;
     }
 
-    ret = pci_device_load(&proxy->dev, f);
+    ret = pci_device_load(pci_dev, f);
     if (ret) {
         return ret;
     }
 
     if (ivshmem_has_feature(proxy, IVSHMEM_MSI)) {
-        msix_load(&proxy->dev, f);
+        msix_load(pci_dev, f);
 	ivshmem_use_msix(proxy);
     } else {
         proxy->intrstatus = qemu_get_be32(f);
@@ -682,7 +689,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
         migrate_add_blocker(s->migration_blocker);
     }
 
-    pci_conf = s->dev.config;
+    pci_conf = dev->config;
     pci_conf[PCI_COMMAND] = PCI_COMMAND_IO | PCI_COMMAND_MEMORY;
 
     pci_config_set_interrupt_pin(pci_conf, 1);
@@ -693,7 +700,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
                           "ivshmem-mmio", IVSHMEM_REG_BAR_SIZE);
 
     /* region for registers*/
-    pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
                      &s->ivshmem_mmio);
 
     memory_region_init(&s->bar, OBJECT(s), "ivshmem-bar2-container", s->ivshmem_size);
@@ -727,7 +734,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
         /* allocate/initialize space for interrupt handling */
         s->peers = g_malloc0(s->nb_peers * sizeof(Peer));
 
-        pci_register_bar(&s->dev, 2, s->ivshmem_attr, &s->bar);
+        pci_register_bar(dev, 2, s->ivshmem_attr, &s->bar);
 
         s->eventfd_chr = g_malloc0(s->vectors * sizeof(CharDriverState *));
 
@@ -768,7 +775,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
 
     }
 
-    s->dev.config_write = ivshmem_write_config;
+    dev->config_write = ivshmem_write_config;
 
     return 0;
 }
commit eb3fedf3d4b1a3ed2a31def23e972aa0c3669fff
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:59:29 2013 +1000

    misc/ivshmem: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    [AF: Simplified casts and converted two more DO_UPCAST()s]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 3594b84..5df29c1 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -48,6 +48,10 @@
 #define IVSHMEM_DPRINTF(fmt, ...)
 #endif
 
+#define TYPE_IVSHMEM "ivshmem"
+#define IVSHMEM(obj) \
+    OBJECT_CHECK(IVShmemState, (obj), TYPE_IVSHMEM)
+
 typedef struct Peer {
     int nb_eventfds;
     EventNotifier *eventfds;
@@ -341,7 +345,7 @@ static void create_shared_memory_BAR(IVShmemState *s, int fd) {
 
     memory_region_init_ram_ptr(&s->ivshmem, OBJECT(s), "ivshmem.bar2",
                                s->ivshmem_size, ptr);
-    vmstate_register_ram(&s->ivshmem, &s->dev.qdev);
+    vmstate_register_ram(&s->ivshmem, DEVICE(s));
     memory_region_add_subregion(&s->bar, 0, &s->ivshmem);
 
     /* region for shared memory */
@@ -469,7 +473,7 @@ static void ivshmem_read(void *opaque, const uint8_t * buf, int flags)
                                                             incoming_fd, 0);
         memory_region_init_ram_ptr(&s->ivshmem, OBJECT(s),
                                    "ivshmem.bar2", s->ivshmem_size, map_ptr);
-        vmstate_register_ram(&s->ivshmem, &s->dev.qdev);
+        vmstate_register_ram(&s->ivshmem, DEVICE(s));
 
         IVSHMEM_DPRINTF("guest h/w addr = %" PRIu64 ", size = %" PRIu64 "\n",
                          s->ivshmem_offset, s->ivshmem_size);
@@ -534,7 +538,7 @@ static void ivshmem_use_msix(IVShmemState * s)
 
 static void ivshmem_reset(DeviceState *d)
 {
-    IVShmemState *s = DO_UPCAST(IVShmemState, dev.qdev, d);
+    IVShmemState *s = IVSHMEM(d);
 
     s->intrstatus = 0;
     ivshmem_use_msix(s);
@@ -639,7 +643,7 @@ static void ivshmem_write_config(PCIDevice *pci_dev, uint32_t address,
 
 static int pci_ivshmem_init(PCIDevice *dev)
 {
-    IVShmemState *s = DO_UPCAST(IVShmemState, dev, dev);
+    IVShmemState *s = IVSHMEM(dev);
     uint8_t *pci_conf;
 
     if (s->sizearg == NULL)
@@ -648,7 +652,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
         s->ivshmem_size = ivshmem_get_size(s);
     }
 
-    register_savevm(&s->dev.qdev, "ivshmem", 0, 0, ivshmem_save, ivshmem_load,
+    register_savevm(DEVICE(dev), "ivshmem", 0, 0, ivshmem_save, ivshmem_load,
                                                                         dev);
 
     /* IRQFD requires MSI */
@@ -771,7 +775,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
 
 static void pci_ivshmem_uninit(PCIDevice *dev)
 {
-    IVShmemState *s = DO_UPCAST(IVShmemState, dev, dev);
+    IVShmemState *s = IVSHMEM(dev);
 
     if (s->migration_blocker) {
         migrate_del_blocker(s->migration_blocker);
@@ -780,10 +784,10 @@ static void pci_ivshmem_uninit(PCIDevice *dev)
 
     memory_region_destroy(&s->ivshmem_mmio);
     memory_region_del_subregion(&s->bar, &s->ivshmem);
-    vmstate_unregister_ram(&s->ivshmem, &s->dev.qdev);
+    vmstate_unregister_ram(&s->ivshmem, DEVICE(dev));
     memory_region_destroy(&s->ivshmem);
     memory_region_destroy(&s->bar);
-    unregister_savevm(&dev->qdev, "ivshmem", s);
+    unregister_savevm(DEVICE(dev), "ivshmem", s);
 }
 
 static Property ivshmem_properties[] = {
@@ -813,7 +817,7 @@ static void ivshmem_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ivshmem_info = {
-    .name          = "ivshmem",
+    .name          = TYPE_IVSHMEM,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(IVShmemState),
     .class_init    = ivshmem_class_init,
commit af21c7403902d5073851ea10371d0761f48e39d1
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 15:01:36 2013 +0200

    display/vmware_vga: QOM parent field cleanup
    
    Replace direct uses of pci_vmsvga_state_s::card with QOM casts and
    rename it to parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 32637e7..3536cde 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -87,7 +87,10 @@ struct vmsvga_state_s {
     OBJECT_CHECK(struct pci_vmsvga_state_s, (obj), TYPE_VMWARE_SVGA)
 
 struct pci_vmsvga_state_s {
-    PCIDevice card;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     struct vmsvga_state_s chip;
     MemoryRegion io_bar;
 };
@@ -792,7 +795,7 @@ static uint32_t vmsvga_value_read(void *opaque, uint32_t address)
     case SVGA_REG_FB_START: {
         struct pci_vmsvga_state_s *pci_vmsvga
             = container_of(s, struct pci_vmsvga_state_s, chip);
-        ret = pci_get_bar_addr(&pci_vmsvga->card, 1);
+        ret = pci_get_bar_addr(PCI_DEVICE(pci_vmsvga), 1);
         break;
     }
 
@@ -828,7 +831,7 @@ static uint32_t vmsvga_value_read(void *opaque, uint32_t address)
     case SVGA_REG_MEM_START: {
         struct pci_vmsvga_state_s *pci_vmsvga
             = container_of(s, struct pci_vmsvga_state_s, chip);
-        ret = pci_get_bar_addr(&pci_vmsvga->card, 2);
+        ret = pci_get_bar_addr(PCI_DEVICE(pci_vmsvga), 2);
         break;
     }
 
@@ -1176,7 +1179,7 @@ static const VMStateDescription vmstate_vmware_vga = {
     .minimum_version_id = 0,
     .minimum_version_id_old = 0,
     .fields      = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(card, struct pci_vmsvga_state_s),
+        VMSTATE_PCI_DEVICE(parent_obj, struct pci_vmsvga_state_s),
         VMSTATE_STRUCT(chip, struct pci_vmsvga_state_s, 0,
                        vmstate_vmware_vga_internal, struct vmsvga_state_s),
         VMSTATE_END_OF_LIST()
@@ -1256,21 +1259,21 @@ static int pci_vmsvga_initfn(PCIDevice *dev)
 {
     struct pci_vmsvga_state_s *s = VMWARE_SVGA(dev);
 
-    s->card.config[PCI_CACHE_LINE_SIZE] = 0x08;         /* Cache line size */
-    s->card.config[PCI_LATENCY_TIMER] = 0x40;           /* Latency timer */
-    s->card.config[PCI_INTERRUPT_LINE] = 0xff;          /* End */
+    dev->config[PCI_CACHE_LINE_SIZE] = 0x08;
+    dev->config[PCI_LATENCY_TIMER] = 0x40;
+    dev->config[PCI_INTERRUPT_LINE] = 0xff;          /* End */
 
     memory_region_init_io(&s->io_bar, NULL, &vmsvga_io_ops, &s->chip,
                           "vmsvga-io", 0x10);
     memory_region_set_flush_coalesced(&s->io_bar);
-    pci_register_bar(&s->card, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
 
     vmsvga_init(DEVICE(dev), &s->chip,
                 pci_address_space(dev), pci_address_space_io(dev));
 
-    pci_register_bar(&s->card, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
+    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
                      &s->chip.vga.vram);
-    pci_register_bar(&s->card, 2, PCI_BASE_ADDRESS_MEM_PREFETCH,
+    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_MEM_PREFETCH,
                      &s->chip.fifo_ram);
 
     if (!dev->rom_bar) {
commit 39d4598763a01816feb828be4633ada780a63886
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:58:45 2013 +1000

    display/vmware_vga: QOM casting sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST() and
    direct -> style casting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    [AF: Renamed to TYPE_VMWARE_VGA and VMWARE_VGA()]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 714908f..32637e7 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -81,6 +81,11 @@ struct vmsvga_state_s {
     int redraw_fifo_first, redraw_fifo_last;
 };
 
+#define TYPE_VMWARE_SVGA "vmware-svga"
+
+#define VMWARE_SVGA(obj) \
+    OBJECT_CHECK(struct pci_vmsvga_state_s, (obj), TYPE_VMWARE_SVGA)
+
 struct pci_vmsvga_state_s {
     PCIDevice card;
     struct vmsvga_state_s chip;
@@ -1092,8 +1097,7 @@ static void vmsvga_update_display(void *opaque)
 
 static void vmsvga_reset(DeviceState *dev)
 {
-    struct pci_vmsvga_state_s *pci =
-        DO_UPCAST(struct pci_vmsvga_state_s, card.qdev, dev);
+    struct pci_vmsvga_state_s *pci = VMWARE_SVGA(dev);
     struct vmsvga_state_s *s = &pci->chip;
 
     s->index = 0;
@@ -1250,8 +1254,7 @@ static const MemoryRegionOps vmsvga_io_ops = {
 
 static int pci_vmsvga_initfn(PCIDevice *dev)
 {
-    struct pci_vmsvga_state_s *s =
-        DO_UPCAST(struct pci_vmsvga_state_s, card, dev);
+    struct pci_vmsvga_state_s *s = VMWARE_SVGA(dev);
 
     s->card.config[PCI_CACHE_LINE_SIZE] = 0x08;         /* Cache line size */
     s->card.config[PCI_LATENCY_TIMER] = 0x40;           /* Latency timer */
@@ -1303,7 +1306,7 @@ static void vmsvga_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo vmsvga_info = {
-    .name          = "vmware-svga",
+    .name          = TYPE_VMWARE_SVGA,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(struct pci_vmsvga_state_s),
     .class_init    = vmsvga_class_init,
commit 6d27a4099e46132768256b686ebf522844a180b6
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 14:48:56 2013 +0200

    misc/pci-testdev: QOM parent field cleanup
    
    Replace direct uses of PCITestDevState::dev with QOM casts and rename it
    to parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index 3fb15c0..d69ff33 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -76,7 +76,10 @@ enum {
 #define IOTEST_ACCESS_WIDTH (sizeof(uint8_t))
 
 typedef struct PCITestDevState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion mmio;
     MemoryRegion portio;
     IOTest *tests;
@@ -237,7 +240,7 @@ static int pci_testdev_init(PCIDevice *pci_dev)
     char *name;
     int r, i;
 
-    pci_conf = d->dev.config;
+    pci_conf = pci_dev->config;
 
     pci_conf[PCI_INTERRUPT_PIN] = 0; /* no interrupt pin */
 
@@ -245,8 +248,8 @@ static int pci_testdev_init(PCIDevice *pci_dev)
                           "pci-testdev-mmio", IOTEST_MEMSIZE * 2);
     memory_region_init_io(&d->portio, OBJECT(d), &pci_testdev_pio_ops, d,
                           "pci-testdev-portio", IOTEST_IOSIZE * 2);
-    pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
-    pci_register_bar(&d->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->portio);
+    pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
+    pci_register_bar(pci_dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->portio);
 
     d->current = -1;
     d->tests = g_malloc0(IOTEST_MAX * sizeof *d->tests);
commit 40108d0a6d1e59aa5904298874753fe0cb420a64
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:58:00 2013 +1000

    misc/pci-testdev: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    [AF: Replaced another DO_UPCAST()]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index 8b0b73f..3fb15c0 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -83,6 +83,11 @@ typedef struct PCITestDevState {
     int current;
 } PCITestDevState;
 
+#define TYPE_PCI_TEST_DEV "pci-testdev"
+
+#define PCI_TEST_DEV(obj) \
+    OBJECT_CHECK(PCITestDevState, (obj), TYPE_PCI_TEST_DEV)
+
 #define IOTEST_IS_MEM(i) (strcmp(IOTEST_TYPE(i), "portio"))
 #define IOTEST_REGION(d, i) (IOTEST_IS_MEM(i) ?  &(d)->mmio : &(d)->portio)
 #define IOTEST_SIZE(i) (IOTEST_IS_MEM(i) ? IOTEST_MEMSIZE : IOTEST_IOSIZE)
@@ -227,7 +232,7 @@ static const MemoryRegionOps pci_testdev_pio_ops = {
 
 static int pci_testdev_init(PCIDevice *pci_dev)
 {
-    PCITestDevState *d = DO_UPCAST(PCITestDevState, dev, pci_dev);
+    PCITestDevState *d = PCI_TEST_DEV(pci_dev);
     uint8_t *pci_conf;
     char *name;
     int r, i;
@@ -274,7 +279,7 @@ static int pci_testdev_init(PCIDevice *pci_dev)
 static void
 pci_testdev_uninit(PCIDevice *dev)
 {
-    PCITestDevState *d = DO_UPCAST(PCITestDevState, dev, dev);
+    PCITestDevState *d = PCI_TEST_DEV(dev);
     int i;
 
     pci_testdev_reset(d);
@@ -291,7 +296,7 @@ pci_testdev_uninit(PCIDevice *dev)
 
 static void qdev_pci_testdev_reset(DeviceState *dev)
 {
-    PCITestDevState *d = DO_UPCAST(PCITestDevState, dev.qdev, dev);
+    PCITestDevState *d = PCI_TEST_DEV(dev);
     pci_testdev_reset(d);
 }
 
@@ -311,7 +316,7 @@ static void pci_testdev_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pci_testdev_info = {
-    .name          = "pci-testdev",
+    .name          = TYPE_PCI_TEST_DEV,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCITestDevState),
     .class_init    = pci_testdev_class_init,
commit 6a6b5580bd03fc7326716ebb36b1f42ebfc0a967
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 14:40:37 2013 +0200

    acpi/piix4: QOM parent field cleanup
    
    Replace direct uses of PIIX4PMState::dev with QOM casts and rename it to
    parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 5cd286e..c885690 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -64,7 +64,9 @@ typedef struct CPUStatus {
 } CPUStatus;
 
 typedef struct PIIX4PMState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
 
     MemoryRegion io;
     MemoryRegion io_gpe;
@@ -135,11 +137,12 @@ static void pm_tmr_timer(ACPIREGS *ar)
 static void apm_ctrl_changed(uint32_t val, void *arg)
 {
     PIIX4PMState *s = arg;
+    PCIDevice *d = PCI_DEVICE(s);
 
     /* ACPI specs 3.0, 4.7.2.5 */
     acpi_pm1_cnt_update(&s->ar, val == ACPI_ENABLE, val == ACPI_DISABLE);
 
-    if (s->dev.config[0x5b] & (1 << 1)) {
+    if (d->config[0x5b] & (1 << 1)) {
         if (s->smi_irq) {
             qemu_irq_raise(s->smi_irq);
         }
@@ -148,24 +151,27 @@ static void apm_ctrl_changed(uint32_t val, void *arg)
 
 static void pm_io_space_update(PIIX4PMState *s)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     uint32_t pm_io_base;
 
-    pm_io_base = le32_to_cpu(*(uint32_t *)(s->dev.config + 0x40));
+    pm_io_base = le32_to_cpu(*(uint32_t *)(d->config + 0x40));
     pm_io_base &= 0xffc0;
 
     memory_region_transaction_begin();
-    memory_region_set_enabled(&s->io, s->dev.config[0x80] & 1);
+    memory_region_set_enabled(&s->io, d->config[0x80] & 1);
     memory_region_set_address(&s->io, pm_io_base);
     memory_region_transaction_commit();
 }
 
 static void smbus_io_space_update(PIIX4PMState *s)
 {
-    s->smb_io_base = le32_to_cpu(*(uint32_t *)(s->dev.config + 0x90));
+    PCIDevice *d = PCI_DEVICE(s);
+
+    s->smb_io_base = le32_to_cpu(*(uint32_t *)(d->config + 0x90));
     s->smb_io_base &= 0xffc0;
 
     memory_region_transaction_begin();
-    memory_region_set_enabled(&s->smb.io, s->dev.config[0xd2] & 1);
+    memory_region_set_enabled(&s->smb.io, d->config[0xd2] & 1);
     memory_region_set_address(&s->smb.io, s->smb_io_base);
     memory_region_transaction_commit();
 }
@@ -244,7 +250,7 @@ static int acpi_load_old(QEMUFile *f, void *opaque, int version_id)
     int ret, i;
     uint16_t temp;
 
-    ret = pci_device_load(&s->dev, f);
+    ret = pci_device_load(PCI_DEVICE(s), f);
     if (ret < 0) {
         return ret;
     }
@@ -288,7 +294,7 @@ static const VMStateDescription vmstate_acpi = {
     .load_state_old = acpi_load_old,
     .post_load = vmstate_acpi_post_load,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, PIIX4PMState),
+        VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
         VMSTATE_UINT16(ar.pm1.evt.sts, PIIX4PMState),
         VMSTATE_UINT16(ar.pm1.evt.en, PIIX4PMState),
         VMSTATE_UINT16(ar.pm1.cnt.cnt, PIIX4PMState),
@@ -359,7 +365,8 @@ static void piix4_update_hotplug(PIIX4PMState *s)
 static void piix4_reset(void *opaque)
 {
     PIIX4PMState *s = opaque;
-    uint8_t *pci_conf = s->dev.config;
+    PCIDevice *d = PCI_DEVICE(s);
+    uint8_t *pci_conf = d->config;
 
     pci_conf[0x58] = 0;
     pci_conf[0x59] = 0;
@@ -387,10 +394,11 @@ static void piix4_pm_powerdown_req(Notifier *n, void *opaque)
 static void piix4_pm_machine_ready(Notifier *n, void *opaque)
 {
     PIIX4PMState *s = container_of(n, PIIX4PMState, machine_ready);
-    MemoryRegion *io_as = pci_address_space_io(&s->dev);
+    PCIDevice *d = PCI_DEVICE(s);
+    MemoryRegion *io_as = pci_address_space_io(d);
     uint8_t *pci_conf;
 
-    pci_conf = s->dev.config;
+    pci_conf = d->config;
     pci_conf[0x5f] = 0x10 |
         (memory_region_present(io_as, 0x378) ? 0x80 : 0);
     pci_conf[0x63] = 0x60;
@@ -403,7 +411,7 @@ static int piix4_pm_initfn(PCIDevice *dev)
     PIIX4PMState *s = PIIX4_PM(dev);
     uint8_t *pci_conf;
 
-    pci_conf = s->dev.config;
+    pci_conf = dev->config;
     pci_conf[0x06] = 0x80;
     pci_conf[0x07] = 0x02;
     pci_conf[0x09] = 0x00;
commit 74e445f6492b315c18e96daa6acb4d50405a0ad9
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:57:14 2013 +1000

    acpi/piix4: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 948ea87..5cd286e 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -96,6 +96,11 @@ typedef struct PIIX4PMState {
     Notifier cpu_added_notifier;
 } PIIX4PMState;
 
+#define TYPE_PIIX4_PM "PIIX4_PM"
+
+#define PIIX4_PM(obj) \
+    OBJECT_CHECK(PIIX4PMState, (obj), TYPE_PIIX4_PM)
+
 static void piix4_acpi_system_hot_add_init(MemoryRegion *parent,
                                            PCIBus *bus, PIIX4PMState *s);
 
@@ -300,7 +305,7 @@ static const VMStateDescription vmstate_acpi = {
 static void acpi_piix_eject_slot(PIIX4PMState *s, unsigned slots)
 {
     BusChild *kid, *next;
-    BusState *bus = qdev_get_parent_bus(&s->dev.qdev);
+    BusState *bus = qdev_get_parent_bus(DEVICE(s));
     int slot = ffs(slots) - 1;
     bool slot_free = true;
 
@@ -326,8 +331,7 @@ static void acpi_piix_eject_slot(PIIX4PMState *s, unsigned slots)
 
 static void piix4_update_hotplug(PIIX4PMState *s)
 {
-    PCIDevice *dev = &s->dev;
-    BusState *bus = qdev_get_parent_bus(&dev->qdev);
+    BusState *bus = qdev_get_parent_bus(DEVICE(s));
     BusChild *kid, *next;
 
     /* Execute any pending removes during reset */
@@ -396,7 +400,7 @@ static void piix4_pm_machine_ready(Notifier *n, void *opaque)
 
 static int piix4_pm_initfn(PCIDevice *dev)
 {
-    PIIX4PMState *s = DO_UPCAST(PIIX4PMState, dev, dev);
+    PIIX4PMState *s = PIIX4_PM(dev);
     uint8_t *pci_conf;
 
     pci_conf = s->dev.config;
@@ -419,7 +423,7 @@ static int piix4_pm_initfn(PCIDevice *dev)
     pci_conf[0x90] = s->smb_io_base | 1;
     pci_conf[0x91] = s->smb_io_base >> 8;
     pci_conf[0xd2] = 0x09;
-    pm_smbus_init(&s->dev.qdev, &s->smb);
+    pm_smbus_init(DEVICE(dev), &s->smb);
     memory_region_set_enabled(&s->smb.io, pci_conf[0xd2] & 1);
     memory_region_add_subregion(pci_address_space_io(dev),
                                 s->smb_io_base, &s->smb.io);
@@ -450,18 +454,18 @@ i2c_bus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base,
                        qemu_irq sci_irq, qemu_irq smi_irq,
                        int kvm_enabled, FWCfgState *fw_cfg)
 {
-    PCIDevice *dev;
+    DeviceState *dev;
     PIIX4PMState *s;
 
-    dev = pci_create(bus, devfn, "PIIX4_PM");
-    qdev_prop_set_uint32(&dev->qdev, "smb_io_base", smb_io_base);
+    dev = DEVICE(pci_create(bus, devfn, TYPE_PIIX4_PM));
+    qdev_prop_set_uint32(dev, "smb_io_base", smb_io_base);
 
-    s = DO_UPCAST(PIIX4PMState, dev, dev);
+    s = PIIX4_PM(dev);
     s->irq = sci_irq;
     s->smi_irq = smi_irq;
     s->kvm_enabled = kvm_enabled;
 
-    qdev_init_nofail(&dev->qdev);
+    qdev_init_nofail(dev);
 
     if (fw_cfg) {
         uint8_t suspend[6] = {128, 0, 0, 129, 128, 128};
@@ -501,7 +505,7 @@ static void piix4_pm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo piix4_pm_info = {
-    .name          = "PIIX4_PM",
+    .name          = TYPE_PIIX4_PM,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PIIX4PMState),
     .class_init    = piix4_pm_class_init,
@@ -679,7 +683,7 @@ static void piix4_acpi_system_hot_add_init(MemoryRegion *parent,
                           "acpi-pci-hotplug", PCI_HOTPLUG_SIZE);
     memory_region_add_subregion(parent, PCI_HOTPLUG_ADDR,
                                 &s->io_pci);
-    pci_bus_hotplug(bus, piix4_device_hotplug, &s->dev.qdev);
+    pci_bus_hotplug(bus, piix4_device_hotplug, DEVICE(s));
 
     qemu_for_each_cpu(piix4_init_cpu_status, &s->gpe_cpu);
     memory_region_init_io(&s->io_cpu, OBJECT(s), &cpu_hotplug_ops, s,
@@ -705,8 +709,7 @@ static int piix4_device_hotplug(DeviceState *qdev, PCIDevice *dev,
 				PCIHotplugState state)
 {
     int slot = PCI_SLOT(dev->devfn);
-    PIIX4PMState *s = DO_UPCAST(PIIX4PMState, dev,
-                                PCI_DEVICE(qdev));
+    PIIX4PMState *s = PIIX4_PM(qdev);
 
     /* Don't send event when device is enabled during qemu machine creation:
      * it is present on boot, no hotplug event is necessary. We do send an
commit 0d3aea5603215b872b6580662d27860eecd6ca24
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 14:19:24 2013 +0200

    ide/ich: QOM parent field cleanup
    
    Replace direct uses of AHCIPCIState::card with QOM casts and rename it
    to parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 1d863b5..f295732 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -117,12 +117,13 @@ static uint32_t  ahci_port_read(AHCIState *s, int port, int offset)
 
 static void ahci_irq_raise(AHCIState *s, AHCIDevice *dev)
 {
-    struct AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
+    AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
+    PCIDevice *pci_dev = PCI_DEVICE(d);
 
     DPRINTF(0, "raise irq\n");
 
-    if (msi_enabled(&d->card)) {
-        msi_notify(&d->card, 0);
+    if (msi_enabled(pci_dev)) {
+        msi_notify(pci_dev, 0);
     } else {
         qemu_irq_raise(s->irq);
     }
@@ -130,11 +131,11 @@ static void ahci_irq_raise(AHCIState *s, AHCIDevice *dev)
 
 static void ahci_irq_lower(AHCIState *s, AHCIDevice *dev)
 {
-    struct AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
+    AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
 
     DPRINTF(0, "lower irq\n");
 
-    if (!msi_enabled(&d->card)) {
+    if (!msi_enabled(PCI_DEVICE(d))) {
         qemu_irq_lower(s->irq);
     }
 }
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index f997c67..20e412c 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -301,7 +301,10 @@ typedef struct AHCIState {
 } AHCIState;
 
 typedef struct AHCIPCIState {
-    PCIDevice card;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     AHCIState ahci;
 } AHCIPCIState;
 
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index a6f78dc..4eb5488 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -84,7 +84,7 @@ static const VMStateDescription vmstate_ich9_ahci = {
     .unmigratable = 1, /* Still buggy under I/O load */
     .version_id = 1,
     .fields = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(card, AHCIPCIState),
+        VMSTATE_PCI_DEVICE(parent_obj, AHCIPCIState),
         VMSTATE_AHCI(ahci, AHCIPCIState),
         VMSTATE_END_OF_LIST()
     },
@@ -106,30 +106,30 @@ static int pci_ich9_ahci_init(PCIDevice *dev)
 
     ahci_init(&d->ahci, DEVICE(dev), pci_get_address_space(dev), 6);
 
-    pci_config_set_prog_interface(d->card.config, AHCI_PROGMODE_MAJOR_REV_1);
+    pci_config_set_prog_interface(dev->config, AHCI_PROGMODE_MAJOR_REV_1);
 
-    d->card.config[PCI_CACHE_LINE_SIZE] = 0x08;  /* Cache line size */
-    d->card.config[PCI_LATENCY_TIMER]   = 0x00;  /* Latency timer */
-    pci_config_set_interrupt_pin(d->card.config, 1);
+    dev->config[PCI_CACHE_LINE_SIZE] = 0x08;  /* Cache line size */
+    dev->config[PCI_LATENCY_TIMER]   = 0x00;  /* Latency timer */
+    pci_config_set_interrupt_pin(dev->config, 1);
 
     /* XXX Software should program this register */
-    d->card.config[0x90]   = 1 << 6; /* Address Map Register - AHCI mode */
+    dev->config[0x90]   = 1 << 6; /* Address Map Register - AHCI mode */
 
     msi_init(dev, 0x50, 1, true, false);
-    d->ahci.irq = d->card.irq[0];
+    d->ahci.irq = dev->irq[0];
 
-    pci_register_bar(&d->card, ICH9_IDP_BAR, PCI_BASE_ADDRESS_SPACE_IO,
+    pci_register_bar(dev, ICH9_IDP_BAR, PCI_BASE_ADDRESS_SPACE_IO,
                      &d->ahci.idp);
-    pci_register_bar(&d->card, ICH9_MEM_BAR, PCI_BASE_ADDRESS_SPACE_MEMORY,
+    pci_register_bar(dev, ICH9_MEM_BAR, PCI_BASE_ADDRESS_SPACE_MEMORY,
                      &d->ahci.mem);
 
-    sata_cap_offset = pci_add_capability(&d->card, PCI_CAP_ID_SATA,
+    sata_cap_offset = pci_add_capability(dev, PCI_CAP_ID_SATA,
                                          ICH9_SATA_CAP_OFFSET, SATA_CAP_SIZE);
     if (sata_cap_offset < 0) {
         return sata_cap_offset;
     }
 
-    sata_cap = d->card.config + sata_cap_offset;
+    sata_cap = dev->config + sata_cap_offset;
     pci_set_word(sata_cap + SATA_CAP_REV, 0x10);
     pci_set_long(sata_cap + SATA_CAP_BAR,
                  (ICH9_IDP_BAR + 0x4) | (ICH9_IDP_INDEX_LOG2 << 4));
commit fd58922cf4ea09c8dbd2d46dd61e50e6559bf447
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:55:45 2013 +1000

    ide/ich: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    [AF: Renamed to TYPE_ICH9_AHCI and used typedef in pci_ich9_reset()]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index 341a571..f997c67 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -305,6 +305,11 @@ typedef struct AHCIPCIState {
     AHCIState ahci;
 } AHCIPCIState;
 
+#define TYPE_ICH9_AHCI "ich9-ahci"
+
+#define ICH_AHCI(obj) \
+    OBJECT_CHECK(AHCIPCIState, (obj), TYPE_ICH9_AHCI)
+
 extern const VMStateDescription vmstate_ahci;
 
 #define VMSTATE_AHCI(_field, _state) {                               \
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index 6c0c0c2..a6f78dc 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -92,7 +92,7 @@ static const VMStateDescription vmstate_ich9_ahci = {
 
 static void pci_ich9_reset(DeviceState *dev)
 {
-    struct AHCIPCIState *d = DO_UPCAST(struct AHCIPCIState, card.qdev, dev);
+    AHCIPCIState *d = ICH_AHCI(dev);
 
     ahci_reset(&d->ahci);
 }
@@ -102,9 +102,9 @@ static int pci_ich9_ahci_init(PCIDevice *dev)
     struct AHCIPCIState *d;
     int sata_cap_offset;
     uint8_t *sata_cap;
-    d = DO_UPCAST(struct AHCIPCIState, card, dev);
+    d = ICH_AHCI(dev);
 
-    ahci_init(&d->ahci, &dev->qdev, pci_get_address_space(dev), 6);
+    ahci_init(&d->ahci, DEVICE(dev), pci_get_address_space(dev), 6);
 
     pci_config_set_prog_interface(d->card.config, AHCI_PROGMODE_MAJOR_REV_1);
 
@@ -141,7 +141,7 @@ static int pci_ich9_ahci_init(PCIDevice *dev)
 static void pci_ich9_uninit(PCIDevice *dev)
 {
     struct AHCIPCIState *d;
-    d = DO_UPCAST(struct AHCIPCIState, card, dev);
+    d = ICH_AHCI(dev);
 
     msi_uninit(dev);
     ahci_uninit(&d->ahci);
@@ -163,7 +163,7 @@ static void ich_ahci_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ich_ahci_info = {
-    .name          = "ich9-ahci",
+    .name          = TYPE_ICH9_AHCI,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(AHCIPCIState),
     .class_init    = ich_ahci_class_init,
commit 4e5dcc774a4003e313b6eec823067b3980b0bc91
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 14:07:49 2013 +0200

    scsi/esp-pci: QOM parent field cleanup
    
    Replace direct uses of PCIESPState::dev with QOM casts and rename it to
    parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index ab1fa85..6cdfd53 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -60,7 +60,10 @@
 #define SBAC_STATUS 0x1000
 
 typedef struct PCIESPState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion io;
     uint32_t dma_regs[8];
     uint32_t sbac;
@@ -260,7 +263,7 @@ static void esp_pci_dma_memory_rw(PCIESPState *pci, uint8_t *buf, int len,
         len = pci->dma_regs[DMA_WBC];
     }
 
-    pci_dma_rw(&pci->dev, addr, buf, len, dir);
+    pci_dma_rw(PCI_DEVICE(pci), addr, buf, len, dir);
 
     /* update status registers */
     pci->dma_regs[DMA_WBC] -= len;
@@ -309,7 +312,7 @@ static const VMStateDescription vmstate_esp_pci_scsi = {
     .minimum_version_id = 0,
     .minimum_version_id_old = 0,
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(dev, PCIESPState),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIESPState),
         VMSTATE_BUFFER_UNSAFE(dma_regs, PCIESPState, 0, 8 * sizeof(uint32_t)),
         VMSTATE_STRUCT(esp, PCIESPState, 0, vmstate_esp, ESPState),
         VMSTATE_END_OF_LIST()
@@ -344,7 +347,7 @@ static int esp_pci_scsi_init(PCIDevice *dev)
     ESPState *s = &pci->esp;
     uint8_t *pci_conf;
 
-    pci_conf = pci->dev.config;
+    pci_conf = dev->config;
 
     /* Interrupt pin A */
     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
@@ -356,8 +359,8 @@ static int esp_pci_scsi_init(PCIDevice *dev)
     memory_region_init_io(&pci->io, OBJECT(pci), &esp_pci_io_ops, pci,
                           "esp-io", 0x80);
 
-    pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->io);
-    s->irq = pci->dev.irq[0];
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->io);
+    s->irq = dev->irq[0];
 
     scsi_bus_new(&s->bus, d, &esp_pci_scsi_info, NULL);
     if (!d->hotplugged) {
commit 3a15effe00b5bd223d5932c8d67c9525914a1526
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:55:00 2013 +1000

    scsi/esp-pci: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 8f97c5a..ab1fa85 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -31,6 +31,9 @@
 
 #define TYPE_AM53C974_DEVICE "am53c974"
 
+#define PCI_ESP(obj) \
+    OBJECT_CHECK(PCIESPState, (obj), TYPE_AM53C974_DEVICE)
+
 #define DMA_CMD   0x0
 #define DMA_STC   0x1
 #define DMA_SPA   0x2
@@ -288,7 +291,7 @@ static const MemoryRegionOps esp_pci_io_ops = {
 
 static void esp_pci_hard_reset(DeviceState *dev)
 {
-    PCIESPState *pci = DO_UPCAST(PCIESPState, dev.qdev, dev);
+    PCIESPState *pci = PCI_ESP(dev);
     esp_hard_reset(&pci->esp);
     pci->dma_regs[DMA_CMD] &= ~(DMA_CMD_DIR | DMA_CMD_INTE_D | DMA_CMD_INTE_P
                               | DMA_CMD_MDL | DMA_CMD_DIAG | DMA_CMD_MASK);
@@ -336,7 +339,8 @@ static const struct SCSIBusInfo esp_pci_scsi_info = {
 
 static int esp_pci_scsi_init(PCIDevice *dev)
 {
-    PCIESPState *pci = DO_UPCAST(PCIESPState, dev, dev);
+    PCIESPState *pci = PCI_ESP(dev);
+    DeviceState *d = DEVICE(dev);
     ESPState *s = &pci->esp;
     uint8_t *pci_conf;
 
@@ -355,8 +359,8 @@ static int esp_pci_scsi_init(PCIDevice *dev)
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->io);
     s->irq = pci->dev.irq[0];
 
-    scsi_bus_new(&s->bus, &dev->qdev, &esp_pci_scsi_info, NULL);
-    if (!dev->qdev.hotplugged) {
+    scsi_bus_new(&s->bus, d, &esp_pci_scsi_info, NULL);
+    if (!d->hotplugged) {
         return scsi_bus_legacy_handle_cmdline(&s->bus);
     }
     return 0;
@@ -364,7 +368,7 @@ static int esp_pci_scsi_init(PCIDevice *dev)
 
 static void esp_pci_scsi_uninit(PCIDevice *d)
 {
-    PCIESPState *pci = DO_UPCAST(PCIESPState, dev, d);
+    PCIESPState *pci = PCI_ESP(d);
 
     memory_region_destroy(&pci->io);
 }
commit 52190c1e0a95440e906f3bb7e7c17823f3eac8c0
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 14:02:53 2013 +0200

    scsi/megasas: QOM parent field cleanup
    
    Replace direct uses of MegasasState::dev with QOM casts and rename it to
    parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 0f2a722..55d5b73 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -70,7 +70,10 @@ typedef struct MegasasCmd {
 } MegasasCmd;
 
 typedef struct MegasasState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion mmio_io;
     MemoryRegion port_io;
     MemoryRegion queue_io;
@@ -237,7 +240,7 @@ static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
                                          MEGASAS_MAX_SGE);
         return iov_count;
     }
-    pci_dma_sglist_init(&cmd->qsg, &s->dev, iov_count);
+    pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
     for (i = 0; i < iov_count; i++) {
         dma_addr_t iov_pa, iov_size_p;
 
@@ -498,6 +501,7 @@ static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
 
 static void megasas_complete_frame(MegasasState *s, uint64_t context)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(s);
     int tail, queue_offset;
 
     /* Decrement busy count */
@@ -526,12 +530,12 @@ static void megasas_complete_frame(MegasasState *s, uint64_t context)
         /* Notify HBA */
         s->doorbell++;
         if (s->doorbell == 1) {
-            if (msix_enabled(&s->dev)) {
+            if (msix_enabled(pci_dev)) {
                 trace_megasas_msix_raise(0);
-                msix_notify(&s->dev, 0);
+                msix_notify(pci_dev, 0);
             } else {
                 trace_megasas_irq_raise();
-                qemu_irq_raise(s->dev.irq[0]);
+                qemu_irq_raise(pci_dev->irq[0]);
             }
         }
     } else {
@@ -633,7 +637,7 @@ static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
     }
     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
-    pci_dma_sglist_init(&cmd->qsg, &s->dev, 1);
+    pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
     cmd->iov_size = iov_size;
     return cmd->iov_size;
@@ -660,6 +664,7 @@ static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
 
 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(s);
     struct mfi_ctrl_info info;
     size_t dcmd_size = sizeof(info);
     BusChild *kid;
@@ -710,11 +715,11 @@ static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
     memcpy(info.image_component[0].build_date, __DATE__, 11);
     memcpy(info.image_component[0].build_time, __TIME__, 8);
     info.image_component_count = 1;
-    if (s->dev.has_rom) {
+    if (pci_dev->has_rom) {
         uint8_t biosver[32];
         uint8_t *ptr;
 
-        ptr = memory_region_get_ram_ptr(&s->dev.rom);
+        ptr = memory_region_get_ram_ptr(&pci_dev->rom);
         memcpy(biosver, ptr + 0x41, 31);
         memcpy(info.image_component[1].name, "BIOS", 4);
         memcpy(info.image_component[1].version, biosver,
@@ -1905,6 +1910,7 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
                                uint64_t val, unsigned size)
 {
     MegasasState *s = opaque;
+    PCIDevice *pci_dev = PCI_DEVICE(s);
     uint64_t frame_addr;
     uint32_t frame_count;
     int i;
@@ -1928,9 +1934,9 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
         break;
     case MFI_OMSK:
         s->intr_mask = val;
-        if (!megasas_intr_enabled(s) && !msix_enabled(&s->dev)) {
+        if (!megasas_intr_enabled(s) && !msix_enabled(pci_dev)) {
             trace_megasas_irq_lower();
-            qemu_irq_lower(s->dev.irq[0]);
+            qemu_irq_lower(pci_dev->irq[0]);
         }
         if (megasas_intr_enabled(s)) {
             trace_megasas_intr_enabled();
@@ -1944,9 +1950,9 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
             /* Update reply queue pointer */
             trace_megasas_qf_update(s->reply_queue_head, s->busy);
             stl_le_phys(s->producer_pa, s->reply_queue_head);
-            if (!msix_enabled(&s->dev)) {
+            if (!msix_enabled(pci_dev)) {
                 trace_megasas_irq_lower();
-                qemu_irq_lower(s->dev.irq[0]);
+                qemu_irq_lower(pci_dev->irq[0]);
             }
         }
         break;
@@ -2055,7 +2061,7 @@ static const VMStateDescription vmstate_megasas = {
     .minimum_version_id = 0,
     .minimum_version_id_old = 0,
     .fields      = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(dev, MegasasState),
+        VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
 
         VMSTATE_INT32(fw_state, MegasasState),
         VMSTATE_INT32(intr_mask, MegasasState),
@@ -2072,7 +2078,7 @@ static void megasas_scsi_uninit(PCIDevice *d)
     MegasasState *s = MEGASAS(d);
 
 #ifdef USE_MSIX
-    msix_uninit(&s->dev, &s->mmio_io);
+    msix_uninit(d, &s->mmio_io);
 #endif
     memory_region_destroy(&s->mmio_io);
     memory_region_destroy(&s->port_io);
@@ -2096,7 +2102,7 @@ static int megasas_scsi_init(PCIDevice *dev)
     uint8_t *pci_conf;
     int i, bar_type;
 
-    pci_conf = s->dev.config;
+    pci_conf = dev->config;
 
     /* PCI latency timer = 0 */
     pci_conf[PCI_LATENCY_TIMER] = 0;
@@ -2113,7 +2119,7 @@ static int megasas_scsi_init(PCIDevice *dev)
 #ifdef USE_MSIX
     /* MSI-X support is currently broken */
     if (megasas_use_msix(s) &&
-        msix_init(&s->dev, 15, &s->mmio_io, 0, 0x2000)) {
+        msix_init(dev, 15, &s->mmio_io, 0, 0x2000)) {
         s->flags &= ~MEGASAS_MASK_USE_MSIX;
     }
 #else
@@ -2121,12 +2127,12 @@ static int megasas_scsi_init(PCIDevice *dev)
 #endif
 
     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
-    pci_register_bar(&s->dev, 0, bar_type, &s->mmio_io);
-    pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
-    pci_register_bar(&s->dev, 3, bar_type, &s->queue_io);
+    pci_register_bar(dev, 0, bar_type, &s->mmio_io);
+    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
+    pci_register_bar(dev, 3, bar_type, &s->queue_io);
 
     if (megasas_use_msix(s)) {
-        msix_vector_use(&s->dev, 0);
+        msix_vector_use(dev, 0);
     }
 
     if (!s->sas_addr) {
commit c79e16ae044d265674ef43dfdd694c8fd0f49e19
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:54:15 2013 +1000

    scsi/megasas: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 45d0c77..0f2a722 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -108,6 +108,11 @@ typedef struct MegasasState {
     SCSIBus bus;
 } MegasasState;
 
+#define TYPE_MEGASAS "megasas"
+
+#define MEGASAS(obj) \
+    OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS)
+
 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
 
 static bool megasas_intr_enabled(MegasasState *s)
@@ -2039,7 +2044,7 @@ static void megasas_soft_reset(MegasasState *s)
 
 static void megasas_scsi_reset(DeviceState *dev)
 {
-    MegasasState *s = DO_UPCAST(MegasasState, dev.qdev, dev);
+    MegasasState *s = MEGASAS(dev);
 
     megasas_soft_reset(s);
 }
@@ -2064,7 +2069,7 @@ static const VMStateDescription vmstate_megasas = {
 
 static void megasas_scsi_uninit(PCIDevice *d)
 {
-    MegasasState *s = DO_UPCAST(MegasasState, dev, d);
+    MegasasState *s = MEGASAS(d);
 
 #ifdef USE_MSIX
     msix_uninit(&s->dev, &s->mmio_io);
@@ -2087,7 +2092,7 @@ static const struct SCSIBusInfo megasas_scsi_info = {
 
 static int megasas_scsi_init(PCIDevice *dev)
 {
-    MegasasState *s = DO_UPCAST(MegasasState, dev, dev);
+    MegasasState *s = MEGASAS(dev);
     uint8_t *pci_conf;
     int i, bar_type;
 
@@ -2158,7 +2163,7 @@ static int megasas_scsi_init(PCIDevice *dev)
         s->frames[i].state = s;
     }
 
-    scsi_bus_new(&s->bus, &dev->qdev, &megasas_scsi_info, NULL);
+    scsi_bus_new(&s->bus, DEVICE(dev), &megasas_scsi_info, NULL);
     scsi_bus_legacy_handle_cmdline(&s->bus);
     return 0;
 }
@@ -2198,7 +2203,7 @@ static void megasas_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo megasas_info = {
-    .name  = "megasas",
+    .name  = TYPE_MEGASAS,
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(MegasasState),
     .class_init = megasas_class_init,
commit 725eec7043bd010856899461817ccd2599a09362
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 13:52:22 2013 +0200

    scsi/lsi53c895a: QOM parent field cleanup
    
    Replace direct uses of LSIState::dev with QOM casts and rename it to
    parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index dae467c..e11224f 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -184,7 +184,10 @@ typedef struct lsi_request {
 } lsi_request;
 
 typedef struct {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion mmio_io;
     MemoryRegion ram_io;
     MemoryRegion io_io;
@@ -387,7 +390,7 @@ static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 {
     uint32_t buf;
 
-    pci_dma_read(&s->dev, addr, &buf, 4);
+    pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
     return cpu_to_le32(buf);
 }
 
@@ -398,6 +401,7 @@ static void lsi_stop_script(LSIState *s)
 
 static void lsi_update_irq(LSIState *s)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     int level;
     static int last_level;
     lsi_request *p;
@@ -429,7 +433,7 @@ static void lsi_update_irq(LSIState *s)
                 level, s->dstat, s->sist1, s->sist0);
         last_level = level;
     }
-    qemu_set_irq(s->dev.irq[0], level);
+    qemu_set_irq(d->irq[0], level);
 
     if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
         DPRINTF("Handled IRQs & disconnected, looking for pending "
@@ -525,6 +529,7 @@ static void lsi_bad_selection(LSIState *s, uint32_t id)
 /* Initiate a SCSI layer data transfer.  */
 static void lsi_do_dma(LSIState *s, int out)
 {
+    PCIDevice *pci_dev;
     uint32_t count;
     dma_addr_t addr;
     SCSIDevice *dev;
@@ -536,6 +541,7 @@ static void lsi_do_dma(LSIState *s, int out)
         return;
     }
 
+    pci_dev = PCI_DEVICE(s);
     dev = s->current->req->dev;
     assert(dev);
 
@@ -561,9 +567,9 @@ static void lsi_do_dma(LSIState *s, int out)
     }
     /* ??? Set SFBR to first data byte.  */
     if (out) {
-        pci_dma_read(&s->dev, addr, s->current->dma_buf, count);
+        pci_dma_read(pci_dev, addr, s->current->dma_buf, count);
     } else {
-        pci_dma_write(&s->dev, addr, s->current->dma_buf, count);
+        pci_dma_write(pci_dev, addr, s->current->dma_buf, count);
     }
     s->current->dma_len -= count;
     if (s->current->dma_len == 0) {
@@ -758,7 +764,7 @@ static void lsi_do_command(LSIState *s)
     DPRINTF("Send command len=%d\n", s->dbc);
     if (s->dbc > 16)
         s->dbc = 16;
-    pci_dma_read(&s->dev, s->dnad, buf, s->dbc);
+    pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
     s->sfbr = buf[0];
     s->command_complete = 0;
 
@@ -809,7 +815,7 @@ static void lsi_do_status(LSIState *s)
     s->dbc = 1;
     status = s->status;
     s->sfbr = status;
-    pci_dma_write(&s->dev, s->dnad, &status, 1);
+    pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
     lsi_set_phase(s, PHASE_MI);
     s->msg_action = 1;
     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
@@ -823,7 +829,7 @@ static void lsi_do_msgin(LSIState *s)
     len = s->msg_len;
     if (len > s->dbc)
         len = s->dbc;
-    pci_dma_write(&s->dev, s->dnad, s->msg, len);
+    pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
     /* Linux drivers rely on the last byte being in the SIDL.  */
     s->sidl = s->msg[len - 1];
     s->msg_len -= len;
@@ -855,7 +861,7 @@ static void lsi_do_msgin(LSIState *s)
 static uint8_t lsi_get_msgbyte(LSIState *s)
 {
     uint8_t data;
-    pci_dma_read(&s->dev, s->dnad, &data, 1);
+    pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
     s->dnad++;
     s->dbc--;
     return data;
@@ -1001,14 +1007,15 @@ static inline int32_t sxt24(int32_t n)
 #define LSI_BUF_SIZE 4096
 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     int n;
     uint8_t buf[LSI_BUF_SIZE];
 
     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
     while (count) {
         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
-        pci_dma_read(&s->dev, src, buf, n);
-        pci_dma_write(&s->dev, dest, buf, n);
+        pci_dma_read(d, src, buf, n);
+        pci_dma_write(d, dest, buf, n);
         src += n;
         dest += n;
         count -= n;
@@ -1034,6 +1041,7 @@ static void lsi_wait_reselect(LSIState *s)
 
 static void lsi_execute_script(LSIState *s)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(s);
     uint32_t insn;
     uint32_t addr, addr_high;
     int opcode;
@@ -1076,7 +1084,7 @@ again:
 
             /* 32-bit Table indirect */
             offset = sxt24(addr);
-            pci_dma_read(&s->dev, s->dsa + offset, buf, 8);
+            pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
             /* byte count is stored in bits 0:23 only */
             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
             s->rbc = s->dbc;
@@ -1435,7 +1443,7 @@ again:
             n = (insn & 7);
             reg = (insn >> 16) & 0xff;
             if (insn & (1 << 24)) {
-                pci_dma_read(&s->dev, addr, data, n);
+                pci_dma_read(pci_dev, addr, data, n);
                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
                         addr, *(int *)data);
                 for (i = 0; i < n; i++) {
@@ -1446,7 +1454,7 @@ again:
                 for (i = 0; i < n; i++) {
                     data[i] = lsi_reg_readb(s, reg + i);
                 }
-                pci_dma_write(&s->dev, addr, data, n);
+                pci_dma_write(pci_dev, addr, data, n);
             }
         }
     }
@@ -1988,7 +1996,7 @@ static const VMStateDescription vmstate_lsi_scsi = {
     .minimum_version_id_old = 0,
     .pre_save = lsi_pre_save,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, LSIState),
+        VMSTATE_PCI_DEVICE(parent_obj, LSIState),
 
         VMSTATE_INT32(carry, LSIState),
         VMSTATE_INT32(status, LSIState),
@@ -2089,7 +2097,7 @@ static int lsi_scsi_init(PCIDevice *dev)
     DeviceState *d = DEVICE(dev);
     uint8_t *pci_conf;
 
-    pci_conf = s->dev.config;
+    pci_conf = dev->config;
 
     /* PCI latency timer = 255 */
     pci_conf[PCI_LATENCY_TIMER] = 0xff;
@@ -2103,9 +2111,9 @@ static int lsi_scsi_init(PCIDevice *dev)
     memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
                           "lsi-io", 256);
 
-    pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
-    pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
-    pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
+    pci_register_bar(dev, 1, 0, &s->mmio_io);
+    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
     QTAILQ_INIT(&s->queue);
 
     scsi_bus_new(&s->bus, d, &lsi_scsi_info, NULL);
commit 71186c867caab48d093fe2c8ae7d8f23d59b0aed
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:53:30 2013 +1000

    scsi/lsi53c895a: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 2c17ae5..dae467c 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -275,6 +275,11 @@ typedef struct {
     uint32_t script_ram[2048];
 } LSIState;
 
+#define TYPE_LSI53C895A "lsi53c895a"
+
+#define LSI53C895A(obj) \
+    OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A)
+
 static inline int lsi_irq_on_rsl(LSIState *s)
 {
     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
@@ -653,7 +658,7 @@ static void lsi_request_free(LSIState *s, lsi_request *p)
 
 static void lsi_request_cancelled(SCSIRequest *req)
 {
-    LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
+    LSIState *s = LSI53C895A(req->bus->qbus.parent);
     lsi_request *p = req->hba_private;
 
     req->hba_private = NULL;
@@ -692,7 +697,7 @@ static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
  /* Callback to indicate that the SCSI layer has completed a command.  */
 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 {
-    LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
+    LSIState *s = LSI53C895A(req->bus->qbus.parent);
     int out;
 
     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
@@ -717,7 +722,7 @@ static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid
  /* Callback to indicate that the SCSI layer has completed a transfer.  */
 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
 {
-    LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
+    LSIState *s = LSI53C895A(req->bus->qbus.parent);
     int out;
 
     assert(req->hba_private);
@@ -1726,7 +1731,7 @@ static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
             lsi_execute_script(s);
         }
         if (val & LSI_ISTAT0_SRST) {
-            qdev_reset_all(&s->dev.qdev);
+            qdev_reset_all(DEVICE(s));
         }
         break;
     case 0x16: /* MBOX0 */
@@ -1960,7 +1965,7 @@ static const MemoryRegionOps lsi_io_ops = {
 
 static void lsi_scsi_reset(DeviceState *dev)
 {
-    LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
+    LSIState *s = LSI53C895A(dev);
 
     lsi_soft_reset(s);
 }
@@ -2061,7 +2066,7 @@ static const VMStateDescription vmstate_lsi_scsi = {
 
 static void lsi_scsi_uninit(PCIDevice *d)
 {
-    LSIState *s = DO_UPCAST(LSIState, dev, d);
+    LSIState *s = LSI53C895A(d);
 
     memory_region_destroy(&s->mmio_io);
     memory_region_destroy(&s->ram_io);
@@ -2080,7 +2085,8 @@ static const struct SCSIBusInfo lsi_scsi_info = {
 
 static int lsi_scsi_init(PCIDevice *dev)
 {
-    LSIState *s = DO_UPCAST(LSIState, dev, dev);
+    LSIState *s = LSI53C895A(dev);
+    DeviceState *d = DEVICE(dev);
     uint8_t *pci_conf;
 
     pci_conf = s->dev.config;
@@ -2102,8 +2108,8 @@ static int lsi_scsi_init(PCIDevice *dev)
     pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
     QTAILQ_INIT(&s->queue);
 
-    scsi_bus_new(&s->bus, &dev->qdev, &lsi_scsi_info, NULL);
-    if (!dev->qdev.hotplugged) {
+    scsi_bus_new(&s->bus, d, &lsi_scsi_info, NULL);
+    if (!d->hotplugged) {
         return scsi_bus_legacy_handle_cmdline(&s->bus);
     }
     return 0;
@@ -2125,7 +2131,7 @@ static void lsi_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lsi_info = {
-    .name          = "lsi53c895a",
+    .name          = TYPE_LSI53C895A,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(LSIState),
     .class_init    = lsi_class_init,
commit 9b7d3334d062e8c9e4f1b0ad3df35abb08cd8bf0
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 13:38:41 2013 +0200

    usb/hcd-xhci: QOM parent field cleanup
    
    Replace direct uses of XHCIState::pci_dev with QOM casts and rename it
    to parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 0566886..9ba3e3e 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -443,7 +443,10 @@ typedef struct XHCIInterrupter {
 } XHCIInterrupter;
 
 struct XHCIState {
-    PCIDevice pci_dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     USBBus bus;
     qemu_irq irq;
     MemoryRegion mem;
@@ -659,7 +662,7 @@ static inline void xhci_dma_read_u32s(XHCIState *xhci, dma_addr_t addr,
 
     assert((len % sizeof(uint32_t)) == 0);
 
-    pci_dma_read(&xhci->pci_dev, addr, buf, len);
+    pci_dma_read(PCI_DEVICE(xhci), addr, buf, len);
 
     for (i = 0; i < (len / sizeof(uint32_t)); i++) {
         buf[i] = le32_to_cpu(buf[i]);
@@ -677,7 +680,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr,
     for (i = 0; i < (len / sizeof(uint32_t)); i++) {
         tmp[i] = cpu_to_le32(buf[i]);
     }
-    pci_dma_write(&xhci->pci_dev, addr, tmp, len);
+    pci_dma_write(PCI_DEVICE(xhci), addr, tmp, len);
 }
 
 static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
@@ -704,10 +707,11 @@ static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
 
 static void xhci_intx_update(XHCIState *xhci)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
     int level = 0;
 
-    if (msix_enabled(&xhci->pci_dev) ||
-        msi_enabled(&xhci->pci_dev)) {
+    if (msix_enabled(pci_dev) ||
+        msi_enabled(pci_dev)) {
         return;
     }
 
@@ -723,9 +727,10 @@ static void xhci_intx_update(XHCIState *xhci)
 
 static void xhci_msix_update(XHCIState *xhci, int v)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
     bool enabled;
 
-    if (!msix_enabled(&xhci->pci_dev)) {
+    if (!msix_enabled(pci_dev)) {
         return;
     }
 
@@ -736,17 +741,19 @@ static void xhci_msix_update(XHCIState *xhci, int v)
 
     if (enabled) {
         trace_usb_xhci_irq_msix_use(v);
-        msix_vector_use(&xhci->pci_dev, v);
+        msix_vector_use(pci_dev, v);
         xhci->intr[v].msix_used = true;
     } else {
         trace_usb_xhci_irq_msix_unuse(v);
-        msix_vector_unuse(&xhci->pci_dev, v);
+        msix_vector_unuse(pci_dev, v);
         xhci->intr[v].msix_used = false;
     }
 }
 
 static void xhci_intr_raise(XHCIState *xhci, int v)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
+
     xhci->intr[v].erdp_low |= ERDP_EHB;
     xhci->intr[v].iman |= IMAN_IP;
     xhci->usbsts |= USBSTS_EINT;
@@ -759,15 +766,15 @@ static void xhci_intr_raise(XHCIState *xhci, int v)
         return;
     }
 
-    if (msix_enabled(&xhci->pci_dev)) {
+    if (msix_enabled(pci_dev)) {
         trace_usb_xhci_irq_msix(v);
-        msix_notify(&xhci->pci_dev, v);
+        msix_notify(pci_dev, v);
         return;
     }
 
-    if (msi_enabled(&xhci->pci_dev)) {
+    if (msi_enabled(pci_dev)) {
         trace_usb_xhci_irq_msi(v);
-        msi_notify(&xhci->pci_dev, v);
+        msi_notify(pci_dev, v);
         return;
     }
 
@@ -790,6 +797,7 @@ static void xhci_die(XHCIState *xhci)
 
 static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
     XHCIInterrupter *intr = &xhci->intr[v];
     XHCITRB ev_trb;
     dma_addr_t addr;
@@ -808,7 +816,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
                                ev_trb.status, ev_trb.control);
 
     addr = intr->er_start + TRB_SIZE*intr->er_ep_idx;
-    pci_dma_write(&xhci->pci_dev, addr, &ev_trb, TRB_SIZE);
+    pci_dma_write(pci_dev, addr, &ev_trb, TRB_SIZE);
 
     intr->er_ep_idx++;
     if (intr->er_ep_idx >= intr->er_size) {
@@ -955,9 +963,11 @@ static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
 static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
                                dma_addr_t *addr)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
+
     while (1) {
         TRBType type;
-        pci_dma_read(&xhci->pci_dev, ring->dequeue, trb, TRB_SIZE);
+        pci_dma_read(pci_dev, ring->dequeue, trb, TRB_SIZE);
         trb->addr = ring->dequeue;
         trb->ccs = ring->ccs;
         le64_to_cpus(&trb->parameter);
@@ -990,6 +1000,7 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
 
 static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
     XHCITRB trb;
     int length = 0;
     dma_addr_t dequeue = ring->dequeue;
@@ -999,7 +1010,7 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
 
     while (1) {
         TRBType type;
-        pci_dma_read(&xhci->pci_dev, dequeue, &trb, TRB_SIZE);
+        pci_dma_read(pci_dev, dequeue, &trb, TRB_SIZE);
         le64_to_cpus(&trb.parameter);
         le32_to_cpus(&trb.status);
         le32_to_cpus(&trb.control);
@@ -1051,7 +1062,7 @@ static void xhci_er_reset(XHCIState *xhci, int v)
         return;
     }
     dma_addr_t erstba = xhci_addr64(intr->erstba_low, intr->erstba_high);
-    pci_dma_read(&xhci->pci_dev, erstba, &seg, sizeof(seg));
+    pci_dma_read(PCI_DEVICE(xhci), erstba, &seg, sizeof(seg));
     le32_to_cpus(&seg.addr_low);
     le32_to_cpus(&seg.addr_high);
     le32_to_cpus(&seg.size);
@@ -1526,7 +1537,7 @@ static int xhci_xfer_create_sgl(XHCITransfer *xfer, int in_xfer)
     int i;
 
     xfer->int_req = false;
-    pci_dma_sglist_init(&xfer->sgl, &xhci->pci_dev, xfer->trb_count);
+    pci_dma_sglist_init(&xfer->sgl, PCI_DEVICE(xhci), xfer->trb_count);
     for (i = 0; i < xfer->trb_count; i++) {
         XHCITRB *trb = &xfer->trbs[i];
         dma_addr_t addr;
@@ -2111,7 +2122,7 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
     assert(slotid >= 1 && slotid <= xhci->numslots);
 
     dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
-    poctx = ldq_le_pci_dma(&xhci->pci_dev, dcbaap + 8*slotid);
+    poctx = ldq_le_pci_dma(PCI_DEVICE(xhci), dcbaap + 8 * slotid);
     ictx = xhci_mask64(pictx);
     octx = xhci_mask64(poctx);
 
@@ -2432,7 +2443,7 @@ static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
     /* TODO: actually implement real values here */
     bw_ctx[0] = 0;
     memset(&bw_ctx[1], 80, xhci->numports); /* 80% */
-    pci_dma_write(&xhci->pci_dev, ctx, bw_ctx, sizeof(bw_ctx));
+    pci_dma_write(PCI_DEVICE(xhci), ctx, bw_ctx, sizeof(bw_ctx));
 
     return CC_SUCCESS;
 }
@@ -2455,11 +2466,12 @@ static uint32_t xhci_nec_challenge(uint32_t hi, uint32_t lo)
 
 static void xhci_via_challenge(XHCIState *xhci, uint64_t addr)
 {
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
     uint32_t buf[8];
     uint32_t obuf[8];
     dma_addr_t paddr = xhci_mask64(addr);
 
-    pci_dma_read(&xhci->pci_dev, paddr, &buf, 32);
+    pci_dma_read(pci_dev, paddr, &buf, 32);
 
     memcpy(obuf, buf, sizeof(obuf));
 
@@ -2475,7 +2487,7 @@ static void xhci_via_challenge(XHCIState *xhci, uint64_t addr)
         obuf[7] = obuf[2] ^ obuf[3] ^ 0x65866593;
     }
 
-    pci_dma_write(&xhci->pci_dev, paddr, &obuf, 32);
+    pci_dma_write(pci_dev, paddr, &obuf, 32);
 }
 
 static void xhci_process_commands(XHCIState *xhci)
@@ -3322,10 +3334,10 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
 
     XHCIState *xhci = XHCI(dev);
 
-    xhci->pci_dev.config[PCI_CLASS_PROG] = 0x30;    /* xHCI */
-    xhci->pci_dev.config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin 1 */
-    xhci->pci_dev.config[PCI_CACHE_LINE_SIZE] = 0x10;
-    xhci->pci_dev.config[0x60] = 0x30; /* release number */
+    dev->config[PCI_CLASS_PROG] = 0x30;    /* xHCI */
+    dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin 1 */
+    dev->config[PCI_CACHE_LINE_SIZE] = 0x10;
+    dev->config[0x60] = 0x30; /* release number */
 
     usb_xhci_init(xhci);
 
@@ -3347,7 +3359,7 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
 
     xhci->mfwrap_timer = qemu_new_timer_ns(vm_clock, xhci_mfwrap_timer, xhci);
 
-    xhci->irq = xhci->pci_dev.irq[0];
+    xhci->irq = dev->irq[0];
 
     memory_region_init(&xhci->mem, OBJECT(xhci), "xhci", LEN_REGS);
     memory_region_init_io(&xhci->mem_cap, OBJECT(xhci), &xhci_cap_ops, xhci,
@@ -3373,18 +3385,18 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
         memory_region_add_subregion(&xhci->mem, offset, &port->mem);
     }
 
-    pci_register_bar(&xhci->pci_dev, 0,
+    pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64,
                      &xhci->mem);
 
-    ret = pcie_endpoint_cap_init(&xhci->pci_dev, 0xa0);
+    ret = pcie_endpoint_cap_init(dev, 0xa0);
     assert(ret >= 0);
 
     if (xhci->flags & (1 << XHCI_FLAG_USE_MSI)) {
-        msi_init(&xhci->pci_dev, 0x70, xhci->numintrs, true, false);
+        msi_init(dev, 0x70, xhci->numintrs, true, false);
     }
     if (xhci->flags & (1 << XHCI_FLAG_USE_MSI_X)) {
-        msix_init(&xhci->pci_dev, xhci->numintrs,
+        msix_init(dev, xhci->numintrs,
                   &xhci->mem, 0, OFF_MSIX_TABLE,
                   &xhci->mem, 0, OFF_MSIX_PBA,
                   0x90);
@@ -3396,6 +3408,7 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
 static int usb_xhci_post_load(void *opaque, int version_id)
 {
     XHCIState *xhci = opaque;
+    PCIDevice *pci_dev = PCI_DEVICE(xhci);
     XHCISlot *slot;
     XHCIEPContext *epctx;
     dma_addr_t dcbaap, pctx;
@@ -3411,7 +3424,7 @@ static int usb_xhci_post_load(void *opaque, int version_id)
             continue;
         }
         slot->ctx =
-            xhci_mask64(ldq_le_pci_dma(&xhci->pci_dev, dcbaap + 8*slotid));
+            xhci_mask64(ldq_le_pci_dma(pci_dev, dcbaap + 8 * slotid));
         xhci_dma_read_u32s(xhci, slot->ctx, slot_ctx, sizeof(slot_ctx));
         slot->uport = xhci_lookup_uport(xhci, slot_ctx);
         assert(slot->uport && slot->uport->dev);
@@ -3436,9 +3449,9 @@ static int usb_xhci_post_load(void *opaque, int version_id)
 
     for (intr = 0; intr < xhci->numintrs; intr++) {
         if (xhci->intr[intr].msix_used) {
-            msix_vector_use(&xhci->pci_dev, intr);
+            msix_vector_use(pci_dev, intr);
         } else {
-            msix_vector_unuse(&xhci->pci_dev, intr);
+            msix_vector_unuse(pci_dev, intr);
         }
     }
 
@@ -3531,8 +3544,8 @@ static const VMStateDescription vmstate_xhci = {
     .version_id = 1,
     .post_load = usb_xhci_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(pci_dev, XHCIState),
-        VMSTATE_MSIX(pci_dev, XHCIState),
+        VMSTATE_PCIE_DEVICE(parent_obj, XHCIState),
+        VMSTATE_MSIX(parent_obj, XHCIState),
 
         VMSTATE_STRUCT_VARRAY_UINT32(ports, XHCIState, numports, 1,
                                      vmstate_xhci_port, XHCIPort),
commit 37034575d23a06447e4f44ab365afec6b198c53f
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:52:45 2013 +1000

    usb/hcd-xhci: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    [AF: Dropped usb_xhci_init() DeviceState argument and renamed variable]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index d7a54fd..0566886 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -482,6 +482,11 @@ struct XHCIState {
     XHCIRing cmd_ring;
 };
 
+#define TYPE_XHCI "nec-usb-xhci"
+
+#define XHCI(obj) \
+    OBJECT_CHECK(XHCIState, (obj), TYPE_XHCI)
+
 typedef struct XHCIEvRingSeg {
     uint32_t addr_low;
     uint32_t addr_high;
@@ -2681,7 +2686,7 @@ static void xhci_port_reset(XHCIPort *port)
 
 static void xhci_reset(DeviceState *dev)
 {
-    XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev.qdev, dev);
+    XHCIState *xhci = XHCI(dev);
     int i;
 
     trace_usb_xhci_reset();
@@ -2926,6 +2931,7 @@ static void xhci_oper_write(void *ptr, hwaddr reg,
                             uint64_t val, unsigned size)
 {
     XHCIState *xhci = ptr;
+    DeviceState *d = DEVICE(ptr);
 
     trace_usb_xhci_oper_write(reg, val);
 
@@ -2939,7 +2945,7 @@ static void xhci_oper_write(void *ptr, hwaddr reg,
         xhci->usbcmd = val & 0xc0f;
         xhci_mfwrap_update(xhci);
         if (val & USBCMD_HCRST) {
-            xhci_reset(&xhci->pci_dev.qdev);
+            xhci_reset(d);
         }
         xhci_intx_update(xhci);
         break;
@@ -3265,8 +3271,9 @@ static USBBusOps xhci_bus_ops = {
     .wakeup_endpoint = xhci_wakeup_endpoint,
 };
 
-static void usb_xhci_init(XHCIState *xhci, DeviceState *dev)
+static void usb_xhci_init(XHCIState *xhci)
 {
+    DeviceState *dev = DEVICE(xhci);
     XHCIPort *port;
     int i, usbports, speedmask;
 
@@ -3281,7 +3288,7 @@ static void usb_xhci_init(XHCIState *xhci, DeviceState *dev)
     usbports = MAX(xhci->numports_2, xhci->numports_3);
     xhci->numports = xhci->numports_2 + xhci->numports_3;
 
-    usb_bus_new(&xhci->bus, &xhci_bus_ops, &xhci->pci_dev.qdev);
+    usb_bus_new(&xhci->bus, &xhci_bus_ops, dev);
 
     for (i = 0; i < usbports; i++) {
         speedmask = 0;
@@ -3313,14 +3320,14 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
 {
     int i, ret;
 
-    XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev, dev);
+    XHCIState *xhci = XHCI(dev);
 
     xhci->pci_dev.config[PCI_CLASS_PROG] = 0x30;    /* xHCI */
     xhci->pci_dev.config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin 1 */
     xhci->pci_dev.config[PCI_CACHE_LINE_SIZE] = 0x10;
     xhci->pci_dev.config[0x60] = 0x30; /* release number */
 
-    usb_xhci_init(xhci, &dev->qdev);
+    usb_xhci_init(xhci);
 
     if (xhci->numintrs > MAXINTRS) {
         xhci->numintrs = MAXINTRS;
@@ -3581,7 +3588,7 @@ static void xhci_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xhci_info = {
-    .name          = "nec-usb-xhci",
+    .name          = TYPE_XHCI,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(XHCIState),
     .class_init    = xhci_class_init,
commit 1f8c79468594cc059eac7a26d37fba48107cb2e4
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:52:00 2013 +1000

    net/pcnet-pci: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    [AF: Renamed parent field, renamed from PC_NET to PCNET]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index f4a5aef..6ef28f7 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -43,9 +43,16 @@
 //#define PCNET_DEBUG_TMD
 //#define PCNET_DEBUG_MATCH
 
+#define TYPE_PCI_PCNET "pcnet"
+
+#define PCI_PCNET(obj) \
+     OBJECT_CHECK(PCIPCNetState, (obj), TYPE_PCI_PCNET)
 
 typedef struct {
-    PCIDevice pci_dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     PCNetState state;
     MemoryRegion io_bar;
 } PCIPCNetState;
@@ -236,7 +243,7 @@ static const VMStateDescription vmstate_pci_pcnet = {
     .minimum_version_id = 2,
     .minimum_version_id_old = 2,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(pci_dev, PCIPCNetState),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIPCNetState),
         VMSTATE_STRUCT(state, PCIPCNetState, 0, vmstate_pcnet, PCNetState),
         VMSTATE_END_OF_LIST()
     }
@@ -273,7 +280,7 @@ static void pci_pcnet_cleanup(NetClientState *nc)
 
 static void pci_pcnet_uninit(PCIDevice *dev)
 {
-    PCIPCNetState *d = DO_UPCAST(PCIPCNetState, pci_dev, dev);
+    PCIPCNetState *d = PCI_PCNET(dev);
 
     memory_region_destroy(&d->state.mmio);
     memory_region_destroy(&d->io_bar);
@@ -293,7 +300,7 @@ static NetClientInfo net_pci_pcnet_info = {
 
 static int pci_pcnet_init(PCIDevice *pci_dev)
 {
-    PCIPCNetState *d = DO_UPCAST(PCIPCNetState, pci_dev, pci_dev);
+    PCIPCNetState *d = PCI_PCNET(pci_dev);
     PCNetState *s = &d->state;
     uint8_t *pci_conf;
 
@@ -329,12 +336,12 @@ static int pci_pcnet_init(PCIDevice *pci_dev)
     s->phys_mem_write = pci_physical_memory_write;
     s->dma_opaque = pci_dev;
 
-    return pcnet_common_init(&pci_dev->qdev, s, &net_pci_pcnet_info);
+    return pcnet_common_init(DEVICE(pci_dev), s, &net_pci_pcnet_info);
 }
 
 static void pci_reset(DeviceState *dev)
 {
-    PCIPCNetState *d = DO_UPCAST(PCIPCNetState, pci_dev.qdev, dev);
+    PCIPCNetState *d = PCI_PCNET(dev);
 
     pcnet_h_reset(&d->state);
 }
@@ -362,7 +369,7 @@ static void pcnet_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pcnet_info = {
-    .name          = "pcnet",
+    .name          = TYPE_PCI_PCNET,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIPCNetState),
     .class_init    = pcnet_class_init,
commit 88a411a8a09102b89ea52fe2511265edd3393cf2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 13:09:00 2013 +0200

    net/rtl8139: QOM parent field cleanup
    
    Replace direct uses of RTL8139State::dev with QOM casts and rename it to
    parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 7f89d5a..6552034 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -433,7 +433,10 @@ typedef struct RTL8139TallyCounters
 static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters);
 
 typedef struct RTL8139State {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     uint8_t phys[8]; /* mac address */
     uint8_t mult[8]; /* multicast mask array */
 
@@ -706,13 +709,14 @@ static void prom9346_set_wire(RTL8139State *s, int eecs, int eesk, int eedi)
 
 static void rtl8139_update_irq(RTL8139State *s)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     int isr;
     isr = (s->IntrStatus & s->IntrMask) & 0xffff;
 
     DPRINTF("Set IRQ to %d (%04x %04x)\n", isr ? 1 : 0, s->IntrStatus,
         s->IntrMask);
 
-    qemu_set_irq(s->dev.irq[0], (isr != 0));
+    qemu_set_irq(d->irq[0], (isr != 0));
 }
 
 static int rtl8139_RxWrap(RTL8139State *s)
@@ -743,6 +747,8 @@ static int rtl8139_cp_transmitter_enabled(RTL8139State *s)
 
 static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
 {
+    PCIDevice *d = PCI_DEVICE(s);
+
     if (s->RxBufAddr + size > s->RxBufferSize)
     {
         int wrapped = MOD2(s->RxBufAddr + size, s->RxBufferSize);
@@ -754,14 +760,14 @@ static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
 
             if (size > wrapped)
             {
-                pci_dma_write(&s->dev, s->RxBuf + s->RxBufAddr,
+                pci_dma_write(d, s->RxBuf + s->RxBufAddr,
                               buf, size-wrapped);
             }
 
             /* reset buffer pointer */
             s->RxBufAddr = 0;
 
-            pci_dma_write(&s->dev, s->RxBuf + s->RxBufAddr,
+            pci_dma_write(d, s->RxBuf + s->RxBufAddr,
                           buf + (size-wrapped), wrapped);
 
             s->RxBufAddr = wrapped;
@@ -771,7 +777,7 @@ static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
     }
 
     /* non-wrapping path or overwrapping enabled */
-    pci_dma_write(&s->dev, s->RxBuf + s->RxBufAddr, buf, size);
+    pci_dma_write(d, s->RxBuf + s->RxBufAddr, buf, size);
 
     s->RxBufAddr += size;
 }
@@ -814,6 +820,7 @@ static int rtl8139_can_receive(NetClientState *nc)
 static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)
 {
     RTL8139State *s = qemu_get_nic_opaque(nc);
+    PCIDevice *d = PCI_DEVICE(s);
     /* size is the length of the buffer passed to the driver */
     int size = size_;
     const uint8_t *dot1q_buf = NULL;
@@ -978,13 +985,13 @@ static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t
 
         uint32_t val, rxdw0,rxdw1,rxbufLO,rxbufHI;
 
-        pci_dma_read(&s->dev, cplus_rx_ring_desc, &val, 4);
+        pci_dma_read(d, cplus_rx_ring_desc, &val, 4);
         rxdw0 = le32_to_cpu(val);
-        pci_dma_read(&s->dev, cplus_rx_ring_desc+4, &val, 4);
+        pci_dma_read(d, cplus_rx_ring_desc+4, &val, 4);
         rxdw1 = le32_to_cpu(val);
-        pci_dma_read(&s->dev, cplus_rx_ring_desc+8, &val, 4);
+        pci_dma_read(d, cplus_rx_ring_desc+8, &val, 4);
         rxbufLO = le32_to_cpu(val);
-        pci_dma_read(&s->dev, cplus_rx_ring_desc+12, &val, 4);
+        pci_dma_read(d, cplus_rx_ring_desc+12, &val, 4);
         rxbufHI = le32_to_cpu(val);
 
         DPRINTF("+++ C+ mode RX descriptor %d %08x %08x %08x %08x\n",
@@ -1052,12 +1059,12 @@ static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t
 
         /* receive/copy to target memory */
         if (dot1q_buf) {
-            pci_dma_write(&s->dev, rx_addr, buf, 2 * ETHER_ADDR_LEN);
-            pci_dma_write(&s->dev, rx_addr + 2 * ETHER_ADDR_LEN,
+            pci_dma_write(d, rx_addr, buf, 2 * ETHER_ADDR_LEN);
+            pci_dma_write(d, rx_addr + 2 * ETHER_ADDR_LEN,
                           buf + 2 * ETHER_ADDR_LEN + VLAN_HLEN,
                           size - 2 * ETHER_ADDR_LEN);
         } else {
-            pci_dma_write(&s->dev, rx_addr, buf, size);
+            pci_dma_write(d, rx_addr, buf, size);
         }
 
         if (s->CpCmd & CPlusRxChkSum)
@@ -1067,7 +1074,7 @@ static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t
 
         /* write checksum */
         val = cpu_to_le32(crc32(0, buf, size_));
-        pci_dma_write(&s->dev, rx_addr+size, (uint8_t *)&val, 4);
+        pci_dma_write(d, rx_addr+size, (uint8_t *)&val, 4);
 
 /* first segment of received packet flag */
 #define CP_RX_STATUS_FS (1<<29)
@@ -1113,9 +1120,9 @@ static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t
 
         /* update ring data */
         val = cpu_to_le32(rxdw0);
-        pci_dma_write(&s->dev, cplus_rx_ring_desc, (uint8_t *)&val, 4);
+        pci_dma_write(d, cplus_rx_ring_desc, (uint8_t *)&val, 4);
         val = cpu_to_le32(rxdw1);
-        pci_dma_write(&s->dev, cplus_rx_ring_desc+4, (uint8_t *)&val, 4);
+        pci_dma_write(d, cplus_rx_ring_desc+4, (uint8_t *)&val, 4);
 
         /* update tally counter */
         ++s->tally_counters.RxOk;
@@ -1298,49 +1305,50 @@ static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters)
 
 static void RTL8139TallyCounters_dma_write(RTL8139State *s, dma_addr_t tc_addr)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     RTL8139TallyCounters *tally_counters = &s->tally_counters;
     uint16_t val16;
     uint32_t val32;
     uint64_t val64;
 
     val64 = cpu_to_le64(tally_counters->TxOk);
-    pci_dma_write(&s->dev, tc_addr + 0,     (uint8_t *)&val64, 8);
+    pci_dma_write(d, tc_addr + 0,     (uint8_t *)&val64, 8);
 
     val64 = cpu_to_le64(tally_counters->RxOk);
-    pci_dma_write(&s->dev, tc_addr + 8,     (uint8_t *)&val64, 8);
+    pci_dma_write(d, tc_addr + 8,     (uint8_t *)&val64, 8);
 
     val64 = cpu_to_le64(tally_counters->TxERR);
-    pci_dma_write(&s->dev, tc_addr + 16,    (uint8_t *)&val64, 8);
+    pci_dma_write(d, tc_addr + 16,    (uint8_t *)&val64, 8);
 
     val32 = cpu_to_le32(tally_counters->RxERR);
-    pci_dma_write(&s->dev, tc_addr + 24,    (uint8_t *)&val32, 4);
+    pci_dma_write(d, tc_addr + 24,    (uint8_t *)&val32, 4);
 
     val16 = cpu_to_le16(tally_counters->MissPkt);
-    pci_dma_write(&s->dev, tc_addr + 28,    (uint8_t *)&val16, 2);
+    pci_dma_write(d, tc_addr + 28,    (uint8_t *)&val16, 2);
 
     val16 = cpu_to_le16(tally_counters->FAE);
-    pci_dma_write(&s->dev, tc_addr + 30,    (uint8_t *)&val16, 2);
+    pci_dma_write(d, tc_addr + 30,    (uint8_t *)&val16, 2);
 
     val32 = cpu_to_le32(tally_counters->Tx1Col);
-    pci_dma_write(&s->dev, tc_addr + 32,    (uint8_t *)&val32, 4);
+    pci_dma_write(d, tc_addr + 32,    (uint8_t *)&val32, 4);
 
     val32 = cpu_to_le32(tally_counters->TxMCol);
-    pci_dma_write(&s->dev, tc_addr + 36,    (uint8_t *)&val32, 4);
+    pci_dma_write(d, tc_addr + 36,    (uint8_t *)&val32, 4);
 
     val64 = cpu_to_le64(tally_counters->RxOkPhy);
-    pci_dma_write(&s->dev, tc_addr + 40,    (uint8_t *)&val64, 8);
+    pci_dma_write(d, tc_addr + 40,    (uint8_t *)&val64, 8);
 
     val64 = cpu_to_le64(tally_counters->RxOkBrd);
-    pci_dma_write(&s->dev, tc_addr + 48,    (uint8_t *)&val64, 8);
+    pci_dma_write(d, tc_addr + 48,    (uint8_t *)&val64, 8);
 
     val32 = cpu_to_le32(tally_counters->RxOkMul);
-    pci_dma_write(&s->dev, tc_addr + 56,    (uint8_t *)&val32, 4);
+    pci_dma_write(d, tc_addr + 56,    (uint8_t *)&val32, 4);
 
     val16 = cpu_to_le16(tally_counters->TxAbt);
-    pci_dma_write(&s->dev, tc_addr + 60,    (uint8_t *)&val16, 2);
+    pci_dma_write(d, tc_addr + 60,    (uint8_t *)&val16, 2);
 
     val16 = cpu_to_le16(tally_counters->TxUndrn);
-    pci_dma_write(&s->dev, tc_addr + 62,    (uint8_t *)&val16, 2);
+    pci_dma_write(d, tc_addr + 62,    (uint8_t *)&val16, 2);
 }
 
 /* Loads values of tally counters from VM state file */
@@ -1830,13 +1838,14 @@ static int rtl8139_transmit_one(RTL8139State *s, int descriptor)
 
     DPRINTF("+++ transmitting from descriptor %d\n", descriptor);
 
+    PCIDevice *d = PCI_DEVICE(s);
     int txsize = s->TxStatus[descriptor] & 0x1fff;
     uint8_t txbuffer[0x2000];
 
     DPRINTF("+++ transmit reading %d bytes from host memory at 0x%08x\n",
         txsize, s->TxAddr[descriptor]);
 
-    pci_dma_read(&s->dev, s->TxAddr[descriptor], txbuffer, txsize);
+    pci_dma_read(d, s->TxAddr[descriptor], txbuffer, txsize);
 
     /* Mark descriptor as transferred */
     s->TxStatus[descriptor] |= TxHostOwns;
@@ -1955,6 +1964,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
         return 0 ;
     }
 
+    PCIDevice *d = PCI_DEVICE(s);
     int descriptor = s->currCPlusTxDesc;
 
     dma_addr_t cplus_tx_ring_desc = rtl8139_addr64(s->TxAddr[0], s->TxAddr[1]);
@@ -1968,13 +1978,13 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
     uint32_t val, txdw0,txdw1,txbufLO,txbufHI;
 
-    pci_dma_read(&s->dev, cplus_tx_ring_desc,    (uint8_t *)&val, 4);
+    pci_dma_read(d, cplus_tx_ring_desc,    (uint8_t *)&val, 4);
     txdw0 = le32_to_cpu(val);
-    pci_dma_read(&s->dev, cplus_tx_ring_desc+4,  (uint8_t *)&val, 4);
+    pci_dma_read(d, cplus_tx_ring_desc+4,  (uint8_t *)&val, 4);
     txdw1 = le32_to_cpu(val);
-    pci_dma_read(&s->dev, cplus_tx_ring_desc+8,  (uint8_t *)&val, 4);
+    pci_dma_read(d, cplus_tx_ring_desc+8,  (uint8_t *)&val, 4);
     txbufLO = le32_to_cpu(val);
-    pci_dma_read(&s->dev, cplus_tx_ring_desc+12, (uint8_t *)&val, 4);
+    pci_dma_read(d, cplus_tx_ring_desc+12, (uint8_t *)&val, 4);
     txbufHI = le32_to_cpu(val);
 
     DPRINTF("+++ C+ mode TX descriptor %d %08x %08x %08x %08x\n", descriptor,
@@ -2081,7 +2091,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
             DMA_ADDR_FMT" to offset %d\n", txsize, tx_addr,
             s->cplus_txbuffer_offset);
 
-    pci_dma_read(&s->dev, tx_addr,
+    pci_dma_read(d, tx_addr,
                  s->cplus_txbuffer + s->cplus_txbuffer_offset, txsize);
     s->cplus_txbuffer_offset += txsize;
 
@@ -2109,7 +2119,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
     /* update ring data */
     val = cpu_to_le32(txdw0);
-    pci_dma_write(&s->dev, cplus_tx_ring_desc, (uint8_t *)&val, 4);
+    pci_dma_write(d, cplus_tx_ring_desc, (uint8_t *)&val, 4);
 
     /* Now decide if descriptor being processed is holding the last segment of packet */
     if (txdw0 & CP_TX_LS)
@@ -3282,7 +3292,7 @@ static const VMStateDescription vmstate_rtl8139 = {
     .post_load = rtl8139_post_load,
     .pre_save  = rtl8139_pre_save,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, RTL8139State),
+        VMSTATE_PCI_DEVICE(parent_obj, RTL8139State),
         VMSTATE_PARTIAL_BUFFER(phys, RTL8139State, 6),
         VMSTATE_BUFFER(mult, RTL8139State),
         VMSTATE_UINT32_ARRAY(TxStatus, RTL8139State, 4),
@@ -3490,7 +3500,7 @@ static int pci_rtl8139_init(PCIDevice *dev)
     DeviceState *d = DEVICE(dev);
     uint8_t *pci_conf;
 
-    pci_conf = s->dev.config;
+    pci_conf = dev->config;
     pci_conf[PCI_INTERRUPT_PIN] = 1;    /* interrupt pin A */
     /* TODO: start of capability list, but no capability
      * list bit in status register, and offset 0xdc seems unused. */
@@ -3500,8 +3510,8 @@ static int pci_rtl8139_init(PCIDevice *dev)
                           "rtl8139", 0x100);
     memory_region_init_io(&s->bar_mem, OBJECT(s), &rtl8139_mmio_ops, s,
                           "rtl8139", 0x100);
-    pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->bar_io);
-    pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar_mem);
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->bar_io);
+    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar_mem);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
commit 39257515888a3fbaa7061c4c2aeeadfe1b9c3c15
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:51:15 2013 +1000

    net/rtl8139: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index a00ff58..7f89d5a 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -92,6 +92,11 @@ static inline GCC_FMT_ATTR(1, 2) int DPRINTF(const char *fmt, ...)
 }
 #endif
 
+#define TYPE_RTL8139 "rtl8139"
+
+#define RTL8139(obj) \
+     OBJECT_CHECK(RTL8139State, (obj), TYPE_RTL8139)
+
 /* Symbolic offsets to registers. */
 enum RTL8139_registers {
     MAC0 = 0,        /* Ethernet hardware address. */
@@ -1197,7 +1202,7 @@ static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
 
 static void rtl8139_reset(DeviceState *d)
 {
-    RTL8139State *s = container_of(d, RTL8139State, dev.qdev);
+    RTL8139State *s = RTL8139(d);
     int i;
 
     /* restore MAC address */
@@ -1364,6 +1369,8 @@ static const VMStateDescription vmstate_tally_counters = {
 
 static void rtl8139_ChipCmd_write(RTL8139State *s, uint32_t val)
 {
+    DeviceState *d = DEVICE(s);
+
     val &= 0xff;
 
     DPRINTF("ChipCmd write val=0x%08x\n", val);
@@ -1371,7 +1378,7 @@ static void rtl8139_ChipCmd_write(RTL8139State *s, uint32_t val)
     if (val & CmdReset)
     {
         DPRINTF("ChipCmd reset\n");
-        rtl8139_reset(&s->dev.qdev);
+        rtl8139_reset(d);
     }
     if (val & CmdRxEnb)
     {
@@ -1525,6 +1532,8 @@ static uint32_t rtl8139_BasicModeStatus_read(RTL8139State *s)
 
 static void rtl8139_Cfg9346_write(RTL8139State *s, uint32_t val)
 {
+    DeviceState *d = DEVICE(s);
+
     val &= 0xff;
 
     DPRINTF("Cfg9346 write val=0x%02x\n", val);
@@ -1544,7 +1553,7 @@ static void rtl8139_Cfg9346_write(RTL8139State *s, uint32_t val)
     } else if (opmode == 0x40) {
         /* Reset.  */
         val = 0;
-        rtl8139_reset(&s->dev.qdev);
+        rtl8139_reset(d);
     }
 
     s->Cfg9346 = val;
@@ -3439,7 +3448,7 @@ static void rtl8139_cleanup(NetClientState *nc)
 
 static void pci_rtl8139_uninit(PCIDevice *dev)
 {
-    RTL8139State *s = DO_UPCAST(RTL8139State, dev, dev);
+    RTL8139State *s = RTL8139(dev);
 
     memory_region_destroy(&s->bar_io);
     memory_region_destroy(&s->bar_mem);
@@ -3477,7 +3486,8 @@ static NetClientInfo net_rtl8139_info = {
 
 static int pci_rtl8139_init(PCIDevice *dev)
 {
-    RTL8139State * s = DO_UPCAST(RTL8139State, dev, dev);
+    RTL8139State *s = RTL8139(dev);
+    DeviceState *d = DEVICE(dev);
     uint8_t *pci_conf;
 
     pci_conf = s->dev.config;
@@ -3507,7 +3517,7 @@ static int pci_rtl8139_init(PCIDevice *dev)
     s->eeprom.contents[9] = s->conf.macaddr.a[4] | s->conf.macaddr.a[5] << 8;
 
     s->nic = qemu_new_nic(&net_rtl8139_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), d->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     s->cplus_txbuffer = NULL;
@@ -3518,7 +3528,7 @@ static int pci_rtl8139_init(PCIDevice *dev)
     s->timer = qemu_new_timer_ns(vm_clock, rtl8139_timer, s);
     rtl8139_set_next_tctr_time(s, qemu_get_clock_ns(vm_clock));
 
-    add_boot_device_path(s->conf.bootindex, &dev->qdev, "/ethernet-phy at 0");
+    add_boot_device_path(s->conf.bootindex, d, "/ethernet-phy at 0");
 
     return 0;
 }
@@ -3546,7 +3556,7 @@ static void rtl8139_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo rtl8139_info = {
-    .name          = "rtl8139",
+    .name          = TYPE_RTL8139,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(RTL8139State),
     .class_init    = rtl8139_class_init,
commit b08340d52b51ab57ba525043dbc83e67ecfcaa23
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 30 12:55:52 2013 +0200

    net/e1000: QOM parent field cleanup
    
    Replace direct uses of E1000State::dev field with QOM casts and rename
    it to parent_obj.
    
    Acked-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 061b9cf..b952d8d 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -85,7 +85,10 @@ enum {
 };
 
 typedef struct E1000State_st {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     NICState *nic;
     NICConf conf;
     MemoryRegion mmio;
@@ -245,6 +248,8 @@ static const uint32_t mac_reg_init[] = {
 static void
 set_interrupt_cause(E1000State *s, int index, uint32_t val)
 {
+    PCIDevice *d = PCI_DEVICE(s);
+
     if (val && (E1000_DEVID >= E1000_DEV_ID_82547EI_MOBILE)) {
         /* Only for 8257x */
         val |= E1000_ICR_INT_ASSERTED;
@@ -261,7 +266,7 @@ set_interrupt_cause(E1000State *s, int index, uint32_t val)
      */
     s->mac_reg[ICS] = val;
 
-    qemu_set_irq(s->dev.irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);
+    qemu_set_irq(d->irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);
 }
 
 static void
@@ -558,6 +563,7 @@ xmit_seg(E1000State *s)
 static void
 process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     uint32_t txd_lower = le32_to_cpu(dp->lower.data);
     uint32_t dtype = txd_lower & (E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_D);
     unsigned int split_size = txd_lower & 0xffff, bytes, sz, op;
@@ -615,7 +621,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
                 bytes = msh - tp->size;
 
             bytes = MIN(sizeof(tp->data) - tp->size, bytes);
-            pci_dma_read(&s->dev, addr, tp->data + tp->size, bytes);
+            pci_dma_read(d, addr, tp->data + tp->size, bytes);
             sz = tp->size + bytes;
             if (sz >= tp->hdr_len && tp->size < tp->hdr_len) {
                 memmove(tp->header, tp->data, tp->hdr_len);
@@ -633,7 +639,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         DBGOUT(TXERR, "TCP segmentation error\n");
     } else {
         split_size = MIN(sizeof(tp->data) - tp->size, split_size);
-        pci_dma_read(&s->dev, addr, tp->data + tp->size, split_size);
+        pci_dma_read(d, addr, tp->data + tp->size, split_size);
         tp->size += split_size;
     }
 
@@ -652,6 +658,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
 static uint32_t
 txdesc_writeback(E1000State *s, dma_addr_t base, struct e1000_tx_desc *dp)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     uint32_t txd_upper, txd_lower = le32_to_cpu(dp->lower.data);
 
     if (!(txd_lower & (E1000_TXD_CMD_RS|E1000_TXD_CMD_RPS)))
@@ -659,7 +666,7 @@ txdesc_writeback(E1000State *s, dma_addr_t base, struct e1000_tx_desc *dp)
     txd_upper = (le32_to_cpu(dp->upper.data) | E1000_TXD_STAT_DD) &
                 ~(E1000_TXD_STAT_EC | E1000_TXD_STAT_LC | E1000_TXD_STAT_TU);
     dp->upper.data = cpu_to_le32(txd_upper);
-    pci_dma_write(&s->dev, base + ((char *)&dp->upper - (char *)dp),
+    pci_dma_write(d, base + ((char *)&dp->upper - (char *)dp),
                   &dp->upper, sizeof(dp->upper));
     return E1000_ICR_TXDW;
 }
@@ -675,6 +682,7 @@ static uint64_t tx_desc_base(E1000State *s)
 static void
 start_xmit(E1000State *s)
 {
+    PCIDevice *d = PCI_DEVICE(s);
     dma_addr_t base;
     struct e1000_tx_desc desc;
     uint32_t tdh_start = s->mac_reg[TDH], cause = E1000_ICS_TXQE;
@@ -687,7 +695,7 @@ start_xmit(E1000State *s)
     while (s->mac_reg[TDH] != s->mac_reg[TDT]) {
         base = tx_desc_base(s) +
                sizeof(struct e1000_tx_desc) * s->mac_reg[TDH];
-        pci_dma_read(&s->dev, base, &desc, sizeof(desc));
+        pci_dma_read(d, base, &desc, sizeof(desc));
 
         DBGOUT(TX, "index %d: %p : %x %x\n", s->mac_reg[TDH],
                (void *)(intptr_t)desc.buffer_addr, desc.lower.data,
@@ -820,6 +828,7 @@ static ssize_t
 e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
     E1000State *s = qemu_get_nic_opaque(nc);
+    PCIDevice *d = PCI_DEVICE(s);
     struct e1000_rx_desc desc;
     dma_addr_t base;
     unsigned int n, rdt;
@@ -879,7 +888,7 @@ e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
             desc_size = s->rxbuf_size;
         }
         base = rx_desc_base(s) + sizeof(desc) * s->mac_reg[RDH];
-        pci_dma_read(&s->dev, base, &desc, sizeof(desc));
+        pci_dma_read(d, base, &desc, sizeof(desc));
         desc.special = vlan_special;
         desc.status |= (vlan_status | E1000_RXD_STAT_DD);
         if (desc.buffer_addr) {
@@ -888,7 +897,7 @@ e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
                 if (copy_size > s->rxbuf_size) {
                     copy_size = s->rxbuf_size;
                 }
-                pci_dma_write(&s->dev, le64_to_cpu(desc.buffer_addr),
+                pci_dma_write(d, le64_to_cpu(desc.buffer_addr),
                               buf + desc_offset + vlan_offset, copy_size);
             }
             desc_offset += desc_size;
@@ -903,7 +912,7 @@ e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         } else { // as per intel docs; skip descriptors with null buf addr
             DBGOUT(RX, "Null RX descriptor!!\n");
         }
-        pci_dma_write(&s->dev, base, &desc, sizeof(desc));
+        pci_dma_write(d, base, &desc, sizeof(desc));
 
         if (++s->mac_reg[RDH] * sizeof(desc) >= s->mac_reg[RDLEN])
             s->mac_reg[RDH] = 0;
@@ -1189,7 +1198,7 @@ static const VMStateDescription vmstate_e1000 = {
     .pre_save = e1000_pre_save,
     .post_load = e1000_post_load,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, E1000State),
+        VMSTATE_PCI_DEVICE(parent_obj, E1000State),
         VMSTATE_UNUSED_TEST(is_version_1, 4), /* was instance id */
         VMSTATE_UNUSED(4), /* Was mmio_base.  */
         VMSTATE_UINT32(rxbuf_size, E1000State),
@@ -1330,7 +1339,7 @@ static int pci_e1000_init(PCIDevice *pci_dev)
     int i;
     uint8_t *macaddr;
 
-    pci_conf = d->dev.config;
+    pci_conf = pci_dev->config;
 
     /* TODO: RST# value should be 0, PCI spec 6.2.4 */
     pci_conf[PCI_CACHE_LINE_SIZE] = 0x10;
@@ -1339,9 +1348,9 @@ static int pci_e1000_init(PCIDevice *pci_dev)
 
     e1000_mmio_setup(d);
 
-    pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
+    pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
 
-    pci_register_bar(&d->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->io);
+    pci_register_bar(pci_dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->io);
 
     memmove(d->eeprom_data, e1000_eeprom_template,
         sizeof e1000_eeprom_template);
commit 567a3c9e7f98f698d1aeb73e32ca614086b63837
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:50:30 2013 +1000

    net/e1000: QOM Upcast Sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST()
    and direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 5f04f13..061b9cf 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -138,6 +138,11 @@ typedef struct E1000State_st {
     uint32_t compat_flags;
 } E1000State;
 
+#define TYPE_E1000 "e1000"
+
+#define E1000(obj) \
+    OBJECT_CHECK(E1000State, (obj), TYPE_E1000)
+
 #define	defreg(x)	x = (E1000_##x>>2)
 enum {
     defreg(CTRL),	defreg(EECD),	defreg(EERD),	defreg(GPRC),
@@ -1298,7 +1303,7 @@ e1000_cleanup(NetClientState *nc)
 static void
 pci_e1000_uninit(PCIDevice *dev)
 {
-    E1000State *d = DO_UPCAST(E1000State, dev, dev);
+    E1000State *d = E1000(dev);
 
     qemu_del_timer(d->autoneg_timer);
     qemu_free_timer(d->autoneg_timer);
@@ -1318,7 +1323,8 @@ static NetClientInfo net_e1000_info = {
 
 static int pci_e1000_init(PCIDevice *pci_dev)
 {
-    E1000State *d = DO_UPCAST(E1000State, dev, pci_dev);
+    DeviceState *dev = DEVICE(pci_dev);
+    E1000State *d = E1000(pci_dev);
     uint8_t *pci_conf;
     uint16_t checksum = 0;
     int i;
@@ -1349,11 +1355,11 @@ static int pci_e1000_init(PCIDevice *pci_dev)
     d->eeprom_data[EEPROM_CHECKSUM_REG] = checksum;
 
     d->nic = qemu_new_nic(&net_e1000_info, &d->conf,
-                          object_get_typename(OBJECT(d)), d->dev.qdev.id, d);
+                          object_get_typename(OBJECT(d)), dev->id, d);
 
     qemu_format_nic_info_str(qemu_get_queue(d->nic), macaddr);
 
-    add_boot_device_path(d->conf.bootindex, &pci_dev->qdev, "/ethernet-phy at 0");
+    add_boot_device_path(d->conf.bootindex, dev, "/ethernet-phy at 0");
 
     d->autoneg_timer = qemu_new_timer_ms(vm_clock, e1000_autoneg_timer, d);
 
@@ -1362,7 +1368,7 @@ static int pci_e1000_init(PCIDevice *pci_dev)
 
 static void qdev_e1000_reset(DeviceState *dev)
 {
-    E1000State *d = DO_UPCAST(E1000State, dev.qdev, dev);
+    E1000State *d = E1000(dev);
     e1000_reset(d);
 }
 
@@ -1392,7 +1398,7 @@ static void e1000_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo e1000_info = {
-    .name          = "e1000",
+    .name          = TYPE_E1000,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(E1000State),
     .class_init    = e1000_class_init,
commit 6783ecf144c80f526c844cade3bf5593fba9e446
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Jun 27 12:03:44 2013 +0100

    hw: Avoid use of QOM type name macros in VMStateDescriptions
    
    The name field in a VMStateDescription is part of the migration state
    versioning, so changing it will break migration.  It's therefore a
    bad idea to use a QOM typename macro to initialize it, because in
    general we're free to rename QOM types as part of code refactoring
    and cleanup.  For the handful of devices that were doing this by
    mistake, replace the QOM typenames with the corresponding literal
    strings.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    [AF: Use TYPE_PVSCSI for TypeInfo instead]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/exynos4210_i2c.c b/hw/i2c/exynos4210_i2c.c
index 52bffa5..42f5e89 100644
--- a/hw/i2c/exynos4210_i2c.c
+++ b/hw/i2c/exynos4210_i2c.c
@@ -271,7 +271,7 @@ static const MemoryRegionOps exynos4210_i2c_ops = {
 };
 
 static const VMStateDescription exynos4210_i2c_vmstate = {
-    .name = TYPE_EXYNOS4_I2C,
+    .name = "exynos4210.i2c",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 97d3aa3..e1074e1 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1136,7 +1136,7 @@ pvscsi_post_load(void *opaque, int version_id)
 }
 
 static const VMStateDescription vmstate_pvscsi = {
-    .name = TYPE_PVSCSI,
+    .name = "pvscsi",
     .version_id = 0,
     .minimum_version_id = 0,
     .minimum_version_id_old = 0,
@@ -1201,7 +1201,7 @@ static void pvscsi_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pvscsi_info = {
-    .name          = "pvscsi",
+    .name          = TYPE_PVSCSI,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PVSCSIState),
     .class_init    = pvscsi_class_init,
diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index e24e0c4..117dc7b 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -370,7 +370,7 @@ static const MemoryRegionOps imx_epit_ops = {
 };
 
 static const VMStateDescription vmstate_imx_timer_epit = {
-    .name = TYPE_IMX_EPIT,
+    .name = "imx.epit",
     .version_id = 2,
     .minimum_version_id = 2,
     .minimum_version_id_old = 2,
diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index 97fbebb..87db0e1 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -142,7 +142,7 @@ typedef struct {
 } IMXGPTState;
 
 static const VMStateDescription vmstate_imx_timer_gpt = {
-    .name = TYPE_IMX_GPT,
+    .name = "imx.gpt",
     .version_id = 3,
     .minimum_version_id = 3,
     .minimum_version_id_old = 3,
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 01c7e6f..5f01ff1 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -364,7 +364,7 @@ static int passthru_exitfn(CCIDCardState *base)
 }
 
 static VMStateDescription passthru_vmstate = {
-    .name = PASSTHRU_DEV_NAME,
+    .name = "ccid-card-passthru",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 125cc2c..b33eb25 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1397,7 +1397,7 @@ static VMStateDescription usb_device_vmstate = {
 };
 
 static VMStateDescription ccid_vmstate = {
-    .name = CCID_DEV_NAME,
+    .name = "usb-ccid",
     .version_id = 1,
     .minimum_version_id = 1,
     .post_load = ccid_post_load,
commit 3464700f6aecb3e2aa9098839d90672d6b3fa974
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Jun 28 12:40:32 2013 +0100

    tests: Add test-bitops.c with some sextract tests
    
    Add some simple test cases for the new sextract32
    and sextract64 functions.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Message-id: 1372419632-5521-3-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/Makefile b/tests/Makefile
index 425a9a8..6c34eec 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -47,6 +47,7 @@ gcov-files-test-mul64-y = util/host-utils.c
 check-unit-y += tests/test-int128$(EXESUF)
 # all code tested by test-int128 is inside int128.h
 gcov-files-test-int128-y =
+check-unit-y += tests/test-bitops$(EXESUF)
 
 check-block-$(CONFIG_POSIX) += tests/qemu-iotests-quick.sh
 
@@ -125,6 +126,7 @@ tests/test-qmp-commands$(EXESUF): tests/test-qmp-commands.o tests/test-qmp-marsh
 tests/test-visitor-serialization$(EXESUF): tests/test-visitor-serialization.o $(test-qapi-obj-y) libqemuutil.a libqemustub.a
 
 tests/test-mul64$(EXESUF): tests/test-mul64.o libqemuutil.a
+tests/test-bitops$(EXESUF): tests/test-bitops.o libqemuutil.a
 
 libqos-obj-y = tests/libqos/pci.o tests/libqos/fw_cfg.o
 libqos-obj-y += tests/libqos/i2c.o
diff --git a/tests/test-bitops.c b/tests/test-bitops.c
new file mode 100644
index 0000000..4e713e4
--- /dev/null
+++ b/tests/test-bitops.c
@@ -0,0 +1,75 @@
+/*
+ * Test bitops routines
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include <glib.h>
+#include <stdint.h>
+#include "qemu/bitops.h"
+
+typedef struct {
+    uint32_t value;
+    int start;
+    int length;
+    int32_t result;
+} S32Test;
+
+typedef struct {
+    uint64_t value;
+    int start;
+    int length;
+    int64_t result;
+} S64Test;
+
+static const S32Test test_s32_data[] = {
+    { 0x38463983, 4, 4, -8 },
+    { 0x38463983, 12, 8, 0x63 },
+    { 0x38463983, 0, 32, 0x38463983 },
+};
+
+static const S64Test test_s64_data[] = {
+    { 0x8459826734967223, 60, 4, -8 },
+    { 0x8459826734967223, 0, 64, 0x8459826734967223 },
+};
+
+static void test_sextract32(void)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(test_s32_data); i++) {
+        const S32Test *test = &test_s32_data[i];
+        int32_t r = sextract32(test->value, test->start, test->length);
+
+        g_assert_cmpint(r, ==, test->result);
+    }
+}
+
+static void test_sextract64(void)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(test_s32_data); i++) {
+        const S32Test *test = &test_s32_data[i];
+        int64_t r = sextract64(test->value, test->start, test->length);
+
+        g_assert_cmpint(r, ==, test->result);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(test_s64_data); i++) {
+        const S64Test *test = &test_s64_data[i];
+        int64_t r = sextract64(test->value, test->start, test->length);
+
+        g_assert_cmpint(r, ==, test->result);
+    }
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+    g_test_add_func("/bitops/sextract32", test_sextract32);
+    g_test_add_func("/bitops/sextract64", test_sextract64);
+    return g_test_run();
+}
commit 2dc6bebde93677b262caff114849d0f5ebdaa82d
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Jun 28 12:40:31 2013 +0100

    bitops: Provide sextract32() and sextract64()
    
    A common operation in instruction decoding is to take a field
    from an instruction that represents a signed integer in some
    arbitrary number of bits, and sign extend it into a C signed
    integer type for manipulation. Provide new functions sextract32()
    and sextract64() which perform this operation; they are like
    the existing extract32() and extract64() except that the field
    is sign-extended into the returned result.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Message-id: 1372419632-5521-2-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
index affcc96..06e2e6f 100644
--- a/include/qemu/bitops.h
+++ b/include/qemu/bitops.h
@@ -222,6 +222,56 @@ static inline uint64_t extract64(uint64_t value, int start, int length)
 }
 
 /**
+ * sextract32:
+ * @value: the value to extract the bit field from
+ * @start: the lowest bit in the bit field (numbered from 0)
+ * @length: the length of the bit field
+ *
+ * Extract from the 32 bit input @value the bit field specified by the
+ * @start and @length parameters, and return it, sign extended to
+ * an int32_t (ie with the most significant bit of the field propagated
+ * to all the upper bits of the return value). The bit field must lie
+ * entirely within the 32 bit word. It is valid to request that
+ * all 32 bits are returned (ie @length 32 and @start 0).
+ *
+ * Returns: the sign extended value of the bit field extracted from the
+ * input value.
+ */
+static inline int32_t sextract32(uint32_t value, int start, int length)
+{
+    assert(start >= 0 && length > 0 && length <= 32 - start);
+    /* Note that this implementation relies on right shift of signed
+     * integers being an arithmetic shift.
+     */
+    return ((int32_t)(value << (32 - length - start))) >> (32 - length);
+}
+
+/**
+ * sextract64:
+ * @value: the value to extract the bit field from
+ * @start: the lowest bit in the bit field (numbered from 0)
+ * @length: the length of the bit field
+ *
+ * Extract from the 64 bit input @value the bit field specified by the
+ * @start and @length parameters, and return it, sign extended to
+ * an int64_t (ie with the most significant bit of the field propagated
+ * to all the upper bits of the return value). The bit field must lie
+ * entirely within the 64 bit word. It is valid to request that
+ * all 64 bits are returned (ie @length 64 and @start 0).
+ *
+ * Returns: the sign extended value of the bit field extracted from the
+ * input value.
+ */
+static inline uint64_t sextract64(uint64_t value, int start, int length)
+{
+    assert(start >= 0 && length > 0 && length <= 64 - start);
+    /* Note that this implementation relies on right shift of signed
+     * integers being an arithmetic shift.
+     */
+    return ((int64_t)(value << (64 - length - start))) >> (64 - length);
+}
+
+/**
  * deposit32:
  * @value: initial value to insert bit field into
  * @start: the lowest bit in the bit field (numbered from 0)
commit fd1d9926e91f421bc851f9dd19875f14799c6e4b
Author: Alex Williamson <alex.williamson at redhat.com>
Date:   Fri Jul 19 12:42:12 2013 -0600

    memory: Fix zero-sized memory region print
    
    if mr->size == 0, then
    
    int128_get64(int128_sub(mr->size, int128_make64(1))) => assert(!a.hi)
    
    Also, use int128_one().
    
    Signed-off-by: Alex Williamson <alex.williamson at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 20130719184124.15864.20803.stgit at bling.home
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/memory.c b/memory.c
index 34a088e..01846c9 100644
--- a/memory.c
+++ b/memory.c
@@ -1787,7 +1787,9 @@ static void mtree_print_mr(fprintf_function mon_printf, void *f,
                    "-" TARGET_FMT_plx "\n",
                    base + mr->addr,
                    base + mr->addr
-                   + (hwaddr)int128_get64(int128_sub(mr->size, int128_make64(1))),
+                   + (int128_nz(mr->size) ?
+                      (hwaddr)int128_get64(int128_sub(mr->size,
+                                                      int128_one())) : 0),
                    mr->priority,
                    mr->romd_mode ? 'R' : '-',
                    !mr->readonly && !(mr->rom_device && mr->romd_mode) ? 'W'
@@ -1802,7 +1804,9 @@ static void mtree_print_mr(fprintf_function mon_printf, void *f,
                    TARGET_FMT_plx "-" TARGET_FMT_plx " (prio %d, %c%c): %s\n",
                    base + mr->addr,
                    base + mr->addr
-                   + (hwaddr)int128_get64(int128_sub(mr->size, int128_make64(1))),
+                   + (int128_nz(mr->size) ?
+                      (hwaddr)int128_get64(int128_sub(mr->size,
+                                                      int128_one())) : 0),
                    mr->priority,
                    mr->romd_mode ? 'R' : '-',
                    !mr->readonly && !(mr->rom_device && mr->romd_mode) ? 'W'
commit 53db78543e473bdf7650a406767d0901c6e26480
Author: Richard Henderson <rth at twiddle.net>
Date:   Sun Jul 21 15:39:26 2013 -0800

    configure: Remove ldscripts
    
    Since 964c6fa16f50a607f9da5068d6bf15ccc93872c0, these files are unused.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Message-id: 1374449966-12926-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ldscripts/alpha.ld b/ldscripts/alpha.ld
deleted file mode 100644
index 906d76b..0000000
--- a/ldscripts/alpha.ld
+++ /dev/null
@@ -1,127 +0,0 @@
-OUTPUT_FORMAT("elf64-alpha", "elf64-alpha",
-	      "elf64-alpha")
-OUTPUT_ARCH(alpha)
-ENTRY(__start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp) 	}
-  .hash          : { *(.hash)		}
-  .dynsym        : { *(.dynsym)		}
-  .dynstr        : { *(.dynstr)		}
-  .gnu.version   : { *(.gnu.version)	}
-  .gnu.version_d   : { *(.gnu.version_d)	}
-  .gnu.version_r   : { *(.gnu.version_r)	}
-  .rel.text      :
-    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
-  .rela.text     :
-    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
-  .rel.data      :
-    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
-  .rela.data     :
-    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
-  .rel.rodata    :
-    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
-  .rela.rodata   :
-    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)		}
-  .rela.got      : { *(.rela.got)		}
-  .rel.ctors     : { *(.rel.ctors)	}
-  .rela.ctors    : { *(.rela.ctors)	}
-  .rel.dtors     : { *(.rel.dtors)	}
-  .rela.dtors    : { *(.rela.dtors)	}
-  .rel.init      : { *(.rel.init)	}
-  .rela.init     : { *(.rela.init)	}
-  .rel.fini      : { *(.rel.fini)	}
-  .rela.fini     : { *(.rela.fini)	}
-  .rel.bss       : { *(.rel.bss)		}
-  .rela.bss      : { *(.rela.bss)		}
-  .rel.plt       : { *(.rel.plt)		}
-  .rela.plt      : { *(.rela.plt)		}
-  .init          : { *(.init)	} =0x47ff041f
-  .text      :
-  {
-    *(.text)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.gnu.linkonce.t*)
-  } =0x47ff041f
-  _etext = .;
-  PROVIDE (etext = .);
-  .fini      : { *(.fini)    } =0x47ff041f
-  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
-  .rodata1   : { *(.rodata1) }
-  .reginfo : { *(.reginfo) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x100000) + (. & (0x100000 - 1));
-  .data    :
-  {
-    *(.data)
-    *(.gnu.linkonce.d*)
-    CONSTRUCTORS
-  }
-  .data1   : { *(.data1) }
-  .ctors         :
-  {
-    *(.ctors)
-  }
-  .dtors         :
-  {
-    *(.dtors)
-  }
-  .plt      : { *(.plt)	}
-  .got           : { *(.got.plt) *(.got) }
-  .dynamic       : { *(.dynamic) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata     : { *(.sdata) }
-  _edata  =  .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss      : { *(.sbss) *(.scommon) }
-  .bss       :
-  {
-   *(.dynbss)
-   *(.bss)
-   *(COMMON)
-  }
-  _end = . ;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /* These must appear regardless of  .  */
-}
diff --git a/ldscripts/arm.ld b/ldscripts/arm.ld
deleted file mode 100644
index 7f13da9..0000000
--- a/ldscripts/arm.ld
+++ /dev/null
@@ -1,153 +0,0 @@
-OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm",
-	      "elf32-littlearm")
-OUTPUT_ARCH(arm)
-ENTRY(_start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp) 	}
-  .hash          : { *(.hash)		}
-  .dynsym        : { *(.dynsym)		}
-  .dynstr        : { *(.dynstr)		}
-  .gnu.version   : { *(.gnu.version)	}
-  .gnu.version_d   : { *(.gnu.version_d)	}
-  .gnu.version_r   : { *(.gnu.version_r)	}
-  .rel.text      :
-    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
-  .rela.text     :
-    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
-  .rel.data      :
-    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
-  .rela.data     :
-    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
-  .rel.rodata    :
-    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
-  .rela.rodata   :
-    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)		}
-  .rela.got      : { *(.rela.got)		}
-  .rel.ctors     : { *(.rel.ctors)	}
-  .rela.ctors    : { *(.rela.ctors)	}
-  .rel.dtors     : { *(.rel.dtors)	}
-  .rela.dtors    : { *(.rela.dtors)	}
-  .rel.init      : { *(.rel.init)	}
-  .rela.init     : { *(.rela.init)	}
-  .rel.fini      : { *(.rel.fini)	}
-  .rela.fini     : { *(.rela.fini)	}
-  .rel.bss       : { *(.rel.bss)		}
-  .rela.bss      : { *(.rela.bss)		}
-  .rel.plt       : { *(.rel.plt)		}
-  .rela.plt      : { *(.rela.plt)		}
-  .init          : { *(.init)	} =0x47ff041f
-  .text      :
-  {
-    *(.text)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.gnu.linkonce.t*)
-  } =0x47ff041f
-  _etext = .;
-  PROVIDE (etext = .);
-  .fini      : { *(.fini)    } =0x47ff041f
-  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
-  .rodata1   : { *(.rodata1) }
-  .ARM.extab   : { *(.ARM.extab* .gnu.linkonce.armextab.*) }
-   __exidx_start = .;
-  .ARM.exidx   : { *(.ARM.exidx* .gnu.linkonce.armexidx.*) }
-   __exidx_end = .;
-  .reginfo : { *(.reginfo) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x100000) + (. & (0x100000 - 1));
-  .data    :
-  {
-    *(.gen_code)
-    *(.data)
-    *(.gnu.linkonce.d*)
-    CONSTRUCTORS
-  }
-  .tbss           : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .data1   : { *(.data1) }
-  .preinit_array     :
-  {
-    PROVIDE (__preinit_array_start = .);
-    KEEP (*(.preinit_array))
-    PROVIDE (__preinit_array_end = .);
-  }
-  .init_array     :
-  {
-     PROVIDE (__init_array_start = .);
-     KEEP (*(SORT(.init_array.*)))
-     KEEP (*(.init_array))
-     PROVIDE (__init_array_end = .);
-  }
-  .fini_array     :
-  {
-    PROVIDE (__fini_array_start = .);
-    KEEP (*(.fini_array))
-    KEEP (*(SORT(.fini_array.*)))
-    PROVIDE (__fini_array_end = .);
-  }
-  .ctors         :
-  {
-    *(.ctors)
-  }
-  .dtors         :
-  {
-    *(.dtors)
-  }
-  .plt      : { *(.plt)	}
-  .got           : { *(.got.plt) *(.got) }
-  .dynamic       : { *(.dynamic) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata     : { *(.sdata) }
-  _edata  =  .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss      : { *(.sbss) *(.scommon) }
-  .bss       :
-  {
-   *(.dynbss)
-   *(.bss)
-   *(COMMON)
-  }
-  _end = . ;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /* These must appear regardless of  .  */
-}
diff --git a/ldscripts/hppa.ld b/ldscripts/hppa.ld
deleted file mode 100644
index 3555b3e..0000000
--- a/ldscripts/hppa.ld
+++ /dev/null
@@ -1,211 +0,0 @@
-/* Default linker script, for normal executables */
-OUTPUT_FORMAT("elf32-hppa-linux", "elf32-hppa-linux",
-	      "elf32-hppa-linux")
-OUTPUT_ARCH(hppa:hppa1.1)
-ENTRY(_start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  PROVIDE (__executable_start = 0x60000000); . = 0x60000000 + SIZEOF_HEADERS;
-  .interp         : { *(.interp) }
-  .hash           : { *(.hash) }
-  .dynsym         : { *(.dynsym) }
-  .dynstr         : { *(.dynstr) }
-  .gnu.version    : { *(.gnu.version) }
-  .gnu.version_d  : { *(.gnu.version_d) }
-  .gnu.version_r  : { *(.gnu.version_r) }
-  .rel.init       : { *(.rel.init) }
-  .rela.init      : { *(.rela.init) }
-  .rel.text       : { *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*) }
-  .rela.text      : { *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*) }
-  .rel.fini       : { *(.rel.fini) }
-  .rela.fini      : { *(.rela.fini) }
-  .rel.rodata     : { *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*) }
-  .rela.rodata    : { *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*) }
-  .rel.data.rel.ro   : { *(.rel.data.rel.ro* .rel.gnu.linkonce.d.rel.ro.*) }
-  .rela.data.rel.ro   : { *(.rela.data.rel.ro* .rela.gnu.linkonce.d.rel.ro.*) }
-  .rel.data       : { *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*) }
-  .rela.data      : { *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*) }
-  .rel.tdata	  : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
-  .rela.tdata	  : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
-  .rel.tbss	  : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
-  .rela.tbss	  : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
-  .rel.ctors      : { *(.rel.ctors) }
-  .rela.ctors     : { *(.rela.ctors) }
-  .rel.dtors      : { *(.rel.dtors) }
-  .rela.dtors     : { *(.rela.dtors) }
-  .rel.got        : { *(.rel.got) }
-  .rela.got       : { *(.rela.got) }
-  .rel.sdata      : { *(.rel.sdata .rel.sdata.* .rel.gnu.linkonce.s.*) }
-  .rela.sdata     : { *(.rela.sdata .rela.sdata.* .rela.gnu.linkonce.s.*) }
-  .rel.sbss       : { *(.rel.sbss .rel.sbss.* .rel.gnu.linkonce.sb.*) }
-  .rela.sbss      : { *(.rela.sbss .rela.sbss.* .rela.gnu.linkonce.sb.*) }
-  .rel.sdata2     : { *(.rel.sdata2 .rel.sdata2.* .rel.gnu.linkonce.s2.*) }
-  .rela.sdata2    : { *(.rela.sdata2 .rela.sdata2.* .rela.gnu.linkonce.s2.*) }
-  .rel.sbss2      : { *(.rel.sbss2 .rel.sbss2.* .rel.gnu.linkonce.sb2.*) }
-  .rela.sbss2     : { *(.rela.sbss2 .rela.sbss2.* .rela.gnu.linkonce.sb2.*) }
-  .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
-  .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
-  .rel.plt        : { *(.rel.plt) }
-  .rela.plt       : { *(.rela.plt) }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0x08000240
-  .text           :
-  {
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    KEEP (*(.text.*personality*))
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-  } =0x08000240
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x08000240
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .sdata2         :
-  {
-    *(.sdata2 .sdata2.* .gnu.linkonce.s2.*)
-  }
-  .sbss2          : { *(.sbss2 .sbss2.* .gnu.linkonce.sb2.*) }
-  .PARISC.unwind   : { *(.PARISC.unwind) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x10000) + (. & (0x10000 - 1));
-  /* Exception handling  */
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { *(.gcc_except_table .gcc_except_table.*) }
-  /* Thread Local Storage sections  */
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .preinit_array     :
-  {
-    PROVIDE (__preinit_array_start = .);
-    KEEP (*(.preinit_array))
-    PROVIDE (__preinit_array_end = .);
-  }
-  .init_array     :
-  {
-     PROVIDE (__init_array_start = .);
-     KEEP (*(SORT(.init_array.*)))
-     KEEP (*(.init_array))
-     PROVIDE (__init_array_end = .);
-  }
-  .fini_array     :
-  {
-    PROVIDE (__fini_array_start = .);
-    KEEP (*(.fini_array))
-    KEEP (*(SORT(.fini_array.*)))
-    PROVIDE (__fini_array_end = .);
-  }
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin*.o(.ctors))
-    /* We don't want to include the .ctor section from
-       the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin*.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  .data.rel.ro : { *(.data.rel.ro.local* .gnu.linkonce.d.rel.ro.local.*) *(.data.rel.ro* .gnu.linkonce.d.rel.ro.*) }
-  .dynamic        : { *(.dynamic) }
-  .data           :
-  {
-    PROVIDE ($global$ = .);
-    *(.data .data.* .gnu.linkonce.d.*)
-    KEEP (*(.gnu.linkonce.d.*personality*))
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  .plt            : { *(.plt) }
-  .got            : { *(.got.plt) *(.got) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata          :
-  {
-    *(.sdata .sdata.* .gnu.linkonce.s.*)
-  }
-  _edata = .; PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss           :
-  {
-    *(.dynsbss)
-    *(.sbss .sbss.* .gnu.linkonce.sb.*)
-    *(.scommon)
-  }
-  .bss            :
-  {
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.
-      FIXME: Why do we need it? When there is no .bss section, we don't
-      pad the .data section.  */
-   . = ALIGN(. != 0 ? 32 / 8 : 1);
-  }
-  . = ALIGN(32 / 8);
-  . = ALIGN(32 / 8);
-  _end = .; PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab          0 : { *(.stab) }
-  .stabstr       0 : { *(.stabstr) }
-  .stab.excl     0 : { *(.stab.excl) }
-  .stab.exclstr  0 : { *(.stab.exclstr) }
-  .stab.index    0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment       0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /DISCARD/ : { *(.note.GNU-stack) }
-}
diff --git a/ldscripts/i386.ld b/ldscripts/i386.ld
deleted file mode 100644
index cc3f160..0000000
--- a/ldscripts/i386.ld
+++ /dev/null
@@ -1,153 +0,0 @@
-/* ld script to make i386 Linux kernel
- * Written by Martin Mares <mj at atrey.karlin.mff.cuni.cz>;
- */
-OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
-OUTPUT_ARCH(i386)
-ENTRY(_start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp) 	}
-  .hash          : { *(.hash)		}
-  .dynsym        : { *(.dynsym)		}
-  .dynstr        : { *(.dynstr)		}
-  .gnu.version   : { *(.gnu.version)	}
-  .gnu.version_d   : { *(.gnu.version_d)	}
-  .gnu.version_r   : { *(.gnu.version_r)	}
-  .rel.text      :
-    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
-  .rela.text     :
-    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
-  .rel.data      :
-    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
-  .rela.data     :
-    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
-  .rel.rodata    :
-    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
-  .rela.rodata   :
-    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)		}
-  .rela.got      : { *(.rela.got)		}
-  .rel.ctors     : { *(.rel.ctors)	}
-  .rela.ctors    : { *(.rela.ctors)	}
-  .rel.dtors     : { *(.rel.dtors)	}
-  .rela.dtors    : { *(.rela.dtors)	}
-  .rel.init      : { *(.rel.init)	}
-  .rela.init     : { *(.rela.init)	}
-  .rel.fini      : { *(.rel.fini)	}
-  .rela.fini     : { *(.rela.fini)	}
-  .rel.bss       : { *(.rel.bss)		}
-  .rela.bss      : { *(.rela.bss)		}
-  .rel.plt      :
-  {
-    *(.rel.plt)
-    PROVIDE (__rel_iplt_start = .);
-    *(.rel.iplt)
-    PROVIDE (__rel_iplt_end = .);
-  }
-  .rela.plt       :
-  {
-    *(.rela.plt)
-    PROVIDE (__rela_iplt_start = .);
-    *(.rela.iplt)
-    PROVIDE (__rela_iplt_end = .);
-  }
-  .init          : { *(.init)	} =0x47ff041f
-  .text      :
-  {
-    *(.text)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.gnu.linkonce.t*)
-  } =0x47ff041f
-  _etext = .;
-  PROVIDE (etext = .);
-  .fini      : { *(.fini)    } =0x47ff041f
-  . = ALIGN(32 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { *(.preinit_array) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { *(.init_array) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { *(.fini_array) }
-  PROVIDE (__fini_array_end = .);
-  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
-  .rodata1   : { *(.rodata1) }
-  .reginfo : { *(.reginfo) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x100000) + (. & (0x100000 - 1));
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .data    :
-  {
-    *(.data)
-    *(.gnu.linkonce.d*)
-    CONSTRUCTORS
-  }
-  .data1   : { *(.data1) }
-  .ctors         :
-  {
-    *(.ctors)
-  }
-  .dtors         :
-  {
-    *(.dtors)
-  }
-  .plt      : { *(.plt)	}
-  .got           : { *(.got.plt) *(.got) }
-  .dynamic       : { *(.dynamic) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata     : { *(.sdata) }
-  _edata  =  .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss      : { *(.sbss) *(.scommon) }
-  .bss       :
-  {
-   *(.dynbss)
-   *(.bss)
-   *(COMMON)
-  }
-  _end = . ;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /* These must appear regardless of  .  */
-}
diff --git a/ldscripts/ia64.ld b/ldscripts/ia64.ld
deleted file mode 100644
index 0c37796..0000000
--- a/ldscripts/ia64.ld
+++ /dev/null
@@ -1,209 +0,0 @@
-/* Default linker script, for normal executables */
-OUTPUT_FORMAT("elf64-ia64-little", "elf64-ia64-little",
-	      "elf64-ia64-little")
-OUTPUT_ARCH(ia64)
-ENTRY(_start)
-/* __DYNAMIC = 0;    */
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  PROVIDE (__executable_start = 0x60000000); . = 0x60000000 + SIZEOF_HEADERS;
-  .interp         : { *(.interp) }
-  .hash           : { *(.hash) }
-  .dynsym         : { *(.dynsym) }
-  .dynstr         : { *(.dynstr) }
-  .gnu.version    : { *(.gnu.version) }
-  .gnu.version_d  : { *(.gnu.version_d) }
-  .gnu.version_r  : { *(.gnu.version_r) }
-  .rel.init       : { *(.rel.init) }
-  .rela.init      : { *(.rela.init) }
-  .rel.text       : { *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*) }
-  .rela.text      : { *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*) }
-  .rel.fini       : { *(.rel.fini) }
-  .rela.fini      : { *(.rela.fini) }
-  .rel.rodata     : { *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*) }
-  .rela.rodata    : { *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*) }
-  .rel.data       : { *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*) }
-  .rela.data      : { *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*) }
-  .rel.tdata	  : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
-  .rela.tdata	  : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
-  .rel.tbss	  : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
-  .rela.tbss	  : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
-  .rel.ctors      : { *(.rel.ctors) }
-  .rela.ctors     : { *(.rela.ctors) }
-  .rel.dtors      : { *(.rel.dtors) }
-  .rela.dtors     : { *(.rela.dtors) }
-  .rel.got        : { *(.rel.got) }
-  .rela.got       : { *(.rela.got) }
-  .rel.sdata      : { *(.rel.sdata .rel.sdata.* .rel.gnu.linkonce.s.*) }
-  .rela.sdata     : { *(.rela.sdata .rela.sdata.* .rela.gnu.linkonce.s.*) }
-  .rel.sbss       : { *(.rel.sbss .rel.sbss.* .rel.gnu.linkonce.sb.*) }
-  .rela.sbss      : { *(.rela.sbss .rela.sbss.* .rela.gnu.linkonce.sb.*) }
-  .rel.sdata2     : { *(.rel.sdata2 .rel.sdata2.* .rel.gnu.linkonce.s2.*) }
-  .rela.sdata2    : { *(.rela.sdata2 .rela.sdata2.* .rela.gnu.linkonce.s2.*) }
-  .rel.sbss2      : { *(.rel.sbss2 .rel.sbss2.* .rel.gnu.linkonce.sb2.*) }
-  .rela.sbss2     : { *(.rela.sbss2 .rela.sbss2.* .rela.gnu.linkonce.sb2.*) }
-  .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
-  .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
-  .rel.plt        : { *(.rel.plt) }
-  .rela.plt       : { *(.rela.plt) }
-  .rela.IA_64.pltoff   : { *(.rela.IA_64.pltoff) }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0x00300000010070000002000001000400
-  .plt            : { *(.plt) }
-  .text           :
-  {
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-  } =0x00300000010070000002000001000400
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x00300000010070000002000001000400
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .sdata2         : { *(.sdata2 .sdata2.* .gnu.linkonce.s2.*) }
-  .sbss2          : { *(.sbss2 .sbss2.* .gnu.linkonce.sb2.*) }
-  .opd            : { *(.opd) }
-  .IA_64.unwind_info   : { *(.IA_64.unwind_info* .gnu.linkonce.ia64unwi.*) }
-  .IA_64.unwind   : { *(.IA_64.unwind* .gnu.linkonce.ia64unw.*) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x10000) + (. & (0x10000 - 1));
-  /* Ensure the __preinit_array_start label is properly aligned.  We
-     could instead move the label definition inside the section, but
-     the linker would then create the section even if it turns out to
-     be empty, which isn't pretty.  */
-  . = ALIGN(64 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { *(.preinit_array) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { *(.init_array) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { *(.fini_array) }
-  PROVIDE (__fini_array_end = .);
-  .data           :
-  {
-    *(.data .data.* .gnu.linkonce.d.*)
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { *(.gcc_except_table) }
-  .dynamic        : { *(.dynamic) }
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin*.o(.ctors))
-    /* We don't want to include the .ctor section from
-       from the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin*.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  /* Ensure __gp is outside the range of any normal data.  We need to
-     do this to avoid the linker optimizing the code in op.o and getting
-     it out of sync with the relocs that we read when processing that
-     file.  A better solution might be to ensure that the dynamically
-     generated code and static qemu code share a single gp-value.  */
-  __gp = . + 0x200000;
-  .got            : { *(.got.plt) *(.got) }
-  .IA_64.pltoff   : { *(.IA_64.pltoff) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata          :
-  {
-    *(.sdata .sdata.* .gnu.linkonce.s.*)
-  }
-  _edata = .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss           :
-  {
-    PROVIDE (__sbss_start = .);
-    PROVIDE (___sbss_start = .);
-    *(.dynsbss)
-    *(.sbss .sbss.* .gnu.linkonce.sb.*)
-    *(.scommon)
-    PROVIDE (__sbss_end = .);
-    PROVIDE (___sbss_end = .);
-  }
-  .bss            :
-  {
-   . += 0x400000;	/* ensure .bss stuff is out of reach of gp */
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.  */
-   . = ALIGN(64 / 8);
-  }
-  . = ALIGN(64 / 8);
-  _end = .;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab          0 : { *(.stab) }
-  .stabstr       0 : { *(.stabstr) }
-  .stab.excl     0 : { *(.stab.excl) }
-  .stab.exclstr  0 : { *(.stab.exclstr) }
-  .stab.index    0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment       0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /DISCARD/ : { *(.note.GNU-stack) }
-}
diff --git a/ldscripts/m68k.ld b/ldscripts/m68k.ld
deleted file mode 100644
index 0e3d9de..0000000
--- a/ldscripts/m68k.ld
+++ /dev/null
@@ -1,175 +0,0 @@
-/* Script for -z combreloc: combine and sort reloc sections */
-OUTPUT_FORMAT("elf32-m68k", "elf32-m68k",
-	      "elf32-m68k")
-OUTPUT_ARCH(m68k)
-ENTRY(_start)
-/* __DYNAMIC = 0;    */
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp         : { *(.interp) }
-  .hash           : { *(.hash) }
-  .dynsym         : { *(.dynsym) }
-  .dynstr         : { *(.dynstr) }
-  .gnu.version    : { *(.gnu.version) }
-  .gnu.version_d  : { *(.gnu.version_d) }
-  .gnu.version_r  : { *(.gnu.version_r) }
-  .rel.dyn        :
-    {
-      *(.rel.init)
-      *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*)
-      *(.rel.fini)
-      *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*)
-      *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*)
-      *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*)
-      *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*)
-      *(.rel.ctors)
-      *(.rel.dtors)
-      *(.rel.got)
-      *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*)
-    }
-  .rela.dyn       :
-    {
-      *(.rela.init)
-      *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*)
-      *(.rela.fini)
-      *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*)
-      *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*)
-      *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*)
-      *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*)
-      *(.rela.ctors)
-      *(.rela.dtors)
-      *(.rela.got)
-      *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*)
-    }
-  .rel.plt        : { *(.rel.plt) }
-  .rela.plt       : { *(.rela.plt) }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0x4e754e75
-  .plt            : { *(.plt) }
-  .text           :
-  {
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-  } =0x4e754e75
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x4e754e75
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x2000) + (. & (0x2000 - 1));
-  /* Ensure the __preinit_array_start label is properly aligned.  We
-     could instead move the label definition inside the section, but
-     the linker would then create the section even if it turns out to
-     be empty, which isn't pretty.  */
-  . = ALIGN(32 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { *(.preinit_array) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { *(.init_array) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { *(.fini_array) }
-  PROVIDE (__fini_array_end = .);
-  .data           :
-  {
-    *(.data .data.* .gnu.linkonce.d.*)
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { *(.gcc_except_table) }
-  .dynamic        : { *(.dynamic) }
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin.o(.ctors))
-    /* We don't want to include the .ctor section from
-       from the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  .got            : { *(.got.plt) *(.got) }
-  _edata = .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .bss            :
-  {
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.  */
-   . = ALIGN(32 / 8);
-  }
-  . = ALIGN(32 / 8);
-  _end = .;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab          0 : { *(.stab) }
-  .stabstr       0 : { *(.stabstr) }
-  .stab.excl     0 : { *(.stab.excl) }
-  .stab.exclstr  0 : { *(.stab.exclstr) }
-  .stab.index    0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment       0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-}
diff --git a/ldscripts/mips.ld b/ldscripts/mips.ld
deleted file mode 100644
index 7b610ce..0000000
--- a/ldscripts/mips.ld
+++ /dev/null
@@ -1,222 +0,0 @@
-/* Default linker script, for normal executables */
-OUTPUT_FORMAT("elf32-tradbigmips", "elf32-tradbigmips",
-             "elf32-tradlittlemips")
-OUTPUT_ARCH(mips)
-ENTRY(__start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  PROVIDE (__executable_start = 0x0400000); . = 0x0400000 + SIZEOF_HEADERS;
-  .interp         : { *(.interp) }
-  .reginfo        : { *(.reginfo) }
-  .dynamic        : { *(.dynamic) }
-  .hash           : { *(.hash) }
-  .dynsym         : { *(.dynsym) }
-  .dynstr         : { *(.dynstr) }
-  .gnu.version    : { *(.gnu.version) }
-  .gnu.version_d  : { *(.gnu.version_d) }
-  .gnu.version_r  : { *(.gnu.version_r) }
-  .rel.init       : { *(.rel.init) }
-  .rela.init      : { *(.rela.init) }
-  .rel.text       : { *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*) }
-  .rela.text      : { *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*) }
-  .rel.fini       : { *(.rel.fini) }
-  .rela.fini      : { *(.rela.fini) }
-  .rel.rodata     : { *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*) }
-  .rela.rodata    : { *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*) }
-  .rel.data.rel.ro   : { *(.rel.data.rel.ro* .rel.gnu.linkonce.d.rel.ro.*) }
-  .rela.data.rel.ro   : { *(.rela.data.rel.ro* .rela.gnu.linkonce.d.rel.ro.*) }
-  .rel.data       : { *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*) }
-  .rela.data      : { *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*) }
-  .rel.tdata     : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
-  .rela.tdata    : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
-  .rel.tbss      : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
-  .rela.tbss     : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
-  .rel.ctors      : { *(.rel.ctors) }
-  .rela.ctors     : { *(.rela.ctors) }
-  .rel.dtors      : { *(.rel.dtors) }
-  .rela.dtors     : { *(.rela.dtors) }
-  .rel.got        : { *(.rel.got) }
-  .rela.got       : { *(.rela.got) }
-  .rel.sdata      : { *(.rel.sdata .rel.sdata.* .rel.gnu.linkonce.s.*) }
-  .rela.sdata     : { *(.rela.sdata .rela.sdata.* .rela.gnu.linkonce.s.*) }
-  .rel.sbss       : { *(.rel.sbss .rel.sbss.* .rel.gnu.linkonce.sb.*) }
-  .rela.sbss      : { *(.rela.sbss .rela.sbss.* .rela.gnu.linkonce.sb.*) }
-  .rel.sdata2     : { *(.rel.sdata2 .rel.sdata2.* .rel.gnu.linkonce.s2.*) }
-  .rela.sdata2    : { *(.rela.sdata2 .rela.sdata2.* .rela.gnu.linkonce.s2.*) }
-  .rel.sbss2      : { *(.rel.sbss2 .rel.sbss2.* .rel.gnu.linkonce.sb2.*) }
-  .rela.sbss2     : { *(.rela.sbss2 .rela.sbss2.* .rela.gnu.linkonce.sb2.*) }
-  .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
-  .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
-  .rel.plt        : { *(.rel.plt) }
-  .rela.plt       : { *(.rela.plt) }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0x47ff041f
-  .plt            : { *(.plt) }
-  .text           :
-  {
-    _ftext = . ;
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    KEEP (*(.text.*personality*))
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.mips16.fn.*) *(.mips16.call.*)
-  } =0x47ff041f
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x47ff041f
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .sdata2         :
-  {
-    *(.sdata2 .sdata2.* .gnu.linkonce.s2.*)
-  }
-  .sbss2          : { *(.sbss2 .sbss2.* .gnu.linkonce.sb2.*) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN (0x40000) - ((0x40000 - .) & (0x40000 - 1)); . = DATA_SEGMENT_ALIGN (0x40000, 0x1000);
-  /* Exception handling  */
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { *(.gcc_except_table .gcc_except_table.*) }
-  /* Thread Local Storage sections  */
-  .tdata         : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss                  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .preinit_array     :
-  {
-    PROVIDE (__preinit_array_start = .);
-    KEEP (*(.preinit_array))
-    PROVIDE (__preinit_array_end = .);
-  }
-  .init_array     :
-  {
-     PROVIDE (__init_array_start = .);
-     KEEP (*(SORT(.init_array.*)))
-     KEEP (*(.init_array))
-     PROVIDE (__init_array_end = .);
-  }
-  .fini_array     :
-  {
-    PROVIDE (__fini_array_start = .);
-    KEEP (*(.fini_array))
-    KEEP (*(SORT(.fini_array.*)))
-    PROVIDE (__fini_array_end = .);
-  }
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin*.o(.ctors))
-    /* We don't want to include the .ctor section from
-       the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin*.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  .data.rel.ro : { *(.data.rel.ro.local* .gnu.linkonce.d.rel.ro.local.*) *(.data.rel.ro* .gnu.linkonce.d.rel.ro.*) }
-  . = DATA_SEGMENT_RELRO_END (0, .);
-  .data           :
-  {
-    _fdata = . ;
-    *(.data .data.* .gnu.linkonce.d.*)
-    KEEP (*(.gnu.linkonce.d.*personality*))
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  . = .;
-  _gp = ALIGN(16) + 0x7ff0;
-  .got            : { *(.got.plt) *(.got) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata          :
-  {
-    *(.sdata .sdata.* .gnu.linkonce.s.*)
-  }
-  .lit8           : { *(.lit8) }
-  .lit4           : { *(.lit4) }
-  _edata = .; PROVIDE (edata = .);
-  __bss_start = .;
-  _fbss = .;
-  .sbss           :
-  {
-    *(.dynsbss)
-    *(.sbss .sbss.* .gnu.linkonce.sb.*)
-    *(.scommon)
-  }
-  .bss            :
-  {
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.
-      FIXME: Why do we need it? When there is no .bss section, we don't
-      pad the .data section.  */
-   . = ALIGN(. != 0 ? 32 / 8 : 1);
-  }
-  . = ALIGN(32 / 8);
-  . = ALIGN(32 / 8);
-  _end = .; PROVIDE (end = .);
-  . = DATA_SEGMENT_END (.);
-  /* Stabs debugging sections.  */
-  .stab          0 : { *(.stab) }
-  .stabstr       0 : { *(.stabstr) }
-  .stab.excl     0 : { *(.stab.excl) }
-  .stab.exclstr  0 : { *(.stab.exclstr) }
-  .stab.index    0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment       0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  .gptab.sdata : { *(.gptab.data) *(.gptab.sdata) }
-  .gptab.sbss : { *(.gptab.bss) *(.gptab.sbss) }
-  /DISCARD/ : { *(.note.GNU-stack) }
-}
diff --git a/ldscripts/ppc.ld b/ldscripts/ppc.ld
deleted file mode 100644
index 2a0dcad..0000000
--- a/ldscripts/ppc.ld
+++ /dev/null
@@ -1,237 +0,0 @@
-/* ld script to make i386 Linux kernel
- * Written by Martin Mares <mj at atrey.karlin.mff.cuni.cz>;
- */
-OUTPUT_FORMAT("elf32-powerpc", "elf32-powerpc", "elf32-powerpc")
-OUTPUT_ARCH(powerpc:common)
-ENTRY(_start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp) 	}
-  .hash          : { *(.hash)		}
-  .dynsym        : { *(.dynsym)		}
-  .dynstr        : { *(.dynstr)		}
-  .gnu.version   : { *(.gnu.version)	}
-  .gnu.version_d   : { *(.gnu.version_d)	}
-  .gnu.version_r   : { *(.gnu.version_r)	}
-  .rel.init       : { *(.rel.init) }
-  .rela.init      : { *(.rela.init) }
-  .rel.text       : { *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*) }
-  .rela.text      : { *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*) }
-  .rel.fini       : { *(.rel.fini) }
-  .rela.fini      : { *(.rela.fini) }
-  .rel.rodata     : { *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*) }
-  .rela.rodata    : { *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*) }
-  .rel.data.rel.ro   : { *(.rel.data.rel.ro* .rel.gnu.linkonce.d.rel.ro.*) }
-  .rela.data.rel.ro   : { *(.rela.data.rel.ro* .rela.gnu.linkonce.d.rel.ro.*) }
-  .rel.data       : { *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*) }
-  .rela.data      : { *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*) }
-  .rel.tdata	  : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
-  .rela.tdata	  : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
-  .rel.tbss	  : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
-  .rela.tbss	  : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
-  .rel.ctors      : { *(.rel.ctors) }
-  .rela.ctors     : { *(.rela.ctors) }
-  .rel.dtors      : { *(.rel.dtors) }
-  .rela.dtors     : { *(.rela.dtors) }
-  .rel.got        : { *(.rel.got) }
-  .rela.got       : { *(.rela.got) }
-  .rela.got1           : { *(.rela.got1) }
-  .rela.got2           : { *(.rela.got2) }
-  .rel.sdata      : { *(.rel.sdata .rel.sdata.* .rel.gnu.linkonce.s.*) }
-  .rela.sdata     : { *(.rela.sdata .rela.sdata.* .rela.gnu.linkonce.s.*) }
-  .rel.sbss       : { *(.rel.sbss .rel.sbss.* .rel.gnu.linkonce.sb.*) }
-  .rela.sbss      : { *(.rela.sbss .rela.sbss.* .rela.gnu.linkonce.sb.*) }
-  .rel.sdata2     : { *(.rel.sdata2 .rel.sdata2.* .rel.gnu.linkonce.s2.*) }
-  .rela.sdata2    : { *(.rela.sdata2 .rela.sdata2.* .rela.gnu.linkonce.s2.*) }
-  .rel.sbss2      : { *(.rel.sbss2 .rel.sbss2.* .rel.gnu.linkonce.sb2.*) }
-  .rela.sbss2     : { *(.rela.sbss2 .rela.sbss2.* .rela.gnu.linkonce.sb2.*) }
-  .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
-  .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
-  .rel.plt      :
-  {
-    *(.rel.plt)
-    PROVIDE (__rel_iplt_start = .);
-    *(.rel.iplt)
-    PROVIDE (__rel_iplt_end = .);
-  }
-  .rela.plt       :
-  {
-    *(.rela.plt)
-    PROVIDE (__rela_iplt_start = .);
-    *(.rela.iplt)
-    PROVIDE (__rela_iplt_end = .);
-  }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0
-  .text           :
-  {
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    KEEP (*(.text.*personality*))
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.glink)
-  } =0x47ff041f
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x47ff041f
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .sdata2         :
-  {
-    PROVIDE (_SDA2_BASE_ = 32768);
-    *(.sdata2 .sdata2.* .gnu.linkonce.s2.*)
-  }
-  .sbss2          : { *(.sbss2 .sbss2.* .gnu.linkonce.sb2.*) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN (0x10000) - ((0x10000 - .) & (0x10000 - 1)); . = DATA_SEGMENT_ALIGN (0x10000, 0x1000);
-  /* Exception handling  */
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { *(.gcc_except_table .gcc_except_table.*) }
-  /* Thread Local Storage sections  */
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .preinit_array     :
-  {
-    PROVIDE (__preinit_array_start = .);
-    KEEP (*(.preinit_array))
-    PROVIDE (__preinit_array_end = .);
-  }
-  .init_array     :
-  {
-     PROVIDE (__init_array_start = .);
-     KEEP (*(SORT(.init_array.*)))
-     KEEP (*(.init_array))
-     PROVIDE (__init_array_end = .);
-  }
-  .fini_array     :
-  {
-    PROVIDE (__fini_array_start = .);
-    KEEP (*(.fini_array))
-    KEEP (*(SORT(.fini_array.*)))
-    PROVIDE (__fini_array_end = .);
-  }
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin*.o(.ctors))
-    /* We don't want to include the .ctor section from
-       the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin*.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  .data.rel.ro : { *(.data.rel.ro.local* .gnu.linkonce.d.rel.ro.local.*) *(.data.rel.ro* .gnu.linkonce.d.rel.ro.*) }
-  .got1           : { *(.got1) }
-  .got2           : { *(.got2) }
-  .dynamic        : { *(.dynamic) }
-  .got            : SPECIAL { *(.got) }
-  . = DATA_SEGMENT_RELRO_END (0, .);
-  .plt            : SPECIAL { *(.plt) }
-  .data           :
-  {
-    *(.data .data.* .gnu.linkonce.d.*)
-    KEEP (*(.gnu.linkonce.d.*personality*))
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  .got            : SPECIAL { *(.got) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata          :
-  {
-    PROVIDE (_SDA_BASE_ = 32768);
-    *(.sdata .sdata.* .gnu.linkonce.s.*)
-  }
-  _edata = .; PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss           :
-  {
-    PROVIDE (__sbss_start = .); PROVIDE (___sbss_start = .);
-    *(.dynsbss)
-    *(.sbss .sbss.* .gnu.linkonce.sb.*)
-    *(.scommon)
-    PROVIDE (__sbss_end = .); PROVIDE (___sbss_end = .);
-  }
-  .plt            : SPECIAL { *(.plt) }
-  .bss            :
-  {
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.
-      FIXME: Why do we need it? When there is no .bss section, we don't
-      pad the .data section.  */
-   . = ALIGN(. != 0 ? 32 / 8 : 1);
-  }
-  . = ALIGN(32 / 8);
-  . = ALIGN(32 / 8);
-  _end = .; PROVIDE (end = .);
-  . = DATA_SEGMENT_END (.);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /* These must appear regardless of  .  */
-  /DISCARD/    : { *(.fixup) }
-  /DISCARD/ : { *(.note.GNU-stack) }
-}
diff --git a/ldscripts/ppc64.ld b/ldscripts/ppc64.ld
deleted file mode 100644
index e2dafa0..0000000
--- a/ldscripts/ppc64.ld
+++ /dev/null
@@ -1,230 +0,0 @@
-/* Script for -z combreloc: combine and sort reloc sections */
-OUTPUT_FORMAT("elf64-powerpc", "elf64-powerpc",
-	      "elf64-powerpc")
-OUTPUT_ARCH(powerpc:common64)
-ENTRY(_start)
-/* __DYNAMIC = 0;    */
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  PROVIDE (__executable_start = 0x60000000); . = 0x60000000 + SIZEOF_HEADERS;
-  .interp         : { *(.interp) }
-  .hash           : { *(.hash) }
-  .dynsym         : { *(.dynsym) }
-  .dynstr         : { *(.dynstr) }
-  .gnu.version    : { *(.gnu.version) }
-  .gnu.version_d  : { *(.gnu.version_d) }
-  .gnu.version_r  : { *(.gnu.version_r) }
-  .rel.dyn        :
-    {
-      *(.rel.init)
-      *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*)
-      *(.rel.fini)
-      *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*)
-      *(.rel.data.rel.ro*)
-      *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*)
-      *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*)
-      *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*)
-      *(.rel.ctors)
-      *(.rel.dtors)
-      *(.rel.got)
-      *(.rel.sdata .rel.sdata.* .rel.gnu.linkonce.s.*)
-      *(.rel.sbss .rel.sbss.* .rel.gnu.linkonce.sb.*)
-      *(.rel.sdata2 .rel.sdata2.* .rel.gnu.linkonce.s2.*)
-      *(.rel.sbss2 .rel.sbss2.* .rel.gnu.linkonce.sb2.*)
-      *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*)
-    }
-  .rela.dyn       :
-    {
-      *(.rela.init)
-      *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*)
-      *(.rela.fini)
-      *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*)
-      *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*)
-      *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*)
-      *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*)
-      *(.rela.ctors)
-      *(.rela.dtors)
-      *(.rela.got)
-      *(.rela.toc)
-      *(.rela.opd)
-      *(.rela.sdata .rela.sdata.* .rela.gnu.linkonce.s.*)
-      *(.rela.sbss .rela.sbss.* .rela.gnu.linkonce.sb.*)
-      *(.rela.sdata2 .rela.sdata2.* .rela.gnu.linkonce.s2.*)
-      *(.rela.sbss2 .rela.sbss2.* .rela.gnu.linkonce.sb2.*)
-      *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*)
-    }
-  .rel.plt      :
-  {
-    *(.rel.plt)
-    PROVIDE (__rel_iplt_start = .);
-    *(.rel.iplt)
-    PROVIDE (__rel_iplt_end = .);
-  }
-  .rela.plt       :
-  {
-    *(.rela.plt)
-    PROVIDE (__rela_iplt_start = .);
-    *(.rela.iplt)
-    PROVIDE (__rela_iplt_end = .);
-  }
-  .rela.tocbss	  : { *(.rela.tocbss) }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0x60000000
-  .text           :
-  {
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    KEEP (*(.text.*personality*))
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.sfpr .glink)
-  } =0x60000000
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x60000000
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .sdata2         : { *(.sdata2 .sdata2.* .gnu.linkonce.s2.*) }
-  .sbss2          : { *(.sbss2 .sbss2.* .gnu.linkonce.sb2.*) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN (0x10000) - ((0x10000 - .) & (0x10000 - 1)); . = DATA_SEGMENT_ALIGN
-(0x10000, 0x1000);   /* Exception handling  */
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { KEEP (*(.gcc_except_table))
-*(.gcc_except_table.*) }   /* Thread Local Storage sections  */
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  /* Ensure the __preinit_array_start label is properly aligned.  We
-     could instead move the label definition inside the section, but
-     the linker would then create the section even if it turns out to
-     be empty, which isn't pretty.  */
-  . = ALIGN(64 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { KEEP (*(.preinit_array)) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { KEEP (*(.init_array)) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { KEEP (*(.fini_array)) }
-  PROVIDE (__fini_array_end = .);
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin*.o(.ctors))
-    /* We don't want to include the .ctor section from
-       from the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin*.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  .data.rel.ro : { *(.data.rel.ro.local) *(.data.rel.ro*) }
-  .dynamic        : { *(.dynamic) }
-  . = DATA_SEGMENT_RELRO_END (0, .);
-  .data           :
-  {
-    *(.data .data.* .gnu.linkonce.d.*)
-    KEEP (*(.gnu.linkonce.d.*personality*))
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  .toc1		 ALIGN(8) : { *(.toc1) }
-  .opd		 ALIGN(8) : { KEEP (*(.opd)) }
-  .got		ALIGN(8) : { *(.got .toc) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata          :
-  {
-    *(.sdata .sdata.* .gnu.linkonce.s.*)
-  }
-  _edata = .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .tocbss	 ALIGN(8) : { *(.tocbss)}
-  .sbss           :
-  {
-    PROVIDE (__sbss_start = .);
-    PROVIDE (___sbss_start = .);
-    *(.dynsbss)
-    *(.sbss .sbss.* .gnu.linkonce.sb.*)
-    *(.scommon)
-    PROVIDE (__sbss_end = .);
-    PROVIDE (___sbss_end = .);
-  }
-  .plt            : { *(.plt) }
-  .bss            :
-  {
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.  */
-   . = ALIGN(64 / 8);
-  }
-  . = ALIGN(64 / 8);
-  _end = .;
-  PROVIDE (end = .);
-  . = DATA_SEGMENT_END (.);
-  /* Stabs debugging sections.  */
-  .stab          0 : { *(.stab) }
-  .stabstr       0 : { *(.stabstr) }
-  .stab.excl     0 : { *(.stab.excl) }
-  .stab.exclstr  0 : { *(.stab.exclstr) }
-  .stab.index    0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment       0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /DISCARD/ : { *(.note.GNU-stack) }
-}
diff --git a/ldscripts/s390.ld b/ldscripts/s390.ld
deleted file mode 100644
index a9c5370..0000000
--- a/ldscripts/s390.ld
+++ /dev/null
@@ -1,201 +0,0 @@
-OUTPUT_FORMAT("elf32-s390", "elf32-s390",
-	      "elf32-s390")
-OUTPUT_ARCH(s390:31-bit)
-ENTRY(_start)
-/* __DYNAMIC = 0;    */
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp         : { *(.interp) }
-  .hash           : { *(.hash) }
-  .dynsym         : { *(.dynsym) }
-  .dynstr         : { *(.dynstr) }
-  .gnu.version    : { *(.gnu.version) }
-  .gnu.version_d  : { *(.gnu.version_d) }
-  .gnu.version_r  : { *(.gnu.version_r) }
-  .rel.dyn        :
-    {
-      *(.rel.init)
-      *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*)
-      *(.rel.fini)
-      *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*)
-      *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*)
-      *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*)
-      *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*)
-      *(.rel.ctors)
-      *(.rel.dtors)
-      *(.rel.got)
-      *(.rel.sdata .rel.sdata.* .rel.gnu.linkonce.s.*)
-      *(.rel.sbss .rel.sbss.* .rel.gnu.linkonce.sb.*)
-      *(.rel.sdata2 .rel.sdata2.* .rel.gnu.linkonce.s2.*)
-      *(.rel.sbss2 .rel.sbss2.* .rel.gnu.linkonce.sb2.*)
-      *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*)
-    }
-  .rela.dyn       :
-    {
-      *(.rela.init)
-      *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*)
-      *(.rela.fini)
-      *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*)
-      *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*)
-      *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*)
-      *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*)
-      *(.rela.ctors)
-      *(.rela.dtors)
-      *(.rela.got)
-      *(.rela.sdata .rela.sdata.* .rela.gnu.linkonce.s.*)
-      *(.rela.sbss .rela.sbss.* .rela.gnu.linkonce.sb.*)
-      *(.rela.sdata2 .rela.sdata2.* .rela.gnu.linkonce.s2.*)
-      *(.rela.sbss2 .rela.sbss2.* .rela.gnu.linkonce.sb2.*)
-      *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*)
-    }
-  .rel.plt        : { *(.rel.plt) }
-  .rela.plt       : { *(.rela.plt) }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0x07070707
-  .plt            : { *(.plt) }
-  .text           :
-  {
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-  } =0x07070707
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x07070707
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .sdata2         : { *(.sdata2 .sdata2.* .gnu.linkonce.s2.*) }
-  .sbss2          : { *(.sbss2 .sbss2.* .gnu.linkonce.sb2.*) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x1000) + (. & (0x1000 - 1));
-  /* Ensure the __preinit_array_start label is properly aligned.  We
-     could instead move the label definition inside the section, but
-     the linker would then create the section even if it turns out to
-     be empty, which isn't pretty.  */
-  . = ALIGN(32 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { *(.preinit_array) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { *(.init_array) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { *(.fini_array) }
-  PROVIDE (__fini_array_end = .);
-  .data           :
-  {
-    *(.data .data.* .gnu.linkonce.d.*)
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { *(.gcc_except_table) }
-  .dynamic        : { *(.dynamic) }
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin.o(.ctors))
-    /* We don't want to include the .ctor section from
-       from the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  .got            : { *(.got.plt) *(.got) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata          :
-  {
-    *(.sdata .sdata.* .gnu.linkonce.s.*)
-  }
-  _edata = .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss           :
-  {
-    PROVIDE (__sbss_start = .);
-    PROVIDE (___sbss_start = .);
-    *(.dynsbss)
-    *(.sbss .sbss.* .gnu.linkonce.sb.*)
-    *(.scommon)
-    PROVIDE (__sbss_end = .);
-    PROVIDE (___sbss_end = .);
-  }
-  .bss            :
-  {
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.  */
-   . = ALIGN(32 / 8);
-  }
-  . = ALIGN(32 / 8);
-  _end = .;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab          0 : { *(.stab) }
-  .stabstr       0 : { *(.stabstr) }
-  .stab.excl     0 : { *(.stab.excl) }
-  .stab.exclstr  0 : { *(.stab.exclstr) }
-  .stab.index    0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment       0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-}
diff --git a/ldscripts/sparc.ld b/ldscripts/sparc.ld
deleted file mode 100644
index 56efe34..0000000
--- a/ldscripts/sparc.ld
+++ /dev/null
@@ -1,150 +0,0 @@
-OUTPUT_FORMAT("elf32-sparc", "elf32-sparc",
-              "elf32-sparc")
-OUTPUT_ARCH(sparc)
-ENTRY(_start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp)    }
-  .hash          : { *(.hash)           }
-  .dynsym        : { *(.dynsym)         }
-  .dynstr        : { *(.dynstr)         }
-  .gnu.version   : { *(.gnu.version)    }
-  .gnu.version_d   : { *(.gnu.version_d)        }
-  .gnu.version_r   : { *(.gnu.version_r)        }
-  .rel.text      :
-    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
-  .rela.text     :
-    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
-  .rel.data      :
-    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
-  .rela.data     :
-    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
-  .rel.rodata    :
-    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
-  .rela.rodata   :
-    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)                }
-  .rela.got      : { *(.rela.got)               }
-  .rel.ctors     : { *(.rel.ctors)      }
-  .rela.ctors    : { *(.rela.ctors)     }
-  .rel.dtors     : { *(.rel.dtors)      }
-  .rela.dtors    : { *(.rela.dtors)     }
-  .rel.init      : { *(.rel.init)       }
-  .rela.init     : { *(.rela.init)      }
-  .rel.fini      : { *(.rel.fini)       }
-  .rela.fini     : { *(.rela.fini)      }
-  .rel.bss       : { *(.rel.bss)                }
-  .rela.bss      : { *(.rela.bss)               }
-  .rel.plt       : { *(.rel.plt)                }
-  .rela.plt      : { *(.rela.plt)               }
-  .init          : { *(.init)   } =0x47ff041f
-  .text      :
-  {
-    *(.text)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.gnu.linkonce.t*)
-  } =0x47ff041f
-  _etext = .;
-  PROVIDE (etext = .);
-  .fini      : { *(.fini)    } =0x47ff041f
-  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
-  .rodata1   : { *(.rodata1) }
-  .reginfo : { *(.reginfo) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x100000) + (. & (0x100000 - 1));
-  .data    :
-  {
-    *(.data)
-    *(.gnu.linkonce.d*)
-    CONSTRUCTORS
-  }
-  .data1   : { *(.data1) }
-  .tdata    : { *(.tdata) }
-  .tbss    : { *(.tbss) }
-  .preinit_array     :
-  {
-    PROVIDE (__preinit_array_start = .);
-    KEEP (*(.preinit_array))
-    PROVIDE (__preinit_array_end = .);
-  }
-  .init_array     :
-  {
-     PROVIDE (__init_array_start = .);
-     KEEP (*(SORT(.init_array.*)))
-     KEEP (*(.init_array))
-     PROVIDE (__init_array_end = .);
-  }
-  .fini_array     :
-  {
-    PROVIDE (__fini_array_start = .);
-    KEEP (*(.fini_array))
-    KEEP (*(SORT(.fini_array.*)))
-    PROVIDE (__fini_array_end = .);
-  }
-  .ctors         :
-  {
-    *(.ctors)
-  }
-  .dtors         :
-  {
-    *(.dtors)
-  }
-  .plt      : { *(.plt) }
-  .got           : { *(.got.plt) *(.got) }
-  .dynamic       : { *(.dynamic) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata     : { *(.sdata) }
-  _edata  =  .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss      : { *(.sbss) *(.scommon) }
-  .bss       :
-  {
-   *(.dynbss)
-   *(.bss)
-   *(COMMON)
-  }
-  _end = . ;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /* These must appear regardless of  .  */
-  /DISCARD/ : { *(.note.GNU-stack) *(.note.ABI-tag) }
-}
diff --git a/ldscripts/sparc64.ld b/ldscripts/sparc64.ld
deleted file mode 100644
index 9ea4143..0000000
--- a/ldscripts/sparc64.ld
+++ /dev/null
@@ -1,138 +0,0 @@
-OUTPUT_FORMAT("elf64-sparc", "elf64-sparc",
-              "elf64-sparc")
-OUTPUT_ARCH(sparc:v9)
-ENTRY(_start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp)    }
-  .hash          : { *(.hash)           }
-  .dynsym        : { *(.dynsym)         }
-  .dynstr        : { *(.dynstr)         }
-  .gnu.version   : { *(.gnu.version)    }
-  .gnu.version_d   : { *(.gnu.version_d)        }
-  .gnu.version_r   : { *(.gnu.version_r)        }
-  .rel.text      :
-    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
-  .rela.text     :
-    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
-  .rel.data      :
-    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
-  .rela.data     :
-    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
-  .rel.rodata    :
-    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
-  .rela.rodata   :
-    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)                }
-  .rela.got      : { *(.rela.got)               }
-  .rel.ctors     : { *(.rel.ctors)      }
-  .rela.ctors    : { *(.rela.ctors)     }
-  .rel.dtors     : { *(.rel.dtors)      }
-  .rela.dtors    : { *(.rela.dtors)     }
-  .rel.init      : { *(.rel.init)       }
-  .rela.init     : { *(.rela.init)      }
-  .rel.fini      : { *(.rel.fini)       }
-  .rela.fini     : { *(.rela.fini)      }
-  .rel.bss       : { *(.rel.bss)                }
-  .rela.bss      : { *(.rela.bss)               }
-  .rel.plt       : { *(.rel.plt)                }
-  .rela.plt      : { *(.rela.plt)               }
-  .init          : { *(.init)   } =0x47ff041f
-  .text      :
-  {
-    *(.text)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    *(.gnu.linkonce.t*)
-  } =0x47ff041f
-  _etext = .;
-  PROVIDE (etext = .);
-  .fini      : { *(.fini)    } =0x47ff041f
-  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
-  .rodata1   : { *(.rodata1) }
-  . = ALIGN(64 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { *(.preinit_array) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { *(.init_array) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { *(.fini_array) }
-  PROVIDE (__fini_array_end = .);
-  .reginfo : { *(.reginfo) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN(0x100000) + (. & (0x100000 - 1));
-  .data    :
-  {
-    *(.gen_code)
-    *(.data)
-    *(.gnu.linkonce.d*)
-    CONSTRUCTORS
-  }
-  .data1   : { *(.data1) }
-  .ctors         :
-  {
-    *(.ctors)
-  }
-  .dtors         :
-  {
-    *(.dtors)
-  }
-  .plt      : { *(.plt) }
-  .got           : { *(.got.plt) *(.got) }
-  .dynamic       : { *(.dynamic) }
-  /* We want the small data sections together, so single-instruction offsets
-     can access them all, and initialized data all before uninitialized, so
-     we can shorten the on-disk segment size.  */
-  .sdata     : { *(.sdata) }
-  _edata  =  .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .sbss      : { *(.sbss) *(.scommon) }
-  .bss       :
-  {
-   *(.dynbss)
-   *(.bss)
-   *(COMMON)
-  }
-  _end = . ;
-  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-  /* These must appear regardless of  .  */
-}
diff --git a/ldscripts/x86_64.ld b/ldscripts/x86_64.ld
deleted file mode 100644
index b7a9f4e..0000000
--- a/ldscripts/x86_64.ld
+++ /dev/null
@@ -1,180 +0,0 @@
-/* Default linker script, for normal executables */
-OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64")
-OUTPUT_ARCH(i386:x86-64)
-ENTRY(_start)
-SECTIONS
-{
-  /* Read-only sections, merged into text segment: */
-  . = 0x60000000 + SIZEOF_HEADERS;
-  .interp         : { *(.interp) }
-  .hash           : { *(.hash) }
-  .dynsym         : { *(.dynsym) }
-  .dynstr         : { *(.dynstr) }
-  .gnu.version    : { *(.gnu.version) }
-  .gnu.version_d  : { *(.gnu.version_d) }
-  .gnu.version_r  : { *(.gnu.version_r) }
-  .rel.init       : { *(.rel.init) }
-  .rela.init      : { *(.rela.init) }
-  .rel.text       : { *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*) }
-  .rela.text      : { *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*) }
-  .rel.fini       : { *(.rel.fini) }
-  .rela.fini      : { *(.rela.fini) }
-  .rel.rodata     : { *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*) }
-  .rela.rodata    : { *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*) }
-  .rel.data       : { *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*) }
-  .rela.data      : { *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*) }
-  .rel.tdata	  : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
-  .rela.tdata	  : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
-  .rel.tbss	  : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
-  .rela.tbss	  : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
-  .rel.ctors      : { *(.rel.ctors) }
-  .rela.ctors     : { *(.rela.ctors) }
-  .rel.dtors      : { *(.rel.dtors) }
-  .rela.dtors     : { *(.rela.dtors) }
-  .rel.got        : { *(.rel.got) }
-  .rela.got       : { *(.rela.got) }
-  .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
-  .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
-  .rel.plt      :
-  {
-    *(.rel.plt)
-    PROVIDE (__rel_iplt_start = .);
-    *(.rel.iplt)
-    PROVIDE (__rel_iplt_end = .);
-  }
-  .rela.plt       :
-  {
-    *(.rela.plt)
-    PROVIDE (__rela_iplt_start = .);
-    *(.rela.iplt)
-    PROVIDE (__rela_iplt_end = .);
-  }
-  .init           :
-  {
-    KEEP (*(.init))
-  } =0x90909090
-  .plt            : { *(.plt) }
-  .text           :
-  {
-    *(.text .stub .text.* .gnu.linkonce.t.*)
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-  } =0x90909090
-  .fini           :
-  {
-    KEEP (*(.fini))
-  } =0x90909090
-  PROVIDE (__etext = .);
-  PROVIDE (_etext = .);
-  PROVIDE (etext = .);
-  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
-  .rodata1        : { *(.rodata1) }
-  .eh_frame_hdr : { *(.eh_frame_hdr) }
-  /* Adjust the address for the data segment.  We want to adjust up to
-     the same address within the page on the next page up.  */
-  . = ALIGN (0x100000) - ((0x100000 - .) & (0x100000 - 1)); . = DATA_SEGMENT_ALIGN (0x100000, 0x1000);
-  /* Ensure the __preinit_array_start label is properly aligned.  We
-     could instead move the label definition inside the section, but
-     the linker would then create the section even if it turns out to
-     be empty, which isn't pretty.  */
-  . = ALIGN(64 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { *(.preinit_array) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { *(.init_array) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { *(.fini_array) }
-  PROVIDE (__fini_array_end = .);
-  .data           :
-  {
-    *(.data .data.* .gnu.linkonce.d.*)
-    SORT(CONSTRUCTORS)
-  }
-  .data1          : { *(.data1) }
-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
-  .eh_frame       : { KEEP (*(.eh_frame)) }
-  .gcc_except_table   : { *(.gcc_except_table) }
-  .dynamic        : { *(.dynamic) }
-  .ctors          :
-  {
-    /* gcc uses crtbegin.o to find the start of
-       the constructors, so we make sure it is
-       first.  Because this is a wildcard, it
-       doesn't matter if the user does not
-       actually link against crtbegin.o; the
-       linker won't look for a file to match a
-       wildcard.  The wildcard also means that it
-       doesn't matter which directory crtbegin.o
-       is in.  */
-    KEEP (*crtbegin.o(.ctors))
-    /* We don't want to include the .ctor section from
-       from the crtend.o file until after the sorted ctors.
-       The .ctor section from the crtend file contains the
-       end of ctors marker and it must be last */
-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-  }
-  .dtors          :
-  {
-    KEEP (*crtbegin.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-  }
-  .jcr            : { KEEP (*(.jcr)) }
-  .got            : { *(.got.plt) *(.got) }
-  _edata = .;
-  PROVIDE (edata = .);
-  __bss_start = .;
-  .bss            :
-  {
-   *(.dynbss)
-   *(.bss .bss.* .gnu.linkonce.b.*)
-   *(COMMON)
-   /* Align here to ensure that the .bss section occupies space up to
-      _end.  Align after .bss to ensure correct alignment even if the
-      .bss section disappears because there are no input sections.  */
-   . = ALIGN(64 / 8);
-  }
-  . = ALIGN(64 / 8);
-  _end = .;
-  PROVIDE (end = .);
-  . = DATA_SEGMENT_END (.);
-  /* Stabs debugging sections.  */
-  .stab          0 : { *(.stab) }
-  .stabstr       0 : { *(.stabstr) }
-  .stab.excl     0 : { *(.stab.excl) }
-  .stab.exclstr  0 : { *(.stab.exclstr) }
-  .stab.index    0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment       0 : { *(.comment) }
-  /* DWARF debug sections.
-     Symbols in the DWARF debugging sections are relative to the beginning
-     of the section so we begin them at 0.  */
-  /* DWARF 1 */
-  .debug          0 : { *(.debug) }
-  .line           0 : { *(.line) }
-  /* GNU DWARF 1 extensions */
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  /* DWARF 1.1 and DWARF 2 */
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  /* DWARF 2 */
-  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
-  .debug_abbrev   0 : { *(.debug_abbrev) }
-  .debug_line     0 : { *(.debug_line) }
-  .debug_frame    0 : { *(.debug_frame) }
-  .debug_str      0 : { *(.debug_str) }
-  .debug_loc      0 : { *(.debug_loc) }
-  .debug_macinfo  0 : { *(.debug_macinfo) }
-  /* SGI/MIPS DWARF 2 extensions */
-  .debug_weaknames 0 : { *(.debug_weaknames) }
-  .debug_funcnames 0 : { *(.debug_funcnames) }
-  .debug_typenames 0 : { *(.debug_typenames) }
-  .debug_varnames  0 : { *(.debug_varnames) }
-}
commit 885a73f72b967900296d71c97cc7c560585a9086
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 10 18:30:38 2013 +0200

    linux-user: Avoid conditional cpu_reset()
    
    Some CPUs reset as part of cpu_init(), some others were reset
    afterwards, some not at all. While some targets didn't implement a
    cpu_[state_]reset() function, QOM cpu_reset() is always available.
    There's nothing wrong with resetting twice on startup, so drop
    the #ifdef.
    
    Suggested-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Cc: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/main.c b/linux-user/main.c
index 5537967..547884c 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3594,9 +3594,7 @@ int main(int argc, char **argv, char **envp)
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-#if defined(TARGET_SPARC) || defined(TARGET_PPC)
     cpu_reset(ENV_GET_CPU(env));
-#endif
 
     thread_cpu = ENV_GET_CPU(env);
 
commit 24cb36a61c663d98a53338620e88e4cd3403459a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:45:00 2013 +0100

    configure: Make NPTL non-optional
    
    Now all linux-user targets support building with NPTL, we can make it
    mandatory. This is a good idea because:
     * NPTL is no longer new and experimental; it is completely standard
     * in practice, linux-user without NPTL is nearly useless for
       binaries built against non-ancient glibc
     * it allows us to delete the rather untested code for handling
       the non-NPTL configuration
    
    Note that this patch leaves the CONFIG_USE_NPTL ifdefs in the
    bsd-user codebase alone. This makes no change for bsd-user, since
    our configure test for NPTL had a "#include <linux/futex.h>"
    which means bsd-user would never have been compiled with
    CONFIG_USE_NPTL defined, and it still is not.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index 999b2ce..9d9088e 100755
--- a/configure
+++ b/configure
@@ -155,7 +155,6 @@ curl=""
 curses=""
 docs=""
 fdt=""
-nptl=""
 pixman=""
 sdl=""
 virtfs=""
@@ -855,10 +854,6 @@ for opt do
   ;;
   --enable-fdt) fdt="yes"
   ;;
-  --disable-nptl) nptl="no"
-  ;;
-  --enable-nptl) nptl="yes"
-  ;;
   --enable-mixemu) mixemu="yes"
   ;;
   --disable-linux-aio) linux_aio="no"
@@ -1096,8 +1091,6 @@ echo "  --disable-slirp          disable SLIRP userspace network connectivity"
 echo "  --disable-kvm            disable KVM acceleration support"
 echo "  --enable-kvm             enable KVM acceleration support"
 echo "  --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)"
-echo "  --disable-nptl           disable usermode NPTL support"
-echo "  --enable-nptl            enable usermode NPTL support"
 echo "  --enable-system          enable all system emulation targets"
 echo "  --disable-system         disable all system emulation targets"
 echo "  --enable-user            enable supported user emulation targets"
@@ -1432,7 +1425,7 @@ fi
 ##########################################
 # NPTL probe
 
-if test "$nptl" != "no" ; then
+if test "$linux_user" = "yes"; then
   cat > $TMPC <<EOF
 #include <sched.h>
 #include <linux/futex.h>
@@ -1443,14 +1436,8 @@ int main(void) {
   return 0;
 }
 EOF
-
-  if compile_object ; then
-    nptl=yes
-  else
-    if test "$nptl" = "yes" ; then
-      feature_not_found "nptl"
-    fi
-    nptl=no
+  if ! compile_object ; then
+    feature_not_found "nptl"
   fi
 fi
 
@@ -3550,7 +3537,6 @@ echo "bluez  support    $bluez"
 echo "Documentation     $docs"
 [ ! -z "$uname_release" ] && \
 echo "uname -r          $uname_release"
-echo "NPTL support      $nptl"
 echo "GUEST_BASE        $guest_base"
 echo "PIE               $pie"
 echo "vde support       $vde"
@@ -4180,7 +4166,6 @@ mkdir -p $target_dir
 echo "# Automatically generated by configure - do not modify" > $config_target_mak
 
 bflt="no"
-target_nptl="yes"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_name/g"`
 gdb_xml_files=""
 
@@ -4351,10 +4336,6 @@ fi
 if test "$target_user_only" = "yes" -a "$bflt" = "yes"; then
   echo "TARGET_HAS_BFLT=y" >> $config_target_mak
 fi
-if test "$target_user_only" = "yes" \
-        -a "$nptl" = "yes" -a "$target_nptl" = "yes"; then
-  echo "CONFIG_USE_NPTL=y" >> $config_target_mak
-fi
 if test "$target_user_only" = "yes" -a "$guest_base" = "yes"; then
   echo "CONFIG_USE_GUEST_BASE=y" >> $config_target_mak
 fi
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index ded4160..8065f40 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -32,7 +32,7 @@ void gdb_register_coprocessor(CPUArchState *env,
 
 static inline int cpu_index(CPUState *cpu)
 {
-#if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
+#if defined(CONFIG_USER_ONLY)
     return cpu->host_tid;
 #else
     return cpu->cpu_index + 1;
diff --git a/linux-user/main.c b/linux-user/main.c
index 99c3b3f..5537967 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -92,7 +92,6 @@ int cpu_get_pic_interrupt(CPUX86State *env)
 }
 #endif
 
-#if defined(CONFIG_USE_NPTL)
 /***********************************************************/
 /* Helper routines for implementing atomic operations.  */
 
@@ -207,43 +206,6 @@ void cpu_list_unlock(void)
 {
     pthread_mutex_unlock(&cpu_list_mutex);
 }
-#else /* if !CONFIG_USE_NPTL */
-/* These are no-ops because we are not threadsafe.  */
-static inline void cpu_exec_start(CPUState *cpu)
-{
-}
-
-static inline void cpu_exec_end(CPUState *cpu)
-{
-}
-
-static inline void start_exclusive(void)
-{
-}
-
-static inline void end_exclusive(void)
-{
-}
-
-void fork_start(void)
-{
-}
-
-void fork_end(int child)
-{
-    if (child) {
-        gdbserver_fork((CPUArchState *)thread_cpu->env_ptr);
-    }
-}
-
-void cpu_list_lock(void)
-{
-}
-
-void cpu_list_unlock(void)
-{
-}
-#endif
 
 
 #ifdef TARGET_I386
@@ -3156,12 +3118,7 @@ THREAD CPUState *thread_cpu;
 void task_settid(TaskState *ts)
 {
     if (ts->ts_tid == 0) {
-#ifdef CONFIG_USE_NPTL
         ts->ts_tid = (pid_t)syscall(SYS_gettid);
-#else
-        /* when no threads are used, tid becomes pid */
-        ts->ts_tid = getpid();
-#endif
     }
 }
 
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index de22197..a249f0c 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -33,7 +33,6 @@
 
 //#define DEBUG_MMAP
 
-#if defined(CONFIG_USE_NPTL)
 static pthread_mutex_t mmap_mutex = PTHREAD_MUTEX_INITIALIZER;
 static __thread int mmap_lock_count;
 
@@ -66,16 +65,6 @@ void mmap_fork_end(int child)
     else
         pthread_mutex_unlock(&mmap_mutex);
 }
-#else
-/* We aren't threadsafe to start with, so no need to worry about locking.  */
-void mmap_lock(void)
-{
-}
-
-void mmap_unlock(void)
-{
-}
-#endif
 
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
 int target_mprotect(abi_ulong start, abi_ulong len, int prot)
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 1ff0fa8..4a16e8f 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -19,11 +19,7 @@
 #include "exec/gdbstub.h"
 #include "qemu/queue.h"
 
-#if defined(CONFIG_USE_NPTL)
 #define THREAD __thread
-#else
-#define THREAD
-#endif
 
 /* This struct is used to hold certain information about the image.
  * Basically, it replicates in user space what would be certain
@@ -116,9 +112,7 @@ typedef struct TaskState {
     uint32_t v86flags;
     uint32_t v86mask;
 #endif
-#ifdef CONFIG_USE_NPTL
     abi_ulong child_tidptr;
-#endif
 #ifdef TARGET_M68K
     int sim_syscalls;
     abi_ulong tp_value;
@@ -268,10 +262,8 @@ void mmap_unlock(void);
 abi_ulong mmap_find_vma(abi_ulong, abi_ulong);
 void cpu_list_lock(void);
 void cpu_list_unlock(void);
-#if defined(CONFIG_USE_NPTL)
 void mmap_fork_start(void);
 void mmap_fork_end(int child);
-#endif
 
 /* main.c */
 extern unsigned long guest_stack_size;
@@ -449,9 +441,7 @@ static inline void *lock_user_string(abi_ulong guest_addr)
 #define unlock_user_struct(host_ptr, guest_addr, copy)		\
     unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
 
-#if defined(CONFIG_USE_NPTL)
 #include <pthread.h>
-#endif
 
 /* Include target-specific struct and function definitions;
  * they may need access to the target-independent structures
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index d3b3590..5bd57d0 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -111,13 +111,8 @@ int __clone2(int (*fn)(void *), void *child_stack_base,
 
 #include "qemu.h"
 
-#if defined(CONFIG_USE_NPTL)
 #define CLONE_NPTL_FLAGS2 (CLONE_SETTLS | \
     CLONE_PARENT_SETTID | CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID)
-#else
-/* XXX: Hardcode the above values.  */
-#define CLONE_NPTL_FLAGS2 0
-#endif
 
 //#define DEBUG
 
@@ -234,12 +229,10 @@ _syscall1(int,exit_group,int,error_code)
 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
 _syscall1(int,set_tid_address,int *,tidptr)
 #endif
-#if defined(CONFIG_USE_NPTL)
 #if defined(TARGET_NR_futex) && defined(__NR_futex)
 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
           const struct timespec *,timeout,int *,uaddr2,int,val3)
 #endif
-#endif
 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
           unsigned long *, user_mask_ptr);
@@ -4227,7 +4220,6 @@ abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
 
 #define NEW_STACK_SIZE 0x40000
 
-#if defined(CONFIG_USE_NPTL)
 
 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
 typedef struct {
@@ -4272,16 +4264,6 @@ static void *clone_func(void *arg)
     /* never exits */
     return NULL;
 }
-#else
-
-static int clone_func(void *arg)
-{
-    CPUArchState *env = arg;
-    cpu_loop(env);
-    /* never exits */
-    return 0;
-}
-#endif
 
 /* do_fork() Must return host values and target errnos (unlike most
    do_*() functions). */
@@ -4292,12 +4274,8 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
     int ret;
     TaskState *ts;
     CPUArchState *new_env;
-#if defined(CONFIG_USE_NPTL)
     unsigned int nptl_flags;
     sigset_t sigmask;
-#else
-    uint8_t *new_stack;
-#endif
 
     /* Emulate vfork() with fork() */
     if (flags & CLONE_VFORK)
@@ -4305,10 +4283,9 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
 
     if (flags & CLONE_VM) {
         TaskState *parent_ts = (TaskState *)env->opaque;
-#if defined(CONFIG_USE_NPTL)
         new_thread_info info;
         pthread_attr_t attr;
-#endif
+
         ts = g_malloc0(sizeof(TaskState));
         init_task_state(ts);
         /* we create a new CPU instance. */
@@ -4321,7 +4298,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
         new_env->opaque = ts;
         ts->bprm = parent_ts->bprm;
         ts->info = parent_ts->info;
-#if defined(CONFIG_USE_NPTL)
         nptl_flags = flags;
         flags &= ~CLONE_NPTL_FLAGS2;
 
@@ -4371,17 +4347,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
         pthread_cond_destroy(&info.cond);
         pthread_mutex_destroy(&info.mutex);
         pthread_mutex_unlock(&clone_lock);
-#else
-        if (flags & CLONE_NPTL_FLAGS2)
-            return -EINVAL;
-        /* This is probably going to die very quickly, but do it anyway.  */
-        new_stack = g_malloc0 (NEW_STACK_SIZE);
-#ifdef __ia64__
-        ret = __clone2(clone_func, new_stack, NEW_STACK_SIZE, flags, new_env);
-#else
-	ret = clone(clone_func, new_stack + NEW_STACK_SIZE, flags, new_env);
-#endif
-#endif
     } else {
         /* if no CLONE_VM, we consider it is a fork */
         if ((flags & ~(CSIGNAL | CLONE_NPTL_FLAGS2)) != 0)
@@ -4392,7 +4357,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
             /* Child Process.  */
             cpu_clone_regs(env, newsp);
             fork_end(1);
-#if defined(CONFIG_USE_NPTL)
             /* There is a race condition here.  The parent process could
                theoretically read the TID in the child process before the child
                tid is set.  This would require using either ptrace
@@ -4408,7 +4372,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
                 cpu_set_tls (env, newtls);
             if (flags & CLONE_CHILD_CLEARTID)
                 ts->child_tidptr = child_tidptr;
-#endif
         } else {
             fork_end(0);
         }
@@ -4834,7 +4797,6 @@ static inline abi_long host_to_target_stat64(void *cpu_env,
 }
 #endif
 
-#if defined(CONFIG_USE_NPTL)
 /* ??? Using host futex calls even when target atomic operations
    are not really atomic probably breaks things.  However implementing
    futexes locally would make futexes shared between multiple processes
@@ -4886,7 +4848,6 @@ static int do_futex(target_ulong uaddr, int op, int val, target_ulong timeout,
         return -TARGET_ENOSYS;
     }
 }
-#endif
 
 /* Map host to target signal numbers for the wait family of syscalls.
    Assume all other status bits are the same.  */
@@ -5132,9 +5093,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                     abi_long arg5, abi_long arg6, abi_long arg7,
                     abi_long arg8)
 {
-#ifdef CONFIG_USE_NPTL
     CPUState *cpu = ENV_GET_CPU(cpu_env);
-#endif
     abi_long ret;
     struct stat st;
     struct statfs stfs;
@@ -5148,7 +5107,6 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
 
     switch(num) {
     case TARGET_NR_exit:
-#ifdef CONFIG_USE_NPTL
         /* In old applications this may be used to implement _exit(2).
            However in threaded applictions it is used for thread termination,
            and _exit_group is used for application termination.
@@ -5186,7 +5144,6 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
             g_free(ts);
             pthread_exit(NULL);
         }
-#endif
 #ifdef TARGET_GPROF
         _mcleanup();
 #endif
@@ -8687,11 +8644,9 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
         }
 	break;
 #endif
-#if defined(CONFIG_USE_NPTL)
     case TARGET_NR_futex:
         ret = do_futex(arg1, arg2, arg3, arg4, arg5, arg6);
         break;
-#endif
 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
     case TARGET_NR_inotify_init:
         ret = get_errno(sys_inotify_init());
commit 2667e71c3d9262d756bea1473e2ea28eb2c9c070
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:59 2013 +0100

    linux-user: Enable NPTL for x86-64
    
    Add x86-64 implementation of cpu_set_tls() (like the kernel, we
    just have to call do_arch_prctl() to set FS); this allows us to
    enable NPTL.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index 547297b..999b2ce 100755
--- a/configure
+++ b/configure
@@ -4193,7 +4193,6 @@ case "$target_name" in
   ;;
   x86_64)
     TARGET_BASE_ARCH=i386
-    target_nptl="no"
   ;;
   alpha)
   ;;
diff --git a/linux-user/i386/target_cpu.h b/linux-user/i386/target_cpu.h
index 1170d84..58f8645 100644
--- a/linux-user/i386/target_cpu.h
+++ b/linux-user/i386/target_cpu.h
@@ -36,6 +36,13 @@ static inline void cpu_set_tls(CPUX86State *env, target_ulong newtls)
     do_set_thread_area(env, newtls);
     cpu_x86_load_seg(env, R_GS, env->segs[R_GS].selector);
 }
+#else
+abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr);
+
+static inline void cpu_set_tls(CPUX86State *env, target_ulong newtls)
+{
+    do_arch_prctl(env, TARGET_ARCH_SET_FS, newtls);
+}
 #endif /* defined(TARGET_ABI32) */
 
 #endif /* !defined(TARGET_CPU_H) */
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 452b89d..d3b3590 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4189,7 +4189,7 @@ static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
 #endif /* TARGET_I386 && TARGET_ABI32 */
 
 #ifndef TARGET_ABI32
-static abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
+abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
 {
     abi_long ret = 0;
     abi_ulong val;
commit bc22eb447c0552e2327f278fdc6bedccb14fc7a3
Author: Alexander Graf <agraf at suse.de>
Date:   Tue Jul 16 18:44:58 2013 +0100

    linux-user: Add i386 TLS setter
    
    We can easily set the TLS on i386. Add code to do so.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    [PMM: also remove "target_nptl=no" line from configure, for
     consistency with other patches in this series]
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index f065edc..547297b 100755
--- a/configure
+++ b/configure
@@ -4190,7 +4190,6 @@ TARGET_ABI_DIR=""
 
 case "$target_name" in
   i386)
-    target_nptl="no"
   ;;
   x86_64)
     TARGET_BASE_ARCH=i386
diff --git a/linux-user/i386/target_cpu.h b/linux-user/i386/target_cpu.h
index abcac79..1170d84 100644
--- a/linux-user/i386/target_cpu.h
+++ b/linux-user/i386/target_cpu.h
@@ -28,6 +28,14 @@ static inline void cpu_clone_regs(CPUX86State *env, target_ulong newsp)
     env->regs[R_EAX] = 0;
 }
 
-/* TODO: need to implement cpu_set_tls() */
+#if defined(TARGET_ABI32)
+abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr);
 
-#endif
+static inline void cpu_set_tls(CPUX86State *env, target_ulong newtls)
+{
+    do_set_thread_area(env, newtls);
+    cpu_x86_load_seg(env, R_GS, env->segs[R_GS].selector);
+}
+#endif /* defined(TARGET_ABI32) */
+
+#endif /* !defined(TARGET_CPU_H) */
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index b167d7f..452b89d 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4055,7 +4055,7 @@ static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
 }
 
 #if defined(TARGET_I386) && defined(TARGET_ABI32)
-static abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
+abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
 {
     uint64_t *gdt_table = g2h(env->gdt.base);
     struct target_modify_ldt_ldt_s ldt_info;
commit 4ce6243dc6216e35b5b691078ffa856463bfa8db
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:57 2013 +0100

    linux-user: Clean up handling of clone() argument order
    
    Linux manages to have three separate orderings of the arguments to
    the clone() syscall on different architectures. In the kernel these
    are selected via CONFIG_CLONE_BACKWARDS and CONFIG_CLONE_BACKWARDS2.
    Clean up our implementation of this to use similar #define names
    rather than a TARGET_* ifdef ladder.
    
    This includes behaviour changes fixing bugs on cris, x86-64, m68k,
    openrisc and unicore32.  cris had explicit but wrong handling; the
    others were just incorrectly using QEMU's default, which happened
    to be the equivalent of CONFIG_CLONE_BACKWARDS. (unicore32 appears
    to be broken in the mainline kernel in that it tries to use arg3 for
    both parent_tidptr and newtls simultaneously -- we don't attempt
    to emulate this bug...)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/arm/syscall.h b/linux-user/arm/syscall.h
index 003d424..73f2931 100644
--- a/linux-user/arm/syscall.h
+++ b/linux-user/arm/syscall.h
@@ -40,3 +40,5 @@ struct target_pt_regs {
 #else
 #define UNAME_MACHINE "armv5tel"
 #endif
+
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/cris/syscall.h b/linux-user/cris/syscall.h
index 50e50b4..832ee64 100644
--- a/linux-user/cris/syscall.h
+++ b/linux-user/cris/syscall.h
@@ -38,4 +38,6 @@ struct target_pt_regs {
         unsigned long eda;
 };
 
+#define TARGET_CLONE_BACKWARDS2
+
 #endif
diff --git a/linux-user/i386/syscall.h b/linux-user/i386/syscall.h
index 266e2c4..12b8c3b 100644
--- a/linux-user/i386/syscall.h
+++ b/linux-user/i386/syscall.h
@@ -144,3 +144,5 @@ struct target_vm86plus_struct {
 };
 
 #define UNAME_MACHINE "i686"
+
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/microblaze/syscall.h b/linux-user/microblaze/syscall.h
index c3e5c55..d550989 100644
--- a/linux-user/microblaze/syscall.h
+++ b/linux-user/microblaze/syscall.h
@@ -48,4 +48,6 @@ struct target_pt_regs {
         uint32_t kernel_mode;
 };
 
+#define TARGET_CLONE_BACKWARDS
+
 #endif
diff --git a/linux-user/mips/syscall.h b/linux-user/mips/syscall.h
index 3deb862..9d437d9 100644
--- a/linux-user/mips/syscall.h
+++ b/linux-user/mips/syscall.h
@@ -225,3 +225,5 @@ struct target_pt_regs {
 #define TARGET_QEMU_ESIGRETURN 255
 
 #define UNAME_MACHINE "mips"
+
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/mips64/syscall.h b/linux-user/mips64/syscall.h
index cd707df..1710f76 100644
--- a/linux-user/mips64/syscall.h
+++ b/linux-user/mips64/syscall.h
@@ -222,3 +222,5 @@ struct target_pt_regs {
 #define TARGET_QEMU_ESIGRETURN 255
 
 #define UNAME_MACHINE "mips64"
+
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/ppc/syscall.h b/linux-user/ppc/syscall.h
index 481047b..ba36acb 100644
--- a/linux-user/ppc/syscall.h
+++ b/linux-user/ppc/syscall.h
@@ -62,3 +62,5 @@ struct target_revectored_struct {
 #else
 #define UNAME_MACHINE "ppc"
 #endif
+
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/s390x/syscall.h b/linux-user/s390x/syscall.h
index e4603b7..ea8c304 100644
--- a/linux-user/s390x/syscall.h
+++ b/linux-user/s390x/syscall.h
@@ -21,3 +21,5 @@ struct target_pt_regs {
 };
 
 #define UNAME_MACHINE "s390x"
+
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/sparc/syscall.h b/linux-user/sparc/syscall.h
index 5a9bb7e..4cd64bf 100644
--- a/linux-user/sparc/syscall.h
+++ b/linux-user/sparc/syscall.h
@@ -7,3 +7,10 @@ struct target_pt_regs {
 };
 
 #define UNAME_MACHINE "sun4"
+
+/* SPARC kernels don't define this in their Kconfig, but they have the
+ * same ABI as if they did, implemented by sparc-specific code which fishes
+ * directly in the u_regs() struct for half the parameters in sparc_do_fork()
+ * and copy_thread().
+ */
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/sparc64/syscall.h b/linux-user/sparc64/syscall.h
index 81a816d..e60bf31 100644
--- a/linux-user/sparc64/syscall.h
+++ b/linux-user/sparc64/syscall.h
@@ -8,3 +8,10 @@ struct target_pt_regs {
 };
 
 #define UNAME_MACHINE "sun4u"
+
+/* SPARC kernels don't define this in their Kconfig, but they have the
+ * same ABI as if they did, implemented by sparc-specific code which fishes
+ * directly in the u_regs() struct for half the parameters in sparc_do_fork()
+ * and copy_thread().
+ */
+#define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 642d0a3..b167d7f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6956,16 +6956,20 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
         ret = get_errno(fsync(arg1));
         break;
     case TARGET_NR_clone:
-#if defined(TARGET_SH4) || defined(TARGET_ALPHA)
-        ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
-#elif defined(TARGET_CRIS)
-        ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg4, arg5));
-#elif defined(TARGET_MICROBLAZE)
+        /* Linux manages to have three different orderings for its
+         * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
+         * match the kernel's CONFIG_CLONE_* settings.
+         * Microblaze is further special in that it uses a sixth
+         * implicit argument to clone for the TLS pointer.
+         */
+#if defined(TARGET_MICROBLAZE)
         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
-#elif defined(TARGET_S390X)
+#elif defined(TARGET_CLONE_BACKWARDS)
+        ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
+#elif defined(TARGET_CLONE_BACKWARDS2)
         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
 #else
-        ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
+        ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
 #endif
         break;
 #ifdef __NR_exit_group
commit d312bbe1051fa563b557de625ca57a466772abe5
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:56 2013 +0100

    linux-user: Add missing 'break' in i386 get_thread_area syscall
    
    The i386 code for the get_thread_area syscall was missing a
    'break' which meant it would have fallen through into the
    implementation of the following syscall; add it.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 9619656..642d0a3 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8572,6 +8572,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
     case TARGET_NR_get_thread_area:
 #if defined(TARGET_I386) && defined(TARGET_ABI32)
         ret = do_get_thread_area(cpu_env, arg1);
+        break;
 #elif defined(TARGET_M68K)
         {
             TaskState *ts = ((CPUArchState *)cpu_env)->opaque;
commit 1ccd9374af22ec4ed5f864d4935a9cfad01f1204
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:55 2013 +0100

    linux-user: Enable NPTL for m68k
    
    For m68k, per-thread data is a purely kernel construct with no
    CPU level support. Implement it via a field in the TaskState structure,
    used by cpu_set_tls() and the set_thread_area/get_thread_area
    syscalls. This allows us to enable compilation with NPTL.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by:  Laurent Vivier <laurent at vivier.eu>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index ab3dc3c..f065edc 100755
--- a/configure
+++ b/configure
@@ -4210,7 +4210,6 @@ case "$target_name" in
   m68k)
     bflt="yes"
     gdb_xml_files="cf-core.xml cf-fp.xml"
-    target_nptl="no"
   ;;
   microblaze|microblazeel)
     TARGET_ARCH=microblaze
diff --git a/linux-user/m68k/target_cpu.h b/linux-user/m68k/target_cpu.h
index 8a2a305..cad9c90 100644
--- a/linux-user/m68k/target_cpu.h
+++ b/linux-user/m68k/target_cpu.h
@@ -29,6 +29,10 @@ static inline void cpu_clone_regs(CPUM68KState *env, target_ulong newsp)
     env->dregs[0] = 0;
 }
 
-/* TODO: need to implement cpu_set_tls() */
+static inline void cpu_set_tls(CPUM68KState *env, target_ulong newtls)
+{
+    TaskState *ts = env->opaque;
+    ts->tp_value = newtls;
+}
 
 #endif
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 8c420da..1ff0fa8 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -121,6 +121,7 @@ typedef struct TaskState {
 #endif
 #ifdef TARGET_M68K
     int sim_syscalls;
+    abi_ulong tp_value;
 #endif
 #if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_UNICORE32)
     /* Extra fields for semihosted binaries.  */
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 00a0390..9619656 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8558,6 +8558,12 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
       ret = do_set_thread_area(cpu_env, arg1);
       break;
+#elif defined(TARGET_M68K)
+      {
+          TaskState *ts = ((CPUArchState *)cpu_env)->opaque;
+          ts->tp_value = arg1;
+          break;
+      }
 #else
       goto unimplemented_nowarn;
 #endif
@@ -8566,6 +8572,12 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
     case TARGET_NR_get_thread_area:
 #if defined(TARGET_I386) && defined(TARGET_ABI32)
         ret = do_get_thread_area(cpu_env, arg1);
+#elif defined(TARGET_M68K)
+        {
+            TaskState *ts = ((CPUArchState *)cpu_env)->opaque;
+            ret = ts->tp_value;
+            break;
+        }
 #else
         goto unimplemented_nowarn;
 #endif
commit f5147c93d0e7f91df0215598017a4d9d6a48f0ee
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:54 2013 +0100

    linux-user: Enable NPTL for SPARC targets
    
    Provide the missing cpu_set_tls(), and resolve the FIXME in
    cpu_clone_regs() by clearing the carry flag for the child.
    This allows us to turn on building with NPTL for SPARC.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index bfad34e..ab3dc3c 100755
--- a/configure
+++ b/configure
@@ -4262,18 +4262,15 @@ case "$target_name" in
     bflt="yes"
   ;;
   sparc)
-    target_nptl="no"
   ;;
   sparc64)
     TARGET_BASE_ARCH=sparc
-    target_nptl="no"
   ;;
   sparc32plus)
     TARGET_ARCH=sparc64
     TARGET_BASE_ARCH=sparc
     TARGET_ABI_DIR=sparc
     echo "TARGET_ABI32=y" >> $config_target_mak
-    target_nptl="no"
   ;;
   s390x)
   ;;
diff --git a/linux-user/sparc/target_cpu.h b/linux-user/sparc/target_cpu.h
index 5a620a2..4944d46 100644
--- a/linux-user/sparc/target_cpu.h
+++ b/linux-user/sparc/target_cpu.h
@@ -25,12 +25,20 @@ static inline void cpu_clone_regs(CPUSPARCState *env, target_ulong newsp)
     if (newsp) {
         env->regwptr[22] = newsp;
     }
+    /* syscall return for clone child: 0, and clear CF since
+     * this counts as a success return value.
+     */
     env->regwptr[0] = 0;
-    /* FIXME: Do we also need to clear CF?  */
-    /* XXXXX */
-    printf("HELPME: %s:%d\n", __FILE__, __LINE__);
+#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
+    env->xcc &= ~PSR_CARRY;
+#else
+    env->psr &= ~PSR_CARRY;
+#endif
 }
 
-/* TODO: need to implement cpu_set_tls() */
+static inline void cpu_set_tls(CPUSPARCState *env, target_ulong newtls)
+{
+    env->gregs[7] = newtls;
+}
 
 #endif
commit 442a59c8ddc55f327ec0219d810fe4580177716a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:53 2013 +0100

    linux-user: Enable NPTL for OpenRISC
    
    The OpenRISC kernel ignores CLONE_SETTLS in its copy_thread()
    implementation, so a cpu_set_tls() implementation is a no-op.
    cpu_clone_regs() was setting the syscall return value in the
    wrong register -- it is gpr[11], not gpr[2]. With these two
    things fixed, we can compile with NPTL enabled.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index 0b19408..bfad34e 100755
--- a/configure
+++ b/configure
@@ -4236,7 +4236,6 @@ case "$target_name" in
   or32)
     TARGET_ARCH=openrisc
     TARGET_BASE_ARCH=openrisc
-    target_nptl="no"
   ;;
   ppc)
     gdb_xml_files="power-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
diff --git a/linux-user/openrisc/target_cpu.h b/linux-user/openrisc/target_cpu.h
index 501fb81..32a46ac 100644
--- a/linux-user/openrisc/target_cpu.h
+++ b/linux-user/openrisc/target_cpu.h
@@ -25,9 +25,14 @@ static inline void cpu_clone_regs(CPUOpenRISCState *env, target_ulong newsp)
     if (newsp) {
         env->gpr[1] = newsp;
     }
-    env->gpr[2] = 0;
+    env->gpr[11] = 0;
 }
 
-/* TODO: need to implement cpu_set_tls() */
+static inline void cpu_set_tls(CPUOpenRISCState *env, target_ulong newtls)
+{
+    /* Linux kernel 3.10 does not pay any attention to CLONE_SETTLS
+     * in copy_thread(), so QEMU need not do so either.
+     */
+}
 
 #endif
commit dfeab06c98f7bc37f8ad8a6a2f8f677e5a57a55d
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:52 2013 +0100

    linux-user: Move includes of target-specific headers to end of qemu.h
    
    The target-specific headers (target_cpu.h and target_signal.h)
    might need to use the target-independent structure and function
    definitions of qemu.h; so include them only at the bottom of
    qemu.h, not the top.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 6569608..8c420da 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -16,8 +16,6 @@
 #include "exec/user/thunk.h"
 #include "syscall_defs.h"
 #include "syscall.h"
-#include "target_cpu.h"
-#include "target_signal.h"
 #include "exec/gdbstub.h"
 #include "qemu/queue.h"
 
@@ -454,4 +452,11 @@ static inline void *lock_user_string(abi_ulong guest_addr)
 #include <pthread.h>
 #endif
 
+/* Include target-specific struct and function definitions;
+ * they may need access to the target-independent structures
+ * above, so include them last.
+ */
+#include "target_cpu.h"
+#include "target_signal.h"
+
 #endif /* QEMU_H */
commit 790d440605a997a5e146809e824e95ca22a14652
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:51 2013 +0100

    configure: Enable threading for unicore32-linux-user
    
    unicore32-linux-user provides cpu_set_tls(), so the failure
    to enable target_nptl was presumably an oversight. Enable it.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index 9b7101c..0b19408 100755
--- a/configure
+++ b/configure
@@ -4279,7 +4279,6 @@ case "$target_name" in
   s390x)
   ;;
   unicore32)
-    target_nptl="no"
   ;;
   xtensa|xtensaeb)
     TARGET_ARCH=xtensa
commit d769c64147d32a80e5e37d41b397f45943d45e0d
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:50 2013 +0100

    configure: Enable threading on all ppc and mips linux-user targets
    
    Though threading (target_nptl) was enabled on the base PPC and MIPS
    targets, it wasn't enabled for the variants mipsn32, mipsn32el,
    mips64, mips64el, ppc64 or ppc46abi32 (probably an oversight).
    Enable threading consistently on all these targets.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index 3792607..9b7101c 100755
--- a/configure
+++ b/configure
@@ -4225,13 +4225,11 @@ case "$target_name" in
     TARGET_BASE_ARCH=mips
     echo "TARGET_ABI_MIPSN32=y" >> $config_target_mak
     echo "TARGET_ABI32=y" >> $config_target_mak
-    target_nptl="no"
   ;;
   mips64|mips64el)
     TARGET_ARCH=mips64
     TARGET_BASE_ARCH=mips
     echo "TARGET_ABI_MIPSN64=y" >> $config_target_mak
-    target_nptl="no"
   ;;
   moxie)
   ;;
@@ -4252,7 +4250,6 @@ case "$target_name" in
     TARGET_BASE_ARCH=ppc
     TARGET_ABI_DIR=ppc
     gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-    target_nptl="no"
   ;;
   ppc64abi32)
     TARGET_ARCH=ppc64
@@ -4260,7 +4257,6 @@ case "$target_name" in
     TARGET_ABI_DIR=ppc
     echo "TARGET_ABI32=y" >> $config_target_mak
     gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-    target_nptl="no"
   ;;
   sh4|sh4eb)
     TARGET_ARCH=sh4
commit fa78f3dbe4e0e1d9a34556b73e5118cb40153875
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:49 2013 +0100

    configure: Don't say target_nptl="no" if there is no linux-user target
    
    For architectures with no linux-user target, don't claim no NPTL
    support. This has no behavioural change, but it means that we
    won't accidentally add a new linux-user target without threading
    support in future (because attempting to do so would be a compile
    failure rather than a silent lack of support).
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index 983f4d5..3792607 100755
--- a/configure
+++ b/configure
@@ -4206,7 +4206,6 @@ case "$target_name" in
   cris)
   ;;
   lm32)
-    target_nptl="no"
   ;;
   m68k)
     bflt="yes"
@@ -4235,7 +4234,6 @@ case "$target_name" in
     target_nptl="no"
   ;;
   moxie)
-    target_nptl="no"
   ;;
   or32)
     TARGET_ARCH=openrisc
@@ -4289,7 +4287,6 @@ case "$target_name" in
   ;;
   xtensa|xtensaeb)
     TARGET_ARCH=xtensa
-    target_nptl="no"
   ;;
   *)
     error_exit "Unsupported target CPU"
commit aa004f5f9c5785273ef56b8c0b775f57ccb19168
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 18:44:48 2013 +0100

    configure: Flip default of target_nptl
    
    Most targets either (a) support threading or (b) don't have a
    linux-user/bsd-user target, so make it default to 'yes', with those
    targets that don't support threading having to specifically say so.
    
    This is a mechanical no-behaviour-change commit; some of the
    "no" entries it adds will be taken out in later patches.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/configure b/configure
index 7c45db2..983f4d5 100755
--- a/configure
+++ b/configure
@@ -4180,7 +4180,7 @@ mkdir -p $target_dir
 echo "# Automatically generated by configure - do not modify" > $config_target_mak
 
 bflt="no"
-target_nptl="no"
+target_nptl="yes"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_name/g"`
 gdb_xml_files=""
 
@@ -4190,69 +4190,71 @@ TARGET_ABI_DIR=""
 
 case "$target_name" in
   i386)
+    target_nptl="no"
   ;;
   x86_64)
     TARGET_BASE_ARCH=i386
+    target_nptl="no"
   ;;
   alpha)
-    target_nptl="yes"
   ;;
   arm|armeb)
     TARGET_ARCH=arm
     bflt="yes"
-    target_nptl="yes"
     gdb_xml_files="arm-core.xml arm-vfp.xml arm-vfp3.xml arm-neon.xml"
   ;;
   cris)
-    target_nptl="yes"
   ;;
   lm32)
+    target_nptl="no"
   ;;
   m68k)
     bflt="yes"
     gdb_xml_files="cf-core.xml cf-fp.xml"
+    target_nptl="no"
   ;;
   microblaze|microblazeel)
     TARGET_ARCH=microblaze
     bflt="yes"
-    target_nptl="yes"
   ;;
   mips|mipsel)
     TARGET_ARCH=mips
     echo "TARGET_ABI_MIPSO32=y" >> $config_target_mak
-    target_nptl="yes"
   ;;
   mipsn32|mipsn32el)
     TARGET_ARCH=mips64
     TARGET_BASE_ARCH=mips
     echo "TARGET_ABI_MIPSN32=y" >> $config_target_mak
     echo "TARGET_ABI32=y" >> $config_target_mak
+    target_nptl="no"
   ;;
   mips64|mips64el)
     TARGET_ARCH=mips64
     TARGET_BASE_ARCH=mips
     echo "TARGET_ABI_MIPSN64=y" >> $config_target_mak
+    target_nptl="no"
   ;;
   moxie)
+    target_nptl="no"
   ;;
   or32)
     TARGET_ARCH=openrisc
     TARGET_BASE_ARCH=openrisc
+    target_nptl="no"
   ;;
   ppc)
     gdb_xml_files="power-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-    target_nptl="yes"
   ;;
   ppcemb)
     TARGET_BASE_ARCH=ppc
     TARGET_ABI_DIR=ppc
     gdb_xml_files="power-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-    target_nptl="yes"
   ;;
   ppc64)
     TARGET_BASE_ARCH=ppc
     TARGET_ABI_DIR=ppc
     gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
+    target_nptl="no"
   ;;
   ppc64abi32)
     TARGET_ARCH=ppc64
@@ -4260,30 +4262,34 @@ case "$target_name" in
     TARGET_ABI_DIR=ppc
     echo "TARGET_ABI32=y" >> $config_target_mak
     gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
+    target_nptl="no"
   ;;
   sh4|sh4eb)
     TARGET_ARCH=sh4
     bflt="yes"
-    target_nptl="yes"
   ;;
   sparc)
+    target_nptl="no"
   ;;
   sparc64)
     TARGET_BASE_ARCH=sparc
+    target_nptl="no"
   ;;
   sparc32plus)
     TARGET_ARCH=sparc64
     TARGET_BASE_ARCH=sparc
     TARGET_ABI_DIR=sparc
     echo "TARGET_ABI32=y" >> $config_target_mak
+    target_nptl="no"
   ;;
   s390x)
-    target_nptl="yes"
   ;;
   unicore32)
+    target_nptl="no"
   ;;
   xtensa|xtensaeb)
     TARGET_ARCH=xtensa
+    target_nptl="no"
   ;;
   *)
     error_exit "Unsupported target CPU"
commit b1e749c02172583ca85bb3a964a9b39221f9ac39
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Mon Jul 22 09:04:32 2013 +0200

    gtk: Fix accelerator filtering
    
    This is in fact very simply: When the input in grabbed, everything
    should be exclusively passed to the guest - except it has our magic
    CTRL-ALT modifier set. Then let GTK filter out those accels that are in
    use. When checking the modifier state, we just need to filter out NUM
    and CAPS lock.
    
    Note: Filtering based on hard-coded modifiers breaks overriding
    accelerators. Needs to be fixed at a later point.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ui/gtk.c b/ui/gtk.c
index 4fb66a3..c38146f 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -98,6 +98,10 @@ static inline void gdk_drawable_get_size(GdkWindow *w, gint *ww, gint *wh)
 #define GDK_KEY_minus GDK_minus
 #endif
 
+#define HOTKEY_MODIFIERS        (GDK_CONTROL_MASK | GDK_MOD1_MASK)
+#define IGNORE_MODIFIER_MASK \
+    (GDK_MODIFIER_MASK & ~(GDK_LOCK_MASK | GDK_MOD2_MASK))
+
 static const int modifier_keycode[] = {
     /* shift, control, alt keys, meta keys, both left & right */
     0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8, 0xdb, 0xdd,
@@ -473,22 +477,10 @@ static void gd_mouse_mode_change(Notifier *notify, void *data)
 static gboolean gd_window_key_event(GtkWidget *widget, GdkEventKey *key, void *opaque)
 {
     GtkDisplayState *s = opaque;
-    GtkAccelGroupEntry *entries;
-    guint n_entries = 0;
-    gboolean propagate_accel = TRUE;
     gboolean handled = FALSE;
 
-    entries = gtk_accel_group_query(s->accel_group, key->keyval,
-                                    key->state, &n_entries);
-    if (n_entries) {
-        const char *quark = g_quark_to_string(entries[0].accel_path_quark);
-
-        if (gd_is_grab_active(s) && strstart(quark, "<QEMU>/File/", NULL)) {
-            propagate_accel = FALSE;
-        }
-    }
-
-    if (!handled && propagate_accel) {
+    if (!gd_is_grab_active(s) ||
+        (key->state & IGNORE_MODIFIER_MASK) == HOTKEY_MODIFIERS) {
         handled = gtk_window_activate_key(GTK_WINDOW(widget), key);
     }
     if (handled) {
@@ -1197,7 +1189,7 @@ static GSList *gd_vc_init(GtkDisplayState *s, VirtualConsole *vc, int index, GSL
     vc->menu_item = gtk_radio_menu_item_new_with_mnemonic(group, label);
     group = gtk_radio_menu_item_get_group(GTK_RADIO_MENU_ITEM(vc->menu_item));
     gtk_menu_item_set_accel_path(GTK_MENU_ITEM(vc->menu_item), path);
-    gtk_accel_map_add_entry(path, GDK_KEY_2 + index, GDK_CONTROL_MASK | GDK_MOD1_MASK);
+    gtk_accel_map_add_entry(path, GDK_KEY_2 + index, HOTKEY_MODIFIERS);
 
     vc->terminal = vte_terminal_new();
 
@@ -1354,7 +1346,8 @@ static GtkWidget *gd_create_menu_view(GtkDisplayState *s, GtkAccelGroup *accel_g
         gtk_image_menu_item_new_from_stock(GTK_STOCK_FULLSCREEN, NULL);
     gtk_menu_item_set_accel_path(GTK_MENU_ITEM(s->full_screen_item),
                                  "<QEMU>/View/Full Screen");
-    gtk_accel_map_add_entry("<QEMU>/View/Full Screen", GDK_KEY_f, GDK_CONTROL_MASK | GDK_MOD1_MASK);
+    gtk_accel_map_add_entry("<QEMU>/View/Full Screen", GDK_KEY_f,
+                            HOTKEY_MODIFIERS);
     gtk_menu_shell_append(GTK_MENU_SHELL(view_menu), s->full_screen_item);
 
     separator = gtk_separator_menu_item_new();
@@ -1363,19 +1356,22 @@ static GtkWidget *gd_create_menu_view(GtkDisplayState *s, GtkAccelGroup *accel_g
     s->zoom_in_item = gtk_image_menu_item_new_from_stock(GTK_STOCK_ZOOM_IN, NULL);
     gtk_menu_item_set_accel_path(GTK_MENU_ITEM(s->zoom_in_item),
                                  "<QEMU>/View/Zoom In");
-    gtk_accel_map_add_entry("<QEMU>/View/Zoom In", GDK_KEY_plus, GDK_CONTROL_MASK | GDK_MOD1_MASK);
+    gtk_accel_map_add_entry("<QEMU>/View/Zoom In", GDK_KEY_plus,
+                            HOTKEY_MODIFIERS);
     gtk_menu_shell_append(GTK_MENU_SHELL(view_menu), s->zoom_in_item);
 
     s->zoom_out_item = gtk_image_menu_item_new_from_stock(GTK_STOCK_ZOOM_OUT, NULL);
     gtk_menu_item_set_accel_path(GTK_MENU_ITEM(s->zoom_out_item),
                                  "<QEMU>/View/Zoom Out");
-    gtk_accel_map_add_entry("<QEMU>/View/Zoom Out", GDK_KEY_minus, GDK_CONTROL_MASK | GDK_MOD1_MASK);
+    gtk_accel_map_add_entry("<QEMU>/View/Zoom Out", GDK_KEY_minus,
+                            HOTKEY_MODIFIERS);
     gtk_menu_shell_append(GTK_MENU_SHELL(view_menu), s->zoom_out_item);
 
     s->zoom_fixed_item = gtk_image_menu_item_new_from_stock(GTK_STOCK_ZOOM_100, NULL);
     gtk_menu_item_set_accel_path(GTK_MENU_ITEM(s->zoom_fixed_item),
                                  "<QEMU>/View/Zoom Fixed");
-    gtk_accel_map_add_entry("<QEMU>/View/Zoom Fixed", GDK_KEY_0, GDK_CONTROL_MASK | GDK_MOD1_MASK);
+    gtk_accel_map_add_entry("<QEMU>/View/Zoom Fixed", GDK_KEY_0,
+                            HOTKEY_MODIFIERS);
     gtk_menu_shell_append(GTK_MENU_SHELL(view_menu), s->zoom_fixed_item);
 
     s->zoom_fit_item = gtk_check_menu_item_new_with_mnemonic(_("Zoom To _Fit"));
@@ -1390,7 +1386,8 @@ static GtkWidget *gd_create_menu_view(GtkDisplayState *s, GtkAccelGroup *accel_g
     s->grab_item = gtk_check_menu_item_new_with_mnemonic(_("_Grab Input"));
     gtk_menu_item_set_accel_path(GTK_MENU_ITEM(s->grab_item),
                                  "<QEMU>/View/Grab Input");
-    gtk_accel_map_add_entry("<QEMU>/View/Grab Input", GDK_KEY_g, GDK_CONTROL_MASK | GDK_MOD1_MASK);
+    gtk_accel_map_add_entry("<QEMU>/View/Grab Input", GDK_KEY_g,
+                            HOTKEY_MODIFIERS);
     gtk_menu_shell_append(GTK_MENU_SHELL(view_menu), s->grab_item);
 
     separator = gtk_separator_menu_item_new();
@@ -1400,7 +1397,7 @@ static GtkWidget *gd_create_menu_view(GtkDisplayState *s, GtkAccelGroup *accel_g
     group = gtk_radio_menu_item_get_group(GTK_RADIO_MENU_ITEM(s->vga_item));
     gtk_menu_item_set_accel_path(GTK_MENU_ITEM(s->vga_item),
                                  "<QEMU>/View/VGA");
-    gtk_accel_map_add_entry("<QEMU>/View/VGA", GDK_KEY_1, GDK_CONTROL_MASK | GDK_MOD1_MASK);
+    gtk_accel_map_add_entry("<QEMU>/View/VGA", GDK_KEY_1, HOTKEY_MODIFIERS);
     gtk_menu_shell_append(GTK_MENU_SHELL(view_menu), s->vga_item);
 
     for (i = 0; i < nb_vcs; i++) {
commit 549c272b3c7c2aac69155be2e158c970828b2844
Merge: c9fea5d fd76663
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 22 10:14:24 2013 -0500

    Merge remote-tracking branch 'pmaydell/tags/pull-arm-devs-20130722' into staging
    
    arm-devs queue
    
    # gpg: Signature made Mon 22 Jul 2013 06:38:52 AM CDT using RSA key ID 14360CDE
    # gpg: Can't check signature: public key not found
    
    # By Peter Maydell (8) and Soren Brinkmann (2)
    # Via Peter Maydell
    * pmaydell/tags/pull-arm-devs-20130722:
      hw/arm: Use 'load_ramdisk()' for loading ramdisks w/ U-Boot header
      hw/loader: Support ramdisk with u-boot header
      vexpress: Add virtio-mmio transports
      vexpress: Make VEDBoardInfo extend arm_boot_info
      arm/boot: Allow boards to modify the FDT blob
      virtio: Implement MMIO based virtio transport
      virtio: Support transports which can specify the vring alignment
      virtio: Add support for guest setting of queue size
      arm/boot: Use qemu_devtree_setprop_sized_cells()
      device_tree: Add qemu_devtree_setprop_sized_cells() utility functions
    
    Message-id: 1374493427-3254-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit c9fea5d701f8fd33f0843728ec264d95cee3ed37
Merge: a20bd9e e1622f4
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 22 10:14:18 2013 -0500

    Merge remote-tracking branch 'bonzini/iommu-for-anthony' into staging
    
    # By Paolo Bonzini (2) and others
    # Via Paolo Bonzini
    * bonzini/iommu-for-anthony:
      exec: fix incorrect assumptions in memory_access_size
      memory: Return -1 again on reads from unsigned regions
      memory: actually set the owner
      exec.c: Pass correct pointer type to qemu_ram_ptr_length
    
    Message-id: 1374264478-23913-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit a20bd9eec3cf3f9dd7e27d45a96d7b1b9ab09ebd
Merge: 5447a9a be022d6
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 22 10:13:49 2013 -0500

    Merge remote-tracking branch 'mjt/trivial-patches' into staging
    
    # By Michael Tokarev (2) and others
    # Via Michael Tokarev
    * mjt/trivial-patches:
      doc: monitor multiplexing rewording
      block/m25p80: Update Micron entries
      Fix command example in qemu.sasl
      slirp: remove mbuf(m_hdr,m_dat) indirection
      linux-user: declare sys_futex to have 6 arguments
    
    Message-id: 1374225073-12959-1-git-send-email-mjt at msgid.tls.msk.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 5447a9afc4150693d3909a8632891061147e170d
Merge: 293706d a23fdf3
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 22 10:13:34 2013 -0500

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Peter Lieven (5) and others
    # Via Stefan Hajnoczi
    * stefanha/block:
      block/raw: add .bdrv_get_info
      block: fix bdrv_read_unthrottled()
      cpus: Let vm_stop[_force_state]() always flush block devices
      block-migration: efficiently encode zero blocks
      block/raw: add bdrv_co_write_zeroes
      block: add bdrv_write_zeroes()
      block: fix vvfat error path for enable_write_target
      QEMUBH: make AioContext's bh re-entrant
      dataplane: sync virtio.c and vring.c virtqueue state
      gluster: Add discard support for GlusterFS block driver.
      gluster: Use pkg-config to configure GlusterFS block driver
    
    Message-id: 1374223132-29107-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 293706dd682f578b457d052988cf3c20b4eab82d
Merge: 90c66f5 b957a1b
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 22 10:13:27 2013 -0500

    Merge remote-tracking branch 'rth/axp-next' into staging
    
    # By Richard Henderson
    # Via Richard Henderson
    * rth/axp-next:
      pc-bios: Update palcode-clipper
      target-alpha: Move alarm to vm_clock
    
    Message-id: 1374161033-11449-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 90c66f587c8d020a642d3c9376f9102c16f2234e
Merge: 2494397 3ba0063
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 22 10:13:15 2013 -0500

    Merge remote-tracking branch 'stefanha/tracing' into staging
    
    # By Markus Armbruster
    # Via Stefan Hajnoczi
    * stefanha/tracing:
      trace-events: Fix up source file comments
      trace-events: Drop unused events
      milkymist-minimac2: Fix minimac2_read/_write tracepoints
      slavio_misc: Fix slavio_led_mem_readw/_writew tracepoints
      cleanup-trace-events.pl: New
    
    Message-id: 1374119369-26496-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit fd76663e3fe59dc7f7d5c439561b74f472727137
Author: Soren Brinkmann <soren.brinkmann at xilinx.com>
Date:   Mon Jul 8 15:40:02 2013 -0700

    hw/arm: Use 'load_ramdisk()' for loading ramdisks w/ U-Boot header
    
    The load_ramdisk function is used to load ramdisk featuring a U-Boot
    header.
    
    Signed-off-by: Soren Brinkmann <soren.brinkmann at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373323202-17083-3-git-send-email-soren.brinkmann at xilinx.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 9fbe5d2..2cbeefd 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -411,10 +411,16 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
     info->entry = entry;
     if (is_linux) {
         if (info->initrd_filename) {
-            initrd_size = load_image_targphys(info->initrd_filename,
-                                              info->initrd_start,
-                                              info->ram_size -
-                                              info->initrd_start);
+            initrd_size = load_ramdisk(info->initrd_filename,
+                                       info->initrd_start,
+                                       info->ram_size -
+                                       info->initrd_start);
+            if (initrd_size < 0) {
+                initrd_size = load_image_targphys(info->initrd_filename,
+                                                  info->initrd_start,
+                                                  info->ram_size -
+                                                  info->initrd_start);
+            }
             if (initrd_size < 0) {
                 fprintf(stderr, "qemu: could not load initrd '%s'\n",
                         info->initrd_filename);
commit 84aee0deae0de620277759e2c3cd3a9cf45390b0
Author: Soren Brinkmann <soren.brinkmann at xilinx.com>
Date:   Mon Jul 8 15:40:01 2013 -0700

    hw/loader: Support ramdisk with u-boot header
    
    Introduce 'load_ramdisk()' which can load "normal" ramdisks and ramdisks
    with a u-boot header.
    To enable this and leverage synergies 'load_uimage()' is refactored to
    accomodate this additional use case.
    
    Signed-off-by: Soren Brinkmann <soren.brinkmann at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373323202-17083-2-git-send-email-soren.brinkmann at xilinx.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/core/loader.c b/hw/core/loader.c
index 44311ff..c3c28cf 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -434,15 +434,17 @@ static ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src,
 }
 
 /* Load a U-Boot image.  */
-int load_uimage(const char *filename, hwaddr *ep,
-                hwaddr *loadaddr, int *is_linux)
+static int load_uboot_image(const char *filename, hwaddr *ep, hwaddr *loadaddr,
+                            int *is_linux, uint8_t image_type)
 {
     int fd;
     int size;
+    hwaddr address;
     uboot_image_header_t h;
     uboot_image_header_t *hdr = &h;
     uint8_t *data = NULL;
     int ret = -1;
+    int do_uncompress = 0;
 
     fd = open(filename, O_RDONLY | O_BINARY);
     if (fd < 0)
@@ -457,32 +459,55 @@ int load_uimage(const char *filename, hwaddr *ep,
     if (hdr->ih_magic != IH_MAGIC)
         goto out;
 
-    /* TODO: Implement other image types.  */
-    if (hdr->ih_type != IH_TYPE_KERNEL) {
-        fprintf(stderr, "Can only load u-boot image type \"kernel\"\n");
+    if (hdr->ih_type != image_type) {
+        fprintf(stderr, "Wrong image type %d, expected %d\n", hdr->ih_type,
+                image_type);
         goto out;
     }
 
-    switch (hdr->ih_comp) {
-    case IH_COMP_NONE:
-    case IH_COMP_GZIP:
+    /* TODO: Implement other image types.  */
+    switch (hdr->ih_type) {
+    case IH_TYPE_KERNEL:
+        address = hdr->ih_load;
+        if (loadaddr) {
+            *loadaddr = hdr->ih_load;
+        }
+
+        switch (hdr->ih_comp) {
+        case IH_COMP_NONE:
+            break;
+        case IH_COMP_GZIP:
+            do_uncompress = 1;
+            break;
+        default:
+            fprintf(stderr,
+                    "Unable to load u-boot images with compression type %d\n",
+                    hdr->ih_comp);
+            goto out;
+        }
+
+        if (ep) {
+            *ep = hdr->ih_ep;
+        }
+
+        /* TODO: Check CPU type.  */
+        if (is_linux) {
+            if (hdr->ih_os == IH_OS_LINUX) {
+                *is_linux = 1;
+            } else {
+                *is_linux = 0;
+            }
+        }
+
+        break;
+    case IH_TYPE_RAMDISK:
+        address = *loadaddr;
         break;
     default:
-        fprintf(stderr,
-                "Unable to load u-boot images with compression type %d\n",
-                hdr->ih_comp);
+        fprintf(stderr, "Unsupported u-boot image type %d\n", hdr->ih_type);
         goto out;
     }
 
-    /* TODO: Check CPU type.  */
-    if (is_linux) {
-        if (hdr->ih_os == IH_OS_LINUX)
-            *is_linux = 1;
-        else
-            *is_linux = 0;
-    }
-
-    *ep = hdr->ih_ep;
     data = g_malloc(hdr->ih_size);
 
     if (read(fd, data, hdr->ih_size) != hdr->ih_size) {
@@ -490,7 +515,7 @@ int load_uimage(const char *filename, hwaddr *ep,
         goto out;
     }
 
-    if (hdr->ih_comp == IH_COMP_GZIP) {
+    if (do_uncompress) {
         uint8_t *compressed_data;
         size_t max_bytes;
         ssize_t bytes;
@@ -508,10 +533,7 @@ int load_uimage(const char *filename, hwaddr *ep,
         hdr->ih_size = bytes;
     }
 
-    rom_add_blob_fixed(filename, data, hdr->ih_size, hdr->ih_load);
-
-    if (loadaddr)
-        *loadaddr = hdr->ih_load;
+    rom_add_blob_fixed(filename, data, hdr->ih_size, address);
 
     ret = hdr->ih_size;
 
@@ -522,6 +544,18 @@ out:
     return ret;
 }
 
+int load_uimage(const char *filename, hwaddr *ep, hwaddr *loadaddr,
+                int *is_linux)
+{
+    return load_uboot_image(filename, ep, loadaddr, is_linux, IH_TYPE_KERNEL);
+}
+
+/* Load a ramdisk.  */
+int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz)
+{
+    return load_uboot_image(filename, NULL, &addr, NULL, IH_TYPE_RAMDISK);
+}
+
 /*
  * Functions for reboot-persistent memory regions.
  *  - used for vga bios and option roms.
diff --git a/include/hw/loader.h b/include/hw/loader.h
index 15d4cc9..eb9c9a3 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -17,6 +17,19 @@ int load_aout(const char *filename, hwaddr addr, int max_sz,
 int load_uimage(const char *filename, hwaddr *ep,
                 hwaddr *loadaddr, int *is_linux);
 
+/**
+ * load_ramdisk:
+ * @filename: Path to the ramdisk image
+ * @addr: Memory address to load the ramdisk to
+ * @max_sz: Maximum allowed ramdisk size (for non-u-boot ramdisks)
+ *
+ * Load a ramdisk image with U-Boot header to the specified memory
+ * address.
+ *
+ * Returns the size of the loaded image on success, -1 otherwise.
+ */
+int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz);
+
 ssize_t read_targphys(const char *name,
                       int fd, hwaddr dst_addr, size_t nbytes);
 void pstrcpy_targphys(const char *name,
commit c8a07b355d7de568b93a61eb09cfe953ef0db409
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:12 2013 +0100

    vexpress: Add virtio-mmio transports
    
    Add some virtio-mmio transports to the vexpress board model,
    together with a modify_dtb hook which adds them to the device
    tree so that the kernel will probe for them. We put them
    in a reserved area of the address map.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373977512-28932-9-git-send-email-peter.maydell at linaro.org

diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 0f15337..9586e38 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -31,11 +31,18 @@
 #include "exec/address-spaces.h"
 #include "sysemu/blockdev.h"
 #include "hw/block/flash.h"
+#include "sysemu/device_tree.h"
+#include <libfdt.h>
 
 #define VEXPRESS_BOARD_ID 0x8e0
 #define VEXPRESS_FLASH_SIZE (64 * 1024 * 1024)
 #define VEXPRESS_FLASH_SECT_SIZE (256 * 1024)
 
+/* Number of virtio transports to create (0..8; limited by
+ * number of available IRQ lines).
+ */
+#define NUM_VIRTIO_TRANSPORTS 4
+
 /* Address maps for peripherals:
  * the Versatile Express motherboard has two possible maps,
  * the "legacy" one (used for A9) and the "Cortex-A Series"
@@ -71,6 +78,7 @@ enum {
     VE_ETHERNET,
     VE_USB,
     VE_DAPROM,
+    VE_VIRTIO,
 };
 
 static hwaddr motherboard_legacy_map[] = {
@@ -89,6 +97,7 @@ static hwaddr motherboard_legacy_map[] = {
     [VE_WDT] = 0x1000f000,
     [VE_TIMER01] = 0x10011000,
     [VE_TIMER23] = 0x10012000,
+    [VE_VIRTIO] = 0x10013000,
     [VE_SERIALDVI] = 0x10016000,
     [VE_RTC] = 0x10017000,
     [VE_COMPACTFLASH] = 0x1001a000,
@@ -135,6 +144,7 @@ static hwaddr motherboard_aseries_map[] = {
     [VE_WDT] = 0x1c0f0000,
     [VE_TIMER01] = 0x1c110000,
     [VE_TIMER23] = 0x1c120000,
+    [VE_VIRTIO] = 0x1c130000,
     [VE_SERIALDVI] = 0x1c160000,
     [VE_RTC] = 0x1c170000,
     [VE_COMPACTFLASH] = 0x1c1a0000,
@@ -395,6 +405,85 @@ static VEDBoardInfo a15_daughterboard = {
     .init = a15_daughterboard_init,
 };
 
+static int add_virtio_mmio_node(void *fdt, uint32_t acells, uint32_t scells,
+                                hwaddr addr, hwaddr size, uint32_t intc,
+                                int irq)
+{
+    /* Add a virtio_mmio node to the device tree blob:
+     *   virtio_mmio at ADDRESS {
+     *       compatible = "virtio,mmio";
+     *       reg = <ADDRESS, SIZE>;
+     *       interrupt-parent = <&intc>;
+     *       interrupts = <0, irq, 1>;
+     *   }
+     * (Note that the format of the interrupts property is dependent on the
+     * interrupt controller that interrupt-parent points to; these are for
+     * the ARM GIC and indicate an SPI interrupt, rising-edge-triggered.)
+     */
+    int rc;
+    char *nodename = g_strdup_printf("/virtio_mmio@%" PRIx64, addr);
+
+    rc = qemu_devtree_add_subnode(fdt, nodename);
+    rc |= qemu_devtree_setprop_string(fdt, nodename,
+                                      "compatible", "virtio,mmio");
+    rc |= qemu_devtree_setprop_sized_cells(fdt, nodename, "reg",
+                                           acells, addr, scells, size);
+    qemu_devtree_setprop_cells(fdt, nodename, "interrupt-parent", intc);
+    qemu_devtree_setprop_cells(fdt, nodename, "interrupts", 0, irq, 1);
+    g_free(nodename);
+    if (rc) {
+        return -1;
+    }
+    return 0;
+}
+
+static uint32_t find_int_controller(void *fdt)
+{
+    /* Find the FDT node corresponding to the interrupt controller
+     * for virtio-mmio devices. We do this by scanning the fdt for
+     * a node with the right compatibility, since we know there is
+     * only one GIC on a vexpress board.
+     * We return the phandle of the node, or 0 if none was found.
+     */
+    const char *compat = "arm,cortex-a9-gic";
+    int offset;
+
+    offset = fdt_node_offset_by_compatible(fdt, -1, compat);
+    if (offset >= 0) {
+        return fdt_get_phandle(fdt, offset);
+    }
+    return 0;
+}
+
+static void vexpress_modify_dtb(const struct arm_boot_info *info, void *fdt)
+{
+    uint32_t acells, scells, intc;
+    const VEDBoardInfo *daughterboard = (const VEDBoardInfo *)info;
+
+    acells = qemu_devtree_getprop_cell(fdt, "/", "#address-cells");
+    scells = qemu_devtree_getprop_cell(fdt, "/", "#size-cells");
+    intc = find_int_controller(fdt);
+    if (!intc) {
+        /* Not fatal, we just won't provide virtio. This will
+         * happen with older device tree blobs.
+         */
+        fprintf(stderr, "QEMU: warning: couldn't find interrupt controller in "
+                "dtb; will not include virtio-mmio devices in the dtb.\n");
+    } else {
+        int i;
+        const hwaddr *map = daughterboard->motherboard_map;
+
+        /* We iterate backwards here because adding nodes
+         * to the dtb puts them in last-first.
+         */
+        for (i = NUM_VIRTIO_TRANSPORTS - 1; i >= 0; i--) {
+            add_virtio_mmio_node(fdt, acells, scells,
+                                 map[VE_VIRTIO] + 0x200 * i,
+                                 0x200, intc, 40 + i);
+        }
+    }
+}
+
 static void vexpress_common_init(VEDBoardInfo *daughterboard,
                                  QEMUMachineInitArgs *args)
 {
@@ -523,6 +612,15 @@ static void vexpress_common_init(VEDBoardInfo *daughterboard,
 
     /* VE_DAPROM: not modelled */
 
+    /* Create mmio transports, so the user can create virtio backends
+     * (which will be automatically plugged in to the transports). If
+     * no backend is created the transport will just sit harmlessly idle.
+     */
+    for (i = 0; i < NUM_VIRTIO_TRANSPORTS; i++) {
+        sysbus_create_simple("virtio-mmio", map[VE_VIRTIO] + 0x200 * i,
+                             pic[40 + i]);
+    }
+
     daughterboard->bootinfo.ram_size = args->ram_size;
     daughterboard->bootinfo.kernel_filename = args->kernel_filename;
     daughterboard->bootinfo.kernel_cmdline = args->kernel_cmdline;
@@ -533,6 +631,7 @@ static void vexpress_common_init(VEDBoardInfo *daughterboard,
     daughterboard->bootinfo.smp_loader_start = map[VE_SRAM];
     daughterboard->bootinfo.smp_bootreg_addr = map[VE_SYSREGS] + 0x30;
     daughterboard->bootinfo.gic_cpu_if_addr = daughterboard->gic_cpu_if_addr;
+    daughterboard->bootinfo.modify_dtb = vexpress_modify_dtb;
     arm_load_kernel(ARM_CPU(first_cpu), &daughterboard->bootinfo);
 }
 
commit cef04a26e76c9beb6f51f1703ccf17440619e226
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:11 2013 +0100

    vexpress: Make VEDBoardInfo extend arm_boot_info
    
    Make the VEDBoardInfo struct extend arm_boot_info; this will
    allow us to get at the VEDBoardInfo information inside callbacks
    from arm/boot code.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373977512-28932-8-git-send-email-peter.maydell at linaro.org

diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 7d1b823..0f15337 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -36,8 +36,6 @@
 #define VEXPRESS_FLASH_SIZE (64 * 1024 * 1024)
 #define VEXPRESS_FLASH_SECT_SIZE (256 * 1024)
 
-static struct arm_boot_info vexpress_binfo;
-
 /* Address maps for peripherals:
  * the Versatile Express motherboard has two possible maps,
  * the "legacy" one (used for A9) and the "Cortex-A Series"
@@ -153,6 +151,7 @@ typedef void DBoardInitFn(const VEDBoardInfo *daughterboard,
                           qemu_irq *pic);
 
 struct VEDBoardInfo {
+    struct arm_boot_info bootinfo;
     const hwaddr *motherboard_map;
     hwaddr loader_start;
     const hwaddr gic_cpu_if_addr;
@@ -272,7 +271,7 @@ static const uint32_t a9_clocks[] = {
     66670000, /* Test chip reference clock: 66.67MHz */
 };
 
-static const VEDBoardInfo a9_daughterboard = {
+static VEDBoardInfo a9_daughterboard = {
     .motherboard_map = motherboard_legacy_map,
     .loader_start = 0x60000000,
     .gic_cpu_if_addr = 0x1e000100,
@@ -384,7 +383,7 @@ static const uint32_t a15_clocks[] = {
     40000000, /* OSCCLK8: 40MHz : DDR2 PLL reference */
 };
 
-static const VEDBoardInfo a15_daughterboard = {
+static VEDBoardInfo a15_daughterboard = {
     .motherboard_map = motherboard_aseries_map,
     .loader_start = 0x80000000,
     .gic_cpu_if_addr = 0x2c002000,
@@ -396,7 +395,7 @@ static const VEDBoardInfo a15_daughterboard = {
     .init = a15_daughterboard_init,
 };
 
-static void vexpress_common_init(const VEDBoardInfo *daughterboard,
+static void vexpress_common_init(VEDBoardInfo *daughterboard,
                                  QEMUMachineInitArgs *args)
 {
     DeviceState *dev, *sysctl, *pl041;
@@ -524,17 +523,17 @@ static void vexpress_common_init(const VEDBoardInfo *daughterboard,
 
     /* VE_DAPROM: not modelled */
 
-    vexpress_binfo.ram_size = args->ram_size;
-    vexpress_binfo.kernel_filename = args->kernel_filename;
-    vexpress_binfo.kernel_cmdline = args->kernel_cmdline;
-    vexpress_binfo.initrd_filename = args->initrd_filename;
-    vexpress_binfo.nb_cpus = smp_cpus;
-    vexpress_binfo.board_id = VEXPRESS_BOARD_ID;
-    vexpress_binfo.loader_start = daughterboard->loader_start;
-    vexpress_binfo.smp_loader_start = map[VE_SRAM];
-    vexpress_binfo.smp_bootreg_addr = map[VE_SYSREGS] + 0x30;
-    vexpress_binfo.gic_cpu_if_addr = daughterboard->gic_cpu_if_addr;
-    arm_load_kernel(ARM_CPU(first_cpu), &vexpress_binfo);
+    daughterboard->bootinfo.ram_size = args->ram_size;
+    daughterboard->bootinfo.kernel_filename = args->kernel_filename;
+    daughterboard->bootinfo.kernel_cmdline = args->kernel_cmdline;
+    daughterboard->bootinfo.initrd_filename = args->initrd_filename;
+    daughterboard->bootinfo.nb_cpus = smp_cpus;
+    daughterboard->bootinfo.board_id = VEXPRESS_BOARD_ID;
+    daughterboard->bootinfo.loader_start = daughterboard->loader_start;
+    daughterboard->bootinfo.smp_loader_start = map[VE_SRAM];
+    daughterboard->bootinfo.smp_bootreg_addr = map[VE_SYSREGS] + 0x30;
+    daughterboard->bootinfo.gic_cpu_if_addr = daughterboard->gic_cpu_if_addr;
+    arm_load_kernel(ARM_CPU(first_cpu), &daughterboard->bootinfo);
 }
 
 static void vexpress_a9_init(QEMUMachineInitArgs *args)
commit 3b1cceb8b52320150fd93dc094ba11fd01c6adfa
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:10 2013 +0100

    arm/boot: Allow boards to modify the FDT blob
    
    Add a callback hook in arm_boot_info to allow board models to
    modify the device tree blob if they need to. (The major expected
    use case is to add virtio-mmio nodes for virtio-mmio transports
    that exist in QEMU but not in the hardware.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373977512-28932-7-git-send-email-peter.maydell at linaro.org

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 1780316..9fbe5d2 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -294,6 +294,11 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
             goto fail;
         }
     }
+
+    if (binfo->modify_dtb) {
+        binfo->modify_dtb(binfo, fdt);
+    }
+
     qemu_devtree_dumpdtb(fdt, size);
 
     cpu_physical_memory_write(addr, fdt, size);
diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index 7b2b02d..bae87c6 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -55,6 +55,10 @@ struct arm_boot_info {
                                  const struct arm_boot_info *info);
     void (*secondary_cpu_reset_hook)(ARMCPU *cpu,
                                      const struct arm_boot_info *info);
+    /* if a board needs to be able to modify a device tree provided by
+     * the user it should implement this hook.
+     */
+    void (*modify_dtb)(const struct arm_boot_info *info, void *fdt);
     /* Used internally by arm_boot.c */
     int is_linux;
     hwaddr initrd_start;
commit 4b52530be987f33f8bffbdec9826298ad53ec180
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:09 2013 +0100

    virtio: Implement MMIO based virtio transport
    
    Add support for the generic MMIO based virtio transport.
    
    This patch includes some fixes for bugs spotted by
    Ying-Shiuan Pan <yspan at itri.org.tw>.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: KONRAD Frederic <fred.konrad at greensocs.com>
    Message-id: 1373977512-28932-6-git-send-email-peter.maydell at linaro.org
    [Fred changes: updated to new virtio-bus mechanisms]
    Signed-off-by: KONRAD Frederic <fred.konrad at greensocs.com>
    [PMM changes:
     * fixed trivial makefile conflict
     * removed unused int_enable
     * host_features doesn't need migrating
     * reset guest accessible state in the reset function
     * minor style fixes like extra blank lines
     * RAZ/WI if there's no backend
     * made transport size 0x200, in line with kvmtool
     * set has_variable_vring_alignment
    ]

diff --git a/hw/virtio/Makefile.objs b/hw/virtio/Makefile.objs
index cbe6d51..1ba53d9 100644
--- a/hw/virtio/Makefile.objs
+++ b/hw/virtio/Makefile.objs
@@ -1,6 +1,7 @@
 common-obj-y += virtio-rng.o
 common-obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
 common-obj-y += virtio-bus.o
+common-obj-y += virtio-mmio.o
 common-obj-$(CONFIG_VIRTIO_BLK_DATA_PLANE) += dataplane/
 
 obj-y += virtio.o virtio-balloon.o 
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
new file mode 100644
index 0000000..54d6679
--- /dev/null
+++ b/hw/virtio/virtio-mmio.c
@@ -0,0 +1,421 @@
+/*
+ * Virtio MMIO bindings
+ *
+ * Copyright (c) 2011 Linaro Limited
+ *
+ * Author:
+ *  Peter Maydell <peter.maydell at linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "hw/sysbus.h"
+#include "hw/virtio/virtio.h"
+#include "qemu/host-utils.h"
+#include "hw/virtio/virtio-bus.h"
+
+/* #define DEBUG_VIRTIO_MMIO */
+
+#ifdef DEBUG_VIRTIO_MMIO
+
+#define DPRINTF(fmt, ...) \
+do { printf("virtio_mmio: " fmt , ## __VA_ARGS__); } while (0)
+#else
+#define DPRINTF(fmt, ...) do {} while (0)
+#endif
+
+/* QOM macros */
+/* virtio-mmio-bus */
+#define TYPE_VIRTIO_MMIO_BUS "virtio-mmio-bus"
+#define VIRTIO_MMIO_BUS(obj) \
+        OBJECT_CHECK(VirtioBusState, (obj), TYPE_VIRTIO_MMIO_BUS)
+#define VIRTIO_MMIO_BUS_GET_CLASS(obj) \
+        OBJECT_GET_CLASS(VirtioBusClass, (obj), TYPE_VIRTIO_MMIO_BUS)
+#define VIRTIO_MMIO_BUS_CLASS(klass) \
+        OBJECT_CLASS_CHECK(VirtioBusClass, (klass), TYPE_VIRTIO_MMIO_BUS)
+
+/* virtio-mmio */
+#define TYPE_VIRTIO_MMIO "virtio-mmio"
+#define VIRTIO_MMIO(obj) \
+        OBJECT_CHECK(VirtIOMMIOProxy, (obj), TYPE_VIRTIO_MMIO)
+
+/* Memory mapped register offsets */
+#define VIRTIO_MMIO_MAGIC 0x0
+#define VIRTIO_MMIO_VERSION 0x4
+#define VIRTIO_MMIO_DEVICEID 0x8
+#define VIRTIO_MMIO_VENDORID 0xc
+#define VIRTIO_MMIO_HOSTFEATURES 0x10
+#define VIRTIO_MMIO_HOSTFEATURESSEL 0x14
+#define VIRTIO_MMIO_GUESTFEATURES 0x20
+#define VIRTIO_MMIO_GUESTFEATURESSEL 0x24
+#define VIRTIO_MMIO_GUESTPAGESIZE 0x28
+#define VIRTIO_MMIO_QUEUESEL 0x30
+#define VIRTIO_MMIO_QUEUENUMMAX 0x34
+#define VIRTIO_MMIO_QUEUENUM 0x38
+#define VIRTIO_MMIO_QUEUEALIGN 0x3c
+#define VIRTIO_MMIO_QUEUEPFN 0x40
+#define VIRTIO_MMIO_QUEUENOTIFY 0x50
+#define VIRTIO_MMIO_INTERRUPTSTATUS 0x60
+#define VIRTIO_MMIO_INTERRUPTACK 0x64
+#define VIRTIO_MMIO_STATUS 0x70
+/* Device specific config space starts here */
+#define VIRTIO_MMIO_CONFIG 0x100
+
+#define VIRT_MAGIC 0x74726976 /* 'virt' */
+#define VIRT_VERSION 1
+#define VIRT_VENDOR 0x554D4551 /* 'QEMU' */
+
+typedef struct {
+    /* Generic */
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+    qemu_irq irq;
+    uint32_t host_features;
+    /* Guest accessible state needing migration and reset */
+    uint32_t host_features_sel;
+    uint32_t guest_features_sel;
+    uint32_t guest_page_shift;
+    /* virtio-bus */
+    VirtioBusState bus;
+} VirtIOMMIOProxy;
+
+static void virtio_mmio_bus_new(VirtioBusState *bus, VirtIOMMIOProxy *dev);
+
+static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
+{
+    VirtIOMMIOProxy *proxy = (VirtIOMMIOProxy *)opaque;
+    VirtIODevice *vdev = proxy->bus.vdev;
+
+    DPRINTF("virtio_mmio_read offset 0x%x\n", (int)offset);
+
+    if (!vdev) {
+        /* If no backend is present, we treat most registers as
+         * read-as-zero, except for the magic number, version and
+         * vendor ID. This is not strictly sanctioned by the virtio
+         * spec, but it allows us to provide transports with no backend
+         * plugged in which don't confuse Linux's virtio code: the
+         * probe won't complain about the bad magic number, but the
+         * device ID of zero means no backend will claim it.
+         */
+        switch (offset) {
+        case VIRTIO_MMIO_MAGIC:
+            return VIRT_MAGIC;
+        case VIRTIO_MMIO_VERSION:
+            return VIRT_VERSION;
+        case VIRTIO_MMIO_VENDORID:
+            return VIRT_VENDOR;
+        default:
+            return 0;
+        }
+    }
+
+    if (offset >= VIRTIO_MMIO_CONFIG) {
+        offset -= VIRTIO_MMIO_CONFIG;
+        switch (size) {
+        case 1:
+            return virtio_config_readb(vdev, offset);
+        case 2:
+            return virtio_config_readw(vdev, offset);
+        case 4:
+            return virtio_config_readl(vdev, offset);
+        default:
+            abort();
+        }
+    }
+    if (size != 4) {
+        DPRINTF("wrong size access to register!\n");
+        return 0;
+    }
+    switch (offset) {
+    case VIRTIO_MMIO_MAGIC:
+        return VIRT_MAGIC;
+    case VIRTIO_MMIO_VERSION:
+        return VIRT_VERSION;
+    case VIRTIO_MMIO_DEVICEID:
+        return vdev->device_id;
+    case VIRTIO_MMIO_VENDORID:
+        return VIRT_VENDOR;
+    case VIRTIO_MMIO_HOSTFEATURES:
+        if (proxy->host_features_sel) {
+            return 0;
+        }
+        return proxy->host_features;
+    case VIRTIO_MMIO_QUEUENUMMAX:
+        return VIRTQUEUE_MAX_SIZE;
+    case VIRTIO_MMIO_QUEUEPFN:
+        return virtio_queue_get_addr(vdev, vdev->queue_sel)
+            >> proxy->guest_page_shift;
+    case VIRTIO_MMIO_INTERRUPTSTATUS:
+        return vdev->isr;
+    case VIRTIO_MMIO_STATUS:
+        return vdev->status;
+    case VIRTIO_MMIO_HOSTFEATURESSEL:
+    case VIRTIO_MMIO_GUESTFEATURES:
+    case VIRTIO_MMIO_GUESTFEATURESSEL:
+    case VIRTIO_MMIO_GUESTPAGESIZE:
+    case VIRTIO_MMIO_QUEUESEL:
+    case VIRTIO_MMIO_QUEUENUM:
+    case VIRTIO_MMIO_QUEUEALIGN:
+    case VIRTIO_MMIO_QUEUENOTIFY:
+    case VIRTIO_MMIO_INTERRUPTACK:
+        DPRINTF("read of write-only register\n");
+        return 0;
+    default:
+        DPRINTF("bad register offset\n");
+        return 0;
+    }
+    return 0;
+}
+
+static void virtio_mmio_write(void *opaque, hwaddr offset, uint64_t value,
+                              unsigned size)
+{
+    VirtIOMMIOProxy *proxy = (VirtIOMMIOProxy *)opaque;
+    VirtIODevice *vdev = proxy->bus.vdev;
+
+    DPRINTF("virtio_mmio_write offset 0x%x value 0x%" PRIx64 "\n",
+            (int)offset, value);
+
+    if (!vdev) {
+        /* If no backend is present, we just make all registers
+         * write-ignored. This allows us to provide transports with
+         * no backend plugged in.
+         */
+        return;
+    }
+
+    if (offset >= VIRTIO_MMIO_CONFIG) {
+        offset -= VIRTIO_MMIO_CONFIG;
+        switch (size) {
+        case 1:
+            virtio_config_writeb(vdev, offset, value);
+            break;
+        case 2:
+            virtio_config_writew(vdev, offset, value);
+            break;
+        case 4:
+            virtio_config_writel(vdev, offset, value);
+            break;
+        default:
+            abort();
+        }
+        return;
+    }
+    if (size != 4) {
+        DPRINTF("wrong size access to register!\n");
+        return;
+    }
+    switch (offset) {
+    case VIRTIO_MMIO_HOSTFEATURESSEL:
+        proxy->host_features_sel = value;
+        break;
+    case VIRTIO_MMIO_GUESTFEATURES:
+        if (!proxy->guest_features_sel) {
+            virtio_set_features(vdev, value);
+        }
+        break;
+    case VIRTIO_MMIO_GUESTFEATURESSEL:
+        proxy->guest_features_sel = value;
+        break;
+    case VIRTIO_MMIO_GUESTPAGESIZE:
+        proxy->guest_page_shift = ctz32(value);
+        if (proxy->guest_page_shift > 31) {
+            proxy->guest_page_shift = 0;
+        }
+        DPRINTF("guest page size %" PRIx64 " shift %d\n", value,
+                proxy->guest_page_shift);
+        break;
+    case VIRTIO_MMIO_QUEUESEL:
+        if (value < VIRTIO_PCI_QUEUE_MAX) {
+            vdev->queue_sel = value;
+        }
+        break;
+    case VIRTIO_MMIO_QUEUENUM:
+        DPRINTF("mmio_queue write %d max %d\n", (int)value, VIRTQUEUE_MAX_SIZE);
+        virtio_queue_set_num(vdev, vdev->queue_sel, value);
+        break;
+    case VIRTIO_MMIO_QUEUEALIGN:
+        virtio_queue_set_align(vdev, vdev->queue_sel, value);
+        break;
+    case VIRTIO_MMIO_QUEUEPFN:
+        if (value == 0) {
+            virtio_reset(vdev);
+        } else {
+            virtio_queue_set_addr(vdev, vdev->queue_sel,
+                                  value << proxy->guest_page_shift);
+        }
+        break;
+    case VIRTIO_MMIO_QUEUENOTIFY:
+        if (value < VIRTIO_PCI_QUEUE_MAX) {
+            virtio_queue_notify(vdev, value);
+        }
+        break;
+    case VIRTIO_MMIO_INTERRUPTACK:
+        vdev->isr &= ~value;
+        virtio_update_irq(vdev);
+        break;
+    case VIRTIO_MMIO_STATUS:
+        virtio_set_status(vdev, value & 0xff);
+        if (vdev->status == 0) {
+            virtio_reset(vdev);
+        }
+        break;
+    case VIRTIO_MMIO_MAGIC:
+    case VIRTIO_MMIO_VERSION:
+    case VIRTIO_MMIO_DEVICEID:
+    case VIRTIO_MMIO_VENDORID:
+    case VIRTIO_MMIO_HOSTFEATURES:
+    case VIRTIO_MMIO_QUEUENUMMAX:
+    case VIRTIO_MMIO_INTERRUPTSTATUS:
+        DPRINTF("write to readonly register\n");
+        break;
+
+    default:
+        DPRINTF("bad register offset\n");
+    }
+}
+
+static const MemoryRegionOps virtio_mem_ops = {
+    .read = virtio_mmio_read,
+    .write = virtio_mmio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void virtio_mmio_update_irq(DeviceState *opaque, uint16_t vector)
+{
+    VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
+    int level;
+
+    if (!proxy->bus.vdev) {
+        return;
+    }
+    level = (proxy->bus.vdev->isr != 0);
+    DPRINTF("virtio_mmio setting IRQ %d\n", level);
+    qemu_set_irq(proxy->irq, level);
+}
+
+static unsigned int virtio_mmio_get_features(DeviceState *opaque)
+{
+    VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
+
+    return proxy->host_features;
+}
+
+static int virtio_mmio_load_config(DeviceState *opaque, QEMUFile *f)
+{
+    VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
+
+    proxy->host_features_sel = qemu_get_be32(f);
+    proxy->guest_features_sel = qemu_get_be32(f);
+    proxy->guest_page_shift = qemu_get_be32(f);
+    return 0;
+}
+
+static void virtio_mmio_save_config(DeviceState *opaque, QEMUFile *f)
+{
+    VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
+
+    qemu_put_be32(f, proxy->host_features_sel);
+    qemu_put_be32(f, proxy->guest_features_sel);
+    qemu_put_be32(f, proxy->guest_page_shift);
+}
+
+static void virtio_mmio_reset(DeviceState *d)
+{
+    VirtIOMMIOProxy *proxy = VIRTIO_MMIO(d);
+
+    virtio_bus_reset(&proxy->bus);
+    proxy->host_features_sel = 0;
+    proxy->guest_features_sel = 0;
+    proxy->guest_page_shift = 0;
+}
+
+/* virtio-mmio device */
+
+/* This is called by virtio-bus just after the device is plugged. */
+static void virtio_mmio_device_plugged(DeviceState *opaque)
+{
+    VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
+
+    proxy->host_features |= (0x1 << VIRTIO_F_NOTIFY_ON_EMPTY);
+    proxy->host_features = virtio_bus_get_vdev_features(&proxy->bus,
+                                                        proxy->host_features);
+}
+
+static void virtio_mmio_realizefn(DeviceState *d, Error **errp)
+{
+    VirtIOMMIOProxy *proxy = VIRTIO_MMIO(d);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(d);
+
+    virtio_mmio_bus_new(&proxy->bus, proxy);
+    sysbus_init_irq(sbd, &proxy->irq);
+    memory_region_init_io(&proxy->iomem, OBJECT(d), &virtio_mem_ops, proxy,
+                          TYPE_VIRTIO_MMIO, 0x200);
+    sysbus_init_mmio(sbd, &proxy->iomem);
+}
+
+static void virtio_mmio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = virtio_mmio_realizefn;
+    dc->reset = virtio_mmio_reset;
+}
+
+static const TypeInfo virtio_mmio_info = {
+    .name          = TYPE_VIRTIO_MMIO,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(VirtIOMMIOProxy),
+    .class_init    = virtio_mmio_class_init,
+};
+
+/* virtio-mmio-bus. */
+
+static void virtio_mmio_bus_new(VirtioBusState *bus, VirtIOMMIOProxy *dev)
+{
+    DeviceState *qdev = DEVICE(dev);
+    BusState *qbus;
+
+    qbus_create_inplace((BusState *)bus, TYPE_VIRTIO_MMIO_BUS, qdev, NULL);
+    qbus = BUS(bus);
+    qbus->allow_hotplug = 0;
+}
+
+static void virtio_mmio_bus_class_init(ObjectClass *klass, void *data)
+{
+    BusClass *bus_class = BUS_CLASS(klass);
+    VirtioBusClass *k = VIRTIO_BUS_CLASS(klass);
+
+    k->notify = virtio_mmio_update_irq;
+    k->save_config = virtio_mmio_save_config;
+    k->load_config = virtio_mmio_load_config;
+    k->get_features = virtio_mmio_get_features;
+    k->device_plugged = virtio_mmio_device_plugged;
+    k->has_variable_vring_alignment = true;
+    bus_class->max_dev = 1;
+}
+
+static const TypeInfo virtio_mmio_bus_info = {
+    .name          = TYPE_VIRTIO_MMIO_BUS,
+    .parent        = TYPE_VIRTIO_BUS,
+    .instance_size = sizeof(VirtioBusState),
+    .class_init    = virtio_mmio_bus_class_init,
+};
+
+static void virtio_mmio_register_types(void)
+{
+    type_register_static(&virtio_mmio_bus_info);
+    type_register_static(&virtio_mmio_info);
+}
+
+type_init(virtio_mmio_register_types)
commit 6ce69d1c7741c0ad524e4cad6dca31e782108a65
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:08 2013 +0100

    virtio: Support transports which can specify the vring alignment
    
    Support virtio transports which can specify the vring alignment
    (ie where the guest communicates this to the host) by providing
    a new virtio_queue_set_align() function. (The default alignment
    remains as before.)
    
    Transports which wish to make use of this must set the
    has_variable_vring_alignment field in their VirtioBusClass
    struct to true; they can then change the alignment via
    virtio_queue_set_align().
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373977512-28932-5-git-send-email-peter.maydell at linaro.org

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 01b05f3..09f62c6 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -19,8 +19,11 @@
 #include "qemu/atomic.h"
 #include "hw/virtio/virtio-bus.h"
 
-/* The alignment to use between consumer and producer parts of vring.
- * x86 pagesize again. */
+/*
+ * The alignment to use between consumer and producer parts of vring.
+ * x86 pagesize again. This is the default, used by transports like PCI
+ * which don't provide a means for the guest to tell the host the alignment.
+ */
 #define VIRTIO_PCI_VRING_ALIGN         4096
 
 typedef struct VRingDesc
@@ -54,6 +57,7 @@ typedef struct VRingUsed
 typedef struct VRing
 {
     unsigned int num;
+    unsigned int align;
     hwaddr desc;
     hwaddr avail;
     hwaddr used;
@@ -93,7 +97,7 @@ static void virtqueue_init(VirtQueue *vq)
     vq->vring.avail = pa + vq->vring.num * sizeof(VRingDesc);
     vq->vring.used = vring_align(vq->vring.avail +
                                  offsetof(VRingAvail, ring[vq->vring.num]),
-                                 VIRTIO_PCI_VRING_ALIGN);
+                                 vq->vring.align);
 }
 
 static inline uint64_t vring_desc_addr(hwaddr desc_pa, int i)
@@ -687,6 +691,21 @@ int virtio_queue_get_id(VirtQueue *vq)
     return vq - &vdev->vq[0];
 }
 
+void virtio_queue_set_align(VirtIODevice *vdev, int n, int align)
+{
+    BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
+    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
+
+    /* Check that the transport told us it was going to do this
+     * (so a buggy transport will immediately assert rather than
+     * silently failing to migrate this state)
+     */
+    assert(k->has_variable_vring_alignment);
+
+    vdev->vq[n].vring.align = align;
+    virtqueue_init(&vdev->vq[n]);
+}
+
 void virtio_queue_notify_vq(VirtQueue *vq)
 {
     if (vq->vring.desc) {
@@ -727,6 +746,7 @@ VirtQueue *virtio_add_queue(VirtIODevice *vdev, int queue_size,
         abort();
 
     vdev->vq[i].vring.num = queue_size;
+    vdev->vq[i].vring.align = VIRTIO_PCI_VRING_ALIGN;
     vdev->vq[i].handle_output = handle_output;
 
     return &vdev->vq[i];
@@ -833,6 +853,9 @@ void virtio_save(VirtIODevice *vdev, QEMUFile *f)
             break;
 
         qemu_put_be32(f, vdev->vq[i].vring.num);
+        if (k->has_variable_vring_alignment) {
+            qemu_put_be32(f, vdev->vq[i].vring.align);
+        }
         qemu_put_be64(f, vdev->vq[i].pa);
         qemu_put_be16s(f, &vdev->vq[i].last_avail_idx);
         if (k->save_queue) {
@@ -889,6 +912,9 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
 
     for (i = 0; i < num; i++) {
         vdev->vq[i].vring.num = qemu_get_be32(f);
+        if (k->has_variable_vring_alignment) {
+            vdev->vq[i].vring.align = qemu_get_be32(f);
+        }
         vdev->vq[i].pa = qemu_get_be64(f);
         qemu_get_be16s(f, &vdev->vq[i].last_avail_idx);
         vdev->vq[i].signalled_used_valid = false;
diff --git a/include/hw/virtio/virtio-bus.h b/include/hw/virtio/virtio-bus.h
index 9ed60f9..9217f85 100644
--- a/include/hw/virtio/virtio-bus.h
+++ b/include/hw/virtio/virtio-bus.h
@@ -62,6 +62,12 @@ typedef struct VirtioBusClass {
      * This is called by virtio-bus just before the device is unplugged.
      */
     void (*device_unplug)(DeviceState *d);
+    /*
+     * Does the transport have variable vring alignment?
+     * (ie can it ever call virtio_queue_set_align()?)
+     * Note that changing this will break migration for this transport.
+     */
+    bool has_variable_vring_alignment;
 } VirtioBusClass;
 
 struct VirtioBusState {
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 65f378d..d7e9e0f 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -202,6 +202,7 @@ void virtio_queue_set_addr(VirtIODevice *vdev, int n, hwaddr addr);
 hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n);
 void virtio_queue_set_num(VirtIODevice *vdev, int n, int num);
 int virtio_queue_get_num(VirtIODevice *vdev, int n);
+void virtio_queue_set_align(VirtIODevice *vdev, int n, int align);
 void virtio_queue_notify(VirtIODevice *vdev, int n);
 uint16_t virtio_queue_vector(VirtIODevice *vdev, int n);
 void virtio_queue_set_vector(VirtIODevice *vdev, int n, uint16_t vector);
commit e63c0ba1bce0b3cc7037c6c2d327267a585534ec
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:07 2013 +0100

    virtio: Add support for guest setting of queue size
    
    The MMIO virtio transport spec allows the guest to tell the host how
    large the queue size is. Add virtio_queue_set_num() function which
    implements this in the QEMU common virtio support code.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373977512-28932-4-git-send-email-peter.maydell at linaro.org

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 8176c14..01b05f3 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -667,6 +667,14 @@ hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n)
     return vdev->vq[n].pa;
 }
 
+void virtio_queue_set_num(VirtIODevice *vdev, int n, int num)
+{
+    if (num <= VIRTQUEUE_MAX_SIZE) {
+        vdev->vq[n].vring.num = num;
+        virtqueue_init(&vdev->vq[n]);
+    }
+}
+
 int virtio_queue_get_num(VirtIODevice *vdev, int n)
 {
     return vdev->vq[n].vring.num;
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 5d1d2be..65f378d 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -200,6 +200,7 @@ void virtio_config_writew(VirtIODevice *vdev, uint32_t addr, uint32_t data);
 void virtio_config_writel(VirtIODevice *vdev, uint32_t addr, uint32_t data);
 void virtio_queue_set_addr(VirtIODevice *vdev, int n, hwaddr addr);
 hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n);
+void virtio_queue_set_num(VirtIODevice *vdev, int n, int num);
 int virtio_queue_get_num(VirtIODevice *vdev, int n);
 void virtio_queue_notify(VirtIODevice *vdev, int n);
 uint16_t virtio_queue_vector(VirtIODevice *vdev, int n);
commit 70976c41c1def9d6e8b664c64cdf83b1ea0daa03
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:06 2013 +0100

    arm/boot: Use qemu_devtree_setprop_sized_cells()
    
    Replace the opencoded assembly of the reg property array for the
    /memory node with a call to qemu_devtree_setprop_sized_cells().
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: 1373977512-28932-3-git-send-email-peter.maydell at linaro.org

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index a2e4032..1780316 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -227,12 +227,10 @@ static void set_kernel_args_old(const struct arm_boot_info *info)
 
 static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
 {
-    uint32_t *mem_reg_property;
-    uint32_t mem_reg_propsize;
     void *fdt = NULL;
     char *filename;
     int size, rc;
-    uint32_t acells, scells, hival;
+    uint32_t acells, scells;
 
     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, binfo->dtb_filename);
     if (!filename) {
@@ -255,29 +253,18 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
         goto fail;
     }
 
-    mem_reg_propsize = acells + scells;
-    mem_reg_property = g_new0(uint32_t, mem_reg_propsize);
-    mem_reg_property[acells - 1] = cpu_to_be32(binfo->loader_start);
-    hival = cpu_to_be32(binfo->loader_start >> 32);
-    if (acells > 1) {
-        mem_reg_property[acells - 2] = hival;
-    } else if (hival != 0) {
-        fprintf(stderr, "qemu: dtb file not compatible with "
-                "RAM start address > 4GB\n");
-        goto fail;
-    }
-    mem_reg_property[acells + scells - 1] = cpu_to_be32(binfo->ram_size);
-    hival = cpu_to_be32(binfo->ram_size >> 32);
-    if (scells > 1) {
-        mem_reg_property[acells + scells - 2] = hival;
-    } else if (hival != 0) {
+    if (scells < 2 && binfo->ram_size >= (1ULL << 32)) {
+        /* This is user error so deserves a friendlier error message
+         * than the failure of setprop_sized_cells would provide
+         */
         fprintf(stderr, "qemu: dtb file not compatible with "
                 "RAM size > 4GB\n");
         goto fail;
     }
 
-    rc = qemu_devtree_setprop(fdt, "/memory", "reg", mem_reg_property,
-                              mem_reg_propsize * sizeof(uint32_t));
+    rc = qemu_devtree_setprop_sized_cells(fdt, "/memory", "reg",
+                                          acells, binfo->loader_start,
+                                          scells, binfo->ram_size);
     if (rc < 0) {
         fprintf(stderr, "couldn't set /memory/reg\n");
         goto fail;
commit 97c38f8c279ae2f71cb0f6aed11aa94ef59b2955
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 16 13:25:05 2013 +0100

    device_tree: Add qemu_devtree_setprop_sized_cells() utility functions
    
    We already have a qemu_devtree_setprop_cells() which sets a dtb
    property to an array of cells whose values are specified by varargs.
    However for the fairly common case of setting a property to a list
    of addresses or of address,size pairs the number of cells used by
    each element in the list depends on the parent's #address-cells
    and #size-cells properties. To make this easier we provide an analogous
    qemu_devtree_setprop_sized_cells() macro which allows the number
    of cells used by each element to be specified. This is implemented
    using an underlying qemu_devtree_setprop_sized_cells_from_array()
    function which takes the values and sizes as an array; this may
    also be directly useful for cases where the cell contents are
    constructed programmatically.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: 1373977512-28932-2-git-send-email-peter.maydell at linaro.org

diff --git a/device_tree.c b/device_tree.c
index 10cf3d0..ffec99a 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -308,3 +308,36 @@ void qemu_devtree_dumpdtb(void *fdt, int size)
         exit(g_file_set_contents(dumpdtb, fdt, size, NULL) ? 0 : 1);
     }
 }
+
+int qemu_devtree_setprop_sized_cells_from_array(void *fdt,
+                                                const char *node_path,
+                                                const char *property,
+                                                int numvalues,
+                                                uint64_t *values)
+{
+    uint32_t *propcells;
+    uint64_t value;
+    int cellnum, vnum, ncells;
+    uint32_t hival;
+
+    propcells = g_new0(uint32_t, numvalues * 2);
+
+    cellnum = 0;
+    for (vnum = 0; vnum < numvalues; vnum++) {
+        ncells = values[vnum * 2];
+        if (ncells != 1 && ncells != 2) {
+            return -1;
+        }
+        value = values[vnum * 2 + 1];
+        hival = cpu_to_be32(value >> 32);
+        if (ncells > 1) {
+            propcells[cellnum++] = hival;
+        } else if (hival != 0) {
+            return -1;
+        }
+        propcells[cellnum++] = cpu_to_be32(value);
+    }
+
+    return qemu_devtree_setprop(fdt, node_path, property, propcells,
+                                cellnum * sizeof(uint32_t));
+}
diff --git a/include/sysemu/device_tree.h b/include/sysemu/device_tree.h
index f0b3f35..2b58baf 100644
--- a/include/sysemu/device_tree.h
+++ b/include/sysemu/device_tree.h
@@ -51,4 +51,63 @@ int qemu_devtree_add_subnode(void *fdt, const char *name);
 
 void qemu_devtree_dumpdtb(void *fdt, int size);
 
+/**
+ * qemu_devtree_setprop_sized_cells_from_array:
+ * @fdt: device tree blob
+ * @node_path: node to set property on
+ * @property: property to set
+ * @numvalues: number of values
+ * @values: array of number-of-cells, value pairs
+ *
+ * Set the specified property on the specified node in the device tree
+ * to be an array of cells. The values of the cells are specified via
+ * the values list, which alternates between "number of cells used by
+ * this value" and "value".
+ * number-of-cells must be either 1 or 2 (other values will result in
+ * an error being returned). If a value is too large to fit in the
+ * number of cells specified for it, an error is returned.
+ *
+ * This function is useful because device tree nodes often have cell arrays
+ * which are either lists of addresses or lists of address,size tuples, but
+ * the number of cells used for each element vary depending on the
+ * #address-cells and #size-cells properties of their parent node.
+ * If you know all your cell elements are one cell wide you can use the
+ * simpler qemu_devtree_setprop_cells(). If you're not setting up the
+ * array programmatically, qemu_devtree_setprop_sized_cells may be more
+ * convenient.
+ *
+ * Return value: 0 on success, <0 on error.
+ */
+int qemu_devtree_setprop_sized_cells_from_array(void *fdt,
+                                                const char *node_path,
+                                                const char *property,
+                                                int numvalues,
+                                                uint64_t *values);
+
+/**
+ * qemu_devtree_setprop_sized_cells:
+ * @fdt: device tree blob
+ * @node_path: node to set property on
+ * @property: property to set
+ * @...: list of number-of-cells, value pairs
+ *
+ * Set the specified property on the specified node in the device tree
+ * to be an array of cells. The values of the cells are specified via
+ * the variable arguments, which alternates between "number of cells
+ * used by this value" and "value".
+ *
+ * This is a convenience wrapper for the function
+ * qemu_devtree_setprop_sized_cells_from_array().
+ *
+ * Return value: 0 on success, <0 on error.
+ */
+#define qemu_devtree_setprop_sized_cells(fdt, node_path, property, ...)       \
+    ({                                                                        \
+        uint64_t qdt_tmp[] = { __VA_ARGS__ };                                 \
+        qemu_devtree_setprop_sized_cells_from_array(fdt, node_path,           \
+                                                    property,                 \
+                                                    ARRAY_SIZE(qdt_tmp) / 2,  \
+                                                    qdt_tmp);                 \
+    })
+
 #endif /* __DEVICE_TREE_H__ */
commit be022d61f4938bb051e8af8e6cb470ec1602c488
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Thu Jul 11 12:55:50 2013 +0400

    doc: monitor multiplexing rewording
    
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-options.hx b/qemu-options.hx
index 4e98b4f..2dbfd42 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2493,8 +2493,8 @@ listening on port 4444 would be:
 @table @code
 @item -serial mon:telnet::4444,server,nowait
 @end table
-When monitor is multiplexed to stdio this way, Ctrl+C will not terminate
-QEMU anymore but will be passed to the guest instead.
+When the monitor is multiplexed to stdio in this way, Ctrl+C will not terminate
+QEMU any more but will be passed to the guest instead.
 
 @item braille
 Braille device.  This will use BrlAPI to display the braille output on a real
commit f5aac8e07ff25846c7a5c1a5153c49c18715d9f0
Author: Ed Maste <emaste at freebsd.org>
Date:   Tue Jun 4 11:59:14 2013 -0400

    block/m25p80: Update Micron entries
    
    - Split 32Mb and 256Mb parts into a11 and a13 variants.
    - Add the 4K sector flag to the 128Mb parts.  (These entries were taken from
      the Linux kernel list, which is missing the flag.)
    - Fill out the table of sizes with entries for 64Mb parts.
    
    Prodded by Peter Crosthwaite.
    
    Signed-off-by: Ed Maste <emaste at freebsd.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index a927a6b..8c3b7f0 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -123,10 +123,14 @@ static const FlashPartInfo known_devices[] = {
     { INFO("mx25l25655e", 0xc22619,      0,  64 << 10, 512, 0) },
 
     /* Micron */
-    { INFO("n25q032a",    0x20bb16,      0,  64 << 10,  64, ER_4K) },
-    { INFO("n25q128a11",  0x20bb18,      0,  64 << 10, 256, 0) },
-    { INFO("n25q128a13",  0x20ba18,      0,  64 << 10, 256, 0) },
-    { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512, ER_4K) },
+    { INFO("n25q032a11",  0x20bb16,      0,  64 << 10,  64, ER_4K) },
+    { INFO("n25q032a13",  0x20ba16,      0,  64 << 10,  64, ER_4K) },
+    { INFO("n25q064a11",  0x20bb17,      0,  64 << 10, 128, ER_4K) },
+    { INFO("n25q064a13",  0x20ba17,      0,  64 << 10, 128, ER_4K) },
+    { INFO("n25q128a11",  0x20bb18,      0,  64 << 10, 256, ER_4K) },
+    { INFO("n25q128a13",  0x20ba18,      0,  64 << 10, 256, ER_4K) },
+    { INFO("n25q256a11",  0x20bb19,      0,  64 << 10, 512, ER_4K) },
+    { INFO("n25q256a13",  0x20ba19,      0,  64 << 10, 512, ER_4K) },
 
     /* Spansion -- single (large) sector size only, at least
      * for the chips listed here (without boot sectors).
commit 805695daf64879959e3ea357fe9c391ddacea9c6
Author: Cole Robinson <crobinso at redhat.com>
Date:   Tue Jul 9 10:07:53 2013 -0400

    Fix command example in qemu.sasl
    
    sasldblistusers2 doesn't have a '-a' option
    
    Signed-off-by: Cole Robinson <crobinso at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu.sasl b/qemu.sasl
index cf19cf8..9dc8323 100644
--- a/qemu.sasl
+++ b/qemu.sasl
@@ -26,7 +26,7 @@ keytab: /etc/qemu/krb5.tab
 
 # If using digest-md5 for username/passwds, then this is the file
 # containing the passwds. Use 'saslpasswd2 -a qemu [username]'
-# to add entries, and 'sasldblistusers2 -a qemu' to browse it
+# to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it
 sasldb_path: /etc/qemu/passwd.db
 
 
commit 0e44486cdccb4c1f9e5fad390cfd7186850c7204
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Sat Jul 13 13:10:05 2013 +0400

    slirp: remove mbuf(m_hdr,m_dat) indirection

diff --git a/slirp/mbuf.h b/slirp/mbuf.h
index 3f3ab09..b144f1c 100644
--- a/slirp/mbuf.h
+++ b/slirp/mbuf.h
@@ -49,22 +49,6 @@
  * free the m_ext.  This is inefficient memory-wise, but who cares.
  */
 
-/* XXX should union some of these! */
-/* header at beginning of each mbuf: */
-struct m_hdr {
-	struct	mbuf *mh_next;		/* Linked list of mbufs */
-	struct	mbuf *mh_prev;
-	struct	mbuf *mh_nextpkt;	/* Next packet in queue/record */
-	struct	mbuf *mh_prevpkt; /* Flags aren't used in the output queue */
-	int	mh_flags;	  /* Misc flags */
-
-	int	mh_size;		/* Size of data */
-	struct	socket *mh_so;
-
-	caddr_t	mh_data;		/* Location of data */
-	int	mh_len;			/* Amount of data in this mbuf */
-};
-
 /*
  * How much room is in the mbuf, from m_data to the end of the mbuf
  */
@@ -80,29 +64,30 @@ struct m_hdr {
 #define M_TRAILINGSPACE M_FREEROOM
 
 struct mbuf {
-	struct	m_hdr m_hdr;
+	/* XXX should union some of these! */
+	/* header at beginning of each mbuf: */
+	struct	mbuf *m_next;		/* Linked list of mbufs */
+	struct	mbuf *m_prev;
+	struct	mbuf *m_nextpkt;	/* Next packet in queue/record */
+	struct	mbuf *m_prevpkt;	/* Flags aren't used in the output queue */
+	int	m_flags;		/* Misc flags */
+
+	int	m_size;			/* Size of data */
+	struct	socket *m_so;
+
+	caddr_t	m_data;			/* Location of data */
+	int	m_len;			/* Amount of data in this mbuf */
+
 	Slirp *slirp;
 	bool	arp_requested;
 	uint64_t expiration_date;
 	/* start of dynamic buffer area, must be last element */
-	union M_dat {
-		char	m_dat_[1]; /* ANSI don't like 0 sized arrays */
-		char	*m_ext_;
-	} M_dat;
+	union {
+		char	m_dat[1]; /* ANSI don't like 0 sized arrays */
+		char	*m_ext;
+	};
 };
 
-#define m_next		m_hdr.mh_next
-#define m_prev		m_hdr.mh_prev
-#define m_nextpkt	m_hdr.mh_nextpkt
-#define m_prevpkt	m_hdr.mh_prevpkt
-#define m_flags		m_hdr.mh_flags
-#define	m_len		m_hdr.mh_len
-#define	m_data		m_hdr.mh_data
-#define m_size		m_hdr.mh_size
-#define m_dat		M_dat.m_dat_
-#define m_ext		M_dat.m_ext_
-#define m_so		m_hdr.mh_so
-
 #define ifq_prev m_prev
 #define ifq_next m_next
 #define ifs_prev m_prevpkt
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
index e98ce1a..043f28f 100644
--- a/slirp/tcp_subr.c
+++ b/slirp/tcp_subr.c
@@ -647,7 +647,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 			n4 =  (laddr & 0xff);
 
 			m->m_len = bptr - m->m_data; /* Adjust length */
-                        m->m_len += snprintf(bptr, m->m_hdr.mh_size - m->m_len,
+                        m->m_len += snprintf(bptr, m->m_size - m->m_len,
                                              "ORT %d,%d,%d,%d,%d,%d\r\n%s",
                                              n1, n2, n3, n4, n5, n6, x==7?buff:"");
 			return 1;
@@ -680,7 +680,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 			n4 =  (laddr & 0xff);
 
 			m->m_len = bptr - m->m_data; /* Adjust length */
-			m->m_len += snprintf(bptr, m->m_hdr.mh_size - m->m_len,
+			m->m_len += snprintf(bptr, m->m_size - m->m_len,
                                              "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
                                              n1, n2, n3, n4, n5, n6, x==7?buff:"");
 
@@ -706,7 +706,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 		if (m->m_data[m->m_len-1] == '\0' && lport != 0 &&
 		    (so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
 		                     htons(lport), SS_FACCEPTONCE)) != NULL)
-                    m->m_len = snprintf(m->m_data, m->m_hdr.mh_size, "%d",
+                    m->m_len = snprintf(m->m_data, m->m_size, "%d",
                                         ntohs(so->so_fport)) + 1;
 		return 1;
 
@@ -726,7 +726,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 				return 1;
 			}
 			m->m_len = bptr - m->m_data; /* Adjust length */
-                        m->m_len += snprintf(bptr, m->m_hdr.mh_size,
+                        m->m_len += snprintf(bptr, m->m_size,
                                              "DCC CHAT chat %lu %u%c\n",
                                              (unsigned long)ntohl(so->so_faddr.s_addr),
                                              ntohs(so->so_fport), 1);
@@ -737,7 +737,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 				return 1;
 			}
 			m->m_len = bptr - m->m_data; /* Adjust length */
-                        m->m_len += snprintf(bptr, m->m_hdr.mh_size,
+                        m->m_len += snprintf(bptr, m->m_size,
                                              "DCC SEND %s %lu %u %u%c\n", buff,
                                              (unsigned long)ntohl(so->so_faddr.s_addr),
                                              ntohs(so->so_fport), n1, 1);
@@ -748,7 +748,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 				return 1;
 			}
 			m->m_len = bptr - m->m_data; /* Adjust length */
-                        m->m_len += snprintf(bptr, m->m_hdr.mh_size,
+                        m->m_len += snprintf(bptr, m->m_size,
                                              "DCC MOVE %s %lu %u %u%c\n", buff,
                                              (unsigned long)ntohl(so->so_faddr.s_addr),
                                              ntohs(so->so_fport), n1, 1);
commit 43be1343667ae03cfb0c9ea4d56575c61b5c8d92
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Mon Jul 15 15:17:40 2013 +0200

    linux-user: declare sys_futex to have 6 arguments
    
    sys_futex has 6 arguments, and all of these need to be copied. Fix incorrect
    declaration in the mips_syscall_args array.
    
    This change fixes the cases where the 5th and 6th arguments have non-zero
    value and have importance. An example is a Linux implementation of
    pthread_cond_wait() function.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/linux-user/main.c b/linux-user/main.c
index 7f15d3d..99c3b3f 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -2028,7 +2028,7 @@ static const uint8_t mips_syscall_args[] = {
 	MIPS_SYS(sys_fremovexattr, 2)	/* 4235 */
 	MIPS_SYS(sys_tkill	, 2)
 	MIPS_SYS(sys_sendfile64	, 5)
-	MIPS_SYS(sys_futex	, 2)
+	MIPS_SYS(sys_futex	, 6)
 	MIPS_SYS(sys_sched_setaffinity, 3)
 	MIPS_SYS(sys_sched_getaffinity, 3)	/* 4240 */
 	MIPS_SYS(sys_io_setup	, 2)
commit a23fdf355969d331f60593fa5b857d43aec25aac
Author: Peter Lieven <pl at kamp.de>
Date:   Mon Jul 15 12:49:34 2013 +0200

    block/raw: add .bdrv_get_info
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/raw.c b/block/raw.c
index 8c81de9..f1682d4 100644
--- a/block/raw.c
+++ b/block/raw.c
@@ -121,6 +121,11 @@ static int raw_has_zero_init(BlockDriverState *bs)
     return bdrv_has_zero_init(bs->file);
 }
 
+static int raw_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
+{
+    return bdrv_get_info(bs->file, bdi);
+}
+
 static BlockDriver bdrv_raw = {
     .format_name        = "raw",
 
@@ -140,6 +145,7 @@ static BlockDriver bdrv_raw = {
 
     .bdrv_probe         = raw_probe,
     .bdrv_getlength     = raw_getlength,
+    .bdrv_get_info      = raw_get_info,
     .bdrv_truncate      = raw_truncate,
 
     .bdrv_is_inserted   = raw_is_inserted,
commit 4e7395e84fc7534f6a6c6f3d5563e770501dbe2e
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 18 10:37:32 2013 +0200

    block: fix bdrv_read_unthrottled()
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index b05e2d6..6cd39fa 100644
--- a/block.c
+++ b/block.c
@@ -2255,7 +2255,7 @@ int bdrv_read_unthrottled(BlockDriverState *bs, int64_t sector_num,
 
     enabled = bs->io_limits_enabled;
     bs->io_limits_enabled = false;
-    ret = bdrv_read(bs, 0, buf, 1);
+    ret = bdrv_read(bs, sector_num, buf, nb_sectors);
     bs->io_limits_enabled = enabled;
     return ret;
 }
commit 594a45ce64dbef1829996403506a1154eb2fd1cc
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Thu Jul 18 14:52:19 2013 +0200

    cpus: Let vm_stop[_force_state]() always flush block devices
    
    Even if the VM is already stopped, we cannot assume that all data has
    already been successfully flushed to disk. The flush during the previous
    vm_stop() could have failed.
    
    Run bdrv_flush_all() unconditionally so that we get an error each time
    if the block device isn't really flushed.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/cpus.c b/cpus.c
index 8062cdd..2509eb5 100644
--- a/cpus.c
+++ b/cpus.c
@@ -443,11 +443,12 @@ static int do_vm_stop(RunState state)
         pause_all_vcpus();
         runstate_set(state);
         vm_state_notify(0, state);
-        bdrv_drain_all();
-        ret = bdrv_flush_all();
         monitor_protocol_event(QEVENT_STOP, NULL);
     }
 
+    bdrv_drain_all();
+    ret = bdrv_flush_all();
+
     return ret;
 }
 
@@ -1126,7 +1127,9 @@ int vm_stop_force_state(RunState state)
         return vm_stop(state);
     } else {
         runstate_set(state);
-        return 0;
+        /* Make sure to return an error if the flush in a previous vm_stop()
+         * failed. */
+        return bdrv_flush_all();
     }
 }
 
commit 323004a39d4d8d33c744a5b108f80bfe6402fca3
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 18 09:48:50 2013 +0200

    block-migration: efficiently encode zero blocks
    
    this patch adds a efficient encoding for zero blocks by
    adding a new flag indicating a block is completely zero.
    
    additionally bdrv_write_zeros() is used at the destination
    to efficiently write these zeroes. depending on the implementation
    this avoids that the destination target gets fully provisioned.
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block-migration.c b/block-migration.c
index 2fd7699..f803f20 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -29,6 +29,7 @@
 #define BLK_MIG_FLAG_DEVICE_BLOCK       0x01
 #define BLK_MIG_FLAG_EOS                0x02
 #define BLK_MIG_FLAG_PROGRESS           0x04
+#define BLK_MIG_FLAG_ZERO_BLOCK         0x08
 
 #define MAX_IS_ALLOCATED_SEARCH 65536
 
@@ -80,6 +81,7 @@ typedef struct BlkMigState {
     int shared_base;
     QSIMPLEQ_HEAD(bmds_list, BlkMigDevState) bmds_list;
     int64_t total_sector_sum;
+    bool zero_blocks;
 
     /* Protected by lock.  */
     QSIMPLEQ_HEAD(blk_list, BlkMigBlock) blk_list;
@@ -114,16 +116,30 @@ static void blk_mig_unlock(void)
 static void blk_send(QEMUFile *f, BlkMigBlock * blk)
 {
     int len;
+    uint64_t flags = BLK_MIG_FLAG_DEVICE_BLOCK;
+
+    if (block_mig_state.zero_blocks &&
+        buffer_is_zero(blk->buf, BLOCK_SIZE)) {
+        flags |= BLK_MIG_FLAG_ZERO_BLOCK;
+    }
 
     /* sector number and flags */
     qemu_put_be64(f, (blk->sector << BDRV_SECTOR_BITS)
-                     | BLK_MIG_FLAG_DEVICE_BLOCK);
+                     | flags);
 
     /* device name */
     len = strlen(blk->bmds->bs->device_name);
     qemu_put_byte(f, len);
     qemu_put_buffer(f, (uint8_t *)blk->bmds->bs->device_name, len);
 
+    /* if a block is zero we need to flush here since the network
+     * bandwidth is now a lot higher than the storage device bandwidth.
+     * thus if we queue zero blocks we slow down the migration */
+    if (flags & BLK_MIG_FLAG_ZERO_BLOCK) {
+        qemu_fflush(f);
+        return;
+    }
+
     qemu_put_buffer(f, blk->buf, BLOCK_SIZE);
 }
 
@@ -344,6 +360,7 @@ static void init_blk_migration(QEMUFile *f)
     block_mig_state.total_sector_sum = 0;
     block_mig_state.prev_progress = -1;
     block_mig_state.bulk_completed = 0;
+    block_mig_state.zero_blocks = migrate_zero_blocks();
 
     bdrv_iterate(init_blk_migration_it, NULL);
 }
@@ -762,12 +779,15 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                 nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
             }
 
-            buf = g_malloc(BLOCK_SIZE);
-
-            qemu_get_buffer(f, buf, BLOCK_SIZE);
-            ret = bdrv_write(bs, addr, buf, nr_sectors);
+            if (flags & BLK_MIG_FLAG_ZERO_BLOCK) {
+                ret = bdrv_write_zeroes(bs, addr, nr_sectors);
+            } else {
+                buf = g_malloc(BLOCK_SIZE);
+                qemu_get_buffer(f, buf, BLOCK_SIZE);
+                ret = bdrv_write(bs, addr, buf, nr_sectors);
+                g_free(buf);
+            }
 
-            g_free(buf);
             if (ret < 0) {
                 return ret;
             }
diff --git a/include/migration/migration.h b/include/migration/migration.h
index bc9fde0..701709a 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -124,6 +124,7 @@ void migrate_add_blocker(Error *reason);
 void migrate_del_blocker(Error *reason);
 
 bool migrate_rdma_pin_all(void);
+bool migrate_zero_blocks(void);
 
 bool migrate_auto_converge(void);
 
diff --git a/migration.c b/migration.c
index 9f5a423..a9c0421 100644
--- a/migration.c
+++ b/migration.c
@@ -493,6 +493,15 @@ bool migrate_auto_converge(void)
     return s->enabled_capabilities[MIGRATION_CAPABILITY_AUTO_CONVERGE];
 }
 
+bool migrate_zero_blocks(void)
+{
+    MigrationState *s;
+
+    s = migrate_get_current();
+
+    return s->enabled_capabilities[MIGRATION_CAPABILITY_ZERO_BLOCKS];
+}
+
 int migrate_use_xbzrle(void)
 {
     MigrationState *s;
diff --git a/qapi-schema.json b/qapi-schema.json
index 8d33d52..592bb9c 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -613,10 +613,16 @@
 #          Disabled by default. Experimental: may (or may not) be renamed after
 #          further testing is complete. (since 1.6)
 #
+# @zero-blocks: During storage migration encode blocks of zeroes efficiently. This
+#          essentially saves 1MB of zeroes per block on the wire. Enabling requires
+#          source and target VM to support this feature. To enable it is sufficient
+#          to enable the capability on the source VM. The feature is disabled by
+#          default. (since 1.6)
+#
 # Since: 1.2
 ##
 { 'enum': 'MigrationCapability',
-  'data': ['xbzrle', 'x-rdma-pin-all', 'auto-converge'] }
+  'data': ['xbzrle', 'x-rdma-pin-all', 'auto-converge', 'zero-blocks'] }
 
 ##
 # @MigrationCapabilityStatus
commit 8bf9344ad6883e6d85b69bab36d9d76e4257e9ed
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 11 14:16:23 2013 +0200

    block/raw: add bdrv_co_write_zeroes
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/raw.c b/block/raw.c
index ce10422..8c81de9 100644
--- a/block/raw.c
+++ b/block/raw.c
@@ -42,6 +42,13 @@ static int coroutine_fn raw_co_is_allocated(BlockDriverState *bs,
     return bdrv_co_is_allocated(bs->file, sector_num, nb_sectors, pnum);
 }
 
+static int coroutine_fn raw_co_write_zeroes(BlockDriverState *bs,
+                                            int64_t sector_num,
+                                            int nb_sectors)
+{
+    return bdrv_co_write_zeroes(bs->file, sector_num, nb_sectors);
+}
+
 static int64_t raw_getlength(BlockDriverState *bs)
 {
     return bdrv_getlength(bs->file);
@@ -128,6 +135,7 @@ static BlockDriver bdrv_raw = {
     .bdrv_co_readv          = raw_co_readv,
     .bdrv_co_writev         = raw_co_writev,
     .bdrv_co_is_allocated   = raw_co_is_allocated,
+    .bdrv_co_write_zeroes   = raw_co_write_zeroes,
     .bdrv_co_discard        = raw_co_discard,
 
     .bdrv_probe         = raw_probe,
commit 4105eaaab9376ea959de711b81bba9e1494c971d
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 11 14:16:22 2013 +0200

    block: add bdrv_write_zeroes()
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index b560241..b05e2d6 100644
--- a/block.c
+++ b/block.c
@@ -2162,6 +2162,7 @@ typedef struct RwCo {
     QEMUIOVector *qiov;
     bool is_write;
     int ret;
+    BdrvRequestFlags flags;
 } RwCo;
 
 static void coroutine_fn bdrv_rw_co_entry(void *opaque)
@@ -2170,10 +2171,12 @@ static void coroutine_fn bdrv_rw_co_entry(void *opaque)
 
     if (!rwco->is_write) {
         rwco->ret = bdrv_co_do_readv(rwco->bs, rwco->sector_num,
-                                     rwco->nb_sectors, rwco->qiov, 0);
+                                     rwco->nb_sectors, rwco->qiov,
+                                     rwco->flags);
     } else {
         rwco->ret = bdrv_co_do_writev(rwco->bs, rwco->sector_num,
-                                      rwco->nb_sectors, rwco->qiov, 0);
+                                      rwco->nb_sectors, rwco->qiov,
+                                      rwco->flags);
     }
 }
 
@@ -2181,7 +2184,8 @@ static void coroutine_fn bdrv_rw_co_entry(void *opaque)
  * Process a vectored synchronous request using coroutines
  */
 static int bdrv_rwv_co(BlockDriverState *bs, int64_t sector_num,
-                       QEMUIOVector *qiov, bool is_write)
+                       QEMUIOVector *qiov, bool is_write,
+                       BdrvRequestFlags flags)
 {
     Coroutine *co;
     RwCo rwco = {
@@ -2191,6 +2195,7 @@ static int bdrv_rwv_co(BlockDriverState *bs, int64_t sector_num,
         .qiov = qiov,
         .is_write = is_write,
         .ret = NOT_DONE,
+        .flags = flags,
     };
     assert((qiov->size & (BDRV_SECTOR_SIZE - 1)) == 0);
 
@@ -2222,7 +2227,7 @@ static int bdrv_rwv_co(BlockDriverState *bs, int64_t sector_num,
  * Process a synchronous request using coroutines
  */
 static int bdrv_rw_co(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
-                      int nb_sectors, bool is_write)
+                      int nb_sectors, bool is_write, BdrvRequestFlags flags)
 {
     QEMUIOVector qiov;
     struct iovec iov = {
@@ -2231,14 +2236,14 @@ static int bdrv_rw_co(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
     };
 
     qemu_iovec_init_external(&qiov, &iov, 1);
-    return bdrv_rwv_co(bs, sector_num, &qiov, is_write);
+    return bdrv_rwv_co(bs, sector_num, &qiov, is_write, flags);
 }
 
 /* return < 0 if error. See bdrv_write() for the return codes */
 int bdrv_read(BlockDriverState *bs, int64_t sector_num,
               uint8_t *buf, int nb_sectors)
 {
-    return bdrv_rw_co(bs, sector_num, buf, nb_sectors, false);
+    return bdrv_rw_co(bs, sector_num, buf, nb_sectors, false, 0);
 }
 
 /* Just like bdrv_read(), but with I/O throttling temporarily disabled */
@@ -2264,12 +2269,18 @@ int bdrv_read_unthrottled(BlockDriverState *bs, int64_t sector_num,
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
                const uint8_t *buf, int nb_sectors)
 {
-    return bdrv_rw_co(bs, sector_num, (uint8_t *)buf, nb_sectors, true);
+    return bdrv_rw_co(bs, sector_num, (uint8_t *)buf, nb_sectors, true, 0);
 }
 
 int bdrv_writev(BlockDriverState *bs, int64_t sector_num, QEMUIOVector *qiov)
 {
-    return bdrv_rwv_co(bs, sector_num, qiov, true);
+    return bdrv_rwv_co(bs, sector_num, qiov, true, 0);
+}
+
+int bdrv_write_zeroes(BlockDriverState *bs, int64_t sector_num, int nb_sectors)
+{
+    return bdrv_rw_co(bs, sector_num, NULL, nb_sectors, true,
+                      BDRV_REQ_ZERO_WRITE);
 }
 
 int bdrv_pread(BlockDriverState *bs, int64_t offset,
diff --git a/include/block/block.h b/include/block/block.h
index b6b9014..742fce5 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -157,6 +157,8 @@ int bdrv_read_unthrottled(BlockDriverState *bs, int64_t sector_num,
                           uint8_t *buf, int nb_sectors);
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
                const uint8_t *buf, int nb_sectors);
+int bdrv_write_zeroes(BlockDriverState *bs, int64_t sector_num,
+               int nb_sectors);
 int bdrv_writev(BlockDriverState *bs, int64_t sector_num, QEMUIOVector *qiov);
 int bdrv_pread(BlockDriverState *bs, int64_t offset,
                void *buf, int count);
commit 78f27bd02ceba4a2f6ac5c725f4d4410eec205ef
Author: Fam Zheng <famz at redhat.com>
Date:   Wed Jul 17 17:57:37 2013 +0800

    block: fix vvfat error path for enable_write_target
    
    s->qcow and s->qcow_filename are allocated but not freed on error. Fix the
    possible leaks, remove unnecessary check for bdrv_new(), propagate ret code of
    bdrv_create() and also the one of enable_write_target().
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vvfat.c b/block/vvfat.c
index 87b0279..cd3b8ed 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -1164,8 +1164,8 @@ DLOG(if (stderr == NULL) {
     s->sector_count = cyls * heads * secs - (s->first_sectors_number - 1);
 
     if (qemu_opt_get_bool(opts, "rw", false)) {
-        if (enable_write_target(s)) {
-            ret = -EIO;
+        ret = enable_write_target(s);
+        if (ret < 0) {
             goto fail;
         }
         bs->read_only = 0;
@@ -2917,9 +2917,7 @@ static int enable_write_target(BDRVVVFATState *s)
     s->qcow_filename = g_malloc(1024);
     ret = get_tmp_filename(s->qcow_filename, 1024);
     if (ret < 0) {
-        g_free(s->qcow_filename);
-        s->qcow_filename = NULL;
-        return ret;
+        goto err;
     }
 
     bdrv_qcow = bdrv_find_format("qcow");
@@ -2927,18 +2925,18 @@ static int enable_write_target(BDRVVVFATState *s)
     set_option_parameter_int(options, BLOCK_OPT_SIZE, s->sector_count * 512);
     set_option_parameter(options, BLOCK_OPT_BACKING_FILE, "fat:");
 
-    if (bdrv_create(bdrv_qcow, s->qcow_filename, options) < 0)
-	return -1;
+    ret = bdrv_create(bdrv_qcow, s->qcow_filename, options);
+    if (ret < 0) {
+        goto err;
+    }
 
     s->qcow = bdrv_new("");
-    if (s->qcow == NULL) {
-        return -1;
-    }
 
     ret = bdrv_open(s->qcow, s->qcow_filename, NULL,
             BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH, bdrv_qcow);
     if (ret < 0) {
-	return ret;
+        bdrv_delete(s->qcow);
+        goto err;
     }
 
 #ifndef _WIN32
@@ -2951,6 +2949,11 @@ static int enable_write_target(BDRVVVFATState *s)
     *(void**)s->bs->backing_hd->opaque = s;
 
     return 0;
+
+err:
+    g_free(s->qcow_filename);
+    s->qcow_filename = NULL;
+    return ret;
 }
 
 static void vvfat_close(BlockDriverState *bs)
commit dcc772e2f2b7c2a68644133fea2b874f6751a57b
Author: Liu Ping Fan <qemulist at gmail.com>
Date:   Tue Jul 16 12:28:58 2013 +0800

    QEMUBH: make AioContext's bh re-entrant
    
    BH will be used outside big lock, so introduce lock to protect
    between the writers, ie, bh's adders and deleter. The lock only
    affects the writers and bh's callback does not take this extra lock.
    Note that for the same AioContext, aio_bh_poll() can not run in
    parallel yet.
    
    Signed-off-by: Liu Ping Fan <pingfank at linux.vnet.ibm.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/async.c b/async.c
index 90fe906..5ce3633 100644
--- a/async.c
+++ b/async.c
@@ -47,11 +47,16 @@ QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque)
     bh->ctx = ctx;
     bh->cb = cb;
     bh->opaque = opaque;
+    qemu_mutex_lock(&ctx->bh_lock);
     bh->next = ctx->first_bh;
+    /* Make sure that the members are ready before putting bh into list */
+    smp_wmb();
     ctx->first_bh = bh;
+    qemu_mutex_unlock(&ctx->bh_lock);
     return bh;
 }
 
+/* Multiple occurrences of aio_bh_poll cannot be called concurrently */
 int aio_bh_poll(AioContext *ctx)
 {
     QEMUBH *bh, **bhp, *next;
@@ -61,9 +66,15 @@ int aio_bh_poll(AioContext *ctx)
 
     ret = 0;
     for (bh = ctx->first_bh; bh; bh = next) {
+        /* Make sure that fetching bh happens before accessing its members */
+        smp_read_barrier_depends();
         next = bh->next;
         if (!bh->deleted && bh->scheduled) {
             bh->scheduled = 0;
+            /* Paired with write barrier in bh schedule to ensure reading for
+             * idle & callbacks coming after bh's scheduling.
+             */
+            smp_rmb();
             if (!bh->idle)
                 ret = 1;
             bh->idle = 0;
@@ -75,6 +86,7 @@ int aio_bh_poll(AioContext *ctx)
 
     /* remove deleted bhs */
     if (!ctx->walking_bh) {
+        qemu_mutex_lock(&ctx->bh_lock);
         bhp = &ctx->first_bh;
         while (*bhp) {
             bh = *bhp;
@@ -85,6 +97,7 @@ int aio_bh_poll(AioContext *ctx)
                 bhp = &bh->next;
             }
         }
+        qemu_mutex_unlock(&ctx->bh_lock);
     }
 
     return ret;
@@ -94,24 +107,38 @@ void qemu_bh_schedule_idle(QEMUBH *bh)
 {
     if (bh->scheduled)
         return;
-    bh->scheduled = 1;
     bh->idle = 1;
+    /* Make sure that idle & any writes needed by the callback are done
+     * before the locations are read in the aio_bh_poll.
+     */
+    smp_wmb();
+    bh->scheduled = 1;
 }
 
 void qemu_bh_schedule(QEMUBH *bh)
 {
     if (bh->scheduled)
         return;
-    bh->scheduled = 1;
     bh->idle = 0;
+    /* Make sure that idle & any writes needed by the callback are done
+     * before the locations are read in the aio_bh_poll.
+     */
+    smp_wmb();
+    bh->scheduled = 1;
     aio_notify(bh->ctx);
 }
 
+
+/* This func is async.
+ */
 void qemu_bh_cancel(QEMUBH *bh)
 {
     bh->scheduled = 0;
 }
 
+/* This func is async.The bottom half will do the delete action at the finial
+ * end.
+ */
 void qemu_bh_delete(QEMUBH *bh)
 {
     bh->scheduled = 0;
@@ -176,6 +203,7 @@ aio_ctx_finalize(GSource     *source)
     thread_pool_free(ctx->thread_pool);
     aio_set_event_notifier(ctx, &ctx->notifier, NULL, NULL);
     event_notifier_cleanup(&ctx->notifier);
+    qemu_mutex_destroy(&ctx->bh_lock);
     g_array_free(ctx->pollfds, TRUE);
 }
 
@@ -211,6 +239,7 @@ AioContext *aio_context_new(void)
     ctx = (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext));
     ctx->pollfds = g_array_new(FALSE, FALSE, sizeof(GPollFD));
     ctx->thread_pool = NULL;
+    qemu_mutex_init(&ctx->bh_lock);
     event_notifier_init(&ctx->notifier, false);
     aio_set_event_notifier(ctx, &ctx->notifier, 
                            (EventNotifierHandler *)
diff --git a/include/block/aio.h b/include/block/aio.h
index 1836793..cc77771 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -17,6 +17,7 @@
 #include "qemu-common.h"
 #include "qemu/queue.h"
 #include "qemu/event_notifier.h"
+#include "qemu/thread.h"
 
 typedef struct BlockDriverAIOCB BlockDriverAIOCB;
 typedef void BlockDriverCompletionFunc(void *opaque, int ret);
@@ -53,6 +54,8 @@ typedef struct AioContext {
      */
     int walking_handlers;
 
+    /* lock to protect between bh's adders and deleter */
+    QemuMutex bh_lock;
     /* Anchor of the list of Bottom Halves belonging to the context */
     struct QEMUBH *first_bh;
 
@@ -127,6 +130,8 @@ void aio_notify(AioContext *ctx);
  * aio_bh_poll: Poll bottom halves for an AioContext.
  *
  * These are internal functions used by the QEMU main loop.
+ * And notice that multiple occurrences of aio_bh_poll cannot
+ * be called concurrently
  */
 int aio_bh_poll(AioContext *ctx);
 
@@ -163,6 +168,8 @@ void qemu_bh_cancel(QEMUBH *bh);
  * Deleting a bottom half frees the memory that was allocated for it by
  * qemu_bh_new.  It also implies canceling the bottom half if it was
  * scheduled.
+ * This func is async. The bottom half will do the delete action at the finial
+ * end.
  *
  * @bh: The bottom half to be deleted.
  */
commit 9154b02c53bb6685797c973fcdbec51c4714777d
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 1 13:29:17 2013 +0200

    dataplane: sync virtio.c and vring.c virtqueue state
    
    Load the virtio.c state into vring.c when we start dataplane mode and
    vice versa when stopping dataplane mode.  This patch makes it possible
    to start and stop dataplane any time while the guest is running.
    
    This will eventually allow us to go back to QEMU main loop for
    bdrv_drain_all() and live migration.  In the meantime, this patch makes
    the dataplane lifecycle more robust but should make no visible
    difference.  It may be useful in the virtio-net dataplane effort.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 0356665..2faed43 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -537,7 +537,7 @@ void virtio_blk_data_plane_stop(VirtIOBlockDataPlane *s)
     /* Clean up guest notifier (irq) */
     k->set_guest_notifiers(qbus->parent, 1, false);
 
-    vring_teardown(&s->vring);
+    vring_teardown(&s->vring, s->vdev, 0);
     s->started = false;
     s->stopping = false;
 }
diff --git a/hw/virtio/dataplane/vring.c b/hw/virtio/dataplane/vring.c
index e0d6e83..82cc151 100644
--- a/hw/virtio/dataplane/vring.c
+++ b/hw/virtio/dataplane/vring.c
@@ -39,8 +39,8 @@ bool vring_setup(Vring *vring, VirtIODevice *vdev, int n)
 
     vring_init(&vring->vr, virtio_queue_get_num(vdev, n), vring_ptr, 4096);
 
-    vring->last_avail_idx = 0;
-    vring->last_used_idx = 0;
+    vring->last_avail_idx = virtio_queue_get_last_avail_idx(vdev, n);
+    vring->last_used_idx = vring->vr.used->idx;
     vring->signalled_used = 0;
     vring->signalled_used_valid = false;
 
@@ -49,8 +49,10 @@ bool vring_setup(Vring *vring, VirtIODevice *vdev, int n)
     return true;
 }
 
-void vring_teardown(Vring *vring)
+void vring_teardown(Vring *vring, VirtIODevice *vdev, int n)
 {
+    virtio_queue_set_last_avail_idx(vdev, n, vring->last_avail_idx);
+
     hostmem_finalize(&vring->hostmem);
 }
 
diff --git a/include/hw/virtio/dataplane/vring.h b/include/hw/virtio/dataplane/vring.h
index 9380cb5..c0b69ff 100644
--- a/include/hw/virtio/dataplane/vring.h
+++ b/include/hw/virtio/dataplane/vring.h
@@ -50,7 +50,7 @@ static inline void vring_set_broken(Vring *vring)
 }
 
 bool vring_setup(Vring *vring, VirtIODevice *vdev, int n);
-void vring_teardown(Vring *vring);
+void vring_teardown(Vring *vring, VirtIODevice *vdev, int n);
 void vring_disable_notification(VirtIODevice *vdev, Vring *vring);
 bool vring_enable_notification(VirtIODevice *vdev, Vring *vring);
 bool vring_should_notify(VirtIODevice *vdev, Vring *vring);
commit 0c14fb47ece5ef42d7a0a4b3e8e43e022b375720
Author: Bharata B Rao <bharata at linux.vnet.ibm.com>
Date:   Tue Jul 16 21:47:42 2013 +0530

    gluster: Add discard support for GlusterFS block driver.
    
    Implement bdrv_aio_discard for gluster.
    
    Signed-off-by: Bharata B Rao <bharata at linux.vnet.ibm.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/gluster.c b/block/gluster.c
index 61424bc..6de418c 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -532,6 +532,39 @@ out:
     return NULL;
 }
 
+#ifdef CONFIG_GLUSTERFS_DISCARD
+static BlockDriverAIOCB *qemu_gluster_aio_discard(BlockDriverState *bs,
+        int64_t sector_num, int nb_sectors, BlockDriverCompletionFunc *cb,
+        void *opaque)
+{
+    int ret;
+    GlusterAIOCB *acb;
+    BDRVGlusterState *s = bs->opaque;
+    size_t size;
+    off_t offset;
+
+    offset = sector_num * BDRV_SECTOR_SIZE;
+    size = nb_sectors * BDRV_SECTOR_SIZE;
+
+    acb = qemu_aio_get(&gluster_aiocb_info, bs, cb, opaque);
+    acb->size = 0;
+    acb->ret = 0;
+    acb->finished = NULL;
+    s->qemu_aio_count++;
+
+    ret = glfs_discard_async(s->fd, offset, size, &gluster_finish_aiocb, acb);
+    if (ret < 0) {
+        goto out;
+    }
+    return &acb->common;
+
+out:
+    s->qemu_aio_count--;
+    qemu_aio_release(acb);
+    return NULL;
+}
+#endif
+
 static int64_t qemu_gluster_getlength(BlockDriverState *bs)
 {
     BDRVGlusterState *s = bs->opaque;
@@ -602,6 +635,9 @@ static BlockDriver bdrv_gluster = {
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
     .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
+#ifdef CONFIG_GLUSTERFS_DISCARD
+    .bdrv_aio_discard             = qemu_gluster_aio_discard,
+#endif
     .create_options               = qemu_gluster_create_options,
 };
 
@@ -618,6 +654,9 @@ static BlockDriver bdrv_gluster_tcp = {
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
     .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
+#ifdef CONFIG_GLUSTERFS_DISCARD
+    .bdrv_aio_discard             = qemu_gluster_aio_discard,
+#endif
     .create_options               = qemu_gluster_create_options,
 };
 
@@ -634,6 +673,9 @@ static BlockDriver bdrv_gluster_unix = {
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
     .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
+#ifdef CONFIG_GLUSTERFS_DISCARD
+    .bdrv_aio_discard             = qemu_gluster_aio_discard,
+#endif
     .create_options               = qemu_gluster_create_options,
 };
 
@@ -650,6 +692,9 @@ static BlockDriver bdrv_gluster_rdma = {
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
     .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
+#ifdef CONFIG_GLUSTERFS_DISCARD
+    .bdrv_aio_discard             = qemu_gluster_aio_discard,
+#endif
     .create_options               = qemu_gluster_create_options,
 };
 
diff --git a/configure b/configure
index cf13493..7c45db2 100755
--- a/configure
+++ b/configure
@@ -237,6 +237,7 @@ libiscsi=""
 coroutine=""
 seccomp=""
 glusterfs=""
+glusterfs_discard="no"
 virtio_blk_data_plane=""
 gtk=""
 gtkabi="2.0"
@@ -2577,6 +2578,9 @@ if test "$glusterfs" != "no" ; then
     CFLAGS="$CFLAGS $glusterfs_cflags"
     libs_tools="$glusterfs_libs $libs_tools"
     libs_softmmu="$glusterfs_libs $libs_softmmu"
+    if $pkg_config --atleast-version=5 glusterfs-api >/dev/null 2>&1; then
+      glusterfs_discard="yes"
+    fi
   else
     if test "$glusterfs" = "yes" ; then
       feature_not_found "GlusterFS backend support"
@@ -3964,6 +3968,10 @@ if test "$glusterfs" = "yes" ; then
   echo "CONFIG_GLUSTERFS=y" >> $config_host_mak
 fi
 
+if test "$glusterfs_discard" = "yes" ; then
+  echo "CONFIG_GLUSTERFS_DISCARD=y" >> $config_host_mak
+fi
+
 if test "$libssh2" = "yes" ; then
   echo "CONFIG_LIBSSH2=y" >> $config_host_mak
 fi
commit e01bee0881e0f0c8a79555f6729d7238841a5b04
Author: Bharata B Rao <bharata at linux.vnet.ibm.com>
Date:   Tue Jul 16 21:47:41 2013 +0530

    gluster: Use pkg-config to configure GlusterFS block driver
    
    Use pkg-config to determine the version and library dependency
    for GlusterFS block driver.
    
    Signed-off-by: Bharata B Rao <bharata at linux.vnet.ibm.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/configure b/configure
index 9e1cd19..cf13493 100755
--- a/configure
+++ b/configure
@@ -2570,23 +2570,18 @@ fi
 ##########################################
 # glusterfs probe
 if test "$glusterfs" != "no" ; then
-  cat > $TMPC <<EOF
-#include <glusterfs/api/glfs.h>
-int main(void) {
-    (void) glfs_new("volume");
-    return 0;
-}
-EOF
-  glusterfs_libs="-lgfapi -lgfrpc -lgfxdr"
-  if compile_prog "" "$glusterfs_libs" ; then
-    glusterfs=yes
+  if $pkg_config --atleast-version=3 glusterfs-api >/dev/null 2>&1; then
+    glusterfs="yes"
+    glusterfs_cflags=`$pkg_config --cflags glusterfs-api 2>/dev/null`
+    glusterfs_libs=`$pkg_config --libs glusterfs-api 2>/dev/null`
+    CFLAGS="$CFLAGS $glusterfs_cflags"
     libs_tools="$glusterfs_libs $libs_tools"
     libs_softmmu="$glusterfs_libs $libs_softmmu"
   else
     if test "$glusterfs" = "yes" ; then
       feature_not_found "GlusterFS backend support"
     fi
-    glusterfs=no
+    glusterfs="no"
   fi
 fi
 
commit 24943978cbe79634a9a8b02a20efb25b29b3ab49
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:23 2013 +0200

    boot-order-test: Add tests for Sun4u
    
    Cc: Blue Swirl <blauwirbel at gmail.com>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-13-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index a3928ed..4b233d0 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -173,6 +173,18 @@ static void test_sun4m_boot_order(void)
     test_boot_orders("SS-5", read_boot_order_sun4m, test_cases_fw_cfg);
 }
 
+static uint64_t read_boot_order_sun4u(void)
+{
+    QFWCFG *fw_cfg = io_fw_cfg_init(0x510);
+
+    return qfw_cfg_get_u16(fw_cfg, FW_CFG_BOOT_DEVICE);
+}
+
+static void test_sun4u_boot_order(void)
+{
+    test_boot_orders("sun4u", read_boot_order_sun4u, test_cases_fw_cfg);
+}
+
 int main(int argc, char *argv[])
 {
     const char *arch = qtest_get_arch();
@@ -189,6 +201,8 @@ int main(int argc, char *argv[])
                        test_pmac_newworld_boot_order);
     } else if (strcmp(arch, "sparc") == 0) {
         qtest_add_func("boot-order/sun4m", test_sun4m_boot_order);
+    } else if (strcmp(arch, "sparc64") == 0) {
+        qtest_add_func("boot-order/sun4u", test_sun4u_boot_order);
     }
 
     return g_test_run();
commit 26491a388ce69d80c6d7d2b15ddf93d4399f04bc
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:22 2013 +0200

    libqos: Generalize I/O-mapped fw_cfg
    
    Provide a constructor that takes the base address in addition to the
    PC-specific one.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-12-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/Makefile b/tests/Makefile
index c570da0..425a9a8 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -128,7 +128,7 @@ tests/test-mul64$(EXESUF): tests/test-mul64.o libqemuutil.a
 
 libqos-obj-y = tests/libqos/pci.o tests/libqos/fw_cfg.o
 libqos-obj-y += tests/libqos/i2c.o
-libqos-pc-obj-y = $(libqos-obj-y) tests/libqos/pci-pc.o tests/libqos/fw_cfg-pc.o
+libqos-pc-obj-y = $(libqos-obj-y) tests/libqos/pci-pc.o
 libqos-pc-obj-y += tests/libqos/malloc-pc.o
 libqos-omap-obj-y = $(libqos-obj-y) tests/libqos/i2c-omap.o
 
diff --git a/tests/fw_cfg-test.c b/tests/fw_cfg-test.c
index c284c4d..b86e49a 100644
--- a/tests/fw_cfg-test.c
+++ b/tests/fw_cfg-test.c
@@ -14,7 +14,7 @@
 
 #include "libqtest.h"
 #include "hw/nvram/fw_cfg.h"
-#include "libqos/fw_cfg-pc.h"
+#include "libqos/fw_cfg.h"
 
 #include <string.h>
 #include <glib.h>
diff --git a/tests/libqos/fw_cfg-pc.c b/tests/libqos/fw_cfg-pc.c
deleted file mode 100644
index 613604d..0000000
--- a/tests/libqos/fw_cfg-pc.c
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * libqos fw_cfg support for PC
- *
- * Copyright IBM, Corp. 2012-2013
- *
- * Authors:
- *  Anthony Liguori   <aliguori at us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "libqos/fw_cfg-pc.h"
-#include "libqtest.h"
-#include <glib.h>
-
-static void pc_fw_cfg_select(QFWCFG *fw_cfg, uint16_t key)
-{
-    outw(0x510, key);
-}
-
-static void pc_fw_cfg_read(QFWCFG *fw_cfg, void *data, size_t len)
-{
-    uint8_t *ptr = data;
-    int i;
-
-    for (i = 0; i < len; i++) {
-        ptr[i] = inb(0x511);
-    }
-}
-
-QFWCFG *pc_fw_cfg_init(void)
-{
-    QFWCFG *fw_cfg = g_malloc0(sizeof(*fw_cfg));
-
-    fw_cfg->select = pc_fw_cfg_select;
-    fw_cfg->read = pc_fw_cfg_read;
-
-    return fw_cfg;
-}
diff --git a/tests/libqos/fw_cfg-pc.h b/tests/libqos/fw_cfg-pc.h
deleted file mode 100644
index 444bd79..0000000
--- a/tests/libqos/fw_cfg-pc.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * libqos fw_cfg support for PC
- *
- * Copyright IBM, Corp. 2012-2013
- *
- * Authors:
- *  Anthony Liguori   <aliguori at us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#ifndef LIBQOS_FW_CFG_PC_H
-#define LIBQOS_FW_CFG_PC_H
-
-#include "libqos/fw_cfg.h"
-
-QFWCFG *pc_fw_cfg_init(void);
-
-#endif
diff --git a/tests/libqos/fw_cfg.c b/tests/libqos/fw_cfg.c
index 49d1683..ef00fed 100644
--- a/tests/libqos/fw_cfg.c
+++ b/tests/libqos/fw_cfg.c
@@ -79,3 +79,29 @@ QFWCFG *mm_fw_cfg_init(uint64_t base)
 
     return fw_cfg;
 }
+
+static void io_fw_cfg_select(QFWCFG *fw_cfg, uint16_t key)
+{
+    outw(fw_cfg->base, key);
+}
+
+static void io_fw_cfg_read(QFWCFG *fw_cfg, void *data, size_t len)
+{
+    uint8_t *ptr = data;
+    int i;
+
+    for (i = 0; i < len; i++) {
+        ptr[i] = inb(fw_cfg->base + 1);
+    }
+}
+
+QFWCFG *io_fw_cfg_init(uint16_t base)
+{
+    QFWCFG *fw_cfg = g_malloc0(sizeof(*fw_cfg));
+
+    fw_cfg->base = base;
+    fw_cfg->select = io_fw_cfg_select;
+    fw_cfg->read = io_fw_cfg_read;
+
+    return fw_cfg;
+}
diff --git a/tests/libqos/fw_cfg.h b/tests/libqos/fw_cfg.h
index 19bb053..61b1548 100644
--- a/tests/libqos/fw_cfg.h
+++ b/tests/libqos/fw_cfg.h
@@ -33,5 +33,11 @@ uint32_t qfw_cfg_get_u32(QFWCFG *fw_cfg, uint16_t key);
 uint64_t qfw_cfg_get_u64(QFWCFG *fw_cfg, uint16_t key);
 
 QFWCFG *mm_fw_cfg_init(uint64_t base);
+QFWCFG *io_fw_cfg_init(uint16_t base);
+
+static inline QFWCFG *pc_fw_cfg_init(void)
+{
+    return io_fw_cfg_init(0x510);
+}
 
 #endif
diff --git a/tests/libqos/malloc-pc.c b/tests/libqos/malloc-pc.c
index adc36c4..db1496c 100644
--- a/tests/libqos/malloc-pc.c
+++ b/tests/libqos/malloc-pc.c
@@ -11,7 +11,7 @@
  */
 
 #include "libqos/malloc-pc.h"
-#include "libqos/fw_cfg-pc.h"
+#include "libqos/fw_cfg.h"
 
 #define NO_QEMU_PROTOS
 #include "hw/nvram/fw_cfg.h"
commit f88dc7dd4d5942714672aa293a3357f5c6469568
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:21 2013 +0200

    boot-order-test: Add tests for Sun4m
    
    Cc: Blue Swirl <blauwirbel at gmail.com>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-11-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index 75b1642..a3928ed 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -161,6 +161,18 @@ static void test_pmac_newworld_boot_order(void)
     test_boot_orders("mac99", read_boot_order_pmac, test_cases_fw_cfg);
 }
 
+static uint64_t read_boot_order_sun4m(void)
+{
+    QFWCFG *fw_cfg = mm_fw_cfg_init(0xd00000510ULL);
+
+    return qfw_cfg_get_u16(fw_cfg, FW_CFG_BOOT_DEVICE);
+}
+
+static void test_sun4m_boot_order(void)
+{
+    test_boot_orders("SS-5", read_boot_order_sun4m, test_cases_fw_cfg);
+}
+
 int main(int argc, char *argv[])
 {
     const char *arch = qtest_get_arch();
@@ -175,6 +187,8 @@ int main(int argc, char *argv[])
                        test_pmac_oldworld_boot_order);
         qtest_add_func("boot-order/pmac_newworld",
                        test_pmac_newworld_boot_order);
+    } else if (strcmp(arch, "sparc") == 0) {
+        qtest_add_func("boot-order/sun4m", test_sun4m_boot_order);
     }
 
     return g_test_run();
commit e99f87cc86ba57a57d2472342a51d21f1e8b4966
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:20 2013 +0200

    boot-order-test: Add tests for PowerPC PREP
    
    Cc: Andreas Färber <afaerber at suse.de>
    Cc: Alexander Graf <agraf at suse.de>
    Cc: qemu-ppc at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-10-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index c711c71..75b1642 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -112,6 +112,30 @@ static void test_pc_boot_order(void)
     test_boot_orders(NULL, read_boot_order_pc, test_cases_pc);
 }
 
+static uint8_t read_m48t59(uint64_t addr, uint16_t reg)
+{
+    writeb(addr, reg & 0xff);
+    writeb(addr + 1, reg >> 8);
+    return readb(addr + 3);
+}
+
+static uint64_t read_boot_order_prep(void)
+{
+    return read_m48t59(0x80000000 + 0x74, 0x34);
+}
+
+static const boot_order_test test_cases_prep[] = {
+    { "", 'c', 'c' },
+    { "-boot c", 'c', 'c' },
+    { "-boot d", 'd', 'd' },
+    {}
+};
+
+static void test_prep_boot_order(void)
+{
+    test_boot_orders("prep", read_boot_order_prep, test_cases_prep);
+}
+
 static uint64_t read_boot_order_pmac(void)
 {
     QFWCFG *fw_cfg = mm_fw_cfg_init(0xf0000510);
@@ -146,6 +170,7 @@ int main(int argc, char *argv[])
     if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
         qtest_add_func("boot-order/pc", test_pc_boot_order);
     } else if (strcmp(arch, "ppc") == 0 || strcmp(arch, "ppc64") == 0) {
+        qtest_add_func("boot-order/prep", test_prep_boot_order);
         qtest_add_func("boot-order/pmac_oldworld",
                        test_pmac_oldworld_boot_order);
         qtest_add_func("boot-order/pmac_newworld",
commit 484986e24282e922e5acb1db2c2b324e55c39ea4
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:19 2013 +0200

    boot-order-test: Code motion for better readability
    
    Cc: Andreas Färber <afaerber at suse.de>
    Cc: Alexander Graf <agraf at suse.de>
    Cc: qemu-ppc at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-9-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index 78249fc..c711c71 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -15,19 +15,15 @@
 #include "libqos/fw_cfg.h"
 #include "libqtest.h"
 
-static uint8_t read_mc146818(uint16_t port, uint8_t reg)
-{
-    outb(port, reg);
-    return inb(port + 1);
-}
-
-static uint64_t read_boot_order_pc(void)
-{
-    uint8_t b1 = read_mc146818(0x70, 0x38);
-    uint8_t b2 = read_mc146818(0x70, 0x3d);
+#define NO_QEMU_PROTOS
+#include "hw/nvram/fw_cfg.h"
+#undef NO_QEMU_PROTOS
 
-    return b1 | (b2 << 8);
-}
+typedef struct {
+    const char *args;
+    uint64_t expected_boot;
+    uint64_t expected_reboot;
+} boot_order_test;
 
 static void test_a_boot_order(const char *machine,
                               const char *test_args,
@@ -57,12 +53,6 @@ static void test_a_boot_order(const char *machine,
     g_free(args);
 }
 
-typedef struct {
-    const char *args;
-    uint64_t expected_boot;
-    uint64_t expected_reboot;
-} boot_order_test;
-
 static void test_boot_orders(const char *machine,
                              uint64_t (*read_boot_order)(void),
                              const boot_order_test *tests)
@@ -77,6 +67,20 @@ static void test_boot_orders(const char *machine,
     }
 }
 
+static uint8_t read_mc146818(uint16_t port, uint8_t reg)
+{
+    outb(port, reg);
+    return inb(port + 1);
+}
+
+static uint64_t read_boot_order_pc(void)
+{
+    uint8_t b1 = read_mc146818(0x70, 0x38);
+    uint8_t b2 = read_mc146818(0x70, 0x3d);
+
+    return b1 | (b2 << 8);
+}
+
 static const boot_order_test test_cases_pc[] = {
     { "",
       0x1230, 0x1230 },
@@ -108,10 +112,6 @@ static void test_pc_boot_order(void)
     test_boot_orders(NULL, read_boot_order_pc, test_cases_pc);
 }
 
-#define NO_QEMU_PROTOS
-#include "hw/nvram/fw_cfg.h"
-#undef NO_QEMU_PROTOS
-
 static uint64_t read_boot_order_pmac(void)
 {
     QFWCFG *fw_cfg = mm_fw_cfg_init(0xf0000510);
commit aea6a16907ca377d450d344dddda8456f87d5c0b
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:18 2013 +0200

    boot-order-test: Better separate target-specific and generic parts
    
    The initial version did just PC.  I didn't bother to separate out
    generic parts, because I don't like to abstract from a single case.
    
    Now we have two cases, PC and PowerMac, and I'm about to add more.
    Time to do it right.
    
    To ease review, this commit changes the code in-place, and the next
    commit reorders it for better readability.
    
    Cc: Andreas Färber <afaerber at suse.de>
    Cc: Alexander Graf <agraf at suse.de>
    Cc: qemu-ppc at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-8-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index 1a8e22a..78249fc 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -15,95 +15,126 @@
 #include "libqos/fw_cfg.h"
 #include "libqtest.h"
 
-static void test_pc_cmos_byte(int reg, int expected)
+static uint8_t read_mc146818(uint16_t port, uint8_t reg)
 {
-    int actual;
-
-    outb(0x70, reg);
-    actual = inb(0x71);
-    g_assert_cmphex(actual, ==, expected);
+    outb(port, reg);
+    return inb(port + 1);
 }
 
-static void test_pc_cmos(uint8_t boot1, uint8_t boot2)
+static uint64_t read_boot_order_pc(void)
 {
-    test_pc_cmos_byte(0x38, boot1);
-    test_pc_cmos_byte(0x3d, boot2);
+    uint8_t b1 = read_mc146818(0x70, 0x38);
+    uint8_t b2 = read_mc146818(0x70, 0x3d);
+
+    return b1 | (b2 << 8);
 }
 
-static void test_pc_with_args(const char *test_args,
-                              uint8_t boot1, uint8_t boot2,
-                              uint8_t reboot1, uint8_t reboot2)
+static void test_a_boot_order(const char *machine,
+                              const char *test_args,
+                              uint64_t (*read_boot_order)(void),
+                              uint64_t expected_boot,
+                              uint64_t expected_reboot)
 {
-    char *args = g_strdup_printf("-nodefaults -display none %s", test_args);
+    char *args;
+    uint64_t actual;
 
+    args = g_strdup_printf("-nodefaults -display none%s%s %s",
+                           machine ? " -M " : "",
+                           machine ?: "",
+                           test_args);
     qtest_start(args);
-    test_pc_cmos(boot1, boot2);
+    actual = read_boot_order();
+    g_assert_cmphex(actual, ==, expected_boot);
     qmp("{ 'execute': 'system_reset' }");
     /*
      * system_reset only requests reset.  We get a RESET event after
      * the actual reset completes.  Need to wait for that.
      */
     qmp("");                    /* HACK: wait for event */
-    test_pc_cmos(reboot1, reboot2);
+    actual = read_boot_order();
+    g_assert_cmphex(actual, ==, expected_reboot);
     qtest_quit(global_qtest);
     g_free(args);
 }
 
-static void test_pc_boot_order(void)
+typedef struct {
+    const char *args;
+    uint64_t expected_boot;
+    uint64_t expected_reboot;
+} boot_order_test;
+
+static void test_boot_orders(const char *machine,
+                             uint64_t (*read_boot_order)(void),
+                             const boot_order_test *tests)
 {
-    test_pc_with_args("", 0x30, 0x12, 0x30, 0x12);
-    test_pc_with_args("-no-fd-bootchk", 0x31, 0x12, 0x31, 0x12);
-    test_pc_with_args("-boot c", 0, 0x02, 0, 0x02);
-    test_pc_with_args("-boot nda", 0x10, 0x34, 0x10, 0x34);
-    test_pc_with_args("-boot order=", 0, 0, 0, 0);
-    test_pc_with_args("-boot order= -boot order=c", 0, 0x02, 0, 0x02);
-    test_pc_with_args("-boot once=a", 0, 0x01, 0x30, 0x12);
-    test_pc_with_args("-boot once=a -no-fd-bootchk", 0x01, 0x01, 0x31, 0x12);
-    test_pc_with_args("-boot once=a,order=c", 0, 0x01, 0, 0x02);
-    test_pc_with_args("-boot once=d -boot order=nda", 0, 0x03, 0x10, 0x34);
-    test_pc_with_args("-boot once=a -boot once=b -boot once=c",
-                      0, 0x02, 0x30, 0x12);
+    int i;
+
+    for (i = 0; tests[i].args; i++) {
+        test_a_boot_order(machine, tests[i].args,
+                          read_boot_order,
+                          tests[i].expected_boot,
+                          tests[i].expected_reboot);
+    }
 }
 
-#define G3BEIGE_CFG_ADDR 0xf0000510
-#define MAC99_CFG_ADDR   0xf0000510
+static const boot_order_test test_cases_pc[] = {
+    { "",
+      0x1230, 0x1230 },
+    { "-no-fd-bootchk",
+      0x1231, 0x1231 },
+    { "-boot c",
+      0x0200, 0x0200 },
+    { "-boot nda",
+      0x3410, 0x3410 },
+    { "-boot order=",
+      0, 0 },
+    { "-boot order= -boot order=c",
+      0x0200, 0x0200 },
+    { "-boot once=a",
+      0x0100, 0x1230 },
+    { "-boot once=a -no-fd-bootchk",
+      0x0101, 0x1231 },
+    { "-boot once=a,order=c",
+      0x0100, 0x0200 },
+    { "-boot once=d -boot order=nda",
+      0x0300, 0x3410 },
+    { "-boot once=a -boot once=b -boot once=c",
+      0x0200, 0x1230 },
+    {}
+};
+
+static void test_pc_boot_order(void)
+{
+    test_boot_orders(NULL, read_boot_order_pc, test_cases_pc);
+}
 
 #define NO_QEMU_PROTOS
 #include "hw/nvram/fw_cfg.h"
 #undef NO_QEMU_PROTOS
 
-static void test_powermac_with_args(bool newworld, const char *extra_args,
-                                    uint16_t expected_boot,
-                                    uint16_t expected_reboot)
+static uint64_t read_boot_order_pmac(void)
 {
-    char *args = g_strdup_printf("-nodefaults -display none -machine %s %s",
-                                 newworld ? "mac99" : "g3beige", extra_args);
-    QFWCFG *fw_cfg = mm_fw_cfg_init(newworld ? MAC99_CFG_ADDR
-                                    : G3BEIGE_CFG_ADDR);
-    uint16_t actual;
+    QFWCFG *fw_cfg = mm_fw_cfg_init(0xf0000510);
 
-    qtest_start(args);
-    actual = qfw_cfg_get_u16(fw_cfg, FW_CFG_BOOT_DEVICE);
-    g_assert_cmphex(actual, ==, expected_boot);
-    qmp("{ 'execute': 'system_reset' }");
-    actual = qfw_cfg_get_u16(fw_cfg, FW_CFG_BOOT_DEVICE);
-    g_assert_cmphex(actual, ==, expected_reboot);
-    qtest_quit(global_qtest);
-    g_free(args);
+    return qfw_cfg_get_u16(fw_cfg, FW_CFG_BOOT_DEVICE);
 }
 
-static void test_powermac_boot_order(void)
-{
-    int i;
+static const boot_order_test test_cases_fw_cfg[] = {
+    { "", 'c', 'c' },
+    { "-boot c", 'c', 'c' },
+    { "-boot d", 'd', 'd' },
+    { "-boot once=d,order=c", 'd', 'c' },
+    {}
+};
 
-    for (i = 0; i < 2; i++) {
-        bool newworld = (i == 1);
+static void test_pmac_oldworld_boot_order(void)
+{
+    test_boot_orders("g3beige", read_boot_order_pmac, test_cases_fw_cfg);
+}
 
-        test_powermac_with_args(newworld, "", 'c', 'c');
-        test_powermac_with_args(newworld, "-boot c", 'c', 'c');
-        test_powermac_with_args(newworld, "-boot d", 'd', 'd');
-        test_powermac_with_args(newworld, "-boot once=d,order=c", 'd', 'c');
-    }
+static void test_pmac_newworld_boot_order(void)
+{
+    test_boot_orders("mac99", read_boot_order_pmac, test_cases_fw_cfg);
 }
 
 int main(int argc, char *argv[])
@@ -115,7 +146,10 @@ int main(int argc, char *argv[])
     if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
         qtest_add_func("boot-order/pc", test_pc_boot_order);
     } else if (strcmp(arch, "ppc") == 0 || strcmp(arch, "ppc64") == 0) {
-        qtest_add_func("boot-order/powermac", test_powermac_boot_order);
+        qtest_add_func("boot-order/pmac_oldworld",
+                       test_pmac_oldworld_boot_order);
+        qtest_add_func("boot-order/pmac_newworld",
+                       test_pmac_newworld_boot_order);
     }
 
     return g_test_run();
commit 995b0e136fca7786657c5b63fa094032114615e3
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:17 2013 +0200

    boot-order-test: Cover -boot once in ppc tests
    
    Cc: Andreas Färber <afaerber at suse.de>
    Cc: Alexander Graf <agraf at suse.de>
    Cc: qemu-ppc at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-7-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index 766981d..1a8e22a 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -102,6 +102,7 @@ static void test_powermac_boot_order(void)
         test_powermac_with_args(newworld, "", 'c', 'c');
         test_powermac_with_args(newworld, "-boot c", 'c', 'c');
         test_powermac_with_args(newworld, "-boot d", 'd', 'd');
+        test_powermac_with_args(newworld, "-boot once=d,order=c", 'd', 'c');
     }
 }
 
commit 530a7e48bccddd8f1558f48cd4e3f6d46c272c83
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jun 26 15:52:16 2013 +0200

    boot-order-test: Add tests for PowerMacs
    
    They set the boot device via fw_cfg, which is then translated to a boot
    path of "hd" or "cd" in OpenBIOS.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-6-git-send-email-armbru at redhat.com
    Cc: Alexander Graf <agraf at suse.de>
    Cc: qemu-ppc at nongnu.org
    Converted to libqos/fw_cfg on Anthony's request.
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/Makefile b/tests/Makefile
index 55bfe24..c570da0 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -70,6 +70,8 @@ gcov-files-sparc-y += hw/m48t59.c
 gcov-files-sparc64-y += hw/m48t59.c
 check-qtest-arm-y = tests/tmp105-test$(EXESUF)
 gcov-files-arm-y += hw/tmp105.c
+check-qtest-ppc-y += tests/boot-order-test$(EXESUF)
+check-qtest-ppc64-y += tests/boot-order-test$(EXESUF)
 
 GENERATED_HEADERS += tests/test-qapi-types.h tests/test-qapi-visit.h tests/test-qmp-commands.h
 
@@ -135,7 +137,7 @@ tests/m48t59-test$(EXESUF): tests/m48t59-test.o
 tests/fdc-test$(EXESUF): tests/fdc-test.o
 tests/ide-test$(EXESUF): tests/ide-test.o $(libqos-pc-obj-y)
 tests/hd-geo-test$(EXESUF): tests/hd-geo-test.o
-tests/boot-order-test$(EXESUF): tests/boot-order-test.o
+tests/boot-order-test$(EXESUF): tests/boot-order-test.o $(libqos-obj-y)
 tests/tmp105-test$(EXESUF): tests/tmp105-test.o $(libqos-omap-obj-y)
 tests/i440fx-test$(EXESUF): tests/i440fx-test.o $(libqos-pc-obj-y)
 tests/fw_cfg-test$(EXESUF): tests/fw_cfg-test.o $(libqos-pc-obj-y)
diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index 447be31..766981d 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -10,7 +10,9 @@
  * See the COPYING file in the top-level directory.
  */
 
+#include <string.h>
 #include <glib.h>
+#include "libqos/fw_cfg.h"
 #include "libqtest.h"
 
 static void test_pc_cmos_byte(int reg, int expected)
@@ -63,11 +65,57 @@ static void test_pc_boot_order(void)
                       0, 0x02, 0x30, 0x12);
 }
 
+#define G3BEIGE_CFG_ADDR 0xf0000510
+#define MAC99_CFG_ADDR   0xf0000510
+
+#define NO_QEMU_PROTOS
+#include "hw/nvram/fw_cfg.h"
+#undef NO_QEMU_PROTOS
+
+static void test_powermac_with_args(bool newworld, const char *extra_args,
+                                    uint16_t expected_boot,
+                                    uint16_t expected_reboot)
+{
+    char *args = g_strdup_printf("-nodefaults -display none -machine %s %s",
+                                 newworld ? "mac99" : "g3beige", extra_args);
+    QFWCFG *fw_cfg = mm_fw_cfg_init(newworld ? MAC99_CFG_ADDR
+                                    : G3BEIGE_CFG_ADDR);
+    uint16_t actual;
+
+    qtest_start(args);
+    actual = qfw_cfg_get_u16(fw_cfg, FW_CFG_BOOT_DEVICE);
+    g_assert_cmphex(actual, ==, expected_boot);
+    qmp("{ 'execute': 'system_reset' }");
+    actual = qfw_cfg_get_u16(fw_cfg, FW_CFG_BOOT_DEVICE);
+    g_assert_cmphex(actual, ==, expected_reboot);
+    qtest_quit(global_qtest);
+    g_free(args);
+}
+
+static void test_powermac_boot_order(void)
+{
+    int i;
+
+    for (i = 0; i < 2; i++) {
+        bool newworld = (i == 1);
+
+        test_powermac_with_args(newworld, "", 'c', 'c');
+        test_powermac_with_args(newworld, "-boot c", 'c', 'c');
+        test_powermac_with_args(newworld, "-boot d", 'd', 'd');
+    }
+}
+
 int main(int argc, char *argv[])
 {
+    const char *arch = qtest_get_arch();
+
     g_test_init(&argc, &argv, NULL);
 
-    qtest_add_func("boot-order/pc", test_pc_boot_order);
+    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
+        qtest_add_func("boot-order/pc", test_pc_boot_order);
+    } else if (strcmp(arch, "ppc") == 0 || strcmp(arch, "ppc64") == 0) {
+        qtest_add_func("boot-order/powermac", test_powermac_boot_order);
+    }
 
     return g_test_run();
 }
commit 7a10016509f740ef33b7875630d6c3549d57c6e8
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:15 2013 +0200

    libqos: Add support for memory-mapped fw_cfg
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-5-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/libqos/fw_cfg.c b/tests/libqos/fw_cfg.c
index e386ff7..49d1683 100644
--- a/tests/libqos/fw_cfg.c
+++ b/tests/libqos/fw_cfg.c
@@ -2,15 +2,19 @@
  * libqos fw_cfg support
  *
  * Copyright IBM, Corp. 2012-2013
+ * Copyright (C) 2013 Red Hat Inc.
  *
  * Authors:
  *  Anthony Liguori   <aliguori at us.ibm.com>
+ *  Markus Armbruster <armbru at redhat.com>
  *
  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  * See the COPYING file in the top-level directory.
  */
 
+#include <glib.h>
 #include "libqos/fw_cfg.h"
+#include "libqtest.h"
 #include "qemu/bswap.h"
 
 void qfw_cfg_select(QFWCFG *fw_cfg, uint16_t key)
@@ -50,3 +54,28 @@ uint64_t qfw_cfg_get_u64(QFWCFG *fw_cfg, uint16_t key)
     return le64_to_cpu(value);
 }
 
+static void mm_fw_cfg_select(QFWCFG *fw_cfg, uint16_t key)
+{
+    writew(fw_cfg->base, key);
+}
+
+static void mm_fw_cfg_read(QFWCFG *fw_cfg, void *data, size_t len)
+{
+    uint8_t *ptr = data;
+    int i;
+
+    for (i = 0; i < len; i++) {
+        ptr[i] = readb(fw_cfg->base + 2);
+    }
+}
+
+QFWCFG *mm_fw_cfg_init(uint64_t base)
+{
+    QFWCFG *fw_cfg = g_malloc0(sizeof(*fw_cfg));
+
+    fw_cfg->base = base;
+    fw_cfg->select = mm_fw_cfg_select;
+    fw_cfg->read = mm_fw_cfg_read;
+
+    return fw_cfg;
+}
diff --git a/tests/libqos/fw_cfg.h b/tests/libqos/fw_cfg.h
index 44fc42b..19bb053 100644
--- a/tests/libqos/fw_cfg.h
+++ b/tests/libqos/fw_cfg.h
@@ -20,6 +20,7 @@ typedef struct QFWCFG QFWCFG;
 
 struct QFWCFG
 {
+    uint64_t base;
     void (*select)(QFWCFG *fw_cfg, uint16_t key);
     void (*read)(QFWCFG *fw_cfg, void *data, size_t len);
 };
@@ -31,4 +32,6 @@ uint16_t qfw_cfg_get_u16(QFWCFG *fw_cfg, uint16_t key);
 uint32_t qfw_cfg_get_u32(QFWCFG *fw_cfg, uint16_t key);
 uint64_t qfw_cfg_get_u64(QFWCFG *fw_cfg, uint16_t key);
 
+QFWCFG *mm_fw_cfg_init(uint64_t base);
+
 #endif
commit db2b5500c9780730b8ad09fca4a1d2de365dcbf0
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Jun 26 15:52:14 2013 +0200

    libqos: include dependencies
    
    Otherwise rebuilds can fail when libqos is modified.
    
    Reported-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/Makefile b/tests/Makefile
index 440fe7b..55bfe24 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -228,3 +228,4 @@ check-block: $(patsubst %,check-%, $(check-block-y))
 check: check-unit check-qtest
 
 -include $(wildcard tests/*.d)
+-include $(wildcard tests/libqos/*.d)
commit edbd790d20cf19d039dfe431aaf0973a9e0afa8f
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:13 2013 +0200

    boot-order-test: New; covering just PC for now
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/Makefile b/tests/Makefile
index 279d5f8..440fe7b 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -57,6 +57,7 @@ gcov-files-i386-y = hw/fdc.c
 check-qtest-i386-y += tests/ide-test$(EXESUF)
 check-qtest-i386-y += tests/hd-geo-test$(EXESUF)
 gcov-files-i386-y += hw/hd-geometry.c
+check-qtest-i386-y += tests/boot-order-test$(EXESUF)
 check-qtest-i386-y += tests/rtc-test$(EXESUF)
 check-qtest-i386-y += tests/i440fx-test$(EXESUF)
 check-qtest-i386-y += tests/fw_cfg-test$(EXESUF)
@@ -134,6 +135,7 @@ tests/m48t59-test$(EXESUF): tests/m48t59-test.o
 tests/fdc-test$(EXESUF): tests/fdc-test.o
 tests/ide-test$(EXESUF): tests/ide-test.o $(libqos-pc-obj-y)
 tests/hd-geo-test$(EXESUF): tests/hd-geo-test.o
+tests/boot-order-test$(EXESUF): tests/boot-order-test.o
 tests/tmp105-test$(EXESUF): tests/tmp105-test.o $(libqos-omap-obj-y)
 tests/i440fx-test$(EXESUF): tests/i440fx-test.o $(libqos-pc-obj-y)
 tests/fw_cfg-test$(EXESUF): tests/fw_cfg-test.o $(libqos-pc-obj-y)
diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
new file mode 100644
index 0000000..447be31
--- /dev/null
+++ b/tests/boot-order-test.c
@@ -0,0 +1,73 @@
+/*
+ * Boot order test cases.
+ *
+ * Copyright (c) 2013 Red Hat Inc.
+ *
+ * Authors:
+ *  Markus Armbruster <armbru at redhat.com>,
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include <glib.h>
+#include "libqtest.h"
+
+static void test_pc_cmos_byte(int reg, int expected)
+{
+    int actual;
+
+    outb(0x70, reg);
+    actual = inb(0x71);
+    g_assert_cmphex(actual, ==, expected);
+}
+
+static void test_pc_cmos(uint8_t boot1, uint8_t boot2)
+{
+    test_pc_cmos_byte(0x38, boot1);
+    test_pc_cmos_byte(0x3d, boot2);
+}
+
+static void test_pc_with_args(const char *test_args,
+                              uint8_t boot1, uint8_t boot2,
+                              uint8_t reboot1, uint8_t reboot2)
+{
+    char *args = g_strdup_printf("-nodefaults -display none %s", test_args);
+
+    qtest_start(args);
+    test_pc_cmos(boot1, boot2);
+    qmp("{ 'execute': 'system_reset' }");
+    /*
+     * system_reset only requests reset.  We get a RESET event after
+     * the actual reset completes.  Need to wait for that.
+     */
+    qmp("");                    /* HACK: wait for event */
+    test_pc_cmos(reboot1, reboot2);
+    qtest_quit(global_qtest);
+    g_free(args);
+}
+
+static void test_pc_boot_order(void)
+{
+    test_pc_with_args("", 0x30, 0x12, 0x30, 0x12);
+    test_pc_with_args("-no-fd-bootchk", 0x31, 0x12, 0x31, 0x12);
+    test_pc_with_args("-boot c", 0, 0x02, 0, 0x02);
+    test_pc_with_args("-boot nda", 0x10, 0x34, 0x10, 0x34);
+    test_pc_with_args("-boot order=", 0, 0, 0, 0);
+    test_pc_with_args("-boot order= -boot order=c", 0, 0x02, 0, 0x02);
+    test_pc_with_args("-boot once=a", 0, 0x01, 0x30, 0x12);
+    test_pc_with_args("-boot once=a -no-fd-bootchk", 0x01, 0x01, 0x31, 0x12);
+    test_pc_with_args("-boot once=a,order=c", 0, 0x01, 0, 0x02);
+    test_pc_with_args("-boot once=d -boot order=nda", 0, 0x03, 0x10, 0x34);
+    test_pc_with_args("-boot once=a -boot once=b -boot once=c",
+                      0, 0x02, 0x30, 0x12);
+}
+
+int main(int argc, char *argv[])
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("boot-order/pc", test_pc_boot_order);
+
+    return g_test_run();
+}
commit ba646ff6a3149f416424122c628e798be4957997
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Jun 26 15:52:12 2013 +0200

    qtest: Don't reset on qtest chardev connect
    
    libqtest's qtest_init() connecting to the qtest socket triggers reset.
    This was coded in the hope we could use the same QEMU process for
    multiple tests that way.  Never used.  Injects an extra reset even
    when it's not used, and that can mess up tests such as the one of
    -boot once I'm about to add.  Drop it.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372254743-15808-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qtest.c b/qtest.c
index 07a9612..74f1842 100644
--- a/qtest.c
+++ b/qtest.c
@@ -472,7 +472,12 @@ static void qtest_event(void *opaque, int event)
 
     switch (event) {
     case CHR_EVENT_OPENED:
-        qemu_system_reset(false);
+        /*
+         * We used to call qemu_system_reset() here, hoping we could
+         * use the same process for multiple tests that way.  Never
+         * used.  Injects an extra reset even when it's not used, and
+         * that can mess up tests, e.g. -boot once.
+         */
         for (i = 0; i < ARRAY_SIZE(irq_levels); i++) {
             irq_levels[i] = 0;
         }
commit 1d9358e686125c125b52529fa68baf36aa2d0d09
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jun 20 08:55:29 2013 +0200

    libqtest: New qtest_end() to go with qtest_start()
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1371711329-9144-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/fdc-test.c b/tests/fdc-test.c
index 4b0301d..fd198dc 100644
--- a/tests/fdc-test.c
+++ b/tests/fdc-test.c
@@ -556,7 +556,7 @@ int main(int argc, char **argv)
     ret = g_test_run();
 
     /* Cleanup */
-    qtest_quit(global_qtest);
+    qtest_end();
     unlink(test_image);
 
     return ret;
diff --git a/tests/hd-geo-test.c b/tests/hd-geo-test.c
index 9a31e85..b72042e 100644
--- a/tests/hd-geo-test.c
+++ b/tests/hd-geo-test.c
@@ -244,7 +244,7 @@ static void test_ide_none(void)
     setup_common(argv, ARRAY_SIZE(argv));
     qtest_start(g_strjoinv(" ", argv));
     test_cmos();
-    qtest_quit(global_qtest);
+    qtest_end();
 }
 
 static void test_ide_mbr(bool use_device, MBRcontents mbr)
@@ -262,7 +262,7 @@ static void test_ide_mbr(bool use_device, MBRcontents mbr)
     }
     qtest_start(g_strjoinv(" ", argv));
     test_cmos();
-    qtest_quit(global_qtest);
+    qtest_end();
 }
 
 /*
@@ -334,7 +334,7 @@ static void test_ide_drive_user(const char *dev, bool trans)
     g_free(opts);
     qtest_start(g_strjoinv(" ", argv));
     test_cmos();
-    qtest_quit(global_qtest);
+    qtest_end();
 }
 
 /*
@@ -387,7 +387,7 @@ static void test_ide_drive_cd_0(void)
     }
     qtest_start(g_strjoinv(" ", argv));
     test_cmos();
-    qtest_quit(global_qtest);
+    qtest_end();
 }
 
 int main(int argc, char **argv)
diff --git a/tests/ide-test.c b/tests/ide-test.c
index 7e2eb94..7307f1d 100644
--- a/tests/ide-test.c
+++ b/tests/ide-test.c
@@ -122,7 +122,7 @@ static void ide_test_start(const char *cmdline_fmt, ...)
 
 static void ide_test_quit(void)
 {
-    qtest_quit(global_qtest);
+    qtest_end();
 }
 
 static QPCIDevice *get_pci_device(uint16_t *bmdma_base)
diff --git a/tests/libqtest.h b/tests/libqtest.h
index 437bda3..0f6aade 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -17,6 +17,7 @@
 #ifndef LIBQTEST_H
 #define LIBQTEST_H
 
+#include <stddef.h>
 #include <stdint.h>
 #include <stdbool.h>
 #include <stdarg.h>
@@ -319,6 +320,17 @@ static inline QTestState *qtest_start(const char *args)
 }
 
 /**
+ * qtest_end:
+ *
+ * Shut down the QEMU process started by qtest_start().
+ */
+static inline void qtest_end(void)
+{
+    qtest_quit(global_qtest);
+    global_qtest = NULL;
+}
+
+/**
  * qmp:
  * @fmt...: QMP message to send to qemu
  *
commit fdd26fca3ce66863e547560fbde1a444fc5d71b7
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jun 20 08:55:28 2013 +0200

    libqtest: Plug fd and memory leaks in qtest_quit()
    
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1371711329-9144-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/libqtest.c b/tests/libqtest.c
index 879ffe9..bb82069 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -171,12 +171,16 @@ void qtest_quit(QTestState *s)
         waitpid(pid, &status, 0);
     }
 
+    close(s->fd);
+    close(s->qmp_fd);
+    g_string_free(s->rx, true);
     unlink(s->pid_file);
     unlink(s->socket_path);
     unlink(s->qmp_socket_path);
     g_free(s->pid_file);
     g_free(s->socket_path);
     g_free(s->qmp_socket_path);
+    g_free(s);
 }
 
 static void socket_sendf(int fd, const char *fmt, va_list ap)
commit 293d2a0014a0e849477413f55aaa05f2743b2e04
Author: Laszlo Ersek <lersek at redhat.com>
Date:   Tue Jul 16 20:19:41 2013 +0200

    monitor: maintain at most one G_IO_OUT watch
    
    When monitor_flush() is invoked repeatedly outside the monitor_unblocked()
    callback, for example from tlb_info() -> ... -> print_pte(), several
    watches may be added for the same event.
    
    This is no problem per se because the extra monitor_unblocked() callbacks
    are harmless if mon->outbuf is empty, the watches will be removed
    gradually. However a big number of watches can grow "gpollfds" without
    limit in glib_pollfds_fill(), triggering a -1/EINVAL condition in
    g_poll().
    
    Keep at most one such watch, by following the pattern observable in eg.
    commits c874ea97 and c3d6b96e. The change has no effect when
    monitor_unblocked() calls monitor_flush() (when the watch can either be
    removed or renewed 1-for-1), but non-callback contexts won't create an
    additional watch when the monitor already has one.
    
    Related RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=970047
    
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Reviewed-by: Amit Shah <amit.shah at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1373998781-29561-3-git-send-email-lersek at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/monitor.c b/monitor.c
index 99b6ed9..6db2ba4 100644
--- a/monitor.c
+++ b/monitor.c
@@ -189,6 +189,7 @@ struct Monitor {
     int suspend_cnt;
     bool skip_flush;
     QString *outbuf;
+    guint watch;
     ReadLineState *rs;
     MonitorControl *mc;
     CPUState *mon_cpu;
@@ -263,7 +264,10 @@ int monitor_read_password(Monitor *mon, ReadLineFunc *readline_func,
 static gboolean monitor_unblocked(GIOChannel *chan, GIOCondition cond,
                                   void *opaque)
 {
-    monitor_flush(opaque);
+    Monitor *mon = opaque;
+
+    mon->watch = 0;
+    monitor_flush(mon);
     return FALSE;
 }
 
@@ -294,7 +298,10 @@ void monitor_flush(Monitor *mon)
             QDECREF(mon->outbuf);
             mon->outbuf = tmp;
         }
-        qemu_chr_fe_add_watch(mon->chr, G_IO_OUT, monitor_unblocked, mon);
+        if (mon->watch == 0) {
+            mon->watch = qemu_chr_fe_add_watch(mon->chr, G_IO_OUT,
+                                               monitor_unblocked, mon);
+        }
     }
 }
 
commit ac8c26f633b01bb32cdf347f9dbd5a80c6712925
Author: Laszlo Ersek <lersek at redhat.com>
Date:   Tue Jul 16 20:19:40 2013 +0200

    char: io_channel_send: don't lose written bytes
    
    The g_io_channel_write_chars() documentation states,
    
      bytes_written: The number of bytes written. This can be nonzero even if
                     the return value is not G_IO_STATUS_NORMAL. [...]
    
    io_channel_send() could lose such bytes before.
    
    Furthermore, the (status == G_IO_STATUS_EOF) condition used to evaluate to
    constant false whenever it was reached. When that condition actually held,
    it always led to -1 / EINVAL. This patch (almost) distinguishes
    G_IO_STATUS_EOF only when no bytes have been written, and then treats it
    as an error.
    
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Reviewed-by: Amit Shah <amit.shah at redhat.com>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1373998781-29561-2-git-send-email-lersek at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index 800d6a6..c86ce4b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -720,35 +720,32 @@ static GIOChannel *io_channel_from_socket(int fd)
 
 static int io_channel_send(GIOChannel *fd, const void *buf, size_t len)
 {
-    GIOStatus status;
-    size_t offset;
+    size_t offset = 0;
+    GIOStatus status = G_IO_STATUS_NORMAL;
 
-    offset = 0;
-    while (offset < len) {
-        gsize bytes_written;
+    while (offset < len && status == G_IO_STATUS_NORMAL) {
+        gsize bytes_written = 0;
 
         status = g_io_channel_write_chars(fd, buf + offset, len - offset,
                                           &bytes_written, NULL);
-        if (status != G_IO_STATUS_NORMAL) {
-            if (status == G_IO_STATUS_AGAIN) {
-                /* If we've written any data, return a partial write. */
-                if (offset) {
-                    break;
-                }
-                errno = EAGAIN;
-            } else {
-                errno = EINVAL;
-            }
-
-            return -1;
-        } else if (status == G_IO_STATUS_EOF) {
-            break;
-        }
-
         offset += bytes_written;
     }
 
-    return offset;
+    if (offset > 0) {
+        return offset;
+    }
+    switch (status) {
+    case G_IO_STATUS_NORMAL:
+        g_assert(len == 0);
+        return 0;
+    case G_IO_STATUS_AGAIN:
+        errno = EAGAIN;
+        return -1;
+    default:
+        break;
+    }
+    errno = EINVAL;
+    return -1;
 }
 
 #ifndef _WIN32
commit 0d185e638861bd9b05b2abb43774a368cadabd38
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Jul 18 16:42:01 2013 +0100

    configure: Provide more helpful message if libvte not present
    
    If the system has GTK but not libvte, it's more helpful to
    tell the user that libvte is missing than to simply say that
    GTK is not present.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1374162121-31582-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/configure b/configure
index cb0f870..9e1cd19 100755
--- a/configure
+++ b/configure
@@ -1697,19 +1697,23 @@ if test "$gtk" != "no"; then
       vtepackage="vte"
       vteversion="0.24.0"
     fi
-    if $pkg_config --exists "$gtkpackage >= $gtkversion" && \
-       $pkg_config --exists "$vtepackage >= $vteversion"; then
+    if ! $pkg_config --exists "$gtkpackage >= $gtkversion"; then
+        if test "$gtk" = "yes" ; then
+            feature_not_found "gtk"
+        fi
+        gtk="no"
+    elif ! $pkg_config --exists "$vtepackage >= $vteversion"; then
+        if test "$gtk" = "yes" ; then
+            error_exit "libvte not found (required for gtk support)"
+        fi
+        gtk="no"
+    else
 	gtk_cflags=`$pkg_config --cflags $gtkpackage 2>/dev/null`
 	gtk_libs=`$pkg_config --libs $gtkpackage 2>/dev/null`
 	vte_cflags=`$pkg_config --cflags $vtepackage 2>/dev/null`
 	vte_libs=`$pkg_config --libs $vtepackage 2>/dev/null`
 	libs_softmmu="$gtk_libs $vte_libs $libs_softmmu"
 	gtk="yes"
-    else
-	if test "$gtk" = "yes" ; then
-	    feature_not_found "gtk"
-	fi
-	gtk="no"
     fi
 fi
 
commit b957a1b03cfd56134519ebc01ba8fe1b166c0c84
Author: Richard Henderson <rth at twiddle.net>
Date:   Tue Jul 16 06:48:28 2013 -0700

    pc-bios: Update palcode-clipper
    
    Update image to c87a92639b28ac42bc8f6c67443543b405dc479b,
    incorporating changes for vm_time.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/.gitmodules b/.gitmodules
index b426ea6..d7e3f3c 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -15,7 +15,7 @@
 	url = git://git.qemu.org/openbios.git
 [submodule "roms/qemu-palcode"]
 	path = roms/qemu-palcode
-	url = git://repo.or.cz/qemu-palcode.git
+	url = git://github.com/rth7680/qemu-palcode.git
 [submodule "roms/sgabios"]
 	path = roms/sgabios
 	url = git://git.qemu.org/sgabios.git
diff --git a/pc-bios/README b/pc-bios/README
index 030d92a..53b5289 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -40,4 +40,4 @@
   git://repo.or.cz/s390-tools.git
 
 - The sources for the Alpha palcode image is available from:
-  git://repo.or.cz/qemu-palcode.git
+  git://github.com/rth7680/qemu-palcode.git
diff --git a/pc-bios/palcode-clipper b/pc-bios/palcode-clipper
index a92372c..9956340 100755
Binary files a/pc-bios/palcode-clipper and b/pc-bios/palcode-clipper differ
diff --git a/roms/qemu-palcode b/roms/qemu-palcode
index 7abb12f..c87a926 160000
--- a/roms/qemu-palcode
+++ b/roms/qemu-palcode
@@ -1 +1 @@
-Subproject commit 7abb12f60eb3069019e9497e193733d77d8f0722
+Subproject commit c87a92639b28ac42bc8f6c67443543b405dc479b
commit 19e0cbb82ffab7220cdbcc78ab2c1dac823ce4e3
Author: Richard Henderson <rth at twiddle.net>
Date:   Tue Jul 16 06:45:57 2013 -0700

    target-alpha: Move alarm to vm_clock
    
    Basing the alarm off the rtc_clock was silly.  It leads to horrible
    spinning in the guest after being suspended and resumed, as it tries
    to catch up with lost ticks.
    
    This requires adding an accessor for reading the vm_clock too.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 3d7a1cd..b7fb044 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -693,7 +693,7 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
         AlphaCPU *cpu = cpus[i];
         s->cchip.cpu[i] = cpu;
         if (cpu != NULL) {
-            cpu->alarm_timer = qemu_new_timer_ns(rtc_clock,
+            cpu->alarm_timer = qemu_new_timer_ns(vm_clock,
                                                  typhoon_alarm_timer,
                                                  (void *)((uintptr_t)s + i));
         }
diff --git a/target-alpha/helper.h b/target-alpha/helper.h
index 3321fde..0e425cf 100644
--- a/target-alpha/helper.h
+++ b/target-alpha/helper.h
@@ -114,7 +114,8 @@ DEF_HELPER_FLAGS_2(tbis, TCG_CALL_NO_RWG, void, env, i64)
 
 DEF_HELPER_1(halt, void, i64);
 
-DEF_HELPER_FLAGS_0(get_time, TCG_CALL_NO_RWG, i64)
+DEF_HELPER_FLAGS_0(get_vmtime, TCG_CALL_NO_RWG, i64)
+DEF_HELPER_FLAGS_0(get_walltime, TCG_CALL_NO_RWG, i64)
 DEF_HELPER_FLAGS_2(set_alarm, TCG_CALL_NO_RWG, void, env, i64)
 #endif
 
diff --git a/target-alpha/sys_helper.c b/target-alpha/sys_helper.c
index 339501a..bd94597 100644
--- a/target-alpha/sys_helper.c
+++ b/target-alpha/sys_helper.c
@@ -70,7 +70,12 @@ void helper_halt(uint64_t restart)
     }
 }
 
-uint64_t helper_get_time(void)
+uint64_t helper_get_vmtime(void)
+{
+    return qemu_get_clock_ns(vm_clock);
+}
+
+uint64_t helper_get_walltime(void)
 {
     return qemu_get_clock_ns(rtc_clock);
 }
diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index dd7f0fb..5558b72 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -1634,15 +1634,19 @@ static ExitStatus gen_mfpr(int ra, int regno)
         return NO_EXIT;
     }
 
-    if (regno == 250) {
-        /* WALL_TIME */
+    /* Special help for VMTIME and WALLTIME.  */
+    if (regno == 250 || regno == 249) {
+	void (*helper)(TCGv) = gen_helper_get_walltime;
+	if (regno == 249) {
+		helper = gen_helper_get_vmtime;
+	}
         if (use_icount) {
             gen_io_start();
-            gen_helper_get_time(cpu_ir[ra]);
+            helper(cpu_ir[ra]);
             gen_io_end();
             return EXIT_PC_STALE;
         } else {
-            gen_helper_get_time(cpu_ir[ra]);
+            helper(cpu_ir[ra]);
             return NO_EXIT;
         }
     }
commit 28199c48ed44895012ae0be3b6e8f080404a4d34
Merge: bbcf59b 7b4b0e9
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 08:14:22 2013 -0500

    Merge remote-tracking branch 'awilliam/tags/vfio-for-qemu-1.6' into staging
    
    vfio: enhanced VGA quirks + AER error containment
    
    # gpg: Signature made Wed 17 Jul 2013 05:39:38 PM CDT using RSA key ID 3BB08B22
    # gpg: Can't check signature: public key not found
    
    # By Alex Williamson (1) and Vijay Mohan Pandarathil (1)
    # Via Alex Williamson
    * awilliam/tags/vfio-for-qemu-1.6:
      vfio: QEMU-AER: Qemu changes to support AER for VFIO-PCI devices
      vfio-pci: VGA quirk update
    
    Message-id: 20130717224939.4763.87264.stgit at bling.home
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit bbcf59bc4ba813b1ff8f1312585f773a675b2e3e
Merge: 5ab4dba f9b1d9b
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 08:14:10 2013 -0500

    Merge remote-tracking branch 'luiz/queue/qmp' into staging
    
    # By Amos Kong (1) and Luiz Capitulino (1)
    # Via Luiz Capitulino
    * luiz/queue/qmp:
      qmp: update send-key document
      qapi: qapi-commands: fix possible leaks on visitor dealloc
    
    Message-id: 1374093679-29213-1-git-send-email-lcapitulino at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 5ab4dba4dac1932f8b14561772d3473d02ccd259
Merge: e9acb8c 0777b5d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 08:13:50 2013 -0500

    Merge remote-tracking branch 'bonzini/scsi-next' into staging
    
    # By Peter Lieven (4) and Ronnie Sahlberg (1)
    # Via Paolo Bonzini
    * bonzini/scsi-next:
      iscsi: factor out sector conversions
      iscsi: assert that sectors are aligned to LUN blocksize
      iscsi: remove support for misaligned nb_sectors in aio_readv
      iscsi: fix -ENOSPC in iscsi_create()
      Fix iSCSI crash on SG_IO with an iovector
    
    Message-id: 1374073524-8469-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit e9acb8cea9b11679cab8cb3c20c4348803bbb58a
Merge: 6453a3a d26d9e1
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 08:12:47 2013 -0500

    Merge remote-tracking branch 'mst/tags/for_anthony' into staging
    
    pci,net,pc enhancements
    
    This includes some fixes and enhancements that accumulated in my tree:
    pci fixes by dkoch, virtio-net enhancements by akong and mst,
    and a fix for xen pc by mst.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Wed 17 Jul 2013 04:44:45 AM CDT using RSA key ID D28D5469
    # gpg: Can't check signature: public key not found
    
    # By Don Koch (2) and others
    # Via Michael S. Tsirkin
    * mst/tags/for_anthony:
      pc: don't access fw cfg if NULL
      virtio-net: add feature bit for any header s/g
      net: add support of mac-programming over macvtap in QEMU side
      pci: fix BRDIGE typo
      pci-bridge: update mappings for migration/restore
    
    Message-id: 1374054430-21966-1-git-send-email-mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit e1622f4b15391bd44eb0f99a244fdf19a20fd981
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Jul 17 13:17:41 2013 +0200

    exec: fix incorrect assumptions in memory_access_size
    
    access_size_min can be 1 because erroneous accesses must not crash
    QEMU, they should trigger exceptions in the guest or just return
    garbage (depending on the CPU).  I am not sure I understand the
    comment: placing a 4-byte field at the last byte of a region
    makes no sense (unless impl.unaligned is true), and that is
    why memory.c:access_with_adjusted_size does not bother with
    minimums larger than the remaining length.
    
    access_size_max can be mr->ops->valid.max_access_size because memory.c
    can and will still break accesses bigger than
    mr->ops->impl.max_access_size.
    
    Reported-by: Markus Armbruster <armbru at redhat.com>
    Tested-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index d312bb4..c8658c6 100644
--- a/exec.c
+++ b/exec.c
@@ -1898,14 +1898,10 @@ static inline bool memory_access_is_direct(MemoryRegion *mr, bool is_write)
 
 static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
 {
-    unsigned access_size_min = mr->ops->impl.min_access_size;
-    unsigned access_size_max = mr->ops->impl.max_access_size;
+    unsigned access_size_max = mr->ops->valid.max_access_size;
 
     /* Regions are assumed to support 1-4 byte accesses unless
        otherwise specified.  */
-    if (access_size_min == 0) {
-        access_size_min = 1;
-    }
     if (access_size_max == 0) {
         access_size_max = 4;
     }
@@ -1922,9 +1918,6 @@ static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
     if (l > access_size_max) {
         l = access_size_max;
     }
-    /* ??? The users of this function are wrong, not supporting minimums larger
-       than the remaining length.  C.f. memory.c:access_with_adjusted_size.  */
-    assert(l >= access_size_min);
 
     return l;
 }
commit 9b8c69243585a32d14b9bb9fcd52c37b0b5a1b71
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Tue Jul 16 14:45:16 2013 +0200

    memory: Return -1 again on reads from unsigned regions
    
    This restore the behavior prior to b018ddf633 which accidentally changed
    the return code to 0. Specifically guests probing for register existence
    were affected by this.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/memory.c b/memory.c
index 9938b6b..34a088e 100644
--- a/memory.c
+++ b/memory.c
@@ -840,7 +840,7 @@ static uint64_t unassigned_mem_read(void *opaque, hwaddr addr,
     if (current_cpu != NULL) {
         cpu_unassigned_access(current_cpu, addr, false, false, 0, size);
     }
-    return 0;
+    return -1ULL;
 }
 
 static void unassigned_mem_write(void *opaque, hwaddr addr,
commit b4afea11aafe85975e74dd562bb94f7ce3de1ef1
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 15 15:48:50 2013 +0200

    memory: actually set the owner
    
    Brown paper bag for me.  Originally commit 803c0816 came before commit
    2c9b15c.  When the order was inverted, I left in the NULL initialization
    of mr->owner.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/memory.c b/memory.c
index c8f9a2b..9938b6b 100644
--- a/memory.c
+++ b/memory.c
@@ -805,7 +805,6 @@ void memory_region_init(MemoryRegion *mr,
     mr->owner = owner;
     mr->iommu_ops = NULL;
     mr->parent = NULL;
-    mr->owner = NULL;
     mr->size = int128_make64(size);
     if (size == UINT64_MAX) {
         mr->size = int128_2_64();
commit cb85f7ab045e8c05ee182b3573c9aba8e287e36b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 8 09:44:04 2013 +0100

    exec.c: Pass correct pointer type to qemu_ram_ptr_length
    
    Commit e3127ae0 introduced a problem where we're passing a
    hwaddr* to qemu_ram_ptr_length() but it wants a ram_addr_t*;
    this will cause problems on 32 bit hosts and in any case
    provokes a clang warning on MacOSX:
    
      CC    arm-softmmu/exec.o
    exec.c:2164:46: warning: incompatible pointer types passing 'hwaddr *'
    (aka 'unsigned long long *') to parameter of type 'ram_addr_t *'
    (aka 'unsigned long *')
    [-Wincompatible-pointer-types]
        return qemu_ram_ptr_length(raddr + base, plen);
                                                 ^~~~
    exec.c:1392:63: note: passing argument to parameter 'size' here
    static void *qemu_ram_ptr_length(ram_addr_t addr, ram_addr_t *size)
                                                                  ^
    
    Since this function is only used in one place, change its
    prototype to pass a hwaddr* rather than a ram_addr_t*,
    rather than contorting the calling code to get the type right.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Tested-by: Riku Voipio <riku.voipio at linaro.org>
    Tested-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index c99a883..d312bb4 100644
--- a/exec.c
+++ b/exec.c
@@ -1379,7 +1379,7 @@ static void *qemu_safe_ram_ptr(ram_addr_t addr)
 
 /* Return a host pointer to guest's ram. Similar to qemu_get_ram_ptr
  * but takes a size argument */
-static void *qemu_ram_ptr_length(ram_addr_t addr, ram_addr_t *size)
+static void *qemu_ram_ptr_length(ram_addr_t addr, hwaddr *size)
 {
     if (*size == 0) {
         return NULL;
commit 3ba00637d024b9d43b26106060a23a85411d0757
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jun 7 12:59:21 2013 +0200

    trace-events: Fix up source file comments
    
    They're all wrong since (at least) Paolo's big source tree
    reorganization.  Need to shuffle some event declarations around to
    keep them under the correct source file comment.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/trace-events b/trace-events
index cc21258..002df83 100644
--- a/trace-events
+++ b/trace-events
@@ -25,18 +25,14 @@
 #
 # The <format-string> should be a sprintf()-compatible format string.
 
-# qemu-malloc.c
-g_malloc(size_t size, void *ptr) "size %zu ptr %p"
-g_realloc(void *ptr, size_t size, void *newptr) "ptr %p size %zu newptr %p"
-g_free(void *ptr) "ptr %p"
-
-# osdep.c
+# util/oslib-win32.c
+# util/oslib-posix.c
 qemu_memalign(size_t alignment, size_t size, void *ptr) "alignment %zu size %zu ptr %p"
 qemu_anon_ram_alloc(size_t size, void *ptr) "size %zu ptr %p"
 qemu_vfree(void *ptr) "ptr %p"
 qemu_anon_ram_free(void *ptr, size_t size) "ptr %p size %zu"
 
-# hw/virtio.c
+# hw/virtio/virtio.c
 virtqueue_fill(void *vq, const void *elem, unsigned int len, unsigned int idx) "vq %p elem %p len %u idx %u"
 virtqueue_flush(void *vq, unsigned int count) "vq %p count %u"
 virtqueue_pop(void *vq, void *elem, unsigned int in_num, unsigned int out_num) "vq %p elem %p in_num %u out_num %u"
@@ -45,13 +41,13 @@ virtio_irq(void *vq) "vq %p"
 virtio_notify(void *vdev, void *vq) "vdev %p vq %p"
 virtio_set_status(void *vdev, uint8_t val) "vdev %p val %u"
 
-# hw/virtio-serial-bus.c
+# hw/char/virtio-serial-bus.c
 virtio_serial_send_control_event(unsigned int port, uint16_t event, uint16_t value) "port %u, event %u, value %u"
 virtio_serial_throttle_port(unsigned int port, bool throttle) "port %u, throttle %d"
 virtio_serial_handle_control_message(uint16_t event, uint16_t value) "event %u, value %u"
 virtio_serial_handle_control_message_port(unsigned int port) "port %u"
 
-# hw/virtio-console.c
+# hw/char/virtio-console.c
 virtio_console_flush_buf(unsigned int port, size_t len, ssize_t ret) "port %u, in_len %zu, out_len %zd"
 virtio_console_chr_read(unsigned int port, int size) "port %u, size %d"
 virtio_console_chr_event(unsigned int port, int event) "port %u, event %d"
@@ -75,6 +71,8 @@ bdrv_co_do_copy_on_readv(void *bs, int64_t sector_num, int nb_sectors, int64_t c
 # block/stream.c
 stream_one_iteration(void *s, int64_t sector_num, int nb_sectors, int is_allocated) "s %p sector_num %"PRId64" nb_sectors %d is_allocated %d"
 stream_start(void *bs, void *base, void *s, void *co, void *opaque) "bs %p base %p s %p co %p opaque %p"
+
+# block/commit.c
 commit_one_iteration(void *s, int64_t sector_num, int nb_sectors, int is_allocated) "s %p sector_num %"PRId64" nb_sectors %d is_allocated %d"
 commit_start(void *bs, void *base, void *top, void *s, void *co, void *opaque) "bs %p base %p top %p s %p co %p opaque %p"
 
@@ -107,19 +105,19 @@ qmp_block_job_complete(void *job) "job %p"
 block_job_cb(void *bs, void *job, int ret) "bs %p job %p ret %d"
 qmp_block_stream(void *bs, void *job) "bs %p job %p"
 
-# hw/virtio-blk.c
+# hw/block/virtio-blk.c
 virtio_blk_req_complete(void *req, int status) "req %p status %d"
 virtio_blk_rw_complete(void *req, int ret) "req %p ret %d"
 virtio_blk_handle_write(void *req, uint64_t sector, size_t nsectors) "req %p sector %"PRIu64" nsectors %zu"
 virtio_blk_handle_read(void *req, uint64_t sector, size_t nsectors) "req %p sector %"PRIu64" nsectors %zu"
 
-# hw/dataplane/virtio-blk.c
+# hw/block/dataplane/virtio-blk.c
 virtio_blk_data_plane_start(void *s) "dataplane %p"
 virtio_blk_data_plane_stop(void *s) "dataplane %p"
 virtio_blk_data_plane_process_request(void *s, unsigned int out_num, unsigned int in_num, unsigned int head) "dataplane %p out_num %u in_num %u head %u"
 virtio_blk_data_plane_complete_request(void *s, unsigned int head, int ret) "dataplane %p head %u ret %d"
 
-# hw/dataplane/vring.c
+# hw/virtio/dataplane/vring.c
 vring_setup(uint64_t physical, void *desc, void *avail, void *used) "vring physical %#"PRIx64" desc %p avail %p used %p"
 
 # thread-pool.c
@@ -127,7 +125,8 @@ thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %
 thread_pool_complete(void *pool, void *req, void *opaque, int ret) "pool %p req %p opaque %p ret %d"
 thread_pool_cancel(void *req, void *opaque) "req %p opaque %p"
 
-# posix-aio-compat.c
+# block/raw-win32.c
+# block/raw-posix.c
 paio_submit(void *acb, void *opaque, int64_t sector_num, int nb_sectors, int type) "acb %p opaque %p sector_num %"PRId64" nb_sectors %d type %d"
 
 # ioport.c
@@ -138,29 +137,31 @@ cpu_out(unsigned int addr, unsigned int val) "addr %#x value %u"
 # Since requests are raised via monitor, not many tracepoints are needed.
 balloon_event(void *opaque, unsigned long addr) "opaque %p addr %lu"
 
-# hw/apic.c
-apic_local_deliver(int vector, uint32_t lvt) "vector %d delivery mode %d"
-apic_deliver_irq(uint8_t dest, uint8_t dest_mode, uint8_t delivery_mode, uint8_t vector_num, uint8_t trigger_mode) "dest %d dest_mode %d delivery_mode %d vector %d trigger_mode %d"
+# hw/intc/apic_common.c
 cpu_set_apic_base(uint64_t val) "%016"PRIx64
 cpu_get_apic_base(uint64_t val) "%016"PRIx64
-apic_mem_readl(uint64_t addr, uint32_t val)  "%"PRIx64" = %08x"
-apic_mem_writel(uint64_t addr, uint32_t val) "%"PRIx64" = %08x"
 # coalescing
 apic_report_irq_delivered(int apic_irq_delivered) "coalescing %d"
 apic_reset_irq_delivered(int apic_irq_delivered) "old coalescing %d"
 apic_get_irq_delivered(int apic_irq_delivered) "returning coalescing %d"
 
-# hw/cs4231.c
+# hw/intc/apic.c
+apic_local_deliver(int vector, uint32_t lvt) "vector %d delivery mode %d"
+apic_deliver_irq(uint8_t dest, uint8_t dest_mode, uint8_t delivery_mode, uint8_t vector_num, uint8_t trigger_mode) "dest %d dest_mode %d delivery_mode %d vector %d trigger_mode %d"
+apic_mem_readl(uint64_t addr, uint32_t val)  "%"PRIx64" = %08x"
+apic_mem_writel(uint64_t addr, uint32_t val) "%"PRIx64" = %08x"
+
+# hw/audio/cs4231.c
 cs4231_mem_readl_dreg(uint32_t reg, uint32_t ret) "read dreg %d: 0x%02x"
 cs4231_mem_readl_reg(uint32_t reg, uint32_t ret) "read reg %d: 0x%08x"
 cs4231_mem_writel_reg(uint32_t reg, uint32_t old, uint32_t val) "write reg %d: 0x%08x -> 0x%08x"
 cs4231_mem_writel_dreg(uint32_t reg, uint32_t old, uint32_t val) "write dreg %d: 0x%02x -> 0x%02x"
 
-# hw/ds1225y.c
+# hw/nvram/ds1225y.c
 nvram_read(uint32_t addr, uint32_t ret) "read addr %d: 0x%02x"
 nvram_write(uint32_t addr, uint32_t old, uint32_t val) "write addr %d: 0x%02x -> 0x%02x"
 
-# hw/eccmemctl.c
+# hw/misc/eccmemctl.c
 ecc_mem_writel_mer(uint32_t val) "Write memory enable %08x"
 ecc_mem_writel_mdr(uint32_t val) "Write memory delay %08x"
 ecc_mem_writel_mfsr(uint32_t val) "Write memory fault status %08x"
@@ -180,26 +181,26 @@ ecc_mem_readl_ecr1(uint32_t ret) "Read event count 2 %08x"
 ecc_diag_mem_writeb(uint64_t addr, uint32_t val) "Write diagnostic %"PRId64" = %02x"
 ecc_diag_mem_readb(uint64_t addr, uint32_t ret) "Read diagnostic %"PRId64"= %02x"
 
-# hw/fw_cfg.c
+# hw/nvram/fw_cfg.c
 fw_cfg_write(void *s, uint8_t value) "%p %d"
 fw_cfg_select(void *s, uint16_t key, int ret) "%p key %d = %d"
 fw_cfg_read(void *s, uint8_t ret) "%p = %d"
 fw_cfg_add_file_dupe(void *s, char *name) "%p %s"
 fw_cfg_add_file(void *s, int index, char *name, size_t len) "%p #%d: %s (%zd bytes)"
 
-# hw/hd-geometry.c
+# hw/block/hd-geometry.c
 hd_geometry_lchs_guess(void *bs, int cyls, int heads, int secs) "bs %p LCHS %d %d %d"
 hd_geometry_guess(void *bs, uint32_t cyls, uint32_t heads, uint32_t secs, int trans) "bs %p CHS %u %u %u trans %d"
 
-# hw/jazz-led.c
+# hw/display/jazz_led.c
 jazz_led_read(uint64_t addr, uint8_t val) "read addr=0x%"PRIx64": 0x%x"
 jazz_led_write(uint64_t addr, uint8_t new) "write addr=0x%"PRIx64": 0x%x"
 
-# hw/lance.c
+# hw/net/lance.c
 lance_mem_readw(uint64_t addr, uint32_t ret) "addr=%"PRIx64"val=0x%04x"
 lance_mem_writew(uint64_t addr, uint32_t val) "addr=%"PRIx64"val=0x%04x"
 
-# hw/slavio_intctl.c
+# hw/intc/slavio_intctl.c
 slavio_intctl_mem_readl(uint32_t cpu, uint64_t addr, uint32_t ret) "read cpu %d reg 0x%"PRIx64" = %x"
 slavio_intctl_mem_writel(uint32_t cpu, uint64_t addr, uint32_t val) "write cpu %d reg 0x%"PRIx64" = %x"
 slavio_intctl_mem_writel_clear(uint32_t cpu, uint32_t val, uint32_t intreg_pending) "Cleared cpu %d irq mask %x, curmask %x"
@@ -213,7 +214,7 @@ slavio_check_interrupts(uint32_t pending, uint32_t intregm_disabled) "pending %x
 slavio_set_irq(uint32_t target_cpu, int irq, uint32_t pil, int level) "Set cpu %d irq %d -> pil %d level %d"
 slavio_set_timer_irq_cpu(int cpu, int level) "Set cpu %d local timer level %d"
 
-# hw/slavio_misc.c
+# hw/misc/slavio_misc.c
 slavio_misc_update_irq_raise(void) "Raise IRQ"
 slavio_misc_update_irq_lower(void) "Lower IRQ"
 slavio_set_power_fail(int power_failing, uint8_t config) "Power fail: %d, config: %d"
@@ -234,7 +235,7 @@ slavio_sysctrl_mem_readl(uint32_t ret) "Read system control %08x"
 slavio_led_mem_writew(uint32_t val) "Write diagnostic LED %04x"
 slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED %04x"
 
-# hw/slavio_timer.c
+# hw/timer/slavio_timer.c
 slavio_timer_get_out(uint64_t limit, uint32_t counthigh, uint32_t count) "limit %"PRIx64" count %x%08x"
 slavio_timer_irq(uint32_t counthigh, uint32_t count) "callback: count %x%08x"
 slavio_timer_mem_readl_invalid(uint64_t addr) "invalid read address %"PRIx64
@@ -249,7 +250,7 @@ slavio_timer_mem_writel_mode_counter(unsigned int timer_index) "processor %d cha
 slavio_timer_mem_writel_mode_invalid(void) "not system timer"
 slavio_timer_mem_writel_invalid(uint64_t addr) "invalid write address %"PRIx64
 
-# hw/sparc32_dma.c
+# hw/dma/sparc32_dma.c
 ledma_memory_read(uint64_t addr) "DMA read addr 0x%"PRIx64
 ledma_memory_write(uint64_t addr) "DMA write addr 0x%"PRIx64
 sparc32_dma_set_irq_raise(void) "Raise IRQ"
@@ -261,13 +262,13 @@ sparc32_dma_mem_writel(uint64_t addr, uint32_t old, uint32_t val) "write dmareg
 sparc32_dma_enable_raise(void) "Raise DMA enable"
 sparc32_dma_enable_lower(void) "Lower DMA enable"
 
-# hw/sun4m.c
+# hw/sparc/sun4m.c
 sun4m_cpu_interrupt(unsigned int level) "Set CPU IRQ %d"
 sun4m_cpu_reset_interrupt(unsigned int level) "Reset CPU IRQ %d"
 sun4m_cpu_set_irq_raise(int level) "Raise CPU IRQ %d"
 sun4m_cpu_set_irq_lower(int level) "Lower CPU IRQ %d"
 
-# hw/sun4m_iommu.c
+# hw/dma/sun4m_iommu.c
 sun4m_iommu_mem_readl(uint64_t addr, uint32_t ret) "read reg[%"PRIx64"] = %x"
 sun4m_iommu_mem_writel(uint64_t addr, uint32_t val) "write reg[%"PRIx64"] = %x"
 sun4m_iommu_mem_writel_ctrl(uint64_t iostart) "iostart = %"PRIx64
@@ -425,6 +426,7 @@ usb_uas_tmf_logical_unit_reset(int addr, uint16_t tag, int lun) "dev %d, tag 0x%
 usb_uas_tmf_unsupported(int addr, uint16_t tag, uint32_t function) "dev %d, tag 0x%x, function 0x%x"
 
 # hw/usb/host-linux.c
+# hw/usb/host-libusb.c
 usb_host_open_started(int bus, int addr) "dev %d:%d"
 usb_host_open_success(int bus, int addr) "dev %d:%d"
 usb_host_open_failure(int bus, int addr) "dev %d:%d"
@@ -464,7 +466,7 @@ usb_host_parse_endpoint(int bus, int addr, int ep, const char *dir, const char *
 usb_host_parse_unknown(int bus, int addr, int len, int type) "dev %d:%d, len %d, type %d"
 usb_host_parse_error(int bus, int addr, const char *errmsg) "dev %d:%d, msg %s"
 
-# hw/scsi-bus.c
+# hw/scsi/scsi-bus.c
 scsi_req_alloc(int target, int lun, int tag) "target %d lun %d tag %d"
 scsi_req_cancel(int target, int lun, int tag) "target %d lun %d tag %d"
 scsi_req_data(int target, int lun, int tag, int len) "target %d lun %d tag %d len %d"
@@ -486,6 +488,9 @@ scsi_request_sense(int target, int lun, int tag) "target %d lun %d tag %d"
 vm_state_notify(int running, int reason) "running %d reason %d"
 load_file(const char *name, const char *path) "name %s location %s"
 runstate_set(int new_state) "new state %d"
+g_malloc(size_t size, void *ptr) "size %zu ptr %p"
+g_realloc(void *ptr, size_t size, void *newptr) "ptr %p size %zu newptr %p"
+g_free(void *ptr) "ptr %p"
 
 # block/qcow2.c
 qcow2_writev_start_req(void *co, int64_t sector, int nb_sectors) "co %p sector %" PRIx64 " nb_sectors %d"
@@ -494,6 +499,7 @@ qcow2_writev_start_part(void *co) "co %p"
 qcow2_writev_done_part(void *co, int cur_nr_sectors) "co %p cur_nr_sectors %d"
 qcow2_writev_data(void *co, uint64_t offset) "co %p offset %" PRIx64
 
+# block/qcow2-cluster.c
 qcow2_alloc_clusters_offset(void *co, uint64_t offset, int n_start, int n_end) "co %p offet %" PRIx64 " n_start %d n_end %d"
 qcow2_handle_copied(void *co, uint64_t guest_offset, uint64_t host_offset, uint64_t bytes) "co %p guest_offet %" PRIx64 " host_offset %" PRIx64 " bytes %" PRIx64
 qcow2_handle_alloc(void *co, uint64_t guest_offset, uint64_t host_offset, uint64_t bytes) "co %p guest_offet %" PRIx64 " host_offset %" PRIx64 " bytes %" PRIx64
@@ -507,6 +513,7 @@ qcow2_l2_allocate_write_l2(void *bs, int l1_index) "bs %p l1_index %d"
 qcow2_l2_allocate_write_l1(void *bs, int l1_index) "bs %p l1_index %d"
 qcow2_l2_allocate_done(void *bs, int l1_index, int ret) "bs %p l1_index %d ret %d"
 
+# block/qcow2-cache.c
 qcow2_cache_get(void *co, int c, uint64_t offset, bool read_from_disk) "co %p is_l2_cache %d offset %" PRIx64 " read_from_disk %d"
 qcow2_cache_get_replace_entry(void *co, int c, int i) "co %p is_l2_cache %d index %d"
 qcow2_cache_get_read(void *co, int c, int i) "co %p is_l2_cache %d index %d"
@@ -538,11 +545,11 @@ qed_aio_write_prefill(void *s, void *acb, uint64_t start, size_t len, uint64_t o
 qed_aio_write_postfill(void *s, void *acb, uint64_t start, size_t len, uint64_t offset) "s %p acb %p start %"PRIu64" len %zu offset %"PRIu64
 qed_aio_write_main(void *s, void *acb, int ret, uint64_t offset, size_t len) "s %p acb %p ret %d offset %"PRIu64" len %zu"
 
-# hw/g364fb.c
+# hw/display/g364fb.c
 g364fb_read(uint64_t addr, uint32_t val) "read addr=0x%"PRIx64": 0x%x"
 g364fb_write(uint64_t addr, uint32_t new) "write addr=0x%"PRIx64": 0x%x"
 
-# hw/grlib_gptimer.c
+# hw/timer/grlib_gptimer.c
 grlib_gptimer_enable(int id, uint32_t count) "timer:%d set count 0x%x and run"
 grlib_gptimer_disabled(int id, uint32_t config) "timer:%d Timer disable config 0x%x"
 grlib_gptimer_restart(int id, uint32_t reload) "timer:%d reload val: 0x%x"
@@ -551,19 +558,19 @@ grlib_gptimer_hit(int id) "timer:%d HIT"
 grlib_gptimer_readl(int id, uint64_t addr, uint32_t val) "timer:%d addr 0x%"PRIx64" 0x%x"
 grlib_gptimer_writel(int id, uint64_t addr, uint32_t val) "timer:%d addr 0x%"PRIx64" 0x%x"
 
-# hw/grlib_irqmp.c
+# hw/intc/grlib_irqmp.c
 grlib_irqmp_check_irqs(uint32_t pend, uint32_t force, uint32_t mask, uint32_t lvl1, uint32_t lvl2) "pend:0x%04x force:0x%04x mask:0x%04x lvl1:0x%04x lvl0:0x%04x"
 grlib_irqmp_ack(int intno) "interrupt:%d"
 grlib_irqmp_set_irq(int irq) "Raise CPU IRQ %d"
 grlib_irqmp_readl_unknown(uint64_t addr) "addr 0x%"PRIx64
 grlib_irqmp_writel_unknown(uint64_t addr, uint32_t value) "addr 0x%"PRIx64" value 0x%x"
 
-# hw/grlib_apbuart.c
+# hw/char/grlib_apbuart.c
 grlib_apbuart_event(int event) "event:%d"
 grlib_apbuart_writel_unknown(uint64_t addr, uint32_t value) "addr 0x%"PRIx64" value 0x%x"
 grlib_apbuart_readl_unknown(uint64_t addr) "addr 0x%"PRIx64""
 
-# hw/leon3.c
+# hw/sparc/leon3.c
 leon3_set_irq(int intno) "Set CPU IRQ %d"
 leon3_reset_irq(int intno) "Reset CPU IRQ %d"
 
@@ -574,7 +581,7 @@ spice_vmc_register_interface(void *scd) "spice vmc registered interface %p"
 spice_vmc_unregister_interface(void *scd) "spice vmc unregistered interface %p"
 spice_vmc_event(int event) "spice vmc event %d"
 
-# hw/lm32_pic.c
+# hw/intc/lm32_pic.c
 lm32_pic_raise_irq(void) "Raise CPU interrupt"
 lm32_pic_lower_irq(void) "Lower CPU interrupt"
 lm32_pic_interrupt(int irq, int level) "Set IRQ%d %d"
@@ -583,27 +590,27 @@ lm32_pic_set_ip(uint32_t ip) "ip 0x%08x"
 lm32_pic_get_im(uint32_t im) "im 0x%08x"
 lm32_pic_get_ip(uint32_t ip) "ip 0x%08x"
 
-# hw/lm32_juart.c
+# hw/char/lm32_juart.c
 lm32_juart_get_jtx(uint32_t value) "jtx 0x%08x"
 lm32_juart_set_jtx(uint32_t value) "jtx 0x%08x"
 lm32_juart_get_jrx(uint32_t value) "jrx 0x%08x"
 lm32_juart_set_jrx(uint32_t value) "jrx 0x%08x"
 
-# hw/lm32_timer.c
+# hw/timer/lm32_timer.c
 lm32_timer_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 lm32_timer_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 lm32_timer_hit(void) "timer hit"
 lm32_timer_irq_state(int level) "irq state %d"
 
-# hw/lm32_uart.c
+# hw/char/lm32_uart.c
 lm32_uart_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 lm32_uart_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 lm32_uart_irq_state(int level) "irq state %d"
 
-# hw/lm32_sys.c
+# hw/misc/lm32_sys.c
 lm32_sys_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 
-# hw/megasas.c
+# hw/scsi/megasas.c
 megasas_init_firmware(uint64_t pa) "pa %" PRIx64 " "
 megasas_init_queue(uint64_t queue_pa, int queue_len, uint64_t head, uint64_t tail, uint32_t flags) "queue at %" PRIx64 " len %d head %" PRIx64 " tail %" PRIx64 " flags %x"
 megasas_initq_map_failed(int frame) "scmd %d: failed to map queue"
@@ -677,7 +684,7 @@ megasas_mmio_invalid_readl(unsigned long addr) "addr 0x%lx"
 megasas_mmio_writel(uint32_t addr, uint32_t val) "addr 0x%x: 0x%x"
 megasas_mmio_invalid_writel(uint32_t addr, uint32_t val) "addr 0x%x: 0x%x"
 
-# hw/milkymist-ac97.c
+# hw/audio/milkymist-ac97.c
 milkymist_ac97_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_ac97_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_ac97_pulse_irq_crrequest(void) "Pulse IRQ CR request"
@@ -689,15 +696,15 @@ milkymist_ac97_in_cb_transferred(int transferred) "transferred %d"
 milkymist_ac97_out_cb(int free, uint32_t remaining) "free %d remaining %u"
 milkymist_ac97_out_cb_transferred(int transferred) "transferred %d"
 
-# hw/milkymist-hpdmc.c
+# hw/misc/milkymist-hpdmc.c
 milkymist_hpdmc_memory_read(uint32_t addr, uint32_t value) "addr=%08x value=%08x"
 milkymist_hpdmc_memory_write(uint32_t addr, uint32_t value) "addr=%08x value=%08x"
 
-# hw/milkymist-memcard.c
+# hw/sd/milkymist-memcard.c
 milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 
-# hw/milkymist-minimac2.c
+# hw/net/milkymist-minimac2.c
 milkymist_minimac2_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_minimac2_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_minimac2_mdio_write(uint8_t phy_addr, uint8_t addr, uint16_t value) "phy_addr %02x addr %02x value %04x"
@@ -710,20 +717,20 @@ milkymist_minimac2_raise_irq_rx(void) "Raise IRQ RX"
 milkymist_minimac2_lower_irq_rx(void) "Lower IRQ RX"
 milkymist_minimac2_pulse_irq_tx(void) "Pulse IRQ TX"
 
-# hw/milkymist-pfpu.c
+# hw/misc/milkymist-pfpu.c
 milkymist_pfpu_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_pfpu_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_pfpu_vectout(uint32_t a, uint32_t b, uint32_t dma_ptr) "a %08x b %08x dma_ptr %08x"
 milkymist_pfpu_pulse_irq(void) "Pulse IRQ"
 
-# hw/milkymist-softusb.c
+# hw/input/milkymist-softusb.c
 milkymist_softusb_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_softusb_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_softusb_mevt(uint8_t m) "m %d"
 milkymist_softusb_kevt(uint8_t m) "m %d"
 milkymist_softusb_pulse_irq(void) "Pulse IRQ"
 
-# hw/milkymist-sysctl.c
+# hw/timer/milkymist-sysctl.c
 milkymist_sysctl_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_sysctl_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_sysctl_icap_write(uint32_t value) "value %08x"
@@ -734,30 +741,30 @@ milkymist_sysctl_stop_timer1(void) "Stop timer1"
 milkymist_sysctl_pulse_irq_timer0(void) "Pulse IRQ Timer0"
 milkymist_sysctl_pulse_irq_timer1(void) "Pulse IRQ Timer1"
 
-# hw/milkymist-tmu2.c
+# hw/display/milkymist-tmu2.c
 milkymist_tmu2_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_tmu2_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_tmu2_start(void) "Start TMU"
 milkymist_tmu2_pulse_irq(void) "Pulse IRQ"
 
-# hw/milkymist-uart.c
+# hw/char/milkymist-uart.c
 milkymist_uart_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_uart_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_uart_raise_irq(void) "Raise IRQ"
 milkymist_uart_lower_irq(void) "Lower IRQ"
 
-# hw/milkymist-vgafb.c
+# hw/display/milkymist-vgafb.c
 milkymist_vgafb_memory_read(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_vgafb_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 
-# hw/mipsnet.c
+# hw/net/mipsnet.c
 mipsnet_send(uint32_t size) "sending len=%u"
 mipsnet_receive(uint32_t size) "receiving len=%u"
 mipsnet_read(uint64_t addr, uint32_t val) "read addr=0x%" PRIx64 " val=0x%x"
 mipsnet_write(uint64_t addr, uint64_t val) "write addr=0x%" PRIx64 " val=0x%" PRIx64 ""
 mipsnet_irq(uint32_t isr, uint32_t intctl) "set irq to %d (%02x)"
 
-# hw/pc87312.c
+# hw/isa/pc87312.c
 pc87312_io_read(uint32_t addr, uint32_t val) "read addr=%x val=%x"
 pc87312_io_write(uint32_t addr, uint32_t val) "write addr=%x val=%x"
 pc87312_info_floppy(uint32_t base) "base 0x%x"
@@ -809,7 +816,7 @@ xen_map_cache(uint64_t phys_addr) "want %#"PRIx64
 xen_remap_bucket(uint64_t index) "index %#"PRIx64
 xen_map_cache_return(void* ptr) "%p"
 
-# hw/xen_platform.c
+# hw/xen/xen_platform.c
 xen_platform_log(char *s) "xen platform: %s"
 
 # qemu-coroutine.c
@@ -825,7 +832,7 @@ qemu_co_mutex_lock_return(void *mutex, void *self) "mutex %p self %p"
 qemu_co_mutex_unlock_entry(void *mutex, void *self) "mutex %p self %p"
 qemu_co_mutex_unlock_return(void *mutex, void *self) "mutex %p self %p"
 
-# hw/escc.c
+# hw/char/escc.c
 escc_put_queue(char channel, int b) "channel %c put: 0x%02x"
 escc_get_queue(char channel, int val) "channel %c get 0x%02x"
 escc_update_irq(int irq) "IRQ = %d"
@@ -846,7 +853,7 @@ iscsi_aio_writev(void *iscsi, int64_t sector_num, int nb_sectors, void *opaque,
 iscsi_aio_read16_cb(void *iscsi, int status, void *acb, int canceled) "iscsi %p status %d acb %p canceled %d"
 iscsi_aio_readv(void *iscsi, int64_t sector_num, int nb_sectors, void *opaque, void *acb) "iscsi %p sector_num %"PRId64" nb_sectors %d opaque %p acb %p"
 
-# hw/esp.c
+# hw/scsi/esp.c
 esp_error_fifo_overrun(void) "FIFO overrun"
 esp_error_unhandled_command(uint32_t val) "unhandled command (%2.2x)"
 esp_error_invalid_write(uint32_t val, uint32_t addr) "invalid write of 0x%02x at [0x%x]"
@@ -881,6 +888,8 @@ esp_mem_writeb_cmd_selatn(uint32_t val) "Select with ATN (%2.2x)"
 esp_mem_writeb_cmd_selatns(uint32_t val) "Select with ATN & stop (%2.2x)"
 esp_mem_writeb_cmd_ensel(uint32_t val) "Enable selection (%2.2x)"
 esp_mem_writeb_cmd_dissel(uint32_t val) "Disable selection (%2.2x)"
+
+# hw/scsi/esp-pci.c
 esp_pci_error_invalid_dma_direction(void) "invalid DMA transfer direction"
 esp_pci_error_invalid_read(uint32_t reg) "read access outside bounds (reg 0x%x)"
 esp_pci_error_invalid_write(uint32_t reg) "write access outside bounds (reg 0x%x)"
@@ -903,7 +912,7 @@ monitor_protocol_event_emit(uint32_t event, void *data) "event=%d data=%p"
 monitor_protocol_event_queue(uint32_t event, void *data, uint64_t rate, uint64_t last, uint64_t now) "event=%d data=%p rate=%" PRId64 " last=%" PRId64 " now=%" PRId64
 monitor_protocol_event_throttle(uint32_t event, uint64_t rate) "event=%d rate=%" PRId64
 
-# hw/opencores_eth.c
+# hw/net/opencores_eth.c
 open_eth_mii_write(unsigned idx, uint16_t v) "MII[%02x] <- %04x"
 open_eth_mii_read(unsigned idx, uint16_t v) "MII[%02x] -> %04x"
 open_eth_update_irq(uint32_t v) "IRQ <- %x"
@@ -973,10 +982,12 @@ mmu_helper_get_phys_addr_code(uint32_t tl, int mmu_idx, uint64_t prim_context, u
 mmu_helper_get_phys_addr_data(uint32_t tl, int mmu_idx, uint64_t prim_context, uint64_t sec_context, uint64_t address) "tl=%d mmu_idx=%d primary context=%"PRIx64" secondary context=%"PRIx64" address=%"PRIx64""
 mmu_helper_mmu_fault(uint64_t address, uint64_t paddr, int mmu_idx, uint32_t tl, uint64_t prim_context, uint64_t sec_context) "Translate at %"PRIx64" -> %"PRIx64", mmu_idx=%d tl=%d primary context=%"PRIx64" secondary context=%"PRIx64""
 
-# target-sparc/int_helper.c
+# target-sparc/int64_helper.c
 int_helper_set_softint(uint32_t softint) "new %08x"
 int_helper_clear_softint(uint32_t softint) "new %08x"
 int_helper_write_softint(uint32_t softint) "new %08x"
+
+# target-sparc/int32_helper.c
 int_helper_icache_freeze(void) "Instruction cache: freeze"
 int_helper_dcache_freeze(void) "Data cache: freeze"
 
@@ -995,7 +1006,7 @@ dma_complete(void *dbs, int ret, void *cb) "dbs=%p ret=%d cb=%p"
 dma_bdrv_cb(void *dbs, int ret) "dbs=%p ret=%d"
 dma_map_wait(void *dbs) "dbs=%p"
 
-# console.h
+# ui/console.c
 console_gfx_new(void) ""
 console_txt_new(int w, int h) "%dx%d"
 console_select(int nr) "%d"
@@ -1005,9 +1016,9 @@ displaysurface_create_from(void *display_surface, int w, int h, int bpp, int swa
 displaysurface_free(void *display_surface) "surface=%p"
 displaychangelistener_register(void *dcl, const char *name) "%p [ %s ]"
 displaychangelistener_unregister(void *dcl, const char *name) "%p [ %s ]"
-
-# vga.c
 ppm_save(const char *filename, void *display_surface) "%s surface=%p"
+
+# hw/display/vmware_vga.c
 vmware_value_read(uint32_t index, uint32_t value) "index %d, value 0x%x"
 vmware_value_write(uint32_t index, uint32_t value) "index %d, value 0x%x"
 vmware_palette_read(uint32_t index, uint32_t value) "index %d, value 0x%x"
@@ -1017,7 +1028,6 @@ vmware_scratch_write(uint32_t index, uint32_t value) "index %d, value 0x%x"
 vmware_setmode(uint32_t w, uint32_t h, uint32_t bpp) "%dx%d @ %d bpp"
 
 # savevm.c
-
 savevm_section_start(void) ""
 savevm_section_end(unsigned int section_id) "section_id %u"
 
@@ -1026,7 +1036,7 @@ migration_bitmap_sync_start(void) ""
 migration_bitmap_sync_end(uint64_t dirty_pages) "dirty_pages %" PRIu64""
 migration_throttle(void) ""
 
-# hw/qxl.c
+# hw/display/qxl.c
 disable qxl_interface_set_mm_time(int qid, uint32_t mm_time) "%d %d"
 disable qxl_io_write_vga(int qid, const char *mode, uint32_t addr, uint32_t val) "%d %s addr=%u val=%u"
 qxl_create_guest_primary(int qid, uint32_t width, uint32_t height, uint64_t mem, uint32_t format, uint32_t position) "%d %ux%u mem=%" PRIx64 " %u,%u"
@@ -1064,12 +1074,6 @@ qxl_ring_res_push_rest(int qid, uint32_t ring_has, uint32_t ring_size, uint32_t
 qxl_ring_res_put(int qid, uint32_t free_res) "%d #res=%d"
 qxl_set_mode(int qid, int modenr, uint32_t x_res, uint32_t y_res, uint32_t bits, uint64_t devmem) "%d mode=%d [ x=%d y=%d @ bpp=%d devmem=0x%" PRIx64 " ]"
 qxl_soft_reset(int qid) "%d"
-qemu_spice_add_memslot(int qid, uint32_t slot_id, unsigned long virt_start, unsigned long virt_end, int async) "%d %u: host virt 0x%lx - 0x%lx async=%d"
-qemu_spice_del_memslot(int qid, uint32_t gid, uint32_t slot_id) "%d gid=%u sid=%u"
-qemu_spice_create_primary_surface(int qid, uint32_t sid, void *surface, int async) "%d sid=%u surface=%p async=%d"
-qemu_spice_destroy_primary_surface(int qid, uint32_t sid, int async) "%d sid=%u async=%d"
-qemu_spice_wakeup(uint32_t qid) "%d"
-qemu_spice_create_update(uint32_t left, uint32_t right, uint32_t top, uint32_t bottom) "lr %d -> %d,  tb -> %d -> %d"
 qxl_spice_destroy_surfaces_complete(int qid) "%d"
 qxl_spice_destroy_surfaces(int qid, int async) "%d async=%d"
 qxl_spice_destroy_surface_wait_complete(int qid, uint32_t id) "%d sid=%d"
@@ -1094,13 +1098,21 @@ qxl_client_monitors_config_capped(int qid, int requested, int limit) "%d %d %d"
 qxl_client_monitors_config_crc(int qid, unsigned size, uint32_t crc32) "%d %u %u"
 qxl_set_client_capabilities_unsupported_by_revision(int qid, int revision) "%d revision=%d"
 
-# hw/qxl-render.c
+# ui/spice-display.c
+qemu_spice_add_memslot(int qid, uint32_t slot_id, unsigned long virt_start, unsigned long virt_end, int async) "%d %u: host virt 0x%lx - 0x%lx async=%d"
+qemu_spice_del_memslot(int qid, uint32_t gid, uint32_t slot_id) "%d gid=%u sid=%u"
+qemu_spice_create_primary_surface(int qid, uint32_t sid, void *surface, int async) "%d sid=%u surface=%p async=%d"
+qemu_spice_destroy_primary_surface(int qid, uint32_t sid, int async) "%d sid=%u async=%d"
+qemu_spice_wakeup(uint32_t qid) "%d"
+qemu_spice_create_update(uint32_t left, uint32_t right, uint32_t top, uint32_t bottom) "lr %d -> %d,  tb -> %d -> %d"
+
+# hw/display/qxl-render.c
 qxl_render_blit_guest_primary_initialized(void) ""
 qxl_render_blit(int32_t stride, int32_t left, int32_t right, int32_t top, int32_t bottom) "stride=%d [%d, %d, %d, %d]"
 qxl_render_guest_primary_resized(int32_t width, int32_t height, int32_t stride, int32_t bytes_pp, int32_t bits_pp) "%dx%d, stride %d, bpp %d, depth %d"
 qxl_render_update_area_done(void *cookie) "%p"
 
-# hw/spapr_pci.c
+# hw/ppc/spapr_pci.c
 spapr_pci_msi(const char *msg, uint32_t n, uint32_t ca) "%s (device#%d, cfg=%x)"
 spapr_pci_msi_setup(const char *name, unsigned vector, uint64_t addr) "dev\"%s\" vector %u, addr=%"PRIx64
 spapr_pci_rtas_ibm_change_msi(unsigned func, unsigned req) "func %u, requested %u"
@@ -1108,7 +1120,7 @@ spapr_pci_rtas_ibm_query_interrupt_source_number(unsigned ioa, unsigned intr) "q
 spapr_pci_msi_write(uint64_t addr, uint64_t data, uint32_t dt_irq) "@%"PRIx64"<=%"PRIx64" IRQ %u"
 spapr_pci_lsi_set(const char *busname, int pin, uint32_t irq) "%s PIN%d IRQ %u"
 
-# hw/xics.c
+# hw/ppc/xics.c
 xics_icp_check_ipi(int server, uint8_t mfrr) "CPU %d can take IPI mfrr=%#x"
 xics_icp_accept(uint32_t old_xirr, uint32_t new_xirr) "icp_accept: XIRR %#"PRIx32"->%#"PRIx32
 xics_icp_eoi(int server, uint32_t xirr, uint32_t new_xirr) "icp_eoi: server %d given XIRR %#"PRIx32" new XIRR %#"PRIx32
@@ -1121,7 +1133,7 @@ xics_ics_write_xive(int nr, int srcno, int server, uint8_t priority) "ics_write_
 xics_ics_reject(int nr, int srcno) "reject irq %#x [src %d]"
 xics_ics_eoi(int nr) "ics_eoi: irq %#x"
 
-# hbitmap.c
+# util/hbitmap.c
 hbitmap_iter_skip_words(const void *hb, void *hbi, uint64_t pos, unsigned long cur) "hb %p hbi %p pos %"PRId64" cur 0x%lx"
 hbitmap_reset(void *hb, uint64_t start, uint64_t count, uint64_t sbit, uint64_t ebit) "hb %p items %"PRIu64",%"PRIu64" bits %"PRIu64"..%"PRIu64
 hbitmap_set(void *hb, uint64_t start, uint64_t count, uint64_t sbit, uint64_t ebit) "hb %p items %"PRIu64",%"PRIu64" bits %"PRIu64"..%"PRIu64
commit 3ae76d23d21a1f47390c6abe3497c33b708aec1f
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jun 7 12:59:20 2013 +0200

    trace-events: Drop unused events
    
    Dropped event                           Unused since
    mirror_cow                              884fea4
    paio_complete                           47e6b25
    paio_cancel                             47e6b25
    usb_ehci_data                           0ce668b
    megasas_qf_dequeue                      never used
    megasas_handle_frame                    never used
    megasas_io_continue                     never used
    megasas_iovec_map_failed                never used
    megasas_dcmd_map_failed                 never used
    milkymist_softusb_mouse_event           4c15ba9
    xen_map_block                           6506e4f
    xen_unmap_block                         6506e4f
    qemu_spice_start                        67be672
    qemu_spice_stop                         67be672
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/trace-events b/trace-events
index 7f6d962..cc21258 100644
--- a/trace-events
+++ b/trace-events
@@ -85,7 +85,6 @@ mirror_before_flush(void *s) "s %p"
 mirror_before_drain(void *s, int64_t cnt) "s %p dirty count %"PRId64
 mirror_before_sleep(void *s, int64_t cnt, int synced) "s %p dirty count %"PRId64" synced %d"
 mirror_one_iteration(void *s, int64_t sector_num, int nb_sectors) "s %p sector_num %"PRId64" nb_sectors %d"
-mirror_cow(void *s, int64_t sector_num) "s %p sector_num %"PRId64
 mirror_iteration_done(void *s, int64_t sector_num, int nb_sectors, int ret) "s %p sector_num %"PRId64" nb_sectors %d ret %d"
 mirror_yield(void *s, int64_t cnt, int buf_free_count, int in_flight) "s %p dirty count %"PRId64" free buffers %d in_flight %d"
 mirror_yield_in_flight(void *s, int64_t sector_num, int in_flight) "s %p sector_num %"PRId64" in_flight %d"
@@ -130,8 +129,6 @@ thread_pool_cancel(void *req, void *opaque) "req %p opaque %p"
 
 # posix-aio-compat.c
 paio_submit(void *acb, void *opaque, int64_t sector_num, int nb_sectors, int type) "acb %p opaque %p sector_num %"PRId64" nb_sectors %d type %d"
-paio_complete(void *acb, void *opaque, int ret) "acb %p opaque %p ret %d"
-paio_cancel(void *acb, void *opaque) "acb %p opaque %p"
 
 # ioport.c
 cpu_in(unsigned int addr, unsigned int val) "addr %#x value %u"
@@ -311,7 +308,6 @@ usb_ehci_sitd(uint32_t addr, uint32_t nxt, uint32_t active) "ITD @ %08x: next %0
 usb_ehci_port_attach(uint32_t port, const char *owner, const char *device) "attach port #%d, owner %s, device %s"
 usb_ehci_port_detach(uint32_t port, const char *owner) "detach port #%d, owner %s"
 usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
-usb_ehci_data(int rw, uint32_t cpage, uint32_t offset, uint32_t addr, uint32_t len, uint32_t bufpos) "write %d, cpage %d, offset 0x%03x, addr 0x%08x, len %d, bufpos %d"
 usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
 usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
 usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
@@ -617,11 +613,9 @@ megasas_qf_new(unsigned int index, void *cmd) "return new frame %x cmd %p"
 megasas_qf_failed(unsigned long pa) "all frames busy for frame %lx"
 megasas_qf_enqueue(unsigned int index, unsigned int count, uint64_t context, unsigned int tail, int busy) "enqueue frame %x count %d context %" PRIx64 " tail %x busy %d"
 megasas_qf_update(unsigned int head, unsigned int busy) "update reply queue head %x busy %d"
-megasas_qf_dequeue(unsigned int index) "dequeue frame %x"
 megasas_qf_map_failed(int cmd, unsigned long frame) "scmd %d: frame %lu"
 megasas_qf_complete_noirq(uint64_t context) "context %" PRIx64 " "
 megasas_qf_complete(uint64_t context, unsigned int tail, unsigned int offset, int busy, unsigned int doorbell) "context %" PRIx64 " tail %x offset %d busy %d doorbell %x"
-megasas_handle_frame(const char *cmd, uint64_t addr, uint64_t context, uint32_t count) "MFI cmd %s addr %" PRIx64 " context %" PRIx64 " count %d"
 megasas_frame_busy(uint64_t addr) "frame %" PRIx64 " busy"
 megasas_unhandled_frame_cmd(int cmd, uint8_t frame_cmd) "scmd %d: Unhandled MFI cmd %x"
 megasas_handle_scsi(const char *frame, int bus, int dev, int lun, void *sdev, unsigned long size) "%s dev %x/%x/%x sdev %p xfer %lu"
@@ -644,8 +638,6 @@ megasas_io_write_start(int cmd, unsigned long lba, unsigned long count, unsigned
 megasas_io_complete(int cmd, uint32_t len) "scmd %d: %d bytes completed"
 megasas_io_read(int cmd, int bytes, int len, unsigned long offset) "scmd %d: %d/%d bytes, iov offset %lu"
 megasas_io_write(int cmd, int bytes, int len, unsigned long offset) "scmd %d: %d/%d bytes, iov offset %lu"
-megasas_io_continue(int cmd, int bytes) "scmd %d: %d bytes left"
-megasas_iovec_map_failed(int cmd, int index, unsigned long iov_size) "scmd %d: iovec %d size %lu"
 megasas_iovec_sgl_overflow(int cmd, int index, int limit) "scmd %d: iovec count %d limit %d"
 megasas_iovec_sgl_underflow(int cmd, int index) "scmd %d: iovec count %d"
 megasas_iovec_sgl_invalid(int cmd, int index, uint64_t pa, uint32_t len) "scmd %d: element %d pa %" PRIx64 " len %u"
@@ -660,7 +652,6 @@ megasas_dcmd_internal_invalid(int cmd, int opcode) "scmd %d: Invalid internal DC
 megasas_dcmd_unhandled(int cmd, int opcode, int len) "scmd %d: opcode %x, len %d"
 megasas_dcmd_zero_sge(int cmd) "scmd %d: zero DCMD sge count"
 megasas_dcmd_invalid_sge(int cmd, int count) "scmd %d: invalid DCMD sge count %d"
-megasas_dcmd_map_failed(int cmd) "scmd %d: Failed to map DCMD buffer"
 megasas_dcmd_invalid_xfer_len(int cmd, unsigned long size, unsigned long max) "scmd %d: invalid xfer len %ld, max %ld"
 megasas_dcmd_enter(int cmd, const char *dcmd, int len) "scmd %d: DCMD %s len %d"
 megasas_dcmd_dummy(int cmd, unsigned long size) "scmd %d: DCMD dummy xfer len %ld"
@@ -730,7 +721,6 @@ milkymist_softusb_memory_read(uint32_t addr, uint32_t value) "addr %08x value %0
 milkymist_softusb_memory_write(uint32_t addr, uint32_t value) "addr %08x value %08x"
 milkymist_softusb_mevt(uint8_t m) "m %d"
 milkymist_softusb_kevt(uint8_t m) "m %d"
-milkymist_softusb_mouse_event(int dx, int dy, int dz, int bs) "dx %d dy %d dz %d bs %02x"
 milkymist_softusb_pulse_irq(void) "Pulse IRQ"
 
 # hw/milkymist-sysctl.c
@@ -818,8 +808,6 @@ xen_client_set_memory(uint64_t start_addr, unsigned long size, bool log_dirty) "
 xen_map_cache(uint64_t phys_addr) "want %#"PRIx64
 xen_remap_bucket(uint64_t index) "index %#"PRIx64
 xen_map_cache_return(void* ptr) "%p"
-xen_map_block(uint64_t phys_addr, uint64_t size) "%#"PRIx64", size %#"PRIx64
-xen_unmap_block(void* addr, unsigned long size) "%p, size %#lx"
 
 # hw/xen_platform.c
 xen_platform_log(char *s) "xen platform: %s"
@@ -1081,8 +1069,6 @@ qemu_spice_del_memslot(int qid, uint32_t gid, uint32_t slot_id) "%d gid=%u sid=%
 qemu_spice_create_primary_surface(int qid, uint32_t sid, void *surface, int async) "%d sid=%u surface=%p async=%d"
 qemu_spice_destroy_primary_surface(int qid, uint32_t sid, int async) "%d sid=%u async=%d"
 qemu_spice_wakeup(uint32_t qid) "%d"
-qemu_spice_start(uint32_t qid) "%d"
-qemu_spice_stop(uint32_t qid) "%d"
 qemu_spice_create_update(uint32_t left, uint32_t right, uint32_t top, uint32_t bottom) "lr %d -> %d,  tb -> %d -> %d"
 qxl_spice_destroy_surfaces_complete(int qid) "%d"
 qxl_spice_destroy_surfaces(int qid, int async) "%d async=%d"
commit 0ece9671fd22e3ea518aa30f941e8794116985e7
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jun 7 12:59:19 2013 +0200

    milkymist-minimac2: Fix minimac2_read/_write tracepoints
    
    Broken in milkymist-minimac.c from the start (commit 0742454),
    faithfully moved to milkymist-minimac2.c (commit 57aa265).
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/net/milkymist-minimac2.c b/hw/net/milkymist-minimac2.c
index 2ef4ac3..becd26c 100644
--- a/hw/net/milkymist-minimac2.c
+++ b/hw/net/milkymist-minimac2.c
@@ -355,7 +355,7 @@ minimac2_write(void *opaque, hwaddr addr, uint64_t value,
 {
     MilkymistMinimac2State *s = opaque;
 
-    trace_milkymist_minimac2_memory_read(addr, value);
+    trace_milkymist_minimac2_memory_write(addr, value);
 
     addr >>= 2;
     switch (addr) {
commit f3a64b8c89ac9b5111f97e2653d249e4668764b3
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jun 7 12:59:18 2013 +0200

    slavio_misc: Fix slavio_led_mem_readw/_writew tracepoints
    
    Broken since they got added in commit 97bf485.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index d274fb4..00d9542 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -368,7 +368,7 @@ static void slavio_led_mem_writew(void *opaque, hwaddr addr,
 {
     MiscState *s = opaque;
 
-    trace_slavio_led_mem_readw(val & 0xffff);
+    trace_slavio_led_mem_writew(val & 0xffff);
     switch (addr) {
     case 0:
         s->leds = val;
commit f0c03c8cf6184f25ba91449c1ff77e5e006ce514
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jun 7 12:59:17 2013 +0200

    cleanup-trace-events.pl: New
    
    Simple script to drop unused events and fix up source file comments.
    The next few commits put it to use.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/scripts/cleanup-trace-events.pl b/scripts/cleanup-trace-events.pl
new file mode 100755
index 0000000..cffbf16
--- /dev/null
+++ b/scripts/cleanup-trace-events.pl
@@ -0,0 +1,51 @@
+#!/usr/bin/perl
+# Copyright (C) 2013 Red Hat, Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru at redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+# Usage: cleanup-trace-events.pl trace-events
+#
+# Print cleaned up trace-events to standard output.
+
+use warnings;
+use strict;
+
+my $buf = '';
+my %seen = ();
+
+sub out {
+    print $buf;
+    $buf = '';
+    %seen = ();
+}
+
+while (<>) {
+    if (/^(disable )?([a-z_0-9]+)\(/) {
+        open GREP, '-|', 'git', 'grep', '-l', "trace_$2"
+            or die "run git grep: $!";
+        my $fname;
+        while ($fname = <GREP>) {
+            chomp $fname;
+            next if $seen{$fname} || $fname eq 'trace-events';
+            $seen{$fname} = 1;
+            $buf = "# $fname\n" . $buf;
+        }
+        unless (close GREP) {
+            die "close git grep: $!"
+                if $!;
+            next;
+        }
+    } elsif (/^# ([^ ]*\.[ch])$/) {
+        out;
+        next;
+    } elsif (!/^#|^$/) {
+        warn "unintelligible line";
+    }
+    $buf .= $_;
+}
+
+out;
commit f9b1d9b20f5d25b95f67a498e312f625d168fc51
Author: Amos Kong <akong at redhat.com>
Date:   Tue Jul 16 19:52:14 2013 +0800

    qmp: update send-key document
    
    commit 9f328977 changes qmp_send_key() to accept key codes in hex,
    but the document wasn't updated. The items of keys list is union
    now, not enum.
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/qmp-commands.hx b/qmp-commands.hx
index e075df4..b8e7758 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -346,7 +346,8 @@ Send keys to VM.
 Arguments:
 
 keys array:
-    - "key": key sequence (a json-array of key enum values)
+    - "key": key sequence (a json-array of key union values,
+             union can be number or qcode enum)
 
 - hold-time: time to delay key up events, milliseconds. Defaults to 100
              (json-int, optional)
@@ -354,7 +355,9 @@ keys array:
 Example:
 
 -> { "execute": "send-key",
-     "arguments": { 'keys': [ 'ctrl', 'alt', 'delete' ] } }
+     "arguments": { "keys": [ { "type": "qcode", "data": "ctrl" },
+                              { "type": "qcode", "data": "alt" },
+                              { "type": "qcode", "data": "delete" } ] } }
 <- { "return": {} }
 
 EQMP
commit 0777b5dde42f4f453abc8bb2c4e145fb8749415d
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 11 14:16:25 2013 +0200

    iscsi: factor out sector conversions
    
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/iscsi.c b/block/iscsi.c
index 1294fdf..5f28c6a 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -232,6 +232,11 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status,
     iscsi_schedule_bh(acb);
 }
 
+static int64_t sector_lun2qemu(int64_t sector, IscsiLun *iscsilun)
+{
+    return sector * iscsilun->block_size / BDRV_SECTOR_SIZE;
+}
+
 static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun)
 {
     return sector * BDRV_SECTOR_SIZE / iscsilun->block_size;
@@ -296,7 +301,7 @@ iscsi_aio_writev_acb(IscsiAIOCB *acb)
     lba = sector_qemu2lun(acb->sector_num, acb->iscsilun);
     *(uint32_t *)&acb->task->cdb[2]  = htonl(lba >> 32);
     *(uint32_t *)&acb->task->cdb[6]  = htonl(lba & 0xffffffff);
-    num_sectors = size / acb->iscsilun->block_size;
+    num_sectors = sector_qemu2lun(acb->nb_sectors, acb->iscsilun);
     *(uint32_t *)&acb->task->cdb[10] = htonl(num_sectors);
     acb->task->expxferlen = size;
 
@@ -1161,8 +1166,7 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags)
     if ((ret = iscsi_readcapacity_sync(iscsilun)) != 0) {
         goto out;
     }
-    bs->total_sectors    = iscsilun->num_blocks *
-                           iscsilun->block_size / BDRV_SECTOR_SIZE ;
+    bs->total_sectors = sector_lun2qemu(iscsilun->num_blocks, iscsilun);
 
     /* Medium changer or tape. We dont have any emulation for this so this must
      * be sg ioctl compatible. We force it to be sg, otherwise qemu will try
commit 91bea4e2bb1a5f7954a3b3a4f2e28e96bd25c458
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 11 14:16:27 2013 +0200

    iscsi: assert that sectors are aligned to LUN blocksize
    
    if the blocksize of an iSCSI LUN is bigger than the BDRV_SECTOR_SIZE
    it is possible that sector_num or nb_sectors are not correctly
    aligned.
    
    to avoid corruption we fail requests which are misaligned.
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/iscsi.c b/block/iscsi.c
index df283ed..1294fdf 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -237,6 +237,18 @@ static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun)
     return sector * BDRV_SECTOR_SIZE / iscsilun->block_size;
 }
 
+static bool is_request_lun_aligned(int64_t sector_num, int nb_sectors,
+                                      IscsiLun *iscsilun)
+{
+    if ((sector_num * BDRV_SECTOR_SIZE) % iscsilun->block_size ||
+        (nb_sectors * BDRV_SECTOR_SIZE) % iscsilun->block_size) {
+            error_report("iSCSI misaligned request: iscsilun->block_size %u, sector_num %ld, nb_sectors %d",
+                         iscsilun->block_size, sector_num, nb_sectors);
+            return 0;
+    }
+    return 1;
+}
+
 static int
 iscsi_aio_writev_acb(IscsiAIOCB *acb)
 {
@@ -321,6 +333,10 @@ iscsi_aio_writev(BlockDriverState *bs, int64_t sector_num,
     IscsiLun *iscsilun = bs->opaque;
     IscsiAIOCB *acb;
 
+    if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) {
+        return NULL;
+    }
+
     acb = qemu_aio_get(&iscsi_aiocb_info, bs, cb, opaque);
     trace_iscsi_aio_writev(iscsilun->iscsi, sector_num, nb_sectors, opaque, acb);
 
@@ -452,6 +468,10 @@ iscsi_aio_readv(BlockDriverState *bs, int64_t sector_num,
     IscsiLun *iscsilun = bs->opaque;
     IscsiAIOCB *acb;
 
+    if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) {
+        return NULL;
+    }
+
     acb = qemu_aio_get(&iscsi_aiocb_info, bs, cb, opaque);
     trace_iscsi_aio_readv(iscsilun->iscsi, sector_num, nb_sectors, opaque, acb);
 
commit 7e4d5a9f94a0d8485bf63e1f8256e0a0014495ab
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 11 14:16:26 2013 +0200

    iscsi: remove support for misaligned nb_sectors in aio_readv
    
    this hask is not working (anymore). support for misaligned offsets should
    be handled at the block layer.
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/iscsi.c b/block/iscsi.c
index 91b602c..df283ed 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -62,8 +62,6 @@ typedef struct IscsiAIOCB {
     int status;
     int canceled;
     int retries;
-    size_t read_size;
-    size_t read_offset;
     int64_t sector_num;
     int nb_sectors;
 #ifdef __linux__
@@ -380,6 +378,7 @@ static int
 iscsi_aio_readv_acb(IscsiAIOCB *acb)
 {
     struct iscsi_context *iscsi = acb->iscsilun->iscsi;
+    size_t size;
     uint64_t lba;
     uint32_t num_sectors;
     int ret;
@@ -392,20 +391,7 @@ iscsi_aio_readv_acb(IscsiAIOCB *acb)
     acb->status      = -EINPROGRESS;
     acb->buf         = NULL;
 
-    /* If LUN blocksize is bigger than BDRV_BLOCK_SIZE a read from QEMU
-     * may be misaligned to the LUN, so we may need to read some extra
-     * data.
-     */
-    acb->read_offset = 0;
-    if (acb->iscsilun->block_size > BDRV_SECTOR_SIZE) {
-        uint64_t bdrv_offset = BDRV_SECTOR_SIZE * acb->sector_num;
-
-        acb->read_offset  = bdrv_offset % acb->iscsilun->block_size;
-    }
-
-    num_sectors  = (acb->read_size + acb->iscsilun->block_size
-                    + acb->read_offset - 1)
-                    / acb->iscsilun->block_size;
+    size = acb->nb_sectors * BDRV_SECTOR_SIZE;
 
     acb->task = malloc(sizeof(struct scsi_task));
     if (acb->task == NULL) {
@@ -416,8 +402,9 @@ iscsi_aio_readv_acb(IscsiAIOCB *acb)
     memset(acb->task, 0, sizeof(struct scsi_task));
 
     acb->task->xfer_dir = SCSI_XFER_READ;
+    acb->task->expxferlen = size;
     lba = sector_qemu2lun(acb->sector_num, acb->iscsilun);
-    acb->task->expxferlen = acb->read_size;
+    num_sectors = sector_qemu2lun(acb->nb_sectors, acb->iscsilun);
 
     switch (acb->iscsilun->type) {
     case TYPE_DISK:
@@ -472,7 +459,6 @@ iscsi_aio_readv(BlockDriverState *bs, int64_t sector_num,
     acb->sector_num  = sector_num;
     acb->iscsilun    = iscsilun;
     acb->qiov        = qiov;
-    acb->read_size   = BDRV_SECTOR_SIZE * (size_t)acb->nb_sectors;
     acb->retries     = ISCSI_CMD_RETRIES;
 
     if (iscsi_aio_readv_acb(acb) != 0) {
commit d3bda7bc166f40326ba646ee145630bb1b59da96
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Jul 11 14:16:24 2013 +0200

    iscsi: fix -ENOSPC in iscsi_create()
    
    the -ENOPSC case did not work due to the missing goto.
    
    Reported-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/iscsi.c b/block/iscsi.c
index fa5252c..91b602c 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1272,6 +1272,7 @@ static int iscsi_create(const char *filename, QEMUOptionParameter *options)
     }
     if (bs.total_sectors < total_size) {
         ret = -ENOSPC;
+        goto out;
     }
 
     ret = 0;
commit 0a53f010745635c39a83756a948df60a84e88fe5
Author: Ronnie Sahlberg <ronniesahlberg at gmail.com>
Date:   Sun Jun 23 08:07:08 2013 -0700

    Fix iSCSI crash on SG_IO with an iovector
    
    Don't assume that SG_IO is always invoked with a simple buffer,
    check the iovec_count and if it is >= 1 then we need to pass an array
    of iovectors to libiscsi instead of just a plain buffer.
    
    Signed-off-by: Ronnie Sahlberg <ronniesahlberg at gmail.com>
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/iscsi.c b/block/iscsi.c
index 0bbf0b1..fa5252c 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -32,6 +32,7 @@
 #include "block/block_int.h"
 #include "trace.h"
 #include "block/scsi.h"
+#include "qemu/iov.h"
 
 #include <iscsi/iscsi.h>
 #include <iscsi/scsi-lowlevel.h>
@@ -651,6 +652,9 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
 {
     IscsiAIOCB *acb = opaque;
 
+    g_free(acb->buf);
+    acb->buf = NULL;
+
     if (acb->canceled != 0) {
         return;
     }
@@ -727,14 +731,30 @@ static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
     memcpy(&acb->task->cdb[0], acb->ioh->cmdp, acb->ioh->cmd_len);
     acb->task->expxferlen = acb->ioh->dxfer_len;
 
+    data.size = 0;
     if (acb->task->xfer_dir == SCSI_XFER_WRITE) {
-        data.data = acb->ioh->dxferp;
-        data.size = acb->ioh->dxfer_len;
+        if (acb->ioh->iovec_count == 0) {
+            data.data = acb->ioh->dxferp;
+            data.size = acb->ioh->dxfer_len;
+        } else {
+#if defined(LIBISCSI_FEATURE_IOVECTOR)
+            scsi_task_set_iov_out(acb->task,
+                                 (struct scsi_iovec *) acb->ioh->dxferp,
+                                 acb->ioh->iovec_count);
+#else
+            struct iovec *iov = (struct iovec *)acb->ioh->dxferp;
+
+            acb->buf = g_malloc(acb->ioh->dxfer_len);
+            data.data = acb->buf;
+            data.size = iov_to_buf(iov, acb->ioh->iovec_count, 0,
+                                   acb->buf, acb->ioh->dxfer_len);
+#endif
+        }
     }
+
     if (iscsi_scsi_command_async(iscsi, iscsilun->lun, acb->task,
                                  iscsi_aio_ioctl_cb,
-                                 (acb->task->xfer_dir == SCSI_XFER_WRITE) ?
-                                     &data : NULL,
+                                 (data.size > 0) ? &data : NULL,
                                  acb) != 0) {
         scsi_free_scsi_task(acb->task);
         qemu_aio_release(acb);
@@ -743,9 +763,26 @@ static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
 
     /* tell libiscsi to read straight into the buffer we got from ioctl */
     if (acb->task->xfer_dir == SCSI_XFER_READ) {
-        scsi_task_add_data_in_buffer(acb->task,
-                                     acb->ioh->dxfer_len,
-                                     acb->ioh->dxferp);
+        if (acb->ioh->iovec_count == 0) {
+            scsi_task_add_data_in_buffer(acb->task,
+                                         acb->ioh->dxfer_len,
+                                         acb->ioh->dxferp);
+        } else {
+#if defined(LIBISCSI_FEATURE_IOVECTOR)
+            scsi_task_set_iov_in(acb->task,
+                                 (struct scsi_iovec *) acb->ioh->dxferp,
+                                 acb->ioh->iovec_count);
+#else
+            int i;
+            for (i = 0; i < acb->ioh->iovec_count; i++) {
+                struct iovec *iov = (struct iovec *)acb->ioh->dxferp;
+
+                scsi_task_add_data_in_buffer(acb->task,
+                    iov[i].iov_len,
+                    iov[i].iov_base);
+            }
+#endif
+        }
     }
 
     iscsi_set_events(iscsilun);
commit 8f91ad8a1b4702966d91ea58cd90bbde1faea1b3
Author: Luiz Capitulino <lcapitulino at redhat.com>
Date:   Thu Jul 11 14:26:56 2013 -0400

    qapi: qapi-commands: fix possible leaks on visitor dealloc
    
    In qmp-marshal.c the dealloc visitor calls use the same errp
    pointer of the input visitor calls. This means that if any of
    the input visitor calls fails, then the dealloc visitor will
    return early, before freeing the object's memory.
    
    Here's an example, consider this code:
    
    int qmp_marshal_input_block_passwd(Monitor *mon, const QDict *qdict, QObject **ret)
    {
    	[...]
    
        char * device = NULL;
        char * password = NULL;
    
        mi = qmp_input_visitor_new_strict(QOBJECT(args));
        v = qmp_input_get_visitor(mi);
        visit_type_str(v, &device, "device", errp);
        visit_type_str(v, &password, "password", errp);
        qmp_input_visitor_cleanup(mi);
    
        if (error_is_set(errp)) {
            goto out;
        }
        qmp_block_passwd(device, password, errp);
    
    out:
        md = qapi_dealloc_visitor_new();
        v = qapi_dealloc_get_visitor(md);
        visit_type_str(v, &device, "device", errp);
        visit_type_str(v, &password, "password", errp);
        qapi_dealloc_visitor_cleanup(md);
    
    	[...]
    
        return 0;
    }
    
    Consider errp != NULL when the out label is reached, we're going
    to leak device and password.
    
    This patch fixes this by always passing errp=NULL for dealloc
    visitors, meaning that we always try to free them regardless of
    any previous failure. The above example would then be:
    
    out:
        md = qapi_dealloc_visitor_new();
        v = qapi_dealloc_get_visitor(md);
        visit_type_str(v, &device, "device", NULL);
        visit_type_str(v, &password, "password", NULL);
        qapi_dealloc_visitor_cleanup(md);
    
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/scripts/qapi-commands.py b/scripts/qapi-commands.py
index e06332b..b12b696 100644
--- a/scripts/qapi-commands.py
+++ b/scripts/qapi-commands.py
@@ -128,12 +128,15 @@ bool has_%(argname)s = false;
 
 def gen_visitor_input_block(args, obj, dealloc=False):
     ret = ""
+    errparg = 'errp'
+
     if len(args) == 0:
         return ret
 
     push_indent()
 
     if dealloc:
+        errparg = 'NULL'
         ret += mcgen('''
 md = qapi_dealloc_visitor_new();
 v = qapi_dealloc_get_visitor(md);
@@ -148,22 +151,22 @@ v = qmp_input_get_visitor(mi);
     for argname, argtype, optional, structured in parse_args(args):
         if optional:
             ret += mcgen('''
-visit_start_optional(v, &has_%(c_name)s, "%(name)s", errp);
+visit_start_optional(v, &has_%(c_name)s, "%(name)s", %(errp)s);
 if (has_%(c_name)s) {
 ''',
-                         c_name=c_var(argname), name=argname)
+                         c_name=c_var(argname), name=argname, errp=errparg)
             push_indent()
         ret += mcgen('''
-%(visitor)s(v, &%(c_name)s, "%(name)s", errp);
+%(visitor)s(v, &%(c_name)s, "%(name)s", %(errp)s);
 ''',
                      c_name=c_var(argname), name=argname, argtype=argtype,
-                     visitor=type_visitor(argtype))
+                     visitor=type_visitor(argtype), errp=errparg)
         if optional:
             pop_indent()
             ret += mcgen('''
 }
-visit_end_optional(v, errp);
-''')
+visit_end_optional(v, %(errp)s);
+''', errp=errparg)
 
     if dealloc:
         ret += mcgen('''
@@ -194,7 +197,7 @@ static void qmp_marshal_output_%(c_name)s(%(c_ret_type)s ret_in, QObject **ret_o
     }
     qmp_output_visitor_cleanup(mo);
     v = qapi_dealloc_get_visitor(md);
-    %(visitor)s(v, &ret_in, "unused", errp);
+    %(visitor)s(v, &ret_in, "unused", NULL);
     qapi_dealloc_visitor_cleanup(md);
 }
 ''',
commit 7b4b0e9eda51902b53bc1a2318df53cdb8b72eed
Author: Vijay Mohan Pandarathil <vijaymohan.pandarathil at hp.com>
Date:   Mon Jul 15 15:49:49 2013 -0600

    vfio: QEMU-AER: Qemu changes to support AER for VFIO-PCI devices
    
    Add support for error containment when a VFIO device assigned to a KVM
    guest encounters an error. This is for PCIe devices/drivers that support AER
    functionality. When the host OS is notified of an error in a device either
    through the firmware first approach or through an interrupt handled by the AER
    root port driver, the error handler registered by the vfio-pci driver gets
    invoked. The qemu process is signaled through an eventfd registered per
    VFIO device by the qemu process. In the eventfd handler, qemu decides on
    what action to take. In this implementation, guest is brought down to
    contain the error.
    
    The kernel patches for the above functionality has been already accepted.
    
    This is a refresh of the QEMU patch which was reviewed earlier.
    http://marc.info/?l=linux-kernel&m=136281557608087&w=2
    This patch has the same contents and has been built after refreshing
    to latest upstream and after the linux headers have been updated in qemu.
    
    	- Create eventfd per vfio device assigned to a guest and register an
              event handler
    
    	- This fd is passed to the vfio_pci driver through the SET_IRQ ioctl
    
    	- When the device encounters an error, the eventfd is signalled
              and the qemu eventfd handler gets invoked.
    
    	- In the handler decide what action to take. Current action taken
              is to stop the guest.
    
    Signed-off-by: Vijay Mohan Pandarathil <vijaymohan.pandarathil at hp.com>
    Signed-off-by: Alex Williamson <alex.williamson at redhat.com>

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index 95baad8..ad8ce77 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -175,6 +175,7 @@ typedef struct VFIODevice {
     PCIHostDeviceAddress host;
     QLIST_ENTRY(VFIODevice) next;
     struct VFIOGroup *group;
+    EventNotifier err_notifier;
     uint32_t features;
 #define VFIO_FEATURE_ENABLE_VGA_BIT 0
 #define VFIO_FEATURE_ENABLE_VGA (1 << VFIO_FEATURE_ENABLE_VGA_BIT)
@@ -182,6 +183,7 @@ typedef struct VFIODevice {
     uint8_t pm_cap;
     bool reset_works;
     bool has_vga;
+    bool pci_aer;
 } VFIODevice;
 
 typedef struct VFIOGroup {
@@ -2766,6 +2768,7 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
 {
     struct vfio_device_info dev_info = { .argsz = sizeof(dev_info) };
     struct vfio_region_info reg_info = { .argsz = sizeof(reg_info) };
+    struct vfio_irq_info irq_info = { .argsz = sizeof(irq_info) };
     int ret, i;
 
     ret = ioctl(group->fd, VFIO_GROUP_GET_DEVICE_FD, name);
@@ -2909,6 +2912,19 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
 
         vdev->has_vga = true;
     }
+    irq_info.index = VFIO_PCI_ERR_IRQ_INDEX;
+
+    ret = ioctl(vdev->fd, VFIO_DEVICE_GET_IRQ_INFO, &irq_info);
+    if (ret) {
+        /* This can fail for an old kernel or legacy PCI dev */
+        DPRINTF("VFIO_DEVICE_GET_IRQ_INFO failure ret=%d\n", ret);
+        ret = 0;
+    } else if (irq_info.count == 1) {
+        vdev->pci_aer = true;
+    } else {
+        error_report("vfio: Warning: "
+                     "Could not enable error recovery for the device\n");
+    }
 
 error:
     if (ret) {
@@ -2931,6 +2947,113 @@ static void vfio_put_device(VFIODevice *vdev)
     }
 }
 
+static void vfio_err_notifier_handler(void *opaque)
+{
+    VFIODevice *vdev = opaque;
+
+    if (!event_notifier_test_and_clear(&vdev->err_notifier)) {
+        return;
+    }
+
+    /*
+     * TBD. Retrieve the error details and decide what action
+     * needs to be taken. One of the actions could be to pass
+     * the error to the guest and have the guest driver recover
+     * from the error. This requires that PCIe capabilities be
+     * exposed to the guest. For now, we just terminate the
+     * guest to contain the error.
+     */
+
+    error_report("%s (%04x:%02x:%02x.%x)"
+        "Unrecoverable error detected...\n"
+        "Please collect any data possible and then kill the guest",
+        __func__, vdev->host.domain, vdev->host.bus,
+        vdev->host.slot, vdev->host.function);
+
+    vm_stop(RUN_STATE_IO_ERROR);
+}
+
+/*
+ * Registers error notifier for devices supporting error recovery.
+ * If we encounter a failure in this function, we report an error
+ * and continue after disabling error recovery support for the
+ * device.
+ */
+static void vfio_register_err_notifier(VFIODevice *vdev)
+{
+    int ret;
+    int argsz;
+    struct vfio_irq_set *irq_set;
+    int32_t *pfd;
+
+    if (!vdev->pci_aer) {
+        return;
+    }
+
+    if (event_notifier_init(&vdev->err_notifier, 0)) {
+        error_report("vfio: Warning: "
+                     "Unable to init event notifier for error detection\n");
+        vdev->pci_aer = false;
+        return;
+    }
+
+    argsz = sizeof(*irq_set) + sizeof(*pfd);
+
+    irq_set = g_malloc0(argsz);
+    irq_set->argsz = argsz;
+    irq_set->flags = VFIO_IRQ_SET_DATA_EVENTFD |
+                     VFIO_IRQ_SET_ACTION_TRIGGER;
+    irq_set->index = VFIO_PCI_ERR_IRQ_INDEX;
+    irq_set->start = 0;
+    irq_set->count = 1;
+    pfd = (int32_t *)&irq_set->data;
+
+    *pfd = event_notifier_get_fd(&vdev->err_notifier);
+    qemu_set_fd_handler(*pfd, vfio_err_notifier_handler, NULL, vdev);
+
+    ret = ioctl(vdev->fd, VFIO_DEVICE_SET_IRQS, irq_set);
+    if (ret) {
+        error_report("vfio: Failed to set up error notification\n");
+        qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
+        event_notifier_cleanup(&vdev->err_notifier);
+        vdev->pci_aer = false;
+    }
+    g_free(irq_set);
+}
+
+static void vfio_unregister_err_notifier(VFIODevice *vdev)
+{
+    int argsz;
+    struct vfio_irq_set *irq_set;
+    int32_t *pfd;
+    int ret;
+
+    if (!vdev->pci_aer) {
+        return;
+    }
+
+    argsz = sizeof(*irq_set) + sizeof(*pfd);
+
+    irq_set = g_malloc0(argsz);
+    irq_set->argsz = argsz;
+    irq_set->flags = VFIO_IRQ_SET_DATA_EVENTFD |
+                     VFIO_IRQ_SET_ACTION_TRIGGER;
+    irq_set->index = VFIO_PCI_ERR_IRQ_INDEX;
+    irq_set->start = 0;
+    irq_set->count = 1;
+    pfd = (int32_t *)&irq_set->data;
+    *pfd = -1;
+
+    ret = ioctl(vdev->fd, VFIO_DEVICE_SET_IRQS, irq_set);
+    if (ret) {
+        error_report("vfio: Failed to de-assign error fd: %d\n", ret);
+    }
+    g_free(irq_set);
+    qemu_set_fd_handler(event_notifier_get_fd(&vdev->err_notifier),
+                        NULL, NULL, vdev);
+    event_notifier_cleanup(&vdev->err_notifier);
+}
+
 static int vfio_initfn(PCIDevice *pdev)
 {
     VFIODevice *pvdev, *vdev = DO_UPCAST(VFIODevice, pdev, pdev);
@@ -3063,6 +3186,7 @@ static int vfio_initfn(PCIDevice *pdev)
     }
 
     add_boot_device_path(vdev->bootindex, &pdev->qdev, NULL);
+    vfio_register_err_notifier(vdev);
 
     return 0;
 
@@ -3082,6 +3206,7 @@ static void vfio_exitfn(PCIDevice *pdev)
     VFIODevice *vdev = DO_UPCAST(VFIODevice, pdev, pdev);
     VFIOGroup *group = vdev->group;
 
+    vfio_unregister_err_notifier(vdev);
     pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
     vfio_disable_interrupts(vdev);
     if (vdev->intx.mmap_timer) {
commit 39360f0b91d38790b5756d621ca9a7dd93ca8816
Author: Alex Williamson <alex.williamson at redhat.com>
Date:   Mon Jul 15 15:48:11 2013 -0600

    vfio-pci: VGA quirk update
    
    Turns out all the suspicions for AMD devices were correct, everywhere
    we read a BAR address that the address matches the config space offset,
    there's full access to PCI config space.  Attempt to generalize some
    helpers to allow quirks to easily be added for mirrors and windows.
    Also fill in complete config space for AMD.
    
    Signed-off-by: Alex Williamson <alex.williamson at redhat.com>

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index 540c377..95baad8 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -59,8 +59,23 @@ typedef struct VFIOQuirk {
     MemoryRegion mem;
     struct VFIODevice *vdev;
     QLIST_ENTRY(VFIOQuirk) next;
-    uint32_t data;
-    uint32_t data2;
+    struct {
+        uint32_t base_offset:TARGET_PAGE_BITS;
+        uint32_t address_offset:TARGET_PAGE_BITS;
+        uint32_t address_size:3;
+        uint32_t bar:3;
+
+        uint32_t address_match;
+        uint32_t address_mask;
+
+        uint32_t address_val:TARGET_PAGE_BITS;
+        uint32_t data_offset:TARGET_PAGE_BITS;
+        uint32_t data_size:3;
+
+        uint8_t flags;
+        uint8_t read_flags;
+        uint8_t write_flags;
+    } data;
 } VFIOQuirk;
 
 typedef struct VFIOBAR {
@@ -72,6 +87,8 @@ typedef struct VFIOBAR {
     size_t size;
     uint32_t flags; /* VFIO region flags (rd/wr/mmap) */
     uint8_t nr; /* cache the BAR number for debug */
+    bool ioport;
+    bool mem64;
     QLIST_HEAD(, VFIOQuirk) quirks;
 } VFIOBAR;
 
@@ -1097,251 +1114,315 @@ static const MemoryRegionOps vfio_vga_ops = {
  * Device specific quirks
  */
 
-#define PCI_VENDOR_ID_ATI               0x1002
+/* Is range1 fully contained within range2?  */
+static bool vfio_range_contained(uint64_t first1, uint64_t len1,
+                                 uint64_t first2, uint64_t len2) {
+    return (first1 >= first2 && first1 + len1 <= first2 + len2);
+}
 
-/*
- * Device 1002:68f9 (Advanced Micro Devices [AMD] nee ATI Cedar PRO [Radeon
- * HD 5450/6350]) reports the upper byte of the physical address of the
- * I/O port BAR4 through VGA register 0x3c3.  The BAR is 256 bytes, so the
- * lower byte is known to be zero.  Probing for this quirk reads 0xff from
- * port 0x3c3 on some devices so we store the physical address and replace
- * reads with the virtual address any time it matches.  XXX Research when
- * to enable quirk.
- */
-static uint64_t vfio_ati_3c3_quirk_read(void *opaque,
-                                        hwaddr addr, unsigned size)
+static bool vfio_flags_enabled(uint8_t flags, uint8_t mask)
+{
+    return (mask && (flags & mask) == mask);
+}
+
+static uint64_t vfio_generic_window_quirk_read(void *opaque,
+                                               hwaddr addr, unsigned size)
 {
     VFIOQuirk *quirk = opaque;
     VFIODevice *vdev = quirk->vdev;
-    PCIDevice *pdev = &vdev->pdev;
-    uint64_t data = vfio_vga_read(&vdev->vga.region[QEMU_PCI_VGA_IO_HI],
-                                  addr + 0x3, size);
+    uint64_t data;
 
-    if (data == quirk->data) {
-        data = pci_get_byte(pdev->config + PCI_BASE_ADDRESS_4 + 1);
-        DPRINTF("%s(0x3c3, 1) = 0x%"PRIx64"\n", __func__, data);
+    if (vfio_flags_enabled(quirk->data.flags, quirk->data.read_flags) &&
+        ranges_overlap(addr, size,
+                       quirk->data.data_offset, quirk->data.data_size)) {
+        hwaddr offset = addr - quirk->data.data_offset;
+
+        if (!vfio_range_contained(addr, size, quirk->data.data_offset,
+                                  quirk->data.data_size)) {
+            hw_error("%s: window data read not fully contained: %s\n",
+                     __func__, memory_region_name(&quirk->mem));
+        }
+
+        data = vfio_pci_read_config(&vdev->pdev,
+                                    quirk->data.address_val + offset, size);
+
+        DPRINTF("%s read(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx", %d) = 0x%"
+                PRIx64"\n", memory_region_name(&quirk->mem), vdev->host.domain,
+                vdev->host.bus, vdev->host.slot, vdev->host.function,
+                quirk->data.bar, addr, size, data);
+    } else {
+        data = vfio_bar_read(&vdev->bars[quirk->data.bar],
+                             addr + quirk->data.base_offset, size);
     }
 
     return data;
 }
 
-static const MemoryRegionOps vfio_ati_3c3_quirk = {
-    .read = vfio_ati_3c3_quirk_read,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-static void vfio_vga_probe_ati_3c3_quirk(VFIODevice *vdev)
+static void vfio_generic_window_quirk_write(void *opaque, hwaddr addr,
+                                            uint64_t data, unsigned size)
 {
-    PCIDevice *pdev = &vdev->pdev;
-    off_t physoffset = vdev->config_offset + PCI_BASE_ADDRESS_4;
-    uint32_t physbar;
-    VFIOQuirk *quirk;
+    VFIOQuirk *quirk = opaque;
+    VFIODevice *vdev = quirk->vdev;
 
-    if (pci_get_word(pdev->config + PCI_VENDOR_ID) != PCI_VENDOR_ID_ATI ||
-        vdev->bars[4].size < 256) {
-        return;
-    }
+    if (ranges_overlap(addr, size,
+                       quirk->data.address_offset, quirk->data.address_size)) {
 
-    /* Get I/O port BAR physical address */
-    if (pread(vdev->fd, &physbar, 4, physoffset) != 4) {
-        error_report("vfio: probe failed for ATI/AMD 0x3c3 quirk on device "
-                     "%04x:%02x:%02x.%x", vdev->host.domain,
-                     vdev->host.bus, vdev->host.slot, vdev->host.function);
-        return;
+        if (addr != quirk->data.address_offset) {
+            hw_error("%s: offset write into address window: %s\n",
+                     __func__, memory_region_name(&quirk->mem));
+        }
+
+        if ((data & ~quirk->data.address_mask) == quirk->data.address_match) {
+            quirk->data.flags |= quirk->data.write_flags |
+                                 quirk->data.read_flags;
+            quirk->data.address_val = data & quirk->data.address_mask;
+        } else {
+            quirk->data.flags &= ~(quirk->data.write_flags |
+                                   quirk->data.read_flags);
+        }
     }
 
-    quirk = g_malloc0(sizeof(*quirk));
-    quirk->vdev = vdev;
-    quirk->data = (physbar >> 8) & 0xff;
+    if (vfio_flags_enabled(quirk->data.flags, quirk->data.write_flags) &&
+        ranges_overlap(addr, size,
+                       quirk->data.data_offset, quirk->data.data_size)) {
+        hwaddr offset = addr - quirk->data.data_offset;
 
-    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_ati_3c3_quirk, quirk,
-                          "vfio-ati-3c3-quirk", 1);
-    memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem, 3,
-                                &quirk->mem);
+        if (!vfio_range_contained(addr, size, quirk->data.data_offset,
+                                  quirk->data.data_size)) {
+            hw_error("%s: window data write not fully contained: %s\n",
+                     __func__, memory_region_name(&quirk->mem));
+        }
 
-    QLIST_INSERT_HEAD(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].quirks,
-                      quirk, next);
+        vfio_pci_write_config(&vdev->pdev,
+                              quirk->data.address_val + offset, data, size);
+        DPRINTF("%s write(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx", 0x%"
+                PRIx64", %d)\n", memory_region_name(&quirk->mem),
+                vdev->host.domain, vdev->host.bus, vdev->host.slot,
+                vdev->host.function, quirk->data.bar, addr, data, size);
+        return;
+    }
 
-    DPRINTF("Enabled ATI/AMD quirk 0x3c3 for device %04x:%02x:%02x.%x\n",
-            vdev->host.domain, vdev->host.bus, vdev->host.slot,
-            vdev->host.function);
+    vfio_bar_write(&vdev->bars[quirk->data.bar],
+                   addr + quirk->data.base_offset, data, size);
 }
 
-/*
- * Device 1002:68f9 (Advanced Micro Devices [AMD] nee ATI Cedar PRO [Radeon
- * HD 5450/6350]) reports the physical address of MMIO BAR0 through a
- * write/read operation on I/O port BAR4.  When uint32_t 0x4010 is written
- * to offset 0x0, the subsequent read from offset 0x4 returns the contents
- * of BAR0.  Test for this quirk on all ATI/AMD devices.  XXX - Note that
- * 0x10 is the offset of BAR0 in config sapce, is this a window to all of
- * config space?
- */
-static uint64_t vfio_ati_4010_quirk_read(void *opaque,
-                                         hwaddr addr, unsigned size)
+static const MemoryRegionOps vfio_generic_window_quirk = {
+    .read = vfio_generic_window_quirk_read,
+    .write = vfio_generic_window_quirk_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static uint64_t vfio_generic_quirk_read(void *opaque,
+                                        hwaddr addr, unsigned size)
 {
     VFIOQuirk *quirk = opaque;
     VFIODevice *vdev = quirk->vdev;
-    PCIDevice *pdev = &vdev->pdev;
-    uint64_t data = vfio_bar_read(&vdev->bars[4], addr, size);
+    hwaddr base = quirk->data.address_match & TARGET_PAGE_MASK;
+    hwaddr offset = quirk->data.address_match & ~TARGET_PAGE_MASK;
+    uint64_t data;
 
-    if (addr == 4 && size == 4 && quirk->data) {
-        data = pci_get_long(pdev->config + PCI_BASE_ADDRESS_0);
-        DPRINTF("%s(BAR4+0x4) = 0x%"PRIx64"\n", __func__, data);
-    }
+    if (vfio_flags_enabled(quirk->data.flags, quirk->data.read_flags) &&
+        ranges_overlap(addr, size, offset, quirk->data.address_mask + 1)) {
+        if (!vfio_range_contained(addr, size, offset,
+                                  quirk->data.address_mask + 1)) {
+            hw_error("%s: read not fully contained: %s\n",
+                     __func__, memory_region_name(&quirk->mem));
+        }
 
-    quirk->data = 0;
+        data = vfio_pci_read_config(&vdev->pdev, addr - offset, size);
+
+        DPRINTF("%s read(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx", %d) = 0x%"
+                PRIx64"\n", memory_region_name(&quirk->mem), vdev->host.domain,
+                vdev->host.bus, vdev->host.slot, vdev->host.function,
+                quirk->data.bar, addr + base, size, data);
+    } else {
+        data = vfio_bar_read(&vdev->bars[quirk->data.bar], addr + base, size);
+    }
 
     return data;
 }
 
-static void vfio_ati_4010_quirk_write(void *opaque, hwaddr addr,
-                                      uint64_t data, unsigned size)
+static void vfio_generic_quirk_write(void *opaque, hwaddr addr,
+                                     uint64_t data, unsigned size)
 {
     VFIOQuirk *quirk = opaque;
     VFIODevice *vdev = quirk->vdev;
+    hwaddr base = quirk->data.address_match & TARGET_PAGE_MASK;
+    hwaddr offset = quirk->data.address_match & ~TARGET_PAGE_MASK;
+
+    if (vfio_flags_enabled(quirk->data.flags, quirk->data.write_flags) &&
+        ranges_overlap(addr, size, offset, quirk->data.address_mask + 1)) {
+        if (!vfio_range_contained(addr, size, offset,
+                                  quirk->data.address_mask + 1)) {
+            hw_error("%s: write not fully contained: %s\n",
+                     __func__, memory_region_name(&quirk->mem));
+        }
 
-    vfio_bar_write(&vdev->bars[4], addr, data, size);
+        vfio_pci_write_config(&vdev->pdev, addr - offset, data, size);
 
-    quirk->data = (addr == 0 && size == 4 && data == 0x4010) ? 1 : 0;
+        DPRINTF("%s write(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx", 0x%"
+                PRIx64", %d)\n", memory_region_name(&quirk->mem),
+                vdev->host.domain, vdev->host.bus, vdev->host.slot,
+                vdev->host.function, quirk->data.bar, addr + base, data, size);
+    } else {
+        vfio_bar_write(&vdev->bars[quirk->data.bar], addr + base, data, size);
+    }
 }
 
-static const MemoryRegionOps vfio_ati_4010_quirk = {
-    .read = vfio_ati_4010_quirk_read,
-    .write = vfio_ati_4010_quirk_write,
+static const MemoryRegionOps vfio_generic_quirk = {
+    .read = vfio_generic_quirk_read,
+    .write = vfio_generic_quirk_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-static void vfio_probe_ati_4010_quirk(VFIODevice *vdev, int nr)
+#define PCI_VENDOR_ID_ATI               0x1002
+
+/*
+ * Radeon HD cards (HD5450 & HD7850) report the upper byte of the I/O port BAR
+ * through VGA register 0x3c3.  On newer cards, the I/O port BAR is always
+ * BAR4 (older cards like the X550 used BAR1, but we don't care to support
+ * those).  Note that on bare metal, a read of 0x3c3 doesn't always return the
+ * I/O port BAR address.  Originally this was coded to return the virtual BAR
+ * address only if the physical register read returns the actual BAR address,
+ * but users have reported greater success if we return the virtual address
+ * unconditionally.
+ */
+static uint64_t vfio_ati_3c3_quirk_read(void *opaque,
+                                        hwaddr addr, unsigned size)
+{
+    VFIOQuirk *quirk = opaque;
+    VFIODevice *vdev = quirk->vdev;
+    uint64_t data = vfio_pci_read_config(&vdev->pdev,
+                                         PCI_BASE_ADDRESS_0 + (4 * 4) + 1,
+                                         size);
+    DPRINTF("%s(0x3c3, 1) = 0x%"PRIx64"\n", __func__, data);
+
+    return data;
+}
+
+static const MemoryRegionOps vfio_ati_3c3_quirk = {
+    .read = vfio_ati_3c3_quirk_read,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void vfio_vga_probe_ati_3c3_quirk(VFIODevice *vdev)
 {
     PCIDevice *pdev = &vdev->pdev;
-    off_t physoffset = vdev->config_offset + PCI_BASE_ADDRESS_0;
-    uint32_t physbar0;
-    uint64_t data;
     VFIOQuirk *quirk;
 
-    if (!vdev->has_vga || nr != 4 || !vdev->bars[0].size ||
-        pci_get_word(pdev->config + PCI_VENDOR_ID) != PCI_VENDOR_ID_ATI) {
-        return;
-    }
-
-    /* Get I/O port BAR physical address */
-    if (pread(vdev->fd, &physbar0, 4, physoffset) != 4) {
-        error_report("vfio: probe failed for ATI/AMD 0x4010 quirk on device "
-                     "%04x:%02x:%02x.%x", vdev->host.domain,
-                     vdev->host.bus, vdev->host.slot, vdev->host.function);
+    if (pci_get_word(pdev->config + PCI_VENDOR_ID) != PCI_VENDOR_ID_ATI) {
         return;
     }
 
-    /* Write 0x4010 to I/O port BAR offset 0 */
-    vfio_bar_write(&vdev->bars[4], 0, 0x4010, 4);
-    /* Read back result */
-    data = vfio_bar_read(&vdev->bars[4], 4, 4);
-
-    /* If the register matches the physical address of BAR0, we need a quirk */
-    if (data != physbar0) {
+    /*
+     * As long as the BAR is >= 256 bytes it will be aligned such that the
+     * lower byte is always zero.  Filter out anything else, if it exists.
+     */
+    if (!vdev->bars[4].ioport || vdev->bars[4].size < 256) {
         return;
     }
 
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_ati_4010_quirk, quirk,
-                          "vfio-ati-4010-quirk", 8);
-    memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_ati_3c3_quirk, quirk,
+                          "vfio-ati-3c3-quirk", 1);
+    memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem,
+                                3 /* offset 3 bytes from 0x3c0 */, &quirk->mem);
 
-    QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
+    QLIST_INSERT_HEAD(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].quirks,
+                      quirk, next);
 
-    DPRINTF("Enabled ATI/AMD quirk 0x4010 for device %04x:%02x:%02x.%x\n",
+    DPRINTF("Enabled ATI/AMD quirk 0x3c3 BAR4for device %04x:%02x:%02x.%x\n",
             vdev->host.domain, vdev->host.bus, vdev->host.slot,
             vdev->host.function);
 }
 
 /*
- * Device 1002:5b63 (Advanced Micro Devices [AMD] nee ATI RV370 [Radeon X550])
- * retrieves the upper half of the MMIO BAR0 physical address by writing
- * 0xf10 to I/O port BAR1 offset 0 and reading the result from offset 6.
- * XXX - 0x10 is the offset of BAR0 in PCI config space, this could provide
- * full access to config space.  Config space is little endian, so the data
- * register probably starts at 0x4.
+ * Newer ATI/AMD devices, including HD5450 and HD7850, have a window to PCI
+ * config space through MMIO BAR2 at offset 0x4000.  Nothing seems to access
+ * the MMIO space directly, but a window to this space is provided through
+ * I/O port BAR4.  Offset 0x0 is the address register and offset 0x4 is the
+ * data register.  When the address is programmed to a range of 0x4000-0x4fff
+ * PCI configuration space is available.  Experimentation seems to indicate
+ * that only read-only access is provided, but we drop writes when the window
+ * is enabled to config space nonetheless.
  */
-static uint64_t vfio_ati_f10_quirk_read(void *opaque,
-                                        hwaddr addr, unsigned size)
+static void vfio_probe_ati_bar4_window_quirk(VFIODevice *vdev, int nr)
 {
-    VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
     PCIDevice *pdev = &vdev->pdev;
-    uint64_t data = vfio_bar_read(&vdev->bars[1], addr, size);
+    VFIOQuirk *quirk;
 
-    if (addr == 6 && size == 2 && quirk->data) {
-        data = pci_get_word(pdev->config + PCI_BASE_ADDRESS_0 + 2);
-        DPRINTF("%s(BAR1+0x6) = 0x%"PRIx64"\n", __func__, data);
+    if (!vdev->has_vga || nr != 4 ||
+        pci_get_word(pdev->config + PCI_VENDOR_ID) != PCI_VENDOR_ID_ATI) {
+        return;
     }
 
-    quirk->data = 0;
-
-    return data;
-}
-
-static void vfio_ati_f10_quirk_write(void *opaque, hwaddr addr,
-                                     uint64_t data, unsigned size)
-{
-    VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
+    quirk = g_malloc0(sizeof(*quirk));
+    quirk->vdev = vdev;
+    quirk->data.address_size = 4;
+    quirk->data.data_offset = 4;
+    quirk->data.data_size = 4;
+    quirk->data.address_match = 0x4000;
+    quirk->data.address_mask = PCIE_CONFIG_SPACE_SIZE - 1;
+    quirk->data.bar = nr;
+    quirk->data.read_flags = quirk->data.write_flags = 1;
+
+    memory_region_init_io(&quirk->mem, OBJECT(vdev),
+                          &vfio_generic_window_quirk, quirk,
+                          "vfio-ati-bar4-window-quirk", 8);
+    memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
+                          quirk->data.base_offset, &quirk->mem, 1);
 
-    vfio_bar_write(&vdev->bars[1], addr, data, size);
+    QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
 
-    quirk->data = (addr == 0 && size == 4 && data == 0xf10) ? 1 : 0;
+    DPRINTF("Enabled ATI/AMD BAR4 window quirk for device %04x:%02x:%02x.%x\n",
+            vdev->host.domain, vdev->host.bus, vdev->host.slot,
+            vdev->host.function);
 }
 
-static const MemoryRegionOps vfio_ati_f10_quirk = {
-    .read = vfio_ati_f10_quirk_read,
-    .write = vfio_ati_f10_quirk_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-static void vfio_probe_ati_f10_quirk(VFIODevice *vdev, int nr)
+/*
+ * Trap the BAR2 MMIO window to config space as well.
+ */
+static void vfio_probe_ati_bar2_4000_quirk(VFIODevice *vdev, int nr)
 {
     PCIDevice *pdev = &vdev->pdev;
-    off_t physoffset = vdev->config_offset + PCI_BASE_ADDRESS_0;
-    uint32_t physbar0;
-    uint64_t data;
     VFIOQuirk *quirk;
 
-    if (!vdev->has_vga || nr != 1 || !vdev->bars[0].size ||
+    /* Only enable on newer devices where BAR2 is 64bit */
+    if (!vdev->has_vga || nr != 2 || !vdev->bars[2].mem64 ||
         pci_get_word(pdev->config + PCI_VENDOR_ID) != PCI_VENDOR_ID_ATI) {
         return;
     }
 
-    /* Get I/O port BAR physical address */
-    if (pread(vdev->fd, &physbar0, 4, physoffset) != 4) {
-        error_report("vfio: probe failed for ATI/AMD 0xf10 quirk on device "
-                     "%04x:%02x:%02x.%x", vdev->host.domain,
-                     vdev->host.bus, vdev->host.slot, vdev->host.function);
-        return;
-    }
-
-    vfio_bar_write(&vdev->bars[1], 0, 0xf10, 4);
-    data = vfio_bar_read(&vdev->bars[1], 0x6, 2);
-
-    /* If the register matches the physical address of BAR0, we need a quirk */
-    if (data != (le32_to_cpu(physbar0) >> 16)) {
-        return;
-    }
-
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
-
-    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_ati_f10_quirk, quirk,
-                          "vfio-ati-f10-quirk", 8);
-    memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
+    quirk->data.flags = quirk->data.read_flags = quirk->data.write_flags = 1;
+    quirk->data.address_match = 0x4000;
+    quirk->data.address_mask = PCIE_CONFIG_SPACE_SIZE - 1;
+    quirk->data.bar = nr;
+
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_generic_quirk, quirk,
+                          "vfio-ati-bar2-4000-quirk",
+                          TARGET_PAGE_ALIGN(quirk->data.address_mask + 1));
+    memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
+                          quirk->data.address_match & TARGET_PAGE_MASK,
+                          &quirk->mem, 1);
 
     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
 
-    DPRINTF("Enabled ATI/AMD quirk 0xf10 for device %04x:%02x:%02x.%x\n",
+    DPRINTF("Enabled ATI/AMD BAR2 0x4000 quirk for device %04x:%02x:%02x.%x\n",
             vdev->host.domain, vdev->host.bus, vdev->host.slot,
             vdev->host.function);
 }
 
+/*
+ * Older ATI/AMD cards like the X550 have a similar window to that above.
+ * I/O port BAR1 provides a window to a mirror of PCI config space located
+ * in BAR2 at offset 0xf00.  We don't care to support such older cards, but
+ * note it for future reference.
+ */
+
 #define PCI_VENDOR_ID_NVIDIA                    0x10de
 
 /*
@@ -1360,7 +1441,7 @@ static void vfio_probe_ati_f10_quirk(VFIODevice *vdev, int nr)
  * that use the I/O port BAR5 window but it doesn't hurt to leave it.
  */
 enum {
-    NV_3D0_NONE,
+    NV_3D0_NONE = 0,
     NV_3D0_SELECT,
     NV_3D0_WINDOW,
     NV_3D0_READ,
@@ -1374,14 +1455,14 @@ static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque,
     VFIODevice *vdev = quirk->vdev;
     PCIDevice *pdev = &vdev->pdev;
     uint64_t data = vfio_vga_read(&vdev->vga.region[QEMU_PCI_VGA_IO_HI],
-                                  addr + 0x10, size);
+                                  addr + quirk->data.base_offset, size);
 
-    if (quirk->data == NV_3D0_READ && addr == 0) {
-        data = vfio_pci_read_config(pdev, quirk->data2, size);
+    if (quirk->data.flags == NV_3D0_READ && addr == quirk->data.data_offset) {
+        data = vfio_pci_read_config(pdev, quirk->data.address_val, size);
         DPRINTF("%s(0x3d0, %d) = 0x%"PRIx64"\n", __func__, size, data);
     }
 
-    quirk->data = NV_3D0_NONE;
+    quirk->data.flags = NV_3D0_NONE;
 
     return data;
 }
@@ -1393,43 +1474,42 @@ static void vfio_nvidia_3d0_quirk_write(void *opaque, hwaddr addr,
     VFIODevice *vdev = quirk->vdev;
     PCIDevice *pdev = &vdev->pdev;
 
-    switch (quirk->data) {
+    switch (quirk->data.flags) {
     case NV_3D0_NONE:
-        if (addr == 4 && data == 0x338) {
-            quirk->data = NV_3D0_SELECT;
+        if (addr == quirk->data.address_offset && data == 0x338) {
+            quirk->data.flags = NV_3D0_SELECT;
         }
         break;
     case NV_3D0_SELECT:
-        quirk->data = NV_3D0_NONE;
-        if (addr == 0 && (data & ~0xff) == 0x1800) {
-            quirk->data = NV_3D0_WINDOW;
-            quirk->data2 = data & 0xff;
+        quirk->data.flags = NV_3D0_NONE;
+        if (addr == quirk->data.data_offset &&
+            (data & ~quirk->data.address_mask) == quirk->data.address_match) {
+            quirk->data.flags = NV_3D0_WINDOW;
+            quirk->data.address_val = data & quirk->data.address_mask;
         }
         break;
     case NV_3D0_WINDOW:
-        quirk->data = NV_3D0_NONE;
-        if (addr == 4) {
+        quirk->data.flags = NV_3D0_NONE;
+        if (addr == quirk->data.address_offset) {
             if (data == 0x538) {
-                quirk->data = NV_3D0_READ;
+                quirk->data.flags = NV_3D0_READ;
             } else if (data == 0x738) {
-                quirk->data = NV_3D0_WRITE;
+                quirk->data.flags = NV_3D0_WRITE;
             }
         }
         break;
     case NV_3D0_WRITE:
-        quirk->data = NV_3D0_NONE;
-        if (addr == 0) {
-            vfio_pci_write_config(pdev, quirk->data2, data, size);
+        quirk->data.flags = NV_3D0_NONE;
+        if (addr == quirk->data.data_offset) {
+            vfio_pci_write_config(pdev, quirk->data.address_val, data, size);
             DPRINTF("%s(0x3d0, 0x%"PRIx64", %d)\n", __func__, data, size);
             return;
         }
         break;
-    default:
-        quirk->data = NV_3D0_NONE;
     }
 
     vfio_vga_write(&vdev->vga.region[QEMU_PCI_VGA_IO_HI],
-                   addr + 0x10, data, size);
+                   addr + quirk->data.base_offset, data, size);
 }
 
 static const MemoryRegionOps vfio_nvidia_3d0_quirk = {
@@ -1450,11 +1530,18 @@ static void vfio_vga_probe_nvidia_3d0_quirk(VFIODevice *vdev)
 
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
-
-    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_3d0_quirk, quirk,
-                          "vfio-nvidia-3d0-quirk", 6);
+    quirk->data.base_offset = 0x10;
+    quirk->data.address_offset = 4;
+    quirk->data.address_size = 2;
+    quirk->data.address_match = 0x1800;
+    quirk->data.address_mask = PCI_CONFIG_SPACE_SIZE - 1;
+    quirk->data.data_offset = 0;
+    quirk->data.data_size = 4;
+
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_3d0_quirk,
+                          quirk, "vfio-nvidia-3d0-quirk", 6);
     memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem,
-                                0x10, &quirk->mem);
+                                quirk->data.base_offset, &quirk->mem);
 
     QLIST_INSERT_HEAD(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].quirks,
                       quirk, next);
@@ -1478,76 +1565,46 @@ enum {
     NV_BAR5_VALID = 0x7,
 };
 
-static uint64_t vfio_nvidia_bar5_window_quirk_read(void *opaque,
-                                                   hwaddr addr, unsigned size)
-{
-    VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
-    uint64_t data = vfio_bar_read(&vdev->bars[5], addr, size);
-
-    if (addr == 0xc && quirk->data == NV_BAR5_VALID) {
-        data = vfio_pci_read_config(&vdev->pdev, quirk->data2, size);
-        DPRINTF("%s(%04x:%02x:%02x.%x:BAR5+0x%"HWADDR_PRIx", %d) = 0x%"
-                PRIx64"\n", __func__, vdev->host.domain, vdev->host.bus,
-                vdev->host.slot, vdev->host.function, addr, size, data);
-    }
-
-    return data;
-}
-
 static void vfio_nvidia_bar5_window_quirk_write(void *opaque, hwaddr addr,
                                                 uint64_t data, unsigned size)
 {
     VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
 
-    /*
-     * Use quirk->data to track enables and quirk->data2 for the offset
-     */
     switch (addr) {
     case 0x0:
         if (data & 0x1) {
-            quirk->data |= NV_BAR5_MASTER;
+            quirk->data.flags |= NV_BAR5_MASTER;
         } else {
-            quirk->data &= ~NV_BAR5_MASTER;
+            quirk->data.flags &= ~NV_BAR5_MASTER;
         }
         break;
     case 0x4:
         if (data & 0x1) {
-            quirk->data |= NV_BAR5_ENABLE;
+            quirk->data.flags |= NV_BAR5_ENABLE;
         } else {
-            quirk->data &= ~NV_BAR5_ENABLE;
+            quirk->data.flags &= ~NV_BAR5_ENABLE;
         }
         break;
     case 0x8:
-        if (quirk->data & NV_BAR5_MASTER) {
+        if (quirk->data.flags & NV_BAR5_MASTER) {
             if ((data & ~0xfff) == 0x88000) {
-                quirk->data |= NV_BAR5_ADDRESS;
-                quirk->data2 = data & 0xfff;
+                quirk->data.flags |= NV_BAR5_ADDRESS;
+                quirk->data.address_val = data & 0xfff;
             } else if ((data & ~0xff) == 0x1800) {
-                quirk->data |= NV_BAR5_ADDRESS;
-                quirk->data2 = data & 0xff;
+                quirk->data.flags |= NV_BAR5_ADDRESS;
+                quirk->data.address_val = data & 0xff;
             } else {
-                quirk->data &= ~NV_BAR5_ADDRESS;
+                quirk->data.flags &= ~NV_BAR5_ADDRESS;
             }
         }
         break;
-    case 0xc:
-        if (quirk->data == NV_BAR5_VALID) {
-            vfio_pci_write_config(&vdev->pdev, quirk->data2, data, size);
-            DPRINTF("%s(%04x:%02x:%02x.%x:BAR5+0x%"HWADDR_PRIx", 0x%"
-                    PRIx64", %d)\n", __func__, vdev->host.domain,
-                    vdev->host.bus, vdev->host.slot, vdev->host.function,
-                    addr, data, size);
-            return;
-        }
     }
 
-    vfio_bar_write(&vdev->bars[5], addr, data, size);
+    vfio_generic_window_quirk_write(opaque, addr, data, size);
 }
 
 static const MemoryRegionOps vfio_nvidia_bar5_window_quirk = {
-    .read = vfio_nvidia_bar5_window_quirk_read,
+    .read = vfio_generic_window_quirk_read,
     .write = vfio_nvidia_bar5_window_quirk_write,
     .valid.min_access_size = 4,
     .endianness = DEVICE_LITTLE_ENDIAN,
@@ -1565,8 +1622,15 @@ static void vfio_probe_nvidia_bar5_window_quirk(VFIODevice *vdev, int nr)
 
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
-
-    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_bar5_window_quirk, quirk,
+    quirk->data.read_flags = quirk->data.write_flags = NV_BAR5_VALID;
+    quirk->data.address_offset = 0x8;
+    quirk->data.address_size = 0; /* actually 4, but avoids generic code */
+    quirk->data.data_offset = 0xc;
+    quirk->data.data_size = 4;
+    quirk->data.bar = nr;
+
+    memory_region_init_io(&quirk->mem, OBJECT(vdev),
+                          &vfio_nvidia_bar5_window_quirk, quirk,
                           "vfio-nvidia-bar5-window-quirk", 16);
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
 
@@ -1586,51 +1650,6 @@ static void vfio_probe_nvidia_bar5_window_quirk(VFIODevice *vdev, int nr)
  *
  * Here's offset 0x88000...
  */
-static uint64_t vfio_nvidia_bar0_88000_quirk_read(void *opaque,
-                                                  hwaddr addr, unsigned size)
-{
-    VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
-    hwaddr base = 0x88000 & TARGET_PAGE_MASK;
-    hwaddr offset = 0x88000 & ~TARGET_PAGE_MASK;
-    uint64_t data = vfio_bar_read(&vdev->bars[0], addr + base, size);
-
-    if (ranges_overlap(addr, size, offset, PCI_CONFIG_SPACE_SIZE)) {
-        data = vfio_pci_read_config(&vdev->pdev, addr - offset, size);
-
-        DPRINTF("%s(%04x:%02x:%02x.%x:BAR0+0x%"HWADDR_PRIx", %d) = 0x%"
-                PRIx64"\n", __func__, vdev->host.domain, vdev->host.bus,
-                vdev->host.slot, vdev->host.function, addr + base, size, data);
-    }
-
-    return data;
-}
-
-static void vfio_nvidia_bar0_88000_quirk_write(void *opaque, hwaddr addr,
-                                               uint64_t data, unsigned size)
-{
-    VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
-    hwaddr base = 0x88000 & TARGET_PAGE_MASK;
-    hwaddr offset = 0x88000 & ~TARGET_PAGE_MASK;
-
-    if (ranges_overlap(addr, size, offset, PCI_CONFIG_SPACE_SIZE)) {
-        vfio_pci_write_config(&vdev->pdev, addr - offset, data, size);
-
-        DPRINTF("%s(%04x:%02x:%02x.%x:BAR0+0x%"HWADDR_PRIx", 0x%"
-                PRIx64", %d)\n", __func__, vdev->host.domain, vdev->host.bus,
-                vdev->host.slot, vdev->host.function, addr + base, data, size);
-    } else {
-        vfio_bar_write(&vdev->bars[0], addr + base, data, size);
-    }
-}
-
-static const MemoryRegionOps vfio_nvidia_bar0_88000_quirk = {
-    .read = vfio_nvidia_bar0_88000_quirk_read,
-    .write = vfio_nvidia_bar0_88000_quirk_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
 static void vfio_probe_nvidia_bar0_88000_quirk(VFIODevice *vdev, int nr)
 {
     PCIDevice *pdev = &vdev->pdev;
@@ -1643,13 +1662,17 @@ static void vfio_probe_nvidia_bar0_88000_quirk(VFIODevice *vdev, int nr)
 
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
-
-    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_bar0_88000_quirk, quirk,
-                          "vfio-nvidia-bar0-88000-quirk",
-                          TARGET_PAGE_ALIGN(PCIE_CONFIG_SPACE_SIZE));
+    quirk->data.flags = quirk->data.read_flags = quirk->data.write_flags = 1;
+    quirk->data.address_match = 0x88000;
+    quirk->data.address_mask = PCIE_CONFIG_SPACE_SIZE - 1;
+    quirk->data.bar = nr;
+
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_generic_quirk,
+                          quirk, "vfio-nvidia-bar0-88000-quirk",
+                          TARGET_PAGE_ALIGN(quirk->data.address_mask + 1));
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
-                                        0x88000 & TARGET_PAGE_MASK,
-                                        &quirk->mem, 1);
+                          quirk->data.address_match & TARGET_PAGE_MASK,
+                          &quirk->mem, 1);
 
     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
 
@@ -1661,51 +1684,6 @@ static void vfio_probe_nvidia_bar0_88000_quirk(VFIODevice *vdev, int nr)
 /*
  * And here's the same for BAR0 offset 0x1800...
  */
-static uint64_t vfio_nvidia_bar0_1800_quirk_read(void *opaque,
-                                                 hwaddr addr, unsigned size)
-{
-    VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
-    hwaddr base = 0x1800 & TARGET_PAGE_MASK;
-    hwaddr offset = 0x1800 & ~TARGET_PAGE_MASK;
-    uint64_t data = vfio_bar_read(&vdev->bars[0], addr + base, size);
-
-    if (ranges_overlap(addr, size, offset, PCI_CONFIG_SPACE_SIZE)) {
-        data = vfio_pci_read_config(&vdev->pdev, addr - offset, size);
-
-        DPRINTF("%s(%04x:%02x:%02x.%x:BAR0+0x%"HWADDR_PRIx", %d) = 0x%"
-                PRIx64"\n", __func__, vdev->host.domain, vdev->host.bus,
-                vdev->host.slot, vdev->host.function, addr + base, size, data);
-    }
-
-    return data;
-}
-
-static void vfio_nvidia_bar0_1800_quirk_write(void *opaque, hwaddr addr,
-                                              uint64_t data, unsigned size)
-{
-    VFIOQuirk *quirk = opaque;
-    VFIODevice *vdev = quirk->vdev;
-    hwaddr base = 0x1800 & TARGET_PAGE_MASK;
-    hwaddr offset = 0x1800 & ~TARGET_PAGE_MASK;
-
-    if (ranges_overlap(addr, size, offset, PCI_CONFIG_SPACE_SIZE)) {
-        vfio_pci_write_config(&vdev->pdev, addr - offset, data, size);
-
-        DPRINTF("%s(%04x:%02x:%02x.%x:BAR0+0x%"HWADDR_PRIx", 0x%"
-                PRIx64", %d)\n", __func__, vdev->host.domain, vdev->host.bus,
-                vdev->host.slot, vdev->host.function, addr + base, data, size);
-    } else {
-        vfio_bar_write(&vdev->bars[0], addr + base, data, size);
-    }
-}
-
-static const MemoryRegionOps vfio_nvidia_bar0_1800_quirk = {
-    .read = vfio_nvidia_bar0_1800_quirk_read,
-    .write = vfio_nvidia_bar0_1800_quirk_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
 static void vfio_probe_nvidia_bar0_1800_quirk(VFIODevice *vdev, int nr)
 {
     PCIDevice *pdev = &vdev->pdev;
@@ -1722,13 +1700,17 @@ static void vfio_probe_nvidia_bar0_1800_quirk(VFIODevice *vdev, int nr)
 
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
+    quirk->data.flags = quirk->data.read_flags = quirk->data.write_flags = 1;
+    quirk->data.address_match = 0x1800;
+    quirk->data.address_mask = PCI_CONFIG_SPACE_SIZE - 1;
+    quirk->data.bar = nr;
 
-    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_bar0_1800_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_generic_quirk, quirk,
                           "vfio-nvidia-bar0-1800-quirk",
-                          TARGET_PAGE_ALIGN(PCI_CONFIG_SPACE_SIZE));
+                          TARGET_PAGE_ALIGN(quirk->data.address_mask + 1));
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
-                                        0x1800 & TARGET_PAGE_MASK,
-                                        &quirk->mem, 1);
+                          quirk->data.address_match & TARGET_PAGE_MASK,
+                          &quirk->mem, 1);
 
     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
 
@@ -1768,8 +1750,8 @@ static void vfio_vga_quirk_teardown(VFIODevice *vdev)
 
 static void vfio_bar_quirk_setup(VFIODevice *vdev, int nr)
 {
-    vfio_probe_ati_4010_quirk(vdev, nr);
-    vfio_probe_ati_f10_quirk(vdev, nr);
+    vfio_probe_ati_bar4_window_quirk(vdev, nr);
+    vfio_probe_ati_bar2_4000_quirk(vdev, nr);
     vfio_probe_nvidia_bar5_window_quirk(vdev, nr);
     vfio_probe_nvidia_bar0_88000_quirk(vdev, nr);
     vfio_probe_nvidia_bar0_1800_quirk(vdev, nr);
@@ -2270,11 +2252,14 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
     }
 
     pci_bar = le32_to_cpu(pci_bar);
-    type = pci_bar & (pci_bar & PCI_BASE_ADDRESS_SPACE_IO ?
-           ~PCI_BASE_ADDRESS_IO_MASK : ~PCI_BASE_ADDRESS_MEM_MASK);
+    bar->ioport = (pci_bar & PCI_BASE_ADDRESS_SPACE_IO);
+    bar->mem64 = bar->ioport ? 0 : (pci_bar & PCI_BASE_ADDRESS_MEM_TYPE_64);
+    type = pci_bar & (bar->ioport ? ~PCI_BASE_ADDRESS_IO_MASK :
+                                    ~PCI_BASE_ADDRESS_MEM_MASK);
 
     /* A "slow" read/write mapping underlies all BARs */
-    memory_region_init_io(&bar->mem, OBJECT(vdev), &vfio_bar_ops, bar, name, size);
+    memory_region_init_io(&bar->mem, OBJECT(vdev), &vfio_bar_ops,
+                          bar, name, size);
     pci_register_bar(&vdev->pdev, nr, type, &bar->mem);
 
     /*
commit f290e4988dd8eb012de0517a1ff93df130e87da1
Merge: a281778 c6d8ed2
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Jul 15 13:21:10 2013 -0700

    Merge git://github.com/hw-claudio/qemu-aarch64-queue into tcg-next

commit a28177820a868eafda8fab007561cc19f41941f4
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Apr 18 19:20:47 2013 +0200

    tcg: Remove temp_buf
    
    All targets have been converted to allocating space for temporaries
    on the stack.  No need to allocate space within the CPU_COMMON block.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 39094b3..5321171 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -154,8 +154,6 @@ typedef struct CPUWatchpoint {
                                      memory was accessed */             \
     CPU_COMMON_TLB                                                      \
     struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];           \
-    /* buffer for temporaries in the code generator */                  \
-    long temp_buf[CPU_TEMP_BUF_NLONGS];                                 \
                                                                         \
     int64_t icount_extra; /* Instructions until next timer event.  */   \
     /* Number of cycles left, with interrupt flag in high bit.          \
commit 6453a3a69488196f26d12654c6b148446abdf3d6
Merge: 2562bec 7ca1dfa
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 15 14:49:15 2013 -0500

    Merge remote-tracking branch 'quintela/migration.next' into staging
    
    # By Chegu Vinod
    # Via Juan Quintela
    * quintela/migration.next:
      Force auto-convegence of live migration
      Add 'auto-converge' migration capability
      Introduce async_run_on_cpu()
    
    Message-id: 1373664508-5404-1-git-send-email-quintela at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 2562becfc126ed7678c662ee23b7c1fe135d8966
Merge: ab4e158 bf72d89
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 15 14:02:41 2013 -0500

    Merge remote-tracking branch 'cohuck/virtio-ccw-upstr' into staging
    
    # By Dominik Dingel
    # Via Cornelia Huck
    * cohuck/virtio-ccw-upstr:
      virtio-ccw: Enable x-data-plane for virtio-ccw-blk
    
    Message-id: 1373903207-27085-1-git-send-email-cornelia.huck at de.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit ab4e1589f072c7a5d1238c7f0d289c163c7736b2
Merge: 1750d01 82a3a11
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 15 14:02:32 2013 -0500

    Merge remote-tracking branch 'pmaydell/tags/pull-target-arm-20130715-1' into staging
    
    target-arm queue
    
    # gpg: Signature made Mon 15 Jul 2013 11:15:13 AM CDT using RSA key ID 14360CDE
    # gpg: Can't check signature: public key not found
    
    # By Mans Rullgard (3) and others
    # Via Peter Maydell
    * pmaydell/tags/pull-target-arm-20130715-1:
      target-arm: Avoid g_hash_table_get_keys()
      target-arm: avoid undefined behaviour when writing TTBCR
      target-arm/helper.c: Allow const opaques in arm CP
      target-arm/helper.c: Implement MIDR aliases
      target-arm/helper.c: OMAP/StrongARM cp15 crn=0 cleanup
      target-arm: explicitly decode SEVL instruction
      target-arm: implement LDA/STL instructions
      target-arm: add feature flag for ARMv8
    
    Message-id: 1373905022-27735-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 1750d019cea1e2383d3283eaad38cd0f93d07b11
Merge: a34001f b25a83f
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 15 14:02:12 2013 -0500

    Merge remote-tracking branch 'pmaydell/tags/pull-arm-devs-20130715' into staging
    
    arm-devs queue
    
    # gpg: Signature made Mon 15 Jul 2013 10:53:44 AM CDT using RSA key ID 14360CDE
    # gpg: Can't check signature: public key not found
    
    # By Peter Maydell (4) and others
    # Via Peter Maydell
    * pmaydell/tags/pull-arm-devs-20130715:
      ARM/highbank: add support for Calxeda ECX-2000 / Midway
      ARM/highbank: prepare for adding similar machines
      hw/arm/vexpress: Add alias for flash at address 0 on A15 board
      hw/dma/omap_dma: Fix bugs with DMA requests above 32
      sd/pl181.c: Avoid undefined shift behaviour in RWORD macro
      hw/cpu/a15mpcore: Correct default value for num-irq
      char/cadence_uart: Fix reset for unattached instances
    
    Message-id: 1373904095-27592-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit a34001fab5da2d0df605a8b83880c917c8aa0606
Merge: 5699a02 e605e96
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 15 14:00:57 2013 -0500

    Merge remote-tracking branch 'rth/axp-next' into staging
    
    # By Richard Henderson
    # Via Richard Henderson
    * rth/axp-next:
      hw/alpha: Use SRM epoch
      hw/alpha: Drop latch_tmp hack
      exec: Support 64-bit operations in address_space_rw
      hw/alpha: Don't machine check on missing pci i/o
      hw/alpha: Don't use get_system_io
    
    Message-id: 1373840171-25556-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 5699a02e01a4d046652bc6e77abd67e887ae209c
Merge: c3cb8e7 a62eaa2
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 15 14:00:32 2013 -0500

    Merge remote-tracking branch 'kwolf/for-anthony' into staging
    
    # By Kevin Wolf (6) and Stefan Hajnoczi (2)
    # Via Kevin Wolf
    * kwolf/for-anthony:
      ahci: Fix FLUSH command
      migration: Fail migration on bdrv_flush_all() error
      cpus: Add return value for vm_stop()
      block: Add return value for bdrv_flush_all()
      qemu-iotests: Update 051 reference output
      block: Don't parse protocol from file.filename
      block: add drive_backup HMP command
      blockdev: add sync mode to drive-backup QMP command
    
    Message-id: 1373887000-4488-1-git-send-email-kwolf at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit d26d9e14c15837eba2b7447e8d15230bab8e0940
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Wed Jul 10 18:28:04 2013 +0300

    pc: don't access fw cfg if NULL
    
    commit f8c457b88d72a48989f190bc3d7b79f4f3b7d11c
         "pc: pass PCI hole ranges to Guests"
    broke Xen as it has no fw_cfg.
    Check for this configuration and boil out.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Tested-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 80c27d6..cb3897e 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1000,7 +1000,7 @@ typedef struct PcRomPciInfo {
 static void pc_fw_cfg_guest_info(PcGuestInfo *guest_info)
 {
     PcRomPciInfo *info;
-    if (!guest_info->has_pci_info) {
+    if (!guest_info->has_pci_info || !guest_info->fw_cfg) {
         return;
     }
 
commit 488f069bd1f3aeb6ee748acb02b7581831bcb3f8
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Jul 11 16:06:46 2013 +0300

    virtio-net: add feature bit for any header s/g
    
    Old qemu versions required that 1st s/g entry is the header.
    
    Since QEMU 1.5, patchset titled "virtio-net: iovec handling cleanup"
    removed this limitation but a feature bit is needed so guests know it's
    safe to lay out header differently.
    
    This patch applies on top and adds such a feature bit to QEMU.
    It is set by default for virtio-net.
    virtio net header inline with the data is beneficial
    for latency and small packet bandwidth - guest driver
    code utilizing this feature has been acked but missed 3.11
    by a narrow margin, it's pending for 3.12.
    
    This feature bit is cleared by default when compatibility with old
    machine types is requested.
    
    Other performance-sensitive devices (blk and scsi)
    don't yet support arbitrary s/g layouts, so
    we only set this bit for virtio-net for now.
    There are plans to allow arbitrary layouts there, but
    no code has been posted yet.
    
    Cc: Rusty Russell <rusty at rustcorp.com.au>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 5949e7e..751592a 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -229,6 +229,10 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
             .driver   = "Nehalem-" TYPE_X86_CPU,\
             .property = "level",\
             .value    = stringify(2),\
+        },{\
+            .driver   = "virtio-net-pci",\
+            .property = "any_layout",\
+            .value    = "off",\
         }
 
 #define PC_COMPAT_1_4 \
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index b315ac9..df60f16 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -243,6 +243,7 @@ struct virtio_net_ctrl_mq {
 
 #define DEFINE_VIRTIO_NET_FEATURES(_state, _field) \
         DEFINE_VIRTIO_COMMON_FEATURES(_state, _field), \
+        DEFINE_PROP_BIT("any_layout", _state, _field, VIRTIO_F_ANY_LAYOUT, true), \
         DEFINE_PROP_BIT("csum", _state, _field, VIRTIO_NET_F_CSUM, true), \
         DEFINE_PROP_BIT("guest_csum", _state, _field, VIRTIO_NET_F_GUEST_CSUM, true), \
         DEFINE_PROP_BIT("gso", _state, _field, VIRTIO_NET_F_GSO, true), \
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index a6c5c53..5d1d2be 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -43,6 +43,8 @@
 /* We notify when the ring is completely used, even if the guest is suppressing
  * callbacks */
 #define VIRTIO_F_NOTIFY_ON_EMPTY        24
+/* Can the device handle any descriptor layout? */
+#define VIRTIO_F_ANY_LAYOUT             27
 /* We support indirect buffer descriptors */
 #define VIRTIO_RING_F_INDIRECT_DESC     28
 /* The Guest publishes the used index for which it expects an interrupt
commit b1be42803b31a913bab65bab563a8760ad2e7f7f
Author: Amos Kong <akong at redhat.com>
Date:   Fri Jun 14 15:45:52 2013 +0800

    net: add support of mac-programming over macvtap in QEMU side
    
    Currently macvtap based macvlan device is working in promiscuous
    mode, we want to implement mac-programming over macvtap through
    Libvirt for better performance.
    
    Design:
     QEMU notifies Libvirt when rx-filter config is changed in guest,
     then Libvirt query the rx-filter information by a monitor command,
     and sync the change to macvtap device. Related rx-filter config
     of the nic contains main mac, rx-mode items and vlan table.
    
    This patch adds a QMP event to notify management of rx-filter change,
    and adds a monitor command for management to query rx-filter
    information.
    
    Test:
     If we repeatedly add/remove vlan, and change macaddr of vlan
     interfaces in guest by a loop script.
    
    Result:
     The events will flood the QMP client(management), management takes
     too much resource to process the events.
    
     Event_throttle API (set rate to 1 ms) can avoid the events to flood
     QMP client, but it could cause an unexpected delay (~1ms), guests
     guests normally expect rx-filter updates immediately.
    
     So we use a flag for each nic to avoid events flooding, the event
     is emitted once until the query command is executed. The flag
     implementation could not introduce unexpected delay.
    
    There maybe exist an uncontrollable delay if we let Libvirt do the
    real change, guests normally expect rx-filter updates immediately.
    But it's another separate issue, we can investigate it when the
    work in Libvirt side is done.
    
    Michael S. Tsirkin: tweaked to enable events on start
    Michael S. Tsirkin: fixed not to crash when no id
    Michael S. Tsirkin: fold in patch:
       "additional fixes for mac-programming feature"
    Amos Kong: always notify QMP client if mactable is changed
    Amos Kong: return NULL list if no net client supports rx-filter query
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/QMP/qmp-events.txt b/QMP/qmp-events.txt
index 24e804e9..39b6016 100644
--- a/QMP/qmp-events.txt
+++ b/QMP/qmp-events.txt
@@ -172,6 +172,23 @@ Data:
   },
   "timestamp": { "seconds": 1265044230, "microseconds": 450486 } }
 
+NIC_RX_FILTER_CHANGED
+-----------------
+
+The event is emitted once until the query command is executed,
+the first event will always be emitted.
+
+Data:
+
+- "name": net client name (json-string)
+- "path": device path (json-string)
+
+{ "event": "NIC_RX_FILTER_CHANGED",
+  "data": { "name": "vnet0",
+            "path": "/machine/peripheral/vnet0/virtio-backend" },
+  "timestamp": { "seconds": 1368697518, "microseconds": 326866 } }
+}
+
 RESET
 -----
 
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 1ea9556..679f50c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -21,6 +21,8 @@
 #include "hw/virtio/virtio-net.h"
 #include "net/vhost_net.h"
 #include "hw/virtio/virtio-bus.h"
+#include "qapi/qmp/qjson.h"
+#include "monitor/monitor.h"
 
 #define VIRTIO_NET_VM_VERSION    11
 
@@ -192,6 +194,105 @@ static void virtio_net_set_link_status(NetClientState *nc)
     virtio_net_set_status(vdev, vdev->status);
 }
 
+static void rxfilter_notify(NetClientState *nc)
+{
+    QObject *event_data;
+    VirtIONet *n = qemu_get_nic_opaque(nc);
+
+    if (nc->rxfilter_notify_enabled) {
+        if (n->netclient_name) {
+            event_data = qobject_from_jsonf("{ 'name': %s, 'path': %s }",
+                                    n->netclient_name,
+                                    object_get_canonical_path(OBJECT(n->qdev)));
+        } else {
+            event_data = qobject_from_jsonf("{ 'path': %s }",
+                                    object_get_canonical_path(OBJECT(n->qdev)));
+        }
+        monitor_protocol_event(QEVENT_NIC_RX_FILTER_CHANGED, event_data);
+        qobject_decref(event_data);
+
+        /* disable event notification to avoid events flooding */
+        nc->rxfilter_notify_enabled = 0;
+    }
+}
+
+static char *mac_strdup_printf(const uint8_t *mac)
+{
+    return g_strdup_printf("%.2x:%.2x:%.2x:%.2x:%.2x:%.2x", mac[0],
+                            mac[1], mac[2], mac[3], mac[4], mac[5]);
+}
+
+static RxFilterInfo *virtio_net_query_rxfilter(NetClientState *nc)
+{
+    VirtIONet *n = qemu_get_nic_opaque(nc);
+    RxFilterInfo *info;
+    strList *str_list, *entry;
+    intList *int_list, *int_entry;
+    int i, j;
+
+    info = g_malloc0(sizeof(*info));
+    info->name = g_strdup(nc->name);
+    info->promiscuous = n->promisc;
+
+    if (n->nouni) {
+        info->unicast = RX_STATE_NONE;
+    } else if (n->alluni) {
+        info->unicast = RX_STATE_ALL;
+    } else {
+        info->unicast = RX_STATE_NORMAL;
+    }
+
+    if (n->nomulti) {
+        info->multicast = RX_STATE_NONE;
+    } else if (n->allmulti) {
+        info->multicast = RX_STATE_ALL;
+    } else {
+        info->multicast = RX_STATE_NORMAL;
+    }
+
+    info->broadcast_allowed = n->nobcast;
+    info->multicast_overflow = n->mac_table.multi_overflow;
+    info->unicast_overflow = n->mac_table.uni_overflow;
+
+    info->main_mac = mac_strdup_printf(n->mac);
+
+    str_list = NULL;
+    for (i = 0; i < n->mac_table.first_multi; i++) {
+        entry = g_malloc0(sizeof(*entry));
+        entry->value = mac_strdup_printf(n->mac_table.macs + i * ETH_ALEN);
+        entry->next = str_list;
+        str_list = entry;
+    }
+    info->unicast_table = str_list;
+
+    str_list = NULL;
+    for (i = n->mac_table.first_multi; i < n->mac_table.in_use; i++) {
+        entry = g_malloc0(sizeof(*entry));
+        entry->value = mac_strdup_printf(n->mac_table.macs + i * ETH_ALEN);
+        entry->next = str_list;
+        str_list = entry;
+    }
+    info->multicast_table = str_list;
+
+    int_list = NULL;
+    for (i = 0; i < MAX_VLAN >> 5; i++) {
+        for (j = 0; n->vlans[i] && j < 0x1f; j++) {
+            if (n->vlans[i] & (1U << j)) {
+                int_entry = g_malloc0(sizeof(*int_entry));
+                int_entry->value = (i << 5) + j;
+                int_entry->next = int_list;
+                int_list = int_entry;
+            }
+        }
+    }
+    info->vlan_table = int_list;
+
+    /* enable event notification after query */
+    nc->rxfilter_notify_enabled = 1;
+
+    return info;
+}
+
 static void virtio_net_reset(VirtIODevice *vdev)
 {
     VirtIONet *n = VIRTIO_NET(vdev);
@@ -420,6 +521,7 @@ static int virtio_net_handle_rx_mode(VirtIONet *n, uint8_t cmd,
 {
     uint8_t on;
     size_t s;
+    NetClientState *nc = qemu_get_queue(n->nic);
 
     s = iov_to_buf(iov, iov_cnt, 0, &on, sizeof(on));
     if (s != sizeof(on)) {
@@ -442,6 +544,8 @@ static int virtio_net_handle_rx_mode(VirtIONet *n, uint8_t cmd,
         return VIRTIO_NET_ERR;
     }
 
+    rxfilter_notify(nc);
+
     return VIRTIO_NET_OK;
 }
 
@@ -487,6 +591,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
 {
     struct virtio_net_ctrl_mac mac_data;
     size_t s;
+    NetClientState *nc = qemu_get_queue(n->nic);
 
     if (cmd == VIRTIO_NET_CTRL_MAC_ADDR_SET) {
         if (iov_size(iov, iov_cnt) != sizeof(n->mac)) {
@@ -495,6 +600,8 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
         s = iov_to_buf(iov, iov_cnt, 0, &n->mac, sizeof(n->mac));
         assert(s == sizeof(n->mac));
         qemu_format_nic_info_str(qemu_get_queue(n->nic), n->mac);
+        rxfilter_notify(nc);
+
         return VIRTIO_NET_OK;
     }
 
@@ -512,19 +619,19 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
                    sizeof(mac_data.entries));
     mac_data.entries = ldl_p(&mac_data.entries);
     if (s != sizeof(mac_data.entries)) {
-        return VIRTIO_NET_ERR;
+        goto error;
     }
     iov_discard_front(&iov, &iov_cnt, s);
 
     if (mac_data.entries * ETH_ALEN > iov_size(iov, iov_cnt)) {
-        return VIRTIO_NET_ERR;
+        goto error;
     }
 
     if (mac_data.entries <= MAC_TABLE_ENTRIES) {
         s = iov_to_buf(iov, iov_cnt, 0, n->mac_table.macs,
                        mac_data.entries * ETH_ALEN);
         if (s != mac_data.entries * ETH_ALEN) {
-            return VIRTIO_NET_ERR;
+            goto error;
         }
         n->mac_table.in_use += mac_data.entries;
     } else {
@@ -539,27 +646,33 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
                    sizeof(mac_data.entries));
     mac_data.entries = ldl_p(&mac_data.entries);
     if (s != sizeof(mac_data.entries)) {
-        return VIRTIO_NET_ERR;
+        goto error;
     }
 
     iov_discard_front(&iov, &iov_cnt, s);
 
     if (mac_data.entries * ETH_ALEN != iov_size(iov, iov_cnt)) {
-        return VIRTIO_NET_ERR;
+        goto error;
     }
 
     if (n->mac_table.in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
         s = iov_to_buf(iov, iov_cnt, 0, n->mac_table.macs,
                        mac_data.entries * ETH_ALEN);
         if (s != mac_data.entries * ETH_ALEN) {
-            return VIRTIO_NET_ERR;
+            goto error;
         }
         n->mac_table.in_use += mac_data.entries;
     } else {
         n->mac_table.multi_overflow = 1;
     }
 
+    rxfilter_notify(nc);
+
     return VIRTIO_NET_OK;
+
+error:
+    rxfilter_notify(nc);
+    return VIRTIO_NET_ERR;
 }
 
 static int virtio_net_handle_vlan_table(VirtIONet *n, uint8_t cmd,
@@ -567,6 +680,7 @@ static int virtio_net_handle_vlan_table(VirtIONet *n, uint8_t cmd,
 {
     uint16_t vid;
     size_t s;
+    NetClientState *nc = qemu_get_queue(n->nic);
 
     s = iov_to_buf(iov, iov_cnt, 0, &vid, sizeof(vid));
     vid = lduw_p(&vid);
@@ -584,6 +698,8 @@ static int virtio_net_handle_vlan_table(VirtIONet *n, uint8_t cmd,
     else
         return VIRTIO_NET_ERR;
 
+    rxfilter_notify(nc);
+
     return VIRTIO_NET_OK;
 }
 
@@ -1312,6 +1428,7 @@ static NetClientInfo net_virtio_info = {
     .receive = virtio_net_receive,
         .cleanup = virtio_net_cleanup,
     .link_status_changed = virtio_net_set_link_status,
+    .query_rx_filter = virtio_net_query_rxfilter,
 };
 
 static bool virtio_net_guest_notifier_pending(VirtIODevice *vdev, int idx)
@@ -1373,6 +1490,7 @@ static int virtio_net_device_init(VirtIODevice *vdev)
 
     DeviceState *qdev = DEVICE(vdev);
     VirtIONet *n = VIRTIO_NET(vdev);
+    NetClientState *nc;
 
     virtio_init(VIRTIO_DEVICE(n), "virtio-net", VIRTIO_ID_NET,
                                   n->config_size);
@@ -1439,6 +1557,9 @@ static int virtio_net_device_init(VirtIODevice *vdev)
 
     n->vlans = g_malloc0(MAX_VLAN >> 3);
 
+    nc = qemu_get_queue(n->nic);
+    nc->rxfilter_notify_enabled = 1;
+
     n->qdev = qdev;
     register_savevm(qdev, "virtio-net", -1, VIRTIO_NET_VM_VERSION,
                     virtio_net_save, virtio_net_load, n);
diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
index 1a6cfcf..1942cc4 100644
--- a/include/monitor/monitor.h
+++ b/include/monitor/monitor.h
@@ -41,6 +41,7 @@ typedef enum MonitorEvent {
     QEVENT_BLOCK_JOB_READY,
     QEVENT_DEVICE_DELETED,
     QEVENT_DEVICE_TRAY_MOVED,
+    QEVENT_NIC_RX_FILTER_CHANGED,
     QEVENT_SUSPEND,
     QEVENT_SUSPEND_DISK,
     QEVENT_WAKEUP,
diff --git a/include/net/net.h b/include/net/net.h
index 43d85a1..30e4b04 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -49,6 +49,7 @@ typedef ssize_t (NetReceiveIOV)(NetClientState *, const struct iovec *, int);
 typedef void (NetCleanup) (NetClientState *);
 typedef void (LinkStatusChanged)(NetClientState *);
 typedef void (NetClientDestructor)(NetClientState *);
+typedef RxFilterInfo *(QueryRxFilter)(NetClientState *);
 
 typedef struct NetClientInfo {
     NetClientOptionsKind type;
@@ -59,6 +60,7 @@ typedef struct NetClientInfo {
     NetCanReceive *can_receive;
     NetCleanup *cleanup;
     LinkStatusChanged *link_status_changed;
+    QueryRxFilter *query_rx_filter;
     NetPoll *poll;
 } NetClientInfo;
 
@@ -74,6 +76,7 @@ struct NetClientState {
     unsigned receive_disabled : 1;
     NetClientDestructor *destructor;
     unsigned int queue_index;
+    unsigned rxfilter_notify_enabled:1;
 };
 
 typedef struct NICState {
diff --git a/monitor.c b/monitor.c
index 9be515c..4278ea3 100644
--- a/monitor.c
+++ b/monitor.c
@@ -490,6 +490,7 @@ static const char *monitor_event_names[] = {
     [QEVENT_BLOCK_JOB_READY] = "BLOCK_JOB_READY",
     [QEVENT_DEVICE_DELETED] = "DEVICE_DELETED",
     [QEVENT_DEVICE_TRAY_MOVED] = "DEVICE_TRAY_MOVED",
+    [QEVENT_NIC_RX_FILTER_CHANGED] = "NIC_RX_FILTER_CHANGED",
     [QEVENT_SUSPEND] = "SUSPEND",
     [QEVENT_SUSPEND_DISK] = "SUSPEND_DISK",
     [QEVENT_WAKEUP] = "WAKEUP",
diff --git a/net/net.c b/net/net.c
index 43a74e4..c0d61bf 100644
--- a/net/net.c
+++ b/net/net.c
@@ -961,6 +961,54 @@ void print_net_client(Monitor *mon, NetClientState *nc)
                    nc->info_str);
 }
 
+RxFilterInfoList *qmp_query_rx_filter(bool has_name, const char *name,
+                                      Error **errp)
+{
+    NetClientState *nc;
+    RxFilterInfoList *filter_list = NULL, *last_entry = NULL;
+
+    QTAILQ_FOREACH(nc, &net_clients, next) {
+        RxFilterInfoList *entry;
+        RxFilterInfo *info;
+
+        if (has_name && strcmp(nc->name, name) != 0) {
+            continue;
+        }
+
+        /* only query rx-filter information of NIC */
+        if (nc->info->type != NET_CLIENT_OPTIONS_KIND_NIC) {
+            if (has_name) {
+                error_setg(errp, "net client(%s) isn't a NIC", name);
+                break;
+            }
+            continue;
+        }
+
+        if (nc->info->query_rx_filter) {
+            info = nc->info->query_rx_filter(nc);
+            entry = g_malloc0(sizeof(*entry));
+            entry->value = info;
+
+            if (!filter_list) {
+                filter_list = entry;
+            } else {
+                last_entry->next = entry;
+            }
+            last_entry = entry;
+        } else if (has_name) {
+            error_setg(errp, "net client(%s) doesn't support"
+                       " rx-filter querying", name);
+            break;
+        }
+    }
+
+    if (filter_list == NULL && !error_is_set(errp) && has_name) {
+        error_setg(errp, "invalid net client name: %s", name);
+    }
+
+    return filter_list;
+}
+
 void do_info_network(Monitor *mon, const QDict *qdict)
 {
     NetClientState *nc, *peer;
diff --git a/qapi-schema.json b/qapi-schema.json
index 5c32528..95ba5a6 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3712,3 +3712,79 @@
             '*cpuid-input-ecx': 'int',
             'cpuid-register': 'X86CPURegister32',
             'features': 'int' } }
+
+##
+# @RxState:
+#
+# Packets receiving state
+#
+# @normal: filter assigned packets according to the mac-table
+#
+# @none: don't receive any assigned packet
+#
+# @all: receive all assigned packets
+#
+# Since: 1.6
+##
+{ 'enum': 'RxState', 'data': [ 'normal', 'none', 'all' ] }
+
+##
+# @RxFilterInfo:
+#
+# Rx-filter information for a NIC.
+#
+# @name: net client name
+#
+# @promiscuous: whether promiscuous mode is enabled
+#
+# @multicast: multicast receive state
+#
+# @unicast: unicast receive state
+#
+# @broadcast-allowed: whether to receive broadcast
+#
+# @multicast-overflow: multicast table is overflowed or not
+#
+# @unicast-overflow: unicast table is overflowed or not
+#
+# @main-mac: the main macaddr string
+#
+# @vlan-table: a list of active vlan id
+#
+# @unicast-table: a list of unicast macaddr string
+#
+# @multicast-table: a list of multicast macaddr string
+#
+# Since 1.6
+##
+
+{ 'type': 'RxFilterInfo',
+  'data': {
+    'name':               'str',
+    'promiscuous':        'bool',
+    'multicast':          'RxState',
+    'unicast':            'RxState',
+    'broadcast-allowed':  'bool',
+    'multicast-overflow': 'bool',
+    'unicast-overflow':   'bool',
+    'main-mac':           'str',
+    'vlan-table':         ['int'],
+    'unicast-table':      ['str'],
+    'multicast-table':    ['str'] }}
+
+##
+# @query-rx-filter:
+#
+# Return rx-filter information for all NICs (or for the given NIC).
+#
+# @name: #optional net client name
+#
+# Returns: list of @RxFilterInfo for all NICs (or for the given NIC).
+#          Returns an error if the given @name doesn't exist, or given
+#          NIC doesn't support rx-filter querying, or given net client
+#          isn't a NIC.
+#
+# Since: 1.6
+##
+{ 'command': 'query-rx-filter', 'data': { '*name': 'str' },
+  'returns': ['RxFilterInfo'] }
diff --git a/qmp-commands.hx b/qmp-commands.hx
index 362f0e1..aee3f96 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -3043,3 +3043,66 @@ Example:
 <- { "return": {} }
 
 EQMP
+    {
+        .name       = "query-rx-filter",
+        .args_type  = "name:s?",
+        .mhandler.cmd_new = qmp_marshal_input_query_rx_filter,
+    },
+
+SQMP
+query-rx-filter
+---------------
+
+Show rx-filter information.
+
+Returns a json-array of rx-filter information for all NICs (or for the
+given NIC), returning an error if the given NIC doesn't exist, or
+given NIC doesn't support rx-filter querying, or given net client
+isn't a NIC.
+
+The query will clear the event notification flag of each NIC, then qemu
+will start to emit event to QMP monitor.
+
+Each array entry contains the following:
+
+- "name": net client name (json-string)
+- "promiscuous": promiscuous mode is enabled (json-bool)
+- "multicast": multicast receive state (one of 'normal', 'none', 'all')
+- "unicast": unicast receive state  (one of 'normal', 'none', 'all')
+- "broadcast-allowed": allow to receive broadcast (json-bool)
+- "multicast-overflow": multicast table is overflowed (json-bool)
+- "unicast-overflow": unicast table is overflowed (json-bool)
+- "main-mac": main macaddr string (json-string)
+- "vlan-table": a json-array of active vlan id
+- "unicast-table": a json-array of unicast macaddr string
+- "multicast-table": a json-array of multicast macaddr string
+
+Example:
+
+-> { "execute": "query-rx-filter", "arguments": { "name": "vnet0" } }
+<- { "return": [
+        {
+            "promiscuous": true,
+            "name": "vnet0",
+            "main-mac": "52:54:00:12:34:56",
+            "unicast": "normal",
+            "vlan-table": [
+                4,
+                0
+            ],
+            "unicast-table": [
+            ],
+            "multicast": "normal",
+            "multicast-overflow": false,
+            "unicast-overflow": false,
+            "multicast-table": [
+                "01:00:5e:00:00:01",
+                "33:33:00:00:00:01",
+                "33:33:ff:12:34:56"
+            ],
+            "broadcast-allowed": false
+        }
+      ]
+   }
+
+EQMP
commit 82a3a11897308b606120f7235001e87809708f85
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 1 12:40:19 2013 +0100

    target-arm: Avoid g_hash_table_get_keys()
    
    g_hash_table_get_keys() was only introduced in glib 2.14, and we're
    still targeting a minimum version of 2.12.  Rewrite the offending
    code (introduced in commit 721fae1) to use g_hash_table_foreach()
    to build the list of keys.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Tested-by: Laurent Desnogues <laurent.desnogues at gmail.com>
    Tested-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: 1372678819-8633-1-git-send-email-peter.maydell at linaro.org

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 57fa8c8..aeae024 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -222,15 +222,23 @@ static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
     return aidx - bidx;
 }
 
+static void cpreg_make_keylist(gpointer key, gpointer value, gpointer udata)
+{
+    GList **plist = udata;
+
+    *plist = g_list_prepend(*plist, key);
+}
+
 void init_cpreg_list(ARMCPU *cpu)
 {
     /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
      * Note that we require cpreg_tuples[] to be sorted by key ID.
      */
-    GList *keys;
+    GList *keys = NULL;
     int arraylen;
 
-    keys = g_hash_table_get_keys(cpu->cp_regs);
+    g_hash_table_foreach(cpu->cp_regs, cpreg_make_keylist, &keys);
+
     keys = g_list_sort(keys, cpreg_key_compare);
 
     cpu->cpreg_array_len = 0;
commit 2ebcebe262e88111ff583f97bc5fe0aae64b8940
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Jun 27 16:38:47 2013 +0100

    target-arm: avoid undefined behaviour when writing TTBCR
    
    LPAE CPUs have more potentially valid bits in the TTBCR, and so the
    simple masking out of invalid bits is no longer sufficient to obtain
    the base address width field of the register, which is what we use to
    precalculate c2_mask and c2_base_mask.  Explicitly extract the
    relevant register field rather than simply shifting by the register
    value.
    
    This bug would have had no ill effects in practice, since if the
    EAE bit (TTBCR bit 31) is set then we don't use the precalculated
    masks, and if EAE is zero then bits 30..3 are all UNK/SBZP, so
    well-behaved guests won't set them. However the shift is undefined
    behaviour, so we should avoid it.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1372347527-4428-1-git-send-email-peter.maydell at linaro.org

diff --git a/target-arm/helper.c b/target-arm/helper.c
index b7c926d..57fa8c8 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -891,6 +891,8 @@ static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
 static int vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                 uint64_t value)
 {
+    int maskshift = extract32(value, 0, 3);
+
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
     } else {
@@ -902,8 +904,8 @@ static int vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
      * and the c2_mask and c2_base_mask values are meaningless.
      */
     env->cp15.c2_control = value;
-    env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> value);
-    env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> value);
+    env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> maskshift);
+    env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> maskshift);
     return 0;
 }
 
commit 204a9c43afb92e2ff44fc9d1d377bc98ee97e3d7
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Wed Jul 10 14:22:59 2013 +1000

    target-arm/helper.c: Allow const opaques in arm CP
    
    Allow for defining const opaque data in ARM CP register definitions by
    setting .opaque = foo. If non null opaque is passed into
    define_one_arm_cp_reg_with_opaque then that opaque will take
    precedence, otherwise if null opaque is passed, the original opaque
    data will be used.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: cf0a3ac3438d97464240db9f5f4ef1585cbc1d77.1373429432.git.peter.crosthwaite at xilinx.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 8d8a8de..b7c926d 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1608,7 +1608,9 @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
                 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
                 *key = ENCODE_CP_REG(r->cp, is64, r->crn, crm, opc1, opc2);
-                r2->opaque = opaque;
+                if (opaque) {
+                    r2->opaque = opaque;
+                }
                 /* Make sure reginfo passed to helpers for wildcarded regs
                  * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
                  */
commit 97ce8d61559b99492b4d389eba51a198e55b8455
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Wed Jul 10 14:22:21 2013 +1000

    target-arm/helper.c: Implement MIDR aliases
    
    Unimplemented registers in the cp15, CRn=0, opc1=0, CRm=0 space default
    to aliasing the MIDR register. Set all registers in the space to access
    MIDR by default.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: 6127846712b7ad2727354a4f5e1d809451f1e859.1373429432.git.peter.crosthwaite at xilinx.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 47e6c09..8d8a8de 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1378,9 +1378,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
         define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
     }
-    if (arm_feature(env, ARM_FEATURE_MPIDR)) {
-        define_arm_cp_regs(cpu, mpidr_cp_reginfo);
-    }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         define_arm_cp_regs(cpu, lpae_cp_reginfo);
     }
@@ -1393,12 +1390,17 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             /* Note that the MIDR isn't a simple constant register because
              * of the TI925 behaviour where writes to another register can
              * cause the MIDR value to change.
+             *
+             * Unimplemented registers in the c15 0 0 0 space default to
+             * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
+             * and friends override accordingly.
              */
             { .name = "MIDR",
-              .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
+              .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
               .access = PL1_R, .resetvalue = cpu->midr,
               .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
-              .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid) },
+              .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
+              .type = ARM_CP_OVERRIDE },
             { .name = "CTR",
               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
@@ -1447,6 +1449,10 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, id_cp_reginfo);
     }
 
+    if (arm_feature(env, ARM_FEATURE_MPIDR)) {
+        define_arm_cp_regs(cpu, mpidr_cp_reginfo);
+    }
+
     if (arm_feature(env, ARM_FEATURE_AUXCR)) {
         ARMCPRegInfo auxcr = {
             .name = "AUXCR", .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1,
commit a703eda18a5c3e9b45f2b9a337a3e1e16c836cf9
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Wed Jul 10 14:21:42 2013 +1000

    target-arm/helper.c: OMAP/StrongARM cp15 crn=0 cleanup
    
    The if block detecting OMAP/StrongARM modifies the id_cp_reginfo
    .access fields in place. So there is no need to replicate the call
    to define_arm_cp_reg(). Dropped, and let the OMAP case fall through
    to the normal behaviour after the in-place modification.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: 72aae9b8ebbc9a76d2b06faf8666ef8a4b34b92a.1373429432.git.peter.crosthwaite at xilinx.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 5f639fd..47e6c09 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1435,21 +1435,16 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             arm_feature(env, ARM_FEATURE_STRONGARM)) {
             ARMCPRegInfo *r;
             /* Register the blanket "writes ignored" value first to cover the
-             * whole space. Then define the specific ID registers, but update
-             * their access field to allow write access, so that they ignore
-             * writes rather than causing them to UNDEF.
+             * whole space. Then update the specific ID registers to allow write
+             * access, so that they ignore writes rather than causing them to
+             * UNDEF.
              */
             define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
             for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
                 r->access = PL1_RW;
-                define_one_arm_cp_reg(cpu, r);
             }
-        } else {
-            /* Just register the standard ID registers (read-only, meaning
-             * that writes will UNDEF).
-             */
-            define_arm_cp_regs(cpu, id_cp_reginfo);
         }
+        define_arm_cp_regs(cpu, id_cp_reginfo);
     }
 
     if (arm_feature(env, ARM_FEATURE_AUXCR)) {
commit 12b10571141a20e1c23d3b597e55d5d1a3113265
Author: Mans Rullgard <mans at mansr.com>
Date:   Mon Jul 15 14:35:25 2013 +0100

    target-arm: explicitly decode SEVL instruction
    
    The ARMv8 SEVL instruction is in the architectural hint space already
    emulated as nop.  This makes the decoding of SEVL explicit for clarity.
    
    Signed-off-by: Mans Rullgard <mans at mansr.com>
    Message-id: 1370606786-5650-3-git-send-email-mans at mansr.com
    [PMM: added 'SEVL' to the TODO comment]
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/translate.c b/target-arm/translate.c
index b7663dd..7b50c8c 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -3501,7 +3501,8 @@ static void gen_nop_hint(DisasContext *s, int val)
         break;
     case 2: /* wfe */
     case 4: /* sev */
-        /* TODO: Implement SEV and WFE.  May help SMP performance.  */
+    case 5: /* sevl */
+        /* TODO: Implement SEV, SEVL and WFE.  May help SMP performance.  */
     default: /* nop */
         break;
     }
commit 2359bf80c1c4e8ed1e7ddb03661fec6bace82a87
Author: Mans Rullgard <mans at mansr.com>
Date:   Mon Jul 15 14:35:25 2013 +0100

    target-arm: implement LDA/STL instructions
    
    This adds support for the ARMv8 load acquire/store release instructions.
    Since qemu does nothing special for memory barriers, these can be
    emulated like their non-acquire/release counterparts.
    
    Signed-off-by: Mans Rullgard <mans at mansr.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/translate.c b/target-arm/translate.c
index 0db1132..b7663dd 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -7274,14 +7274,72 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
                     rd = (insn >> 12) & 0xf;
                     if (insn & (1 << 23)) {
                         /* load/store exclusive */
+                        int op2 = (insn >> 8) & 3;
                         op1 = (insn >> 21) & 0x3;
-                        if (op1)
-                            ARCH(6K);
-                        else
-                            ARCH(6);
+
+                        switch (op2) {
+                        case 0: /* lda/stl */
+                            if (op1 == 1) {
+                                goto illegal_op;
+                            }
+                            ARCH(8);
+                            break;
+                        case 1: /* reserved */
+                            goto illegal_op;
+                        case 2: /* ldaex/stlex */
+                            ARCH(8);
+                            break;
+                        case 3: /* ldrex/strex */
+                            if (op1) {
+                                ARCH(6K);
+                            } else {
+                                ARCH(6);
+                            }
+                            break;
+                        }
+
                         addr = tcg_temp_local_new_i32();
                         load_reg_var(s, addr, rn);
-                        if (insn & (1 << 20)) {
+
+                        /* Since the emulation does not have barriers,
+                           the acquire/release semantics need no special
+                           handling */
+                        if (op2 == 0) {
+                            if (insn & (1 << 20)) {
+                                tmp = tcg_temp_new_i32();
+                                switch (op1) {
+                                case 0: /* lda */
+                                    tcg_gen_qemu_ld32u(tmp, addr, IS_USER(s));
+                                    break;
+                                case 2: /* ldab */
+                                    tcg_gen_qemu_ld8u(tmp, addr, IS_USER(s));
+                                    break;
+                                case 3: /* ldah */
+                                    tcg_gen_qemu_ld16u(tmp, addr, IS_USER(s));
+                                    break;
+                                default:
+                                    abort();
+                                }
+                                store_reg(s, rd, tmp);
+                            } else {
+                                rm = insn & 0xf;
+                                tmp = load_reg(s, rm);
+                                switch (op1) {
+                                case 0: /* stl */
+                                    tcg_gen_qemu_st32(tmp, addr, IS_USER(s));
+                                    break;
+                                case 2: /* stlb */
+                                    tcg_gen_qemu_st8(tmp, addr, IS_USER(s));
+                                    break;
+                                case 3: /* stlh */
+                                    tcg_gen_qemu_st16(tmp, addr, IS_USER(s));
+                                    break;
+                                default:
+                                    abort();
+                                }
+                                tcg_temp_free_i32(tmp);
+                            }
+                        } else if (insn & (1 << 20)) {
                             switch (op1) {
                             case 0: /* ldrex */
                                 gen_load_exclusive(s, rd, 15, addr, 2);
@@ -8126,7 +8184,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                     gen_store_exclusive(s, rd, rs, 15, addr, 2);
                 }
                 tcg_temp_free_i32(addr);
-            } else if ((insn & (1 << 6)) == 0) {
+            } else if ((insn & (7 << 5)) == 0) {
                 /* Table Branch.  */
                 if (rn == 15) {
                     addr = tcg_temp_new_i32();
@@ -8152,15 +8210,66 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                 tcg_gen_addi_i32(tmp, tmp, s->pc);
                 store_reg(s, 15, tmp);
             } else {
-                /* Load/store exclusive byte/halfword/doubleword.  */
-                ARCH(7);
+                int op2 = (insn >> 6) & 0x3;
                 op = (insn >> 4) & 0x3;
-                if (op == 2) {
+                switch (op2) {
+                case 0:
                     goto illegal_op;
+                case 1:
+                    /* Load/store exclusive byte/halfword/doubleword */
+                    if (op == 2) {
+                        goto illegal_op;
+                    }
+                    ARCH(7);
+                    break;
+                case 2:
+                    /* Load-acquire/store-release */
+                    if (op == 3) {
+                        goto illegal_op;
+                    }
+                    /* Fall through */
+                case 3:
+                    /* Load-acquire/store-release exclusive */
+                    ARCH(8);
+                    break;
                 }
                 addr = tcg_temp_local_new_i32();
                 load_reg_var(s, addr, rn);
-                if (insn & (1 << 20)) {
+                if (!(op2 & 1)) {
+                    if (insn & (1 << 20)) {
+                        tmp = tcg_temp_new_i32();
+                        switch (op) {
+                        case 0: /* ldab */
+                            tcg_gen_qemu_ld8u(tmp, addr, IS_USER(s));
+                            break;
+                        case 1: /* ldah */
+                            tcg_gen_qemu_ld16u(tmp, addr, IS_USER(s));
+                            break;
+                        case 2: /* lda */
+                            tcg_gen_qemu_ld32u(tmp, addr, IS_USER(s));
+                            break;
+                        default:
+                            abort();
+                        }
+                        store_reg(s, rs, tmp);
+                    } else {
+                        tmp = load_reg(s, rs);
+                        switch (op) {
+                        case 0: /* stlb */
+                            tcg_gen_qemu_st8(tmp, addr, IS_USER(s));
+                            break;
+                        case 1: /* stlh */
+                            tcg_gen_qemu_st16(tmp, addr, IS_USER(s));
+                            break;
+                        case 2: /* stl */
+                            tcg_gen_qemu_st32(tmp, addr, IS_USER(s));
+                            break;
+                        default:
+                            abort();
+                        }
+                        tcg_temp_free_i32(tmp);
+                    }
+                } else if (insn & (1 << 20)) {
                     gen_load_exclusive(s, rs, rd, addr, op);
                 } else {
                     gen_store_exclusive(s, rm, rs, rd, addr, op);
commit bf72d89f0a8fb27a6bfde1a689690fd577227762
Author: Dominik Dingel <dingel at linux.vnet.ibm.com>
Date:   Thu Jul 11 13:22:19 2013 +0200

    virtio-ccw: Enable x-data-plane for virtio-ccw-blk
    
    Add property x-data-plane to virtio-ccw-blk devices.
    
    Signed-off-by: Dominik Dingel <dingel at linux.vnet.ibm.com>
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index e744957..8835bd4 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1031,6 +1031,9 @@ static Property virtio_ccw_blk_properties[] = {
     DEFINE_VIRTIO_BLK_PROPERTIES(VirtIOBlkCcw, blk),
     DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
                     VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
+#ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+    DEFINE_PROP_BIT("x-data-plane", VirtIOBlkCcw, blk.data_plane, 0, false),
+#endif
     DEFINE_PROP_END_OF_LIST(),
 };
 
commit b25a83f0538fceede15cba6cfd6ea0f1ffc9d777
Author: Andre Przywara <andre.przywara at calxeda.com>
Date:   Fri Jul 5 14:21:37 2013 +0200

    ARM/highbank: add support for Calxeda ECX-2000 / Midway
    
    The Calxeda ECX-2000 chip (aka. Midway) is model-wise quite similar
    to the Highbank. The most prominent difference is the Cortex-A15 CPU
    core in it, together with the associated core peripherals.
    
    Add a new ARM machine type called "midway".
    Move the L2 cache controller device into the Highbank specific part,
    since Midway does not have (and need) it.
    
    Signed-off-by: Andre Przywara <andre.przywara at calxeda.com>
    Message-id: 1373026897-12085-3-git-send-email-andre.przywara at calxeda.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index b8a7dd4..be264d3 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -185,6 +185,7 @@ static struct arm_boot_info highbank_binfo;
 
 enum cxmachines {
     CALXEDA_HIGHBANK,
+    CALXEDA_MIDWAY,
 };
 
 /* ram_size must be set to match the upper bound of memory in the
@@ -216,6 +217,9 @@ static void calxeda_init(QEMUMachineInitArgs *args, enum cxmachines machine)
         case CALXEDA_HIGHBANK:
             cpu_model = "cortex-a9";
             break;
+        case CALXEDA_MIDWAY:
+            cpu_model = "cortex-a15";
+            break;
         }
     }
 
@@ -256,8 +260,16 @@ static void calxeda_init(QEMUMachineInitArgs *args, enum cxmachines machine)
 
     switch (machine) {
     case CALXEDA_HIGHBANK:
+        dev = qdev_create(NULL, "l2x0");
+        qdev_init_nofail(dev);
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, 0xfff12000);
+
         dev = qdev_create(NULL, "a9mpcore_priv");
         break;
+    case CALXEDA_MIDWAY:
+        dev = qdev_create(NULL, "a15mpcore_priv");
+        break;
     }
     qdev_prop_set_uint32(dev, "num-cpu", smp_cpus);
     qdev_prop_set_uint32(dev, "num-irq", NIRQ_GIC);
@@ -272,11 +284,6 @@ static void calxeda_init(QEMUMachineInitArgs *args, enum cxmachines machine)
         pic[n] = qdev_get_gpio_in(dev, n);
     }
 
-    dev = qdev_create(NULL, "l2x0");
-    qdev_init_nofail(dev);
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_mmio_map(busdev, 0, 0xfff12000);
-
     dev = qdev_create(NULL, "sp804");
     qdev_prop_set_uint32(dev, "freq0", 150000000);
     qdev_prop_set_uint32(dev, "freq1", 150000000);
@@ -341,6 +348,11 @@ static void highbank_init(QEMUMachineInitArgs *args)
     calxeda_init(args, CALXEDA_HIGHBANK);
 }
 
+static void midway_init(QEMUMachineInitArgs *args)
+{
+    calxeda_init(args, CALXEDA_MIDWAY);
+}
+
 static QEMUMachine highbank_machine = {
     .name = "highbank",
     .desc = "Calxeda Highbank (ECX-1000)",
@@ -350,9 +362,19 @@ static QEMUMachine highbank_machine = {
     DEFAULT_MACHINE_OPTIONS,
 };
 
+static QEMUMachine midway_machine = {
+    .name = "midway",
+    .desc = "Calxeda Midway (ECX-2000)",
+    .init = midway_init,
+    .block_default_type = IF_SCSI,
+    .max_cpus = 4,
+    DEFAULT_MACHINE_OPTIONS,
+};
+
 static void calxeda_machines_init(void)
 {
     qemu_register_machine(&highbank_machine);
+    qemu_register_machine(&midway_machine);
 }
 
 machine_init(calxeda_machines_init);
commit 574f66bcbe10cd8fbf8bbf6d87451a944ae421bd
Author: Andre Przywara <andre.przywara at calxeda.com>
Date:   Fri Jul 5 14:21:36 2013 +0200

    ARM/highbank: prepare for adding similar machines
    
    To allow the modelling of machines similar to Calxeda Highbank,
    introduce a parameter to the init function and call it from a
    wrapper. This allows to tweak the definition for individual machines
    later on.
    
    Signed-off-by: Andre Przywara <andre.przywara at calxeda.com>
    Message-id: 1373026897-12085-2-git-send-email-andre.przywara at calxeda.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index 3a2fb4c..b8a7dd4 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -183,20 +183,24 @@ type_init(highbank_regs_register_types)
 
 static struct arm_boot_info highbank_binfo;
 
+enum cxmachines {
+    CALXEDA_HIGHBANK,
+};
+
 /* ram_size must be set to match the upper bound of memory in the
  * device tree (linux/arch/arm/boot/dts/highbank.dts), which is
  * normally 0xff900000 or -m 4089. When running this board on a
  * 32-bit host, set the reg value of memory to 0xf7ff00000 in the
  * device tree and pass -m 2047 to QEMU.
  */
-static void highbank_init(QEMUMachineInitArgs *args)
+static void calxeda_init(QEMUMachineInitArgs *args, enum cxmachines machine)
 {
     ram_addr_t ram_size = args->ram_size;
     const char *cpu_model = args->cpu_model;
     const char *kernel_filename = args->kernel_filename;
     const char *kernel_cmdline = args->kernel_cmdline;
     const char *initrd_filename = args->initrd_filename;
-    DeviceState *dev;
+    DeviceState *dev = NULL;
     SysBusDevice *busdev;
     qemu_irq *irqp;
     qemu_irq pic[128];
@@ -208,7 +212,11 @@ static void highbank_init(QEMUMachineInitArgs *args)
     char *sysboot_filename;
 
     if (!cpu_model) {
-        cpu_model = "cortex-a9";
+        switch (machine) {
+        case CALXEDA_HIGHBANK:
+            cpu_model = "cortex-a9";
+            break;
+        }
     }
 
     for (n = 0; n < smp_cpus; n++) {
@@ -246,7 +254,11 @@ static void highbank_init(QEMUMachineInitArgs *args)
         }
     }
 
-    dev = qdev_create(NULL, "a9mpcore_priv");
+    switch (machine) {
+    case CALXEDA_HIGHBANK:
+        dev = qdev_create(NULL, "a9mpcore_priv");
+        break;
+    }
     qdev_prop_set_uint32(dev, "num-cpu", smp_cpus);
     qdev_prop_set_uint32(dev, "num-irq", NIRQ_GIC);
     qdev_init_nofail(dev);
@@ -324,6 +336,11 @@ static void highbank_init(QEMUMachineInitArgs *args)
     arm_load_kernel(ARM_CPU(first_cpu), &highbank_binfo);
 }
 
+static void highbank_init(QEMUMachineInitArgs *args)
+{
+    calxeda_init(args, CALXEDA_HIGHBANK);
+}
+
 static QEMUMachine highbank_machine = {
     .name = "highbank",
     .desc = "Calxeda Highbank (ECX-1000)",
@@ -333,9 +350,9 @@ static QEMUMachine highbank_machine = {
     DEFAULT_MACHINE_OPTIONS,
 };
 
-static void highbank_machine_init(void)
+static void calxeda_machines_init(void)
 {
     qemu_register_machine(&highbank_machine);
 }
 
-machine_init(highbank_machine_init);
+machine_init(calxeda_machines_init);
commit 8941d6ce25b43824cf96d30cb94742e02e80b2f2
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 9 13:49:40 2013 +0100

    hw/arm/vexpress: Add alias for flash at address 0 on A15 board
    
    The A15 Versatile Express board can remap a variety of things at address
    0. We don't currently emulate the Serial Configuration Controller which
    is how the guest can control this remapping, but we can provide the
    initial default mapping of the first flash device into this space.
    In particular this allows QEMU to boot flash images such as UEFI which
    expect to include an exception vector table.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Tested-by: Grant Likely <grant.likely at linaro.org>
    Message-id: 1373374180-19884-1-git-send-email-peter.maydell at linaro.org

diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index fd18b60..7d1b823 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -67,6 +67,7 @@ enum {
     VE_CLCD,
     VE_NORFLASH0,
     VE_NORFLASH1,
+    VE_NORFLASHALIAS,
     VE_SRAM,
     VE_VIDEORAM,
     VE_ETHERNET,
@@ -104,9 +105,11 @@ static hwaddr motherboard_legacy_map[] = {
     [VE_VIDEORAM] = 0x4c000000,
     [VE_ETHERNET] = 0x4e000000,
     [VE_USB] = 0x4f000000,
+    [VE_NORFLASHALIAS] = -1, /* not present */
 };
 
 static hwaddr motherboard_aseries_map[] = {
+    [VE_NORFLASHALIAS] = 0,
     /* CS0: 0x08000000 .. 0x0c000000 */
     [VE_NORFLASH0] = 0x08000000,
     /* CS4: 0x0c000000 .. 0x10000000 */
@@ -400,10 +403,13 @@ static void vexpress_common_init(const VEDBoardInfo *daughterboard,
     qemu_irq pic[64];
     uint32_t sys_id;
     DriveInfo *dinfo;
+    pflash_t *pflash0;
     ram_addr_t vram_size, sram_size;
     MemoryRegion *sysmem = get_system_memory();
     MemoryRegion *vram = g_new(MemoryRegion, 1);
     MemoryRegion *sram = g_new(MemoryRegion, 1);
+    MemoryRegion *flashalias = g_new(MemoryRegion, 1);
+    MemoryRegion *flash0mem;
     const hwaddr *map = daughterboard->motherboard_map;
     int i;
 
@@ -471,15 +477,24 @@ static void vexpress_common_init(const VEDBoardInfo *daughterboard,
     sysbus_create_simple("pl111", map[VE_CLCD], pic[14]);
 
     dinfo = drive_get_next(IF_PFLASH);
-    if (!pflash_cfi01_register(map[VE_NORFLASH0], NULL, "vexpress.flash0",
+    pflash0 = pflash_cfi01_register(map[VE_NORFLASH0], NULL, "vexpress.flash0",
             VEXPRESS_FLASH_SIZE, dinfo ? dinfo->bdrv : NULL,
             VEXPRESS_FLASH_SECT_SIZE,
             VEXPRESS_FLASH_SIZE / VEXPRESS_FLASH_SECT_SIZE, 4,
-            0x00, 0x89, 0x00, 0x18, 0)) {
+            0x00, 0x89, 0x00, 0x18, 0);
+    if (!pflash0) {
         fprintf(stderr, "vexpress: error registering flash 0.\n");
         exit(1);
     }
 
+    if (map[VE_NORFLASHALIAS] != -1) {
+        /* Map flash 0 as an alias into low memory */
+        flash0mem = sysbus_mmio_get_region(SYS_BUS_DEVICE(pflash0), 0);
+        memory_region_init_alias(flashalias, NULL, "vexpress.flashalias",
+                                 flash0mem, 0, VEXPRESS_FLASH_SIZE);
+        memory_region_add_subregion(sysmem, map[VE_NORFLASHALIAS], flashalias);
+    }
+
     dinfo = drive_get_next(IF_PFLASH);
     if (!pflash_cfi01_register(map[VE_NORFLASH1], NULL, "vexpress.flash1",
             VEXPRESS_FLASH_SIZE, dinfo ? dinfo->bdrv : NULL,
commit 7648673636bbd7dcb9abf3cc87a8ba7a65b85436
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Jun 28 13:51:59 2013 +0100

    hw/dma/omap_dma: Fix bugs with DMA requests above 32
    
    The drqbmp field of struct soc_dma_s is a uint64_t; however several
    places in the code attempt to set bits in it using "(1 << drq)",
    which will fail if drq is large enough that the 1 bit gets shifted
    off the top of a 32 bit integer.  Change these to "(1ULL << drq)" so
    that the promotion to 64 bit happens before the shift rather than
    afterwards.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1372423919-5669-1-git-send-email-peter.maydell at linaro.org

diff --git a/hw/dma/omap_dma.c b/hw/dma/omap_dma.c
index a81ffc4..0e8cccd 100644
--- a/hw/dma/omap_dma.c
+++ b/hw/dma/omap_dma.c
@@ -248,7 +248,7 @@ static void omap_dma_deactivate_channel(struct omap_dma_s *s,
 
     /* Don't deactive the channel if it is synchronized and the DMA request is
        active */
-    if (ch->sync && ch->enable && (s->dma->drqbmp & (1 << ch->sync)))
+    if (ch->sync && ch->enable && (s->dma->drqbmp & (1ULL << ch->sync)))
         return;
 
     if (ch->active) {
@@ -268,8 +268,9 @@ static void omap_dma_enable_channel(struct omap_dma_s *s,
         /* TODO: theoretically if ch->sync && ch->prefetch &&
          * !s->dma->drqbmp[ch->sync], we should also activate and fetch
          * from source and then stall until signalled.  */
-        if ((!ch->sync) || (s->dma->drqbmp & (1 << ch->sync)))
+        if ((!ch->sync) || (s->dma->drqbmp & (1ULL << ch->sync))) {
             omap_dma_activate_channel(s, ch);
+        }
     }
 }
 
@@ -1551,12 +1552,12 @@ static void omap_dma_request(void *opaque, int drq, int req)
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
     /* The request pins are level triggered in QEMU.  */
     if (req) {
-        if (~s->dma->drqbmp & (1 << drq)) {
-            s->dma->drqbmp |= 1 << drq;
+        if (~s->dma->drqbmp & (1ULL << drq)) {
+            s->dma->drqbmp |= 1ULL << drq;
             omap_dma_process_request(s, drq);
         }
     } else
-        s->dma->drqbmp &= ~(1 << drq);
+        s->dma->drqbmp &= ~(1ULL << drq);
 }
 
 /* XXX: this won't be needed once soc_dma knows about clocks.  */
commit 8827b0fb66cab9f7978c4e66dad4cf3c0989a72e
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Jun 27 15:03:51 2013 +0100

    sd/pl181.c: Avoid undefined shift behaviour in RWORD macro
    
    Add a cast to avoid potentially shifting into the sign bit of
    a signed value, which is undefined behaviour in C.
    
    (Detected with clang's -fsanitize=undefined.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1372341831-4264-1-git-send-email-peter.maydell at linaro.org

diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index 4b17234..f5eb1e4 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -175,7 +175,7 @@ static void pl181_send_command(pl181_state *s)
     if (rlen < 0)
         goto error;
     if (s->cmd & PL181_CMD_RESPONSE) {
-#define RWORD(n) ((response[n] << 24) | (response[n + 1] << 16) \
+#define RWORD(n) (((uint32_t)response[n] << 24) | (response[n + 1] << 16) \
                   | (response[n + 2] << 8) | response[n + 3])
         if (rlen == 0 || (rlen == 4 && (s->cmd & PL181_CMD_LONGRESP)))
             goto error;
commit 528622421eb1be95eaadfe91e8e11729d1e46431
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Jul 5 14:54:41 2013 +0100

    hw/cpu/a15mpcore: Correct default value for num-irq
    
    The a15mpcore device claims that its default value for num-irq
    is the number of interrupts used by the A15MP in the vexpress-a15
    board. However that chip has 128 external interrupts, not 64.
    Since there is only one A15 based model in QEMU currently, we
    can fix this by simply changing the default value.
    
    This error was causing recent (3.10) Linux kernels to print
    warnings/backtraces when the number of interrupts reported
    by the GIC was smaller than an interrupt number they wanted
    to use.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1373032481-15280-1-git-send-email-peter.maydell at linaro.org

diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index 967b080..c736257 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -82,12 +82,12 @@ static int a15mp_priv_init(SysBusDevice *dev)
 static Property a15mp_priv_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", A15MPPrivState, num_cpu, 1),
     /* The Cortex-A15MP may have anything from 0 to 224 external interrupt
-     * IRQ lines (with another 32 internal). We default to 64+32, which
+     * IRQ lines (with another 32 internal). We default to 128+32, which
      * is the number provided by the Cortex-A15MP test chip in the
      * Versatile Express A15 development board.
      * Other boards may differ and should set this property appropriately.
      */
-    DEFINE_PROP_UINT32("num-irq", A15MPPrivState, num_irq, 96),
+    DEFINE_PROP_UINT32("num-irq", A15MPPrivState, num_irq, 160),
     DEFINE_PROP_END_OF_LIST(),
 };
 
commit 81e69fb093099ec5dccd61c92cec308f83091511
Author: Mans Rullgard <mans at mansr.com>
Date:   Mon Jul 15 14:35:25 2013 +0100

    target-arm: add feature flag for ARMv8
    
    Signed-off-by: Mans Rullgard <mans at mansr.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index be26acc..9f1696f 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -157,6 +157,11 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     CPUARMState *env = &cpu->env;
 
     /* Some features automatically imply others: */
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_ARM_DIV);
+        set_feature(env, ARM_FEATURE_LPAE);
+    }
     if (arm_feature(env, ARM_FEATURE_V7)) {
         set_feature(env, ARM_FEATURE_VAPA);
         set_feature(env, ARM_FEATURE_THUMB2);
@@ -744,7 +749,7 @@ static void pxa270c5_initfn(Object *obj)
 static void arm_any_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_V8);
     set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_VFP_FP16);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 1369604..c798b27 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -387,6 +387,7 @@ enum arm_features {
     ARM_FEATURE_MPIDR, /* has cp15 MPIDR */
     ARM_FEATURE_PXN, /* has Privileged Execute Never bit */
     ARM_FEATURE_LPAE, /* has Large Physical Address Extension */
+    ARM_FEATURE_V8,
 };
 
 static inline int arm_feature(CPUARMState *env, int feature)
diff --git a/target-arm/translate.c b/target-arm/translate.c
index 9310c58..0db1132 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -42,6 +42,7 @@
 #define ENABLE_ARCH_6K   arm_feature(env, ARM_FEATURE_V6K)
 #define ENABLE_ARCH_6T2   arm_feature(env, ARM_FEATURE_THUMB2)
 #define ENABLE_ARCH_7     arm_feature(env, ARM_FEATURE_V7)
+#define ENABLE_ARCH_8     arm_feature(env, ARM_FEATURE_V8)
 
 #define ARCH(x) do { if (!ENABLE_ARCH_##x) goto illegal_op; } while(0)
 
commit 9121d02cb33c96b444a3973579f5edc119597e81
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jul 15 12:28:07 2013 +0100

    char/cadence_uart: Fix reset for unattached instances
    
    commit 1db8b5efe0c2b5000e50691eea61264a615f43de introduced an issue
    where QEMU would segfault if you have an unattached Cadence UART.
    
    Fix by guarding the flush-on-reset logic on there being a qemu_chr
    attachment.
    
    Reported-by: Soren Brinkmann <soren.brinkmann at xilinx.com>
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Tested-by: Soren Brinkmann <soren.brinkmann at xilinx.com>
    Message-id: 9009578ee10a50d994b2e10aa2840d73765f5968.1370577272.git.peter.crosthwaite at xilinx.com
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 131370a..4d457f8 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -157,7 +157,9 @@ static void uart_rx_reset(UartState *s)
 {
     s->rx_wpos = 0;
     s->rx_count = 0;
-    qemu_chr_accept_input(s->chr);
+    if (s->chr) {
+        qemu_chr_accept_input(s->chr);
+    }
 
     s->r[R_SR] |= UART_SR_INTR_REMPTY;
     s->r[R_SR] &= ~UART_SR_INTR_RFUL;
commit c6d8ed24b446b1f1e07af87cde54317f54a1d42e
Author: Jani Kokkonen <Jani.Kokkonen at huawei.com>
Date:   Wed Jul 10 17:02:00 2013 +0200

    tcg/aarch64: Implement tlb lookup fast path
    
    Supports CONFIG_QEMU_LDST_OPTIMIZATION
    
    Signed-off-by: Jani Kokkonen <jani.kokkonen at huawei.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Claudio Fontana <claudio.fontana at huawei.com>

diff --git a/configure b/configure
index 0e0adde..8e425ba 100755
--- a/configure
+++ b/configure
@@ -3594,7 +3594,7 @@ echo "libs_softmmu=$libs_softmmu" >> $config_host_mak
 echo "ARCH=$ARCH" >> $config_host_mak
 
 case "$cpu" in
-  arm|i386|x86_64|ppc)
+  arm|i386|x86_64|ppc|aarch64)
     # The TCG interpreter currently does not support ld/st optimization.
     if test "$tcg_interpreter" = "no" ; then
         echo "CONFIG_QEMU_LDST_OPTIMIZATION=y" >> $config_host_mak
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index b2162a4..5920f73 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -358,6 +358,20 @@ static inline uintptr_t tcg_getpc_ldst(uintptr_t ra)
                                    not the start of the next opcode  */
     return ra;
 }
+#elif defined(__aarch64__)
+#  define GETRA()       ((uintptr_t)__builtin_return_address(0))
+#  define GETPC_LDST()  tcg_getpc_ldst(GETRA())
+static inline uintptr_t tcg_getpc_ldst(uintptr_t ra)
+{
+    int32_t b;
+    ra += 4;                    /* skip one instruction */
+    b = *(int32_t *)ra;         /* load the branch insn */
+    b = (b << 6) >> (6 - 2);    /* extract the displacement */
+    ra += b;                    /* apply the displacement  */
+    ra -= 4;                    /* return a pointer into the current opcode,
+                                   not the start of the next opcode  */
+    return ra;
+}
 # else
 #  error "CONFIG_QEMU_LDST_OPTIMIZATION needs GETPC_LDST() implementation!"
 # endif
diff --git a/tcg/aarch64/tcg-target.c b/tcg/aarch64/tcg-target.c
index cfd4081..41a17f8 100644
--- a/tcg/aarch64/tcg-target.c
+++ b/tcg/aarch64/tcg-target.c
@@ -732,6 +732,51 @@ static inline void tcg_out_uxt(TCGContext *s, int s_bits,
     tcg_out_ubfm(s, 0, rd, rn, 0, bits);
 }
 
+static inline void tcg_out_addi(TCGContext *s, int ext,
+                                TCGReg rd, TCGReg rn, unsigned int aimm)
+{
+    /* add immediate aimm unsigned 12bit value (with LSL 0 or 12) */
+    /* using ADD 0x11000000 | (ext) | (aimm << 10) | (rn << 5) | rd */
+    unsigned int base = ext ? 0x91000000 : 0x11000000;
+
+    if (aimm <= 0xfff) {
+        aimm <<= 10;
+    } else {
+        /* we can only shift left by 12, on assert we cannot represent */
+        assert(!(aimm & 0xfff));
+        assert(aimm <= 0xfff000);
+        base |= 1 << 22; /* apply LSL 12 */
+        aimm >>= 2;
+    }
+
+    tcg_out32(s, base | aimm | (rn << 5) | rd);
+}
+
+static inline void tcg_out_subi(TCGContext *s, int ext,
+                                TCGReg rd, TCGReg rn, unsigned int aimm)
+{
+    /* sub immediate aimm unsigned 12bit value (with LSL 0 or 12) */
+    /* using SUB 0x51000000 | (ext) | (aimm << 10) | (rn << 5) | rd */
+    unsigned int base = ext ? 0xd1000000 : 0x51000000;
+
+    if (aimm <= 0xfff) {
+        aimm <<= 10;
+    } else {
+        /* we can only shift left by 12, on assert we cannot represent */
+        assert(!(aimm & 0xfff));
+        assert(aimm <= 0xfff000);
+        base |= 1 << 22; /* apply LSL 12 */
+        aimm >>= 2;
+    }
+
+    tcg_out32(s, base | aimm | (rn << 5) | rd);
+}
+
+static inline void tcg_out_nop(TCGContext *s)
+{
+    tcg_out32(s, 0xd503201f);
+}
+
 #ifdef CONFIG_SOFTMMU
 #include "exec/softmmu_defs.h"
 
@@ -753,7 +798,125 @@ static const void * const qemu_st_helpers[4] = {
     helper_stq_mmu,
 };
 
-#else /* !CONFIG_SOFTMMU */
+static void tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+{
+    reloc_pc19(lb->label_ptr[0], (tcg_target_long)s->code_ptr);
+    tcg_out_movr(s, 1, TCG_REG_X0, TCG_AREG0);
+    tcg_out_movr(s, (TARGET_LONG_BITS == 64), TCG_REG_X1, lb->addrlo_reg);
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X2, lb->mem_index);
+    tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP,
+                 (tcg_target_long)qemu_ld_helpers[lb->opc & 3]);
+    tcg_out_callr(s, TCG_REG_TMP);
+    if (lb->opc & 0x04) {
+        tcg_out_sxt(s, 1, lb->opc & 3, lb->datalo_reg, TCG_REG_X0);
+    } else {
+        tcg_out_movr(s, 1, lb->datalo_reg, TCG_REG_X0);
+    }
+
+    tcg_out_goto(s, (tcg_target_long)lb->raddr);
+}
+
+static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *lb)
+{
+    reloc_pc19(lb->label_ptr[0], (tcg_target_long)s->code_ptr);
+
+    tcg_out_movr(s, 1, TCG_REG_X0, TCG_AREG0);
+    tcg_out_movr(s, (TARGET_LONG_BITS == 64), TCG_REG_X1, lb->addrlo_reg);
+    tcg_out_movr(s, 1, TCG_REG_X2, lb->datalo_reg);
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X3, lb->mem_index);
+    tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP,
+                 (tcg_target_long)qemu_st_helpers[lb->opc & 3]);
+    tcg_out_callr(s, TCG_REG_TMP);
+
+    tcg_out_nop(s);
+    tcg_out_goto(s, (tcg_target_long)lb->raddr);
+}
+
+void tcg_out_tb_finalize(TCGContext *s)
+{
+    int i;
+    for (i = 0; i < s->nb_qemu_ldst_labels; i++) {
+        TCGLabelQemuLdst *label = &s->qemu_ldst_labels[i];
+        if (label->is_ld) {
+            tcg_out_qemu_ld_slow_path(s, label);
+        } else {
+            tcg_out_qemu_st_slow_path(s, label);
+        }
+    }
+}
+
+static void add_qemu_ldst_label(TCGContext *s, int is_ld, int opc,
+                                TCGReg data_reg, TCGReg addr_reg,
+                                int mem_index,
+                                uint8_t *raddr, uint8_t *label_ptr)
+{
+    int idx;
+    TCGLabelQemuLdst *label;
+
+    if (s->nb_qemu_ldst_labels >= TCG_MAX_QEMU_LDST) {
+        tcg_abort();
+    }
+
+    idx = s->nb_qemu_ldst_labels++;
+    label = &s->qemu_ldst_labels[idx];
+    label->is_ld = is_ld;
+    label->opc = opc;
+    label->datalo_reg = data_reg;
+    label->addrlo_reg = addr_reg;
+    label->mem_index = mem_index;
+    label->raddr = raddr;
+    label->label_ptr[0] = label_ptr;
+}
+
+/* Load and compare a TLB entry, emitting the conditional jump to the
+   slow path for the failure case, which will be patched later when finalizing
+   the slow path. Generated code returns the host addend in X1,
+   clobbers X0,X2,X3,TMP. */
+static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg,
+            int s_bits, uint8_t **label_ptr, int mem_index, int is_read)
+{
+    TCGReg base = TCG_AREG0;
+    int tlb_offset = is_read ?
+        offsetof(CPUArchState, tlb_table[mem_index][0].addr_read)
+        : offsetof(CPUArchState, tlb_table[mem_index][0].addr_write);
+    /* Extract the TLB index from the address into X0.
+       X0<CPU_TLB_BITS:0> =
+       addr_reg<TARGET_PAGE_BITS+CPU_TLB_BITS:TARGET_PAGE_BITS> */
+    tcg_out_ubfm(s, (TARGET_LONG_BITS == 64), TCG_REG_X0, addr_reg,
+                 TARGET_PAGE_BITS, TARGET_PAGE_BITS + CPU_TLB_BITS);
+    /* Store the page mask part of the address and the low s_bits into X3.
+       Later this allows checking for equality and alignment at the same time.
+       X3 = addr_reg & (PAGE_MASK | ((1 << s_bits) - 1)) */
+    tcg_out_andi(s, (TARGET_LONG_BITS == 64), TCG_REG_X3, addr_reg,
+                 (TARGET_LONG_BITS - TARGET_PAGE_BITS) + s_bits,
+                 (TARGET_LONG_BITS - TARGET_PAGE_BITS));
+    /* Add any "high bits" from the tlb offset to the env address into X2,
+       to take advantage of the LSL12 form of the addi instruction.
+       X2 = env + (tlb_offset & 0xfff000) */
+    tcg_out_addi(s, 1, TCG_REG_X2, base, tlb_offset & 0xfff000);
+    /* Merge the tlb index contribution into X2.
+       X2 = X2 + (X0 << CPU_TLB_ENTRY_BITS) */
+    tcg_out_arith(s, ARITH_ADD, 1, TCG_REG_X2, TCG_REG_X2,
+                  TCG_REG_X0, -CPU_TLB_ENTRY_BITS);
+    /* Merge "low bits" from tlb offset, load the tlb comparator into X0.
+       X0 = load [X2 + (tlb_offset & 0x000fff)] */
+    tcg_out_ldst(s, TARGET_LONG_BITS == 64 ? LDST_64 : LDST_32,
+                 LDST_LD, TCG_REG_X0, TCG_REG_X2,
+                 (tlb_offset & 0xfff));
+    /* Load the tlb addend. Do that early to avoid stalling.
+       X1 = load [X2 + (tlb_offset & 0xfff) + offsetof(addend)] */
+    tcg_out_ldst(s, LDST_64, LDST_LD, TCG_REG_X1, TCG_REG_X2,
+                 (tlb_offset & 0xfff) + (offsetof(CPUTLBEntry, addend)) -
+                 (is_read ? offsetof(CPUTLBEntry, addr_read)
+                  : offsetof(CPUTLBEntry, addr_write)));
+    /* Perform the address comparison. */
+    tcg_out_cmp(s, (TARGET_LONG_BITS == 64), TCG_REG_X0, TCG_REG_X3, 0);
+    *label_ptr = s->code_ptr;
+    /* If not equal, we jump to the slow path. */
+    tcg_out_goto_cond_noaddr(s, TCG_COND_NE);
+}
+
+#endif /* CONFIG_SOFTMMU */
 
 static void tcg_out_qemu_ld_direct(TCGContext *s, int opc, TCGReg data_r,
                                    TCGReg addr_r, TCGReg off_r)
@@ -841,13 +1004,13 @@ static void tcg_out_qemu_st_direct(TCGContext *s, int opc, TCGReg data_r,
         tcg_abort();
     }
 }
-#endif /* CONFIG_SOFTMMU */
 
 static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
 {
     TCGReg addr_reg, data_reg;
 #ifdef CONFIG_SOFTMMU
     int mem_index, s_bits;
+    uint8_t *label_ptr;
 #endif
     data_reg = args[0];
     addr_reg = args[1];
@@ -855,23 +1018,10 @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
 #ifdef CONFIG_SOFTMMU
     mem_index = args[2];
     s_bits = opc & 3;
-
-    /* TODO: insert TLB lookup here */
-
-    /* all arguments passed via registers */
-    tcg_out_movr(s, 1, TCG_REG_X0, TCG_AREG0);
-    tcg_out_movr(s, (TARGET_LONG_BITS == 64), TCG_REG_X1, addr_reg);
-    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X2, mem_index);
-    tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP,
-                 (tcg_target_long)qemu_ld_helpers[s_bits]);
-    tcg_out_callr(s, TCG_REG_TMP);
-
-    if (opc & 0x04) { /* sign extend */
-        tcg_out_sxt(s, 1, s_bits, data_reg, TCG_REG_X0);
-    } else {
-        tcg_out_movr(s, 1, data_reg, TCG_REG_X0);
-    }
-
+    tcg_out_tlb_read(s, addr_reg, s_bits, &label_ptr, mem_index, 1);
+    tcg_out_qemu_ld_direct(s, opc, data_reg, addr_reg, TCG_REG_X1);
+    add_qemu_ldst_label(s, 1, opc, data_reg, addr_reg,
+                        mem_index, s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
     tcg_out_qemu_ld_direct(s, opc, data_reg, addr_reg,
                            GUEST_BASE ? TCG_REG_GUEST_BASE : TCG_REG_XZR);
@@ -883,6 +1033,7 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
     TCGReg addr_reg, data_reg;
 #ifdef CONFIG_SOFTMMU
     int mem_index, s_bits;
+    uint8_t *label_ptr;
 #endif
     data_reg = args[0];
     addr_reg = args[1];
@@ -891,17 +1042,10 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
     mem_index = args[2];
     s_bits = opc & 3;
 
-    /* TODO: insert TLB lookup here */
-
-    /* all arguments passed via registers */
-    tcg_out_movr(s, 1, TCG_REG_X0, TCG_AREG0);
-    tcg_out_movr(s, (TARGET_LONG_BITS == 64), TCG_REG_X1, addr_reg);
-    tcg_out_movr(s, 1, TCG_REG_X2, data_reg);
-    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_X3, mem_index);
-    tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP,
-                 (tcg_target_long)qemu_st_helpers[s_bits]);
-    tcg_out_callr(s, TCG_REG_TMP);
-
+    tcg_out_tlb_read(s, addr_reg, s_bits, &label_ptr, mem_index, 0);
+    tcg_out_qemu_st_direct(s, opc, data_reg, addr_reg, TCG_REG_X1);
+    add_qemu_ldst_label(s, 0, opc, data_reg, addr_reg,
+                        mem_index, s->code_ptr, label_ptr);
 #else /* !CONFIG_SOFTMMU */
     tcg_out_qemu_st_direct(s, opc, data_reg, addr_reg,
                            GUEST_BASE ? TCG_REG_GUEST_BASE : TCG_REG_XZR);
@@ -1344,26 +1488,6 @@ static void tcg_target_init(TCGContext *s)
     tcg_add_target_add_op_defs(aarch64_op_defs);
 }
 
-static inline void tcg_out_addi(TCGContext *s, int ext,
-                                TCGReg rd, TCGReg rn, unsigned int aimm)
-{
-    /* add immediate aimm unsigned 12bit value (we use LSL 0 - no shift) */
-    /* using ADD 0x11000000 | (ext) | (aimm << 10) | (rn << 5) | rd */
-    unsigned int base = ext ? 0x91000000 : 0x11000000;
-    assert(aimm <= 0xfff);
-    tcg_out32(s, base | (aimm << 10) | (rn << 5) | rd);
-}
-
-static inline void tcg_out_subi(TCGContext *s, int ext,
-                                TCGReg rd, TCGReg rn, unsigned int aimm)
-{
-    /* sub immediate aimm unsigned 12bit value (we use LSL 0 - no shift) */
-    /* using SUB 0x51000000 | (ext) | (aimm << 10) | (rn << 5) | rd */
-    unsigned int base = ext ? 0xd1000000 : 0x51000000;
-    assert(aimm <= 0xfff);
-    tcg_out32(s, base | (aimm << 10) | (rn << 5) | rd);
-}
-
 static void tcg_target_qemu_prologue(TCGContext *s)
 {
     /* NB: frame sizes are in 16 byte stack units! */
commit a62eaa26c1d6d48fbdc3ac1d32bd1314f5fdc8c9
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Jul 15 11:25:55 2013 +0200

    ahci: Fix FLUSH command
    
    AHCI couldn't cope with asynchronous commands that aren't doing DMA, it
    simply wouldn't complete them. Due to the bug fixed in commit f68ec837,
    FLUSH commands would seem to have completed immediately even if they
    were still running on the host. After the commit, they would simply hang
    and never unset the BSY bit, rendering AHCI unusable on any OS sending
    flushes.
    
    This patch adds another callback for the completion of asynchronous
    commands. This is what AHCI really wants to use for its command
    completion logic rather than an DMA completion callback.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 97eddec..1d863b5 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1107,9 +1107,14 @@ static int ahci_dma_add_status(IDEDMA *dma, int status)
 
 static int ahci_dma_set_inactive(IDEDMA *dma)
 {
+    return 0;
+}
+
+static int ahci_async_cmd_done(IDEDMA *dma)
+{
     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
 
-    DPRINTF(ad->port_no, "dma done\n");
+    DPRINTF(ad->port_no, "async cmd done\n");
 
     /* update d2h status */
     ahci_write_fis_d2h(ad, NULL);
@@ -1144,6 +1149,7 @@ static const IDEDMAOps ahci_dma_ops = {
     .set_unit = ahci_dma_set_unit,
     .add_status = ahci_dma_add_status,
     .set_inactive = ahci_dma_set_inactive,
+    .async_cmd_done = ahci_async_cmd_done,
     .restart_cb = ahci_dma_restart_cb,
     .reset = ahci_dma_reset,
 };
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 03d1cfa..a73af72 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -568,10 +568,18 @@ static void dma_buf_commit(IDEState *s)
     qemu_sglist_destroy(&s->sg);
 }
 
+static void ide_async_cmd_done(IDEState *s)
+{
+    if (s->bus->dma->ops->async_cmd_done) {
+        s->bus->dma->ops->async_cmd_done(s->bus->dma);
+    }
+}
+
 void ide_set_inactive(IDEState *s)
 {
     s->bus->dma->aiocb = NULL;
     s->bus->dma->ops->set_inactive(s->bus->dma);
+    ide_async_cmd_done(s);
 }
 
 void ide_dma_error(IDEState *s)
@@ -804,6 +812,7 @@ static void ide_flush_cb(void *opaque, int ret)
 
     bdrv_acct_done(s->bs, &s->acct);
     s->status = READY_STAT | SEEK_STAT;
+    ide_async_cmd_done(s);
     ide_set_irq(s->bus);
 }
 
diff --git a/hw/ide/internal.h b/hw/ide/internal.h
index 03f1489..048a052 100644
--- a/hw/ide/internal.h
+++ b/hw/ide/internal.h
@@ -433,6 +433,7 @@ struct IDEDMAOps {
     DMAIntFunc *set_unit;
     DMAIntFunc *add_status;
     DMAFunc *set_inactive;
+    DMAFunc *async_cmd_done;
     DMARestartFunc *restart_cb;
     DMAFunc *reset;
 };
commit 0e1146a7a011a69d8cbc958b4f7ebad186730fc3
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Jul 5 13:54:55 2013 +0200

    migration: Fail migration on bdrv_flush_all() error
    
    If bdrv_flush_all() returns an error, there is an inconsistency in the
    view of an image file between the source and the destination host.
    Completing the migration would lead to corruption. Better abort
    migration in this case.
    
    To reproduce this case, try the following (ensures that there is
    something to flush, and then fails that flush):
    
    $ qemu-img create -f qcow2 test.qcow2 1G
    $ cat blkdebug.cfg
    [inject-error]
    event = "flush_to_os"
    errno = "5"
    $ qemu-system-x86_64 -hda blkdebug:blkdebug.cfg:test.qcow2 -monitor stdio
    (qemu) qemu-io ide0-hd0 "write 0 4k"
    (qemu) migrate ...
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/migration.c b/migration.c
index 635a7e7..0681d8e 100644
--- a/migration.c
+++ b/migration.c
@@ -527,15 +527,26 @@ static void *migration_thread(void *opaque)
             if (pending_size && pending_size >= max_size) {
                 qemu_savevm_state_iterate(s->file);
             } else {
+                int ret;
+
                 DPRINTF("done iterating\n");
                 qemu_mutex_lock_iothread();
                 start_time = qemu_get_clock_ms(rt_clock);
                 qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER);
                 old_vm_running = runstate_is_running();
-                vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);
-                qemu_file_set_rate_limit(s->file, INT_MAX);
-                qemu_savevm_state_complete(s->file);
+
+                ret = vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);
+                if (ret >= 0) {
+                    qemu_file_set_rate_limit(s->file, INT_MAX);
+                    qemu_savevm_state_complete(s->file);
+                }
                 qemu_mutex_unlock_iothread();
+
+                if (ret < 0) {
+                    migrate_finish_set_state(s, MIG_STATE_ERROR);
+                    break;
+                }
+
                 if (!qemu_file_get_error(s->file)) {
                     migrate_finish_set_state(s, MIG_STATE_COMPLETED);
                     break;
commit 5698346391b306c2c84358c68ee897c095d714cc
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Jul 5 13:49:54 2013 +0200

    cpus: Add return value for vm_stop()
    
    If flushing the block devices fails, return an error. The VM is stopped
    anyway.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/cpus.c b/cpus.c
index f141428..29277e1 100644
--- a/cpus.c
+++ b/cpus.c
@@ -434,17 +434,21 @@ bool cpu_is_stopped(CPUState *cpu)
     return !runstate_is_running() || cpu->stopped;
 }
 
-static void do_vm_stop(RunState state)
+static int do_vm_stop(RunState state)
 {
+    int ret = 0;
+
     if (runstate_is_running()) {
         cpu_disable_ticks();
         pause_all_vcpus();
         runstate_set(state);
         vm_state_notify(0, state);
         bdrv_drain_all();
-        bdrv_flush_all();
+        ret = bdrv_flush_all();
         monitor_protocol_event(QEVENT_STOP, NULL);
     }
+
+    return ret;
 }
 
 static bool cpu_can_run(CPUState *cpu)
@@ -1070,7 +1074,7 @@ void cpu_stop_current(void)
     }
 }
 
-void vm_stop(RunState state)
+int vm_stop(RunState state)
 {
     if (qemu_in_vcpu_thread()) {
         qemu_system_vmstop_request(state);
@@ -1079,19 +1083,21 @@ void vm_stop(RunState state)
          * vm_stop() has been requested.
          */
         cpu_stop_current();
-        return;
+        return 0;
     }
-    do_vm_stop(state);
+
+    return do_vm_stop(state);
 }
 
 /* does a state transition even if the VM is already stopped,
    current state is forgotten forever */
-void vm_stop_force_state(RunState state)
+int vm_stop_force_state(RunState state)
 {
     if (runstate_is_running()) {
-        vm_stop(state);
+        return vm_stop(state);
     } else {
         runstate_set(state);
+        return 0;
     }
 }
 
diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index d85bdc0..3caeb66 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -35,8 +35,8 @@ void vm_state_notify(int running, RunState state);
 #define VMRESET_REPORT   true
 
 void vm_start(void);
-void vm_stop(RunState state);
-void vm_stop_force_state(RunState state);
+int vm_stop(RunState state);
+int vm_stop_force_state(RunState state);
 
 typedef enum WakeupReason {
     QEMU_WAKEUP_REASON_OTHER = 0,
diff --git a/stubs/vm-stop.c b/stubs/vm-stop.c
index 4568935..f82c897 100644
--- a/stubs/vm-stop.c
+++ b/stubs/vm-stop.c
@@ -1,7 +1,7 @@
 #include "qemu-common.h"
 #include "sysemu/sysemu.h"
 
-void vm_stop(RunState state)
+int vm_stop(RunState state)
 {
     abort();
 }
commit f0f0fdfeec6c67ad374114ecc4b3e3ccde5e94d2
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Jul 5 13:48:01 2013 +0200

    block: Add return value for bdrv_flush_all()
    
    bdrv_flush() can fail, and bdrv_flush_all() should return an error as
    well if this happens for a block device. It returns the first error
    return now, but still at least tries to flush the remaining devices even
    in error cases.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index 2df65c8..b560241 100644
--- a/block.c
+++ b/block.c
@@ -2910,13 +2910,19 @@ int bdrv_get_flags(BlockDriverState *bs)
     return bs->open_flags;
 }
 
-void bdrv_flush_all(void)
+int bdrv_flush_all(void)
 {
     BlockDriverState *bs;
+    int result = 0;
 
     QTAILQ_FOREACH(bs, &bdrv_states, list) {
-        bdrv_flush(bs);
+        int ret = bdrv_flush(bs);
+        if (ret < 0 && !result) {
+            result = ret;
+        }
     }
+
+    return result;
 }
 
 int bdrv_has_zero_init_1(BlockDriverState *bs)
diff --git a/include/block/block.h b/include/block/block.h
index eeb4816..b6b9014 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -267,7 +267,7 @@ void bdrv_clear_incoming_migration_all(void);
 /* Ensure contents are flushed to disk.  */
 int bdrv_flush(BlockDriverState *bs);
 int coroutine_fn bdrv_co_flush(BlockDriverState *bs);
-void bdrv_flush_all(void);
+int bdrv_flush_all(void);
 void bdrv_close_all(void);
 void bdrv_drain_all(void);
 
commit 7a370406bdd13b1d46230d1cbca308d984d0dcae
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jul 10 17:30:26 2013 +0200

    qemu-iotests: Update 051 reference output
    
    This has been broken by commit bd5c51ee.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index 6b3d636..95ff245 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -23,10 +23,12 @@ QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,unknown_opt=foo: could not
 === Enable and disable lazy refcounting on the command line, plus some invalid values ===
 
 Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=on
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=off
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=: Parameter 'lazy_refcounts' expects 'on' or 'off'
@@ -49,112 +51,152 @@ QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=on: Lazy ref
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=on: could not open disk image TEST_DIR/t.qcow2: Invalid argument
 
 Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,lazy_refcounts=off
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 
 === No medium ===
 
 Testing: -drive if=floppy
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive if=ide,media=cdrom
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive if=scsi,media=cdrom
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive if=ide
-QEMU_PROG: Device needs media, but drive is empty
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: Device needs media, but drive is empty
+QEMU_PROG: Device initialization failed.
 QEMU_PROG: Initialization of device ide-hd failed
 
 Testing: -drive if=virtio
-QEMU_PROG: -drive if=virtio: Device needs media, but drive is empty
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -drive if=virtio: Device needs media, but drive is empty
+QEMU_PROG: -drive if=virtio: Device initialization failed.
+QEMU_PROG: -drive if=virtio: Device initialization failed.
 QEMU_PROG: -drive if=virtio: Device 'virtio-blk-pci' could not be initialized
 
 Testing: -drive if=scsi
-QEMU_PROG: -drive if=scsi: Device needs media, but drive is empty
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -drive if=scsi: Device needs media, but drive is empty
+QEMU_PROG: -drive if=scsi: Device initialization failed.
+QEMU_PROG: Device initialization failed.
 QEMU_PROG: Initialization of device lsi53c895a failed
 
 Testing: -drive if=none,id=disk -device ide-cd,drive=disk
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive if=none,id=disk -device ide-drive,drive=disk
-QEMU_PROG: -device ide-drive,drive=disk: Device needs media, but drive is empty
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -device ide-drive,drive=disk: Device needs media, but drive is empty
+QEMU_PROG: -device ide-drive,drive=disk: Device initialization failed.
 QEMU_PROG: -device ide-drive,drive=disk: Device 'ide-drive' could not be initialized
 
 Testing: -drive if=none,id=disk -device ide-hd,drive=disk
-QEMU_PROG: -device ide-hd,drive=disk: Device needs media, but drive is empty
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -device ide-hd,drive=disk: Device needs media, but drive is empty
+QEMU_PROG: -device ide-hd,drive=disk: Device initialization failed.
 QEMU_PROG: -device ide-hd,drive=disk: Device 'ide-hd' could not be initialized
 
 Testing: -drive if=none,id=disk -device lsi53c895a -device scsi-disk,drive=disk
-QEMU_PROG: -device scsi-disk,drive=disk: Device needs media, but drive is empty
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -device scsi-disk,drive=disk: Device needs media, but drive is empty
+QEMU_PROG: -device scsi-disk,drive=disk: Device initialization failed.
 QEMU_PROG: -device scsi-disk,drive=disk: Device 'scsi-disk' could not be initialized
 
 Testing: -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
-QEMU_PROG: -device scsi-hd,drive=disk: Device needs media, but drive is empty
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -device scsi-hd,drive=disk: Device needs media, but drive is empty
+QEMU_PROG: -device scsi-hd,drive=disk: Device initialization failed.
 QEMU_PROG: -device scsi-hd,drive=disk: Device 'scsi-hd' could not be initialized
 
 
 === Read-only ===
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=floppy,readonly=on
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=ide,media=cdrom,readonly=on
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=scsi,media=cdrom,readonly=on
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=ide,readonly=on
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,if=ide,readonly=on: readonly not supported by this bus type
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=virtio,readonly=on
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=scsi,readonly=on
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=none,id=disk,readonly=on -device ide-cd,drive=disk
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=none,id=disk,readonly=on -device ide-drive,drive=disk
-QEMU_PROG: -device ide-drive,drive=disk: Can't use a read-only drive
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -device ide-drive,drive=disk: Can't use a read-only drive
+QEMU_PROG: -device ide-drive,drive=disk: Device initialization failed.
 QEMU_PROG: -device ide-drive,drive=disk: Device 'ide-drive' could not be initialized
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=none,id=disk,readonly=on -device ide-hd,drive=disk
-QEMU_PROG: -device ide-hd,drive=disk: Can't use a read-only drive
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) QEMU_PROG: -device ide-hd,drive=disk: Can't use a read-only drive
+QEMU_PROG: -device ide-hd,drive=disk: Device initialization failed.
 QEMU_PROG: -device ide-hd,drive=disk: Device 'ide-hd' could not be initialized
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=none,id=disk,readonly=on -device lsi53c895a -device scsi-disk,drive=disk
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 
 === Cache modes ===
 
 Testing: -drive media=cdrom,cache=none
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive media=cdrom,cache=directsync
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive media=cdrom,cache=writeback
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive media=cdrom,cache=writethrough
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive media=cdrom,cache=unsafe
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive media=cdrom,cache=invalid_value
 QEMU_PROG: -drive media=cdrom,cache=invalid_value: invalid cache option
@@ -163,7 +205,8 @@ QEMU_PROG: -drive media=cdrom,cache=invalid_value: invalid cache option
 === Specifying the protocol layer ===
 
 Testing: -drive file=TEST_DIR/t.qcow2,file.driver=file
-qququiquit
+QEMU 1.5.50 monitor - type 'help' for more information
+(qemu) qququiquit
 
 Testing: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2: Can't use 'qcow2' as a block driver for the protocol level
diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
index dcf6391..9dbcae8 100644
--- a/tests/qemu-iotests/common.filter
+++ b/tests/qemu-iotests/common.filter
@@ -155,7 +155,7 @@ _filter_qemu_io()
 # replace occurrences of QEMU_PROG with "qemu"
 _filter_qemu()
 {
-    sed -e "s#^$(basename $QEMU_PROG):#QEMU_PROG:#"
+    sed -e "s#\\(^\\|(qemu) \\)$(basename $QEMU_PROG):#\1QEMU_PROG:#"
 }
 
 # make sure this script returns success
commit 98289620e0460fa595581020ab20127da4a2fc44
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jul 10 15:47:39 2013 +0200

    block: Don't parse protocol from file.filename
    
    One of the major reasons for doing something new for -blockdev and
    blockdev-add was that the old block layer code parses filenames instead
    of just taking them literally. So we should really leave it untouched
    when it's passing using the new interfaces (like -drive
    file.filename=...).
    
    This allows opening relative file names that contain a colon.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block.c b/block.c
index 183fec8..2df65c8 100644
--- a/block.c
+++ b/block.c
@@ -417,7 +417,7 @@ int bdrv_create_file(const char* filename, QEMUOptionParameter *options)
 {
     BlockDriver *drv;
 
-    drv = bdrv_find_protocol(filename);
+    drv = bdrv_find_protocol(filename, true);
     if (drv == NULL) {
         return -ENOENT;
     }
@@ -482,7 +482,8 @@ static BlockDriver *find_hdev_driver(const char *filename)
     return drv;
 }
 
-BlockDriver *bdrv_find_protocol(const char *filename)
+BlockDriver *bdrv_find_protocol(const char *filename,
+                                bool allow_protocol_prefix)
 {
     BlockDriver *drv1;
     char protocol[128];
@@ -503,9 +504,10 @@ BlockDriver *bdrv_find_protocol(const char *filename)
         return drv1;
     }
 
-    if (!path_has_protocol(filename)) {
+    if (!path_has_protocol(filename) || !allow_protocol_prefix) {
         return bdrv_find_format("file");
     }
+
     p = strchr(filename, ':');
     assert(p != NULL);
     len = p - filename;
@@ -784,6 +786,7 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename,
     BlockDriverState *bs;
     BlockDriver *drv;
     const char *drvname;
+    bool allow_protocol_prefix = false;
     int ret;
 
     /* NULL means an empty set of options */
@@ -800,6 +803,7 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename,
         filename = qdict_get_try_str(options, "filename");
     } else if (filename && !qdict_haskey(options, "filename")) {
         qdict_put(options, "filename", qstring_from_str(filename));
+        allow_protocol_prefix = true;
     } else {
         qerror_report(ERROR_CLASS_GENERIC_ERROR, "Can't specify 'file' and "
                       "'filename' options at the same time");
@@ -813,7 +817,10 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename,
         drv = bdrv_find_whitelisted_format(drvname, !(flags & BDRV_O_RDWR));
         qdict_del(options, "driver");
     } else if (filename) {
-        drv = bdrv_find_protocol(filename);
+        drv = bdrv_find_protocol(filename, allow_protocol_prefix);
+        if (!drv) {
+            qerror_report(ERROR_CLASS_GENERIC_ERROR, "Unknown protocol");
+        }
     } else {
         qerror_report(ERROR_CLASS_GENERIC_ERROR,
                       "Must specify either driver or file");
@@ -4452,7 +4459,7 @@ void bdrv_img_create(const char *filename, const char *fmt,
         return;
     }
 
-    proto_drv = bdrv_find_protocol(filename);
+    proto_drv = bdrv_find_protocol(filename, true);
     if (!proto_drv) {
         error_setg(errp, "Unknown protocol '%s'", filename);
         return;
diff --git a/block/sheepdog.c b/block/sheepdog.c
index b397b5b..6a41ad9 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -1510,7 +1510,7 @@ static int sd_create(const char *filename, QEMUOptionParameter *options)
         BlockDriver *drv;
 
         /* Currently, only Sheepdog backing image is supported. */
-        drv = bdrv_find_protocol(backing_file);
+        drv = bdrv_find_protocol(backing_file, true);
         if (!drv || strcmp(drv->protocol_name, "sheepdog") != 0) {
             error_report("backing_file must be a sheepdog image");
             ret = -EINVAL;
diff --git a/include/block/block.h b/include/block/block.h
index dd8eca1..eeb4816 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -111,7 +111,8 @@ bool bdrv_io_limits_enabled(BlockDriverState *bs);
 
 void bdrv_init(void);
 void bdrv_init_with_whitelist(void);
-BlockDriver *bdrv_find_protocol(const char *filename);
+BlockDriver *bdrv_find_protocol(const char *filename,
+                                bool allow_protocol_prefix);
 BlockDriver *bdrv_find_format(const char *format_name);
 BlockDriver *bdrv_find_whitelisted_format(const char *format_name,
                                           bool readonly);
diff --git a/qemu-img.c b/qemu-img.c
index f8c97d3..c55ca5c 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -240,7 +240,7 @@ static int print_block_option_help(const char *filename, const char *fmt)
         return 1;
     }
 
-    proto_drv = bdrv_find_protocol(filename);
+    proto_drv = bdrv_find_protocol(filename, true);
     if (!proto_drv) {
         error_report("Unknown protocol '%s'", filename);
         return 1;
@@ -1261,7 +1261,7 @@ static int img_convert(int argc, char **argv)
         goto out;
     }
 
-    proto_drv = bdrv_find_protocol(out_filename);
+    proto_drv = bdrv_find_protocol(out_filename, true);
     if (!proto_drv) {
         error_report("Unknown protocol '%s'", out_filename);
         ret = -1;
diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
index 8039e23..1cf8bf7 100755
--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
@@ -149,6 +149,18 @@ echo
 run_qemu -drive file=$TEST_IMG,file.driver=file
 run_qemu -drive file=$TEST_IMG,file.driver=qcow2
 
+echo
+echo === Parsing protocol from file name ===
+echo
+
+# Protocol strings are supposed to be parsed from traditional option strings,
+# but not when using driver-specific options. We can distinguish them by the
+# error message for non-existing files.
+
+run_qemu -hda foo:bar
+run_qemu -drive file=foo:bar
+run_qemu -drive file.filename=foo:bar
+
 # success, all done
 echo "*** done"
 rm -f $seq.full
diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index 3d1ac7b..6b3d636 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -169,4 +169,18 @@ Testing: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2: Can't use 'qcow2' as a block driver for the protocol level
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2: could not open disk image TEST_DIR/t.qcow2: Invalid argument
 
+
+=== Parsing protocol from file name ===
+
+Testing: -hda foo:bar
+QEMU_PROG: -hda foo:bar: Unknown protocol
+QEMU_PROG: -hda foo:bar: could not open disk image foo:bar: No such file or directory
+
+Testing: -drive file=foo:bar
+QEMU_PROG: -drive file=foo:bar: Unknown protocol
+QEMU_PROG: -drive file=foo:bar: could not open disk image foo:bar: No such file or directory
+
+Testing: -drive file.filename=foo:bar
+QEMU_PROG: -drive file.filename=foo:bar: could not open disk image ide0-hd0: No such file or directory
+
 *** done
commit de90930a0c45760e7523138fac57ff07312bf51d
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Jun 26 14:11:58 2013 +0200

    block: add drive_backup HMP command
    
    Make "drive_backup" available on the HMP monitor:
    
      drive_backup [-n] [-f] device target [format]
    
    The -n flag requests QEMU to reuse the image found in new-image-file,
    instead of recreating it from scratch.
    
    The -f flag requests QEMU to copy the whole disk, so that the result
    does not need a backing file.  Note that this flag *must* currently be
    passed since the other sync modes ('none' and 'top') have not been
    implemented yet.  Requiring it ensures that "drive_backup" behaves like
    "drive_mirror".
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/hmp-commands.hx b/hmp-commands.hx
index d1cdcfb..8c6b91a 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1059,6 +1059,26 @@ using the specified target.
 ETEXI
 
     {
+        .name       = "drive_backup",
+        .args_type  = "reuse:-n,full:-f,device:B,target:s,format:s?",
+        .params     = "[-n] [-f] device target [format]",
+        .help       = "initiates a point-in-time\n\t\t\t"
+                      "copy for a device. The device's contents are\n\t\t\t"
+                      "copied to the new image file, excluding data that\n\t\t\t"
+                      "is written after the command is started.\n\t\t\t"
+                      "The -n flag requests QEMU to reuse the image found\n\t\t\t"
+                      "in new-image-file, instead of recreating it from scratch.\n\t\t\t"
+                      "The -f flag requests QEMU to copy the whole disk,\n\t\t\t"
+                      "so that the result does not need a backing file.\n\t\t\t",
+        .mhandler.cmd = hmp_drive_backup,
+    },
+STEXI
+ at item drive_backup
+ at findex drive_backup
+Start a point-in-time copy of a block device to a specificed target.
+ETEXI
+
+    {
         .name       = "drive_add",
         .args_type  = "pci_addr:s,opts:s",
         .params     = "[[<domain>:]<bus>:]<slot>\n"
diff --git a/hmp.c b/hmp.c
index 2daed43..dc4d8d4 100644
--- a/hmp.c
+++ b/hmp.c
@@ -907,6 +907,34 @@ void hmp_drive_mirror(Monitor *mon, const QDict *qdict)
     hmp_handle_error(mon, &errp);
 }
 
+void hmp_drive_backup(Monitor *mon, const QDict *qdict)
+{
+    const char *device = qdict_get_str(qdict, "device");
+    const char *filename = qdict_get_str(qdict, "target");
+    const char *format = qdict_get_try_str(qdict, "format");
+    int reuse = qdict_get_try_bool(qdict, "reuse", 0);
+    int full = qdict_get_try_bool(qdict, "full", 0);
+    enum NewImageMode mode;
+    Error *errp = NULL;
+
+    if (!filename) {
+        error_set(&errp, QERR_MISSING_PARAMETER, "target");
+        hmp_handle_error(mon, &errp);
+        return;
+    }
+
+    if (reuse) {
+        mode = NEW_IMAGE_MODE_EXISTING;
+    } else {
+        mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;
+    }
+
+    qmp_drive_backup(device, filename, !!format, format,
+                     full ? MIRROR_SYNC_MODE_FULL : MIRROR_SYNC_MODE_TOP,
+                     true, mode, false, 0, false, 0, false, 0, &errp);
+    hmp_handle_error(mon, &errp);
+}
+
 void hmp_snapshot_blkdev(Monitor *mon, const QDict *qdict)
 {
     const char *device = qdict_get_str(qdict, "device");
diff --git a/hmp.h b/hmp.h
index 56d2e92..6c3bdcd 100644
--- a/hmp.h
+++ b/hmp.h
@@ -55,6 +55,7 @@ void hmp_balloon(Monitor *mon, const QDict *qdict);
 void hmp_block_resize(Monitor *mon, const QDict *qdict);
 void hmp_snapshot_blkdev(Monitor *mon, const QDict *qdict);
 void hmp_drive_mirror(Monitor *mon, const QDict *qdict);
+void hmp_drive_backup(Monitor *mon, const QDict *qdict);
 void hmp_migrate_cancel(Monitor *mon, const QDict *qdict);
 void hmp_migrate_set_downtime(Monitor *mon, const QDict *qdict);
 void hmp_migrate_set_speed(Monitor *mon, const QDict *qdict);
commit b53169eae06d6cf6f512a8b1fdd5424a0a6aab85
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Jun 26 14:11:57 2013 +0200

    blockdev: add sync mode to drive-backup QMP command
    
    The drive-backup command is similar to the drive-mirror command, except
    no guest data written after the command executes gets copied.  Add a
    sync mode argument which determines whether the entire disk is copied,
    just allocated clusters, or only clusters being written to by the guest.
    
    Currently only sync mode 'full' is supported - it copies the entire disk.
    For read-only point-in-time snapshots we may only need sync mode 'none'
    since the target can be a qcow2 file using the guest's disk as its
    backing file (no need to copy the entire disk).  Finally, sync mode
    'top' is useful if we wish to preserve the backing chain.
    
    Note that this patch just adds the sync mode argument to drive-backup.
    It does not implement sync modes 'top' or 'none'.  This patch is
    necessary so we can add a drive-backup HMP command that behaves like the
    existing drive-mirror HMP command and takes a sync mode.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index b3a57e0..c5abd65 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -936,6 +936,7 @@ static void drive_backup_prepare(BlkTransactionState *common, Error **errp)
 
     qmp_drive_backup(backup->device, backup->target,
                      backup->has_format, backup->format,
+                     backup->sync,
                      backup->has_mode, backup->mode,
                      backup->has_speed, backup->speed,
                      backup->has_on_source_error, backup->on_source_error,
@@ -1421,6 +1422,7 @@ void qmp_block_commit(const char *device,
 
 void qmp_drive_backup(const char *device, const char *target,
                       bool has_format, const char *format,
+                      enum MirrorSyncMode sync,
                       bool has_mode, enum NewImageMode mode,
                       bool has_speed, int64_t speed,
                       bool has_on_source_error, BlockdevOnError on_source_error,
@@ -1435,6 +1437,10 @@ void qmp_drive_backup(const char *device, const char *target,
     int64_t size;
     int ret;
 
+    if (sync != MIRROR_SYNC_MODE_FULL) {
+        error_setg(errp, "only sync mode 'full' is currently supported");
+        return;
+    }
     if (!has_speed) {
         speed = 0;
     }
diff --git a/qapi-schema.json b/qapi-schema.json
index b251d28..cf57783 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1634,6 +1634,10 @@
 # @format: #optional the format of the new destination, default is to
 #          probe if @mode is 'existing', else the format of the source
 #
+# @sync: what parts of the disk image should be copied to the destination
+#        (all the disk, only the sectors allocated in the topmost image, or
+#        only new I/O).
+#
 # @mode: #optional whether and how QEMU should create a new image, default is
 #        'absolute-paths'.
 #
@@ -1655,7 +1659,8 @@
 ##
 { 'type': 'DriveBackup',
   'data': { 'device': 'str', 'target': 'str', '*format': 'str',
-            '*mode': 'NewImageMode', '*speed': 'int',
+            'sync': 'MirrorSyncMode', '*mode': 'NewImageMode',
+            '*speed': 'int',
             '*on-source-error': 'BlockdevOnError',
             '*on-target-error': 'BlockdevOnError' } }
 
diff --git a/qmp-commands.hx b/qmp-commands.hx
index 362f0e1..e075df4 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -913,7 +913,7 @@ EQMP
 
     {
         .name       = "drive-backup",
-        .args_type  = "device:B,target:s,speed:i?,mode:s?,format:s?,"
+        .args_type  = "sync:s,device:B,target:s,speed:i?,mode:s?,format:s?,"
                       "on-source-error:s?,on-target-error:s?",
         .mhandler.cmd_new = qmp_marshal_input_drive_backup,
     },
@@ -939,6 +939,10 @@ Arguments:
 - "format": the format of the new destination, default is to probe if 'mode' is
             'existing', else the format of the source
             (json-string, optional)
+- "sync": what parts of the disk image should be copied to the destination;
+  possibilities include "full" for all the disk, "top" for only the sectors
+  allocated in the topmost image, or "none" to only replicate new I/O
+  (MirrorSyncMode).
 - "mode": whether and how QEMU should create a new image
           (NewImageMode, optional, default 'absolute-paths')
 - "speed": the maximum speed, in bytes per second (json-int, optional)
diff --git a/tests/qemu-iotests/055 b/tests/qemu-iotests/055
index 887c959..c66f8db 100755
--- a/tests/qemu-iotests/055
+++ b/tests/qemu-iotests/055
@@ -54,7 +54,7 @@ class TestSingleDrive(iotests.QMPTestCase):
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-backup', device='drive0',
-                             target=target_img)
+                             target=target_img, sync='full')
         self.assert_qmp(result, 'return', {})
 
         event = self.cancel_and_wait()
@@ -64,7 +64,7 @@ class TestSingleDrive(iotests.QMPTestCase):
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-backup', device='drive0',
-                             target=target_img)
+                             target=target_img, sync='full')
         self.assert_qmp(result, 'return', {})
 
         result = self.vm.qmp('block-job-pause', device='drive0')
@@ -89,17 +89,17 @@ class TestSingleDrive(iotests.QMPTestCase):
 
     def test_medium_not_found(self):
         result = self.vm.qmp('drive-backup', device='ide1-cd0',
-                             target=target_img)
+                             target=target_img, sync='full')
         self.assert_qmp(result, 'error/class', 'GenericError')
 
     def test_image_not_found(self):
         result = self.vm.qmp('drive-backup', device='drive0',
-                             mode='existing', target=target_img)
+                             target=target_img, sync='full', mode='existing')
         self.assert_qmp(result, 'error/class', 'GenericError')
 
     def test_device_not_found(self):
         result = self.vm.qmp('drive-backup', device='nonexistent',
-                             target=target_img)
+                             target=target_img, sync='full')
         self.assert_qmp(result, 'error/class', 'DeviceNotFound')
 
 class TestSetSpeed(iotests.QMPTestCase):
@@ -119,7 +119,7 @@ class TestSetSpeed(iotests.QMPTestCase):
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-backup', device='drive0',
-                             target=target_img)
+                             target=target_img, sync='full')
         self.assert_qmp(result, 'return', {})
 
         # Default speed is 0
@@ -140,7 +140,7 @@ class TestSetSpeed(iotests.QMPTestCase):
 
         # Check setting speed in drive-backup works
         result = self.vm.qmp('drive-backup', device='drive0',
-                             target=target_img, speed=4*1024*1024)
+                             target=target_img, sync='full', speed=4*1024*1024)
         self.assert_qmp(result, 'return', {})
 
         result = self.vm.qmp('query-block-jobs')
@@ -154,13 +154,13 @@ class TestSetSpeed(iotests.QMPTestCase):
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-backup', device='drive0',
-                             target=target_img, speed=-1)
+                             target=target_img, sync='full', speed=-1)
         self.assert_qmp(result, 'error/class', 'GenericError')
 
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-backup', device='drive0',
-                             target=target_img)
+                             target=target_img, sync='full')
         self.assert_qmp(result, 'return', {})
 
         result = self.vm.qmp('block-job-set-speed', device='drive0', speed=-1)
@@ -196,7 +196,8 @@ class TestSingleTransaction(iotests.QMPTestCase):
         result = self.vm.qmp('transaction', actions=[{
                 'type': 'drive-backup',
                 'data': { 'device': 'drive0',
-                          'target': target_img },
+                          'target': target_img,
+                          'sync': 'full' },
             }
         ])
         self.assert_qmp(result, 'return', {})
@@ -210,7 +211,8 @@ class TestSingleTransaction(iotests.QMPTestCase):
         result = self.vm.qmp('transaction', actions=[{
                 'type': 'drive-backup',
                 'data': { 'device': 'drive0',
-                          'target': target_img },
+                          'target': target_img,
+                          'sync': 'full' },
             }
         ])
         self.assert_qmp(result, 'return', {})
@@ -239,7 +241,8 @@ class TestSingleTransaction(iotests.QMPTestCase):
         result = self.vm.qmp('transaction', actions=[{
                 'type': 'drive-backup',
                 'data': { 'device': 'ide1-cd0',
-                          'target': target_img },
+                          'target': target_img,
+                          'sync': 'full' },
             }
         ])
         self.assert_qmp(result, 'error/class', 'GenericError')
@@ -249,7 +252,8 @@ class TestSingleTransaction(iotests.QMPTestCase):
                 'type': 'drive-backup',
                 'data': { 'device': 'drive0',
                           'mode': 'existing',
-                          'target': target_img },
+                          'target': target_img,
+                          'sync': 'full' },
             }
         ])
         self.assert_qmp(result, 'error/class', 'GenericError')
@@ -259,7 +263,8 @@ class TestSingleTransaction(iotests.QMPTestCase):
                 'type': 'drive-backup',
                 'data': { 'device': 'nonexistent',
                           'mode': 'existing',
-                          'target': target_img },
+                          'target': target_img,
+                          'sync': 'full' },
             }
         ])
         self.assert_qmp(result, 'error/class', 'DeviceNotFound')
@@ -269,7 +274,8 @@ class TestSingleTransaction(iotests.QMPTestCase):
                 'type': 'drive-backup',
                 'data': { 'device': 'nonexistent',
                           'mode': 'existing',
-                          'target': target_img },
+                          'target': target_img,
+                          'sync': 'full' },
             }, {
                 'type': 'Abort',
                 'data': {},
commit e605e969953d793036dbd450da6b59bb434fb3d8
Author: Richard Henderson <rth at twiddle.net>
Date:   Sat Jul 13 17:23:37 2013 -0700

    hw/alpha: Use SRM epoch
    
    The 1980 epoch is used by the ARC PALcode for NT.  But we're emulating
    a system using the SRM PALcode.  Using the proper epoch results in less
    confusion in the guest userland.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/hw/alpha/dp264.c b/hw/alpha/dp264.c
index 8dad08f..95fde61 100644
--- a/hw/alpha/dp264.c
+++ b/hw/alpha/dp264.c
@@ -73,7 +73,9 @@ static void clipper_init(QEMUMachineInitArgs *args)
     pci_bus = typhoon_init(ram_size, &isa_bus, &rtc_irq, cpus,
                            clipper_pci_map_irq);
 
-    rtc_init(isa_bus, 1980, rtc_irq);
+    /* Since we have an SRM-compatible PALcode, use the SRM epoch.  */
+    rtc_init(isa_bus, 1900, rtc_irq);
+
     pit_init(isa_bus, 0x40, 0, NULL);
     isa_create_simple(isa_bus, "i8042");
 
commit 678421650dc166cd6cb35bb2bc0baf1b481b40ca
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Jul 8 14:57:39 2013 -0700

    hw/alpha: Drop latch_tmp hack
    
    The memory and i/o core now support passing 64-bit accesses along
    from the guest, so we no longer need to emulate them.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 69e2255..3d7a1cd 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -51,9 +51,6 @@ typedef struct TyphoonState {
     TyphoonPchip pchip;
     MemoryRegion dchip_region;
     MemoryRegion ram_region;
-
-    /* QEMU emulation state.  */
-    uint32_t latch_tmp;
 } TyphoonState;
 
 /* Called when one of DRIR or DIM changes.  */
@@ -76,10 +73,6 @@ static uint64_t cchip_read(void *opaque, hwaddr addr, unsigned size)
     TyphoonState *s = opaque;
     uint64_t ret = 0;
 
-    if (addr & 4) {
-        return s->latch_tmp;
-    }
-
     switch (addr) {
     case 0x0000:
         /* CSC: Cchip System Configuration Register.  */
@@ -199,7 +192,6 @@ static uint64_t cchip_read(void *opaque, hwaddr addr, unsigned size)
         return -1;
     }
 
-    s->latch_tmp = ret >> 32;
     return ret;
 }
 
@@ -214,10 +206,6 @@ static uint64_t pchip_read(void *opaque, hwaddr addr, unsigned size)
     TyphoonState *s = opaque;
     uint64_t ret = 0;
 
-    if (addr & 4) {
-        return s->latch_tmp;
-    }
-
     switch (addr) {
     case 0x0000:
         /* WSBA0: Window Space Base Address Register.  */
@@ -302,23 +290,14 @@ static uint64_t pchip_read(void *opaque, hwaddr addr, unsigned size)
         return -1;
     }
 
-    s->latch_tmp = ret >> 32;
     return ret;
 }
 
 static void cchip_write(void *opaque, hwaddr addr,
-                        uint64_t v32, unsigned size)
+                        uint64_t val, unsigned size)
 {
     TyphoonState *s = opaque;
-    uint64_t val, oldval, newval;
-
-    if (addr & 4) {
-        val = v32 << 32 | s->latch_tmp;
-        addr ^= 4;
-    } else {
-        s->latch_tmp = v32;
-        return;
-    }
+    uint64_t oldval, newval;
 
     switch (addr) {
     case 0x0000:
@@ -471,18 +450,10 @@ static void dchip_write(void *opaque, hwaddr addr,
 }
 
 static void pchip_write(void *opaque, hwaddr addr,
-                        uint64_t v32, unsigned size)
+                        uint64_t val, unsigned size)
 {
     TyphoonState *s = opaque;
-    uint64_t val, oldval;
-
-    if (addr & 4) {
-        val = v32 << 32 | s->latch_tmp;
-        addr ^= 4;
-    } else {
-        s->latch_tmp = v32;
-        return;
-    }
+    uint64_t oldval;
 
     switch (addr) {
     case 0x0000:
@@ -585,12 +556,12 @@ static const MemoryRegionOps cchip_ops = {
     .write = cchip_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
-        .min_access_size = 4,  /* ??? Should be 8.  */
+        .min_access_size = 8,
         .max_access_size = 8,
     },
     .impl = {
-        .min_access_size = 4,
-        .max_access_size = 4,
+        .min_access_size = 8,
+        .max_access_size = 8,
     },
 };
 
@@ -599,11 +570,11 @@ static const MemoryRegionOps dchip_ops = {
     .write = dchip_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
-        .min_access_size = 4,  /* ??? Should be 8.  */
+        .min_access_size = 8,
         .max_access_size = 8,
     },
     .impl = {
-        .min_access_size = 4,
+        .min_access_size = 8,
         .max_access_size = 8,
     },
 };
@@ -613,12 +584,12 @@ static const MemoryRegionOps pchip_ops = {
     .write = pchip_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
-        .min_access_size = 4,  /* ??? Should be 8.  */
+        .min_access_size = 8,
         .max_access_size = 8,
     },
     .impl = {
-        .min_access_size = 4,
-        .max_access_size = 4,
+        .min_access_size = 8,
+        .max_access_size = 8,
     },
 };
 
commit 23326164ae6fe8d94b7eff123e03f97ca6978d33
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Jul 8 14:55:59 2013 -0700

    exec: Support 64-bit operations in address_space_rw
    
    Honor the implementation maximum access size, and at least check
    the minimum access size.
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/exec.c b/exec.c
index 80ee2ab..c99a883 100644
--- a/exec.c
+++ b/exec.c
@@ -1896,15 +1896,37 @@ static inline bool memory_access_is_direct(MemoryRegion *mr, bool is_write)
     return false;
 }
 
-static inline int memory_access_size(MemoryRegion *mr, int l, hwaddr addr)
+static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
 {
-    if (l >= 4 && (((addr & 3) == 0 || mr->ops->impl.unaligned))) {
-        return 4;
+    unsigned access_size_min = mr->ops->impl.min_access_size;
+    unsigned access_size_max = mr->ops->impl.max_access_size;
+
+    /* Regions are assumed to support 1-4 byte accesses unless
+       otherwise specified.  */
+    if (access_size_min == 0) {
+        access_size_min = 1;
+    }
+    if (access_size_max == 0) {
+        access_size_max = 4;
+    }
+
+    /* Bound the maximum access by the alignment of the address.  */
+    if (!mr->ops->impl.unaligned) {
+        unsigned align_size_max = addr & -addr;
+        if (align_size_max != 0 && align_size_max < access_size_max) {
+            access_size_max = align_size_max;
+        }
     }
-    if (l >= 2 && (((addr & 1) == 0) || mr->ops->impl.unaligned)) {
-        return 2;
+
+    /* Don't attempt accesses larger than the maximum.  */
+    if (l > access_size_max) {
+        l = access_size_max;
     }
-    return 1;
+    /* ??? The users of this function are wrong, not supporting minimums larger
+       than the remaining length.  C.f. memory.c:access_with_adjusted_size.  */
+    assert(l >= access_size_min);
+
+    return l;
 }
 
 bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
@@ -1926,18 +1948,29 @@ bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
                 l = memory_access_size(mr, l, addr1);
                 /* XXX: could force current_cpu to NULL to avoid
                    potential bugs */
-                if (l == 4) {
+                switch (l) {
+                case 8:
+                    /* 64 bit write access */
+                    val = ldq_p(buf);
+                    error |= io_mem_write(mr, addr1, val, 8);
+                    break;
+                case 4:
                     /* 32 bit write access */
                     val = ldl_p(buf);
                     error |= io_mem_write(mr, addr1, val, 4);
-                } else if (l == 2) {
+                    break;
+                case 2:
                     /* 16 bit write access */
                     val = lduw_p(buf);
                     error |= io_mem_write(mr, addr1, val, 2);
-                } else {
+                    break;
+                case 1:
                     /* 8 bit write access */
                     val = ldub_p(buf);
                     error |= io_mem_write(mr, addr1, val, 1);
+                    break;
+                default:
+                    abort();
                 }
             } else {
                 addr1 += memory_region_get_ram_addr(mr);
@@ -1950,18 +1983,29 @@ bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
             if (!memory_access_is_direct(mr, is_write)) {
                 /* I/O case */
                 l = memory_access_size(mr, l, addr1);
-                if (l == 4) {
+                switch (l) {
+                case 8:
+                    /* 64 bit read access */
+                    error |= io_mem_read(mr, addr1, &val, 8);
+                    stq_p(buf, val);
+                    break;
+                case 4:
                     /* 32 bit read access */
                     error |= io_mem_read(mr, addr1, &val, 4);
                     stl_p(buf, val);
-                } else if (l == 2) {
+                    break;
+                case 2:
                     /* 16 bit read access */
                     error |= io_mem_read(mr, addr1, &val, 2);
                     stw_p(buf, val);
-                } else {
+                    break;
+                case 1:
                     /* 8 bit read access */
                     error |= io_mem_read(mr, addr1, &val, 1);
                     stb_p(buf, val);
+                    break;
+                default:
+                    abort();
                 }
             } else {
                 /* RAM case */
commit 3661049fec64ffd7ab008e57e396881c6a4b53a4
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Jul 8 15:46:37 2013 -0700

    hw/alpha: Don't machine check on missing pci i/o
    
    Not really correct, but we don't implement all of the random devices
    that the kernel looks for.  This is good enough to keep us booting.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/hw/alpha/alpha_sys.h b/hw/alpha/alpha_sys.h
index 0987851..e11025b 100644
--- a/hw/alpha/alpha_sys.h
+++ b/hw/alpha/alpha_sys.h
@@ -14,6 +14,7 @@ PCIBus *typhoon_init(ram_addr_t, ISABus **, qemu_irq *, AlphaCPU *[4],
                      pci_map_irq_fn);
 
 /* alpha_pci.c.  */
+extern const MemoryRegionOps alpha_pci_ignore_ops;
 extern const MemoryRegionOps alpha_pci_conf1_ops;
 extern const MemoryRegionOps alpha_pci_iack_ops;
 
diff --git a/hw/alpha/pci.c b/hw/alpha/pci.c
index 25637e0..d839dd5 100644
--- a/hw/alpha/pci.c
+++ b/hw/alpha/pci.c
@@ -12,6 +12,32 @@
 #include "sysemu/sysemu.h"
 
 
+/* Fallback for unassigned PCI I/O operations.  Avoids MCHK.  */
+
+static uint64_t ignore_read(void *opaque, hwaddr addr, unsigned size)
+{
+    return 0;
+}
+
+static void ignore_write(void *opaque, hwaddr addr, uint64_t v, unsigned size)
+{
+}
+
+const MemoryRegionOps alpha_pci_ignore_ops = {
+    .read = ignore_read,
+    .write = ignore_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 8,
+    },
+};
+
+
 /* PCI config space reads/writes, to byte-word addressable memory.  */
 static uint64_t bw_conf1_read(void *opaque, hwaddr addr,
                               unsigned size)
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 9dac9df..69e2255 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -764,7 +764,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
                                 &s->pchip.reg_mem);
 
     /* Pchip0 PCI I/O, 0x801.FC00.0000, 32MB.  */
-    memory_region_init(&s->pchip.reg_io, OBJECT(s), "pci0-io", 32*MB);
+    memory_region_init_io(&s->pchip.reg_io, OBJECT(s), &alpha_pci_ignore_ops,
+                          NULL, "pci0-io", 32*MB);
     memory_region_add_subregion(addr_space, 0x801fc000000ULL,
                                 &s->pchip.reg_io);
 
commit 056e6bae1c91f47165d962564f82f5176bae47f0
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Jul 8 13:55:30 2013 -0700

    hw/alpha: Don't use get_system_io
    
    Advancements in the ioport subsystem mean that we need no longer
    thunk memory-mapped i/o through the system-io address space.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/hw/alpha/alpha_sys.h b/hw/alpha/alpha_sys.h
index 50e7730..0987851 100644
--- a/hw/alpha/alpha_sys.h
+++ b/hw/alpha/alpha_sys.h
@@ -14,7 +14,6 @@ PCIBus *typhoon_init(ram_addr_t, ISABus **, qemu_irq *, AlphaCPU *[4],
                      pci_map_irq_fn);
 
 /* alpha_pci.c.  */
-extern const MemoryRegionOps alpha_pci_bw_io_ops;
 extern const MemoryRegionOps alpha_pci_conf1_ops;
 extern const MemoryRegionOps alpha_pci_iack_ops;
 
diff --git a/hw/alpha/pci.c b/hw/alpha/pci.c
index 7327d48..25637e0 100644
--- a/hw/alpha/pci.c
+++ b/hw/alpha/pci.c
@@ -12,50 +12,6 @@
 #include "sysemu/sysemu.h"
 
 
-/* PCI IO reads/writes, to byte-word addressable memory.  */
-/* ??? Doesn't handle multiple PCI busses.  */
-
-static uint64_t bw_io_read(void *opaque, hwaddr addr, unsigned size)
-{
-    switch (size) {
-    case 1:
-        return cpu_inb(addr);
-    case 2:
-        return cpu_inw(addr);
-    case 4:
-        return cpu_inl(addr);
-    }
-    abort();
-}
-
-static void bw_io_write(void *opaque, hwaddr addr,
-                        uint64_t val, unsigned size)
-{
-    switch (size) {
-    case 1:
-        cpu_outb(addr, val);
-        break;
-    case 2:
-        cpu_outw(addr, val);
-        break;
-    case 4:
-        cpu_outl(addr, val);
-        break;
-    default:
-        abort();
-    }
-}
-
-const MemoryRegionOps alpha_pci_bw_io_ops = {
-    .read = bw_io_read,
-    .write = bw_io_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 4,
-    },
-};
-
 /* PCI config space reads/writes, to byte-word addressable memory.  */
 static uint64_t bw_conf1_read(void *opaque, hwaddr addr,
                               unsigned size)
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 1c3ac8e..9dac9df 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -705,7 +705,6 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
     const uint64_t MB = 1024 * 1024;
     const uint64_t GB = 1024 * MB;
     MemoryRegion *addr_space = get_system_memory();
-    MemoryRegion *addr_space_io = get_system_io();
     DeviceState *dev;
     TyphoonState *s;
     PCIHostState *phb;
@@ -765,28 +764,25 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
                                 &s->pchip.reg_mem);
 
     /* Pchip0 PCI I/O, 0x801.FC00.0000, 32MB.  */
-    /* ??? Ideally we drop the "system" i/o space on the floor and give the
-       PCI subsystem the full address space reserved by the chipset.
-       We can't do that until the MEM and IO paths in memory.c are unified.  */
-    memory_region_init_io(&s->pchip.reg_io, OBJECT(s), &alpha_pci_bw_io_ops,
-                          NULL, "pci0-io", 32*MB);
+    memory_region_init(&s->pchip.reg_io, OBJECT(s), "pci0-io", 32*MB);
     memory_region_add_subregion(addr_space, 0x801fc000000ULL,
                                 &s->pchip.reg_io);
 
     b = pci_register_bus(dev, "pci",
                          typhoon_set_irq, sys_map_irq, s,
-                         &s->pchip.reg_mem, addr_space_io, 0, 64, TYPE_PCI_BUS);
+                         &s->pchip.reg_mem, &s->pchip.reg_io,
+                         0, 64, TYPE_PCI_BUS);
     phb->bus = b;
 
     /* Pchip0 PCI special/interrupt acknowledge, 0x801.F800.0000, 64MB.  */
-    memory_region_init_io(&s->pchip.reg_iack, OBJECT(s), &alpha_pci_iack_ops, b,
-                          "pci0-iack", 64*MB);
+    memory_region_init_io(&s->pchip.reg_iack, OBJECT(s), &alpha_pci_iack_ops,
+                          b, "pci0-iack", 64*MB);
     memory_region_add_subregion(addr_space, 0x801f8000000ULL,
                                 &s->pchip.reg_iack);
 
     /* Pchip0 PCI configuration, 0x801.FE00.0000, 16MB.  */
-    memory_region_init_io(&s->pchip.reg_conf, OBJECT(s), &alpha_pci_conf1_ops, b,
-                          "pci0-conf", 16*MB);
+    memory_region_init_io(&s->pchip.reg_conf, OBJECT(s), &alpha_pci_conf1_ops,
+                          b, "pci0-conf", 16*MB);
     memory_region_add_subregion(addr_space, 0x801fe000000ULL,
                                 &s->pchip.reg_conf);
 
@@ -804,7 +800,7 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
     {
         qemu_irq isa_pci_irq, *isa_irqs;
 
-        *isa_bus = isa_bus_new(NULL, addr_space_io);
+        *isa_bus = isa_bus_new(NULL, &s->pchip.reg_io);
         isa_pci_irq = *qemu_allocate_irqs(typhoon_set_isa_irq, s, 1);
         isa_irqs = i8259_init(*isa_bus, isa_pci_irq);
         isa_bus_irqs(*isa_bus, isa_irqs);
commit c3cb8e77804313e1be99b5f28a34a346736707a5
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jul 12 14:37:47 2013 -0500

    ioport: remove LITTLE_ENDIAN mark for portio
    
    Setting it to LE forces a byte swap when host != guest endian but
    this makes no sense at all.
    
    Herve made the suggestion upon observing that word writes/reads
    were broken into byte writes/reads in such a way as to assume
    devices are interpret registers as LE.
    
    However, even if this were a problem, marking the region as LE is
    not useful because what's essentially happening here is that LE is
    open coded.  So by marking it LE in MemoryRegionOps, we're doing a
    superflous swap.
    
    Now, the portio code is suspicious to begin with.  The dispatch
    layer really has no purpose in splitting I/O requests in the first
    place...
    
    Cc: Hervé Poussineau <hpoussin at reactos.org>
    Cc: Alex Graf <agraf at suse.de>
    Cc: Benjamin Herrenschmidt <benh at kernel.crashing.org>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ioport.c b/ioport.c
index 79b7f1a..89b17d6 100644
--- a/ioport.c
+++ b/ioport.c
@@ -183,7 +183,6 @@ static void portio_write(void *opaque, hwaddr addr, uint64_t data,
 static const MemoryRegionOps portio_ops = {
     .read = portio_read,
     .write = portio_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
     .valid.unaligned = true,
     .impl.unaligned = true,
 };
commit 7ca1dfad952d8a8655b32e78623edcc38a51b14a
Author: Chegu Vinod <chegu_vinod at hp.com>
Date:   Mon Jun 24 03:47:39 2013 -0600

    Force auto-convegence of live migration
    
    If a user chooses to turn on the auto-converge migration capability
    these changes detect the lack of convergence and throttle down the
    guest. i.e. force the VCPUs out of the guest for some duration
    and let the migration thread catchup and help converge.
    
    Verified the convergence using the following :
     - Java Warehouse workload running on a 20VCPU/256G guest(~80% busy)
     - OLTP like workload running on a 80VCPU/512G guest (~80% busy)
    
    Sample results with Java warehouse workload : (migrate speed set to 20Gb and
    migrate downtime set to 4seconds).
    
     (qemu) info migrate
     capabilities: xbzrle: off auto-converge: off  <----
     Migration status: active
     total time: 1487503 milliseconds
     expected downtime: 519 milliseconds
     transferred ram: 383749347 kbytes
     remaining ram: 2753372 kbytes
     total ram: 268444224 kbytes
     duplicate: 65461532 pages
     skipped: 64901568 pages
     normal: 95750218 pages
     normal bytes: 383000872 kbytes
     dirty pages rate: 67551 pages
    
     ---
    
     (qemu) info migrate
     capabilities: xbzrle: off auto-converge: on   <----
     Migration status: completed
     total time: 241161 milliseconds
     downtime: 6373 milliseconds
     transferred ram: 28235307 kbytes
     remaining ram: 0 kbytes
     total ram: 268444224 kbytes
     duplicate: 64946416 pages
     skipped: 64903523 pages
     normal: 7044971 pages
     normal bytes: 28179884 kbytes
    
    Signed-off-by: Chegu Vinod <chegu_vinod at hp.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index 0e553c9..e9dd96f 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -104,6 +104,9 @@ int graphic_depth = 32;
 #endif
 
 const uint32_t arch_type = QEMU_ARCH;
+static bool mig_throttle_on;
+static int dirty_rate_high_cnt;
+static void check_guest_throttling(void);
 
 /***********************************************************/
 /* ram save/restore */
@@ -378,8 +381,14 @@ static void migration_bitmap_sync(void)
     uint64_t num_dirty_pages_init = migration_dirty_pages;
     MigrationState *s = migrate_get_current();
     static int64_t start_time;
+    static int64_t bytes_xfer_prev;
     static int64_t num_dirty_pages_period;
     int64_t end_time;
+    int64_t bytes_xfer_now;
+
+    if (!bytes_xfer_prev) {
+        bytes_xfer_prev = ram_bytes_transferred();
+    }
 
     if (!start_time) {
         start_time = qemu_get_clock_ms(rt_clock);
@@ -404,6 +413,25 @@ static void migration_bitmap_sync(void)
 
     /* more than 1 second = 1000 millisecons */
     if (end_time > start_time + 1000) {
+        if (migrate_auto_converge()) {
+            /* The following detection logic can be refined later. For now:
+               Check to see if the dirtied bytes is 50% more than the approx.
+               amount of bytes that just got transferred since the last time we
+               were in this routine. If that happens >N times (for now N==4)
+               we turn on the throttle down logic */
+            bytes_xfer_now = ram_bytes_transferred();
+            if (s->dirty_pages_rate &&
+               (num_dirty_pages_period * TARGET_PAGE_SIZE >
+                   (bytes_xfer_now - bytes_xfer_prev)/2) &&
+               (dirty_rate_high_cnt++ > 4)) {
+                    trace_migration_throttle();
+                    mig_throttle_on = true;
+                    dirty_rate_high_cnt = 0;
+             }
+             bytes_xfer_prev = bytes_xfer_now;
+        } else {
+             mig_throttle_on = false;
+        }
         s->dirty_pages_rate = num_dirty_pages_period * 1000
             / (end_time - start_time);
         s->dirty_bytes_rate = s->dirty_pages_rate * TARGET_PAGE_SIZE;
@@ -573,6 +601,8 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
     migration_bitmap = bitmap_new(ram_pages);
     bitmap_set(migration_bitmap, 0, ram_pages);
     migration_dirty_pages = ram_pages;
+    mig_throttle_on = false;
+    dirty_rate_high_cnt = 0;
 
     if (migrate_use_xbzrle()) {
         XBZRLE.cache = cache_init(migrate_xbzrle_cache_size() /
@@ -635,6 +665,7 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
         }
         total_sent += bytes_sent;
         acct_info.iterations++;
+        check_guest_throttling();
         /* we want to check in the 1st loop, just in case it was the 1st time
            and we had to sync the dirty bitmap.
            qemu_get_clock_ns() is a bit expensive, so we only check each some
@@ -1110,3 +1141,53 @@ TargetInfo *qmp_query_target(Error **errp)
 
     return info;
 }
+
+/* Stub function that's gets run on the vcpu when its brought out of the
+   VM to run inside qemu via async_run_on_cpu()*/
+static void mig_sleep_cpu(void *opq)
+{
+    qemu_mutex_unlock_iothread();
+    g_usleep(30*1000);
+    qemu_mutex_lock_iothread();
+}
+
+/* To reduce the dirty rate explicitly disallow the VCPUs from spending
+   much time in the VM. The migration thread will try to catchup.
+   Workload will experience a performance drop.
+*/
+static void mig_throttle_cpu_down(CPUState *cpu, void *data)
+{
+    async_run_on_cpu(cpu, mig_sleep_cpu, NULL);
+}
+
+static void mig_throttle_guest_down(void)
+{
+    qemu_mutex_lock_iothread();
+    qemu_for_each_cpu(mig_throttle_cpu_down, NULL);
+    qemu_mutex_unlock_iothread();
+}
+
+static void check_guest_throttling(void)
+{
+    static int64_t t0;
+    int64_t        t1;
+
+    if (!mig_throttle_on) {
+        return;
+    }
+
+    if (!t0)  {
+        t0 = qemu_get_clock_ns(rt_clock);
+        return;
+    }
+
+    t1 = qemu_get_clock_ns(rt_clock);
+
+    /* If it has been more than 40 ms since the last time the guest
+     * was throttled then do it again.
+     */
+    if (40 < (t1-t0)/1000000) {
+        mig_throttle_guest_down();
+        t0 = t1;
+    }
+}
diff --git a/trace-events b/trace-events
index 0acce7b..7f6d962 100644
--- a/trace-events
+++ b/trace-events
@@ -1036,6 +1036,7 @@ savevm_section_end(unsigned int section_id) "section_id %u"
 # arch_init.c
 migration_bitmap_sync_start(void) ""
 migration_bitmap_sync_end(uint64_t dirty_pages) "dirty_pages %" PRIu64""
+migration_throttle(void) ""
 
 # hw/qxl.c
 disable qxl_interface_set_mm_time(int qid, uint32_t mm_time) "%d %d"
commit bde1e2ec2176c363c1783bf8887b6b1beb08dfee
Author: Chegu Vinod <chegu_vinod at hp.com>
Date:   Mon Jun 24 03:49:42 2013 -0600

    Add 'auto-converge' migration capability
    
    The auto-converge migration capability allows the user to specify if they
    choose live migration seqeunce to automatically detect and force convergence.
    
    Signed-off-by: Chegu Vinod <chegu_vinod at hp.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/include/migration/migration.h b/include/migration/migration.h
index f0640e0..bc9fde0 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -125,6 +125,8 @@ void migrate_del_blocker(Error *reason);
 
 bool migrate_rdma_pin_all(void);
 
+bool migrate_auto_converge(void);
+
 int xbzrle_encode_buffer(uint8_t *old_buf, uint8_t *new_buf, int slen,
                          uint8_t *dst, int dlen);
 int xbzrle_decode_buffer(uint8_t *src, int slen, uint8_t *dst, int dlen);
diff --git a/migration.c b/migration.c
index 635a7e7..184ae3f 100644
--- a/migration.c
+++ b/migration.c
@@ -484,6 +484,15 @@ bool migrate_rdma_pin_all(void)
     return s->enabled_capabilities[MIGRATION_CAPABILITY_X_RDMA_PIN_ALL];
 }
 
+bool migrate_auto_converge(void)
+{
+    MigrationState *s;
+
+    s = migrate_get_current();
+
+    return s->enabled_capabilities[MIGRATION_CAPABILITY_AUTO_CONVERGE];
+}
+
 int migrate_use_xbzrle(void)
 {
     MigrationState *s;
diff --git a/qapi-schema.json b/qapi-schema.json
index b251d28..35095ff 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -616,7 +616,7 @@
 # Since: 1.2
 ##
 { 'enum': 'MigrationCapability',
-  'data': ['xbzrle', 'x-rdma-pin-all'] }
+  'data': ['xbzrle', 'x-rdma-pin-all', 'auto-converge'] }
 
 ##
 # @MigrationCapabilityStatus
commit 3c02270db980007424d797506301826310ce2db4
Author: Chegu Vinod <chegu_vinod at hp.com>
Date:   Mon Jun 24 03:49:41 2013 -0600

    Introduce async_run_on_cpu()
    
    Introduce an asynchronous version of run_on_cpu() i.e. the caller
    doesn't have to block till the call back routine finishes execution
    on the target vcpu.
    
    Signed-off-by: Chegu Vinod <chegu_vinod at hp.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/cpus.c b/cpus.c
index f141428..5123972 100644
--- a/cpus.c
+++ b/cpus.c
@@ -648,6 +648,7 @@ void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
 
     wi.func = func;
     wi.data = data;
+    wi.free = false;
     if (cpu->queued_work_first == NULL) {
         cpu->queued_work_first = &wi;
     } else {
@@ -666,6 +667,31 @@ void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
     }
 }
 
+void async_run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
+{
+    struct qemu_work_item *wi;
+
+    if (qemu_cpu_is_self(cpu)) {
+        func(data);
+        return;
+    }
+
+    wi = g_malloc0(sizeof(struct qemu_work_item));
+    wi->func = func;
+    wi->data = data;
+    wi->free = true;
+    if (cpu->queued_work_first == NULL) {
+        cpu->queued_work_first = wi;
+    } else {
+        cpu->queued_work_last->next = wi;
+    }
+    cpu->queued_work_last = wi;
+    wi->next = NULL;
+    wi->done = false;
+
+    qemu_cpu_kick(cpu);
+}
+
 static void flush_queued_work(CPUState *cpu)
 {
     struct qemu_work_item *wi;
@@ -678,6 +704,9 @@ static void flush_queued_work(CPUState *cpu)
         cpu->queued_work_first = wi->next;
         wi->func(wi->data);
         wi->done = true;
+        if (wi->free) {
+            g_free(wi);
+        }
     }
     cpu->queued_work_last = NULL;
     qemu_cond_broadcast(&qemu_work_cond);
diff --git a/include/qemu-common.h b/include/qemu-common.h
index f439738..6948bb9 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -293,6 +293,7 @@ struct qemu_work_item {
     void (*func)(void *data);
     void *data;
     int done;
+    bool free;
 };
 
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 147c256..dfd81a1 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -379,6 +379,16 @@ bool cpu_is_stopped(CPUState *cpu);
 void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data);
 
 /**
+ * async_run_on_cpu:
+ * @cpu: The vCPU to run on.
+ * @func: The function to be executed.
+ * @data: Data to pass to the function.
+ *
+ * Schedules the function @func for execution on the vCPU @cpu asynchronously.
+ */
+void async_run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data);
+
+/**
  * qemu_for_each_cpu:
  * @func: The function to be executed.
  * @data: Data to pass to the function.
commit 25ca6a1f5a3ee0a1ae670590877ed14f05e28fba
Merge: c170a23 f35ea98
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jul 12 07:58:31 2013 -0500

    Merge remote-tracking branch 'agraf/ppc-for-upstream' into staging
    
    # By Alexander Graf (16) and others
    # Via Alexander Graf
    * agraf/ppc-for-upstream: (22 commits)
      PPC: dbdma: Support more multi-issue DMA requests
      PPC: Add timer handler for newworld mac-io
      PPC: dbdma: Support unaligned DMA access
      PPC: dbdma: Wait for DMA until we have data
      PPC: dbdma: Move processing to io
      PPC: dbdma: macio: Add DMA callback
      PPC: dbdma: Move static bh variable to device struct
      PPC: dbdma: Introduce kick function
      PPC: dbdma: Move defines into header file
      PPC: dbdma: Allow new commands in RUN state
      PPC: dbdma: Fix debug print
      PPC: Mac: Add debug prints in macio and dbdma code
      PPC: dbdma: Replace tabs with spaces
      PPC: Macio: Replace tabs with spaces
      PPC: g3beige: Move secondary IDE bus to mac-io
      PPC: Mac: Fix guest exported tbfreq values
      target-ppc: Add POWER8 v1.0 CPU model
      pseries: move interrupt controllers to hw/intc/
      spapr: Respect -bios command line option for SLOF
      spapr: Use named enum for function remove_hpte
      ...
    
    Message-id: 1373562085-29728-1-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit f35ea98cd9f75db9286f05bf3dc4b532f4cb5eaa
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 15:29:13 2013 +0200

    PPC: dbdma: Support more multi-issue DMA requests
    
    A DMA request can happen for data that hasn't been completely been
    provided by the IDE core yet. For example
    
      - DBDMA request for 0x1000 bytes
      - IDE request for 1 sector
      - DBDMA wants to read 0x1000 bytes (8 sectors) from bdrv
      - breakage
    
    Instead, we should truncate our bdrv request to the maximum number
    of sectors we're allowed to read at that given time. Once that transfer
    is through, we will fall into our recently introduced waiting logic.
    
      - DBDMA requests for 0x1000 bytes
      - IDE request for 1 sector
      - DBDMA wants to read MIN(0x1000, 1 * 512) bytes
      - DBDMA finishes reading, indicates to IDE core that transfer is complete
      - IDE request for 7 sectors
      - DBDMA finishes the DMA
    
    Reported-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 18bc1d1..38ad924 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -87,7 +87,7 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
         s->io_buffer_index &= 0x7ff;
     }
 
-    s->io_buffer_size = io->len;
+    s->io_buffer_size = MIN(io->len, s->packet_transfer_size);
 
     MACIO_DPRINTF("remainder: %d io->len: %d size: %d\n", io->remainder_len,
                   io->len, s->packet_transfer_size);
@@ -253,7 +253,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     /* launch next transfer */
 
     s->io_buffer_index = 0;
-    s->io_buffer_size = io->len;
+    s->io_buffer_size = MIN(io->len, s->nsector * 512);
 
     /* handle unaligned accesses first, get them over with and only do the
        remaining bulk transfer using our async DMA helpers */
commit a0f9fdfd98cc0571f9921a7eadd7316532e3e289
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 05:15:14 2013 +0200

    PPC: Add timer handler for newworld mac-io
    
    Mac OS X accesses fancy timer registers inside of the mac-io on bootup.
    
    These really should be ticking at the mac-io bus frequency, but I don't
    see anyone upset when we just make them as fast as we want to.
    
    With this patch on top of my previous patch queue and latest OpenBIOS
    I am able to boot Mac OS X 10.4 with -M mac99.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index 6459bc1..c0d0bf7 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -234,11 +234,39 @@ static void macio_oldworld_init(Object *obj)
     }
 }
 
+static void timer_write(void *opaque, hwaddr addr, uint64_t value,
+                       unsigned size)
+{
+}
+
+static uint64_t timer_read(void *opaque, hwaddr addr, unsigned size)
+{
+    uint32_t value = 0;
+
+    switch (addr) {
+    case 0x38:
+        value = qemu_get_clock_ns(vm_clock);
+        break;
+    case 0x3c:
+        value = qemu_get_clock_ns(vm_clock) >> 32;
+        break;
+    }
+
+    return value;
+}
+
+static const MemoryRegionOps timer_ops = {
+    .read = timer_read,
+    .write = timer_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
 static int macio_newworld_initfn(PCIDevice *d)
 {
     MacIOState *s = MACIO(d);
     NewWorldMacIOState *ns = NEWWORLD_MACIO(d);
     SysBusDevice *sysbus_dev;
+    MemoryRegion *timer_memory = g_new(MemoryRegion, 1);
     int i;
     int cur_irq = 0;
     int ret = macio_common_initfn(d);
@@ -265,6 +293,11 @@ static int macio_newworld_initfn(PCIDevice *d)
         }
     }
 
+    /* Timer */
+    memory_region_init_io(timer_memory, OBJECT(s), &timer_ops, NULL, "timer",
+                          0x1000);
+    memory_region_add_subregion(&s->bar, 0x15000, timer_memory);
+
     return 0;
 }
 
commit 80fc95d8bdaf3392106b131a97ca701fd374489a
Author: Alexander Graf <agraf at suse.de>
Date:   Fri Jun 28 13:30:01 2013 +0200

    PPC: dbdma: Support unaligned DMA access
    
    The DBDMA engine really just reads bytes from a producing device (IDE
    in our case) and shoves these bytes into memory. It doesn't care whether
    any alignment takes place or not.
    
    Our code today however assumes that block accesses always happen on
    sector (512 byte) boundaries. This is a fair assumption for most cases.
    
    However, Mac OS X really likes to do unaligned, incomplete accesses
    that it finishes with the next DMA request.
    
    So we need to read / write the unaligned bits independent of the actual
    asynchronous request, because that one can only handle 512-byte-aligned
    data. We also need to cache these unaligned sectors until the next DMA
    request, at which point the data might be successfully flushed from the
    pipe.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 2b1e51d..18bc1d1 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -56,11 +56,13 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
     DBDMA_io *io = opaque;
     MACIOIDEState *m = io->opaque;
     IDEState *s = idebus_active_if(&m->bus);
+    int unaligned;
 
     if (ret < 0) {
         m->aiocb = NULL;
         qemu_sglist_destroy(&s->sg);
         ide_atapi_io_error(s, ret);
+        io->remainder_len = 0;
         goto done;
     }
 
@@ -85,7 +87,31 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
         s->io_buffer_index &= 0x7ff;
     }
 
-    if (s->packet_transfer_size <= 0) {
+    s->io_buffer_size = io->len;
+
+    MACIO_DPRINTF("remainder: %d io->len: %d size: %d\n", io->remainder_len,
+                  io->len, s->packet_transfer_size);
+    if (io->remainder_len && io->len) {
+        /* guest wants the rest of its previous transfer */
+        int remainder_len = MIN(io->remainder_len, io->len);
+
+        MACIO_DPRINTF("copying remainder %d bytes\n", remainder_len);
+
+        cpu_physical_memory_write(io->addr, io->remainder + 0x200 -
+                                  remainder_len, remainder_len);
+
+        io->addr += remainder_len;
+        io->len -= remainder_len;
+        s->io_buffer_size = remainder_len;
+        io->remainder_len -= remainder_len;
+        /* treat remainder as individual transfer, start again */
+        qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
+                         &address_space_memory);
+        pmac_ide_atapi_transfer_cb(opaque, 0);
+        return;
+    }
+
+    if (!s->packet_transfer_size) {
         MACIO_DPRINTF("end of transfer\n");
         ide_atapi_cmd_ok(s);
         m->dma_active = false;
@@ -98,14 +124,40 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
 
     /* launch next transfer */
 
-    MACIO_DPRINTF("io->len = %#x\n", io->len);
+    /* handle unaligned accesses first, get them over with and only do the
+       remaining bulk transfer using our async DMA helpers */
+    unaligned = io->len & 0x1ff;
+    if (unaligned) {
+        int sector_num = (s->lba << 2) + (s->io_buffer_index >> 9);
+        int nsector = io->len >> 9;
 
-    s->io_buffer_size = io->len;
+        MACIO_DPRINTF("precopying unaligned %d bytes to %#lx\n",
+                      unaligned, io->addr + io->len - unaligned);
+
+        bdrv_read(s->bs, sector_num + nsector, io->remainder, 1);
+        cpu_physical_memory_write(io->addr + io->len - unaligned,
+                                  io->remainder, unaligned);
+
+        io->len -= unaligned;
+    }
+
+    MACIO_DPRINTF("io->len = %#x\n", io->len);
 
     qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
                      &address_space_memory);
     qemu_sglist_add(&s->sg, io->addr, io->len);
-    io->addr += io->len;
+    io->addr += s->io_buffer_size;
+    io->remainder_len = MIN(s->packet_transfer_size - s->io_buffer_size,
+                            (0x200 - unaligned) & 0x1ff);
+    MACIO_DPRINTF("set remainder to: %d\n", io->remainder_len);
+
+    /* We would read no data from the block layer, thus not get a callback.
+       Just fake completion manually. */
+    if (!io->len) {
+        pmac_ide_atapi_transfer_cb(opaque, 0);
+        return;
+    }
+
     io->len = 0;
 
     MACIO_DPRINTF("sector_num=%d size=%d, cmd_cmd=%d\n",
@@ -128,14 +180,16 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     DBDMA_io *io = opaque;
     MACIOIDEState *m = io->opaque;
     IDEState *s = idebus_active_if(&m->bus);
-    int n;
+    int n = 0;
     int64_t sector_num;
+    int unaligned;
 
     if (ret < 0) {
         MACIO_DPRINTF("DMA error\n");
         m->aiocb = NULL;
         qemu_sglist_destroy(&s->sg);
         ide_dma_error(s);
+        io->remainder_len = 0;
         goto done;
     }
 
@@ -158,7 +212,33 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
         s->nsector -= n;
     }
 
-    if (s->nsector == 0) {
+    MACIO_DPRINTF("remainder: %d io->len: %d nsector: %d sector_num: %ld\n",
+                  io->remainder_len, io->len, s->nsector, sector_num);
+    if (io->remainder_len && io->len) {
+        /* guest wants the rest of its previous transfer */
+        int remainder_len = MIN(io->remainder_len, io->len);
+        uint8_t *p = &io->remainder[0x200 - remainder_len];
+
+        MACIO_DPRINTF("copying remainder %d bytes at %#lx\n",
+                      remainder_len, io->addr);
+
+        switch (s->dma_cmd) {
+        case IDE_DMA_READ:
+            cpu_physical_memory_write(io->addr, p, remainder_len);
+            break;
+        case IDE_DMA_WRITE:
+            cpu_physical_memory_read(io->addr, p, remainder_len);
+            bdrv_write(s->bs, sector_num - 1, io->remainder, 1);
+            break;
+        case IDE_DMA_TRIM:
+            break;
+        }
+        io->addr += remainder_len;
+        io->len -= remainder_len;
+        io->remainder_len -= remainder_len;
+    }
+
+    if (s->nsector == 0 && !io->remainder_len) {
         MACIO_DPRINTF("end of transfer\n");
         s->status = READY_STAT | SEEK_STAT;
         ide_set_irq(s->bus);
@@ -175,12 +255,49 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     s->io_buffer_index = 0;
     s->io_buffer_size = io->len;
 
+    /* handle unaligned accesses first, get them over with and only do the
+       remaining bulk transfer using our async DMA helpers */
+    unaligned = io->len & 0x1ff;
+    if (unaligned) {
+        int nsector = io->len >> 9;
+
+        MACIO_DPRINTF("precopying unaligned %d bytes to %#lx\n",
+                      unaligned, io->addr + io->len - unaligned);
+
+        switch (s->dma_cmd) {
+        case IDE_DMA_READ:
+            bdrv_read(s->bs, sector_num + nsector, io->remainder, 1);
+            cpu_physical_memory_write(io->addr + io->len - unaligned,
+                                      io->remainder, unaligned);
+            break;
+        case IDE_DMA_WRITE:
+            /* cache the contents in our io struct */
+            cpu_physical_memory_read(io->addr + io->len - unaligned,
+                                     io->remainder, unaligned);
+            break;
+        case IDE_DMA_TRIM:
+            break;
+        }
+
+        io->len -= unaligned;
+    }
+
     MACIO_DPRINTF("io->len = %#x\n", io->len);
 
     qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
                      &address_space_memory);
     qemu_sglist_add(&s->sg, io->addr, io->len);
-    io->addr += io->len;
+    io->addr += io->len + unaligned;
+    io->remainder_len = (0x200 - unaligned) & 0x1ff;
+    MACIO_DPRINTF("set remainder to: %d\n", io->remainder_len);
+
+    /* We would read no data from the block layer, thus not get a callback.
+       Just fake completion manually. */
+    if (!io->len) {
+        pmac_ide_transfer_cb(opaque, 0);
+        return;
+    }
+
     io->len = 0;
 
     MACIO_DPRINTF("sector_num=%" PRId64 " n=%d, nsector=%d, cmd_cmd=%d\n",
diff --git a/include/hw/ppc/mac_dbdma.h b/include/hw/ppc/mac_dbdma.h
index 4d7318d..90efd27 100644
--- a/include/hw/ppc/mac_dbdma.h
+++ b/include/hw/ppc/mac_dbdma.h
@@ -39,6 +39,9 @@ struct DBDMA_io {
     DBDMA_end dma_end;
     /* DMA is in progress, don't start another one */
     bool processing;
+    /* unaligned last sector of a request */
+    uint8_t remainder[0x200];
+    int remainder_len;
 };
 
 /*
commit cae323572eddc1a45e2f6ef98c006d98fed23b1e
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 02:54:35 2013 +0200

    PPC: dbdma: Wait for DMA until we have data
    
    We should only start processing DMA requests when we have data to process.
    Hold off working through the DMA shuffling until the IDE core told us that
    it's ready.
    
    This is required because the guest can program the DMA engine or the IDE
    transfer first. Both are legal.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 126549d..2b1e51d 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -64,6 +64,14 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
         goto done;
     }
 
+    if (!m->dma_active) {
+        MACIO_DPRINTF("waiting for data (%#x - %#x - %x)\n",
+                      s->nsector, io->len, s->status);
+        /* data not ready yet, wait for the channel to get restarted */
+        io->processing = false;
+        return;
+    }
+
     MACIO_DPRINTF("io_buffer_size = %#x\n", s->io_buffer_size);
 
     if (s->io_buffer_size > 0) {
@@ -80,6 +88,7 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
     if (s->packet_transfer_size <= 0) {
         MACIO_DPRINTF("end of transfer\n");
         ide_atapi_cmd_ok(s);
+        m->dma_active = false;
     }
 
     if (io->len == 0) {
@@ -130,6 +139,14 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
         goto done;
     }
 
+    if (!m->dma_active) {
+        MACIO_DPRINTF("waiting for data (%#x - %#x - %x)\n",
+                      s->nsector, io->len, s->status);
+        /* data not ready yet, wait for the channel to get restarted */
+        io->processing = false;
+        return;
+    }
+
     sector_num = ide_get_sector(s);
     MACIO_DPRINTF("io_buffer_size = %#x\n", s->io_buffer_size);
     if (s->io_buffer_size > 0) {
@@ -145,6 +162,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
         MACIO_DPRINTF("end of transfer\n");
         s->status = READY_STAT | SEEK_STAT;
         ide_set_irq(s->bus);
+        m->dma_active = false;
     }
 
     if (io->len == 0) {
@@ -379,6 +397,7 @@ static void ide_dbdma_start(IDEDMA *dma, IDEState *s,
     MACIOIDEState *m = container_of(dma, MACIOIDEState, dma);
 
     MACIO_DPRINTF("\n");
+    m->dma_active = true;
     DBDMA_kick(m->dbdma);
 }
 
diff --git a/hw/ppc/mac.h b/hw/ppc/mac.h
index 27c4ca3..1e578dd 100644
--- a/hw/ppc/mac.h
+++ b/hw/ppc/mac.h
@@ -133,6 +133,7 @@ typedef struct MACIOIDEState {
     BlockDriverAIOCB *aiocb;
     IDEDMA dma;
     void *dbdma;
+    bool dma_active;
 } MACIOIDEState;
 
 void macio_ide_init_drives(MACIOIDEState *ide, DriveInfo **hd_table);
commit 03ee3b1e58266c7e5b155d58f443d94b23d2bd05
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 02:47:20 2013 +0200

    PPC: dbdma: Move processing to io
    
    Soon we will introduce intermediate processing pauses which will
    allow the bottom half to restart a DMA request that couldn't be
    fulfilled yet.
    
    For that to work, move the processing variable into the io struct
    which is what DMA providers work with.
    
    While touching it, also change it into a bool
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index 4ca0491..f47a736 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -275,7 +275,9 @@ static void dbdma_end(DBDMA_io *io)
     conditional_branch(ch);
 
 wait:
-    ch->processing = 0;
+    /* Indicate that we're ready for a new DMA round */
+    ch->io.processing = false;
+
     if ((ch->regs[DBDMA_STATUS] & RUN) &&
         (ch->regs[DBDMA_STATUS] & ACTIVE))
         channel_run(ch);
@@ -301,7 +303,7 @@ static void start_output(DBDMA_channel *ch, int key, uint32_t addr,
     ch->io.is_last = is_last;
     ch->io.dma_end = dbdma_end;
     ch->io.is_dma_out = 1;
-    ch->processing = 1;
+    ch->io.processing = true;
     if (ch->rw) {
         ch->rw(&ch->io);
     }
@@ -327,7 +329,7 @@ static void start_input(DBDMA_channel *ch, int key, uint32_t addr,
     ch->io.is_last = is_last;
     ch->io.dma_end = dbdma_end;
     ch->io.is_dma_out = 0;
-    ch->processing = 1;
+    ch->io.processing = true;
     if (ch->rw) {
         ch->rw(&ch->io);
     }
@@ -525,7 +527,7 @@ static void DBDMA_run(DBDMAState *s)
     for (channel = 0; channel < DBDMA_CHANNELS; channel++) {
         DBDMA_channel *ch = &s->channels[channel];
         uint32_t status = ch->regs[DBDMA_STATUS];
-        if (!ch->processing && (status & RUN) && (status & ACTIVE)) {
+        if (!ch->io.processing && (status & RUN) && (status & ACTIVE)) {
             channel_run(ch);
         }
     }
diff --git a/include/hw/ppc/mac_dbdma.h b/include/hw/ppc/mac_dbdma.h
index eb8e0f0..4d7318d 100644
--- a/include/hw/ppc/mac_dbdma.h
+++ b/include/hw/ppc/mac_dbdma.h
@@ -37,6 +37,8 @@ struct DBDMA_io {
     int is_last;
     int is_dma_out;
     DBDMA_end dma_end;
+    /* DMA is in progress, don't start another one */
+    bool processing;
 };
 
 /*
@@ -148,7 +150,6 @@ typedef struct DBDMA_channel {
     DBDMA_rw rw;
     DBDMA_flush flush;
     dbdma_cmd current;
-    int processing;
 } DBDMA_channel;
 
 typedef struct {
commit 4aa3510f6f36c5ea35219acf641788222d977437
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 02:36:14 2013 +0200

    PPC: dbdma: macio: Add DMA callback
    
    We need to know when the IDE core starts a DMA transfer. Add a notifier
    function so we have the chance to start transmitting data.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 8d42b5c..126549d 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -359,11 +359,50 @@ static void macio_ide_reset(DeviceState *dev)
     ide_bus_reset(&d->bus);
 }
 
+static int ide_nop(IDEDMA *dma)
+{
+    return 0;
+}
+
+static int ide_nop_int(IDEDMA *dma, int x)
+{
+    return 0;
+}
+
+static void ide_nop_restart(void *opaque, int x, RunState y)
+{
+}
+
+static void ide_dbdma_start(IDEDMA *dma, IDEState *s,
+                            BlockDriverCompletionFunc *cb)
+{
+    MACIOIDEState *m = container_of(dma, MACIOIDEState, dma);
+
+    MACIO_DPRINTF("\n");
+    DBDMA_kick(m->dbdma);
+}
+
+static const IDEDMAOps dbdma_ops = {
+    .start_dma      = ide_dbdma_start,
+    .start_transfer = ide_nop,
+    .prepare_buf    = ide_nop_int,
+    .rw_buf         = ide_nop_int,
+    .set_unit       = ide_nop_int,
+    .add_status     = ide_nop_int,
+    .set_inactive   = ide_nop,
+    .restart_cb     = ide_nop_restart,
+    .reset          = ide_nop,
+};
+
 static void macio_ide_realizefn(DeviceState *dev, Error **errp)
 {
     MACIOIDEState *s = MACIO_IDE(dev);
 
     ide_init2(&s->bus, s->irq);
+
+    /* Register DMA callbacks */
+    s->dma.ops = &dbdma_ops;
+    s->bus.dma = &s->dma;
 }
 
 static void macio_ide_initfn(Object *obj)
@@ -414,6 +453,7 @@ void macio_ide_init_drives(MACIOIDEState *s, DriveInfo **hd_table)
 
 void macio_ide_register_dma(MACIOIDEState *s, void *dbdma, int channel)
 {
+    s->dbdma = dbdma;
     DBDMA_register_channel(dbdma, channel, s->dma_irq,
                            pmac_ide_transfer, pmac_ide_flush, s);
 }
diff --git a/hw/ppc/mac.h b/hw/ppc/mac.h
index 54efaed..27c4ca3 100644
--- a/hw/ppc/mac.h
+++ b/hw/ppc/mac.h
@@ -131,6 +131,8 @@ typedef struct MACIOIDEState {
     MemoryRegion mem;
     IDEBus bus;
     BlockDriverAIOCB *aiocb;
+    IDEDMA dma;
+    void *dbdma;
 } MACIOIDEState;
 
 void macio_ide_init_drives(MACIOIDEState *ide, DriveInfo **hd_table);
commit d2f0ce2189feef94516d81fa5834fa4d65435053
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 02:22:41 2013 +0200

    PPC: dbdma: Move static bh variable to device struct
    
    The DBDMA controller has a bottom half to asynchronously process DMA
    request queues.
    
    This bh was stored as a gross static variable. Move it into the device
    struct instead.
    
    While at it, move all users of it to the new generic kick function.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index d1506ce..4ca0491 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -54,6 +54,11 @@
 /*
  */
 
+static DBDMAState *dbdma_from_ch(DBDMA_channel *ch)
+{
+    return container_of(ch, DBDMAState, channels[ch->channel]);
+}
+
 #ifdef DEBUG_DBDMA
 static void dump_dbdma_cmd(dbdma_cmd *cmd)
 {
@@ -248,7 +253,6 @@ static void conditional_branch(DBDMA_channel *ch)
     }
 }
 
-static QEMUBH *dbdma_bh;
 static void channel_run(DBDMA_channel *ch);
 
 static void dbdma_end(DBDMA_io *io)
@@ -365,7 +369,7 @@ static void load_word(DBDMA_channel *ch, int key, uint32_t addr,
     next(ch);
 
 wait:
-    qemu_bh_schedule(dbdma_bh);
+    DBDMA_kick(dbdma_from_ch(ch));
 }
 
 static void store_word(DBDMA_channel *ch, int key, uint32_t addr,
@@ -403,7 +407,7 @@ static void store_word(DBDMA_channel *ch, int key, uint32_t addr,
     next(ch);
 
 wait:
-    qemu_bh_schedule(dbdma_bh);
+    DBDMA_kick(dbdma_from_ch(ch));
 }
 
 static void nop(DBDMA_channel *ch)
@@ -420,7 +424,7 @@ static void nop(DBDMA_channel *ch)
     conditional_branch(ch);
 
 wait:
-    qemu_bh_schedule(dbdma_bh);
+    DBDMA_kick(dbdma_from_ch(ch));
 }
 
 static void stop(DBDMA_channel *ch)
@@ -538,7 +542,7 @@ static void DBDMA_run_bh(void *opaque)
 
 void DBDMA_kick(DBDMAState *dbdma)
 {
-    qemu_bh_schedule(dbdma_bh);
+    qemu_bh_schedule(dbdma->bh);
 }
 
 void DBDMA_register_channel(void *dbdma, int nchan, qemu_irq irq,
@@ -594,10 +598,12 @@ dbdma_control_write(DBDMA_channel *ch)
 
     ch->regs[DBDMA_STATUS] = status;
 
-    if (status & ACTIVE)
-        qemu_bh_schedule(dbdma_bh);
-    if ((status & FLUSH) && ch->flush)
+    if (status & ACTIVE) {
+        DBDMA_kick(dbdma_from_ch(ch));
+    }
+    if ((status & FLUSH) && ch->flush) {
         ch->flush(&ch->io);
+    }
 }
 
 static void dbdma_write(void *opaque, hwaddr addr,
@@ -750,7 +756,7 @@ void* DBDMA_init (MemoryRegion **dbdma_mem)
     vmstate_register(NULL, -1, &vmstate_dbdma, s);
     qemu_register_reset(dbdma_reset, s);
 
-    dbdma_bh = qemu_bh_new(DBDMA_run_bh, s);
+    s->bh = qemu_bh_new(DBDMA_run_bh, s);
 
     return s;
 }
diff --git a/include/hw/ppc/mac_dbdma.h b/include/hw/ppc/mac_dbdma.h
index aaeab10..eb8e0f0 100644
--- a/include/hw/ppc/mac_dbdma.h
+++ b/include/hw/ppc/mac_dbdma.h
@@ -154,6 +154,7 @@ typedef struct DBDMA_channel {
 typedef struct {
     MemoryRegion mem;
     DBDMA_channel channels[DBDMA_CHANNELS];
+    QEMUBH *bh;
 } DBDMAState;
 
 /* Externally callable functions */
commit d1e562deb2de5c2ced639b18dee59a9ab08236b6
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 02:18:54 2013 +0200

    PPC: dbdma: Introduce kick function
    
    The DBDMA engine really is running all the time, waiting for input. However
    we don't want to waste cycles constantly polling.
    
    So introduce a kick function that data providers can call to notify the
    DBDMA controller of new input.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index c55c75c..d1506ce 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -536,6 +536,11 @@ static void DBDMA_run_bh(void *opaque)
     DBDMA_run(s);
 }
 
+void DBDMA_kick(DBDMAState *dbdma)
+{
+    qemu_bh_schedule(dbdma_bh);
+}
+
 void DBDMA_register_channel(void *dbdma, int nchan, qemu_irq irq,
                             DBDMA_rw rw, DBDMA_flush flush,
                             void *opaque)
diff --git a/include/hw/ppc/mac_dbdma.h b/include/hw/ppc/mac_dbdma.h
index 90be5d9..aaeab10 100644
--- a/include/hw/ppc/mac_dbdma.h
+++ b/include/hw/ppc/mac_dbdma.h
@@ -161,6 +161,7 @@ typedef struct {
 void DBDMA_register_channel(void *dbdma, int nchan, qemu_irq irq,
                             DBDMA_rw rw, DBDMA_flush flush,
                             void *opaque);
+void DBDMA_kick(DBDMAState *dbdma);
 void* DBDMA_init (MemoryRegion **dbdma_mem);
 
 #endif
commit f2f963fd0775263f9c1cdd3cd92b171c8dae6c77
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 02:06:35 2013 +0200

    PPC: dbdma: Move defines into header file
    
    We usually keep struct and constant definitions in header files. Move
    them there to stay consistent and to make access to fields easier.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index 7656767..c55c75c 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -54,123 +54,6 @@
 /*
  */
 
-/*
- * DBDMA control/status registers.  All little-endian.
- */
-
-#define DBDMA_CONTROL         0x00
-#define DBDMA_STATUS          0x01
-#define DBDMA_CMDPTR_HI       0x02
-#define DBDMA_CMDPTR_LO       0x03
-#define DBDMA_INTR_SEL        0x04
-#define DBDMA_BRANCH_SEL      0x05
-#define DBDMA_WAIT_SEL        0x06
-#define DBDMA_XFER_MODE       0x07
-#define DBDMA_DATA2PTR_HI     0x08
-#define DBDMA_DATA2PTR_LO     0x09
-#define DBDMA_RES1            0x0A
-#define DBDMA_ADDRESS_HI      0x0B
-#define DBDMA_BRANCH_ADDR_HI  0x0C
-#define DBDMA_RES2            0x0D
-#define DBDMA_RES3            0x0E
-#define DBDMA_RES4            0x0F
-
-#define DBDMA_REGS            16
-#define DBDMA_SIZE            (DBDMA_REGS * sizeof(uint32_t))
-
-#define DBDMA_CHANNEL_SHIFT   7
-#define DBDMA_CHANNEL_SIZE    (1 << DBDMA_CHANNEL_SHIFT)
-
-#define DBDMA_CHANNELS        (0x1000 >> DBDMA_CHANNEL_SHIFT)
-
-/* Bits in control and status registers */
-
-#define RUN        0x8000
-#define PAUSE      0x4000
-#define FLUSH      0x2000
-#define WAKE       0x1000
-#define DEAD       0x0800
-#define ACTIVE     0x0400
-#define BT         0x0100
-#define DEVSTAT    0x00ff
-
-/*
- * DBDMA command structure.  These fields are all little-endian!
- */
-
-typedef struct dbdma_cmd {
-    uint16_t req_count;          /* requested byte transfer count */
-    uint16_t command;            /* command word (has bit-fields) */
-    uint32_t phy_addr;           /* physical data address */
-    uint32_t cmd_dep;            /* command-dependent field */
-    uint16_t res_count;          /* residual count after completion */
-    uint16_t xfer_status;        /* transfer status */
-} dbdma_cmd;
-
-/* DBDMA command values in command field */
-
-#define COMMAND_MASK    0xf000
-#define OUTPUT_MORE     0x0000        /* transfer memory data to stream */
-#define OUTPUT_LAST     0x1000        /* ditto followed by end marker */
-#define INPUT_MORE      0x2000        /* transfer stream data to memory */
-#define INPUT_LAST      0x3000        /* ditto, expect end marker */
-#define STORE_WORD      0x4000        /* write word (4 bytes) to device reg */
-#define LOAD_WORD       0x5000        /* read word (4 bytes) from device reg */
-#define DBDMA_NOP       0x6000        /* do nothing */
-#define DBDMA_STOP      0x7000        /* suspend processing */
-
-/* Key values in command field */
-
-#define KEY_MASK        0x0700
-#define KEY_STREAM0     0x0000        /* usual data stream */
-#define KEY_STREAM1     0x0100        /* control/status stream */
-#define KEY_STREAM2     0x0200        /* device-dependent stream */
-#define KEY_STREAM3     0x0300        /* device-dependent stream */
-#define KEY_STREAM4     0x0400        /* reserved */
-#define KEY_REGS        0x0500        /* device register space */
-#define KEY_SYSTEM      0x0600        /* system memory-mapped space */
-#define KEY_DEVICE      0x0700        /* device memory-mapped space */
-
-/* Interrupt control values in command field */
-
-#define INTR_MASK       0x0030
-#define INTR_NEVER      0x0000        /* don't interrupt */
-#define INTR_IFSET      0x0010        /* intr if condition bit is 1 */
-#define INTR_IFCLR      0x0020        /* intr if condition bit is 0 */
-#define INTR_ALWAYS     0x0030        /* always interrupt */
-
-/* Branch control values in command field */
-
-#define BR_MASK         0x000c
-#define BR_NEVER        0x0000        /* don't branch */
-#define BR_IFSET        0x0004        /* branch if condition bit is 1 */
-#define BR_IFCLR        0x0008        /* branch if condition bit is 0 */
-#define BR_ALWAYS       0x000c        /* always branch */
-
-/* Wait control values in command field */
-
-#define WAIT_MASK       0x0003
-#define WAIT_NEVER      0x0000        /* don't wait */
-#define WAIT_IFSET      0x0001        /* wait if condition bit is 1 */
-#define WAIT_IFCLR      0x0002        /* wait if condition bit is 0 */
-#define WAIT_ALWAYS     0x0003        /* always wait */
-
-typedef struct DBDMA_channel {
-    int channel;
-    uint32_t regs[DBDMA_REGS];
-    qemu_irq irq;
-    DBDMA_io io;
-    DBDMA_rw rw;
-    DBDMA_flush flush;
-    dbdma_cmd current;
-    int processing;
-} DBDMA_channel;
-
-typedef struct {
-    MemoryRegion mem;
-    DBDMA_channel channels[DBDMA_CHANNELS];
-} DBDMAState;
-
 #ifdef DEBUG_DBDMA
 static void dump_dbdma_cmd(dbdma_cmd *cmd)
 {
diff --git a/include/hw/ppc/mac_dbdma.h b/include/hw/ppc/mac_dbdma.h
index 691263e..90be5d9 100644
--- a/include/hw/ppc/mac_dbdma.h
+++ b/include/hw/ppc/mac_dbdma.h
@@ -39,6 +39,124 @@ struct DBDMA_io {
     DBDMA_end dma_end;
 };
 
+/*
+ * DBDMA control/status registers.  All little-endian.
+ */
+
+#define DBDMA_CONTROL         0x00
+#define DBDMA_STATUS          0x01
+#define DBDMA_CMDPTR_HI       0x02
+#define DBDMA_CMDPTR_LO       0x03
+#define DBDMA_INTR_SEL        0x04
+#define DBDMA_BRANCH_SEL      0x05
+#define DBDMA_WAIT_SEL        0x06
+#define DBDMA_XFER_MODE       0x07
+#define DBDMA_DATA2PTR_HI     0x08
+#define DBDMA_DATA2PTR_LO     0x09
+#define DBDMA_RES1            0x0A
+#define DBDMA_ADDRESS_HI      0x0B
+#define DBDMA_BRANCH_ADDR_HI  0x0C
+#define DBDMA_RES2            0x0D
+#define DBDMA_RES3            0x0E
+#define DBDMA_RES4            0x0F
+
+#define DBDMA_REGS            16
+#define DBDMA_SIZE            (DBDMA_REGS * sizeof(uint32_t))
+
+#define DBDMA_CHANNEL_SHIFT   7
+#define DBDMA_CHANNEL_SIZE    (1 << DBDMA_CHANNEL_SHIFT)
+
+#define DBDMA_CHANNELS        (0x1000 >> DBDMA_CHANNEL_SHIFT)
+
+/* Bits in control and status registers */
+
+#define RUN        0x8000
+#define PAUSE      0x4000
+#define FLUSH      0x2000
+#define WAKE       0x1000
+#define DEAD       0x0800
+#define ACTIVE     0x0400
+#define BT         0x0100
+#define DEVSTAT    0x00ff
+
+/*
+ * DBDMA command structure.  These fields are all little-endian!
+ */
+
+typedef struct dbdma_cmd {
+    uint16_t req_count;          /* requested byte transfer count */
+    uint16_t command;            /* command word (has bit-fields) */
+    uint32_t phy_addr;           /* physical data address */
+    uint32_t cmd_dep;            /* command-dependent field */
+    uint16_t res_count;          /* residual count after completion */
+    uint16_t xfer_status;        /* transfer status */
+} dbdma_cmd;
+
+/* DBDMA command values in command field */
+
+#define COMMAND_MASK    0xf000
+#define OUTPUT_MORE     0x0000        /* transfer memory data to stream */
+#define OUTPUT_LAST     0x1000        /* ditto followed by end marker */
+#define INPUT_MORE      0x2000        /* transfer stream data to memory */
+#define INPUT_LAST      0x3000        /* ditto, expect end marker */
+#define STORE_WORD      0x4000        /* write word (4 bytes) to device reg */
+#define LOAD_WORD       0x5000        /* read word (4 bytes) from device reg */
+#define DBDMA_NOP       0x6000        /* do nothing */
+#define DBDMA_STOP      0x7000        /* suspend processing */
+
+/* Key values in command field */
+
+#define KEY_MASK        0x0700
+#define KEY_STREAM0     0x0000        /* usual data stream */
+#define KEY_STREAM1     0x0100        /* control/status stream */
+#define KEY_STREAM2     0x0200        /* device-dependent stream */
+#define KEY_STREAM3     0x0300        /* device-dependent stream */
+#define KEY_STREAM4     0x0400        /* reserved */
+#define KEY_REGS        0x0500        /* device register space */
+#define KEY_SYSTEM      0x0600        /* system memory-mapped space */
+#define KEY_DEVICE      0x0700        /* device memory-mapped space */
+
+/* Interrupt control values in command field */
+
+#define INTR_MASK       0x0030
+#define INTR_NEVER      0x0000        /* don't interrupt */
+#define INTR_IFSET      0x0010        /* intr if condition bit is 1 */
+#define INTR_IFCLR      0x0020        /* intr if condition bit is 0 */
+#define INTR_ALWAYS     0x0030        /* always interrupt */
+
+/* Branch control values in command field */
+
+#define BR_MASK         0x000c
+#define BR_NEVER        0x0000        /* don't branch */
+#define BR_IFSET        0x0004        /* branch if condition bit is 1 */
+#define BR_IFCLR        0x0008        /* branch if condition bit is 0 */
+#define BR_ALWAYS       0x000c        /* always branch */
+
+/* Wait control values in command field */
+
+#define WAIT_MASK       0x0003
+#define WAIT_NEVER      0x0000        /* don't wait */
+#define WAIT_IFSET      0x0001        /* wait if condition bit is 1 */
+#define WAIT_IFCLR      0x0002        /* wait if condition bit is 0 */
+#define WAIT_ALWAYS     0x0003        /* always wait */
+
+typedef struct DBDMA_channel {
+    int channel;
+    uint32_t regs[DBDMA_REGS];
+    qemu_irq irq;
+    DBDMA_io io;
+    DBDMA_rw rw;
+    DBDMA_flush flush;
+    dbdma_cmd current;
+    int processing;
+} DBDMA_channel;
+
+typedef struct {
+    MemoryRegion mem;
+    DBDMA_channel channels[DBDMA_CHANNELS];
+} DBDMAState;
+
+/* Externally callable functions */
 
 void DBDMA_register_channel(void *dbdma, int nchan, qemu_irq irq,
                             DBDMA_rw rw, DBDMA_flush flush,
commit 7eaba824b6bc14ee724f8593891f2165d2faa4ab
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 01:53:51 2013 +0200

    PPC: dbdma: Allow new commands in RUN state
    
    The DBDMA controller can not change its command stream while it's
    actively streaming data, true. But the fact that it's in RUN state
    doesn't actually indicate anything. It could just as well be in
    WAIT while in RUN. And then it's legal to change commands.
    
    This fixes a real world issue I've encountered with Mac OS X.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index 3b1e97e..7656767 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -725,11 +725,11 @@ static void dbdma_write(void *opaque, hwaddr addr,
     DBDMA_DPRINTF("channel 0x%x reg 0x%x\n",
                   (uint32_t)addr >> DBDMA_CHANNEL_SHIFT, reg);
 
-    /* cmdptr cannot be modified if channel is RUN or ACTIVE */
+    /* cmdptr cannot be modified if channel is ACTIVE */
 
-    if (reg == DBDMA_CMDPTR_LO &&
-        (ch->regs[DBDMA_STATUS] & (RUN | ACTIVE)))
+    if (reg == DBDMA_CMDPTR_LO && (ch->regs[DBDMA_STATUS] & ACTIVE)) {
         return;
+    }
 
     ch->regs[reg] = value;
 
commit 58c0c311838dd2c6622a156b4d261aa127c510dd
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 01:53:05 2013 +0200

    PPC: dbdma: Fix debug print
    
    There was a debug print that didn't compile for me because the format
    and the arguments weren't in sync. Fix it up.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index 0d7f40b..3b1e97e 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -720,7 +720,8 @@ static void dbdma_write(void *opaque, hwaddr addr,
     DBDMA_channel *ch = &s->channels[channel];
     int reg = (addr - (channel << DBDMA_CHANNEL_SHIFT)) >> 2;
 
-    DBDMA_DPRINTF("writel 0x" TARGET_FMT_plx " <= 0x%08x\n", addr, value);
+    DBDMA_DPRINTF("writel 0x" TARGET_FMT_plx " <= 0x%08"PRIx64"\n",
+                  addr, value);
     DBDMA_DPRINTF("channel 0x%x reg 0x%x\n",
                   (uint32_t)addr >> DBDMA_CHANNEL_SHIFT, reg);
 
commit 33ce36bb33cc00ac3070d49e17b4afed62b412a8
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 01:23:45 2013 +0200

    PPC: Mac: Add debug prints in macio and dbdma code
    
    The macio code is basically undebuggable as it stands today, with no
    debug prints anywhere whatsoever. DBDMA was better, but I needed a
    few more to create reasonable logs that tell me where breakage is.
    
    Add a DPRINTF macro in the macio source file and add a bunch of debug
    prints that are all disabled by default of course.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 60b64ac..8d42b5c 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -30,6 +30,22 @@
 
 #include <hw/ide/internal.h>
 
+/* debug MACIO */
+// #define DEBUG_MACIO
+
+#ifdef DEBUG_MACIO
+static const int debug_macio = 1;
+#else
+static const int debug_macio = 0;
+#endif
+
+#define MACIO_DPRINTF(fmt, ...) do { \
+        if (debug_macio) { \
+            printf(fmt , ## __VA_ARGS__); \
+        } \
+    } while (0)
+
+
 /***********************************************************/
 /* MacIO based PowerPC IDE */
 
@@ -48,6 +64,8 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
         goto done;
     }
 
+    MACIO_DPRINTF("io_buffer_size = %#x\n", s->io_buffer_size);
+
     if (s->io_buffer_size > 0) {
         m->aiocb = NULL;
         qemu_sglist_destroy(&s->sg);
@@ -59,15 +77,20 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
         s->io_buffer_index &= 0x7ff;
     }
 
-    if (s->packet_transfer_size <= 0)
+    if (s->packet_transfer_size <= 0) {
+        MACIO_DPRINTF("end of transfer\n");
         ide_atapi_cmd_ok(s);
+    }
 
     if (io->len == 0) {
+        MACIO_DPRINTF("end of DMA\n");
         goto done;
     }
 
     /* launch next transfer */
 
+    MACIO_DPRINTF("io->len = %#x\n", io->len);
+
     s->io_buffer_size = io->len;
 
     qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
@@ -76,12 +99,17 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
     io->addr += io->len;
     io->len = 0;
 
+    MACIO_DPRINTF("sector_num=%d size=%d, cmd_cmd=%d\n",
+                  (s->lba << 2) + (s->io_buffer_index >> 9),
+                  s->packet_transfer_size, s->dma_cmd);
+
     m->aiocb = dma_bdrv_read(s->bs, &s->sg,
                              (int64_t)(s->lba << 2) + (s->io_buffer_index >> 9),
                              pmac_ide_atapi_transfer_cb, io);
     return;
 
 done:
+    MACIO_DPRINTF("done DMA\n");
     bdrv_acct_done(s->bs, &s->acct);
     io->dma_end(opaque);
 }
@@ -95,6 +123,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     int64_t sector_num;
 
     if (ret < 0) {
+        MACIO_DPRINTF("DMA error\n");
         m->aiocb = NULL;
         qemu_sglist_destroy(&s->sg);
         ide_dma_error(s);
@@ -102,6 +131,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     }
 
     sector_num = ide_get_sector(s);
+    MACIO_DPRINTF("io_buffer_size = %#x\n", s->io_buffer_size);
     if (s->io_buffer_size > 0) {
         m->aiocb = NULL;
         qemu_sglist_destroy(&s->sg);
@@ -111,14 +141,14 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
         s->nsector -= n;
     }
 
-    /* end of transfer ? */
     if (s->nsector == 0) {
+        MACIO_DPRINTF("end of transfer\n");
         s->status = READY_STAT | SEEK_STAT;
         ide_set_irq(s->bus);
     }
 
-    /* end of DMA ? */
     if (io->len == 0) {
+        MACIO_DPRINTF("end of DMA\n");
         goto done;
     }
 
@@ -127,12 +157,17 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     s->io_buffer_index = 0;
     s->io_buffer_size = io->len;
 
+    MACIO_DPRINTF("io->len = %#x\n", io->len);
+
     qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
                      &address_space_memory);
     qemu_sglist_add(&s->sg, io->addr, io->len);
     io->addr += io->len;
     io->len = 0;
 
+    MACIO_DPRINTF("sector_num=%" PRId64 " n=%d, nsector=%d, cmd_cmd=%d\n",
+                  sector_num, n, s->nsector, s->dma_cmd);
+
     switch (s->dma_cmd) {
     case IDE_DMA_READ:
         m->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
@@ -162,6 +197,8 @@ static void pmac_ide_transfer(DBDMA_io *io)
     MACIOIDEState *m = io->opaque;
     IDEState *s = idebus_active_if(&m->bus);
 
+    MACIO_DPRINTF("\n");
+
     s->io_buffer_size = 0;
     if (s->drive_kind == IDE_CD) {
         bdrv_acct_start(s->bs, &s->acct, io->len, BDRV_ACCT_READ);
diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index fc46727..0d7f40b 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -224,7 +224,7 @@ static void conditional_interrupt(DBDMA_channel *ch)
     uint32_t status;
     int cond;
 
-    DBDMA_DPRINTF("conditional_interrupt\n");
+    DBDMA_DPRINTF("%s\n", __func__);
 
     intr = le16_to_cpu(current->command) & INTR_MASK;
 
@@ -233,6 +233,7 @@ static void conditional_interrupt(DBDMA_channel *ch)
         return;
     case INTR_ALWAYS: /* always interrupt */
         qemu_irq_raise(ch->irq);
+        DBDMA_DPRINTF("%s: raise\n", __func__);
         return;
     }
 
@@ -245,12 +246,16 @@ static void conditional_interrupt(DBDMA_channel *ch)
 
     switch(intr) {
     case INTR_IFSET:  /* intr if condition bit is 1 */
-        if (cond)
+        if (cond) {
             qemu_irq_raise(ch->irq);
+            DBDMA_DPRINTF("%s: raise\n", __func__);
+        }
         return;
     case INTR_IFCLR:  /* intr if condition bit is 0 */
-        if (!cond)
+        if (!cond) {
             qemu_irq_raise(ch->irq);
+            DBDMA_DPRINTF("%s: raise\n", __func__);
+        }
         return;
     }
 }
@@ -368,6 +373,8 @@ static void dbdma_end(DBDMA_io *io)
     DBDMA_channel *ch = io->channel;
     dbdma_cmd *current = &ch->current;
 
+    DBDMA_DPRINTF("%s\n", __func__);
+
     if (conditional_wait(ch))
         goto wait;
 
@@ -422,6 +429,7 @@ static void start_input(DBDMA_channel *ch, int key, uint32_t addr,
      * are not implemented in the mac-io chip
      */
 
+    DBDMA_DPRINTF("addr 0x%x key 0x%x\n", addr, key);
     if (!addr || key > KEY_STREAM3) {
         kill_channel(ch);
         return;
commit 9e232428784641b8e48a237a4cb2ffe84450d15c
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 01:45:22 2013 +0200

    PPC: dbdma: Replace tabs with spaces
    
    s/^I/        /g on the file with a few manual tweaks to align things.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index a1d7862..fc46727 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -85,75 +85,75 @@
 
 /* Bits in control and status registers */
 
-#define RUN	0x8000
-#define PAUSE	0x4000
-#define FLUSH	0x2000
-#define WAKE	0x1000
-#define DEAD	0x0800
-#define ACTIVE	0x0400
-#define BT	0x0100
-#define DEVSTAT	0x00ff
+#define RUN        0x8000
+#define PAUSE      0x4000
+#define FLUSH      0x2000
+#define WAKE       0x1000
+#define DEAD       0x0800
+#define ACTIVE     0x0400
+#define BT         0x0100
+#define DEVSTAT    0x00ff
 
 /*
  * DBDMA command structure.  These fields are all little-endian!
  */
 
 typedef struct dbdma_cmd {
-    uint16_t req_count;	  /* requested byte transfer count */
-    uint16_t command;	  /* command word (has bit-fields) */
-    uint32_t phy_addr;	  /* physical data address */
-    uint32_t cmd_dep;	  /* command-dependent field */
-    uint16_t res_count;	  /* residual count after completion */
-    uint16_t xfer_status; /* transfer status */
+    uint16_t req_count;          /* requested byte transfer count */
+    uint16_t command;            /* command word (has bit-fields) */
+    uint32_t phy_addr;           /* physical data address */
+    uint32_t cmd_dep;            /* command-dependent field */
+    uint16_t res_count;          /* residual count after completion */
+    uint16_t xfer_status;        /* transfer status */
 } dbdma_cmd;
 
 /* DBDMA command values in command field */
 
 #define COMMAND_MASK    0xf000
-#define OUTPUT_MORE	0x0000	/* transfer memory data to stream */
-#define OUTPUT_LAST	0x1000	/* ditto followed by end marker */
-#define INPUT_MORE	0x2000	/* transfer stream data to memory */
-#define INPUT_LAST	0x3000	/* ditto, expect end marker */
-#define STORE_WORD	0x4000	/* write word (4 bytes) to device reg */
-#define LOAD_WORD	0x5000	/* read word (4 bytes) from device reg */
-#define DBDMA_NOP	0x6000	/* do nothing */
-#define DBDMA_STOP	0x7000	/* suspend processing */
+#define OUTPUT_MORE     0x0000        /* transfer memory data to stream */
+#define OUTPUT_LAST     0x1000        /* ditto followed by end marker */
+#define INPUT_MORE      0x2000        /* transfer stream data to memory */
+#define INPUT_LAST      0x3000        /* ditto, expect end marker */
+#define STORE_WORD      0x4000        /* write word (4 bytes) to device reg */
+#define LOAD_WORD       0x5000        /* read word (4 bytes) from device reg */
+#define DBDMA_NOP       0x6000        /* do nothing */
+#define DBDMA_STOP      0x7000        /* suspend processing */
 
 /* Key values in command field */
 
 #define KEY_MASK        0x0700
-#define KEY_STREAM0	0x0000	/* usual data stream */
-#define KEY_STREAM1	0x0100	/* control/status stream */
-#define KEY_STREAM2	0x0200	/* device-dependent stream */
-#define KEY_STREAM3	0x0300	/* device-dependent stream */
-#define KEY_STREAM4	0x0400	/* reserved */
-#define KEY_REGS	0x0500	/* device register space */
-#define KEY_SYSTEM	0x0600	/* system memory-mapped space */
-#define KEY_DEVICE	0x0700	/* device memory-mapped space */
+#define KEY_STREAM0     0x0000        /* usual data stream */
+#define KEY_STREAM1     0x0100        /* control/status stream */
+#define KEY_STREAM2     0x0200        /* device-dependent stream */
+#define KEY_STREAM3     0x0300        /* device-dependent stream */
+#define KEY_STREAM4     0x0400        /* reserved */
+#define KEY_REGS        0x0500        /* device register space */
+#define KEY_SYSTEM      0x0600        /* system memory-mapped space */
+#define KEY_DEVICE      0x0700        /* device memory-mapped space */
 
 /* Interrupt control values in command field */
 
 #define INTR_MASK       0x0030
-#define INTR_NEVER	0x0000	/* don't interrupt */
-#define INTR_IFSET	0x0010	/* intr if condition bit is 1 */
-#define INTR_IFCLR	0x0020	/* intr if condition bit is 0 */
-#define INTR_ALWAYS	0x0030	/* always interrupt */
+#define INTR_NEVER      0x0000        /* don't interrupt */
+#define INTR_IFSET      0x0010        /* intr if condition bit is 1 */
+#define INTR_IFCLR      0x0020        /* intr if condition bit is 0 */
+#define INTR_ALWAYS     0x0030        /* always interrupt */
 
 /* Branch control values in command field */
 
 #define BR_MASK         0x000c
-#define BR_NEVER	0x0000	/* don't branch */
-#define BR_IFSET	0x0004	/* branch if condition bit is 1 */
-#define BR_IFCLR	0x0008	/* branch if condition bit is 0 */
-#define BR_ALWAYS	0x000c	/* always branch */
+#define BR_NEVER        0x0000        /* don't branch */
+#define BR_IFSET        0x0004        /* branch if condition bit is 1 */
+#define BR_IFCLR        0x0008        /* branch if condition bit is 0 */
+#define BR_ALWAYS       0x000c        /* always branch */
 
 /* Wait control values in command field */
 
 #define WAIT_MASK       0x0003
-#define WAIT_NEVER	0x0000	/* don't wait */
-#define WAIT_IFSET	0x0001	/* wait if condition bit is 1 */
-#define WAIT_IFCLR	0x0002	/* wait if condition bit is 0 */
-#define WAIT_ALWAYS	0x0003	/* always wait */
+#define WAIT_NEVER      0x0000        /* don't wait */
+#define WAIT_IFSET      0x0001        /* wait if condition bit is 1 */
+#define WAIT_IFCLR      0x0002        /* wait if condition bit is 0 */
+#define WAIT_ALWAYS     0x0003        /* always wait */
 
 typedef struct DBDMA_channel {
     int channel;
@@ -558,11 +558,11 @@ static void channel_run(DBDMA_channel *ch)
     switch (cmd) {
     case DBDMA_NOP:
         nop(ch);
-	return;
+        return;
 
     case DBDMA_STOP:
         stop(ch);
-	return;
+        return;
     }
 
     key = le16_to_cpu(current->command) & 0x0700;
@@ -578,19 +578,19 @@ static void channel_run(DBDMA_channel *ch)
     switch (cmd) {
     case OUTPUT_MORE:
         start_output(ch, key, phy_addr, req_count, 0);
-	return;
+        return;
 
     case OUTPUT_LAST:
         start_output(ch, key, phy_addr, req_count, 1);
-	return;
+        return;
 
     case INPUT_MORE:
         start_input(ch, key, phy_addr, req_count, 0);
-	return;
+        return;
 
     case INPUT_LAST:
         start_input(ch, key, phy_addr, req_count, 1);
-	return;
+        return;
     }
 
     if (key < KEY_REGS) {
@@ -615,11 +615,11 @@ static void channel_run(DBDMA_channel *ch)
     switch (cmd) {
     case LOAD_WORD:
         load_word(ch, key, phy_addr, req_count);
-	return;
+        return;
 
     case STORE_WORD:
         store_word(ch, key, phy_addr, req_count);
-	return;
+        return;
     }
 }
 
@@ -720,7 +720,7 @@ static void dbdma_write(void *opaque, hwaddr addr,
 
     if (reg == DBDMA_CMDPTR_LO &&
         (ch->regs[DBDMA_STATUS] & (RUN | ACTIVE)))
-	return;
+        return;
 
     ch->regs[reg] = value;
 
commit 8aef291fb876670b264297ab333f5072cddbf625
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 30 01:43:17 2013 +0200

    PPC: Macio: Replace tabs with spaces
    
    s/^I/        /g on the file.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 0b05a74..60b64ac 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -55,7 +55,7 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
         s->packet_transfer_size -= s->io_buffer_size;
 
         s->io_buffer_index += s->io_buffer_size;
-	s->lba += s->io_buffer_index >> 11;
+        s->lba += s->io_buffer_index >> 11;
         s->io_buffer_index &= 0x7ff;
     }
 
@@ -97,7 +97,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     if (ret < 0) {
         m->aiocb = NULL;
         qemu_sglist_destroy(&s->sg);
-	ide_dma_error(s);
+        ide_dma_error(s);
         goto done;
     }
 
@@ -136,11 +136,11 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     switch (s->dma_cmd) {
     case IDE_DMA_READ:
         m->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
-		                 pmac_ide_transfer_cb, io);
+                                 pmac_ide_transfer_cb, io);
         break;
     case IDE_DMA_WRITE:
         m->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num,
-		                  pmac_ide_transfer_cb, io);
+                                  pmac_ide_transfer_cb, io);
         break;
     case IDE_DMA_TRIM:
         m->aiocb = dma_bdrv_io(s->bs, &s->sg, sector_num,
commit 14eefd0ec3b4720faddf4cc7682d7ac8c82a3a45
Author: Alexander Graf <agraf at suse.de>
Date:   Mon Jun 24 21:40:50 2013 +0200

    PPC: g3beige: Move secondary IDE bus to mac-io
    
    On a real G3 Beige the secondary IDE bus lives on the mac-io chip, not
    on some random PCI device. Move it there to become more compatible.
    
    While at it, also clean up the IDE channel connection logic.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 4798202..0b05a74 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -363,7 +363,7 @@ static void macio_ide_register_types(void)
     type_register_static(&macio_ide_type_info);
 }
 
-/* hd_table must contain 4 block drivers */
+/* hd_table must contain 2 block drivers */
 void macio_ide_init_drives(MACIOIDEState *s, DriveInfo **hd_table)
 {
     int i;
diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index 76a1cfb..6459bc1 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -52,10 +52,10 @@ typedef struct OldWorldMacIOState {
     MacIOState parent_obj;
     /*< public >*/
 
-    qemu_irq irqs[3];
+    qemu_irq irqs[5];
 
     MacIONVRAMState nvram;
-    MACIOIDEState ide;
+    MACIOIDEState ide[2];
 } OldWorldMacIOState;
 
 #define NEWWORLD_MACIO(obj) \
@@ -147,18 +147,32 @@ static int macio_common_initfn(PCIDevice *d)
     return 0;
 }
 
+static int macio_initfn_ide(MacIOState *s, MACIOIDEState *ide, qemu_irq irq0,
+                            qemu_irq irq1, int dmaid)
+{
+    SysBusDevice *sysbus_dev;
+
+    sysbus_dev = SYS_BUS_DEVICE(ide);
+    sysbus_connect_irq(sysbus_dev, 0, irq0);
+    sysbus_connect_irq(sysbus_dev, 1, irq1);
+    macio_ide_register_dma(ide, s->dbdma, dmaid);
+    return qdev_init(DEVICE(ide));
+}
+
 static int macio_oldworld_initfn(PCIDevice *d)
 {
     MacIOState *s = MACIO(d);
     OldWorldMacIOState *os = OLDWORLD_MACIO(d);
     SysBusDevice *sysbus_dev;
+    int i;
+    int cur_irq = 0;
     int ret = macio_common_initfn(d);
     if (ret < 0) {
         return ret;
     }
 
     sysbus_dev = SYS_BUS_DEVICE(&s->cuda);
-    sysbus_connect_irq(sysbus_dev, 0, os->irqs[0]);
+    sysbus_connect_irq(sysbus_dev, 0, os->irqs[cur_irq++]);
 
     ret = qdev_init(DEVICE(&os->nvram));
     if (ret < 0) {
@@ -174,23 +188,39 @@ static int macio_oldworld_initfn(PCIDevice *d)
         memory_region_add_subregion(&s->bar, 0x00000, s->pic_mem);
     }
 
-    sysbus_dev = SYS_BUS_DEVICE(&os->ide);
-    sysbus_connect_irq(sysbus_dev, 0, os->irqs[1]);
-    sysbus_connect_irq(sysbus_dev, 1, os->irqs[2]);
-    macio_ide_register_dma(&os->ide, s->dbdma, 0x16);
-    ret = qdev_init(DEVICE(&os->ide));
-    if (ret < 0) {
-        return ret;
+    /* IDE buses */
+    for (i = 0; i < ARRAY_SIZE(os->ide); i++) {
+        qemu_irq irq0 = os->irqs[cur_irq++];
+        qemu_irq irq1 = os->irqs[cur_irq++];
+
+        ret = macio_initfn_ide(s, &os->ide[i], irq0, irq1, 0x16 + (i * 4));
+        if (ret < 0) {
+            return ret;
+        }
     }
 
     return 0;
 }
 
+static void macio_init_ide(MacIOState *s, MACIOIDEState *ide, int index)
+{
+    gchar *name;
+
+    object_initialize(ide, TYPE_MACIO_IDE);
+    qdev_set_parent_bus(DEVICE(ide), sysbus_get_default());
+    memory_region_add_subregion(&s->bar, 0x1f000 + ((index + 1) * 0x1000),
+                                &ide->mem);
+    name = g_strdup_printf("ide[%i]", index);
+    object_property_add_child(OBJECT(s), name, OBJECT(ide), NULL);
+    g_free(name);
+}
+
 static void macio_oldworld_init(Object *obj)
 {
     MacIOState *s = MACIO(obj);
     OldWorldMacIOState *os = OLDWORLD_MACIO(obj);
     DeviceState *dev;
+    int i;
 
     qdev_init_gpio_out(DEVICE(obj), os->irqs, ARRAY_SIZE(os->irqs));
 
@@ -199,10 +229,9 @@ static void macio_oldworld_init(Object *obj)
     qdev_prop_set_uint32(dev, "size", 0x2000);
     qdev_prop_set_uint32(dev, "it_shift", 4);
 
-    object_initialize(&os->ide, TYPE_MACIO_IDE);
-    qdev_set_parent_bus(DEVICE(&os->ide), sysbus_get_default());
-    memory_region_add_subregion(&s->bar, 0x1f000 + (1 * 0x1000), &os->ide.mem);
-    object_property_add_child(obj, "ide", OBJECT(&os->ide), NULL);
+    for (i = 0; i < 2; i++) {
+        macio_init_ide(s, &os->ide[i], i);
+    }
 }
 
 static int macio_newworld_initfn(PCIDevice *d)
@@ -210,35 +239,30 @@ static int macio_newworld_initfn(PCIDevice *d)
     MacIOState *s = MACIO(d);
     NewWorldMacIOState *ns = NEWWORLD_MACIO(d);
     SysBusDevice *sysbus_dev;
+    int i;
+    int cur_irq = 0;
     int ret = macio_common_initfn(d);
     if (ret < 0) {
         return ret;
     }
 
     sysbus_dev = SYS_BUS_DEVICE(&s->cuda);
-    sysbus_connect_irq(sysbus_dev, 0, ns->irqs[0]);
+    sysbus_connect_irq(sysbus_dev, 0, ns->irqs[cur_irq++]);
 
     if (s->pic_mem) {
         /* OpenPIC */
         memory_region_add_subregion(&s->bar, 0x40000, s->pic_mem);
     }
 
-    sysbus_dev = SYS_BUS_DEVICE(&ns->ide[0]);
-    sysbus_connect_irq(sysbus_dev, 0, ns->irqs[1]);
-    sysbus_connect_irq(sysbus_dev, 1, ns->irqs[2]);
-    macio_ide_register_dma(&ns->ide[0], s->dbdma, 0x16);
-    ret = qdev_init(DEVICE(&ns->ide[0]));
-    if (ret < 0) {
-        return ret;
-    }
+    /* IDE buses */
+    for (i = 0; i < ARRAY_SIZE(ns->ide); i++) {
+        qemu_irq irq0 = ns->irqs[cur_irq++];
+        qemu_irq irq1 = ns->irqs[cur_irq++];
 
-    sysbus_dev = SYS_BUS_DEVICE(&ns->ide[1]);
-    sysbus_connect_irq(sysbus_dev, 0, ns->irqs[3]);
-    sysbus_connect_irq(sysbus_dev, 1, ns->irqs[4]);
-    macio_ide_register_dma(&ns->ide[1], s->dbdma, 0x1a);
-    ret = qdev_init(DEVICE(&ns->ide[1]));
-    if (ret < 0) {
-        return ret;
+        ret = macio_initfn_ide(s, &ns->ide[i], irq0, irq1, 0x16 + (i * 4));
+        if (ret < 0) {
+            return ret;
+        }
     }
 
     return 0;
@@ -249,18 +273,11 @@ static void macio_newworld_init(Object *obj)
     MacIOState *s = MACIO(obj);
     NewWorldMacIOState *ns = NEWWORLD_MACIO(obj);
     int i;
-    gchar *name;
 
     qdev_init_gpio_out(DEVICE(obj), ns->irqs, ARRAY_SIZE(ns->irqs));
 
     for (i = 0; i < 2; i++) {
-        object_initialize(&ns->ide[i], TYPE_MACIO_IDE);
-        qdev_set_parent_bus(DEVICE(&ns->ide[i]), sysbus_get_default());
-        memory_region_add_subregion(&s->bar, 0x1f000 + ((i + 1) * 0x1000),
-                                    &ns->ide[i].mem);
-        name = g_strdup_printf("ide[%i]", i);
-        object_property_add_child(obj, name, OBJECT(&ns->ide[i]), NULL);
-        g_free(name);
+        macio_init_ide(s, &ns->ide[i], i);
     }
 }
 
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index b607471..8b8c6b9 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -268,20 +268,19 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
     macio = pci_create(pci_bus, -1, TYPE_OLDWORLD_MACIO);
     dev = DEVICE(macio);
     qdev_connect_gpio_out(dev, 0, pic[0x12]); /* CUDA */
-    qdev_connect_gpio_out(dev, 1, pic[0x0D]); /* IDE */
-    qdev_connect_gpio_out(dev, 2, pic[0x02]); /* IDE DMA */
+    qdev_connect_gpio_out(dev, 1, pic[0x0D]); /* IDE-0 */
+    qdev_connect_gpio_out(dev, 2, pic[0x02]); /* IDE-0 DMA */
+    qdev_connect_gpio_out(dev, 3, pic[0x0E]); /* IDE-1 */
+    qdev_connect_gpio_out(dev, 4, pic[0x03]); /* IDE-1 DMA */
     macio_init(macio, pic_mem, escc_bar);
 
-    /* First IDE channel is a MAC IDE on the MacIO bus */
     macio_ide = MACIO_IDE(object_resolve_path_component(OBJECT(macio),
-                                                        "ide"));
+                                                        "ide[0]"));
     macio_ide_init_drives(macio_ide, hd);
 
-    /* Second IDE channel is a CMD646 on the PCI bus */
-    hd[0] = hd[MAX_IDE_DEVS];
-    hd[1] = hd[MAX_IDE_DEVS + 1];
-    hd[3] = hd[2] = NULL;
-    pci_cmd646_ide_init(pci_bus, hd, 0);
+    macio_ide = MACIO_IDE(object_resolve_path_component(OBJECT(macio),
+                                                        "ide[1]"));
+    macio_ide_init_drives(macio_ide, &hd[MAX_IDE_DEVS]);
 
     dev = DEVICE(object_resolve_path_component(OBJECT(macio), "cuda"));
     adb_bus = qdev_get_child_bus(dev, "adb.0");
commit 536d8cda4adef3d202a800688ed5f63dae1f0f88
Author: Alexander Graf <agraf at suse.de>
Date:   Sat Jun 29 17:34:58 2013 +0200

    PPC: Mac: Fix guest exported tbfreq values
    
    We can tell the guest the frequency of its time base through fwcfg.
    
    However, we tell it a different value from the speed tb actually runs
    at. Let's fix it and make the tbfreq initialization and the fwcfg exposure
    use the same values.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 77a8c2e..fe80348 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -71,6 +71,7 @@
 
 #define MAX_IDE_BUS 2
 #define CFG_ADDR 0xf0000510
+#define TBFREQ (100UL * 1000UL * 1000UL)
 
 /* debug UniNorth */
 //#define DEBUG_UNIN
@@ -191,7 +192,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
         env = &cpu->env;
 
         /* Set time-base frequency to 100 Mhz */
-        cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
+        cpu_ppc_tb_init(env, TBFREQ);
         qemu_register_reset(ppc_core99_reset, cpu);
     }
 
@@ -460,7 +461,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_KVM_PID, getpid());
 #endif
     } else {
-        fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, get_ticks_per_sec());
+        fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, TBFREQ);
     }
     /* Mac OS X requires a "known good" clock-frequency value; pass it one. */
     fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_CLOCKFREQ, 266000000);
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 4663ed2..b607471 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -45,6 +45,7 @@
 
 #define MAX_IDE_BUS 2
 #define CFG_ADDR 0xf0000510
+#define TBFREQ 16600000UL
 
 static int fw_cfg_boot_set(void *opaque, const char *boot_device)
 {
@@ -114,7 +115,7 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
         env = &cpu->env;
 
         /* Set time-base frequency to 16.6 Mhz */
-        cpu_ppc_tb_init(env,  16600000UL);
+        cpu_ppc_tb_init(env,  TBFREQ);
         qemu_register_reset(ppc_heathrow_reset, cpu);
     }
 
@@ -331,7 +332,7 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_KVM_PID, getpid());
 #endif
     } else {
-        fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, get_ticks_per_sec());
+        fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, TBFREQ);
     }
     /* Mac OS X requires a "known good" clock-frequency value; pass it one. */
     fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_CLOCKFREQ, 266000000);
commit 8d43ea1c97d0d611f9cf868fe78b17f2a1031298
Author: Prerna Saxena <prerna at linux.vnet.ibm.com>
Date:   Thu Jul 4 12:12:32 2013 +0530

    target-ppc: Add POWER8 v1.0 CPU model
    
    This patch adds CPU PVR definition for POWER8,
    and enables QEMU to launch guests on POWER8 hardware.
    
    Signed-off-by: Prerna Saxena <prerna at linux.vnet.ibm.com>
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Reviewed-by: Paul Mackerras <paulus at samba.org>
    Reviewed-by: Andreas Farber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/cpu-models.c b/target-ppc/cpu-models.c
index 13dd670..9578ed8 100644
--- a/target-ppc/cpu-models.c
+++ b/target-ppc/cpu-models.c
@@ -1143,6 +1143,8 @@
                 "POWER7 v2.1")
     POWERPC_DEF("POWER7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
+    POWERPC_DEF("POWER8_v1.0",   CPU_POWERPC_POWER8_v10,             POWER8,
+                "POWER8 v1.0")
     POWERPC_DEF("970",           CPU_POWERPC_970,                    970,
                 "PowerPC 970")
     POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970FX,
@@ -1388,6 +1390,7 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "Dino",  "POWER3" },
     { "POWER3+", "631" },
     { "POWER7", "POWER7_v2.3" },
+    { "POWER8", "POWER8_v1.0" },
     { "970fx", "970fx_v3.1" },
     { "970mp", "970mp_v1.1" },
     { "Apache", "RS64" },
diff --git a/target-ppc/cpu-models.h b/target-ppc/cpu-models.h
index fcd3a15..01e488f 100644
--- a/target-ppc/cpu-models.h
+++ b/target-ppc/cpu-models.h
@@ -556,6 +556,7 @@ enum {
     CPU_POWERPC_POWER7_v20         = 0x003F0200,
     CPU_POWERPC_POWER7_v21         = 0x003F0201,
     CPU_POWERPC_POWER7_v23         = 0x003F0203,
+    CPU_POWERPC_POWER8_v10         = 0x004B0100,
     CPU_POWERPC_970                = 0x00390202,
     CPU_POWERPC_970FX_v10          = 0x00391100,
     CPU_POWERPC_970FX_v20          = 0x003C0200,
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 76483d9..79bfcd8 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7136,6 +7136,40 @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
     pcc->l1_dcache_size = 0x8000;
     pcc->l1_icache_size = 0x8000;
 }
+
+POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+
+    dc->desc = "POWER8";
+    pcc->init_proc = init_proc_POWER7;
+    pcc->check_pow = check_pow_nocheck;
+    pcc->insns_flags = PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |
+                       PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+                       PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
+                       PPC_FLOAT_STFIWX |
+                       PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |
+                       PPC_MEM_SYNC | PPC_MEM_EIEIO |
+                       PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
+                       PPC_64B | PPC_ALTIVEC |
+                       PPC_SEGMENT_64B | PPC_SLBI |
+                       PPC_POPCNTB | PPC_POPCNTWD;
+    pcc->insns_flags2 = PPC2_VSX | PPC2_DFP | PPC2_DBRX;
+    pcc->msr_mask = 0x800000000204FF36ULL;
+    pcc->mmu_model = POWERPC_MMU_2_06;
+#if defined(CONFIG_SOFTMMU)
+    pcc->handle_mmu_fault = ppc_hash64_handle_mmu_fault;
+#endif
+    pcc->excp_model = POWERPC_EXCP_POWER7;
+    pcc->bus_model = PPC_FLAGS_INPUT_POWER7;
+    pcc->bfd_mach = bfd_mach_ppc64;
+    pcc->flags = POWERPC_FLAG_VRE | POWERPC_FLAG_SE |
+                 POWERPC_FLAG_BE | POWERPC_FLAG_PMM |
+                 POWERPC_FLAG_BUS_CLK | POWERPC_FLAG_CFAR;
+    pcc->l1_dcache_size = 0x8000;
+    pcc->l1_icache_size = 0x8000;
+}
 #endif /* defined (TARGET_PPC64) */
 
 
commit 42e5b4c9884c2c69825d6b6c6ddfbf25290856db
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Sat Jul 6 23:53:58 2013 +1000

    pseries: move interrupt controllers to hw/intc/
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/default-configs/ppc64-softmmu.mak b/default-configs/ppc64-softmmu.mak
index 5a72b5f..6d1933b 100644
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -45,5 +45,7 @@ CONFIG_OPENPIC=y
 CONFIG_PSERIES=y
 CONFIG_E500=y
 CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
+# For pSeries
+CONFIG_XICS=$(CONFIG_PSERIES)
 # For PReP
 CONFIG_MC146818RTC=y
diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index 86f9d5b..2851eed 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -22,3 +22,4 @@ obj-$(CONFIG_IOAPIC) += ioapic.o
 obj-$(CONFIG_OMAP) += omap_intc.o
 obj-$(CONFIG_OPENPIC_KVM) += openpic_kvm.o
 obj-$(CONFIG_SH4) += sh_intc.o
+obj-$(CONFIG_XICS) += xics.o
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
new file mode 100644
index 0000000..091912e
--- /dev/null
+++ b/hw/intc/xics.c
@@ -0,0 +1,587 @@
+/*
+ * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
+ *
+ * PAPR Virtualized Interrupt System, aka ICS/ICP aka xics
+ *
+ * Copyright (c) 2010,2011 David Gibson, IBM Corporation.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ */
+
+#include "hw/hw.h"
+#include "trace.h"
+#include "hw/ppc/spapr.h"
+#include "hw/ppc/xics.h"
+
+/*
+ * ICP: Presentation layer
+ */
+
+struct icp_server_state {
+    uint32_t xirr;
+    uint8_t pending_priority;
+    uint8_t mfrr;
+    qemu_irq output;
+};
+
+#define XISR_MASK  0x00ffffff
+#define CPPR_MASK  0xff000000
+
+#define XISR(ss)   (((ss)->xirr) & XISR_MASK)
+#define CPPR(ss)   (((ss)->xirr) >> 24)
+
+struct ics_state;
+
+struct icp_state {
+    long nr_servers;
+    struct icp_server_state *ss;
+    struct ics_state *ics;
+};
+
+static void ics_reject(struct ics_state *ics, int nr);
+static void ics_resend(struct ics_state *ics);
+static void ics_eoi(struct ics_state *ics, int nr);
+
+static void icp_check_ipi(struct icp_state *icp, int server)
+{
+    struct icp_server_state *ss = icp->ss + server;
+
+    if (XISR(ss) && (ss->pending_priority <= ss->mfrr)) {
+        return;
+    }
+
+    trace_xics_icp_check_ipi(server, ss->mfrr);
+
+    if (XISR(ss)) {
+        ics_reject(icp->ics, XISR(ss));
+    }
+
+    ss->xirr = (ss->xirr & ~XISR_MASK) | XICS_IPI;
+    ss->pending_priority = ss->mfrr;
+    qemu_irq_raise(ss->output);
+}
+
+static void icp_resend(struct icp_state *icp, int server)
+{
+    struct icp_server_state *ss = icp->ss + server;
+
+    if (ss->mfrr < CPPR(ss)) {
+        icp_check_ipi(icp, server);
+    }
+    ics_resend(icp->ics);
+}
+
+static void icp_set_cppr(struct icp_state *icp, int server, uint8_t cppr)
+{
+    struct icp_server_state *ss = icp->ss + server;
+    uint8_t old_cppr;
+    uint32_t old_xisr;
+
+    old_cppr = CPPR(ss);
+    ss->xirr = (ss->xirr & ~CPPR_MASK) | (cppr << 24);
+
+    if (cppr < old_cppr) {
+        if (XISR(ss) && (cppr <= ss->pending_priority)) {
+            old_xisr = XISR(ss);
+            ss->xirr &= ~XISR_MASK; /* Clear XISR */
+            ss->pending_priority = 0xff;
+            qemu_irq_lower(ss->output);
+            ics_reject(icp->ics, old_xisr);
+        }
+    } else {
+        if (!XISR(ss)) {
+            icp_resend(icp, server);
+        }
+    }
+}
+
+static void icp_set_mfrr(struct icp_state *icp, int server, uint8_t mfrr)
+{
+    struct icp_server_state *ss = icp->ss + server;
+
+    ss->mfrr = mfrr;
+    if (mfrr < CPPR(ss)) {
+        icp_check_ipi(icp, server);
+    }
+}
+
+static uint32_t icp_accept(struct icp_server_state *ss)
+{
+    uint32_t xirr = ss->xirr;
+
+    qemu_irq_lower(ss->output);
+    ss->xirr = ss->pending_priority << 24;
+    ss->pending_priority = 0xff;
+
+    trace_xics_icp_accept(xirr, ss->xirr);
+
+    return xirr;
+}
+
+static void icp_eoi(struct icp_state *icp, int server, uint32_t xirr)
+{
+    struct icp_server_state *ss = icp->ss + server;
+
+    /* Send EOI -> ICS */
+    ss->xirr = (ss->xirr & ~CPPR_MASK) | (xirr & CPPR_MASK);
+    trace_xics_icp_eoi(server, xirr, ss->xirr);
+    ics_eoi(icp->ics, xirr & XISR_MASK);
+    if (!XISR(ss)) {
+        icp_resend(icp, server);
+    }
+}
+
+static void icp_irq(struct icp_state *icp, int server, int nr, uint8_t priority)
+{
+    struct icp_server_state *ss = icp->ss + server;
+
+    trace_xics_icp_irq(server, nr, priority);
+
+    if ((priority >= CPPR(ss))
+        || (XISR(ss) && (ss->pending_priority <= priority))) {
+        ics_reject(icp->ics, nr);
+    } else {
+        if (XISR(ss)) {
+            ics_reject(icp->ics, XISR(ss));
+        }
+        ss->xirr = (ss->xirr & ~XISR_MASK) | (nr & XISR_MASK);
+        ss->pending_priority = priority;
+        trace_xics_icp_raise(ss->xirr, ss->pending_priority);
+        qemu_irq_raise(ss->output);
+    }
+}
+
+/*
+ * ICS: Source layer
+ */
+
+struct ics_irq_state {
+    int server;
+    uint8_t priority;
+    uint8_t saved_priority;
+#define XICS_STATUS_ASSERTED           0x1
+#define XICS_STATUS_SENT               0x2
+#define XICS_STATUS_REJECTED           0x4
+#define XICS_STATUS_MASKED_PENDING     0x8
+    uint8_t status;
+};
+
+struct ics_state {
+    int nr_irqs;
+    int offset;
+    qemu_irq *qirqs;
+    bool *islsi;
+    struct ics_irq_state *irqs;
+    struct icp_state *icp;
+};
+
+static int ics_valid_irq(struct ics_state *ics, uint32_t nr)
+{
+    return (nr >= ics->offset)
+        && (nr < (ics->offset + ics->nr_irqs));
+}
+
+static void resend_msi(struct ics_state *ics, int srcno)
+{
+    struct ics_irq_state *irq = ics->irqs + srcno;
+
+    /* FIXME: filter by server#? */
+    if (irq->status & XICS_STATUS_REJECTED) {
+        irq->status &= ~XICS_STATUS_REJECTED;
+        if (irq->priority != 0xff) {
+            icp_irq(ics->icp, irq->server, srcno + ics->offset,
+                    irq->priority);
+        }
+    }
+}
+
+static void resend_lsi(struct ics_state *ics, int srcno)
+{
+    struct ics_irq_state *irq = ics->irqs + srcno;
+
+    if ((irq->priority != 0xff)
+        && (irq->status & XICS_STATUS_ASSERTED)
+        && !(irq->status & XICS_STATUS_SENT)) {
+        irq->status |= XICS_STATUS_SENT;
+        icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
+    }
+}
+
+static void set_irq_msi(struct ics_state *ics, int srcno, int val)
+{
+    struct ics_irq_state *irq = ics->irqs + srcno;
+
+    trace_xics_set_irq_msi(srcno, srcno + ics->offset);
+
+    if (val) {
+        if (irq->priority == 0xff) {
+            irq->status |= XICS_STATUS_MASKED_PENDING;
+            trace_xics_masked_pending();
+        } else  {
+            icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
+        }
+    }
+}
+
+static void set_irq_lsi(struct ics_state *ics, int srcno, int val)
+{
+    struct ics_irq_state *irq = ics->irqs + srcno;
+
+    trace_xics_set_irq_lsi(srcno, srcno + ics->offset);
+    if (val) {
+        irq->status |= XICS_STATUS_ASSERTED;
+    } else {
+        irq->status &= ~XICS_STATUS_ASSERTED;
+    }
+    resend_lsi(ics, srcno);
+}
+
+static void ics_set_irq(void *opaque, int srcno, int val)
+{
+    struct ics_state *ics = (struct ics_state *)opaque;
+
+    if (ics->islsi[srcno]) {
+        set_irq_lsi(ics, srcno, val);
+    } else {
+        set_irq_msi(ics, srcno, val);
+    }
+}
+
+static void write_xive_msi(struct ics_state *ics, int srcno)
+{
+    struct ics_irq_state *irq = ics->irqs + srcno;
+
+    if (!(irq->status & XICS_STATUS_MASKED_PENDING)
+        || (irq->priority == 0xff)) {
+        return;
+    }
+
+    irq->status &= ~XICS_STATUS_MASKED_PENDING;
+    icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
+}
+
+static void write_xive_lsi(struct ics_state *ics, int srcno)
+{
+    resend_lsi(ics, srcno);
+}
+
+static void ics_write_xive(struct ics_state *ics, int nr, int server,
+                           uint8_t priority, uint8_t saved_priority)
+{
+    int srcno = nr - ics->offset;
+    struct ics_irq_state *irq = ics->irqs + srcno;
+
+    irq->server = server;
+    irq->priority = priority;
+    irq->saved_priority = saved_priority;
+
+    trace_xics_ics_write_xive(nr, srcno, server, priority);
+
+    if (ics->islsi[srcno]) {
+        write_xive_lsi(ics, srcno);
+    } else {
+        write_xive_msi(ics, srcno);
+    }
+}
+
+static void ics_reject(struct ics_state *ics, int nr)
+{
+    struct ics_irq_state *irq = ics->irqs + nr - ics->offset;
+
+    trace_xics_ics_reject(nr, nr - ics->offset);
+    irq->status |= XICS_STATUS_REJECTED; /* Irrelevant but harmless for LSI */
+    irq->status &= ~XICS_STATUS_SENT; /* Irrelevant but harmless for MSI */
+}
+
+static void ics_resend(struct ics_state *ics)
+{
+    int i;
+
+    for (i = 0; i < ics->nr_irqs; i++) {
+        /* FIXME: filter by server#? */
+        if (ics->islsi[i]) {
+            resend_lsi(ics, i);
+        } else {
+            resend_msi(ics, i);
+        }
+    }
+}
+
+static void ics_eoi(struct ics_state *ics, int nr)
+{
+    int srcno = nr - ics->offset;
+    struct ics_irq_state *irq = ics->irqs + srcno;
+
+    trace_xics_ics_eoi(nr);
+
+    if (ics->islsi[srcno]) {
+        irq->status &= ~XICS_STATUS_SENT;
+    }
+}
+
+/*
+ * Exported functions
+ */
+
+qemu_irq xics_get_qirq(struct icp_state *icp, int irq)
+{
+    if (!ics_valid_irq(icp->ics, irq)) {
+        return NULL;
+    }
+
+    return icp->ics->qirqs[irq - icp->ics->offset];
+}
+
+void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi)
+{
+    assert(ics_valid_irq(icp->ics, irq));
+
+    icp->ics->islsi[irq - icp->ics->offset] = lsi;
+}
+
+static target_ulong h_cppr(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                           target_ulong opcode, target_ulong *args)
+{
+    CPUState *cs = CPU(cpu);
+    target_ulong cppr = args[0];
+
+    icp_set_cppr(spapr->icp, cs->cpu_index, cppr);
+    return H_SUCCESS;
+}
+
+static target_ulong h_ipi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                          target_ulong opcode, target_ulong *args)
+{
+    target_ulong server = args[0];
+    target_ulong mfrr = args[1];
+
+    if (server >= spapr->icp->nr_servers) {
+        return H_PARAMETER;
+    }
+
+    icp_set_mfrr(spapr->icp, server, mfrr);
+    return H_SUCCESS;
+}
+
+static target_ulong h_xirr(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                           target_ulong opcode, target_ulong *args)
+{
+    CPUState *cs = CPU(cpu);
+    uint32_t xirr = icp_accept(spapr->icp->ss + cs->cpu_index);
+
+    args[0] = xirr;
+    return H_SUCCESS;
+}
+
+static target_ulong h_eoi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                          target_ulong opcode, target_ulong *args)
+{
+    CPUState *cs = CPU(cpu);
+    target_ulong xirr = args[0];
+
+    icp_eoi(spapr->icp, cs->cpu_index, xirr);
+    return H_SUCCESS;
+}
+
+static void rtas_set_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                          uint32_t token,
+                          uint32_t nargs, target_ulong args,
+                          uint32_t nret, target_ulong rets)
+{
+    struct ics_state *ics = spapr->icp->ics;
+    uint32_t nr, server, priority;
+
+    if ((nargs != 3) || (nret != 1)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    nr = rtas_ld(args, 0);
+    server = rtas_ld(args, 1);
+    priority = rtas_ld(args, 2);
+
+    if (!ics_valid_irq(ics, nr) || (server >= ics->icp->nr_servers)
+        || (priority > 0xff)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    ics_write_xive(ics, nr, server, priority, priority);
+
+    rtas_st(rets, 0, 0); /* Success */
+}
+
+static void rtas_get_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                          uint32_t token,
+                          uint32_t nargs, target_ulong args,
+                          uint32_t nret, target_ulong rets)
+{
+    struct ics_state *ics = spapr->icp->ics;
+    uint32_t nr;
+
+    if ((nargs != 1) || (nret != 3)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    nr = rtas_ld(args, 0);
+
+    if (!ics_valid_irq(ics, nr)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    rtas_st(rets, 0, 0); /* Success */
+    rtas_st(rets, 1, ics->irqs[nr - ics->offset].server);
+    rtas_st(rets, 2, ics->irqs[nr - ics->offset].priority);
+}
+
+static void rtas_int_off(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                         uint32_t token,
+                         uint32_t nargs, target_ulong args,
+                         uint32_t nret, target_ulong rets)
+{
+    struct ics_state *ics = spapr->icp->ics;
+    uint32_t nr;
+
+    if ((nargs != 1) || (nret != 1)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    nr = rtas_ld(args, 0);
+
+    if (!ics_valid_irq(ics, nr)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    ics_write_xive(ics, nr, ics->irqs[nr - ics->offset].server, 0xff,
+                   ics->irqs[nr - ics->offset].priority);
+
+    rtas_st(rets, 0, 0); /* Success */
+}
+
+static void rtas_int_on(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                        uint32_t token,
+                        uint32_t nargs, target_ulong args,
+                        uint32_t nret, target_ulong rets)
+{
+    struct ics_state *ics = spapr->icp->ics;
+    uint32_t nr;
+
+    if ((nargs != 1) || (nret != 1)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    nr = rtas_ld(args, 0);
+
+    if (!ics_valid_irq(ics, nr)) {
+        rtas_st(rets, 0, -3);
+        return;
+    }
+
+    ics_write_xive(ics, nr, ics->irqs[nr - ics->offset].server,
+                   ics->irqs[nr - ics->offset].saved_priority,
+                   ics->irqs[nr - ics->offset].saved_priority);
+
+    rtas_st(rets, 0, 0); /* Success */
+}
+
+static void xics_reset(void *opaque)
+{
+    struct icp_state *icp = (struct icp_state *)opaque;
+    struct ics_state *ics = icp->ics;
+    int i;
+
+    for (i = 0; i < icp->nr_servers; i++) {
+        icp->ss[i].xirr = 0;
+        icp->ss[i].pending_priority = 0xff;
+        icp->ss[i].mfrr = 0xff;
+        /* Make all outputs are deasserted */
+        qemu_set_irq(icp->ss[i].output, 0);
+    }
+
+    memset(ics->irqs, 0, sizeof(struct ics_irq_state) * ics->nr_irqs);
+    for (i = 0; i < ics->nr_irqs; i++) {
+        ics->irqs[i].priority = 0xff;
+        ics->irqs[i].saved_priority = 0xff;
+    }
+}
+
+void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu)
+{
+    CPUState *cs = CPU(cpu);
+    CPUPPCState *env = &cpu->env;
+    struct icp_server_state *ss = &icp->ss[cs->cpu_index];
+
+    assert(cs->cpu_index < icp->nr_servers);
+
+    switch (PPC_INPUT(env)) {
+    case PPC_FLAGS_INPUT_POWER7:
+        ss->output = env->irq_inputs[POWER7_INPUT_INT];
+        break;
+
+    case PPC_FLAGS_INPUT_970:
+        ss->output = env->irq_inputs[PPC970_INPUT_INT];
+        break;
+
+    default:
+        fprintf(stderr, "XICS interrupt controller does not support this CPU "
+                "bus model\n");
+        abort();
+    }
+}
+
+struct icp_state *xics_system_init(int nr_servers, int nr_irqs)
+{
+    struct icp_state *icp;
+    struct ics_state *ics;
+
+    icp = g_malloc0(sizeof(*icp));
+    icp->nr_servers = nr_servers;
+    icp->ss = g_malloc0(icp->nr_servers*sizeof(struct icp_server_state));
+
+    ics = g_malloc0(sizeof(*ics));
+    ics->nr_irqs = nr_irqs;
+    ics->offset = XICS_IRQ_BASE;
+    ics->irqs = g_malloc0(nr_irqs * sizeof(struct ics_irq_state));
+    ics->islsi = g_malloc0(nr_irqs * sizeof(bool));
+
+    icp->ics = ics;
+    ics->icp = icp;
+
+    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, nr_irqs);
+
+    spapr_register_hypercall(H_CPPR, h_cppr);
+    spapr_register_hypercall(H_IPI, h_ipi);
+    spapr_register_hypercall(H_XIRR, h_xirr);
+    spapr_register_hypercall(H_EOI, h_eoi);
+
+    spapr_rtas_register("ibm,set-xive", rtas_set_xive);
+    spapr_rtas_register("ibm,get-xive", rtas_get_xive);
+    spapr_rtas_register("ibm,int-off", rtas_int_off);
+    spapr_rtas_register("ibm,int-on", rtas_int_on);
+
+    qemu_register_reset(xics_reset, icp);
+
+    return icp;
+}
diff --git a/hw/ppc/Makefile.objs b/hw/ppc/Makefile.objs
index be00d1d..7a1cd5d 100644
--- a/hw/ppc/Makefile.objs
+++ b/hw/ppc/Makefile.objs
@@ -1,7 +1,7 @@
 # shared objects
 obj-y += ppc.o ppc_booke.o
 # IBM pSeries (sPAPR)
-obj-$(CONFIG_PSERIES) += spapr.o xics.o spapr_vio.o spapr_events.o
+obj-$(CONFIG_PSERIES) += spapr.o spapr_vio.o spapr_events.o
 obj-$(CONFIG_PSERIES) += spapr_hcall.o spapr_iommu.o spapr_rtas.o
 obj-$(CONFIG_PSERIES) += spapr_pci.o
 # PowerPC 4xx boards
diff --git a/hw/ppc/xics.c b/hw/ppc/xics.c
deleted file mode 100644
index 091912e..0000000
--- a/hw/ppc/xics.c
+++ /dev/null
@@ -1,587 +0,0 @@
-/*
- * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
- *
- * PAPR Virtualized Interrupt System, aka ICS/ICP aka xics
- *
- * Copyright (c) 2010,2011 David Gibson, IBM Corporation.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- *
- */
-
-#include "hw/hw.h"
-#include "trace.h"
-#include "hw/ppc/spapr.h"
-#include "hw/ppc/xics.h"
-
-/*
- * ICP: Presentation layer
- */
-
-struct icp_server_state {
-    uint32_t xirr;
-    uint8_t pending_priority;
-    uint8_t mfrr;
-    qemu_irq output;
-};
-
-#define XISR_MASK  0x00ffffff
-#define CPPR_MASK  0xff000000
-
-#define XISR(ss)   (((ss)->xirr) & XISR_MASK)
-#define CPPR(ss)   (((ss)->xirr) >> 24)
-
-struct ics_state;
-
-struct icp_state {
-    long nr_servers;
-    struct icp_server_state *ss;
-    struct ics_state *ics;
-};
-
-static void ics_reject(struct ics_state *ics, int nr);
-static void ics_resend(struct ics_state *ics);
-static void ics_eoi(struct ics_state *ics, int nr);
-
-static void icp_check_ipi(struct icp_state *icp, int server)
-{
-    struct icp_server_state *ss = icp->ss + server;
-
-    if (XISR(ss) && (ss->pending_priority <= ss->mfrr)) {
-        return;
-    }
-
-    trace_xics_icp_check_ipi(server, ss->mfrr);
-
-    if (XISR(ss)) {
-        ics_reject(icp->ics, XISR(ss));
-    }
-
-    ss->xirr = (ss->xirr & ~XISR_MASK) | XICS_IPI;
-    ss->pending_priority = ss->mfrr;
-    qemu_irq_raise(ss->output);
-}
-
-static void icp_resend(struct icp_state *icp, int server)
-{
-    struct icp_server_state *ss = icp->ss + server;
-
-    if (ss->mfrr < CPPR(ss)) {
-        icp_check_ipi(icp, server);
-    }
-    ics_resend(icp->ics);
-}
-
-static void icp_set_cppr(struct icp_state *icp, int server, uint8_t cppr)
-{
-    struct icp_server_state *ss = icp->ss + server;
-    uint8_t old_cppr;
-    uint32_t old_xisr;
-
-    old_cppr = CPPR(ss);
-    ss->xirr = (ss->xirr & ~CPPR_MASK) | (cppr << 24);
-
-    if (cppr < old_cppr) {
-        if (XISR(ss) && (cppr <= ss->pending_priority)) {
-            old_xisr = XISR(ss);
-            ss->xirr &= ~XISR_MASK; /* Clear XISR */
-            ss->pending_priority = 0xff;
-            qemu_irq_lower(ss->output);
-            ics_reject(icp->ics, old_xisr);
-        }
-    } else {
-        if (!XISR(ss)) {
-            icp_resend(icp, server);
-        }
-    }
-}
-
-static void icp_set_mfrr(struct icp_state *icp, int server, uint8_t mfrr)
-{
-    struct icp_server_state *ss = icp->ss + server;
-
-    ss->mfrr = mfrr;
-    if (mfrr < CPPR(ss)) {
-        icp_check_ipi(icp, server);
-    }
-}
-
-static uint32_t icp_accept(struct icp_server_state *ss)
-{
-    uint32_t xirr = ss->xirr;
-
-    qemu_irq_lower(ss->output);
-    ss->xirr = ss->pending_priority << 24;
-    ss->pending_priority = 0xff;
-
-    trace_xics_icp_accept(xirr, ss->xirr);
-
-    return xirr;
-}
-
-static void icp_eoi(struct icp_state *icp, int server, uint32_t xirr)
-{
-    struct icp_server_state *ss = icp->ss + server;
-
-    /* Send EOI -> ICS */
-    ss->xirr = (ss->xirr & ~CPPR_MASK) | (xirr & CPPR_MASK);
-    trace_xics_icp_eoi(server, xirr, ss->xirr);
-    ics_eoi(icp->ics, xirr & XISR_MASK);
-    if (!XISR(ss)) {
-        icp_resend(icp, server);
-    }
-}
-
-static void icp_irq(struct icp_state *icp, int server, int nr, uint8_t priority)
-{
-    struct icp_server_state *ss = icp->ss + server;
-
-    trace_xics_icp_irq(server, nr, priority);
-
-    if ((priority >= CPPR(ss))
-        || (XISR(ss) && (ss->pending_priority <= priority))) {
-        ics_reject(icp->ics, nr);
-    } else {
-        if (XISR(ss)) {
-            ics_reject(icp->ics, XISR(ss));
-        }
-        ss->xirr = (ss->xirr & ~XISR_MASK) | (nr & XISR_MASK);
-        ss->pending_priority = priority;
-        trace_xics_icp_raise(ss->xirr, ss->pending_priority);
-        qemu_irq_raise(ss->output);
-    }
-}
-
-/*
- * ICS: Source layer
- */
-
-struct ics_irq_state {
-    int server;
-    uint8_t priority;
-    uint8_t saved_priority;
-#define XICS_STATUS_ASSERTED           0x1
-#define XICS_STATUS_SENT               0x2
-#define XICS_STATUS_REJECTED           0x4
-#define XICS_STATUS_MASKED_PENDING     0x8
-    uint8_t status;
-};
-
-struct ics_state {
-    int nr_irqs;
-    int offset;
-    qemu_irq *qirqs;
-    bool *islsi;
-    struct ics_irq_state *irqs;
-    struct icp_state *icp;
-};
-
-static int ics_valid_irq(struct ics_state *ics, uint32_t nr)
-{
-    return (nr >= ics->offset)
-        && (nr < (ics->offset + ics->nr_irqs));
-}
-
-static void resend_msi(struct ics_state *ics, int srcno)
-{
-    struct ics_irq_state *irq = ics->irqs + srcno;
-
-    /* FIXME: filter by server#? */
-    if (irq->status & XICS_STATUS_REJECTED) {
-        irq->status &= ~XICS_STATUS_REJECTED;
-        if (irq->priority != 0xff) {
-            icp_irq(ics->icp, irq->server, srcno + ics->offset,
-                    irq->priority);
-        }
-    }
-}
-
-static void resend_lsi(struct ics_state *ics, int srcno)
-{
-    struct ics_irq_state *irq = ics->irqs + srcno;
-
-    if ((irq->priority != 0xff)
-        && (irq->status & XICS_STATUS_ASSERTED)
-        && !(irq->status & XICS_STATUS_SENT)) {
-        irq->status |= XICS_STATUS_SENT;
-        icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
-    }
-}
-
-static void set_irq_msi(struct ics_state *ics, int srcno, int val)
-{
-    struct ics_irq_state *irq = ics->irqs + srcno;
-
-    trace_xics_set_irq_msi(srcno, srcno + ics->offset);
-
-    if (val) {
-        if (irq->priority == 0xff) {
-            irq->status |= XICS_STATUS_MASKED_PENDING;
-            trace_xics_masked_pending();
-        } else  {
-            icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
-        }
-    }
-}
-
-static void set_irq_lsi(struct ics_state *ics, int srcno, int val)
-{
-    struct ics_irq_state *irq = ics->irqs + srcno;
-
-    trace_xics_set_irq_lsi(srcno, srcno + ics->offset);
-    if (val) {
-        irq->status |= XICS_STATUS_ASSERTED;
-    } else {
-        irq->status &= ~XICS_STATUS_ASSERTED;
-    }
-    resend_lsi(ics, srcno);
-}
-
-static void ics_set_irq(void *opaque, int srcno, int val)
-{
-    struct ics_state *ics = (struct ics_state *)opaque;
-
-    if (ics->islsi[srcno]) {
-        set_irq_lsi(ics, srcno, val);
-    } else {
-        set_irq_msi(ics, srcno, val);
-    }
-}
-
-static void write_xive_msi(struct ics_state *ics, int srcno)
-{
-    struct ics_irq_state *irq = ics->irqs + srcno;
-
-    if (!(irq->status & XICS_STATUS_MASKED_PENDING)
-        || (irq->priority == 0xff)) {
-        return;
-    }
-
-    irq->status &= ~XICS_STATUS_MASKED_PENDING;
-    icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
-}
-
-static void write_xive_lsi(struct ics_state *ics, int srcno)
-{
-    resend_lsi(ics, srcno);
-}
-
-static void ics_write_xive(struct ics_state *ics, int nr, int server,
-                           uint8_t priority, uint8_t saved_priority)
-{
-    int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
-
-    irq->server = server;
-    irq->priority = priority;
-    irq->saved_priority = saved_priority;
-
-    trace_xics_ics_write_xive(nr, srcno, server, priority);
-
-    if (ics->islsi[srcno]) {
-        write_xive_lsi(ics, srcno);
-    } else {
-        write_xive_msi(ics, srcno);
-    }
-}
-
-static void ics_reject(struct ics_state *ics, int nr)
-{
-    struct ics_irq_state *irq = ics->irqs + nr - ics->offset;
-
-    trace_xics_ics_reject(nr, nr - ics->offset);
-    irq->status |= XICS_STATUS_REJECTED; /* Irrelevant but harmless for LSI */
-    irq->status &= ~XICS_STATUS_SENT; /* Irrelevant but harmless for MSI */
-}
-
-static void ics_resend(struct ics_state *ics)
-{
-    int i;
-
-    for (i = 0; i < ics->nr_irqs; i++) {
-        /* FIXME: filter by server#? */
-        if (ics->islsi[i]) {
-            resend_lsi(ics, i);
-        } else {
-            resend_msi(ics, i);
-        }
-    }
-}
-
-static void ics_eoi(struct ics_state *ics, int nr)
-{
-    int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
-
-    trace_xics_ics_eoi(nr);
-
-    if (ics->islsi[srcno]) {
-        irq->status &= ~XICS_STATUS_SENT;
-    }
-}
-
-/*
- * Exported functions
- */
-
-qemu_irq xics_get_qirq(struct icp_state *icp, int irq)
-{
-    if (!ics_valid_irq(icp->ics, irq)) {
-        return NULL;
-    }
-
-    return icp->ics->qirqs[irq - icp->ics->offset];
-}
-
-void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi)
-{
-    assert(ics_valid_irq(icp->ics, irq));
-
-    icp->ics->islsi[irq - icp->ics->offset] = lsi;
-}
-
-static target_ulong h_cppr(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                           target_ulong opcode, target_ulong *args)
-{
-    CPUState *cs = CPU(cpu);
-    target_ulong cppr = args[0];
-
-    icp_set_cppr(spapr->icp, cs->cpu_index, cppr);
-    return H_SUCCESS;
-}
-
-static target_ulong h_ipi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                          target_ulong opcode, target_ulong *args)
-{
-    target_ulong server = args[0];
-    target_ulong mfrr = args[1];
-
-    if (server >= spapr->icp->nr_servers) {
-        return H_PARAMETER;
-    }
-
-    icp_set_mfrr(spapr->icp, server, mfrr);
-    return H_SUCCESS;
-}
-
-static target_ulong h_xirr(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                           target_ulong opcode, target_ulong *args)
-{
-    CPUState *cs = CPU(cpu);
-    uint32_t xirr = icp_accept(spapr->icp->ss + cs->cpu_index);
-
-    args[0] = xirr;
-    return H_SUCCESS;
-}
-
-static target_ulong h_eoi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                          target_ulong opcode, target_ulong *args)
-{
-    CPUState *cs = CPU(cpu);
-    target_ulong xirr = args[0];
-
-    icp_eoi(spapr->icp, cs->cpu_index, xirr);
-    return H_SUCCESS;
-}
-
-static void rtas_set_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                          uint32_t token,
-                          uint32_t nargs, target_ulong args,
-                          uint32_t nret, target_ulong rets)
-{
-    struct ics_state *ics = spapr->icp->ics;
-    uint32_t nr, server, priority;
-
-    if ((nargs != 3) || (nret != 1)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    nr = rtas_ld(args, 0);
-    server = rtas_ld(args, 1);
-    priority = rtas_ld(args, 2);
-
-    if (!ics_valid_irq(ics, nr) || (server >= ics->icp->nr_servers)
-        || (priority > 0xff)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    ics_write_xive(ics, nr, server, priority, priority);
-
-    rtas_st(rets, 0, 0); /* Success */
-}
-
-static void rtas_get_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                          uint32_t token,
-                          uint32_t nargs, target_ulong args,
-                          uint32_t nret, target_ulong rets)
-{
-    struct ics_state *ics = spapr->icp->ics;
-    uint32_t nr;
-
-    if ((nargs != 1) || (nret != 3)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    nr = rtas_ld(args, 0);
-
-    if (!ics_valid_irq(ics, nr)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    rtas_st(rets, 0, 0); /* Success */
-    rtas_st(rets, 1, ics->irqs[nr - ics->offset].server);
-    rtas_st(rets, 2, ics->irqs[nr - ics->offset].priority);
-}
-
-static void rtas_int_off(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                         uint32_t token,
-                         uint32_t nargs, target_ulong args,
-                         uint32_t nret, target_ulong rets)
-{
-    struct ics_state *ics = spapr->icp->ics;
-    uint32_t nr;
-
-    if ((nargs != 1) || (nret != 1)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    nr = rtas_ld(args, 0);
-
-    if (!ics_valid_irq(ics, nr)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    ics_write_xive(ics, nr, ics->irqs[nr - ics->offset].server, 0xff,
-                   ics->irqs[nr - ics->offset].priority);
-
-    rtas_st(rets, 0, 0); /* Success */
-}
-
-static void rtas_int_on(PowerPCCPU *cpu, sPAPREnvironment *spapr,
-                        uint32_t token,
-                        uint32_t nargs, target_ulong args,
-                        uint32_t nret, target_ulong rets)
-{
-    struct ics_state *ics = spapr->icp->ics;
-    uint32_t nr;
-
-    if ((nargs != 1) || (nret != 1)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    nr = rtas_ld(args, 0);
-
-    if (!ics_valid_irq(ics, nr)) {
-        rtas_st(rets, 0, -3);
-        return;
-    }
-
-    ics_write_xive(ics, nr, ics->irqs[nr - ics->offset].server,
-                   ics->irqs[nr - ics->offset].saved_priority,
-                   ics->irqs[nr - ics->offset].saved_priority);
-
-    rtas_st(rets, 0, 0); /* Success */
-}
-
-static void xics_reset(void *opaque)
-{
-    struct icp_state *icp = (struct icp_state *)opaque;
-    struct ics_state *ics = icp->ics;
-    int i;
-
-    for (i = 0; i < icp->nr_servers; i++) {
-        icp->ss[i].xirr = 0;
-        icp->ss[i].pending_priority = 0xff;
-        icp->ss[i].mfrr = 0xff;
-        /* Make all outputs are deasserted */
-        qemu_set_irq(icp->ss[i].output, 0);
-    }
-
-    memset(ics->irqs, 0, sizeof(struct ics_irq_state) * ics->nr_irqs);
-    for (i = 0; i < ics->nr_irqs; i++) {
-        ics->irqs[i].priority = 0xff;
-        ics->irqs[i].saved_priority = 0xff;
-    }
-}
-
-void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu)
-{
-    CPUState *cs = CPU(cpu);
-    CPUPPCState *env = &cpu->env;
-    struct icp_server_state *ss = &icp->ss[cs->cpu_index];
-
-    assert(cs->cpu_index < icp->nr_servers);
-
-    switch (PPC_INPUT(env)) {
-    case PPC_FLAGS_INPUT_POWER7:
-        ss->output = env->irq_inputs[POWER7_INPUT_INT];
-        break;
-
-    case PPC_FLAGS_INPUT_970:
-        ss->output = env->irq_inputs[PPC970_INPUT_INT];
-        break;
-
-    default:
-        fprintf(stderr, "XICS interrupt controller does not support this CPU "
-                "bus model\n");
-        abort();
-    }
-}
-
-struct icp_state *xics_system_init(int nr_servers, int nr_irqs)
-{
-    struct icp_state *icp;
-    struct ics_state *ics;
-
-    icp = g_malloc0(sizeof(*icp));
-    icp->nr_servers = nr_servers;
-    icp->ss = g_malloc0(icp->nr_servers*sizeof(struct icp_server_state));
-
-    ics = g_malloc0(sizeof(*ics));
-    ics->nr_irqs = nr_irqs;
-    ics->offset = XICS_IRQ_BASE;
-    ics->irqs = g_malloc0(nr_irqs * sizeof(struct ics_irq_state));
-    ics->islsi = g_malloc0(nr_irqs * sizeof(bool));
-
-    icp->ics = ics;
-    ics->icp = icp;
-
-    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, nr_irqs);
-
-    spapr_register_hypercall(H_CPPR, h_cppr);
-    spapr_register_hypercall(H_IPI, h_ipi);
-    spapr_register_hypercall(H_XIRR, h_xirr);
-    spapr_register_hypercall(H_EOI, h_eoi);
-
-    spapr_rtas_register("ibm,set-xive", rtas_set_xive);
-    spapr_rtas_register("ibm,get-xive", rtas_get_xive);
-    spapr_rtas_register("ibm,int-off", rtas_int_off);
-    spapr_rtas_register("ibm,int-on", rtas_int_on);
-
-    qemu_register_reset(xics_reset, icp);
-
-    return icp;
-}
commit 8e7ea787a20e30d44232cafb5a6e9a9fea364c66
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 3 21:26:50 2013 +0200

    spapr: Respect -bios command line option for SLOF
    
    Allow the user to override the firmware file name rather than always
    using "slof.bin".
    
    Reported-by: Dinar Valeev <k0da at opensuse.org>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 5c31ad3..48ae092 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -940,7 +940,10 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
         }
     }
 
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, FW_FILE_NAME);
+    if (bios_name == NULL) {
+        bios_name = FW_FILE_NAME;
+    }
+    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
     fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE);
     if (fw_size < 0) {
         hw_error("qemu: could not load LPAR rtas '%s'\n", filename);
commit a3801402aa01e2ecb617f89b2e11f212d948b5af
Author: Stefan Weil <sw at weilnetz.de>
Date:   Mon Jun 24 19:48:47 2013 +0200

    spapr: Use named enum for function remove_hpte
    
    The function returned a target_ulong which was made from unnamed enum
    values. The target_ulong was then assigned to an int variable which
    was used in a switch statement.
    
    Using a named enum in both cases makes reviews easier.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 8bad27f..ed32dec 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -121,14 +121,14 @@ static target_ulong h_enter(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     return H_SUCCESS;
 }
 
-enum {
+typedef enum {
     REMOVE_SUCCESS = 0,
     REMOVE_NOT_FOUND = 1,
     REMOVE_PARM = 2,
     REMOVE_HW = 3,
-};
+} RemoveResult;
 
-static target_ulong remove_hpte(CPUPPCState *env, target_ulong ptex,
+static RemoveResult remove_hpte(CPUPPCState *env, target_ulong ptex,
                                 target_ulong avpn,
                                 target_ulong flags,
                                 target_ulong *vp, target_ulong *rp)
@@ -165,7 +165,7 @@ static target_ulong h_remove(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     target_ulong flags = args[0];
     target_ulong pte_index = args[1];
     target_ulong avpn = args[2];
-    int ret;
+    RemoveResult ret;
 
     ret = remove_hpte(env, pte_index, avpn, flags,
                       &args[0], &args[1]);
commit 9a39970df783cf8317e7dbf00a8af184ce868b1b
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sat Jun 29 15:47:26 2013 +0200

    spapr: Fix compiler warnings for some versions of gcc
    
    i686-w64-mingw32-gcc (GCC) 4.6.3 from Debian wheezy reports these warnings:
    
    hw/ppc/spapr_hcall.c:188:1: warning:
     control reaches end of non-void function [-Wreturn-type]
    
    hw/ppc/spapr_pci.c:454:1: warning:
     control reaches end of non-void function [-Wreturn-type]
    
    Both warnings are fixed by using g_assert_not_reached instead of assert.
    A second line with assert(0) in spapr_pci.c which did not raise a compiler
    warning was modified, too, because g_assert_not_reached documents the
    purpose of that statement and is not removed in release builds.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Acked-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index e6f321d..8bad27f 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -184,7 +184,7 @@ static target_ulong h_remove(PowerPCCPU *cpu, sPAPREnvironment *spapr,
         return H_HARDWARE;
     }
 
-    assert(0);
+    g_assert_not_reached();
 }
 
 #define H_BULK_REMOVE_TYPE             0xc000000000000000ULL
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 18f2e2f..318bc9d 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -451,7 +451,7 @@ static uint64_t spapr_io_read(void *opaque, hwaddr addr,
     case 4:
         return cpu_inl(addr);
     }
-    assert(0);
+    g_assert_not_reached();
 }
 
 static void spapr_io_write(void *opaque, hwaddr addr,
@@ -468,7 +468,7 @@ static void spapr_io_write(void *opaque, hwaddr addr,
         cpu_outl(addr, data);
         return;
     }
-    assert(0);
+    g_assert_not_reached();
 }
 
 static const MemoryRegionOps spapr_io_ops = {
commit 7162bdea75e9f63afdd2cacfe26ee4b472a59362
Author: Julio Guerra <guerr at julio.in>
Date:   Mon Jun 24 23:15:54 2013 +0200

    e600 core for MPC86xx processors
    
    MPC86xx processors are based on the e600 core, which is not the case
    in qemu where it is based on the 7400 processor.
    
    This patch creates the e600 core and instantiates the MPC86xx
    processors based on it. Therefore, adding the high BATs, the SPRG
    4..7 registers, which are e600-specific [1], and a HW MMU model (as 7400).
    This allows to define the MPC8610 processor too.
    
    Tested with a kernel using the HW TLB misses.
    
    [1] http://cache.freescale.com/files/32bit/doc/ref_manual/E600CORERM.pdf
    
    Signed-off-by: Julio Guerra <guerr at julio.in>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/cpu-models.c b/target-ppc/cpu-models.c
index 9bb68c8..13dd670 100644
--- a/target-ppc/cpu-models.c
+++ b/target-ppc/cpu-models.c
@@ -792,17 +792,15 @@
     POWERPC_DEF_SVR("MPC8572E", "MPC8572E",
                     CPU_POWERPC_MPC8572E,     POWERPC_SVR_8572E,     e500v2)
     /* e600 family                                                           */
-    POWERPC_DEF("e600",          CPU_POWERPC_e600,                   7400,
+    POWERPC_DEF("e600",          CPU_POWERPC_e600,                   e600,
                 "PowerPC e600 core")
     /* PowerPC e600 microcontrollers                                         */
-#if defined(TODO)
     POWERPC_DEF_SVR("MPC8610", "MPC8610",
-                    CPU_POWERPC_MPC8610,      POWERPC_SVR_8610,      7400)
-#endif
+                    CPU_POWERPC_MPC8610,      POWERPC_SVR_8610,      e600)
     POWERPC_DEF_SVR("MPC8641", "MPC8641",
-                    CPU_POWERPC_MPC8641,      POWERPC_SVR_8641,      7400)
+                    CPU_POWERPC_MPC8641,      POWERPC_SVR_8641,      e600)
     POWERPC_DEF_SVR("MPC8641D", "MPC8641D",
-                    CPU_POWERPC_MPC8641D,     POWERPC_SVR_8641D,     7400)
+                    CPU_POWERPC_MPC8641D,     POWERPC_SVR_8641D,     e600)
     /* 32 bits "classic" PowerPC                                             */
     /* PowerPC 6xx family                                                    */
     POWERPC_DEF("601_v0",        CPU_POWERPC_601_v0,                 601,
diff --git a/target-ppc/cpu-models.h b/target-ppc/cpu-models.h
index ae8f7c7..fcd3a15 100644
--- a/target-ppc/cpu-models.h
+++ b/target-ppc/cpu-models.h
@@ -732,9 +732,7 @@ enum {
     POWERPC_SVR_8568E              = 0x807D0011 | POWERPC_SVR_E500,
     POWERPC_SVR_8572               = 0x80E00010 | POWERPC_SVR_E500,
     POWERPC_SVR_8572E              = 0x80E80010 | POWERPC_SVR_E500,
-#if 0
-    POWERPC_SVR_8610               = xxx,
-#endif
+    POWERPC_SVR_8610               = 0x80A00011,
     POWERPC_SVR_8641               = 0x80900021,
     POWERPC_SVR_8641D              = 0x80900121,
 };
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index b62f04a..76483d9 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -6479,6 +6479,131 @@ POWERPC_FAMILY(7457)(ObjectClass *oc, void *data)
                  POWERPC_FLAG_BUS_CLK;
 }
 
+static void init_proc_e600 (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_7xx(env);
+    /* Time base */
+    gen_tbl(env);
+    /* 74xx specific SPR */
+    gen_spr_74xx(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UBAMR, "UBAMR",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_LDSTCR, "LDSTCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_ICTRL, "ICTRL",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MSSSR0, "MSSSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_PMC5, "PMC5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UPMC5, "UPMC5",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_PMC6, "PMC6",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UPMC6, "UPMC6",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* SPRGs */
+    spr_register(env, SPR_SPRG4, "SPRG4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG4, "USPRG4",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_SPRG5, "SPRG5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG5, "USPRG5",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_SPRG6, "SPRG6",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG6, "USPRG6",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_SPRG7, "SPRG7",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG7, "USPRG7",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    gen_high_BATs(env);
+    gen_74xx_soft_tlb(env, 128, 2);
+    init_excp_7450(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
+
+POWERPC_FAMILY(e600)(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+
+    dc->desc = "PowerPC e600";
+    pcc->init_proc = init_proc_e600;
+    pcc->check_pow = check_pow_hid0_74xx;
+    pcc->insns_flags = PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |
+                       PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+                       PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
+                       PPC_FLOAT_STFIWX |
+                       PPC_CACHE | PPC_CACHE_ICBI |
+                       PPC_CACHE_DCBA | PPC_CACHE_DCBZ |
+                       PPC_MEM_SYNC | PPC_MEM_EIEIO |
+                       PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
+                       PPC_MEM_TLBIA | PPC_74xx_TLB |
+                       PPC_SEGMENT | PPC_EXTERN |
+                       PPC_ALTIVEC;
+    pcc->insns_flags2 = PPC_NONE;
+    pcc->msr_mask = 0x000000000205FF77ULL;
+    pcc->mmu_model = POWERPC_MMU_32B;
+#if defined(CONFIG_SOFTMMU)
+    pcc->handle_mmu_fault = ppc_hash32_handle_mmu_fault;
+#endif
+    pcc->excp_model = POWERPC_EXCP_74xx;
+    pcc->bus_model = PPC_FLAGS_INPUT_6xx;
+    pcc->bfd_mach = bfd_mach_ppc_7400;
+    pcc->flags = POWERPC_FLAG_VRE | POWERPC_FLAG_SE |
+                 POWERPC_FLAG_BE | POWERPC_FLAG_PMM |
+                 POWERPC_FLAG_BUS_CLK;
+}
+
 #if defined (TARGET_PPC64)
 #if defined(CONFIG_USER_ONLY)
 #define POWERPC970_HID5_INIT 0x00000080
commit c170a23ca0097a95b44fc7cc604018cd3c3b7d44
Merge: 51455c5 5e2ac51
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Jul 10 14:34:32 2013 -0500

    Merge remote-tracking branch 'luiz/queue/qmp' into staging
    
    # By Kevin Wolf (4) and others
    # Via Luiz Capitulino
    * luiz/queue/qmp:
      add timestamp to error_report()
      qapi-schema: Use existing type for drive-backup arguments
      qapi-schema: Use BlockdevSnapshot type for blockdev-snapshot-sync
      qapi.py: Allow top-level type reference for command definitions
      qapi.py: Avoid code duplication
      qemu-char: Fix ringbuf option size
    
    Message-id: 1373478767-20965-1-git-send-email-lcapitulino at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 5e2ac5191772dea782ff78e95edd395985273019
Author: Seiji Aguchi <seiji.aguchi at hds.com>
Date:   Wed Jul 3 23:02:46 2013 -0400

    add timestamp to error_report()
    
    [Issue]
    When we offer a customer support service and a problem happens
    in a customer's system, we try to understand the problem by
    comparing what the customer reports with message logs of the
    customer's system.
    
    In this case, we often need to know when the problem happens.
    
    But, currently, there is no timestamp in qemu's error messages.
    Therefore, we may not be able to understand the problem based on
    error messages.
    
    [Solution]
    Add a timestamp to qemu's error message logged by
    error_report() with g_time_val_to_iso8601().
    
    Signed-off-by: Seiji Aguchi <seiji.aguchi at hds.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/include/qemu/error-report.h b/include/qemu/error-report.h
index 14c1719..3b098a9 100644
--- a/include/qemu/error-report.h
+++ b/include/qemu/error-report.h
@@ -14,6 +14,7 @@
 #define QEMU_ERROR_H
 
 #include <stdarg.h>
+#include <stdbool.h>
 #include "qemu/compiler.h"
 
 typedef struct Location {
@@ -40,5 +41,6 @@ void error_print_loc(void);
 void error_set_progname(const char *argv0);
 void error_report(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
 const char *error_get_progname(void);
+extern bool enable_timestamp_msg;
 
 #endif
diff --git a/qemu-options.hx b/qemu-options.hx
index 7cc4d8e..4e98b4f 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -3100,6 +3100,17 @@ property must be set.  These objects are placed in the
 '/objects' path.
 ETEXI
 
+DEF("msg", HAS_ARG, QEMU_OPTION_msg,
+    "-msg timestamp[=on|off]\n"
+    "                change the format of messages\n"
+    "                on|off controls leading timestamps (default:on)\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -msg timestamp[=on|off]
+ at findex -msg
+prepend a timestamp to each log message.(default:on)
+ETEXI
+
 HXCOMM This is the last statement. Insert new options before this line!
 STEXI
 @end table
diff --git a/util/qemu-error.c b/util/qemu-error.c
index 08a36f4..fec02c6 100644
--- a/util/qemu-error.c
+++ b/util/qemu-error.c
@@ -196,6 +196,7 @@ void error_print_loc(void)
     }
 }
 
+bool enable_timestamp_msg;
 /*
  * Print an error message to current monitor if we have one, else to stderr.
  * Format arguments like sprintf().  The result should not contain
@@ -206,6 +207,15 @@ void error_print_loc(void)
 void error_report(const char *fmt, ...)
 {
     va_list ap;
+    GTimeVal tv;
+    gchar *timestr;
+
+    if (enable_timestamp_msg) {
+        g_get_current_time(&tv);
+        timestr = g_time_val_to_iso8601(&tv);
+        error_printf("%s ", timestr);
+        g_free(timestr);
+    }
 
     error_print_loc();
     va_start(ap, fmt);
diff --git a/vl.c b/vl.c
index bea1a10..25b8f2f 100644
--- a/vl.c
+++ b/vl.c
@@ -516,6 +516,18 @@ static QemuOptsList qemu_realtime_opts = {
     },
 };
 
+static QemuOptsList qemu_msg_opts = {
+    .name = "msg",
+    .head = QTAILQ_HEAD_INITIALIZER(qemu_msg_opts.head),
+    .desc = {
+        {
+            .name = "timestamp",
+            .type = QEMU_OPT_BOOL,
+        },
+        { /* end of list */ }
+    },
+};
+
 /**
  * Get machine options
  *
@@ -1503,6 +1515,12 @@ static void configure_realtime(QemuOpts *opts)
     }
 }
 
+
+static void configure_msg(QemuOpts *opts)
+{
+    enable_timestamp_msg = qemu_opt_get_bool(opts, "timestamp", true);
+}
+
 /***********************************************************/
 /* USB devices */
 
@@ -2942,6 +2960,7 @@ int main(int argc, char **argv, char **envp)
     qemu_add_opts(&qemu_object_opts);
     qemu_add_opts(&qemu_tpmdev_opts);
     qemu_add_opts(&qemu_realtime_opts);
+    qemu_add_opts(&qemu_msg_opts);
 
     runstate_init();
 
@@ -3838,6 +3857,13 @@ int main(int argc, char **argv, char **envp)
                 }
                 configure_realtime(opts);
                 break;
+            case QEMU_OPTION_msg:
+                opts = qemu_opts_parse(qemu_find_opts("msg"), optarg, 0);
+                if (!opts) {
+                    exit(1);
+                }
+                configure_msg(opts);
+                break;
             default:
                 os_parse_cmd_args(popt->index, optarg);
             }
commit f53cae50f81449596e55159cfe61efbef9246b2e
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 9 10:05:35 2013 +0200

    qapi-schema: Use existing type for drive-backup arguments
    
    This removes duplicated definitions and documentation by reusing the
    existing data type.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index a90aeb1..b251d28 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1791,42 +1791,14 @@
 # The operation can be stopped before it has completed using the
 # block-job-cancel command.
 #
-# @device: the name of the device which should be copied.
-#
-# @target: the target of the new image. If the file exists, or if it
-#          is a device, the existing file/device will be used as the new
-#          destination.  If it does not exist, a new file will be created.
-#
-# @format: #optional the format of the new destination, default is to
-#          probe if @mode is 'existing', else the format of the source
-#
-# @mode: #optional whether and how QEMU should create a new image, default is
-#        'absolute-paths'.
-#
-# @speed: #optional the maximum speed, in bytes per second
-#
-# @on-source-error: #optional the action to take on an error on the source,
-#                   default 'report'.  'stop' and 'enospc' can only be used
-#                   if the block device supports io-status (see BlockInfo).
-#
-# @on-target-error: #optional the action to take on an error on the target,
-#                   default 'report' (no limitations, since this applies to
-#                   a different block device than @device).
-#
-# Note that @on-source-error and @on-target-error only affect background I/O.
-# If an error occurs during a guest write request, the device's rerror/werror
-# actions will be used.
+# For the arguments, see the documentation of DriveBackup.
 #
 # Returns: nothing on success
 #          If @device is not a valid block device, DeviceNotFound
 #
 # Since 1.6
 ##
-{ 'command': 'drive-backup',
-  'data': { 'device': 'str', 'target': 'str', '*format': 'str',
-            '*mode': 'NewImageMode', '*speed': 'int',
-            '*on-source-error': 'BlockdevOnError',
-            '*on-target-error': 'BlockdevOnError' } }
+{ 'command': 'drive-backup', 'data': 'DriveBackup' }
 
 ##
 # @drive-mirror
commit 852ad1a900a4ae23514e1a53c86632543592c31b
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Jul 1 16:31:52 2013 +0200

    qapi-schema: Use BlockdevSnapshot type for blockdev-snapshot-sync
    
    We don't have to duplicate the definition any more now that we may refer
    to a type instead.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index 5c32528..a90aeb1 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1709,16 +1709,7 @@
 #
 # Generates a synchronous snapshot of a block device.
 #
-# @device:  the name of the device to generate the snapshot from.
-#
-# @snapshot-file: the target of the new image. If the file exists, or if it
-#                 is a device, the snapshot will be created in the existing
-#                 file/device. If does not exist, a new file will be created.
-#
-# @format: #optional the format of the snapshot image, default is 'qcow2'.
-#
-# @mode: #optional whether and how QEMU should create a new image, default is
-#        'absolute-paths'.
+# For the arguments, see the documentation of BlockdevSnapshot.
 #
 # Returns: nothing on success
 #          If @device is not a valid block device, DeviceNotFound
@@ -1726,8 +1717,7 @@
 # Since 0.14.0
 ##
 { 'command': 'blockdev-snapshot-sync',
-  'data': { 'device': 'str', 'snapshot-file': 'str', '*format': 'str',
-            '*mode': 'NewImageMode'} }
+  'data': 'BlockdevSnapshot' }
 
 ##
 # @human-monitor-command:
commit b35284ea207a0ae1c0b162344cdef2a83304befc
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Jul 1 16:31:51 2013 +0200

    qapi.py: Allow top-level type reference for command definitions
    
    If 'data' for a command definition isn't a dict, but a string, it is
    taken as a (struct) type name and the fields of this struct are directly
    used as parameters.
    
    This is useful for transactionable commands that can use the same type
    definition for both the transaction action and the arguments of the
    standalone command.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 3139994..baf1321 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -106,11 +106,18 @@ def parse_schema(fp):
             add_enum(expr_eval['enum'])
         elif expr_eval.has_key('union'):
             add_enum('%sKind' % expr_eval['union'])
+        elif expr_eval.has_key('type'):
+            add_struct(expr_eval)
         exprs.append(expr_eval)
 
     return exprs
 
 def parse_args(typeinfo):
+    if isinstance(typeinfo, basestring):
+        struct = find_struct(typeinfo)
+        assert struct != None
+        typeinfo = struct['data']
+
     for member in typeinfo:
         argname = member
         argentry = typeinfo[member]
@@ -180,6 +187,18 @@ def type_name(name):
     return name
 
 enum_types = []
+struct_types = []
+
+def add_struct(definition):
+    global struct_types
+    struct_types.append(definition)
+
+def find_struct(name):
+    global struct_types
+    for struct in struct_types:
+        if struct['type'] == name:
+            return struct
+    return None
 
 def add_enum(name):
     global enum_types
commit bd9927fee4e63b451b4ef67a4c49729070d8b05d
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Jul 1 16:31:50 2013 +0200

    qapi.py: Avoid code duplication
    
    The code that interprets the read JSON expression and appends types to
    the respective global variables was duplicated. We can avoid that by
    splitting off the part that reads from the file.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 02ad668..3139994 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -78,10 +78,8 @@ def parse(tokens):
 def evaluate(string):
     return parse(map(lambda x: x, tokenize(string)))[0]
 
-def parse_schema(fp):
-    exprs = []
+def get_expr(fp):
     expr = ''
-    expr_eval = None
 
     for line in fp:
         if line.startswith('#') or line == '\n':
@@ -90,18 +88,20 @@ def parse_schema(fp):
         if line.startswith(' '):
             expr += line
         elif expr:
-            expr_eval = evaluate(expr)
-            if expr_eval.has_key('enum'):
-                add_enum(expr_eval['enum'])
-            elif expr_eval.has_key('union'):
-                add_enum('%sKind' % expr_eval['union'])
-            exprs.append(expr_eval)
+            yield expr
             expr = line
         else:
             expr += line
 
     if expr:
+        yield expr
+
+def parse_schema(fp):
+    exprs = []
+
+    for expr in get_expr(fp):
         expr_eval = evaluate(expr)
+
         if expr_eval.has_key('enum'):
             add_enum(expr_eval['enum'])
         elif expr_eval.has_key('union'):
commit 0f953051178f2e3df36efa5158a71f33d35fa812
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jun 27 16:22:07 2013 +0200

    qemu-char: Fix ringbuf option size
    
    Any attempt to use it trips an "opt->desc->type == QEMU_OPT_NUMBER"
    assertion.  Broken in commit 1da48c65.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/qemu-char.c b/qemu-char.c
index 18c42a3..800d6a6 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3115,7 +3115,7 @@ static void qemu_chr_parse_memory(QemuOpts *opts, ChardevBackend *backend,
 
     backend->memory = g_new0(ChardevMemory, 1);
 
-    val = qemu_opt_get_number(opts, "size", 0);
+    val = qemu_opt_get_size(opts, "size", 0);
     if (val != 0) {
         backend->memory->has_size = true;
         backend->memory->size = val;
commit 51455c59ddc370612f6e070d8eb0e594aaa7ef24
Merge: 9f9a03b 91b1df8
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Jul 10 10:54:16 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into staging
    
    QOM CPUState refactorings
    
    * Fix for OpenRISCCPU subclasses
    * Fix for gdbstub CPU selection
    * Move linux-user CPU functions into new header
    * CPUState part 10 refactoring: first_cpu, next_cpu, cpu_single_env et al.
    * Fix some targets to consistently inline TCG code generation
    * Centrally log CPU reset
    
    # gpg: Signature made Wed 10 Jul 2013 07:52:39 AM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Andreas Färber (41) and others
    # Via Andreas Färber
    * afaerber/tags/qom-cpu-for-anthony: (43 commits)
      cpu: Move reset logging to CPUState
      target-ppc: Change LOG_MMU_STATE() argument to CPUState
      target-i386: Change LOG_PCALL_STATE() argument to CPUState
      log: Change log_cpu_state[_mask]() argument to CPUState
      target-i386: Change do_smm_enter() argument to X86CPU
      target-i386: Change do_interrupt_all() argument to X86CPU
      target-xtensa: Change gen_intermediate_code_internal() arg to XtensaCPU
      target-unicore32: Change gen_intermediate_code_internal() signature
      target-sparc: Change gen_intermediate_code_internal() argument to SPARCCPU
      target-sh4: Change gen_intermediate_code_internal() argument to SuperHCPU
      target-s390x: Change gen_intermediate_code_internal() argument to S390CPU
      target-ppc: Change gen_intermediate_code_internal() argument to PowerPCCPU
      target-mips: Change gen_intermediate_code_internal() argument to MIPSCPU
      target-microblaze: Change gen_intermediate_code_internal() argument types
      target-m68k: Change gen_intermediate_code_internal() argument to M68kCPU
      target-lm32: Change gen_intermediate_code_internal() argument to LM32CPU
      target-i386: Change gen_intermediate_code_internal() argument to X86CPU
      target-cris: Change gen_intermediate_code_internal() argument to CRISCPU
      target-arm: Change gen_intermediate_code_internal() argument to ARMCPU
      target-alpha: Change gen_intermediate_code_internal() argument to AlphaCPU
      ...

commit 9f9a03b9818194da39c6759d9b0cbee5d7ace4e1
Merge: 6272d17 8384274
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Jul 10 10:54:09 2013 -0500

    Merge remote-tracking branch 'riku/linux-user-for-upstream' into staging
    
    # By Andreas Schwab (2) and others
    # Via Riku Voipio
    * riku/linux-user-for-upstream:
      linux-user: Do not ignore mmap failure from host
      linux-user: improve target_to_host_sock_type conversion
      user-exec.c: Set is_write correctly in the ARM cpu_signal_handler()
      linux-user: Fix sys_utimensat (would not compile on old glibc)
      linux-user: fix signal number range check
      linux-user: add SIOCADDRT/SIOCDELRT support
      linux-user: handle /proc/$$ like /proc/self
    
    Message-id: cover.1373051589.git.riku.voipio at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 6272d17c420b8cdd6af1784edd34f0b3e9f26b76
Merge: 9d6a3d5 0caa91f
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Jul 10 10:53:55 2013 -0500

    Merge remote-tracking branch 'rth/tcg-next' into staging
    
    # By Richard Henderson
    # Via Richard Henderson
    * rth/tcg-next:
      tcg-arm: Implement tcg_register_jit
      tcg-i386: Use QEMU_BUILD_BUG_ON instead of assert for frame size
      tcg: Move the CIE and FDE header definitions to common code
      tcg: Fix high_pc fields in .debug_info
      tcg-arm: Use AT_PLATFORM to detect the host ISA
      tcg-arm: Simplify logic in detecting the ARM ISA in use
      tcg-arm: Rename use_armv5_instructions to use_armvt5_instructions
      tcg-arm: Make use of conditional availability of opcodes for divide
      tcg: Simplify logic using TCG_OPF_NOT_PRESENT
      tcg: Allow non-constant control macros
      tcg-ppc64: Don't implement rem
      tcg-ppc: Don't implement rem
      tcg-arm: Don't implement rem
      tcg: Split rem requirement from div requirement
      tcg: Add myself to general TCG maintainership
    
    Message-id: 1373379515-28596-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 9d6a3d58e4d1431ab3809ff621cfd1f9ec75eef5
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Jun 18 19:18:59 2013 +1000

    qom: Fix class cast of NULL classes
    
    Its clear from the implementation that class casting is supposed to work
    with a NULL class argument. Guard all dereferences of the class argument
    against NULL accordingly.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: 94cd5ba46b74eea289a7e582635820c1c54e66fa.1371546907.git.peter.crosthwaite at xilinx.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qom/object.c b/qom/object.c
index cbd7e86..b2479d1 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -531,14 +531,14 @@ ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
 #ifdef CONFIG_QOM_CAST_DEBUG
     int i;
 
-    for (i = 0; i < OBJECT_CLASS_CAST_CACHE; i++) {
+    for (i = 0; class && i < OBJECT_CLASS_CAST_CACHE; i++) {
         if (class->cast_cache[i] == typename) {
             ret = class;
             goto out;
         }
     }
 #else
-    if (!class->interfaces) {
+    if (!class || !class->interfaces) {
         return class;
     }
 #endif
@@ -551,7 +551,7 @@ ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
     }
 
 #ifdef CONFIG_QOM_CAST_DEBUG
-    if (ret == class) {
+    if (class && ret == class) {
         for (i = 1; i < OBJECT_CLASS_CAST_CACHE; i++) {
             class->cast_cache[i - 1] = class->cast_cache[i];
         }
commit 4268b096272657b129a014f6f019625c4c8df2c1
Author: Don Koch <dkoch at verizon.com>
Date:   Tue Jul 9 13:36:05 2013 -0400

    pci: fix BRDIGE typo
    
    Fix typo in macro name: PCI_CLASS_BRDIGE_PCI_INF_SUB.
    
    Signed-off-by: Don Koch <dkoch at verizon.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 5807a92..b98bfb0 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -69,7 +69,7 @@ static int i82801b11_bridge_initfn(PCIDevice *d)
     if (rc < 0) {
         goto err_bridge;
     }
-    pci_config_set_prog_interface(d->config, PCI_CLASS_BRDIGE_PCI_INF_SUB);
+    pci_config_set_prog_interface(d->config, PCI_CLASS_BRIDGE_PCI_INF_SUB);
     return 0;
 
 err_bridge:
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index 08f8161..d7933bf 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -39,7 +39,7 @@
 #define PCI_CLASS_BRIDGE_HOST            0x0600
 #define PCI_CLASS_BRIDGE_ISA             0x0601
 #define PCI_CLASS_BRIDGE_PCI             0x0604
-#define PCI_CLASS_BRDIGE_PCI_INF_SUB     0x01
+#define PCI_CLASS_BRIDGE_PCI_INF_SUB     0x01
 #define PCI_CLASS_BRIDGE_OTHER           0x0680
 
 #define PCI_CLASS_COMMUNICATION_SERIAL   0x0700
commit e78e9ae4a933504d383703870d491615b0261801
Author: Don Koch <dkoch at verizon.com>
Date:   Tue Jul 9 11:40:02 2013 -0400

    pci-bridge: update mappings for migration/restore
    
    Fix for LP#1187529: Devices on PCI bridge stop working when
    live-migrated. Update bridge mappings for all PCI bridge
    devices in get_pci_config_device().
    
    Signed-off-by: Don Koch <dkoch at verizon.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 8680063..8087c18 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -378,6 +378,7 @@ int pci_bus_num(PCIBus *s)
 static int get_pci_config_device(QEMUFile *f, void *pv, size_t size)
 {
     PCIDevice *s = container_of(pv, PCIDevice, config);
+    PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(s);
     uint8_t *config;
     int i;
 
@@ -395,6 +396,10 @@ static int get_pci_config_device(QEMUFile *f, void *pv, size_t size)
     memcpy(s->config, config, size);
 
     pci_update_mappings(s);
+    if (pc->is_bridge) {
+        PCIBridge *b = container_of(s, PCIBridge, dev);
+        pci_bridge_update_mappings(b);
+    }
 
     memory_region_set_enabled(&s->bus_master_enable_region,
                               pci_get_word(s->config + PCI_COMMAND)
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 24be6c5..3897bd8 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -224,7 +224,7 @@ static void pci_bridge_region_cleanup(PCIBridge *br, PCIBridgeWindows *w)
     g_free(w);
 }
 
-static void pci_bridge_update_mappings(PCIBridge *br)
+void pci_bridge_update_mappings(PCIBridge *br)
 {
     PCIBridgeWindows *w = br->windows;
 
diff --git a/include/hw/pci/pci_bridge.h b/include/hw/pci/pci_bridge.h
index 1868f7a..1d8f997 100644
--- a/include/hw/pci/pci_bridge.h
+++ b/include/hw/pci/pci_bridge.h
@@ -37,6 +37,7 @@ PCIBus *pci_bridge_get_sec_bus(PCIBridge *br);
 pcibus_t pci_bridge_get_base(const PCIDevice *bridge, uint8_t type);
 pcibus_t pci_bridge_get_limit(const PCIDevice *bridge, uint8_t type);
 
+void pci_bridge_update_mappings(PCIBridge *br);
 void pci_bridge_write_config(PCIDevice *d,
                              uint32_t address, uint32_t val, int len);
 void pci_bridge_disable_base_limit(PCIDevice *dev);
commit 91b1df8cf9e1ecaa8679c9ea8713d1e25c28e6c4
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 16 07:49:48 2013 +0200

    cpu: Move reset logging to CPUState
    
    x86 was using additional CPU_DUMP_* flags, so make that configurable in
    CPUClass::reset_dump_flags.
    
    This adds reset logging for alpha, unicore32 and xtensa.
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index a08a8ab..147c256 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -53,6 +53,7 @@ typedef void (*CPUUnassignedAccess)(CPUState *cpu, hwaddr addr,
  * @class_by_name: Callback to map -cpu command line model name to an
  * instantiatable CPU type.
  * @reset: Callback to reset the #CPUState to its initial state.
+ * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @do_interrupt: Callback for interrupt handling.
  * @do_unassigned_access: Callback for unassigned access handling.
  * @dump_state: Callback for dumping state.
@@ -72,6 +73,7 @@ typedef struct CPUClass {
     ObjectClass *(*class_by_name)(const char *cpu_model);
 
     void (*reset)(CPUState *cpu);
+    int reset_dump_flags;
     void (*do_interrupt)(CPUState *cpu);
     CPUUnassignedAccess do_unassigned_access;
     void (*dump_state)(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
diff --git a/qom/cpu.c b/qom/cpu.c
index ee8f632..5c45ab5 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -22,6 +22,7 @@
 #include "qom/cpu.h"
 #include "sysemu/kvm.h"
 #include "qemu/notify.h"
+#include "qemu/log.h"
 #include "sysemu/sysemu.h"
 
 typedef struct CPUExistsArgs {
@@ -187,6 +188,13 @@ void cpu_reset(CPUState *cpu)
 
 static void cpu_common_reset(CPUState *cpu)
 {
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
+        qemu_log("CPU Reset (CPU %d)\n", cpu->cpu_index);
+        log_cpu_state(cpu, cc->reset_dump_flags);
+    }
+
     cpu->exit_request = 0;
     cpu->interrupt_request = 0;
     cpu->current_tb = NULL;
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 84974a9..be26acc 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -63,11 +63,6 @@ static void arm_cpu_reset(CPUState *s)
     ARMCPUClass *acc = ARM_CPU_GET_CLASS(cpu);
     CPUARMState *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     acc->parent_reset(s);
 
     memset(env, 0, offsetof(CPUARMState, breakpoints));
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index f6c4f3f..2abb57f 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -34,11 +34,6 @@ static void cris_cpu_reset(CPUState *s)
     CPUCRISState *env = &cpu->env;
     uint32_t vr;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     ccc->parent_reset(s);
 
     vr = env->pregs[PR_VR];
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 82a451b..e3f75a8 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2175,11 +2175,6 @@ static void x86_cpu_reset(CPUState *s)
     CPUX86State *env = &cpu->env;
     int i;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, CPU_DUMP_FPU | CPU_DUMP_CCOP);
-    }
-
     xcc->parent_reset(s);
 
 
@@ -2523,6 +2518,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 
     xcc->parent_reset = cc->reset;
     cc->reset = x86_cpu_reset;
+    cc->reset_dump_flags = CPU_DUMP_FPU | CPU_DUMP_CCOP;
 
     cc->do_interrupt = x86_cpu_do_interrupt;
     cc->dump_state = x86_cpu_dump_state;
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 6e44d45..04327ac 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -29,11 +29,6 @@ static void lm32_cpu_reset(CPUState *s)
     LM32CPUClass *lcc = LM32_CPU_GET_CLASS(cpu);
     CPULM32State *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     lcc->parent_reset(s);
 
     /* reset cpu state */
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index c9ac30f..1b6ef66 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -35,11 +35,6 @@ static void m68k_cpu_reset(CPUState *s)
     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(cpu);
     CPUM68KState *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     mcc->parent_reset(s);
 
     memset(env, 0, offsetof(CPUM68KState, breakpoints));
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index d93519e..dce1c7e 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -33,11 +33,6 @@ static void mb_cpu_reset(CPUState *s)
     MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(cpu);
     CPUMBState *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     mcc->parent_reset(s);
 
     memset(env, 0, offsetof(CPUMBState, breakpoints));
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index cab9572..60a3faf 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -29,11 +29,6 @@ static void mips_cpu_reset(CPUState *s)
     MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(cpu);
     CPUMIPSState *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     mcc->parent_reset(s);
 
     memset(env, 0, offsetof(CPUMIPSState, breakpoints));
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 7314d4b..92ca594 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -28,11 +28,6 @@ static void moxie_cpu_reset(CPUState *s)
     MoxieCPUClass *mcc = MOXIE_CPU_GET_CLASS(cpu);
     CPUMoxieState *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     mcc->parent_reset(s);
 
     memset(env, 0, offsetof(CPUMoxieState, breakpoints));
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index 0dc60c9..6d40f1b 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -26,11 +26,6 @@ static void openrisc_cpu_reset(CPUState *s)
     OpenRISCCPU *cpu = OPENRISC_CPU(s);
     OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(cpu);
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     occ->parent_reset(s);
 
     memset(&cpu->env, 0, offsetof(CPUOpenRISCState, breakpoints));
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 43eec67..b62f04a 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8171,11 +8171,6 @@ static void ppc_cpu_reset(CPUState *s)
     CPUPPCState *env = &cpu->env;
     target_ulong msr;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     pcc->parent_reset(s);
 
     msr = (target_ulong)0;
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 732d393..1ef2fc0 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -65,11 +65,6 @@ static void s390_cpu_reset(CPUState *s)
     S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
     CPUS390XState *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     s390_del_running_cpu(cpu);
 
     scc->parent_reset(s);
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 653acec..03487eb 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -31,11 +31,6 @@ static void superh_cpu_reset(CPUState *s)
     SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(cpu);
     CPUSH4State *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     scc->parent_reset(s);
 
     memset(env, 0, offsetof(CPUSH4State, breakpoints));
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 4cbb206..87c3a50 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -30,11 +30,6 @@ static void sparc_cpu_reset(CPUState *s)
     SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(cpu);
     CPUSPARCState *env = &cpu->env;
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(s, 0);
-    }
-
     scc->parent_reset(s);
 
     memset(env, 0, offsetof(CPUSPARCState, breakpoints));
commit 77710e7aec1e5ae0195cf6ebae6864e3ccb5693a
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 3 00:52:23 2013 +0200

    target-ppc: Change LOG_MMU_STATE() argument to CPUState
    
    Choose CPUState rather than PowerPCCPU since doing a CPU() cast on the
    macro argument would hide type mismatches.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/mmu-hash32.c b/target-ppc/mmu-hash32.c
index b5ebe07..6a77dc4 100644
--- a/target-ppc/mmu-hash32.c
+++ b/target-ppc/mmu-hash32.c
@@ -29,10 +29,10 @@
 
 #ifdef DEBUG_MMU
 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
-#  define LOG_MMU_STATE(env) log_cpu_state(CPU(ppc_env_get_cpu(env)), 0)
+#  define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
 #else
 #  define LOG_MMU(...) do { } while (0)
-#  define LOG_MMU_STATE(...) do { } while (0)
+#  define LOG_MMU_STATE(cpu) do { } while (0)
 #endif
 
 #ifdef DEBUG_BATS
diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
index 759cef3..67fc1b5 100644
--- a/target-ppc/mmu-hash64.c
+++ b/target-ppc/mmu-hash64.c
@@ -28,10 +28,10 @@
 
 #ifdef DEBUG_MMU
 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
-#  define LOG_MMU_STATE(env) log_cpu_state(CPU(ppc_env_get_cpu(env)), 0)
+#  define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
 #else
 #  define LOG_MMU(...) do { } while (0)
-#  define LOG_MMU_STATE(...) do { } while (0)
+#  define LOG_MMU_STATE(cpu) do { } while (0)
 #endif
 
 #ifdef DEBUG_SLB
diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index 413e95b..77102c4 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -32,10 +32,10 @@
 
 #ifdef DEBUG_MMU
 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
-#  define LOG_MMU_STATE(env) log_cpu_state(CPU(ppc_env_get_cpu(env)), 0)
+#  define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
 #else
 #  define LOG_MMU(...) do { } while (0)
-#  define LOG_MMU_STATE(...) do { } while (0)
+#  define LOG_MMU_STATE(cpu) do { } while (0)
 #endif
 
 #ifdef DEBUG_SOFTWARE_TLB
@@ -1508,7 +1508,7 @@ static int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address,
                      mmu_idx, TARGET_PAGE_SIZE);
         ret = 0;
     } else if (ret < 0) {
-        LOG_MMU_STATE(env);
+        LOG_MMU_STATE(CPU(ppc_env_get_cpu(env)));
         if (access_type == ACCESS_CODE) {
             switch (ret) {
             case -1:
commit 8995b7a083e0fda9fac1db3888b3dafe14bd033c
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 3 01:07:10 2013 +0200

    target-i386: Change LOG_PCALL_STATE() argument to CPUState
    
    Since log_cpu_state_mask() argument was changed to CPUState,
    CPUArchState is no longer needed.
    
    Choose CPUState rather than X86CPU to not hide type mismatches with CPU().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index fc7ffad..e789102 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -30,11 +30,11 @@
 
 #ifdef DEBUG_PCALL
 # define LOG_PCALL(...) qemu_log_mask(CPU_LOG_PCALL, ## __VA_ARGS__)
-# define LOG_PCALL_STATE(env)                                  \
-    log_cpu_state_mask(CPU_LOG_PCALL, CPU(x86_env_get_cpu(env)), CPU_DUMP_CCOP)
+# define LOG_PCALL_STATE(cpu)                                  \
+    log_cpu_state_mask(CPU_LOG_PCALL, (cpu), CPU_DUMP_CCOP)
 #else
 # define LOG_PCALL(...) do { } while (0)
-# define LOG_PCALL_STATE(env) do { } while (0)
+# define LOG_PCALL_STATE(cpu) do { } while (0)
 #endif
 
 /* return non zero if error */
@@ -1686,7 +1686,7 @@ void helper_lcall_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
 
     next_eip = env->eip + next_eip_addend;
     LOG_PCALL("lcall %04x:%08x s=%d\n", new_cs, (uint32_t)new_eip, shift);
-    LOG_PCALL_STATE(env);
+    LOG_PCALL_STATE(CPU(x86_env_get_cpu(env)));
     if ((new_cs & 0xfffc) == 0) {
         raise_exception_err(env, EXCP0D_GPF, 0);
     }
@@ -2020,7 +2020,7 @@ static inline void helper_ret_protected(CPUX86State *env, int shift,
     }
     LOG_PCALL("lret new %04x:" TARGET_FMT_lx " s=%d addend=0x%x\n",
               new_cs, new_eip, shift, addend);
-    LOG_PCALL_STATE(env);
+    LOG_PCALL_STATE(CPU(x86_env_get_cpu(env)));
     if ((new_cs & 0xfffc) == 0) {
         raise_exception_err(env, EXCP0D_GPF, new_cs & 0xfffc);
     }
commit a0762859ae2aae2e221c59e2541f964f1350d68b
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 16 07:28:50 2013 +0200

    log: Change log_cpu_state[_mask]() argument to CPUState
    
    Since commit 878096eeb278a8ac1ccd6667af73e026f29b4cf5 (cpu: Turn
    cpu_dump_{state,statistics}() into CPUState hooks) CPUArchState is no
    longer needed.
    
    Add documentation and make the functions available through qemu/log.h
    outside NEED_CPU_H to allow use in qom/cpu.c. Moving them to qom/cpu.h
    was not yet possible due to convoluted include paths, so that some
    devices grow an implicit and unneeded dependency on qom/cpu.h for now.
    
    Acked-by: Michael Walle <michael at walle.cc> (for lm32)
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    [AF: Simplified mb_cpu_do_interrupt() and do_interrupt_all() changes]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpu-exec.c b/cpu-exec.c
index 58a0674..6c784a7 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -577,15 +577,15 @@ int cpu_exec(CPUArchState *env)
                 if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
                     /* restore flags in standard format */
 #if defined(TARGET_I386)
-                    log_cpu_state(env, CPU_DUMP_CCOP);
+                    log_cpu_state(cpu, CPU_DUMP_CCOP);
 #elif defined(TARGET_M68K)
                     cpu_m68k_flush_flags(env, env->cc_op);
                     env->cc_op = CC_OP_FLAGS;
                     env->sr = (env->sr & 0xffe0)
                               | env->cc_dest | (env->cc_x << 4);
-                    log_cpu_state(env, 0);
+                    log_cpu_state(cpu, 0);
 #else
-                    log_cpu_state(env, 0);
+                    log_cpu_state(cpu, 0);
 #endif
                 }
 #endif /* DEBUG_DISAS */
diff --git a/exec.c b/exec.c
index 61b094a..f01e3b6 100644
--- a/exec.c
+++ b/exec.c
@@ -617,7 +617,7 @@ void cpu_abort(CPUArchState *env, const char *fmt, ...)
         qemu_log("qemu: fatal: ");
         qemu_log_vprintf(fmt, ap2);
         qemu_log("\n");
-        log_cpu_state(env, CPU_DUMP_FPU | CPU_DUMP_CCOP);
+        log_cpu_state(cpu, CPU_DUMP_FPU | CPU_DUMP_CCOP);
         qemu_log_flush();
         qemu_log_close();
     }
diff --git a/include/qemu/log.h b/include/qemu/log.h
index a9cf214..d515424 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -5,6 +5,7 @@
 #include <stdbool.h>
 #include <stdio.h>
 #include "qemu/compiler.h"
+#include "qom/cpu.h"
 #ifdef NEED_CPU_H
 #include "disas/disas.h"
 #endif
@@ -70,22 +71,37 @@ void GCC_FMT_ATTR(2, 3) qemu_log_mask(int mask, const char *fmt, ...);
 
 /* Special cases: */
 
-#ifdef NEED_CPU_H
 /* cpu_dump_state() logging functions: */
-static inline void log_cpu_state(CPUArchState *env1, int flags)
+/**
+ * log_cpu_state:
+ * @cpu: The CPU whose state is to be logged.
+ * @flags: Flags what to log.
+ *
+ * Logs the output of cpu_dump_state().
+ */
+static inline void log_cpu_state(CPUState *cpu, int flags)
 {
     if (qemu_log_enabled()) {
-        cpu_dump_state(ENV_GET_CPU(env1), qemu_logfile, fprintf, flags);
+        cpu_dump_state(cpu, qemu_logfile, fprintf, flags);
     }
 }
 
-static inline void log_cpu_state_mask(int mask, CPUArchState *env1, int flags)
+/**
+ * log_cpu_state_mask:
+ * @mask: Mask when to log.
+ * @cpu: The CPU whose state is to be logged.
+ * @flags: Flags what to log.
+ *
+ * Logs the output of cpu_dump_state() if loglevel includes @mask.
+ */
+static inline void log_cpu_state_mask(int mask, CPUState *cpu, int flags)
 {
     if (qemu_loglevel & mask) {
-        log_cpu_state(env1, flags);
+        log_cpu_state(cpu, flags);
     }
 }
 
+#ifdef NEED_CPU_H
 /* disas() and target_disas() to qemu_logfile: */
 static inline void log_target_disas(CPUArchState *env, target_ulong start,
                                     target_ulong len, int flags)
diff --git a/linux-user/main.c b/linux-user/main.c
index 67ea9ba..7f15d3d 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -1302,11 +1302,12 @@ int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
 
 #define EXCP_DUMP(env, fmt, ...)                                        \
 do {                                                                    \
+    CPUState *cs = ENV_GET_CPU(env);                                    \
     fprintf(stderr, fmt , ## __VA_ARGS__);                              \
-    cpu_dump_state(ENV_GET_CPU(env), stderr, fprintf, 0);               \
+    cpu_dump_state(cs, stderr, fprintf, 0);                             \
     qemu_log(fmt, ## __VA_ARGS__);                                      \
     if (qemu_log_enabled()) {                                           \
-        log_cpu_state(env, 0);                                          \
+        log_cpu_state(cs, 0);                                           \
     }                                                                   \
 } while (0)
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 1bc227e..84974a9 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -65,7 +65,7 @@ static void arm_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     acc->parent_reset(s);
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 6a3bdf0..f6c4f3f 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -36,7 +36,7 @@ static void cris_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     ccc->parent_reset(s);
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index b7416fe..82a451b 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2177,7 +2177,7 @@ static void x86_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, CPU_DUMP_FPU | CPU_DUMP_CCOP);
+        log_cpu_state(s, CPU_DUMP_FPU | CPU_DUMP_CCOP);
     }
 
     xcc->parent_reset(s);
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index 92caa84..fc7ffad 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -31,7 +31,7 @@
 #ifdef DEBUG_PCALL
 # define LOG_PCALL(...) qemu_log_mask(CPU_LOG_PCALL, ## __VA_ARGS__)
 # define LOG_PCALL_STATE(env)                                  \
-    log_cpu_state_mask(CPU_LOG_PCALL, (env), CPU_DUMP_CCOP)
+    log_cpu_state_mask(CPU_LOG_PCALL, CPU(x86_env_get_cpu(env)), CPU_DUMP_CCOP)
 #else
 # define LOG_PCALL(...) do { } while (0)
 # define LOG_PCALL_STATE(env) do { } while (0)
@@ -1182,7 +1182,7 @@ static void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
                 qemu_log(" env->regs[R_EAX]=" TARGET_FMT_lx, env->regs[R_EAX]);
             }
             qemu_log("\n");
-            log_cpu_state(env, CPU_DUMP_CCOP);
+            log_cpu_state(CPU(cpu), CPU_DUMP_CCOP);
 #if 0
             {
                 int i;
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index 78abe5b..6cb4551 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -48,7 +48,7 @@ void do_smm_enter(X86CPU *cpu)
     int i, offset;
 
     qemu_log_mask(CPU_LOG_INT, "SMM: enter\n");
-    log_cpu_state_mask(CPU_LOG_INT, env, CPU_DUMP_CCOP);
+    log_cpu_state_mask(CPU_LOG_INT, CPU(cpu), CPU_DUMP_CCOP);
 
     env->hflags |= HF_SMM_MASK;
     cpu_smm_update(env);
@@ -180,6 +180,7 @@ void do_smm_enter(X86CPU *cpu)
 
 void helper_rsm(CPUX86State *env)
 {
+    X86CPU *cpu = x86_env_get_cpu(env);
     target_ulong sm_state;
     int i, offset;
     uint32_t val;
@@ -296,7 +297,7 @@ void helper_rsm(CPUX86State *env)
     cpu_smm_update(env);
 
     qemu_log_mask(CPU_LOG_INT, "SMM: after RSM\n");
-    log_cpu_state_mask(CPU_LOG_INT, env, CPU_DUMP_CCOP);
+    log_cpu_state_mask(CPU_LOG_INT, CPU(cpu), CPU_DUMP_CCOP);
 }
 
 #endif /* !CONFIG_USER_ONLY */
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 02f8436..6e44d45 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -31,7 +31,7 @@ static void lm32_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     lcc->parent_reset(s);
diff --git a/target-lm32/helper.c b/target-lm32/helper.c
index 03fa5fb..615b44e 100644
--- a/target-lm32/helper.c
+++ b/target-lm32/helper.c
@@ -70,7 +70,7 @@ void lm32_cpu_do_interrupt(CPUState *cs)
         } else {
             env->pc = env->eba + (env->exception_index * 32);
         }
-        log_cpu_state_mask(CPU_LOG_INT, env, 0);
+        log_cpu_state_mask(CPU_LOG_INT, cs, 0);
         break;
     case EXCP_BREAKPOINT:
     case EXCP_WATCHPOINT:
@@ -79,7 +79,7 @@ void lm32_cpu_do_interrupt(CPUState *cs)
         env->ie |= (env->ie & IE_IE) ? IE_BIE : 0;
         env->ie &= ~IE_IE;
         env->pc = env->deba + (env->exception_index * 32);
-        log_cpu_state_mask(CPU_LOG_INT, env, 0);
+        log_cpu_state_mask(CPU_LOG_INT, cs, 0);
         break;
     default:
         cpu_abort(env, "unhandled exception type=%d\n",
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 799869f..c9ac30f 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -37,7 +37,7 @@ static void m68k_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     mcc->parent_reset(s);
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index a0fcdf4..d93519e 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -35,7 +35,7 @@ static void mb_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     mcc->parent_reset(s);
diff --git a/target-microblaze/helper.c b/target-microblaze/helper.c
index 01d4bbf..c6c96d4 100644
--- a/target-microblaze/helper.c
+++ b/target-microblaze/helper.c
@@ -152,7 +152,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
                           "hw exception at pc=%x ear=%x esr=%x iflags=%x\n",
                           env->sregs[SR_PC], env->sregs[SR_EAR],
                           env->sregs[SR_ESR], env->iflags);
-            log_cpu_state_mask(CPU_LOG_INT, env, 0);
+            log_cpu_state_mask(CPU_LOG_INT, cs, 0);
             env->iflags &= ~(IMM_FLAG | D_FLAG);
             env->sregs[SR_PC] = cpu->base_vectors + 0x20;
             break;
@@ -175,7 +175,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
                                   "bimm exception at pc=%x iflags=%x\n",
                                   env->sregs[SR_PC], env->iflags);
                     env->regs[17] -= 4;
-                    log_cpu_state_mask(CPU_LOG_INT, env, 0);
+                    log_cpu_state_mask(CPU_LOG_INT, cs, 0);
                 }
             } else if (env->iflags & IMM_FLAG) {
                 D(qemu_log("IMM_FLAG set at exception\n"));
@@ -192,7 +192,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
             qemu_log_mask(CPU_LOG_INT,
                           "exception at pc=%x ear=%x iflags=%x\n",
                           env->sregs[SR_PC], env->sregs[SR_EAR], env->iflags);
-            log_cpu_state_mask(CPU_LOG_INT, env, 0);
+            log_cpu_state_mask(CPU_LOG_INT, cs, 0);
             env->iflags &= ~(IMM_FLAG | D_FLAG);
             env->sregs[SR_PC] = cpu->base_vectors + 0x20;
             break;
@@ -222,7 +222,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
                          env->sregs[SR_PC], env->sregs[SR_MSR], t, env->iflags,
                          sym);
 
-                    log_cpu_state(env, 0);
+                    log_cpu_state(cs, 0);
                 }
             }
 #endif
@@ -236,7 +236,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
 
             env->regs[14] = env->sregs[SR_PC];
             env->sregs[SR_PC] = cpu->base_vectors + 0x10;
-            //log_cpu_state_mask(CPU_LOG_INT, env, 0);
+            //log_cpu_state_mask(CPU_LOG_INT, cs, 0);
             break;
 
         case EXCP_BREAK:
@@ -247,7 +247,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
             qemu_log_mask(CPU_LOG_INT,
                         "break at pc=%x msr=%x %x iflags=%x\n",
                         env->sregs[SR_PC], env->sregs[SR_MSR], t, env->iflags);
-            log_cpu_state_mask(CPU_LOG_INT, env, 0);
+            log_cpu_state_mask(CPU_LOG_INT, cs, 0);
             env->sregs[SR_MSR] &= ~(MSR_VMS | MSR_UMS | MSR_VM | MSR_UM);
             env->sregs[SR_MSR] |= t;
             env->sregs[SR_MSR] |= MSR_BIP;
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index b5cb141..eba255b 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1777,7 +1777,7 @@ gen_intermediate_code_internal(MicroBlazeCPU *cpu, TranslationBlock *tb,
     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
 #if !SIM_COMPAT
         qemu_log("--------------\n");
-        log_cpu_state(env, 0);
+        log_cpu_state(CPU(cpu), 0);
 #endif
     }
 
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index b61e207..cab9572 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -31,7 +31,7 @@ static void mips_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     mcc->parent_reset(s);
diff --git a/target-mips/helper.c b/target-mips/helper.c
index 36929dd..6983b92 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -276,7 +276,7 @@ int cpu_mips_handle_mmu_fault (CPUMIPSState *env, target_ulong address, int rw,
     int ret = 0;
 
 #if 0
-    log_cpu_state(env, 0);
+    log_cpu_state(CPU(mips_env_get_cpu(env)), 0);
 #endif
     qemu_log("%s pc " TARGET_FMT_lx " ad " TARGET_FMT_lx " rw %d mmu_idx %d\n",
               __func__, env->active_tc.PC, address, rw, mmu_idx);
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index f3c0d22..7314d4b 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -30,7 +30,7 @@ static void moxie_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     mcc->parent_reset(s);
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index d38c28b..0dc60c9 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -28,7 +28,7 @@ static void openrisc_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(&cpu->env, 0);
+        log_cpu_state(s, 0);
     }
 
     occ->parent_reset(s);
diff --git a/target-openrisc/translate.c b/target-openrisc/translate.c
index c59fd02..f222834 100644
--- a/target-openrisc/translate.c
+++ b/target-openrisc/translate.c
@@ -1684,7 +1684,7 @@ static inline void gen_intermediate_code_internal(OpenRISCCPU *cpu,
     dc->singlestep_enabled = cpu->env.singlestep_enabled;
     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
         qemu_log("-----------------------------------------\n");
-        log_cpu_state(&cpu->env, 0);
+        log_cpu_state(CPU(cpu), 0);
     }
 
     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
diff --git a/target-ppc/mmu-hash32.c b/target-ppc/mmu-hash32.c
index f6adf22..b5ebe07 100644
--- a/target-ppc/mmu-hash32.c
+++ b/target-ppc/mmu-hash32.c
@@ -29,7 +29,7 @@
 
 #ifdef DEBUG_MMU
 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
-#  define LOG_MMU_STATE(env) log_cpu_state((env), 0)
+#  define LOG_MMU_STATE(env) log_cpu_state(CPU(ppc_env_get_cpu(env)), 0)
 #else
 #  define LOG_MMU(...) do { } while (0)
 #  define LOG_MMU_STATE(...) do { } while (0)
diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
index 5c67ec3..759cef3 100644
--- a/target-ppc/mmu-hash64.c
+++ b/target-ppc/mmu-hash64.c
@@ -28,7 +28,7 @@
 
 #ifdef DEBUG_MMU
 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
-#  define LOG_MMU_STATE(env) log_cpu_state((env), 0)
+#  define LOG_MMU_STATE(env) log_cpu_state(CPU(ppc_env_get_cpu(env)), 0)
 #else
 #  define LOG_MMU(...) do { } while (0)
 #  define LOG_MMU_STATE(...) do { } while (0)
diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index e4e111c..413e95b 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -32,7 +32,7 @@
 
 #ifdef DEBUG_MMU
 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
-#  define LOG_MMU_STATE(env) log_cpu_state((env), 0)
+#  define LOG_MMU_STATE(env) log_cpu_state(CPU(ppc_env_get_cpu(env)), 0)
 #else
 #  define LOG_MMU(...) do { } while (0)
 #  define LOG_MMU_STATE(...) do { } while (0)
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 50e0ee5..43eec67 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8173,7 +8173,7 @@ static void ppc_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     pcc->parent_reset(s);
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index c3697cd..732d393 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -67,7 +67,7 @@ static void s390_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     s390_del_running_cpu(cpu);
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index e739156..653acec 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -33,7 +33,7 @@ static void superh_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     scc->parent_reset(s);
diff --git a/target-sh4/helper.c b/target-sh4/helper.c
index ce10ca8..cb6a2d2 100644
--- a/target-sh4/helper.c
+++ b/target-sh4/helper.c
@@ -159,7 +159,7 @@ void superh_cpu_do_interrupt(CPUState *cs)
 	}
 	qemu_log("exception 0x%03x [%s] raised\n",
 		  irq_vector, expname);
-	log_cpu_state(env, 0);
+        log_cpu_state(cs, 0);
     }
 
     env->ssr = env->sr;
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 65ae6f7..4cbb206 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -32,7 +32,7 @@ static void sparc_cpu_reset(CPUState *s)
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", s->cpu_index);
-        log_cpu_state(env, 0);
+        log_cpu_state(s, 0);
     }
 
     scc->parent_reset(s);
diff --git a/target-sparc/int32_helper.c b/target-sparc/int32_helper.c
index 7221460..d532238 100644
--- a/target-sparc/int32_helper.c
+++ b/target-sparc/int32_helper.c
@@ -86,7 +86,7 @@ void sparc_cpu_do_interrupt(CPUState *cs)
         }
 
         qemu_log("%6d: %s (v=%02x)\n", count, name, intno);
-        log_cpu_state(env, 0);
+        log_cpu_state(cs, 0);
 #if 0
         {
             int i;
diff --git a/target-sparc/int64_helper.c b/target-sparc/int64_helper.c
index f411884..bf7dd86 100644
--- a/target-sparc/int64_helper.c
+++ b/target-sparc/int64_helper.c
@@ -92,7 +92,7 @@ void sparc_cpu_do_interrupt(CPUState *cs)
         }
 
         qemu_log("%6d: %s (v=%04x)\n", count, name, intno);
-        log_cpu_state(env, 0);
+        log_cpu_state(cs, 0);
 #if 0
         {
             int i;
commit 518e9d7d486273f4ee8d38946e73a7483aca4a92
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 3 02:45:17 2013 +0200

    target-i386: Change do_smm_enter() argument to X86CPU
    
    Prepares for log_cpu_state_mask() changing argument to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpu-exec.c b/cpu-exec.c
index 503b103..58a0674 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -331,7 +331,7 @@ int cpu_exec(CPUArchState *env)
                             cpu_svm_check_intercept_param(env, SVM_EXIT_SMI,
                                                           0);
                             cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
-                            do_smm_enter(env);
+                            do_smm_enter(x86_env_get_cpu(env));
                             next_tb = 0;
                         } else if ((interrupt_request & CPU_INTERRUPT_NMI) &&
                                    !(env->hflags2 & HF2_NMI_MASK)) {
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 2849672..2d005b3 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1220,7 +1220,7 @@ void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1);
 /* seg_helper.c */
 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw);
 
-void do_smm_enter(CPUX86State *env1);
+void do_smm_enter(X86CPU *cpu);
 
 void cpu_report_tpr_access(CPUX86State *env, TPRAccess access);
 
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index 2489573..78abe5b 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -24,7 +24,7 @@
 
 #if defined(CONFIG_USER_ONLY)
 
-void do_smm_enter(CPUX86State *env)
+void do_smm_enter(X86CPU *cpu)
 {
 }
 
@@ -40,8 +40,9 @@ void helper_rsm(CPUX86State *env)
 #define SMM_REVISION_ID 0x00020000
 #endif
 
-void do_smm_enter(CPUX86State *env)
+void do_smm_enter(X86CPU *cpu)
 {
+    CPUX86State *env = &cpu->env;
     target_ulong sm_state;
     SegmentCache *dt;
     int i, offset;
commit ca4c810aab853788e907a791f8edea68ac30b0e8
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 3 02:00:09 2013 +0200

    target-i386: Change do_interrupt_all() argument to X86CPU
    
    Prepares for log_cpu_state() changing argument to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index 9c799e1..92caa84 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -1160,9 +1160,11 @@ static void handle_even_inj(CPUX86State *env, int intno, int is_int,
  * the int instruction. next_eip is the env->eip value AFTER the interrupt
  * instruction. It is only relevant if is_int is TRUE.
  */
-static void do_interrupt_all(CPUX86State *env, int intno, int is_int,
+static void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
                              int error_code, target_ulong next_eip, int is_hw)
 {
+    CPUX86State *env = &cpu->env;
+
     if (qemu_loglevel_mask(CPU_LOG_INT)) {
         if ((env->cr[0] & CR0_PE_MASK)) {
             static int count;
@@ -1252,7 +1254,7 @@ void x86_cpu_do_interrupt(CPUState *cs)
     /* simulate a real cpu exception. On i386, it can
        trigger new exceptions, but we do not handle
        double or triple faults yet. */
-    do_interrupt_all(env, env->exception_index,
+    do_interrupt_all(cpu, env->exception_index,
                      env->exception_is_int,
                      env->error_code,
                      env->exception_next_eip, 0);
@@ -1263,7 +1265,7 @@ void x86_cpu_do_interrupt(CPUState *cs)
 
 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw)
 {
-    do_interrupt_all(env, intno, 0, 0, 0, is_hw);
+    do_interrupt_all(x86_env_get_cpu(env), intno, 0, 0, 0, is_hw);
 }
 
 void helper_enter_level(CPUX86State *env, int level, int data32,
commit 90b85b7706e2f80a1f0aa148e180ed70e4093846
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:33:01 2013 +0200

    target-xtensa: Change gen_intermediate_code_internal() arg to XtensaCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
index e384812..e4cf828 100644
--- a/target-xtensa/translate.c
+++ b/target-xtensa/translate.c
@@ -2876,9 +2876,10 @@ static void gen_ibreak_check(CPUXtensaState *env, DisasContext *dc)
 }
 
 static inline
-void gen_intermediate_code_internal(CPUXtensaState *env,
-                                    TranslationBlock *tb, int search_pc)
+void gen_intermediate_code_internal(XtensaCPU *cpu,
+                                    TranslationBlock *tb, bool search_pc)
 {
+    CPUXtensaState *env = &cpu->env;
     DisasContext dc;
     int insn_count = 0;
     int j, lj = -1;
@@ -3007,12 +3008,12 @@ void gen_intermediate_code_internal(CPUXtensaState *env,
 
 void gen_intermediate_code(CPUXtensaState *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(xtensa_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPUXtensaState *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(xtensa_env_get_cpu(env), tb, true);
 }
 
 void xtensa_cpu_dump_state(CPUState *cs, FILE *f,
commit 62a80559368de7b2dedc91039d8d11650e31ba4c
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:29:57 2013 +0200

    target-unicore32: Change gen_intermediate_code_internal() signature
    
    Use UniCore32CPU and bool.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-unicore32/translate.c b/target-unicore32/translate.c
index e1fe4e6..d85185d 100644
--- a/target-unicore32/translate.c
+++ b/target-unicore32/translate.c
@@ -1876,9 +1876,10 @@ static void disas_uc32_insn(CPUUniCore32State *env, DisasContext *s)
 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
    basic block 'tb'. If search_pc is TRUE, also generate PC
    information for each intermediate instruction. */
-static inline void gen_intermediate_code_internal(CPUUniCore32State *env,
-        TranslationBlock *tb, int search_pc)
+static inline void gen_intermediate_code_internal(UniCore32CPU *cpu,
+        TranslationBlock *tb, bool search_pc)
 {
+    CPUUniCore32State *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     CPUBreakpoint *bp;
     uint16_t *gen_opc_end;
@@ -2065,12 +2066,12 @@ done_generating:
 
 void gen_intermediate_code(CPUUniCore32State *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(uc32_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPUUniCore32State *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(uc32_env_get_cpu(env), tb, true);
 }
 
 static const char *cpu_mode_names[16] = {
commit 68a471556d911a0adcf639e5fd5af2a2be4c4cb1
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:27:28 2013 +0200

    target-sparc: Change gen_intermediate_code_internal() argument to SPARCCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-sparc/translate.c b/target-sparc/translate.c
index eb6e800..5e771e5 100644
--- a/target-sparc/translate.c
+++ b/target-sparc/translate.c
@@ -5219,9 +5219,11 @@ static void disas_sparc_insn(DisasContext * dc, unsigned int insn)
     }
 }
 
-static inline void gen_intermediate_code_internal(TranslationBlock * tb,
-                                                  int spc, CPUSPARCState *env)
+static inline void gen_intermediate_code_internal(SPARCCPU *cpu,
+                                                  TranslationBlock *tb,
+                                                  bool spc)
 {
+    CPUSPARCState *env = &cpu->env;
     target_ulong pc_start, last_pc;
     uint16_t *gen_opc_end;
     DisasContext dc1, *dc = &dc1;
@@ -5347,12 +5349,12 @@ static inline void gen_intermediate_code_internal(TranslationBlock * tb,
 
 void gen_intermediate_code(CPUSPARCState * env, TranslationBlock * tb)
 {
-    gen_intermediate_code_internal(tb, 0, env);
+    gen_intermediate_code_internal(sparc_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPUSPARCState * env, TranslationBlock * tb)
 {
-    gen_intermediate_code_internal(tb, 1, env);
+    gen_intermediate_code_internal(sparc_env_get_cpu(env), tb, true);
 }
 
 void gen_intermediate_code_init(CPUSPARCState *env)
commit 38e308103d40d859e2da74166fd4a1a80d78106d
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:24:41 2013 +0200

    target-sh4: Change gen_intermediate_code_internal() argument to SuperHCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 292c9e9..2fbe668 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -1846,9 +1846,10 @@ static void decode_opc(DisasContext * ctx)
 }
 
 static inline void
-gen_intermediate_code_internal(CPUSH4State * env, TranslationBlock * tb,
-                               int search_pc)
+gen_intermediate_code_internal(SuperHCPU *cpu, TranslationBlock *tb,
+                               bool search_pc)
 {
+    CPUSH4State *env = &cpu->env;
     DisasContext ctx;
     target_ulong pc_start;
     static uint16_t *gen_opc_end;
@@ -1969,12 +1970,12 @@ gen_intermediate_code_internal(CPUSH4State * env, TranslationBlock * tb,
 
 void gen_intermediate_code(CPUSH4State * env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(sh_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPUSH4State * env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(sh_env_get_cpu(env), tb, true);
 }
 
 void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb, int pc_pos)
commit d9916c23d3024ce2ae7f6300a7b4e62780e4632b
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:22:09 2013 +0200

    target-s390x: Change gen_intermediate_code_internal() argument to S390CPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-s390x/translate.c b/target-s390x/translate.c
index cd9880e..cba7b87 100644
--- a/target-s390x/translate.c
+++ b/target-s390x/translate.c
@@ -4736,10 +4736,11 @@ static ExitStatus translate_one(CPUS390XState *env, DisasContext *s)
     return ret;
 }
 
-static inline void gen_intermediate_code_internal(CPUS390XState *env,
+static inline void gen_intermediate_code_internal(S390CPU *cpu,
                                                   TranslationBlock *tb,
-                                                  int search_pc)
+                                                  bool search_pc)
 {
+    CPUS390XState *env = &cpu->env;
     DisasContext dc;
     target_ulong pc_start;
     uint64_t next_page_start;
@@ -4872,12 +4873,12 @@ static inline void gen_intermediate_code_internal(CPUS390XState *env,
 
 void gen_intermediate_code (CPUS390XState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(s390_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc (CPUS390XState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(s390_env_get_cpu(env), tb, true);
 }
 
 void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb, int pc_pos)
commit 213fe1f5135abe052b634e08fddf6e9945f0eeed
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:19:32 2013 +0200

    target-ppc: Change gen_intermediate_code_internal() argument to PowerPCCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 3643863..eb96272 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -9726,10 +9726,11 @@ void ppc_cpu_dump_statistics(CPUState *cs, FILE*f,
 }
 
 /*****************************************************************************/
-static inline void gen_intermediate_code_internal(CPUPPCState *env,
+static inline void gen_intermediate_code_internal(PowerPCCPU *cpu,
                                                   TranslationBlock *tb,
-                                                  int search_pc)
+                                                  bool search_pc)
 {
+    CPUPPCState *env = &cpu->env;
     DisasContext ctx, *ctxp = &ctx;
     opc_handler_t **table, *handler;
     target_ulong pc_start;
@@ -9917,12 +9918,12 @@ static inline void gen_intermediate_code_internal(CPUPPCState *env,
 
 void gen_intermediate_code (CPUPPCState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(ppc_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc (CPUPPCState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(ppc_env_get_cpu(env), tb, true);
 }
 
 void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb, int pc_pos)
commit 6429db34c11f8cbb2af446a9c1c80395794e6113
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:17:17 2013 +0200

    target-mips: Change gen_intermediate_code_internal() argument to MIPSCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-mips/translate.c b/target-mips/translate.c
index 160c0c0..8246c20 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -15540,9 +15540,10 @@ static void decode_opc (CPUMIPSState *env, DisasContext *ctx, int *is_branch)
 }
 
 static inline void
-gen_intermediate_code_internal (CPUMIPSState *env, TranslationBlock *tb,
-                                int search_pc)
+gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
+                               bool search_pc)
 {
+    CPUMIPSState *env = &cpu->env;
     DisasContext ctx;
     target_ulong pc_start;
     uint16_t *gen_opc_end;
@@ -15698,12 +15699,12 @@ done_generating:
 
 void gen_intermediate_code (CPUMIPSState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(mips_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc (CPUMIPSState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(mips_env_get_cpu(env), tb, true);
 }
 
 static void fpu_dump_state(CPUMIPSState *env, FILE *f, fprintf_function fpu_fprintf,
commit 4a274212f03adaf8b5971cc39d460335392a97f6
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:14:44 2013 +0200

    target-microblaze: Change gen_intermediate_code_internal() argument types
    
    Use MicroBlazeCPU and bool.
    
    Prepares for changing log_cpu_state() argument to CPUState and for
    moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index 27da4bf..b5cb141 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1738,9 +1738,10 @@ static void check_breakpoint(CPUMBState *env, DisasContext *dc)
 
 /* generate intermediate code for basic block 'tb'.  */
 static inline void
-gen_intermediate_code_internal(CPUMBState *env, TranslationBlock *tb,
-                               int search_pc)
+gen_intermediate_code_internal(MicroBlazeCPU *cpu, TranslationBlock *tb,
+                               bool search_pc)
 {
+    CPUMBState *env = &cpu->env;
     uint16_t *gen_opc_end;
     uint32_t pc_start;
     int j, lj;
@@ -1941,12 +1942,12 @@ gen_intermediate_code_internal(CPUMBState *env, TranslationBlock *tb,
 
 void gen_intermediate_code (CPUMBState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(mb_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc (CPUMBState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(mb_env_get_cpu(env), tb, true);
 }
 
 void mb_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
commit c296b15b7c2425a2973ad0e63810029913511b51
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:11:36 2013 +0200

    target-m68k: Change gen_intermediate_code_internal() argument to M68kCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-m68k/translate.c b/target-m68k/translate.c
index 3752094..2d73af5 100644
--- a/target-m68k/translate.c
+++ b/target-m68k/translate.c
@@ -2971,9 +2971,10 @@ static void disas_m68k_insn(CPUM68KState * env, DisasContext *s)
 
 /* generate intermediate code for basic block 'tb'.  */
 static inline void
-gen_intermediate_code_internal(CPUM68KState *env, TranslationBlock *tb,
-                               int search_pc)
+gen_intermediate_code_internal(M68kCPU *cpu, TranslationBlock *tb,
+                               bool search_pc)
 {
+    CPUM68KState *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     uint16_t *gen_opc_end;
     CPUBreakpoint *bp;
@@ -3096,12 +3097,12 @@ gen_intermediate_code_internal(CPUM68KState *env, TranslationBlock *tb,
 
 void gen_intermediate_code(CPUM68KState *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(m68k_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPUM68KState *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(m68k_env_get_cpu(env), tb, true);
 }
 
 void m68k_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
commit cd0db97ee050ccea7082361a1193a3bef5648454
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:09:30 2013 +0200

    target-lm32: Change gen_intermediate_code_internal() argument to LM32CPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-lm32/translate.c b/target-lm32/translate.c
index 7d82dc7..ed12f50 100644
--- a/target-lm32/translate.c
+++ b/target-lm32/translate.c
@@ -1012,9 +1012,10 @@ static void check_breakpoint(CPULM32State *env, DisasContext *dc)
 
 /* generate intermediate code for basic block 'tb'.  */
 static inline
-void gen_intermediate_code_internal(CPULM32State *env,
-                                    TranslationBlock *tb, int search_pc)
+void gen_intermediate_code_internal(LM32CPU *cpu,
+                                    TranslationBlock *tb, bool search_pc)
 {
+    CPULM32State *env = &cpu->env;
     struct DisasContext ctx, *dc = &ctx;
     uint16_t *gen_opc_end;
     uint32_t pc_start;
@@ -1134,12 +1135,12 @@ void gen_intermediate_code_internal(CPULM32State *env,
 
 void gen_intermediate_code(CPULM32State *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(lm32_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPULM32State *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(lm32_env_get_cpu(env), tb, true);
 }
 
 void lm32_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
commit 467215c20f4befed253696dd6910839bacf75837
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:09:01 2013 +0200

    target-i386: Change gen_intermediate_code_internal() argument to X86CPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/translate.c b/target-i386/translate.c
index 14b0298..6550c27 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -8251,10 +8251,11 @@ void optimize_flags_init(void)
 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
    basic block 'tb'. If search_pc is TRUE, also generate PC
    information for each intermediate instruction. */
-static inline void gen_intermediate_code_internal(CPUX86State *env,
+static inline void gen_intermediate_code_internal(X86CPU *cpu,
                                                   TranslationBlock *tb,
-                                                  int search_pc)
+                                                  bool search_pc)
 {
+    CPUX86State *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     target_ulong pc_ptr;
     uint16_t *gen_opc_end;
@@ -8428,12 +8429,12 @@ static inline void gen_intermediate_code_internal(CPUX86State *env,
 
 void gen_intermediate_code(CPUX86State *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(x86_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPUX86State *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(x86_env_get_cpu(env), tb, true);
 }
 
 void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb, int pc_pos)
commit 7fd2592dbcc0130e9999a739867a1b539c5ee853
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:04:49 2013 +0200

    target-cris: Change gen_intermediate_code_internal() argument to CRISCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-cris/translate.c b/target-cris/translate.c
index ee9ae22..1de9743 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3162,9 +3162,10 @@ static void check_breakpoint(CPUCRISState *env, DisasContext *dc)
 
 /* generate intermediate code for basic block 'tb'.  */
 static inline void
-gen_intermediate_code_internal(CPUCRISState *env, TranslationBlock *tb,
-                               int search_pc)
+gen_intermediate_code_internal(CRISCPU *cpu, TranslationBlock *tb,
+                               bool search_pc)
 {
+    CPUCRISState *env = &cpu->env;
     uint16_t *gen_opc_end;
     uint32_t pc_start;
     unsigned int insn_len;
@@ -3419,12 +3420,12 @@ gen_intermediate_code_internal(CPUCRISState *env, TranslationBlock *tb,
 
 void gen_intermediate_code (CPUCRISState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(cris_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc (CPUCRISState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(cris_env_get_cpu(env), tb, true);
 }
 
 void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
commit 5639c3f224bbe3095ce6584bc8a5ace68b6d8197
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 21:57:04 2013 +0200

    target-arm: Change gen_intermediate_code_internal() argument to ARMCPU
    
    Also use bool type while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-arm/translate.c b/target-arm/translate.c
index af2aef2..9310c58 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -9796,10 +9796,11 @@ undef:
 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
    basic block 'tb'. If search_pc is TRUE, also generate PC
    information for each intermediate instruction. */
-static inline void gen_intermediate_code_internal(CPUARMState *env,
+static inline void gen_intermediate_code_internal(ARMCPU *cpu,
                                                   TranslationBlock *tb,
-                                                  int search_pc)
+                                                  bool search_pc)
 {
+    CPUARMState *env = &cpu->env;
     DisasContext dc1, *dc = &dc1;
     CPUBreakpoint *bp;
     uint16_t *gen_opc_end;
@@ -10072,12 +10073,12 @@ done_generating:
 
 void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(arm_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc(CPUARMState *env, TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(arm_env_get_cpu(env), tb, true);
 }
 
 static const char *cpu_mode_names[16] = {
commit 86a35f7c4608b1961a1a459659a97033cc14d274
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 22:01:20 2013 +0200

    target-alpha: Change gen_intermediate_code_internal() argument to AlphaCPU
    
    Also use bool argument while at it.
    
    Prepares for moving singlestep_enabled field to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index 4db16db..dd7f0fb 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -3375,10 +3375,11 @@ static ExitStatus translate_one(DisasContext *ctx, uint32_t insn)
     return ret;
 }
 
-static inline void gen_intermediate_code_internal(CPUAlphaState *env,
+static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
                                                   TranslationBlock *tb,
-                                                  int search_pc)
+                                                  bool search_pc)
 {
+    CPUAlphaState *env = &cpu->env;
     DisasContext ctx, *ctxp = &ctx;
     target_ulong pc_start;
     uint32_t insn;
@@ -3502,12 +3503,12 @@ static inline void gen_intermediate_code_internal(CPUAlphaState *env,
 
 void gen_intermediate_code (CPUAlphaState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(alpha_env_get_cpu(env), tb, false);
 }
 
 void gen_intermediate_code_pc (CPUAlphaState *env, struct TranslationBlock *tb)
 {
-    gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(alpha_env_get_cpu(env), tb, true);
 }
 
 void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb, int pc_pos)
commit ae06d4988d6799f0bd16f27c2bcf80fa1cd2cfd7
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jul 2 20:05:21 2013 +0200

    target-xtensa: gen_intermediate_code_internal() should be inlined
    
    Cc: qemu-stable at nongnu.org
    Reported-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
index dcb90a5..e384812 100644
--- a/target-xtensa/translate.c
+++ b/target-xtensa/translate.c
@@ -2875,8 +2875,9 @@ static void gen_ibreak_check(CPUXtensaState *env, DisasContext *dc)
     }
 }
 
-static void gen_intermediate_code_internal(
-        CPUXtensaState *env, TranslationBlock *tb, int search_pc)
+static inline
+void gen_intermediate_code_internal(CPUXtensaState *env,
+                                    TranslationBlock *tb, int search_pc)
 {
     DisasContext dc;
     int insn_count = 0;
commit 13cccc692818a570d1fb1326c84d3edae68987aa
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jul 2 20:04:28 2013 +0200

    target-moxie: gen_intermediate_code_internal() should be inlined
    
    Cc: qemu-stable at nongnu.org
    Reported-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-moxie/translate.c b/target-moxie/translate.c
index b0ae38a..664d359 100644
--- a/target-moxie/translate.c
+++ b/target-moxie/translate.c
@@ -820,7 +820,7 @@ static int decode_opc(MoxieCPU *cpu, DisasContext *ctx)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-static void
+static inline void
 gen_intermediate_code_internal(MoxieCPU *cpu, TranslationBlock *tb,
                                bool search_pc)
 {
commit fd327f48f7e5892318b6dca2c9c6030618f65728
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jul 2 20:03:00 2013 +0200

    target-microblaze: gen_intermediate_code_internal() should be inlined
    
    Cc: qemu-stable at nongnu.org
    Reported-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index 54f439f..27da4bf 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1737,7 +1737,7 @@ static void check_breakpoint(CPUMBState *env, DisasContext *dc)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-static void
+static inline void
 gen_intermediate_code_internal(CPUMBState *env, TranslationBlock *tb,
                                int search_pc)
 {
commit 28014bcab244e968cb03f20384943494bd069ee0
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jul 2 19:35:02 2013 +0200

    target-lm32: gen_intermediate_code_internal() should be inlined
    
    Cc: qemu-stable at nongnu.org
    Reported-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Michael Walle <michael at walle.cc>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-lm32/translate.c b/target-lm32/translate.c
index 227a801..7d82dc7 100644
--- a/target-lm32/translate.c
+++ b/target-lm32/translate.c
@@ -1011,8 +1011,9 @@ static void check_breakpoint(CPULM32State *env, DisasContext *dc)
 }
 
 /* generate intermediate code for basic block 'tb'.  */
-static void gen_intermediate_code_internal(CPULM32State *env,
-        TranslationBlock *tb, int search_pc)
+static inline
+void gen_intermediate_code_internal(CPULM32State *env,
+                                    TranslationBlock *tb, int search_pc)
 {
     struct DisasContext ctx, *dc = &ctx;
     uint16_t *gen_opc_end;
commit 6f47ec50db92b4bc77de06661a9e7a3eb538b660
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jul 2 19:30:14 2013 +0200

    target-cris: gen_intermediate_code_internal() should be inlined
    
    Cc: qemu-stable at nongnu.org
    Reported-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-cris/translate.c b/target-cris/translate.c
index 09d0d2b..ee9ae22 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3161,7 +3161,7 @@ static void check_breakpoint(CPUCRISState *env, DisasContext *dc)
  */
 
 /* generate intermediate code for basic block 'tb'.  */
-static void
+static inline void
 gen_intermediate_code_internal(CPUCRISState *env, TranslationBlock *tb,
                                int search_pc)
 {
commit 369ff018fee40ffb8f6721e5d7f6b56bea74176c
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jun 26 17:51:27 2013 +0200

    target-i386: Don't overuse CPUArchState
    
    Use CPUX86State instead in dump support code.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/arch_dump.c b/target-i386/arch_dump.c
index d133228..10dc228 100644
--- a/target-i386/arch_dump.c
+++ b/target-i386/arch_dump.c
@@ -35,7 +35,7 @@ typedef struct {
 } x86_64_elf_prstatus;
 
 static int x86_64_write_elf64_note(WriteCoreDumpFunction f,
-                                   CPUArchState *env, int id,
+                                   CPUX86State *env, int id,
                                    void *opaque)
 {
     x86_64_user_regs_struct regs;
@@ -119,7 +119,7 @@ typedef struct {
     char pad3[4];
 } x86_elf_prstatus;
 
-static void x86_fill_elf_prstatus(x86_elf_prstatus *prstatus, CPUArchState *env,
+static void x86_fill_elf_prstatus(x86_elf_prstatus *prstatus, CPUX86State *env,
                                   int id)
 {
     memset(prstatus, 0, sizeof(x86_elf_prstatus));
@@ -144,7 +144,7 @@ static void x86_fill_elf_prstatus(x86_elf_prstatus *prstatus, CPUArchState *env,
     prstatus->pid = id;
 }
 
-static int x86_write_elf64_note(WriteCoreDumpFunction f, CPUArchState *env,
+static int x86_write_elf64_note(WriteCoreDumpFunction f, CPUX86State *env,
                                 int id, void *opaque)
 {
     x86_elf_prstatus prstatus;
@@ -274,7 +274,7 @@ static void copy_segment(QEMUCPUSegment *d, SegmentCache *s)
     d->base = s->base;
 }
 
-static void qemu_get_cpustate(QEMUCPUState *s, CPUArchState *env)
+static void qemu_get_cpustate(QEMUCPUState *s, CPUX86State *env)
 {
     memset(s, 0, sizeof(QEMUCPUState));
 
@@ -321,7 +321,7 @@ static void qemu_get_cpustate(QEMUCPUState *s, CPUArchState *env)
 }
 
 static inline int cpu_write_qemu_note(WriteCoreDumpFunction f,
-                                      CPUArchState *env,
+                                      CPUX86State *env,
                                       void *opaque,
                                       int type)
 {
commit 4fd6dd06e66a93fce31b05909ad8d9f0f9dba06e
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 17:17:00 2013 +0200

    target-s390x: Change handle_{hypercall,diag}() argument to S390CPU
    
    This allows to get rid of the last remaining ENV_GET_CPU() in
    target-s390x/ by using CPU() cast directly on the argument.
    
    Cc: Jason J. Herne <jjherne at us.ibm.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index af499cf..60e94f8 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -607,9 +607,10 @@ static int handle_priv(S390CPU *cpu, struct kvm_run *run,
     return r;
 }
 
-static int handle_hypercall(CPUS390XState *env, struct kvm_run *run)
+static int handle_hypercall(S390CPU *cpu, struct kvm_run *run)
 {
-    CPUState *cs = ENV_GET_CPU(env);
+    CPUState *cs = CPU(cpu);
+    CPUS390XState *env = &cpu->env;
 
     kvm_s390_get_registers_partial(cs);
     cs->kvm_vcpu_dirty = true;
@@ -618,13 +619,13 @@ static int handle_hypercall(CPUS390XState *env, struct kvm_run *run)
     return 0;
 }
 
-static int handle_diag(CPUS390XState *env, struct kvm_run *run, int ipb_code)
+static int handle_diag(S390CPU *cpu, struct kvm_run *run, int ipb_code)
 {
     int r = 0;
 
     switch (ipb_code) {
         case DIAG_KVM_HYPERCALL:
-            r = handle_hypercall(env, run);
+            r = handle_hypercall(cpu, run);
             break;
         case DIAG_KVM_BREAKPOINT:
             sleep(10);
@@ -735,7 +736,6 @@ out:
 
 static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
 {
-    CPUS390XState *env = &cpu->env;
     unsigned int ipa0 = (run->s390_sieic.ipa & 0xff00);
     uint8_t ipa1 = run->s390_sieic.ipa & 0x00ff;
     int ipb_code = (run->s390_sieic.ipb & 0x0fff0000) >> 16;
@@ -749,7 +749,7 @@ static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
         r = handle_priv(cpu, run, ipa0 >> 8, ipa1);
         break;
     case IPA0_DIAG:
-        r = handle_diag(env, run, ipb_code);
+        r = handle_diag(cpu, run, ipb_code);
         break;
     case IPA0_SIGP:
         r = handle_sigp(cpu, run, ipa1);
commit 19079e460520053114127f812ddc488b974c2117
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 17:04:45 2013 +0200

    target-s390x: Don't overuse ENV_GET_CPU()
    
    Commit 3474b679486caa8f6448bae974e131370f360c13 (Utilize selective
    runtime reg sync for hot code paths) introduced two uses of
    ENV_GET_CPU() inside target-s390x/ KVM code. In one case we can use a
    direct CPU() cast instead.
    
    Cc: Jason J. Herne <jjherne at us.ibm.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 42f758f..af499cf 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -469,7 +469,7 @@ static int kvm_handle_css_inst(S390CPU *cpu, struct kvm_run *run,
     int r = 0;
     int no_cc = 0;
     CPUS390XState *env = &cpu->env;
-    CPUState *cs = ENV_GET_CPU(env);
+    CPUState *cs = CPU(cpu);
 
     if (ipa0 != 0xb2) {
         /* Not handled for now. */
commit 09c6a63a6144bbfe2fe434e84d16dd4db6028b6a
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jun 21 17:00:04 2013 +0200

    target-ppc: Don't overuse ENV_GET_CPU()
    
    Commit b632a148b677b773ff155f9de840b37a653567b9 (target-ppc: QOM method
    dispatch for MMU fault handling) introduced a use of ENV_GET_CPU()
    inside target-ppc/ code. Use ppc_env_get_cpu() instead.
    
    Purely cosmetic, non-functional change to aid in locating and removing
    ENV_GET_CPU() usages.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index 385b67a..e4e111c 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -2890,7 +2890,7 @@ void helper_booke206_tlbflush(CPUPPCState *env, uint32_t type)
 void tlb_fill(CPUPPCState *env, target_ulong addr, int is_write, int mmu_idx,
               uintptr_t retaddr)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUState *cpu = CPU(ppc_env_get_cpu(env));
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
     int ret;
 
commit de6db419e5cfe604464a7612b5a5f9214d0af837
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 16 17:10:28 2013 +0200

    timer/arm_mptimer: Build arm_mptimer only once
    
    Since current_cpu is CPUState it no longer depends on CPUARMState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
index 32b5c1a..eca5905 100644
--- a/hw/timer/Makefile.objs
+++ b/hw/timer/Makefile.objs
@@ -1,4 +1,5 @@
 common-obj-$(CONFIG_ARM_TIMER) += arm_timer.o
+common-obj-$(CONFIG_ARM_MPTIMER) += arm_mptimer.o
 common-obj-$(CONFIG_CADENCE) += cadence_ttc.o
 common-obj-$(CONFIG_DS1338) += ds1338.o
 common-obj-$(CONFIG_HPET) += hpet.o
@@ -25,5 +26,4 @@ obj-$(CONFIG_PXA2XX) += pxa2xx_timer.o
 obj-$(CONFIG_SH4) += sh_timer.o
 obj-$(CONFIG_TUSB6010) += tusb6010.o
 
-obj-$(CONFIG_ARM_MPTIMER) += arm_mptimer.o
 obj-$(CONFIG_MC146818RTC) += mc146818rtc.o
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index fbc69c9..0ceb240 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -21,6 +21,7 @@
 
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
+#include "qom/cpu.h"
 
 /* This device implements the per-cpu private timer and watchdog block
  * which is used in both the ARM11MPCore and Cortex-A9MP.
commit 2b927571ccdb79deda74ba84ef493e6cb37eacbe
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 16 17:04:21 2013 +0200

    intc/openpic: Build openpic only once
    
    Since current_cpu is CPUState it no longer depends on CPUPPCState.
    
    Move ppce500_set_mpic_proxy() to a new hw/ppc/ppc_e500.h because
    hw/ppc/ppc.h is too heavily using CPUPPCState and PowerPCCPU.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index e8f9267..86f9d5b 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -11,6 +11,7 @@ common-obj-$(CONFIG_SLAVIO) += slavio_intctl.o
 common-obj-$(CONFIG_IOAPIC) += ioapic_common.o
 common-obj-$(CONFIG_ARM_GIC) += arm_gic_common.o
 common-obj-$(CONFIG_ARM_GIC) += arm_gic.o
+common-obj-$(CONFIG_OPENPIC) += openpic.o
 
 obj-$(CONFIG_APIC) += apic.o apic_common.o
 obj-$(CONFIG_ARM_GIC_KVM) += arm_gic_kvm.o
@@ -19,6 +20,5 @@ obj-$(CONFIG_EXYNOS4) += exynos4210_gic.o exynos4210_combiner.o
 obj-$(CONFIG_GRLIB) += grlib_irqmp.o
 obj-$(CONFIG_IOAPIC) += ioapic.o
 obj-$(CONFIG_OMAP) += omap_intc.o
-obj-$(CONFIG_OPENPIC) += openpic.o
 obj-$(CONFIG_OPENPIC_KVM) += openpic_kvm.o
 obj-$(CONFIG_SH4) += sh_intc.o
diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index d984dba..7df72f4 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -37,10 +37,10 @@
 #include "hw/ppc/mac.h"
 #include "hw/pci/pci.h"
 #include "hw/ppc/openpic.h"
+#include "hw/ppc/ppc_e500.h"
 #include "hw/sysbus.h"
 #include "hw/pci/msi.h"
 #include "qemu/bitops.h"
-#include "hw/ppc/ppc.h"
 
 //#define DEBUG_OPENPIC
 
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 554f244..e1c095c 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -23,6 +23,7 @@
  */
 #include "hw/hw.h"
 #include "hw/ppc/ppc.h"
+#include "hw/ppc/ppc_e500.h"
 #include "qemu/timer.h"
 #include "sysemu/sysemu.h"
 #include "hw/timer/m48t59.h"
diff --git a/include/hw/ppc/ppc.h b/include/hw/ppc/ppc.h
index dfcad25..132ab97 100644
--- a/include/hw/ppc/ppc.h
+++ b/include/hw/ppc/ppc.h
@@ -73,8 +73,6 @@ void ppc6xx_irq_init (CPUPPCState *env);
 void ppc970_irq_init (CPUPPCState *env);
 void ppcPOWER7_irq_init (CPUPPCState *env);
 
-void ppce500_set_mpic_proxy(bool enabled);
-
 /* PPC machines for OpenBIOS */
 enum {
     ARCH_PREP = 0,
diff --git a/include/hw/ppc/ppc_e500.h b/include/hw/ppc/ppc_e500.h
new file mode 100644
index 0000000..b66c0e3
--- /dev/null
+++ b/include/hw/ppc/ppc_e500.h
@@ -0,0 +1,6 @@
+#ifndef HW_PPC_E500_H
+#define HW_PPC_E500_H
+
+void ppce500_set_mpic_proxy(bool enabled);
+
+#endif
commit dfc080791dfb9dd8907a15e6d45b6cc4969b986f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 16 16:42:03 2013 +0200

    intc/arm_gic: Build arm_gic only once
    
    Since current_cpu is CPUState it no longer needs CPUArchState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index 2ba49d0..e8f9267 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -10,9 +10,9 @@ common-obj-$(CONFIG_REALVIEW) += realview_gic.o
 common-obj-$(CONFIG_SLAVIO) += slavio_intctl.o
 common-obj-$(CONFIG_IOAPIC) += ioapic_common.o
 common-obj-$(CONFIG_ARM_GIC) += arm_gic_common.o
+common-obj-$(CONFIG_ARM_GIC) += arm_gic.o
 
 obj-$(CONFIG_APIC) += apic.o apic_common.o
-obj-$(CONFIG_ARM_GIC) += arm_gic.o
 obj-$(CONFIG_ARM_GIC_KVM) += arm_gic_kvm.o
 obj-$(CONFIG_STELLARIS) += armv7m_nvic.o
 obj-$(CONFIG_EXYNOS4) += exynos4210_gic.o exynos4210_combiner.o
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index 237d1d6..8e34004 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -20,6 +20,7 @@
 
 #include "hw/sysbus.h"
 #include "gic_internal.h"
+#include "qom/cpu.h"
 
 //#define DEBUG_GIC
 
commit dca1173c20e7e7366a9c36f88ae4234e5387ed28
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 9 19:51:23 2013 +0200

    bsd-user: Change thread_env to CPUState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
index 5e20510..93fd9e4 100644
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -98,7 +98,7 @@ enum {
 static const char *get_elf_platform(void)
 {
     static char elf_platform[] = "i386";
-    int family = (thread_env->cpuid_version >> 8) & 0xff;
+    int family = object_property_get_int(OBJECT(thread_cpu), "family", NULL);
     if (family > 6)
         family = 6;
     if (family >= 3)
@@ -110,7 +110,9 @@ static const char *get_elf_platform(void)
 
 static uint32_t get_elf_hwcap(void)
 {
-    return thread_env->features[FEAT_1_EDX];
+    X86CPU *cpu = X86_CPU(thread_cpu);
+
+    return cpu->env.features[FEAT_1_EDX];
 }
 
 #ifdef TARGET_X86_64
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 75dbd7f..1e92552 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -92,7 +92,7 @@ void fork_start(void)
 void fork_end(int child)
 {
     if (child) {
-        gdbserver_fork(thread_env);
+        gdbserver_fork((CPUArchState *)thread_cpu->env_ptr);
     }
 }
 
@@ -713,7 +713,7 @@ static void usage(void)
     exit(1);
 }
 
-THREAD CPUArchState *thread_env;
+THREAD CPUState *thread_cpu;
 
 /* Assumes contents are already zeroed.  */
 void init_task_state(TaskState *ts)
@@ -915,7 +915,7 @@ int main(int argc, char **argv)
 #if defined(TARGET_SPARC) || defined(TARGET_PPC)
     cpu_reset(ENV_GET_CPU(env));
 #endif
-    thread_env = env;
+    thread_cpu = ENV_GET_CPU(env);
 
     if (getenv("QEMU_STRACE")) {
         do_strace = 1;
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index a826086..325f564 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -139,7 +139,7 @@ abi_long do_openbsd_syscall(void *cpu_env, int num, abi_long arg1,
                             abi_long arg2, abi_long arg3, abi_long arg4,
                             abi_long arg5, abi_long arg6);
 void gemu_log(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
-extern THREAD CPUArchState *thread_env;
+extern THREAD CPUState *thread_cpu;
 void cpu_loop(CPUArchState *env);
 char *target_strerror(int err);
 int get_osversion(void);
commit a2247f8ec919c51c5749c2e3659841f1a733cce3
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 9 19:47:04 2013 +0200

    linux-user: Change thread_env to CPUState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index d517450..7ce2eab 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -125,7 +125,7 @@ typedef abi_int         target_pid_t;
 static const char *get_elf_platform(void)
 {
     static char elf_platform[] = "i386";
-    int family = (thread_env->cpuid_version >> 8) & 0xff;
+    int family = object_property_get_int(OBJECT(thread_cpu), "family", NULL);
     if (family > 6)
         family = 6;
     if (family >= 3)
@@ -137,7 +137,9 @@ static const char *get_elf_platform(void)
 
 static uint32_t get_elf_hwcap(void)
 {
-    return thread_env->features[FEAT_1_EDX];
+    X86CPU *cpu = X86_CPU(thread_cpu);
+
+    return cpu->env.features[FEAT_1_EDX];
 }
 
 #ifdef TARGET_X86_64
@@ -404,7 +406,7 @@ static int validate_guest_space(unsigned long guest_base,
 
 static uint32_t get_elf_hwcap(void)
 {
-    CPUARMState *e = thread_env;
+    ARMCPU *cpu = ARM_CPU(thread_cpu);
     uint32_t hwcaps = 0;
 
     hwcaps |= ARM_HWCAP_ARM_SWP;
@@ -415,7 +417,7 @@ static uint32_t get_elf_hwcap(void)
 
     /* probe for the extra features */
 #define GET_FEATURE(feat, hwcap) \
-    do {if (arm_feature(e, feat)) { hwcaps |= hwcap; } } while (0)
+    do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)
     GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP);
     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
@@ -619,13 +621,13 @@ enum {
 
 static uint32_t get_elf_hwcap(void)
 {
-    CPUPPCState *e = thread_env;
+    PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
     uint32_t features = 0;
 
     /* We don't have to be terribly complete here; the high points are
        Altivec/FP/SPE support.  Anything else is just a bonus.  */
 #define GET_FEATURE(flag, feature)                                      \
-    do {if (e->insns_flags & flag) features |= feature; } while(0)
+    do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
     GET_FEATURE(PPC_64B, QEMU_PPC_FEATURE_64);
     GET_FEATURE(PPC_FLOAT, QEMU_PPC_FEATURE_HAS_FPU);
     GET_FEATURE(PPC_ALTIVEC, QEMU_PPC_FEATURE_HAS_ALTIVEC);
@@ -2667,7 +2669,7 @@ static int fill_note_info(struct elf_note_info *info,
     /* read and fill status of all threads */
     cpu_list_lock();
     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
-        if (cpu == ENV_GET_CPU(thread_env)) {
+        if (cpu == thread_cpu) {
             continue;
         }
         fill_thread_info(info, (CPUArchState *)cpu->env_ptr);
diff --git a/linux-user/linuxload.c b/linux-user/linuxload.c
index 381ab89..5cd6d91 100644
--- a/linux-user/linuxload.c
+++ b/linux-user/linuxload.c
@@ -89,7 +89,8 @@ static int prepare_binprm(struct linux_binprm *bprm)
 abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp,
                               abi_ulong stringp, int push_ptr)
 {
-    TaskState *ts = (TaskState *)thread_env->opaque;
+    CPUArchState *env = thread_cpu->env_ptr;
+    TaskState *ts = (TaskState *)env->opaque;
     int n = sizeof(abi_ulong);
     abi_ulong envp;
     abi_ulong argv;
diff --git a/linux-user/main.c b/linux-user/main.c
index 564bed6..67ea9ba 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -120,7 +120,7 @@ void fork_end(int child)
     if (child) {
         /* Child processes created by fork() only have a single thread.
            Discard information about the parent threads.  */
-        first_cpu = ENV_GET_CPU(thread_env);
+        first_cpu = thread_cpu;
         first_cpu->next_cpu = NULL;
         pending_cpus = 0;
         pthread_mutex_init(&exclusive_lock, NULL);
@@ -128,7 +128,7 @@ void fork_end(int child)
         pthread_cond_init(&exclusive_cond, NULL);
         pthread_cond_init(&exclusive_resume, NULL);
         pthread_mutex_init(&tcg_ctx.tb_ctx.tb_lock, NULL);
-        gdbserver_fork(thread_env);
+        gdbserver_fork((CPUArchState *)thread_cpu->env_ptr);
     } else {
         pthread_mutex_unlock(&exclusive_lock);
         pthread_mutex_unlock(&tcg_ctx.tb_ctx.tb_lock);
@@ -232,7 +232,7 @@ void fork_start(void)
 void fork_end(int child)
 {
     if (child) {
-        gdbserver_fork(thread_env);
+        gdbserver_fork((CPUArchState *)thread_cpu->env_ptr);
     }
 }
 
@@ -3150,7 +3150,7 @@ void cpu_loop(CPUS390XState *env)
 
 #endif /* TARGET_S390X */
 
-THREAD CPUArchState *thread_env;
+THREAD CPUState *thread_cpu;
 
 void task_settid(TaskState *ts)
 {
@@ -3640,7 +3640,7 @@ int main(int argc, char **argv, char **envp)
     cpu_reset(ENV_GET_CPU(env));
 #endif
 
-    thread_env = env;
+    thread_cpu = ENV_GET_CPU(env);
 
     if (getenv("QEMU_STRACE")) {
         do_strace = 1;
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 20d171c..6569608 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -198,7 +198,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                     abi_long arg5, abi_long arg6, abi_long arg7,
                     abi_long arg8);
 void gemu_log(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
-extern THREAD CPUArchState *thread_env;
+extern THREAD CPUState *thread_cpu;
 void cpu_loop(CPUArchState *env);
 char *target_strerror(int err);
 int get_osversion(void);
diff --git a/linux-user/signal.c b/linux-user/signal.c
index c4e20dc..42d8911 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -388,17 +388,18 @@ static inline void free_sigqueue(CPUArchState *env, struct sigqueue *q)
 /* abort execution with signal */
 static void QEMU_NORETURN force_sig(int target_sig)
 {
-    TaskState *ts = (TaskState *)thread_env->opaque;
+    CPUArchState *env = thread_cpu->env_ptr;
+    TaskState *ts = (TaskState *)env->opaque;
     int host_sig, core_dumped = 0;
     struct sigaction act;
     host_sig = target_to_host_signal(target_sig);
-    gdb_signalled(thread_env, target_sig);
+    gdb_signalled(env, target_sig);
 
     /* dump core if supported by target binary format */
     if (core_dump_signal(target_sig) && (ts->bprm->core_dump != NULL)) {
         stop_all_tasks();
         core_dumped =
-            ((*ts->bprm->core_dump)(target_sig, thread_env) == 0);
+            ((*ts->bprm->core_dump)(target_sig, env) == 0);
     }
     if (core_dumped) {
         /* we already dumped the core of target process, we don't want
@@ -503,6 +504,7 @@ int queue_signal(CPUArchState *env, int sig, target_siginfo_t *info)
 static void host_signal_handler(int host_signum, siginfo_t *info,
                                 void *puc)
 {
+    CPUArchState *env = thread_cpu->env_ptr;
     int sig;
     target_siginfo_t tinfo;
 
@@ -522,9 +524,9 @@ static void host_signal_handler(int host_signum, siginfo_t *info,
     fprintf(stderr, "qemu: got signal %d\n", sig);
 #endif
     host_to_target_siginfo_noswap(&tinfo, info);
-    if (queue_signal(thread_env, sig, &tinfo) == 1) {
+    if (queue_signal(env, sig, &tinfo) == 1) {
         /* interrupt the virtual CPU as soon as possible */
-        cpu_exit(ENV_GET_CPU(thread_env));
+        cpu_exit(thread_cpu);
     }
 }
 
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 4c96f4f..433d3ba 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4171,8 +4171,8 @@ static void *clone_func(void *arg)
 
     env = info->env;
     cpu = ENV_GET_CPU(env);
-    thread_env = env;
-    ts = (TaskState *)thread_env->opaque;
+    thread_cpu = cpu;
+    ts = (TaskState *)env->opaque;
     info->tid = gettid();
     cpu->host_tid = info->tid;
     task_settid(ts);
@@ -5079,7 +5079,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                 sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
                           NULL, NULL, 0);
             }
-            thread_env = NULL;
+            thread_cpu = NULL;
             object_unref(OBJECT(ENV_GET_CPU(cpu_env)));
             g_free(ts);
             pthread_exit(NULL);
commit 182735efaf956ccab50b6d74a4fed163e0f35660
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed May 29 22:29:20 2013 +0200

    cpu: Make first_cpu and next_cpu CPUState
    
    Move next_cpu from CPU_COMMON to CPUState.
    Move first_cpu variable to qom/cpu.h.
    
    gdbstub needs to use CPUState::env_ptr for now.
    cpu_copy() no longer needs to save and restore cpu_next.
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    [AF: Rebased, simplified cpu_copy()]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index e9bfa71..f141428 100644
--- a/cpus.c
+++ b/cpus.c
@@ -60,7 +60,7 @@
 
 #endif /* CONFIG_LINUX */
 
-static CPUArchState *next_cpu;
+static CPUState *next_cpu;
 
 static bool cpu_thread_is_idle(CPUState *cpu)
 {
@@ -79,10 +79,10 @@ static bool cpu_thread_is_idle(CPUState *cpu)
 
 static bool all_cpu_threads_idle(void)
 {
-    CPUArchState *env;
+    CPUState *cpu;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        if (!cpu_thread_is_idle(ENV_GET_CPU(env))) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        if (!cpu_thread_is_idle(cpu)) {
             return false;
         }
     }
@@ -388,15 +388,13 @@ void configure_icount(const char *option)
 void hw_error(const char *fmt, ...)
 {
     va_list ap;
-    CPUArchState *env;
     CPUState *cpu;
 
     va_start(ap, fmt);
     fprintf(stderr, "qemu: hardware error: ");
     vfprintf(stderr, fmt, ap);
     fprintf(stderr, "\n");
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = ENV_GET_CPU(env);
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         fprintf(stderr, "CPU #%d:\n", cpu->cpu_index);
         cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_FPU);
     }
@@ -406,28 +404,28 @@ void hw_error(const char *fmt, ...)
 
 void cpu_synchronize_all_states(void)
 {
-    CPUArchState *env;
+    CPUState *cpu;
 
-    for (env = first_cpu; env; env = env->next_cpu) {
-        cpu_synchronize_state(ENV_GET_CPU(env));
+    for (cpu = first_cpu; cpu; cpu = cpu->next_cpu) {
+        cpu_synchronize_state(cpu);
     }
 }
 
 void cpu_synchronize_all_post_reset(void)
 {
-    CPUArchState *cpu;
+    CPUState *cpu;
 
     for (cpu = first_cpu; cpu; cpu = cpu->next_cpu) {
-        cpu_synchronize_post_reset(ENV_GET_CPU(cpu));
+        cpu_synchronize_post_reset(cpu);
     }
 }
 
 void cpu_synchronize_all_post_init(void)
 {
-    CPUArchState *cpu;
+    CPUState *cpu;
 
     for (cpu = first_cpu; cpu; cpu = cpu->next_cpu) {
-        cpu_synchronize_post_init(ENV_GET_CPU(cpu));
+        cpu_synchronize_post_init(cpu);
     }
 }
 
@@ -698,7 +696,7 @@ static void qemu_wait_io_event_common(CPUState *cpu)
 
 static void qemu_tcg_wait_io_event(void)
 {
-    CPUArchState *env;
+    CPUState *cpu;
 
     while (all_cpu_threads_idle()) {
        /* Start accounting real time to the virtual clock if the CPUs
@@ -711,8 +709,8 @@ static void qemu_tcg_wait_io_event(void)
         qemu_cond_wait(&qemu_io_proceeded_cond, &qemu_global_mutex);
     }
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        qemu_wait_io_event_common(ENV_GET_CPU(env));
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        qemu_wait_io_event_common(cpu);
     }
 }
 
@@ -814,7 +812,6 @@ static void tcg_signal_cpu_creation(CPUState *cpu, void *data)
 static void *qemu_tcg_cpu_thread_fn(void *arg)
 {
     CPUState *cpu = arg;
-    CPUArchState *env;
 
     qemu_tcg_init_cpu_signals();
     qemu_thread_get_self(cpu->thread);
@@ -824,12 +821,12 @@ static void *qemu_tcg_cpu_thread_fn(void *arg)
     qemu_cond_signal(&qemu_cpu_cond);
 
     /* wait for initial kick-off after machine start */
-    while (ENV_GET_CPU(first_cpu)->stopped) {
+    while (first_cpu->stopped) {
         qemu_cond_wait(tcg_halt_cond, &qemu_global_mutex);
 
         /* process any pending work */
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
-            qemu_wait_io_event_common(ENV_GET_CPU(env));
+        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+            qemu_wait_io_event_common(cpu);
         }
     }
 
@@ -923,7 +920,7 @@ void qemu_mutex_lock_iothread(void)
     } else {
         iothread_requesting_mutex = true;
         if (qemu_mutex_trylock(&qemu_global_mutex)) {
-            qemu_cpu_kick_thread(ENV_GET_CPU(first_cpu));
+            qemu_cpu_kick_thread(first_cpu);
             qemu_mutex_lock(&qemu_global_mutex);
         }
         iothread_requesting_mutex = false;
@@ -938,14 +935,13 @@ void qemu_mutex_unlock_iothread(void)
 
 static int all_vcpus_paused(void)
 {
-    CPUArchState *penv = first_cpu;
+    CPUState *cpu = first_cpu;
 
-    while (penv) {
-        CPUState *pcpu = ENV_GET_CPU(penv);
-        if (!pcpu->stopped) {
+    while (cpu) {
+        if (!cpu->stopped) {
             return 0;
         }
-        penv = penv->next_cpu;
+        cpu = cpu->next_cpu;
     }
 
     return 1;
@@ -953,25 +949,23 @@ static int all_vcpus_paused(void)
 
 void pause_all_vcpus(void)
 {
-    CPUArchState *penv = first_cpu;
+    CPUState *cpu = first_cpu;
 
     qemu_clock_enable(vm_clock, false);
-    while (penv) {
-        CPUState *pcpu = ENV_GET_CPU(penv);
-        pcpu->stop = true;
-        qemu_cpu_kick(pcpu);
-        penv = penv->next_cpu;
+    while (cpu) {
+        cpu->stop = true;
+        qemu_cpu_kick(cpu);
+        cpu = cpu->next_cpu;
     }
 
     if (qemu_in_vcpu_thread()) {
         cpu_stop_current();
         if (!kvm_enabled()) {
-            penv = first_cpu;
-            while (penv) {
-                CPUState *pcpu = ENV_GET_CPU(penv);
-                pcpu->stop = false;
-                pcpu->stopped = true;
-                penv = penv->next_cpu;
+            cpu = first_cpu;
+            while (cpu) {
+                cpu->stop = false;
+                cpu->stopped = true;
+                cpu = cpu->next_cpu;
             }
             return;
         }
@@ -979,10 +973,10 @@ void pause_all_vcpus(void)
 
     while (!all_vcpus_paused()) {
         qemu_cond_wait(&qemu_pause_cond, &qemu_global_mutex);
-        penv = first_cpu;
-        while (penv) {
-            qemu_cpu_kick(ENV_GET_CPU(penv));
-            penv = penv->next_cpu;
+        cpu = first_cpu;
+        while (cpu) {
+            qemu_cpu_kick(cpu);
+            cpu = cpu->next_cpu;
         }
     }
 }
@@ -996,13 +990,12 @@ void cpu_resume(CPUState *cpu)
 
 void resume_all_vcpus(void)
 {
-    CPUArchState *penv = first_cpu;
+    CPUState *cpu = first_cpu;
 
     qemu_clock_enable(vm_clock, true);
-    while (penv) {
-        CPUState *pcpu = ENV_GET_CPU(penv);
-        cpu_resume(pcpu);
-        penv = penv->next_cpu;
+    while (cpu) {
+        cpu_resume(cpu);
+        cpu = cpu->next_cpu;
     }
 }
 
@@ -1151,8 +1144,8 @@ static void tcg_exec_all(void)
         next_cpu = first_cpu;
     }
     for (; next_cpu != NULL && !exit_request; next_cpu = next_cpu->next_cpu) {
-        CPUArchState *env = next_cpu;
-        CPUState *cpu = ENV_GET_CPU(env);
+        CPUState *cpu = next_cpu;
+        CPUArchState *env = cpu->env_ptr;
 
         qemu_clock_enable(vm_clock,
                           (env->singlestep_enabled & SSTEP_NOTIMER) == 0);
@@ -1172,12 +1165,10 @@ static void tcg_exec_all(void)
 
 void set_numa_modes(void)
 {
-    CPUArchState *env;
     CPUState *cpu;
     int i;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = ENV_GET_CPU(env);
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         for (i = 0; i < nb_numa_nodes; i++) {
             if (test_bit(cpu->cpu_index, node_cpumask[i])) {
                 cpu->numa_node = i;
@@ -1197,18 +1188,30 @@ void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
 CpuInfoList *qmp_query_cpus(Error **errp)
 {
     CpuInfoList *head = NULL, *cur_item = NULL;
-    CPUArchState *env;
+    CPUState *cpu;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        CPUState *cpu = ENV_GET_CPU(env);
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         CpuInfoList *info;
+#if defined(TARGET_I386)
+        X86CPU *x86_cpu = X86_CPU(cpu);
+        CPUX86State *env = &x86_cpu->env;
+#elif defined(TARGET_PPC)
+        PowerPCCPU *ppc_cpu = POWERPC_CPU(cpu);
+        CPUPPCState *env = &ppc_cpu->env;
+#elif defined(TARGET_SPARC)
+        SPARCCPU *sparc_cpu = SPARC_CPU(cpu);
+        CPUSPARCState *env = &sparc_cpu->env;
+#elif defined(TARGET_MIPS)
+        MIPSCPU *mips_cpu = MIPS_CPU(cpu);
+        CPUMIPSState *env = &mips_cpu->env;
+#endif
 
         cpu_synchronize_state(cpu);
 
         info = g_malloc0(sizeof(*info));
         info->value = g_malloc0(sizeof(*info->value));
         info->value->CPU = cpu->cpu_index;
-        info->value->current = (env == first_cpu);
+        info->value->current = (cpu == first_cpu);
         info->value->halted = cpu->halted;
         info->value->thread_id = cpu->thread_id;
 #if defined(TARGET_I386)
@@ -1316,11 +1319,14 @@ exit:
 void qmp_inject_nmi(Error **errp)
 {
 #if defined(TARGET_I386)
-    CPUArchState *env;
+    CPUState *cs;
+
+    for (cs = first_cpu; cs != NULL; cs = cs->next_cpu) {
+        X86CPU *cpu = X86_CPU(cs);
+        CPUX86State *env = &cpu->env;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
         if (!env->apic_state) {
-            cpu_interrupt(CPU(x86_env_get_cpu(env)), CPU_INTERRUPT_NMI);
+            cpu_interrupt(cs, CPU_INTERRUPT_NMI);
         } else {
             apic_deliver_nmi(env->apic_state);
         }
diff --git a/cputlb.c b/cputlb.c
index 828007c..977c0ca 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -186,11 +186,13 @@ static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
 
 void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
 {
+    CPUState *cpu;
     CPUArchState *env;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         int mmu_idx;
 
+        env = cpu->env_ptr;
         for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
             unsigned int i;
 
diff --git a/dump.c b/dump.c
index c812cfa..6a3a72a 100644
--- a/dump.c
+++ b/dump.c
@@ -275,13 +275,11 @@ static inline int cpu_index(CPUState *cpu)
 
 static int write_elf64_notes(DumpState *s)
 {
-    CPUArchState *env;
     CPUState *cpu;
     int ret;
     int id;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = ENV_GET_CPU(env);
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         id = cpu_index(cpu);
         ret = cpu_write_elf64_note(fd_write_vmcore, cpu, id, s);
         if (ret < 0) {
@@ -290,7 +288,7 @@ static int write_elf64_notes(DumpState *s)
         }
     }
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         ret = cpu_write_elf64_qemunote(fd_write_vmcore, cpu, s);
         if (ret < 0) {
             dump_error(s, "dump: failed to write CPU status.\n");
@@ -327,13 +325,11 @@ static int write_elf32_note(DumpState *s)
 
 static int write_elf32_notes(DumpState *s)
 {
-    CPUArchState *env;
     CPUState *cpu;
     int ret;
     int id;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = ENV_GET_CPU(env);
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         id = cpu_index(cpu);
         ret = cpu_write_elf32_note(fd_write_vmcore, cpu, id, s);
         if (ret < 0) {
@@ -342,7 +338,7 @@ static int write_elf32_notes(DumpState *s)
         }
     }
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         ret = cpu_write_elf32_qemunote(fd_write_vmcore, cpu, s);
         if (ret < 0) {
             dump_error(s, "dump: failed to write CPU status.\n");
@@ -705,7 +701,7 @@ static ram_addr_t get_start_block(DumpState *s)
 static int dump_init(DumpState *s, int fd, bool paging, bool has_filter,
                      int64_t begin, int64_t length, Error **errp)
 {
-    CPUArchState *env;
+    CPUState *cpu;
     int nr_cpus;
     Error *err = NULL;
     int ret;
@@ -738,7 +734,7 @@ static int dump_init(DumpState *s, int fd, bool paging, bool has_filter,
      */
     cpu_synchronize_all_states();
     nr_cpus = 0;
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         nr_cpus++;
     }
 
diff --git a/exec.c b/exec.c
index 9ca80cc..61b094a 100644
--- a/exec.c
+++ b/exec.c
@@ -69,7 +69,7 @@ static MemoryRegion io_mem_unassigned;
 
 #endif
 
-CPUArchState *first_cpu;
+CPUState *first_cpu;
 /* current CPU in the current thread. It is only valid inside
    cpu_exec() */
 DEFINE_TLS(CPUState *, current_cpu);
@@ -351,27 +351,26 @@ const VMStateDescription vmstate_cpu_common = {
 
 CPUState *qemu_get_cpu(int index)
 {
-    CPUArchState *env = first_cpu;
-    CPUState *cpu = NULL;
+    CPUState *cpu = first_cpu;
 
-    while (env) {
-        cpu = ENV_GET_CPU(env);
+    while (cpu) {
         if (cpu->cpu_index == index) {
             break;
         }
-        env = env->next_cpu;
+        cpu = cpu->next_cpu;
     }
 
-    return env ? cpu : NULL;
+    return cpu;
 }
 
 void qemu_for_each_cpu(void (*func)(CPUState *cpu, void *data), void *data)
 {
-    CPUArchState *env = first_cpu;
+    CPUState *cpu;
 
-    while (env) {
-        func(ENV_GET_CPU(env), data);
-        env = env->next_cpu;
+    cpu = first_cpu;
+    while (cpu) {
+        func(cpu, data);
+        cpu = cpu->next_cpu;
     }
 }
 
@@ -379,17 +378,17 @@ void cpu_exec_init(CPUArchState *env)
 {
     CPUState *cpu = ENV_GET_CPU(env);
     CPUClass *cc = CPU_GET_CLASS(cpu);
-    CPUArchState **penv;
+    CPUState **pcpu;
     int cpu_index;
 
 #if defined(CONFIG_USER_ONLY)
     cpu_list_lock();
 #endif
-    env->next_cpu = NULL;
-    penv = &first_cpu;
+    cpu->next_cpu = NULL;
+    pcpu = &first_cpu;
     cpu_index = 0;
-    while (*penv != NULL) {
-        penv = &(*penv)->next_cpu;
+    while (*pcpu != NULL) {
+        pcpu = &(*pcpu)->next_cpu;
         cpu_index++;
     }
     cpu->cpu_index = cpu_index;
@@ -399,7 +398,7 @@ void cpu_exec_init(CPUArchState *env)
 #ifndef CONFIG_USER_ONLY
     cpu->thread_id = qemu_get_thread_id();
 #endif
-    *penv = env;
+    *pcpu = cpu;
 #if defined(CONFIG_USER_ONLY)
     cpu_list_unlock();
 #endif
@@ -638,7 +637,6 @@ void cpu_abort(CPUArchState *env, const char *fmt, ...)
 CPUArchState *cpu_copy(CPUArchState *env)
 {
     CPUArchState *new_env = cpu_init(env->cpu_model_str);
-    CPUArchState *next_cpu = new_env->next_cpu;
 #if defined(TARGET_HAS_ICE)
     CPUBreakpoint *bp;
     CPUWatchpoint *wp;
@@ -646,9 +644,6 @@ CPUArchState *cpu_copy(CPUArchState *env)
 
     memcpy(new_env, env, sizeof(CPUArchState));
 
-    /* Preserve chaining. */
-    new_env->next_cpu = next_cpu;
-
     /* Clone all break/watchpoints.
        Note: Once we support ptrace with hw-debug register access, make sure
        BP_CPU break/watchpoints are handled correctly on clone. */
@@ -1757,12 +1752,14 @@ static void core_commit(MemoryListener *listener)
 
 static void tcg_commit(MemoryListener *listener)
 {
-    CPUArchState *env;
+    CPUState *cpu;
 
     /* since each CPU stores ram addresses in its TLB cache, we must
        reset the modified entries */
     /* XXX: slow ! */
-    for(env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        CPUArchState *env = cpu->env_ptr;
+
         tlb_flush(env, 1);
     }
 }
diff --git a/gdbstub.c b/gdbstub.c
index f7d9f13..0ee82a9 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1839,6 +1839,7 @@ static const char *get_feature_xml(const char *p, const char **newp)
         /* Generate the XML description for this CPU.  */
         if (!target_xml[0]) {
             GDBRegisterState *r;
+            CPUArchState *env = first_cpu->env_ptr;
 
             snprintf(target_xml, sizeof(target_xml),
                      "<?xml version=\"1.0\"?>"
@@ -1847,7 +1848,7 @@ static const char *get_feature_xml(const char *p, const char **newp)
                      "<xi:include href=\"%s\"/>",
                      GDB_CORE_XML);
 
-            for (r = first_cpu->gdb_regs; r; r = r->next) {
+            for (r = env->gdb_regs; r; r = r->next) {
                 pstrcat(target_xml, sizeof(target_xml), "<xi:include href=\"");
                 pstrcat(target_xml, sizeof(target_xml), r->xml);
                 pstrcat(target_xml, sizeof(target_xml), "\"/>");
@@ -1949,6 +1950,7 @@ static const int xlat_gdb_type[] = {
 
 static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 {
+    CPUState *cpu;
     CPUArchState *env;
     int err = 0;
 
@@ -1958,7 +1960,8 @@ static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
     switch (type) {
     case GDB_BREAKPOINT_SW:
     case GDB_BREAKPOINT_HW:
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+            env = cpu->env_ptr;
             err = cpu_breakpoint_insert(env, addr, BP_GDB, NULL);
             if (err)
                 break;
@@ -1968,7 +1971,8 @@ static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
     case GDB_WATCHPOINT_WRITE:
     case GDB_WATCHPOINT_READ:
     case GDB_WATCHPOINT_ACCESS:
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+            env = cpu->env_ptr;
             err = cpu_watchpoint_insert(env, addr, len, xlat_gdb_type[type],
                                         NULL);
             if (err)
@@ -1983,6 +1987,7 @@ static int gdb_breakpoint_insert(target_ulong addr, target_ulong len, int type)
 
 static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 {
+    CPUState *cpu;
     CPUArchState *env;
     int err = 0;
 
@@ -1992,7 +1997,8 @@ static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
     switch (type) {
     case GDB_BREAKPOINT_SW:
     case GDB_BREAKPOINT_HW:
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+            env = cpu->env_ptr;
             err = cpu_breakpoint_remove(env, addr, BP_GDB);
             if (err)
                 break;
@@ -2002,7 +2008,8 @@ static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
     case GDB_WATCHPOINT_WRITE:
     case GDB_WATCHPOINT_READ:
     case GDB_WATCHPOINT_ACCESS:
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+            env = cpu->env_ptr;
             err = cpu_watchpoint_remove(env, addr, len, xlat_gdb_type[type]);
             if (err)
                 break;
@@ -2016,6 +2023,7 @@ static int gdb_breakpoint_remove(target_ulong addr, target_ulong len, int type)
 
 static void gdb_breakpoint_remove_all(void)
 {
+    CPUState *cpu;
     CPUArchState *env;
 
     if (kvm_enabled()) {
@@ -2023,7 +2031,8 @@ static void gdb_breakpoint_remove_all(void)
         return;
     }
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        env = cpu->env_ptr;
         cpu_breakpoint_remove_all(env, BP_GDB);
 #ifndef CONFIG_USER_ONLY
         cpu_watchpoint_remove_all(env, BP_GDB);
@@ -2071,13 +2080,11 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 
 static CPUArchState *find_cpu(uint32_t thread_id)
 {
-    CPUArchState *env;
     CPUState *cpu;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = ENV_GET_CPU(env);
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         if (cpu_index(cpu) == thread_id) {
-            return env;
+            return cpu->env_ptr;
         }
     }
 
@@ -2394,7 +2401,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             put_packet(s, "QC1");
             break;
         } else if (strcmp(p,"fThreadInfo") == 0) {
-            s->query_cpu = first_cpu;
+            s->query_cpu = first_cpu->env_ptr;
             goto report_cpuinfo;
         } else if (strcmp(p,"sThreadInfo") == 0) {
         report_cpuinfo:
@@ -2402,7 +2409,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
                 snprintf(buf, sizeof(buf), "m%x",
                          cpu_index(ENV_GET_CPU(s->query_cpu)));
                 put_packet(s, buf);
-                s->query_cpu = s->query_cpu->next_cpu;
+                s->query_cpu = ENV_GET_CPU(s->query_cpu)->next_cpu->env_ptr;
             } else
                 put_packet(s, "l");
             break;
@@ -2869,8 +2876,8 @@ static void gdb_accept(void)
     socket_set_nodelay(fd);
 
     s = g_malloc0(sizeof(GDBState));
-    s->c_cpu = first_cpu;
-    s->g_cpu = first_cpu;
+    s->c_cpu = first_cpu->env_ptr;
+    s->g_cpu = first_cpu->env_ptr;
     s->fd = fd;
     gdb_has_xml = 0;
 
@@ -3054,8 +3061,8 @@ int gdbserver_start(const char *device)
         mon_chr = s->mon_chr;
         memset(s, 0, sizeof(GDBState));
     }
-    s->c_cpu = first_cpu;
-    s->g_cpu = first_cpu;
+    s->c_cpu = first_cpu->env_ptr;
+    s->g_cpu = first_cpu->env_ptr;
     s->chr = chr;
     s->state = chr ? RS_IDLE : RS_INACTIVE;
     s->mon_chr = mon_chr;
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 7c0090f..2b33444 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -333,7 +333,7 @@ static void do_cpu_reset(void *opaque)
             env->regs[15] = info->entry & 0xfffffffe;
             env->thumb = info->entry & 1;
         } else {
-            if (env == first_cpu) {
+            if (CPU(cpu) == first_cpu) {
                 env->regs[15] = info->loader_start;
                 if (!info->dtb_filename) {
                     if (old_param) {
@@ -351,7 +351,7 @@ static void do_cpu_reset(void *opaque)
 
 void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
 {
-    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
     int kernel_size;
     int initrd_size;
     int n;
@@ -476,9 +476,9 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
     }
     info->is_linux = is_linux;
 
-    for (; env; env = env->next_cpu) {
-        cpu = arm_env_get_cpu(env);
-        env->boot_info = info;
+    for (; cs; cs = cs->next_cpu) {
+        cpu = ARM_CPU(cs);
+        cpu->env.boot_info = info;
         qemu_register_reset(do_cpu_reset, cpu);
     }
 }
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index 74f110b..7c90b2d 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -131,7 +131,7 @@ static void nuri_init(QEMUMachineInitArgs *args)
 {
     exynos4_boards_init_common(args, EXYNOS4_BOARD_NURI);
 
-    arm_load_kernel(arm_env_get_cpu(first_cpu), &exynos4_board_binfo);
+    arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
 static void smdkc210_init(QEMUMachineInitArgs *args)
@@ -141,7 +141,7 @@ static void smdkc210_init(QEMUMachineInitArgs *args)
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
             qemu_irq_invert(s->irq_table[exynos4210_get_irq(37, 1)]));
-    arm_load_kernel(arm_env_get_cpu(first_cpu), &exynos4_board_binfo);
+    arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
 static QEMUMachine exynos4_machines[EXYNOS4_NUM_OF_BOARDS] = {
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index de6c98a..3a2fb4c 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -321,7 +321,7 @@ static void highbank_init(QEMUMachineInitArgs *args)
     highbank_binfo.loader_start = 0;
     highbank_binfo.write_secondary_boot = hb_write_secondary;
     highbank_binfo.secondary_cpu_reset_hook = hb_reset_secondary;
-    arm_load_kernel(arm_env_get_cpu(first_cpu), &highbank_binfo);
+    arm_load_kernel(ARM_CPU(first_cpu), &highbank_binfo);
 }
 
 static QEMUMachine highbank_machine = {
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index b596256..3060f48 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -331,7 +331,7 @@ static void realview_init(QEMUMachineInitArgs *args,
     realview_binfo.nb_cpus = smp_cpus;
     realview_binfo.board_id = realview_board_id[board_type];
     realview_binfo.loader_start = (board_type == BOARD_PB_A8 ? 0x70000000 : 0);
-    arm_load_kernel(arm_env_get_cpu(first_cpu), &realview_binfo);
+    arm_load_kernel(ARM_CPU(first_cpu), &realview_binfo);
 }
 
 static void realview_eb_init(QEMUMachineInitArgs *args)
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 710413e..fd18b60 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -519,7 +519,7 @@ static void vexpress_common_init(const VEDBoardInfo *daughterboard,
     vexpress_binfo.smp_loader_start = map[VE_SRAM];
     vexpress_binfo.smp_bootreg_addr = map[VE_SYSREGS] + 0x30;
     vexpress_binfo.gic_cpu_if_addr = daughterboard->gic_cpu_if_addr;
-    arm_load_kernel(arm_env_get_cpu(first_cpu), &vexpress_binfo);
+    arm_load_kernel(ARM_CPU(first_cpu), &vexpress_binfo);
 }
 
 static void vexpress_a9_init(QEMUMachineInitArgs *args)
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index 0dc0871..3444823 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -226,7 +226,7 @@ static void zynq_init(QEMUMachineInitArgs *args)
     zynq_binfo.nb_cpus = 1;
     zynq_binfo.board_id = 0xd32;
     zynq_binfo.loader_start = 0;
-    arm_load_kernel(arm_env_get_cpu(first_cpu), &zynq_binfo);
+    arm_load_kernel(ARM_CPU(first_cpu), &zynq_binfo);
 }
 
 static QEMUMachine zynq_machine = {
diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
index 98e5ca5..1022d67 100644
--- a/hw/i386/kvm/clock.c
+++ b/hw/i386/kvm/clock.c
@@ -33,7 +33,7 @@ static void kvmclock_vm_state_change(void *opaque, int running,
                                      RunState state)
 {
     KVMClockState *s = opaque;
-    CPUArchState *penv = first_cpu;
+    CPUState *cpu = first_cpu;
     int cap_clock_ctrl = kvm_check_extension(kvm_state, KVM_CAP_KVMCLOCK_CTRL);
     int ret;
 
@@ -53,8 +53,8 @@ static void kvmclock_vm_state_change(void *opaque, int running,
         if (!cap_clock_ctrl) {
             return;
         }
-        for (penv = first_cpu; penv != NULL; penv = penv->next_cpu) {
-            ret = kvm_vcpu_ioctl(ENV_GET_CPU(penv), KVM_KVMCLOCK_CTRL, 0);
+        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+            ret = kvm_vcpu_ioctl(cpu, KVM_KVMCLOCK_CTRL, 0);
             if (ret) {
                 if (ret != -EINVAL) {
                     fprintf(stderr, "%s: %s\n", __func__, strerror(-ret));
@@ -124,9 +124,11 @@ static const TypeInfo kvmclock_info = {
 /* Note: Must be called after VCPU initialization. */
 void kvmclock_create(void)
 {
+    X86CPU *cpu = X86_CPU(first_cpu);
+
     if (kvm_enabled() &&
-        first_cpu->features[FEAT_KVM] & ((1ULL << KVM_FEATURE_CLOCKSOURCE) |
-                                         (1ULL << KVM_FEATURE_CLOCKSOURCE2))) {
+        cpu->env.features[FEAT_KVM] & ((1ULL << KVM_FEATURE_CLOCKSOURCE) |
+                                       (1ULL << KVM_FEATURE_CLOCKSOURCE2))) {
         sysbus_create_simple("kvmclock", -1, NULL);
     }
 }
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index e13678f..ccd089a 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -490,13 +490,15 @@ static void vapic_enable_tpr_reporting(bool enable)
     VAPICEnableTPRReporting info = {
         .enable = enable,
     };
+    CPUState *cs;
     X86CPU *cpu;
     CPUX86State *env;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = x86_env_get_cpu(env);
+    for (cs = first_cpu; cs != NULL; cs = cs->next_cpu) {
+        cpu = X86_CPU(cs);
+        env = &cpu->env;
         info.apic = env->apic_state;
-        run_on_cpu(CPU(cpu), vapic_do_enable_tpr_reporting, &info);
+        run_on_cpu(cs, vapic_do_enable_tpr_reporting, &info);
     }
 }
 
@@ -719,8 +721,9 @@ static int vapic_init(SysBusDevice *dev)
 static void do_vapic_enable(void *data)
 {
     VAPICROMState *s = data;
+    X86CPU *cpu = X86_CPU(first_cpu);
 
-    vapic_enable(s, first_cpu);
+    vapic_enable(s, &cpu->env);
 }
 
 static int vapic_post_load(void *opaque, int version_id)
@@ -743,7 +746,7 @@ static int vapic_post_load(void *opaque, int version_id)
     }
     if (s->state == VAPIC_ACTIVE) {
         if (smp_cpus == 1) {
-            run_on_cpu(ENV_GET_CPU(first_cpu), do_vapic_enable, s);
+            run_on_cpu(first_cpu, do_vapic_enable, s);
         } else {
             zero = g_malloc0(s->rom_state.vapic_size);
             cpu_physical_memory_rw(s->vapic_paddr, zero,
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 5224256..c5d8570 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -160,8 +160,9 @@ void cpu_smm_register(cpu_set_smm_t callback, void *arg)
 
 void cpu_smm_update(CPUX86State *env)
 {
-    if (smm_set && smm_arg && env == first_cpu)
+    if (smm_set && smm_arg && CPU(x86_env_get_cpu(env)) == first_cpu) {
         smm_set(!!(env->hflags & HF_SMM_MASK), smm_arg);
+    }
 }
 
 
@@ -185,18 +186,21 @@ int cpu_get_pic_interrupt(CPUX86State *env)
 
 static void pic_irq_request(void *opaque, int irq, int level)
 {
-    CPUX86State *env = first_cpu;
+    CPUState *cs = first_cpu;
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
 
     DPRINTF("pic_irqs: %s irq %d\n", level? "raise" : "lower", irq);
     if (env->apic_state) {
-        while (env) {
+        while (cs) {
+            cpu = X86_CPU(cs);
+            env = &cpu->env;
             if (apic_accept_pic_intr(env->apic_state)) {
                 apic_deliver_pic_intr(env->apic_state, level);
             }
-            env = env->next_cpu;
+            cs = cs->next_cpu;
         }
     } else {
-        CPUState *cs = CPU(x86_env_get_cpu(env));
         if (level) {
             cpu_interrupt(cs, CPU_INTERRUPT_HARD);
         } else {
@@ -1274,8 +1278,7 @@ void pc_basic_device_init(ISABus *isa_bus, qemu_irq *gsi,
         }
     }
 
-    a20_line = qemu_allocate_irqs(handle_a20_line_change,
-                                  x86_env_get_cpu(first_cpu), 2);
+    a20_line = qemu_allocate_irqs(handle_a20_line_change, first_cpu, 2);
     i8042 = isa_create_simple(isa_bus, "i8042");
     i8042_setup_a20_line(i8042, &a20_line[0]);
     if (!no_vmport) {
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 01323a9..b58c255 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -229,8 +229,7 @@ static void pc_init1(MemoryRegion *system_memory,
     if (pci_enabled && acpi_enabled) {
         i2c_bus *smbus;
 
-        smi_irq = qemu_allocate_irqs(pc_acpi_smi_interrupt,
-                                     x86_env_get_cpu(first_cpu), 1);
+        smi_irq = qemu_allocate_irqs(pc_acpi_smi_interrupt, first_cpu, 1);
         /* TODO: Populate SPD eeprom data.  */
         smbus = piix4_pm_init(pci_bus, piix3_devfn + 3, 0xb100,
                               gsi[9], *smi_irq,
diff --git a/hw/intc/sh_intc.c b/hw/intc/sh_intc.c
index f397950..55c76e4 100644
--- a/hw/intc/sh_intc.c
+++ b/hw/intc/sh_intc.c
@@ -42,16 +42,15 @@ void sh_intc_toggle_source(struct intc_source *source,
         pending_changed = 1;
 
     if (pending_changed) {
-        CPUState *cpu = CPU(sh_env_get_cpu(first_cpu));
         if (source->pending) {
             source->parent->pending++;
             if (source->parent->pending == 1) {
-                cpu_interrupt(cpu, CPU_INTERRUPT_HARD);
+                cpu_interrupt(first_cpu, CPU_INTERRUPT_HARD);
             }
         } else {
             source->parent->pending--;
             if (source->parent->pending == 0) {
-                cpu_reset_interrupt(cpu, CPU_INTERRUPT_HARD);
+                cpu_reset_interrupt(first_cpu, CPU_INTERRUPT_HARD);
             }
 	}
     }
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index b49be4d..d1921aa 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -380,7 +380,7 @@ static void ich9_apm_ctrl_changed(uint32_t val, void *arg)
 
     /* SMI_EN = PMBASE + 30. SMI control and enable register */
     if (lpc->pm.smi_en & ICH9_PMIO_SMI_EN_APMC_EN) {
-        cpu_interrupt(CPU(x86_env_get_cpu(first_cpu)), CPU_INTERRUPT_SMI);
+        cpu_interrupt(first_cpu, CPU_INTERRUPT_SMI);
     }
 }
 
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 7e56121..de87241 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -844,7 +844,8 @@ void mips_malta_init(QEMUMachineInitArgs *args)
         cpu_mips_clock_init(env);
         qemu_register_reset(main_cpu_reset, cpu);
     }
-    env = first_cpu;
+    cpu = MIPS_CPU(first_cpu);
+    env = &cpu->env;
 
     /* allocate RAM */
     if (ram_size > (256 << 20)) {
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 69837a5..9600599 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -500,7 +500,6 @@ static DeviceState *ppce500_init_mpic_kvm(PPCE500Params *params,
                                           qemu_irq **irqs)
 {
     DeviceState *dev;
-    CPUPPCState *env;
     CPUState *cs;
     int r;
 
@@ -512,9 +511,7 @@ static DeviceState *ppce500_init_mpic_kvm(PPCE500Params *params,
         return NULL;
     }
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cs = ENV_GET_CPU(env);
-
+    for (cs = first_cpu; cs != NULL; cs = cs->next_cpu) {
         if (kvm_openpic_connect_vcpu(dev, cs)) {
             fprintf(stderr, "%s: failed to connect vcpu to irqchip\n",
                     __func__);
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index fb57b42..554f244 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -440,15 +440,14 @@ void ppce500_irq_init(CPUPPCState *env)
 /* Enable or Disable the E500 EPR capability */
 void ppce500_set_mpic_proxy(bool enabled)
 {
-    CPUPPCState *env;
+    CPUState *cs;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        PowerPCCPU *cpu = ppc_env_get_cpu(env);
-        CPUState *cs = CPU(cpu);
+    for (cs = first_cpu; cs != NULL; cs = cs->next_cpu) {
+        PowerPCCPU *cpu = POWERPC_CPU(cs);
 
-        env->mpic_proxy = enabled;
+        cpu->env.mpic_proxy = enabled;
         if (kvm_enabled()) {
-            kvmppc_set_mpic_proxy(POWERPC_CPU(cs), enabled);
+            kvmppc_set_mpic_proxy(cpu, enabled);
         }
     }
 }
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index d07dd01..19f2442 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -605,8 +605,9 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
     /* PCI -> ISA bridge */
     pci = pci_create_simple(pci_bus, PCI_DEVFN(1, 0), "i82378");
     cpu_exit_irq = qemu_allocate_irqs(cpu_request_exit, NULL, 1);
+    cpu = POWERPC_CPU(first_cpu);
     qdev_connect_gpio_out(&pci->qdev, 0,
-                          first_cpu->irq_inputs[PPC6xx_INPUT_INT]);
+                          cpu->env.irq_inputs[PPC6xx_INPUT_INT]);
     qdev_connect_gpio_out(&pci->qdev, 1, *cpu_exit_irq);
     sysbus_connect_irq(&pcihost->busdev, 0, qdev_get_gpio_in(&pci->qdev, 9));
     sysbus_connect_irq(&pcihost->busdev, 1, qdev_get_gpio_in(&pci->qdev, 11));
@@ -651,7 +652,8 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
     }
     isa_create_simple(isa_bus, "i8042");
 
-    sysctrl->reset_irq = first_cpu->irq_inputs[PPC6xx_INPUT_HRESET];
+    cpu = POWERPC_CPU(first_cpu);
+    sysctrl->reset_irq = cpu->env.irq_inputs[PPC6xx_INPUT_HRESET];
 
     portio_list_init(port_list, NULL, prep_portio_list, sysctrl, "prep");
     portio_list_add(port_list, get_system_io(), 0x0);
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index c040794..e46aad3 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -131,7 +131,6 @@ int spapr_allocate_irq_block(int num, bool lsi)
 static int spapr_fixup_cpu_dt(void *fdt, sPAPREnvironment *spapr)
 {
     int ret = 0, offset;
-    CPUPPCState *env;
     CPUState *cpu;
     char cpu_model[32];
     int smt = kvmppc_smt_threads();
@@ -139,8 +138,7 @@ static int spapr_fixup_cpu_dt(void *fdt, sPAPREnvironment *spapr)
 
     assert(spapr->cpu_model);
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = CPU(ppc_env_get_cpu(env));
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
         uint32_t associativity[] = {cpu_to_be32(0x5),
                                     cpu_to_be32(0x0),
                                     cpu_to_be32(0x0),
@@ -231,7 +229,7 @@ static void *spapr_create_fdt_skel(const char *cpu_model,
                                    uint32_t epow_irq)
 {
     void *fdt;
-    CPUPPCState *env;
+    CPUState *cs;
     uint32_t start_prop = cpu_to_be32(initrd_base);
     uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
     char hypertas_prop[] = "hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt"
@@ -304,10 +302,11 @@ static void *spapr_create_fdt_skel(const char *cpu_model,
     /* This is needed during FDT finalization */
     spapr->cpu_model = g_strdup(modelname);
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        CPUState *cpu = CPU(ppc_env_get_cpu(env));
-        PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
-        int index = cpu->cpu_index;
+    for (cs = first_cpu; cs != NULL; cs = cs->next_cpu) {
+        PowerPCCPU *cpu = POWERPC_CPU(cs);
+        CPUPPCState *env = &cpu->env;
+        PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
+        int index = cs->cpu_index;
         uint32_t servers_prop[smp_threads];
         uint32_t gservers_prop[smp_threads * 2];
         char *nodename;
@@ -632,7 +631,7 @@ static void spapr_reset_htab(sPAPREnvironment *spapr)
 
 static void ppc_spapr_reset(void)
 {
-    CPUState *first_cpu_cpu;
+    PowerPCCPU *first_ppc_cpu;
 
     /* Reset the hash table & recalc the RMA */
     spapr_reset_htab(spapr);
@@ -644,11 +643,11 @@ static void ppc_spapr_reset(void)
                        spapr->rtas_size);
 
     /* Set up the entry state */
-    first_cpu_cpu = ENV_GET_CPU(first_cpu);
-    first_cpu->gpr[3] = spapr->fdt_addr;
-    first_cpu->gpr[5] = 0;
-    first_cpu_cpu->halted = 0;
-    first_cpu->nip = spapr->entry_point;
+    first_ppc_cpu = POWERPC_CPU(first_cpu);
+    first_ppc_cpu->env.gpr[3] = spapr->fdt_addr;
+    first_ppc_cpu->env.gpr[5] = 0;
+    first_cpu->halted = 0;
+    first_ppc_cpu->env.nip = spapr->entry_point;
 
 }
 
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 6760851..6499cd0 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -356,7 +356,6 @@ CPUArchState *cpu_copy(CPUArchState *env);
 
 void QEMU_NORETURN cpu_abort(CPUArchState *env, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
-extern CPUArchState *first_cpu;
 
 /* Flags for use in ENV->INTERRUPT_PENDING.
 
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index c4ac929..39094b3 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -181,7 +181,6 @@ typedef struct CPUWatchpoint {
     sigjmp_buf jmp_env;                                                 \
     int exception_index;                                                \
                                                                         \
-    CPUArchState *next_cpu; /* next CPU sharing TB cache */                 \
     /* user data */                                                     \
     void *opaque;                                                       \
                                                                         \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index d7fc186..a08a8ab 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -114,6 +114,7 @@ struct kvm_run;
  *           CPU and return to its top level loop.
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
+ * @next_cpu: Next CPU sharing TB cache.
  * @kvm_fd: vCPU file descriptor for KVM.
  *
  * State of one CPU core or thread.
@@ -146,6 +147,7 @@ struct CPUState {
 
     void *env_ptr; /* CPUArchState */
     struct TranslationBlock *current_tb;
+    CPUState *next_cpu;
 
     int kvm_fd;
     bool kvm_vcpu_dirty;
@@ -157,6 +159,8 @@ struct CPUState {
     uint32_t halted; /* used by alpha, cris, ppc TCG */
 };
 
+extern CPUState *first_cpu;
+
 DECLARE_TLS(CPUState *, current_cpu);
 #define current_cpu tls_var(current_cpu)
 
diff --git a/kvm-all.c b/kvm-all.c
index 2c14ef3..c130705 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1938,7 +1938,9 @@ int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
         }
     }
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        CPUArchState *env = cpu->env_ptr;
+
         err = kvm_update_guest_debug(env, 0);
         if (err) {
             return err;
@@ -1979,7 +1981,9 @@ int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
         }
     }
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        CPUArchState *env = cpu->env_ptr;
+
         err = kvm_update_guest_debug(env, 0);
         if (err) {
             return err;
@@ -1992,13 +1996,11 @@ void kvm_remove_all_breakpoints(CPUState *cpu)
 {
     struct kvm_sw_breakpoint *bp, *next;
     KVMState *s = cpu->kvm_state;
-    CPUArchState *env;
 
     QTAILQ_FOREACH_SAFE(bp, &s->kvm_sw_breakpoints, entry, next) {
         if (kvm_arch_remove_sw_breakpoint(cpu, bp) != 0) {
             /* Try harder to find a CPU that currently sees the breakpoint. */
-            for (env = first_cpu; env != NULL; env = env->next_cpu) {
-                cpu = ENV_GET_CPU(env);
+            for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
                 if (kvm_arch_remove_sw_breakpoint(cpu, bp) == 0) {
                     break;
                 }
@@ -2009,7 +2011,9 @@ void kvm_remove_all_breakpoints(CPUState *cpu)
     }
     kvm_arch_remove_all_hw_breakpoints();
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        CPUArchState *env = cpu->env_ptr;
+
         kvm_update_guest_debug(env, 0);
     }
 }
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ddef23e..d517450 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2628,7 +2628,7 @@ static int fill_note_info(struct elf_note_info *info,
                           long signr, const CPUArchState *env)
 {
 #define NUMNOTES 3
-    CPUArchState *cpu = NULL;
+    CPUState *cpu = NULL;
     TaskState *ts = (TaskState *)env->opaque;
     int i;
 
@@ -2667,9 +2667,10 @@ static int fill_note_info(struct elf_note_info *info,
     /* read and fill status of all threads */
     cpu_list_lock();
     for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
-        if (cpu == thread_env)
+        if (cpu == ENV_GET_CPU(thread_env)) {
             continue;
-        fill_thread_info(info, cpu);
+        }
+        fill_thread_info(info, (CPUArchState *)cpu->env_ptr);
     }
     cpu_list_unlock();
 
diff --git a/linux-user/main.c b/linux-user/main.c
index af82db8..564bed6 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -120,8 +120,8 @@ void fork_end(int child)
     if (child) {
         /* Child processes created by fork() only have a single thread.
            Discard information about the parent threads.  */
-        first_cpu = thread_env;
-        thread_env->next_cpu = NULL;
+        first_cpu = ENV_GET_CPU(thread_env);
+        first_cpu->next_cpu = NULL;
         pending_cpus = 0;
         pthread_mutex_init(&exclusive_lock, NULL);
         pthread_mutex_init(&cpu_list_mutex, NULL);
@@ -148,7 +148,6 @@ static inline void exclusive_idle(void)
    Must only be called from outside cpu_arm_exec.   */
 static inline void start_exclusive(void)
 {
-    CPUArchState *other;
     CPUState *other_cpu;
 
     pthread_mutex_lock(&exclusive_lock);
@@ -156,8 +155,7 @@ static inline void start_exclusive(void)
 
     pending_cpus = 1;
     /* Make all other cpus stop executing.  */
-    for (other = first_cpu; other; other = other->next_cpu) {
-        other_cpu = ENV_GET_CPU(other);
+    for (other_cpu = first_cpu; other_cpu; other_cpu = other_cpu->next_cpu) {
         if (other_cpu->running) {
             pending_cpus++;
             cpu_exit(other_cpu);
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index a2125fa..4c96f4f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -5030,6 +5030,9 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                     abi_long arg5, abi_long arg6, abi_long arg7,
                     abi_long arg8)
 {
+#ifdef CONFIG_USE_NPTL
+    CPUState *cpu = ENV_GET_CPU(cpu_env);
+#endif
     abi_long ret;
     struct stat st;
     struct statfs stfs;
@@ -5052,13 +5055,13 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
            be disabling signals.  */
         if (first_cpu->next_cpu) {
             TaskState *ts;
-            CPUArchState **lastp;
-            CPUArchState *p;
+            CPUState **lastp;
+            CPUState *p;
 
             cpu_list_lock();
             lastp = &first_cpu;
             p = first_cpu;
-            while (p && p != (CPUArchState *)cpu_env) {
+            while (p && p != cpu) {
                 lastp = &p->next_cpu;
                 p = p->next_cpu;
             }
diff --git a/memory_mapping.c b/memory_mapping.c
index 5634f81..515a984 100644
--- a/memory_mapping.c
+++ b/memory_mapping.c
@@ -165,13 +165,13 @@ void memory_mapping_list_init(MemoryMappingList *list)
     QTAILQ_INIT(&list->head);
 }
 
-static CPUArchState *find_paging_enabled_cpu(CPUArchState *start_cpu)
+static CPUState *find_paging_enabled_cpu(CPUState *start_cpu)
 {
-    CPUArchState *env;
+    CPUState *cpu;
 
-    for (env = start_cpu; env != NULL; env = env->next_cpu) {
-        if (cpu_paging_enabled(ENV_GET_CPU(env))) {
-            return env;
+    for (cpu = start_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        if (cpu_paging_enabled(cpu)) {
+            return cpu;
         }
     }
 
@@ -180,15 +180,15 @@ static CPUArchState *find_paging_enabled_cpu(CPUArchState *start_cpu)
 
 void qemu_get_guest_memory_mapping(MemoryMappingList *list, Error **errp)
 {
-    CPUArchState *env, *first_paging_enabled_cpu;
+    CPUState *cpu, *first_paging_enabled_cpu;
     RAMBlock *block;
     ram_addr_t offset, length;
 
     first_paging_enabled_cpu = find_paging_enabled_cpu(first_cpu);
     if (first_paging_enabled_cpu) {
-        for (env = first_paging_enabled_cpu; env != NULL; env = env->next_cpu) {
+        for (cpu = first_paging_enabled_cpu; cpu != NULL; cpu = cpu->next_cpu) {
             Error *err = NULL;
-            cpu_get_memory_mapping(ENV_GET_CPU(env), list, &err);
+            cpu_get_memory_mapping(cpu, list, &err);
             if (err) {
                 error_propagate(errp, err);
                 return;
diff --git a/monitor.c b/monitor.c
index 9be515c..2ba7876 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1806,14 +1806,12 @@ static void do_info_mtree(Monitor *mon, const QDict *qdict)
 static void do_info_numa(Monitor *mon, const QDict *qdict)
 {
     int i;
-    CPUArchState *env;
     CPUState *cpu;
 
     monitor_printf(mon, "%d nodes\n", nb_numa_nodes);
     for (i = 0; i < nb_numa_nodes; i++) {
         monitor_printf(mon, "node %d cpus:", i);
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
-            cpu = ENV_GET_CPU(env);
+        for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
             if (cpu->numa_node == i) {
                 monitor_printf(mon, " %d", cpu->cpu_index);
             }
diff --git a/target-i386/arch_dump.c b/target-i386/arch_dump.c
index 83898cd..d133228 100644
--- a/target-i386/arch_dump.c
+++ b/target-i386/arch_dump.c
@@ -185,7 +185,8 @@ int x86_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
     X86CPU *cpu = X86_CPU(cs);
     int ret;
 #ifdef TARGET_X86_64
-    bool lma = !!(first_cpu->hflags & HF_LMA_MASK);
+    X86CPU *first_x86_cpu = X86_CPU(first_cpu);
+    bool lma = !!(first_x86_cpu->env.hflags & HF_LMA_MASK);
 
     if (lma) {
         ret = x86_64_write_elf64_note(f, &cpu->env, cpuid, opaque);
@@ -394,7 +395,9 @@ int cpu_get_dump_info(ArchDumpInfo *info)
     RAMBlock *block;
 
 #ifdef TARGET_X86_64
-    lma = !!(first_cpu->hflags & HF_LMA_MASK);
+    X86CPU *first_x86_cpu = X86_CPU(first_cpu);
+
+    lma = !!(first_x86_cpu->env.hflags & HF_LMA_MASK);
 #endif
 
     if (lma) {
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 5e5abe3..d6f43d7 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1188,6 +1188,7 @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
                         uint64_t status, uint64_t mcg_status, uint64_t addr,
                         uint64_t misc, int flags)
 {
+    CPUState *cs = CPU(cpu);
     CPUX86State *cenv = &cpu->env;
     MCEInjectionParams params = {
         .mon = mon,
@@ -1200,7 +1201,6 @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
         .flags = flags,
     };
     unsigned bank_num = cenv->mcg_cap & 0xff;
-    CPUX86State *env;
 
     if (!cenv->mcg_cap) {
         monitor_printf(mon, "MCE injection not supported\n");
@@ -1220,19 +1220,22 @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
         return;
     }
 
-    run_on_cpu(CPU(cpu), do_inject_x86_mce, &params);
+    run_on_cpu(cs, do_inject_x86_mce, &params);
     if (flags & MCE_INJECT_BROADCAST) {
+        CPUState *other_cs;
+
         params.bank = 1;
         params.status = MCI_STATUS_VAL | MCI_STATUS_UC;
         params.mcg_status = MCG_STATUS_MCIP | MCG_STATUS_RIPV;
         params.addr = 0;
         params.misc = 0;
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
-            if (cenv == env) {
+        for (other_cs = first_cpu; other_cs != NULL;
+             other_cs = other_cs->next_cpu) {
+            if (other_cs == cs) {
                 continue;
             }
-            params.cpu = x86_env_get_cpu(env);
-            run_on_cpu(CPU(cpu), do_inject_x86_mce, &params);
+            params.cpu = X86_CPU(other_cs);
+            run_on_cpu(other_cs, do_inject_x86_mce, &params);
         }
     }
 }
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 4b557b3..935ef63 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -345,20 +345,22 @@ int kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
 
 int kvm_arch_on_sigbus(int code, void *addr)
 {
-    if ((first_cpu->mcg_cap & MCG_SER_P) && addr && code == BUS_MCEERR_AO) {
+    X86CPU *cpu = X86_CPU(first_cpu);
+
+    if ((cpu->env.mcg_cap & MCG_SER_P) && addr && code == BUS_MCEERR_AO) {
         ram_addr_t ram_addr;
         hwaddr paddr;
 
         /* Hope we are lucky for AO MCE */
         if (qemu_ram_addr_from_host(addr, &ram_addr) == NULL ||
-            !kvm_physical_memory_addr_from_host(CPU(first_cpu)->kvm_state,
+            !kvm_physical_memory_addr_from_host(first_cpu->kvm_state,
                                                 addr, &paddr)) {
             fprintf(stderr, "Hardware memory error for memory used by "
                     "QEMU itself instead of guest system!: %p\n", addr);
             return 0;
         }
         kvm_hwpoison_page_add(ram_addr);
-        kvm_mce_inject(x86_env_get_cpu(first_cpu), paddr, code);
+        kvm_mce_inject(X86_CPU(first_cpu), paddr, code);
     } else {
         if (code == BUS_MCEERR_AO) {
             return 0;
diff --git a/target-i386/misc_helper.c b/target-i386/misc_helper.c
index e345f9a..957926c 100644
--- a/target-i386/misc_helper.c
+++ b/target-i386/misc_helper.c
@@ -610,7 +610,7 @@ void helper_mwait(CPUX86State *env, int next_eip_addend)
     cpu = x86_env_get_cpu(env);
     cs = CPU(cpu);
     /* XXX: not complete but not completely erroneous */
-    if (cs->cpu_index != 0 || env->next_cpu != NULL) {
+    if (cs->cpu_index != 0 || cs->next_cpu != NULL) {
         /* more than one CPU: do not sleep because another CPU may
            wake this one */
     } else {
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index f6838ec..5cf1c3f 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -1696,39 +1696,38 @@ target_ulong helper_emt(void)
 
 target_ulong helper_dvpe(CPUMIPSState *env)
 {
-    CPUMIPSState *other_cpu_env = first_cpu;
+    CPUState *other_cs = first_cpu;
     target_ulong prev = env->mvp->CP0_MVPControl;
 
     do {
+        MIPSCPU *other_cpu = MIPS_CPU(other_cs);
         /* Turn off all VPEs except the one executing the dvpe.  */
-        if (other_cpu_env != env) {
-            MIPSCPU *other_cpu = mips_env_get_cpu(other_cpu_env);
-
-            other_cpu_env->mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);
+        if (&other_cpu->env != env) {
+            other_cpu->env.mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);
             mips_vpe_sleep(other_cpu);
         }
-        other_cpu_env = other_cpu_env->next_cpu;
-    } while (other_cpu_env);
+        other_cs = other_cs->next_cpu;
+    } while (other_cs);
     return prev;
 }
 
 target_ulong helper_evpe(CPUMIPSState *env)
 {
-    CPUMIPSState *other_cpu_env = first_cpu;
+    CPUState *other_cs = first_cpu;
     target_ulong prev = env->mvp->CP0_MVPControl;
 
     do {
-        MIPSCPU *other_cpu = mips_env_get_cpu(other_cpu_env);
+        MIPSCPU *other_cpu = MIPS_CPU(other_cs);
 
-        if (other_cpu_env != env
+        if (&other_cpu->env != env
             /* If the VPE is WFI, don't disturb its sleep.  */
             && !mips_vpe_is_wfi(other_cpu)) {
             /* Enable the VPE.  */
-            other_cpu_env->mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
+            other_cpu->env.mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
             mips_vpe_wake(other_cpu); /* And wake it up.  */
         }
-        other_cpu_env = other_cpu_env->next_cpu;
-    } while (other_cpu_env);
+        other_cs = other_cs->next_cpu;
+    } while (other_cs);
     return prev;
 }
 #endif /* !CONFIG_USER_ONLY */
diff --git a/target-ppc/excp_helper.c b/target-ppc/excp_helper.c
index 4a0fc6d..e9fcad8 100644
--- a/target-ppc/excp_helper.c
+++ b/target-ppc/excp_helper.c
@@ -986,16 +986,19 @@ void helper_msgsnd(target_ulong rb)
 {
     int irq = dbell2irq(rb);
     int pir = rb & DBELL_PIRTAG_MASK;
-    CPUPPCState *cenv;
+    CPUState *cs;
 
     if (irq < 0) {
         return;
     }
 
-    for (cenv = first_cpu; cenv != NULL; cenv = cenv->next_cpu) {
+    for (cs = first_cpu; cs != NULL; cs = cs->next_cpu) {
+        PowerPCCPU *cpu = POWERPC_CPU(cs);
+        CPUPPCState *cenv = &cpu->env;
+
         if ((rb & DBELL_BRDCAST) || (cenv->spr[SPR_BOOKE_PIR] == pir)) {
             cenv->pending_interrupts |= 1 << irq;
-            cpu_interrupt(CPU(ppc_env_get_cpu(cenv)), CPU_INTERRUPT_HARD);
+            cpu_interrupt(cs, CPU_INTERRUPT_HARD);
         }
     }
 }
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index e95ad4a..b0099e1 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1579,7 +1579,7 @@ uint64_t kvmppc_rma_size(uint64_t current_size, unsigned int hash_shift)
 
     /* Find the largest hardware supported page size that's less than
      * or equal to the (logical) backing page size of guest RAM */
-    kvm_get_smmu_info(ppc_env_get_cpu(first_cpu), &info);
+    kvm_get_smmu_info(POWERPC_CPU(first_cpu), &info);
     rampagesize = getrampagesize();
     best_page_shift = 0;
 
diff --git a/translate-all.c b/translate-all.c
index 02f8e5e..e8683d2 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -681,7 +681,7 @@ static void page_flush_tb(void)
 /* XXX: tb_flush is currently not thread safe */
 void tb_flush(CPUArchState *env1)
 {
-    CPUArchState *env;
+    CPUState *cpu;
 
 #if defined(DEBUG_FLUSH)
     printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
@@ -696,7 +696,9 @@ void tb_flush(CPUArchState *env1)
     }
     tcg_ctx.tb_ctx.nb_tbs = 0;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        CPUArchState *env = cpu->env_ptr;
+
         memset(env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof(void *));
     }
 
@@ -821,7 +823,7 @@ static inline void tb_reset_jump(TranslationBlock *tb, int n)
 /* invalidate one TB */
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
 {
-    CPUArchState *env;
+    CPUState *cpu;
     PageDesc *p;
     unsigned int h, n1;
     tb_page_addr_t phys_pc;
@@ -848,7 +850,9 @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
 
     /* remove the TB from the hash list */
     h = tb_jmp_cache_hash_func(tb->pc);
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+        CPUArchState *env = cpu->env_ptr;
+
         if (env->tb_jmp_cache[h] == tb) {
             env->tb_jmp_cache[h] = NULL;
         }
commit 9b056fcc5becd183fa2bdec9d259bf26b5f71207
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Jun 24 23:53:10 2013 +0200

    linux-user: Clean up do_syscall() Coding Style for TARGET_NR_exit
    
    In particular fix 6-/10-char indentation.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index cdd0c28..a2125fa 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -5044,42 +5044,43 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
     switch(num) {
     case TARGET_NR_exit:
 #ifdef CONFIG_USE_NPTL
-      /* In old applications this may be used to implement _exit(2).
-         However in threaded applictions it is used for thread termination,
-         and _exit_group is used for application termination.
-         Do thread termination if we have more then one thread.  */
-      /* FIXME: This probably breaks if a signal arrives.  We should probably
-         be disabling signals.  */
-      if (first_cpu->next_cpu) {
-          TaskState *ts;
-          CPUArchState **lastp;
-          CPUArchState *p;
-
-          cpu_list_lock();
-          lastp = &first_cpu;
-          p = first_cpu;
-          while (p && p != (CPUArchState *)cpu_env) {
-              lastp = &p->next_cpu;
-              p = p->next_cpu;
-          }
-          /* If we didn't find the CPU for this thread then something is
-             horribly wrong.  */
-          if (!p)
-              abort();
-          /* Remove the CPU from the list.  */
-          *lastp = p->next_cpu;
-          cpu_list_unlock();
-          ts = ((CPUArchState *)cpu_env)->opaque;
-          if (ts->child_tidptr) {
-              put_user_u32(0, ts->child_tidptr);
-              sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
-                        NULL, NULL, 0);
-          }
-          thread_env = NULL;
-          object_unref(OBJECT(ENV_GET_CPU(cpu_env)));
-          g_free(ts);
-          pthread_exit(NULL);
-      }
+        /* In old applications this may be used to implement _exit(2).
+           However in threaded applictions it is used for thread termination,
+           and _exit_group is used for application termination.
+           Do thread termination if we have more then one thread.  */
+        /* FIXME: This probably breaks if a signal arrives.  We should probably
+           be disabling signals.  */
+        if (first_cpu->next_cpu) {
+            TaskState *ts;
+            CPUArchState **lastp;
+            CPUArchState *p;
+
+            cpu_list_lock();
+            lastp = &first_cpu;
+            p = first_cpu;
+            while (p && p != (CPUArchState *)cpu_env) {
+                lastp = &p->next_cpu;
+                p = p->next_cpu;
+            }
+            /* If we didn't find the CPU for this thread then something is
+               horribly wrong.  */
+            if (!p) {
+                abort();
+            }
+            /* Remove the CPU from the list.  */
+            *lastp = p->next_cpu;
+            cpu_list_unlock();
+            ts = ((CPUArchState *)cpu_env)->opaque;
+            if (ts->child_tidptr) {
+                put_user_u32(0, ts->child_tidptr);
+                sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
+                          NULL, NULL, 0);
+            }
+            thread_env = NULL;
+            object_unref(OBJECT(ENV_GET_CPU(cpu_env)));
+            g_free(ts);
+            pthread_exit(NULL);
+        }
 #endif
 #ifdef TARGET_GPROF
         _mcleanup();
commit 1d5791f4a67048591c1b038e47c85ccb2c023214
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 14:40:48 2013 +0200

    kvm: Change kvm_remove_all_breakpoints() argument to CPUState
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 9ae6576..f7d9f13 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2019,7 +2019,7 @@ static void gdb_breakpoint_remove_all(void)
     CPUArchState *env;
 
     if (kvm_enabled()) {
-        kvm_remove_all_breakpoints(gdbserver_state->c_cpu);
+        kvm_remove_all_breakpoints(ENV_GET_CPU(gdbserver_state->c_cpu));
         return;
     }
 
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 7596aca..1e08a85 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -173,7 +173,7 @@ int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type);
 int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type);
-void kvm_remove_all_breakpoints(CPUArchState *env);
+void kvm_remove_all_breakpoints(CPUState *cpu);
 int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap);
 #ifndef _WIN32
 int kvm_set_signal_mask(CPUState *cpu, const sigset_t *sigset);
diff --git a/kvm-all.c b/kvm-all.c
index ed13d57..2c14ef3 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1988,11 +1988,11 @@ int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
     return 0;
 }
 
-void kvm_remove_all_breakpoints(CPUArchState *env)
+void kvm_remove_all_breakpoints(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_sw_breakpoint *bp, *next;
     KVMState *s = cpu->kvm_state;
+    CPUArchState *env;
 
     QTAILQ_FOREACH_SAFE(bp, &s->kvm_sw_breakpoints, entry, next) {
         if (kvm_arch_remove_sw_breakpoint(cpu, bp) != 0) {
@@ -2033,7 +2033,7 @@ int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
     return -EINVAL;
 }
 
-void kvm_remove_all_breakpoints(CPUArchState *env)
+void kvm_remove_all_breakpoints(CPUState *cpu)
 {
 }
 #endif /* !KVM_CAP_SET_GUEST_DEBUG */
diff --git a/kvm-stub.c b/kvm-stub.c
index 583c636..370c837 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -95,7 +95,7 @@ int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
     return -EINVAL;
 }
 
-void kvm_remove_all_breakpoints(CPUArchState *env)
+void kvm_remove_all_breakpoints(CPUState *cpu)
 {
 }
 
commit 4917cf44326a1bda2fd7f27303aff7a25ad86518
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 05:17:50 2013 +0200

    cpu: Replace cpu_single_env with CPUState current_cpu
    
    Move it to qom/cpu.h.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpu-exec.c b/cpu-exec.c
index ec46380..503b103 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -213,12 +213,12 @@ int cpu_exec(CPUArchState *env)
         cpu->halted = 0;
     }
 
-    cpu_single_env = env;
+    current_cpu = cpu;
 
-    /* As long as cpu_single_env is null, up to the assignment just above,
+    /* As long as current_cpu is null, up to the assignment just above,
      * requests by other threads to exit the execution loop are expected to
      * be issued using the exit_request global. We must make sure that our
-     * evaluation of the global value is performed past the cpu_single_env
+     * evaluation of the global value is performed past the current_cpu
      * value transition point, which requires a memory barrier as well as
      * an instruction scheduling constraint on modern architectures.  */
     smp_mb();
@@ -673,7 +673,8 @@ int cpu_exec(CPUArchState *env)
         } else {
             /* Reload env after longjmp - the compiler may have smashed all
              * local variables as longjmp is marked 'noreturn'. */
-            env = cpu_single_env;
+            cpu = current_cpu;
+            env = cpu->env_ptr;
         }
     } /* for(;;) */
 
@@ -707,7 +708,7 @@ int cpu_exec(CPUArchState *env)
 #error unsupported target CPU
 #endif
 
-    /* fail safe : never use cpu_single_env outside cpu_exec() */
-    cpu_single_env = NULL;
+    /* fail safe : never use current_cpu outside cpu_exec() */
+    current_cpu = NULL;
     return ret;
 }
diff --git a/cpus.c b/cpus.c
index 20958e5..e9bfa71 100644
--- a/cpus.c
+++ b/cpus.c
@@ -118,10 +118,11 @@ TimersState timers_state;
 int64_t cpu_get_icount(void)
 {
     int64_t icount;
-    CPUArchState *env = cpu_single_env;
+    CPUState *cpu = current_cpu;
 
     icount = qemu_icount;
-    if (env) {
+    if (cpu) {
+        CPUArchState *env = cpu->env_ptr;
         if (!can_do_io(env)) {
             fprintf(stderr, "Bad clock read\n");
         }
@@ -468,8 +469,8 @@ static void cpu_handle_guest_debug(CPUState *cpu)
 
 static void cpu_signal(int sig)
 {
-    if (cpu_single_env) {
-        cpu_exit(ENV_GET_CPU(cpu_single_env));
+    if (current_cpu) {
+        cpu_exit(current_cpu);
     }
     exit_request = 1;
 }
@@ -660,10 +661,10 @@ void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
 
     qemu_cpu_kick(cpu);
     while (!wi.done) {
-        CPUArchState *self_env = cpu_single_env;
+        CPUState *self_cpu = current_cpu;
 
         qemu_cond_wait(&qemu_work_cond, &qemu_global_mutex);
-        cpu_single_env = self_env;
+        current_cpu = self_cpu;
     }
 }
 
@@ -733,7 +734,7 @@ static void *qemu_kvm_cpu_thread_fn(void *arg)
     qemu_mutex_lock(&qemu_global_mutex);
     qemu_thread_get_self(cpu->thread);
     cpu->thread_id = qemu_get_thread_id();
-    cpu_single_env = cpu->env_ptr;
+    current_cpu = cpu;
 
     r = kvm_init_vcpu(cpu);
     if (r < 0) {
@@ -781,9 +782,9 @@ static void *qemu_dummy_cpu_thread_fn(void *arg)
     cpu->created = true;
     qemu_cond_signal(&qemu_cpu_cond);
 
-    cpu_single_env = cpu->env_ptr;
+    current_cpu = cpu;
     while (1) {
-        cpu_single_env = NULL;
+        current_cpu = NULL;
         qemu_mutex_unlock_iothread();
         do {
             int sig;
@@ -794,7 +795,7 @@ static void *qemu_dummy_cpu_thread_fn(void *arg)
             exit(1);
         }
         qemu_mutex_lock_iothread();
-        cpu_single_env = cpu->env_ptr;
+        current_cpu = cpu;
         qemu_wait_io_event_common(cpu);
     }
 
@@ -894,12 +895,11 @@ void qemu_cpu_kick(CPUState *cpu)
 void qemu_cpu_kick_self(void)
 {
 #ifndef _WIN32
-    assert(cpu_single_env);
-    CPUState *cpu_single_cpu = ENV_GET_CPU(cpu_single_env);
+    assert(current_cpu);
 
-    if (!cpu_single_cpu->thread_kicked) {
-        qemu_cpu_kick_thread(cpu_single_cpu);
-        cpu_single_cpu->thread_kicked = true;
+    if (!current_cpu->thread_kicked) {
+        qemu_cpu_kick_thread(current_cpu);
+        current_cpu->thread_kicked = true;
     }
 #else
     abort();
@@ -913,7 +913,7 @@ bool qemu_cpu_is_self(CPUState *cpu)
 
 static bool qemu_in_vcpu_thread(void)
 {
-    return cpu_single_env && qemu_cpu_is_self(ENV_GET_CPU(cpu_single_env));
+    return current_cpu && qemu_cpu_is_self(current_cpu);
 }
 
 void qemu_mutex_lock_iothread(void)
@@ -1069,11 +1069,10 @@ void qemu_init_vcpu(CPUState *cpu)
 
 void cpu_stop_current(void)
 {
-    if (cpu_single_env) {
-        CPUState *cpu_single_cpu = ENV_GET_CPU(cpu_single_env);
-        cpu_single_cpu->stop = false;
-        cpu_single_cpu->stopped = true;
-        cpu_exit(cpu_single_cpu);
+    if (current_cpu) {
+        current_cpu->stop = false;
+        current_cpu->stopped = true;
+        cpu_exit(current_cpu);
         qemu_cond_signal(&qemu_pause_cond);
     }
 }
diff --git a/exec.c b/exec.c
index 03fdf7e..9ca80cc 100644
--- a/exec.c
+++ b/exec.c
@@ -72,7 +72,7 @@ static MemoryRegion io_mem_unassigned;
 CPUArchState *first_cpu;
 /* current CPU in the current thread. It is only valid inside
    cpu_exec() */
-DEFINE_TLS(CPUArchState *,cpu_single_env);
+DEFINE_TLS(CPUState *, current_cpu);
 /* 0 = Do not count executed instructions.
    1 = Precise instruction counting.
    2 = Adaptive rate instruction counting.  */
@@ -1472,8 +1472,10 @@ static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
     cpu_physical_memory_set_dirty_flags(ram_addr, dirty_flags);
     /* we remove the notdirty callback only if the code has been
        flushed */
-    if (dirty_flags == 0xff)
-        tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
+    if (dirty_flags == 0xff) {
+        CPUArchState *env = current_cpu->env_ptr;
+        tlb_set_dirty(env, env->mem_io_vaddr);
+    }
 }
 
 static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
@@ -1491,7 +1493,7 @@ static const MemoryRegionOps notdirty_mem_ops = {
 /* Generate a debug exception if a watchpoint has been hit.  */
 static void check_watchpoint(int offset, int len_mask, int flags)
 {
-    CPUArchState *env = cpu_single_env;
+    CPUArchState *env = current_cpu->env_ptr;
     target_ulong pc, cs_base;
     target_ulong vaddr;
     CPUWatchpoint *wp;
@@ -1930,7 +1932,7 @@ bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
         if (is_write) {
             if (!memory_access_is_direct(mr, is_write)) {
                 l = memory_access_size(mr, l, addr1);
-                /* XXX: could force cpu_single_env to NULL to avoid
+                /* XXX: could force current_cpu to NULL to avoid
                    potential bugs */
                 if (l == 4) {
                     /* 32 bit write access */
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 63cc2cb..1c3ac8e 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -72,9 +72,8 @@ static void cpu_irq_change(AlphaCPU *cpu, uint64_t req)
 
 static uint64_t cchip_read(void *opaque, hwaddr addr, unsigned size)
 {
-    CPUAlphaState *env = cpu_single_env;
+    CPUState *cpu = current_cpu;
     TyphoonState *s = opaque;
-    CPUState *cpu;
     uint64_t ret = 0;
 
     if (addr & 4) {
@@ -95,7 +94,6 @@ static uint64_t cchip_read(void *opaque, hwaddr addr, unsigned size)
 
     case 0x0080:
         /* MISC: Miscellaneous Register.  */
-        cpu = ENV_GET_CPU(env);
         ret = s->cchip.misc | (cpu->cpu_index & 3);
         break;
 
@@ -197,7 +195,6 @@ static uint64_t cchip_read(void *opaque, hwaddr addr, unsigned size)
         break;
 
     default:
-        cpu = CPU(alpha_env_get_cpu(cpu_single_env));
         cpu_unassigned_access(cpu, addr, false, false, 0, size);
         return -1;
     }
@@ -215,7 +212,6 @@ static uint64_t dchip_read(void *opaque, hwaddr addr, unsigned size)
 static uint64_t pchip_read(void *opaque, hwaddr addr, unsigned size)
 {
     TyphoonState *s = opaque;
-    CPUState *cs;
     uint64_t ret = 0;
 
     if (addr & 4) {
@@ -302,8 +298,7 @@ static uint64_t pchip_read(void *opaque, hwaddr addr, unsigned size)
         break;
 
     default:
-        cs = CPU(alpha_env_get_cpu(cpu_single_env));
-        cpu_unassigned_access(cs, addr, false, false, 0, size);
+        cpu_unassigned_access(current_cpu, addr, false, false, 0, size);
         return -1;
     }
 
@@ -315,7 +310,6 @@ static void cchip_write(void *opaque, hwaddr addr,
                         uint64_t v32, unsigned size)
 {
     TyphoonState *s = opaque;
-    CPUState *cpu_single_cpu = CPU(alpha_env_get_cpu(cpu_single_env));
     uint64_t val, oldval, newval;
 
     if (addr & 4) {
@@ -465,7 +459,7 @@ static void cchip_write(void *opaque, hwaddr addr,
         break;
 
     default:
-        cpu_unassigned_access(cpu_single_cpu, addr, true, false, 0, size);
+        cpu_unassigned_access(current_cpu, addr, true, false, 0, size);
         return;
     }
 }
@@ -480,7 +474,6 @@ static void pchip_write(void *opaque, hwaddr addr,
                         uint64_t v32, unsigned size)
 {
     TyphoonState *s = opaque;
-    CPUState *cs;
     uint64_t val, oldval;
 
     if (addr & 4) {
@@ -582,8 +575,7 @@ static void pchip_write(void *opaque, hwaddr addr,
         break;
 
     default:
-        cs = CPU(alpha_env_get_cpu(cpu_single_env));
-        cpu_unassigned_access(cs, addr, true, false, 0, size);
+        cpu_unassigned_access(current_cpu, addr, true, false, 0, size);
         return;
     }
 }
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 5a22654..3c520d7 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -301,8 +301,7 @@ static int pxa2xx_pwrmode_write(CPUARMState *env, const ARMCPRegInfo *ri,
 #endif
 
         /* Suspend */
-        cpu_interrupt(CPU(arm_env_get_cpu(cpu_single_env)),
-                      CPU_INTERRUPT_HALT);
+        cpu_interrupt(current_cpu, CPU_INTERRUPT_HALT);
 
         goto message;
 
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 9850a85..e13678f 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -624,11 +624,13 @@ static int vapic_prepare(VAPICROMState *s)
 static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
                         unsigned int size)
 {
-    CPUX86State *env = cpu_single_env;
+    CPUState *cs = current_cpu;
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
     hwaddr rom_paddr;
     VAPICROMState *s = opaque;
 
-    cpu_synchronize_state(CPU(x86_env_get_cpu(env)));
+    cpu_synchronize_state(cs);
 
     /*
      * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index e00f9dc..5224256 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -886,8 +886,9 @@ void pc_init_ne2k_isa(ISABus *bus, NICInfo *nd)
 
 DeviceState *cpu_get_current_apic(void)
 {
-    if (cpu_single_env) {
-        return cpu_single_env->apic_state;
+    if (current_cpu) {
+        X86CPU *cpu = X86_CPU(current_cpu);
+        return cpu->env.apic_state;
     } else {
         return NULL;
     }
@@ -1176,10 +1177,10 @@ DeviceState *pc_vga_init(ISABus *isa_bus, PCIBus *pci_bus)
 
 static void cpu_request_exit(void *opaque, int irq, int level)
 {
-    CPUX86State *env = cpu_single_env;
+    CPUState *cpu = current_cpu;
 
-    if (env && level) {
-        cpu_exit(CPU(x86_env_get_cpu(env)));
+    if (cpu && level) {
+        cpu_exit(cpu);
     }
 }
 
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index b59df06..237d1d6 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -39,8 +39,7 @@ static const uint8_t gic_id[] = {
 static inline int gic_get_current_cpu(GICState *s)
 {
     if (s->num_cpu > 1) {
-        CPUState *cpu = ENV_GET_CPU(cpu_single_env);
-        return cpu->cpu_index;
+        return current_cpu->cpu_index;
     }
     return 0;
 }
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 2a57f77..178344b 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -140,6 +140,7 @@ void armv7m_nvic_complete_irq(void *opaque, int irq)
 
 static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
 {
+    ARMCPU *cpu;
     uint32_t val;
     int irq;
 
@@ -171,7 +172,8 @@ static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
     case 0x1c: /* SysTick Calibration Value.  */
         return 10000;
     case 0xd00: /* CPUID Base.  */
-        return cpu_single_env->cp15.c0_cpuid;
+        cpu = ARM_CPU(current_cpu);
+        return cpu->env.cp15.c0_cpuid;
     case 0xd04: /* Interrupt Control State.  */
         /* VECTACTIVE */
         val = s->gic.running_irq[0];
@@ -206,7 +208,8 @@ static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
             val |= (1 << 31);
         return val;
     case 0xd08: /* Vector Table Offset.  */
-        return cpu_single_env->v7m.vecbase;
+        cpu = ARM_CPU(current_cpu);
+        return cpu->env.v7m.vecbase;
     case 0xd0c: /* Application Interrupt/Reset Control.  */
         return 0xfa05000;
     case 0xd10: /* System Control.  */
@@ -279,6 +282,7 @@ static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
 
 static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value)
 {
+    ARMCPU *cpu;
     uint32_t oldval;
     switch (offset) {
     case 0x10: /* SysTick Control and Status.  */
@@ -331,7 +335,8 @@ static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value)
         }
         break;
     case 0xd08: /* Vector Table Offset.  */
-        cpu_single_env->v7m.vecbase = value & 0xffffff80;
+        cpu = ARM_CPU(current_cpu);
+        cpu->env.v7m.vecbase = value & 0xffffff80;
         break;
     case 0xd0c: /* Application Interrupt/Reset Control.  */
         if ((value >> 16) == 0x05fa) {
diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index 937e292..d984dba 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -180,14 +180,11 @@ static int output_to_inttgt(int output)
 
 static int get_current_cpu(void)
 {
-    CPUState *cpu_single_cpu;
-
-    if (!cpu_single_env) {
+    if (!current_cpu) {
         return -1;
     }
 
-    cpu_single_cpu = ENV_GET_CPU(cpu_single_env);
-    return cpu_single_cpu->cpu_index;
+    return current_cpu->cpu_index;
 }
 
 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index 03e44d5..9e305d2 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -250,10 +250,10 @@ static void network_init (PCIBus *pci_bus)
 
 static void cpu_request_exit(void *opaque, int irq, int level)
 {
-    CPUMIPSState *env = cpu_single_env;
+    CPUState *cpu = current_cpu;
 
-    if (env && level) {
-        cpu_exit(CPU(mips_env_get_cpu(env)));
+    if (cpu && level) {
+        cpu_exit(cpu);
     }
 }
 
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 3eac63b..31e138b 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -99,10 +99,10 @@ static const MemoryRegionOps dma_dummy_ops = {
 
 static void cpu_request_exit(void *opaque, int irq, int level)
 {
-    CPUMIPSState *env = cpu_single_env;
+    CPUState *cpu = current_cpu;
 
-    if (env && level) {
-        cpu_exit(CPU(mips_env_get_cpu(env)));
+    if (cpu && level) {
+        cpu_exit(cpu);
     }
 }
 
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index ceadc72..7e56121 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -770,10 +770,10 @@ static void main_cpu_reset(void *opaque)
 
 static void cpu_request_exit(void *opaque, int irq, int level)
 {
-    CPUMIPSState *env = cpu_single_env;
+    CPUState *cpu = current_cpu;
 
-    if (env && level) {
-        cpu_exit(CPU(mips_env_get_cpu(env)));
+    if (cpu && level) {
+        cpu_exit(cpu);
     }
 }
 
diff --git a/hw/misc/vmport.c b/hw/misc/vmport.c
index 7463776..0b5a564 100644
--- a/hw/misc/vmport.c
+++ b/hw/misc/vmport.c
@@ -62,11 +62,13 @@ static uint64_t vmport_ioport_read(void *opaque, hwaddr addr,
                                    unsigned size)
 {
     VMPortState *s = opaque;
-    CPUX86State *env = cpu_single_env;
+    CPUState *cs = current_cpu;
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
     unsigned char command;
     uint32_t eax;
 
-    cpu_synchronize_state(CPU(x86_env_get_cpu(env)));
+    cpu_synchronize_state(cs);
 
     eax = env->regs[R_EAX];
     if (eax != VMPORT_MAGIC)
@@ -89,29 +91,32 @@ static uint64_t vmport_ioport_read(void *opaque, hwaddr addr,
 static void vmport_ioport_write(void *opaque, hwaddr addr,
                                 uint64_t val, unsigned size)
 {
-    CPUX86State *env = cpu_single_env;
+    X86CPU *cpu = X86_CPU(current_cpu);
 
-    env->regs[R_EAX] = vmport_ioport_read(opaque, addr, 4);
+    cpu->env.regs[R_EAX] = vmport_ioport_read(opaque, addr, 4);
 }
 
 static uint32_t vmport_cmd_get_version(void *opaque, uint32_t addr)
 {
-    CPUX86State *env = cpu_single_env;
-    env->regs[R_EBX] = VMPORT_MAGIC;
+    X86CPU *cpu = X86_CPU(current_cpu);
+
+    cpu->env.regs[R_EBX] = VMPORT_MAGIC;
     return 6;
 }
 
 static uint32_t vmport_cmd_ram_size(void *opaque, uint32_t addr)
 {
-    CPUX86State *env = cpu_single_env;
-    env->regs[R_EBX] = 0x1177;
+    X86CPU *cpu = X86_CPU(current_cpu);
+
+    cpu->env.regs[R_EBX] = 0x1177;
     return ram_size;
 }
 
 /* vmmouse helpers */
 void vmmouse_get_data(uint32_t *data)
 {
-    CPUX86State *env = cpu_single_env;
+    X86CPU *cpu = X86_CPU(current_cpu);
+    CPUX86State *env = &cpu->env;
 
     data[0] = env->regs[R_EAX]; data[1] = env->regs[R_EBX];
     data[2] = env->regs[R_ECX]; data[3] = env->regs[R_EDX];
@@ -120,7 +125,8 @@ void vmmouse_get_data(uint32_t *data)
 
 void vmmouse_set_data(const uint32_t *data)
 {
-    CPUX86State *env = cpu_single_env;
+    X86CPU *cpu = X86_CPU(current_cpu);
+    CPUX86State *env = &cpu->env;
 
     env->regs[R_EAX] = data[0]; env->regs[R_EBX] = data[1];
     env->regs[R_ECX] = data[2]; env->regs[R_EDX] = data[3];
diff --git a/hw/ppc/mpc8544_guts.c b/hw/ppc/mpc8544_guts.c
index 2e2f2eb..a10abe9 100644
--- a/hw/ppc/mpc8544_guts.c
+++ b/hw/ppc/mpc8544_guts.c
@@ -68,7 +68,8 @@ static uint64_t mpc8544_guts_read(void *opaque, hwaddr addr,
                                   unsigned size)
 {
     uint32_t value = 0;
-    CPUPPCState *env = cpu_single_env;
+    PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
+    CPUPPCState *env = &cpu->env;
 
     addr &= MPC8544_GUTS_MMIO_SIZE - 1;
     switch (addr) {
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 7b2559d..d07dd01 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -417,10 +417,10 @@ static const MemoryRegionOps PPC_prep_io_ops = {
 
 static void cpu_request_exit(void *opaque, int irq, int level)
 {
-    CPUPPCState *env = cpu_single_env;
+    CPUState *cpu = current_cpu;
 
-    if (env && level) {
-        cpu_exit(CPU(ppc_env_get_cpu(env)));
+    if (cpu && level) {
+        cpu_exit(cpu);
     }
 }
 
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 90b7b60..7a0c1ab 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -264,9 +264,8 @@ static void secondary_cpu_reset(void *opaque)
 
 static void cpu_halt_signal(void *opaque, int irq, int level)
 {
-    if (level && cpu_single_env) {
-        cpu_interrupt(CPU(sparc_env_get_cpu(cpu_single_env)),
-                      CPU_INTERRUPT_HALT);
+    if (level && current_cpu) {
+        cpu_interrupt(current_cpu, CPU_INTERRUPT_HALT);
     }
 }
 
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index d23462d..fbc69c9 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -49,13 +49,11 @@ typedef struct {
 
 static inline int get_current_cpu(ARMMPTimerState *s)
 {
-    CPUState *cpu_single_cpu = ENV_GET_CPU(cpu_single_env);
-
-    if (cpu_single_cpu->cpu_index >= s->num_cpu) {
+    if (current_cpu->cpu_index >= s->num_cpu) {
         hw_error("arm_mptimer: num-cpu %d but this cpu is %d!\n",
-                 s->num_cpu, cpu_single_cpu->cpu_index);
+                 s->num_cpu, current_cpu->cpu_index);
     }
-    return cpu_single_cpu->cpu_index;
+    return current_cpu->cpu_index;
 }
 
 static inline void timerblock_update_irq(TimerBlock *tb)
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 35bdf85..6760851 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -20,7 +20,6 @@
 #define CPU_ALL_H
 
 #include "qemu-common.h"
-#include "qemu/tls.h"
 #include "exec/cpu-common.h"
 #include "qemu/thread.h"
 
@@ -358,8 +357,6 @@ CPUArchState *cpu_copy(CPUArchState *env);
 void QEMU_NORETURN cpu_abort(CPUArchState *env, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
 extern CPUArchState *first_cpu;
-DECLARE_TLS(CPUArchState *,cpu_single_env);
-#define cpu_single_env tls_var(cpu_single_env)
 
 /* Flags for use in ENV->INTERRUPT_PENDING.
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 7cb5e54..d7fc186 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -24,6 +24,7 @@
 #include "hw/qdev-core.h"
 #include "exec/hwaddr.h"
 #include "qemu/thread.h"
+#include "qemu/tls.h"
 #include "qemu/typedefs.h"
 
 typedef int (*WriteCoreDumpFunction)(void *buf, size_t size, void *opaque);
@@ -156,6 +157,9 @@ struct CPUState {
     uint32_t halted; /* used by alpha, cris, ppc TCG */
 };
 
+DECLARE_TLS(CPUState *, current_cpu);
+#define current_cpu tls_var(current_cpu)
+
 /**
  * cpu_paging_enabled:
  * @cpu: The CPU whose state is to be inspected.
diff --git a/memory.c b/memory.c
index 35553b5..c8f9a2b 100644
--- a/memory.c
+++ b/memory.c
@@ -838,9 +838,8 @@ static uint64_t unassigned_mem_read(void *opaque, hwaddr addr,
 #ifdef DEBUG_UNASSIGNED
     printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
 #endif
-    if (cpu_single_env != NULL) {
-        cpu_unassigned_access(ENV_GET_CPU(cpu_single_env),
-                              addr, false, false, 0, size);
+    if (current_cpu != NULL) {
+        cpu_unassigned_access(current_cpu, addr, false, false, 0, size);
     }
     return 0;
 }
@@ -851,9 +850,8 @@ static void unassigned_mem_write(void *opaque, hwaddr addr,
 #ifdef DEBUG_UNASSIGNED
     printf("Unassigned mem write " TARGET_FMT_plx " = 0x%"PRIx64"\n", addr, val);
 #endif
-    if (cpu_single_env != NULL) {
-        cpu_unassigned_access(ENV_GET_CPU(cpu_single_env),
-                              addr, true, false, 0, size);
+    if (current_cpu != NULL) {
+        cpu_unassigned_access(current_cpu, addr, true, false, 0, size);
     }
 }
 
diff --git a/translate-all.c b/translate-all.c
index 9acb2b1..02f8e5e 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -999,8 +999,10 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
                                    int is_cpu_write_access)
 {
     TranslationBlock *tb, *tb_next, *saved_tb;
-    CPUArchState *env = cpu_single_env;
-    CPUState *cpu = NULL;
+    CPUState *cpu = current_cpu;
+#if defined(TARGET_HAS_PRECISE_SMC) || !defined(CONFIG_USER_ONLY)
+    CPUArchState *env = NULL;
+#endif
     tb_page_addr_t tb_start, tb_end;
     PageDesc *p;
     int n;
@@ -1023,9 +1025,11 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
         /* build code bitmap */
         build_page_bitmap(p);
     }
-    if (env != NULL) {
-        cpu = ENV_GET_CPU(env);
+#if defined(TARGET_HAS_PRECISE_SMC) || !defined(CONFIG_USER_ONLY)
+    if (cpu != NULL) {
+        env = cpu->env_ptr;
     }
+#endif
 
     /* we remove all the TBs in the range [start, end[ */
     /* XXX: see if in some cases it could be faster to invalidate all
@@ -1147,8 +1151,8 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr,
     int n;
 #ifdef TARGET_HAS_PRECISE_SMC
     TranslationBlock *current_tb = NULL;
-    CPUArchState *env = cpu_single_env;
-    CPUState *cpu = NULL;
+    CPUState *cpu = current_cpu;
+    CPUArchState *env = NULL;
     int current_tb_modified = 0;
     target_ulong current_pc = 0;
     target_ulong current_cs_base = 0;
@@ -1165,8 +1169,8 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr,
     if (tb && pc != 0) {
         current_tb = tb_find_pc(pc);
     }
-    if (env != NULL) {
-        cpu = ENV_GET_CPU(env);
+    if (cpu != NULL) {
+        env = cpu->env_ptr;
     }
 #endif
     while (tb != NULL) {
diff --git a/user-exec.c b/user-exec.c
index fa7f1f1..26cde7c 100644
--- a/user-exec.c
+++ b/user-exec.c
@@ -81,6 +81,7 @@ static inline int handle_cpu_signal(uintptr_t pc, unsigned long address,
                                     int is_write, sigset_t *old_set,
                                     void *puc)
 {
+    CPUArchState *env;
     int ret;
 
 #if defined(DEBUG_SIGNAL)
@@ -93,9 +94,9 @@ static inline int handle_cpu_signal(uintptr_t pc, unsigned long address,
         return 1;
     }
 
+    env = current_cpu->env_ptr;
     /* see if it is an MMU fault */
-    ret = cpu_handle_mmu_fault(cpu_single_env, address, is_write,
-                               MMU_USER_IDX);
+    ret = cpu_handle_mmu_fault(env, address, is_write, MMU_USER_IDX);
     if (ret < 0) {
         return 0; /* not an MMU fault */
     }
@@ -103,12 +104,12 @@ static inline int handle_cpu_signal(uintptr_t pc, unsigned long address,
         return 1; /* the MMU fault was handled without causing real CPU fault */
     }
     /* now we have a real cpu fault */
-    cpu_restore_state(cpu_single_env, pc);
+    cpu_restore_state(env, pc);
 
     /* we restore the process signal mask as the sigreturn should
        do it (XXX: use sigsetjmp) */
     sigprocmask(SIG_SETMASK, old_set, NULL);
-    exception_action(cpu_single_env);
+    exception_action(env);
 
     /* never comes here */
     return 1;
commit 80b7cd735417b0883a026d79a513629a2817cdb4
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jun 19 17:37:31 2013 +0200

    kvm: Free current_cpu identifier
    
    Since CPU loops are done as last step in kvm_{insert,remove}_breakpoint()
    and kvm_remove_all_breakpoints(), we do not need to distinguish between
    invoking CPU and iterated CPUs and can thereby free the identifier for
    use as a global variable.
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index a14cfe9..7596aca 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -169,11 +169,11 @@ void *kvm_arch_ram_alloc(ram_addr_t size);
 void kvm_setup_guest_memory(void *start, size_t size);
 void kvm_flush_coalesced_mmio_buffer(void);
 
-int kvm_insert_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type);
-int kvm_remove_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type);
-void kvm_remove_all_breakpoints(CPUArchState *current_env);
+void kvm_remove_all_breakpoints(CPUArchState *env);
 int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap);
 #ifndef _WIN32
 int kvm_set_signal_mask(CPUState *cpu, const sigset_t *sigset);
@@ -252,9 +252,9 @@ struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
 
 int kvm_sw_breakpoints_active(CPUState *cpu);
 
-int kvm_arch_insert_sw_breakpoint(CPUState *current_cpu,
+int kvm_arch_insert_sw_breakpoint(CPUState *cpu,
                                   struct kvm_sw_breakpoint *bp);
-int kvm_arch_remove_sw_breakpoint(CPUState *current_cpu,
+int kvm_arch_remove_sw_breakpoint(CPUState *cpu,
                                   struct kvm_sw_breakpoint *bp);
 int kvm_arch_insert_hw_breakpoint(target_ulong addr,
                                   target_ulong len, int type);
diff --git a/kvm-all.c b/kvm-all.c
index de658de..ed13d57 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1903,16 +1903,15 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
     return data.err;
 }
 
-int kvm_insert_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type)
 {
-    CPUState *current_cpu = ENV_GET_CPU(current_env);
+    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_sw_breakpoint *bp;
-    CPUArchState *env;
     int err;
 
     if (type == GDB_BREAKPOINT_SW) {
-        bp = kvm_find_sw_breakpoint(current_cpu, addr);
+        bp = kvm_find_sw_breakpoint(cpu, addr);
         if (bp) {
             bp->use_count++;
             return 0;
@@ -1925,14 +1924,13 @@ int kvm_insert_breakpoint(CPUArchState *current_env, target_ulong addr,
 
         bp->pc = addr;
         bp->use_count = 1;
-        err = kvm_arch_insert_sw_breakpoint(current_cpu, bp);
+        err = kvm_arch_insert_sw_breakpoint(cpu, bp);
         if (err) {
             g_free(bp);
             return err;
         }
 
-        QTAILQ_INSERT_HEAD(&current_cpu->kvm_state->kvm_sw_breakpoints,
-                          bp, entry);
+        QTAILQ_INSERT_HEAD(&cpu->kvm_state->kvm_sw_breakpoints, bp, entry);
     } else {
         err = kvm_arch_insert_hw_breakpoint(addr, len, type);
         if (err) {
@@ -1949,16 +1947,15 @@ int kvm_insert_breakpoint(CPUArchState *current_env, target_ulong addr,
     return 0;
 }
 
-int kvm_remove_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type)
 {
-    CPUState *current_cpu = ENV_GET_CPU(current_env);
+    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_sw_breakpoint *bp;
-    CPUArchState *env;
     int err;
 
     if (type == GDB_BREAKPOINT_SW) {
-        bp = kvm_find_sw_breakpoint(current_cpu, addr);
+        bp = kvm_find_sw_breakpoint(cpu, addr);
         if (!bp) {
             return -ENOENT;
         }
@@ -1968,12 +1965,12 @@ int kvm_remove_breakpoint(CPUArchState *current_env, target_ulong addr,
             return 0;
         }
 
-        err = kvm_arch_remove_sw_breakpoint(current_cpu, bp);
+        err = kvm_arch_remove_sw_breakpoint(cpu, bp);
         if (err) {
             return err;
         }
 
-        QTAILQ_REMOVE(&current_cpu->kvm_state->kvm_sw_breakpoints, bp, entry);
+        QTAILQ_REMOVE(&cpu->kvm_state->kvm_sw_breakpoints, bp, entry);
         g_free(bp);
     } else {
         err = kvm_arch_remove_hw_breakpoint(addr, len, type);
@@ -1991,16 +1988,14 @@ int kvm_remove_breakpoint(CPUArchState *current_env, target_ulong addr,
     return 0;
 }
 
-void kvm_remove_all_breakpoints(CPUArchState *current_env)
+void kvm_remove_all_breakpoints(CPUArchState *env)
 {
-    CPUState *current_cpu = ENV_GET_CPU(current_env);
+    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_sw_breakpoint *bp, *next;
-    KVMState *s = current_cpu->kvm_state;
-    CPUArchState *env;
-    CPUState *cpu;
+    KVMState *s = cpu->kvm_state;
 
     QTAILQ_FOREACH_SAFE(bp, &s->kvm_sw_breakpoints, entry, next) {
-        if (kvm_arch_remove_sw_breakpoint(current_cpu, bp) != 0) {
+        if (kvm_arch_remove_sw_breakpoint(cpu, bp) != 0) {
             /* Try harder to find a CPU that currently sees the breakpoint. */
             for (env = first_cpu; env != NULL; env = env->next_cpu) {
                 cpu = ENV_GET_CPU(env);
@@ -2026,19 +2021,19 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
     return -EINVAL;
 }
 
-int kvm_insert_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
 }
 
-int kvm_remove_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
 }
 
-void kvm_remove_all_breakpoints(CPUArchState *current_env)
+void kvm_remove_all_breakpoints(CPUArchState *env)
 {
 }
 #endif /* !KVM_CAP_SET_GUEST_DEBUG */
diff --git a/kvm-stub.c b/kvm-stub.c
index dec7a83..583c636 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -83,19 +83,19 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
     return -ENOSYS;
 }
 
-int kvm_insert_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_insert_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
 }
 
-int kvm_remove_breakpoint(CPUArchState *current_env, target_ulong addr,
+int kvm_remove_breakpoint(CPUArchState *env, target_ulong addr,
                           target_ulong len, int type)
 {
     return -EINVAL;
 }
 
-void kvm_remove_all_breakpoints(CPUArchState *current_env)
+void kvm_remove_all_breakpoints(CPUArchState *env)
 {
 }
 
commit 6e42be7cd10260fd3a006d94f6c870692bf7a2c0
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri May 10 16:34:06 2013 +0200

    cpu: Drop unnecessary dynamic casts in *_env_get_cpu()
    
    A transition from CPUFooState to FooCPU can be considered safe,
    just like FooCPU::env access in the opposite direction.
    The only benefit of the FOO_CPU() casts would be protection against
    bogus CPUFooState pointers, but then surrounding code would likely
    break, too.
    
    This should slightly improve interrupt etc. performance when going from
    CPUFooState to FooCPU.
    For any additional CPU() casts see 3556c233d931ad5ffa46a35cb25cfc057732ebb8
    (qom: allow turning cast debugging off).
    
    Reported-by: Anthony Liguori <aliguori at us.ibm.com>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index 94e4a54..60125b1 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -67,7 +67,7 @@ typedef struct AlphaCPU {
 
 static inline AlphaCPU *alpha_env_get_cpu(CPUAlphaState *env)
 {
-    return ALPHA_CPU(container_of(env, AlphaCPU, env));
+    return container_of(env, AlphaCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(alpha_env_get_cpu(e))
diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index ef6261f..48ba605 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -127,7 +127,7 @@ typedef struct ARMCPU {
 
 static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
 {
-    return ARM_CPU(container_of(env, ARMCPU, env));
+    return container_of(env, ARMCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(arm_env_get_cpu(e))
diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index e08bdb1..af7d14d 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -66,7 +66,7 @@ typedef struct CRISCPU {
 
 static inline CRISCPU *cris_env_get_cpu(CPUCRISState *env)
 {
-    return CRIS_CPU(container_of(env, CRISCPU, env));
+    return container_of(env, CRISCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(cris_env_get_cpu(e))
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index b7c70d6..7e55e5f 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -72,7 +72,7 @@ typedef struct X86CPU {
 
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
 {
-    return X86_CPU(container_of(env, X86CPU, env));
+    return container_of(env, X86CPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(x86_env_get_cpu(e))
diff --git a/target-lm32/cpu-qom.h b/target-lm32/cpu-qom.h
index 5ef884b..e3bb619 100644
--- a/target-lm32/cpu-qom.h
+++ b/target-lm32/cpu-qom.h
@@ -64,7 +64,7 @@ typedef struct LM32CPU {
 
 static inline LM32CPU *lm32_env_get_cpu(CPULM32State *env)
 {
-    return LM32_CPU(container_of(env, LM32CPU, env));
+    return container_of(env, LM32CPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(lm32_env_get_cpu(e))
diff --git a/target-m68k/cpu-qom.h b/target-m68k/cpu-qom.h
index 2436c13..858bf30 100644
--- a/target-m68k/cpu-qom.h
+++ b/target-m68k/cpu-qom.h
@@ -63,7 +63,7 @@ typedef struct M68kCPU {
 
 static inline M68kCPU *m68k_env_get_cpu(CPUM68KState *env)
 {
-    return M68K_CPU(container_of(env, M68kCPU, env));
+    return container_of(env, M68kCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(m68k_env_get_cpu(e))
diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index 3e9c206..ec2b989 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -64,7 +64,7 @@ typedef struct MicroBlazeCPU {
 
 static inline MicroBlazeCPU *mb_env_get_cpu(CPUMBState *env)
 {
-    return MICROBLAZE_CPU(container_of(env, MicroBlazeCPU, env));
+    return container_of(env, MicroBlazeCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(mb_env_get_cpu(e))
diff --git a/target-mips/cpu-qom.h b/target-mips/cpu-qom.h
index a7ff9e6..654744a 100644
--- a/target-mips/cpu-qom.h
+++ b/target-mips/cpu-qom.h
@@ -67,7 +67,7 @@ typedef struct MIPSCPU {
 
 static inline MIPSCPU *mips_env_get_cpu(CPUMIPSState *env)
 {
-    return MIPS_CPU(container_of(env, MIPSCPU, env));
+    return container_of(env, MIPSCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(mips_env_get_cpu(e))
diff --git a/target-moxie/cpu.h b/target-moxie/cpu.h
index 374b24a..72d02c2 100644
--- a/target-moxie/cpu.h
+++ b/target-moxie/cpu.h
@@ -106,7 +106,7 @@ typedef struct MoxieCPU {
 
 static inline MoxieCPU *moxie_env_get_cpu(CPUMoxieState *env)
 {
-    return MOXIE_CPU(container_of(env, MoxieCPU, env));
+    return container_of(env, MoxieCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(moxie_env_get_cpu(e))
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index b016f57..0aff8f2 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -335,7 +335,7 @@ typedef struct OpenRISCCPU {
 
 static inline OpenRISCCPU *openrisc_env_get_cpu(CPUOpenRISCState *env)
 {
-    return OPENRISC_CPU(container_of(env, OpenRISCCPU, env));
+    return container_of(env, OpenRISCCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(openrisc_env_get_cpu(e))
diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index 84ba105..7132599 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -91,7 +91,7 @@ typedef struct PowerPCCPU {
 
 static inline PowerPCCPU *ppc_env_get_cpu(CPUPPCState *env)
 {
-    return POWERPC_CPU(container_of(env, PowerPCCPU, env));
+    return container_of(env, PowerPCCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(ppc_env_get_cpu(e))
diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index ec32d21..4c091e3 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -64,7 +64,7 @@ typedef struct S390CPU {
 
 static inline S390CPU *s390_env_get_cpu(CPUS390XState *env)
 {
-    return S390_CPU(container_of(env, S390CPU, env));
+    return container_of(env, S390CPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(s390_env_get_cpu(e))
diff --git a/target-sh4/cpu-qom.h b/target-sh4/cpu-qom.h
index 01d1637..c229a9a 100644
--- a/target-sh4/cpu-qom.h
+++ b/target-sh4/cpu-qom.h
@@ -76,7 +76,7 @@ typedef struct SuperHCPU {
 
 static inline SuperHCPU *sh_env_get_cpu(CPUSH4State *env)
 {
-    return SUPERH_CPU(container_of(env, SuperHCPU, env));
+    return container_of(env, SuperHCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(sh_env_get_cpu(e))
diff --git a/target-sparc/cpu-qom.h b/target-sparc/cpu-qom.h
index 97c1ec7..033a5b5 100644
--- a/target-sparc/cpu-qom.h
+++ b/target-sparc/cpu-qom.h
@@ -68,7 +68,7 @@ typedef struct SPARCCPU {
 
 static inline SPARCCPU *sparc_env_get_cpu(CPUSPARCState *env)
 {
-    return SPARC_CPU(container_of(env, SPARCCPU, env));
+    return container_of(env, SPARCCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(sparc_env_get_cpu(e))
diff --git a/target-unicore32/cpu-qom.h b/target-unicore32/cpu-qom.h
index 7eec448..350d480 100644
--- a/target-unicore32/cpu-qom.h
+++ b/target-unicore32/cpu-qom.h
@@ -53,7 +53,7 @@ typedef struct UniCore32CPU {
 
 static inline UniCore32CPU *uc32_env_get_cpu(CPUUniCore32State *env)
 {
-    return UNICORE32_CPU(container_of(env, UniCore32CPU, env));
+    return container_of(env, UniCore32CPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(uc32_env_get_cpu(e))
diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index 30506cf..31e7498 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -73,7 +73,7 @@ typedef struct XtensaCPU {
 
 static inline XtensaCPU *xtensa_env_get_cpu(const CPUXtensaState *env)
 {
-    return XTENSA_CPU(container_of(env, XtensaCPU, env));
+    return container_of(env, XtensaCPU, env);
 }
 
 #define ENV_GET_CPU(e) CPU(xtensa_env_get_cpu(e))
commit 6291ad77d7c57dfc52a6a938d1a77ec3ec3ad16c
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Jun 28 14:22:32 2013 +0100

    linux-user: Move cpu_clone_regs() and cpu_set_tls() into linux-user
    
    The functions cpu_clone_regs() and cpu_set_tls() are not purely CPU
    related -- they are specific to the TLS ABI for a a particular OS.
    Move them into the linux-user/ tree where they belong.
    
    target-lm32 had entirely unused implementations, since it has no
    linux-user target; just drop them.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/linux-user/alpha/target_cpu.h b/linux-user/alpha/target_cpu.h
new file mode 100644
index 0000000..4256245
--- /dev/null
+++ b/linux-user/alpha/target_cpu.h
@@ -0,0 +1,36 @@
+/*
+ * Alpha specific CPU ABI and functions for linux-user
+ *
+ *  Copyright (c) 2007 Jocelyn Mayer
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUAlphaState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->ir[IR_SP] = newsp;
+    }
+    env->ir[IR_V0] = 0;
+    env->ir[IR_A3] = 0;
+}
+
+static inline void cpu_set_tls(CPUAlphaState *env, target_ulong newtls)
+{
+    env->unique = newtls;
+}
+
+#endif
diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
new file mode 100644
index 0000000..ed323c0
--- /dev/null
+++ b/linux-user/arm/target_cpu.h
@@ -0,0 +1,35 @@
+/*
+ * ARM specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUARMState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->regs[13] = newsp;
+    }
+    env->regs[0] = 0;
+}
+
+static inline void cpu_set_tls(CPUARMState *env, target_ulong newtls)
+{
+    env->cp15.c13_tls2 = newtls;
+}
+
+#endif
diff --git a/linux-user/cris/target_cpu.h b/linux-user/cris/target_cpu.h
new file mode 100644
index 0000000..4d787e5
--- /dev/null
+++ b/linux-user/cris/target_cpu.h
@@ -0,0 +1,36 @@
+/*
+ * CRIS specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2007 AXIS Communications AB
+ * Written by Edgar E. Iglesias
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUCRISState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->regs[14] = newsp;
+    }
+    env->regs[10] = 0;
+}
+
+static inline void cpu_set_tls(CPUCRISState *env, target_ulong newtls)
+{
+    env->pregs[PR_PID] = (env->pregs[PR_PID] & 0xff) | newtls;
+}
+
+#endif
diff --git a/linux-user/i386/target_cpu.h b/linux-user/i386/target_cpu.h
new file mode 100644
index 0000000..abcac79
--- /dev/null
+++ b/linux-user/i386/target_cpu.h
@@ -0,0 +1,33 @@
+/*
+ * i386 specific CPU ABI and functions for linux-user
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUX86State *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->regs[R_ESP] = newsp;
+    }
+    env->regs[R_EAX] = 0;
+}
+
+/* TODO: need to implement cpu_set_tls() */
+
+#endif
diff --git a/linux-user/m68k/target_cpu.h b/linux-user/m68k/target_cpu.h
new file mode 100644
index 0000000..8a2a305
--- /dev/null
+++ b/linux-user/m68k/target_cpu.h
@@ -0,0 +1,34 @@
+/*
+ * m68k specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2005-2007 CodeSourcery
+ * Written by Paul Brook
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUM68KState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->aregs[7] = newsp;
+    }
+    env->dregs[0] = 0;
+}
+
+/* TODO: need to implement cpu_set_tls() */
+
+#endif
diff --git a/linux-user/microblaze/target_cpu.h b/linux-user/microblaze/target_cpu.h
new file mode 100644
index 0000000..c6386ea
--- /dev/null
+++ b/linux-user/microblaze/target_cpu.h
@@ -0,0 +1,35 @@
+/*
+ * MicroBlaze specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2009 Edgar E. Iglesias
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUMBState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->regs[R_SP] = newsp;
+    }
+    env->regs[3] = 0;
+}
+
+static inline void cpu_set_tls(CPUMBState *env, target_ulong newtls)
+{
+    env->regs[21] = newtls;
+}
+
+#endif
diff --git a/linux-user/mips/target_cpu.h b/linux-user/mips/target_cpu.h
new file mode 100644
index 0000000..ba8e9eb
--- /dev/null
+++ b/linux-user/mips/target_cpu.h
@@ -0,0 +1,36 @@
+/*
+ * MIPS specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2004-2005 Jocelyn Mayer
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUMIPSState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->active_tc.gpr[29] = newsp;
+    }
+    env->active_tc.gpr[7] = 0;
+    env->active_tc.gpr[2] = 0;
+}
+
+static inline void cpu_set_tls(CPUMIPSState *env, target_ulong newtls)
+{
+    env->tls_value = newtls;
+}
+
+#endif
diff --git a/linux-user/mips64/target_cpu.h b/linux-user/mips64/target_cpu.h
new file mode 100644
index 0000000..fa36407
--- /dev/null
+++ b/linux-user/mips64/target_cpu.h
@@ -0,0 +1 @@
+#include "../mips/target_cpu.h"
diff --git a/linux-user/openrisc/target_cpu.h b/linux-user/openrisc/target_cpu.h
new file mode 100644
index 0000000..501fb81
--- /dev/null
+++ b/linux-user/openrisc/target_cpu.h
@@ -0,0 +1,33 @@
+/*
+ * OpenRISC specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2011-2012 Jia Liu <proljc at gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUOpenRISCState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->gpr[1] = newsp;
+    }
+    env->gpr[2] = 0;
+}
+
+/* TODO: need to implement cpu_set_tls() */
+
+#endif
diff --git a/linux-user/ppc/target_cpu.h b/linux-user/ppc/target_cpu.h
new file mode 100644
index 0000000..9cc0c3b
--- /dev/null
+++ b/linux-user/ppc/target_cpu.h
@@ -0,0 +1,41 @@
+/*
+ * PowerPC specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2003-2007 Jocelyn Mayer
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUPPCState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->gpr[1] = newsp;
+    }
+    env->gpr[3] = 0;
+}
+
+static inline void cpu_set_tls(CPUPPCState *env, target_ulong newtls)
+{
+#if defined(TARGET_PPC64)
+    /* The kernel checks TIF_32BIT here; we don't support loading 32-bit
+       binaries on PPC64 yet. */
+    env->gpr[13] = newtls;
+#else
+    env->gpr[2] = newtls;
+#endif
+}
+
+#endif
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index b10e957..20d171c 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -16,6 +16,7 @@
 #include "exec/user/thunk.h"
 #include "syscall_defs.h"
 #include "syscall.h"
+#include "target_cpu.h"
 #include "target_signal.h"
 #include "exec/gdbstub.h"
 #include "qemu/queue.h"
diff --git a/linux-user/s390x/target_cpu.h b/linux-user/s390x/target_cpu.h
new file mode 100644
index 0000000..f10abe8
--- /dev/null
+++ b/linux-user/s390x/target_cpu.h
@@ -0,0 +1,39 @@
+/*
+ * S/390 specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2009 Ulrich Hecht
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * Contributions after 2012-10-29 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ *
+ * You should have received a copy of the GNU (Lesser) General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUS390XState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->regs[15] = newsp;
+    }
+    env->regs[2] = 0;
+}
+
+static inline void cpu_set_tls(CPUS390XState *env, target_ulong newtls)
+{
+    env->aregs[0] = newtls >> 32;
+    env->aregs[1] = newtls & 0xffffffffULL;
+}
+
+#endif
diff --git a/linux-user/sh4/target_cpu.h b/linux-user/sh4/target_cpu.h
new file mode 100644
index 0000000..141856f
--- /dev/null
+++ b/linux-user/sh4/target_cpu.h
@@ -0,0 +1,35 @@
+/*
+ * SH4 specific CPU ABI and functions for linux-user
+ *
+ * Copyright (c) 2005 Samuel Tardieu
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUSH4State *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->gregs[15] = newsp;
+    }
+    env->gregs[0] = 0;
+}
+
+static inline void cpu_set_tls(CPUSH4State *env, target_ulong newtls)
+{
+  env->gbr = newtls;
+}
+
+#endif
diff --git a/linux-user/sparc/target_cpu.h b/linux-user/sparc/target_cpu.h
new file mode 100644
index 0000000..5a620a2
--- /dev/null
+++ b/linux-user/sparc/target_cpu.h
@@ -0,0 +1,36 @@
+/*
+ * SPARC specific CPU ABI and functions for linux-user
+ *
+ * Copyright (C) 2003 Thomas M. Ogrisegg <tom at fnord.at>
+ * Copyright (C) 2003-2005 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUSPARCState *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->regwptr[22] = newsp;
+    }
+    env->regwptr[0] = 0;
+    /* FIXME: Do we also need to clear CF?  */
+    /* XXXXX */
+    printf("HELPME: %s:%d\n", __FILE__, __LINE__);
+}
+
+/* TODO: need to implement cpu_set_tls() */
+
+#endif
diff --git a/linux-user/sparc64/target_cpu.h b/linux-user/sparc64/target_cpu.h
new file mode 100644
index 0000000..b22263d
--- /dev/null
+++ b/linux-user/sparc64/target_cpu.h
@@ -0,0 +1 @@
+#include "../sparc/target_cpu.h"
diff --git a/linux-user/unicore32/target_cpu.h b/linux-user/unicore32/target_cpu.h
new file mode 100644
index 0000000..fb79087
--- /dev/null
+++ b/linux-user/unicore32/target_cpu.h
@@ -0,0 +1,27 @@
+/*
+ * UniCore32 specific CPU ABI and functions for linux-user
+ *
+ * Copyright (C) 2010-2012 Guan Xuetao
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation, or (at your option) any
+ * later version. See the COPYING file in the top-level directory.
+ */
+#ifndef TARGET_CPU_H
+#define TARGET_CPU_H
+
+static inline void cpu_clone_regs(CPUUniCore32State *env, target_ulong newsp)
+{
+    if (newsp) {
+        env->regs[29] = newsp;
+    }
+    env->regs[0] = 0;
+}
+
+static inline void cpu_set_tls(CPUUniCore32State *env, target_ulong newtls)
+{
+    env->regs[16] = newtls;
+}
+
+#endif
diff --git a/linux-user/x86_64/target_cpu.h b/linux-user/x86_64/target_cpu.h
new file mode 100644
index 0000000..9ec7cbb
--- /dev/null
+++ b/linux-user/x86_64/target_cpu.h
@@ -0,0 +1 @@
+#include "../i386/target_cpu.h"
diff --git a/target-alpha/cpu.h b/target-alpha/cpu.h
index 01f4ebb..066f032 100644
--- a/target-alpha/cpu.h
+++ b/target-alpha/cpu.h
@@ -498,22 +498,6 @@ static inline void cpu_get_tb_cpu_state(CPUAlphaState *env, target_ulong *pc,
     *pflags = flags;
 }
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUAlphaState *env, target_ulong newsp)
-{
-    if (newsp) {
-        env->ir[IR_SP] = newsp;
-    }
-    env->ir[IR_V0] = 0;
-    env->ir[IR_A3] = 0;
-}
-
-static inline void cpu_set_tls(CPUAlphaState *env, target_ulong newtls)
-{
-    env->unique = newtls;
-}
-#endif
-
 static inline bool cpu_has_work(CPUState *cpu)
 {
     /* Here we are checking to see if the CPU should wake up from HALT.
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index abcc0b4..1369604 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -249,11 +249,6 @@ int cpu_arm_handle_mmu_fault (CPUARMState *env, target_ulong address, int rw,
                               int mmu_idx);
 #define cpu_handle_mmu_fault cpu_arm_handle_mmu_fault
 
-static inline void cpu_set_tls(CPUARMState *env, target_ulong newtls)
-{
-  env->cp15.c13_tls2 = newtls;
-}
-
 #define CPSR_M (0x1f)
 #define CPSR_T (1 << 5)
 #define CPSR_F (1 << 6)
@@ -734,15 +729,6 @@ static inline int cpu_mmu_index (CPUARMState *env)
     return (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR ? 1 : 0;
 }
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUARMState *env, target_ulong newsp)
-{
-    if (newsp)
-        env->regs[13] = newsp;
-    env->regs[0] = 0;
-}
-#endif
-
 #include "exec/cpu-all.h"
 
 /* Bit usage in the TB flags field: */
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index dbd7d36..c12a8ca 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -247,20 +247,6 @@ int cpu_cris_handle_mmu_fault(CPUCRISState *env, target_ulong address, int rw,
                               int mmu_idx);
 #define cpu_handle_mmu_fault cpu_cris_handle_mmu_fault
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUCRISState *env, target_ulong newsp)
-{
-    if (newsp)
-        env->regs[14] = newsp;
-    env->regs[10] = 0;
-}
-#endif
-
-static inline void cpu_set_tls(CPUCRISState *env, target_ulong newtls)
-{
-	env->pregs[PR_PID] = (env->pregs[PR_PID] & 0xff) | newtls;
-}
-
 /* Support function regs.  */
 #define SFR_RW_GC_CFG      0][0
 #define SFR_RW_MM_CFG      env->pregs[PR_SRS]][0
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 62e3547..2849672 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1125,15 +1125,6 @@ static inline target_long lshift(target_long x, int n)
 /* translate.c */
 void optimize_flags_init(void);
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUX86State *env, target_ulong newsp)
-{
-    if (newsp)
-        env->regs[R_ESP] = newsp;
-    env->regs[R_EAX] = 0;
-}
-#endif
-
 #include "exec/cpu-all.h"
 #include "svm.h"
 
diff --git a/target-lm32/cpu.h b/target-lm32/cpu.h
index bfb9150..856bdc7 100644
--- a/target-lm32/cpu.h
+++ b/target-lm32/cpu.h
@@ -215,20 +215,6 @@ int cpu_lm32_handle_mmu_fault(CPULM32State *env, target_ulong address, int rw,
                               int mmu_idx);
 #define cpu_handle_mmu_fault cpu_lm32_handle_mmu_fault
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPULM32State *env, target_ulong newsp)
-{
-    if (newsp) {
-        env->regs[R_SP] = newsp;
-    }
-    env->regs[R_R1] = 0;
-}
-#endif
-
-static inline void cpu_set_tls(CPULM32State *env, target_ulong newtls)
-{
-}
-
 #include "exec/cpu-all.h"
 
 static inline void cpu_get_tb_cpu_state(CPULM32State *env, target_ulong *pc,
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index c90c40c..9fdf89e 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -241,15 +241,6 @@ int cpu_m68k_handle_mmu_fault(CPUM68KState *env, target_ulong address, int rw,
                               int mmu_idx);
 #define cpu_handle_mmu_fault cpu_m68k_handle_mmu_fault
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUM68KState *env, target_ulong newsp)
-{
-    if (newsp)
-        env->aregs[7] = newsp;
-    env->dregs[0] = 0;
-}
-#endif
-
 #include "exec/cpu-all.h"
 
 static inline void cpu_get_tb_cpu_state(CPUM68KState *env, target_ulong *pc,
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 75ae5ba..6c35475 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -331,20 +331,6 @@ int cpu_mb_handle_mmu_fault(CPUMBState *env, target_ulong address, int rw,
                             int mmu_idx);
 #define cpu_handle_mmu_fault cpu_mb_handle_mmu_fault
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUMBState *env, target_ulong newsp)
-{
-    if (newsp)
-        env->regs[R_SP] = newsp;
-    env->regs[3] = 0;
-}
-#endif
-
-static inline void cpu_set_tls(CPUMBState *env, target_ulong newtls)
-{
-    env->regs[21] = newtls;
-}
-
 static inline int cpu_interrupts_enabled(CPUMBState *env)
 {
     return env->sregs[SR_MSR] & MSR_IE;
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index fa0f0d1..7ffd2e3 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -521,14 +521,6 @@ static inline int cpu_mmu_index (CPUMIPSState *env)
     return env->hflags & MIPS_HFLAG_KSU;
 }
 
-static inline void cpu_clone_regs(CPUMIPSState *env, target_ulong newsp)
-{
-    if (newsp)
-        env->active_tc.gpr[29] = newsp;
-    env->active_tc.gpr[7] = 0;
-    env->active_tc.gpr[2] = 0;
-}
-
 static inline int cpu_mips_hw_interrupts_pending(CPUMIPSState *env)
 {
     int32_t pending;
@@ -679,11 +671,6 @@ static inline void cpu_get_tb_cpu_state(CPUMIPSState *env, target_ulong *pc,
     *flags = env->hflags & (MIPS_HFLAG_TMASK | MIPS_HFLAG_BMASK);
 }
 
-static inline void cpu_set_tls(CPUMIPSState *env, target_ulong newtls)
-{
-    env->tls_value = newtls;
-}
-
 static inline int mips_vpe_active(CPUMIPSState *env)
 {
     int active = 1;
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index 80a82df..b016f57 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -394,16 +394,6 @@ static inline CPUOpenRISCState *cpu_init(const char *cpu_model)
     return NULL;
 }
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUOpenRISCState *env, target_ulong newsp)
-{
-    if (newsp) {
-        env->gpr[1] = newsp;
-    }
-    env->gpr[2] = 0;
-}
-#endif
-
 #include "exec/cpu-all.h"
 
 static inline void cpu_get_tb_cpu_state(CPUOpenRISCState *env,
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 0ede077..7a7b1bf 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -1188,15 +1188,6 @@ static inline int cpu_mmu_index (CPUPPCState *env)
     return env->mmu_idx;
 }
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUPPCState *env, target_ulong newsp)
-{
-    if (newsp)
-        env->gpr[1] = newsp;
-    env->gpr[3] = 0;
-}
-#endif
-
 #include "exec/cpu-all.h"
 
 /*****************************************************************************/
@@ -2036,17 +2027,6 @@ static inline void cpu_get_tb_cpu_state(CPUPPCState *env, target_ulong *pc,
     *flags = env->hflags;
 }
 
-static inline void cpu_set_tls(CPUPPCState *env, target_ulong newtls)
-{
-#if defined(TARGET_PPC64)
-    /* The kernel checks TIF_32BIT here; we don't support loading 32-bit
-       binaries on PPC64 yet. */
-    env->gpr[13] = newtls;
-#else
-    env->gpr[2] = newtls;
-#endif
-}
-
 #if !defined(CONFIG_USER_ONLY)
 static inline int booke206_tlbm_id(CPUPPCState *env, ppcmas_tlb_t *tlbm)
 {
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 741c4e4..6462688 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -149,16 +149,6 @@ typedef struct CPUS390XState {
 
 #include "cpu-qom.h"
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUS390XState *env, target_ulong newsp)
-{
-    if (newsp) {
-        env->regs[15] = newsp;
-    }
-    env->regs[2] = 0;
-}
-#endif
-
 /* distinguish between 24 bit and 31 bit addressing */
 #define HIGH_ORDER_BIT 0x80000000
 
@@ -515,12 +505,6 @@ static inline bool css_present(uint8_t cssid)
 }
 #endif
 
-static inline void cpu_set_tls(CPUS390XState *env, target_ulong newtls)
-{
-    env->aregs[0] = newtls >> 32;
-    env->aregs[1] = newtls & 0xffffffffULL;
-}
-
 #define cpu_init(model) (&cpu_s390x_init(model)->env)
 #define cpu_exec cpu_s390x_exec
 #define cpu_gen_code cpu_s390x_gen_code
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index fd7da92..c8df18b 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -220,11 +220,6 @@ void cpu_sh4_write_mmaped_utlb_data(CPUSH4State *s, hwaddr addr,
 
 int cpu_sh4_is_cached(CPUSH4State * env, target_ulong addr);
 
-static inline void cpu_set_tls(CPUSH4State *env, target_ulong newtls)
-{
-  env->gbr = newtls;
-}
-
 void cpu_load_tlb(CPUSH4State * env);
 
 static inline CPUSH4State *cpu_init(const char *cpu_model)
@@ -250,15 +245,6 @@ static inline int cpu_mmu_index (CPUSH4State *env)
     return (env->sr & SR_MD) == 0 ? 1 : 0;
 }
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUSH4State *env, target_ulong newsp)
-{
-    if (newsp)
-        env->gregs[15] = newsp;
-    env->gregs[0] = 0;
-}
-#endif
-
 #include "exec/cpu-all.h"
 
 /* Memory access type */
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 021eb157..41b014a 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -690,18 +690,6 @@ static inline int cpu_pil_allowed(CPUSPARCState *env1, int pil)
 #endif
 }
 
-#if defined(CONFIG_USER_ONLY)
-static inline void cpu_clone_regs(CPUSPARCState *env, target_ulong newsp)
-{
-    if (newsp)
-        env->regwptr[22] = newsp;
-    env->regwptr[0] = 0;
-    /* FIXME: Do we also need to clear CF?  */
-    /* XXXXX */
-    printf ("HELPME: %s:%d\n", __FILE__, __LINE__);
-}
-#endif
-
 #include "exec/cpu-all.h"
 
 #ifdef TARGET_SPARC64
diff --git a/target-unicore32/cpu.h b/target-unicore32/cpu.h
index 5b2b9d1..d4be525 100644
--- a/target-unicore32/cpu.h
+++ b/target-unicore32/cpu.h
@@ -142,19 +142,6 @@ static inline int cpu_mmu_index(CPUUniCore32State *env)
     return (env->uncached_asr & ASR_M) == ASR_MODE_USER ? 1 : 0;
 }
 
-static inline void cpu_clone_regs(CPUUniCore32State *env, target_ulong newsp)
-{
-    if (newsp) {
-        env->regs[29] = newsp;
-    }
-    env->regs[0] = 0;
-}
-
-static inline void cpu_set_tls(CPUUniCore32State *env, target_ulong newtls)
-{
-    env->regs[16] = newtls;
-}
-
 #include "exec/cpu-all.h"
 #include "cpu-qom.h"
 #include "exec/exec-all.h"
commit aa48dd9319dcee78ec17f4d516fb7bfc62b1a4d2
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jul 9 20:50:52 2013 +0200

    Revert "gdbstub: Simplify find_cpu()"
    
    This reverts commit c52a6b67c1d7c6fc9fb2e3ba988d7b978e1487d3, which
    replaced cpu_index() with cpu_index field, leading to deviation from
    thread ID for NTPL and off-by-one otherwise.
    
    Reported-by: Max Filippov <jcmvbkbc at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 3101a43..9ae6576 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2071,13 +2071,17 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 
 static CPUArchState *find_cpu(uint32_t thread_id)
 {
+    CPUArchState *env;
     CPUState *cpu;
 
-    cpu = qemu_get_cpu(thread_id);
-    if (cpu == NULL) {
-        return NULL;
+    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        cpu = ENV_GET_CPU(env);
+        if (cpu_index(cpu) == thread_id) {
+            return env;
+        }
     }
-    return cpu->env_ptr;
+
+    return NULL;
 }
 
 static int gdb_handle_packet(GDBState *s, const char *line_buf)
commit c1b71b0c03df575c72ea413b2f2c27a7a477c05a
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jul 4 15:09:23 2013 +0200

    vl: Tighten parsing of -machine option phandle_start
    
    Make it QEMU_OPT_NUMBER, so it gets parsed by generic code, which
    actually bothers to check for errors, rather than its user, which
    doesn't.
    
    Cc: Alexander Graf <agraf at suse.de>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Acked-by: Alexander Graf <agraf at suse.de>
    Message-id: 1372943363-24081-8-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/device_tree.c b/device_tree.c
index 0e7fe2d..10cf3d0 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -240,11 +240,8 @@ uint32_t qemu_devtree_alloc_phandle(void *fdt)
      * which phandle id to start allocting phandles.
      */
     if (!phandle) {
-        const char *phandle_start = qemu_opt_get(qemu_get_machine_opts(),
-                                                 "phandle_start");
-        if (phandle_start) {
-            phandle = strtoul(phandle_start, NULL, 0);
-        }
+        phandle = qemu_opt_get_number(qemu_get_machine_opts(),
+                                      "phandle_start", 0);
     }
 
     if (!phandle) {
diff --git a/vl.c b/vl.c
index fb69f22..bea1a10 100644
--- a/vl.c
+++ b/vl.c
@@ -409,7 +409,7 @@ static QemuOptsList qemu_machine_opts = {
             .help = "Dump current dtb to a file and quit",
         }, {
             .name = "phandle_start",
-            .type = QEMU_OPT_STRING,
+            .type = QEMU_OPT_NUMBER,
             .help = "The first phandle ID we may generate dynamically",
         }, {
             .name = "dt_compatible",
commit 2ff3de685a875ece3ee21256736c0a9dbf39dc4c
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jul 4 15:09:22 2013 +0200

    Simplify -machine option queries with qemu_get_machine_opts()
    
    The previous two commits fixed bugs in -machine option queries.  I
    can't find fault with the remaining queries, but let's use
    qemu_get_machine_opts() everywhere, for consistency, simplicity and
    robustness.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372943363-24081-7-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/device_tree.c b/device_tree.c
index 69be9da..0e7fe2d 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "qemu-common.h"
 #include "sysemu/device_tree.h"
+#include "sysemu/sysemu.h"
 #include "hw/loader.h"
 #include "qemu/option.h"
 #include "qemu/config-file.h"
@@ -239,14 +240,10 @@ uint32_t qemu_devtree_alloc_phandle(void *fdt)
      * which phandle id to start allocting phandles.
      */
     if (!phandle) {
-        QemuOpts *machine_opts;
-        machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-        if (machine_opts) {
-            const char *phandle_start;
-            phandle_start = qemu_opt_get(machine_opts, "phandle_start");
-            if (phandle_start) {
-                phandle = strtoul(phandle_start, NULL, 0);
-            }
+        const char *phandle_start = qemu_opt_get(qemu_get_machine_opts(),
+                                                 "phandle_start");
+        if (phandle_start) {
+            phandle = strtoul(phandle_start, NULL, 0);
         }
     }
 
@@ -307,15 +304,10 @@ int qemu_devtree_add_subnode(void *fdt, const char *name)
 
 void qemu_devtree_dumpdtb(void *fdt, int size)
 {
-    QemuOpts *machine_opts;
-
-    machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (machine_opts) {
-        const char *dumpdtb = qemu_opt_get(machine_opts, "dumpdtb");
-        if (dumpdtb) {
-            /* Dump the dtb to a file and quit */
-            exit(g_file_set_contents(dumpdtb, fdt, size, NULL) ? 0 : 1);
-        }
-    }
+    const char *dumpdtb = qemu_opt_get(qemu_get_machine_opts(), "dumpdtb");
 
+    if (dumpdtb) {
+        /* Dump the dtb to a file and quit */
+        exit(g_file_set_contents(dumpdtb, fdt, size, NULL) ? 0 : 1);
+    }
 }
diff --git a/exec.c b/exec.c
index 485d811..e150935 100644
--- a/exec.c
+++ b/exec.c
@@ -31,6 +31,7 @@
 #include "hw/qdev.h"
 #include "qemu/osdep.h"
 #include "sysemu/kvm.h"
+#include "sysemu/sysemu.h"
 #include "hw/xen/xen.h"
 #include "qemu/timer.h"
 #include "qemu/config-file.h"
@@ -1043,12 +1044,10 @@ ram_addr_t last_ram_offset(void)
 static void qemu_ram_setup_dump(void *addr, ram_addr_t size)
 {
     int ret;
-    QemuOpts *machine_opts;
 
     /* Use MADV_DONTDUMP, if user doesn't want the guest memory in the core */
-    machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (machine_opts &&
-        !qemu_opt_get_bool(machine_opts, "dump-guest-core", true)) {
+    if (!qemu_opt_get_bool(qemu_get_machine_opts(),
+                           "dump-guest-core", true)) {
         ret = qemu_madvise(addr, size, QEMU_MADV_DONTDUMP);
         if (ret) {
             perror("qemu_madvise");
@@ -1095,10 +1094,7 @@ void qemu_ram_set_idstr(ram_addr_t addr, const char *name, DeviceState *dev)
 
 static int memory_try_enable_merging(void *addr, size_t len)
 {
-    QemuOpts *opts;
-
-    opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (opts && !qemu_opt_get_bool(opts, "mem-merge", true)) {
+    if (!qemu_opt_get_bool(qemu_get_machine_opts(), "mem-merge", true)) {
         /* disabled by the user */
         return 0;
     }
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 7c0090f..3e8741e 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -359,7 +359,6 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
     uint64_t elf_entry;
     hwaddr entry;
     int big_endian;
-    QemuOpts *machine_opts;
 
     /* Load the kernel.  */
     if (!info->kernel_filename) {
@@ -367,12 +366,7 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
         exit(1);
     }
 
-    machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (machine_opts) {
-        info->dtb_filename = qemu_opt_get(machine_opts, "dtb");
-    } else {
-        info->dtb_filename = NULL;
-    }
+    info->dtb_filename = qemu_opt_get(qemu_get_machine_opts(), "dtb");
 
     if (!info->secondary_cpu_reset_hook) {
         info->secondary_cpu_reset_hook = default_reset_secondary;
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 2f3018d..ee7e49a 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -137,7 +137,6 @@ static int ppce500_load_device_tree(CPUPPCState *env,
     uint32_t clock_freq = 400000000;
     uint32_t tb_freq = 400000000;
     int i;
-    const char *toplevel_compat = NULL; /* user override */
     char compatible_sb[] = "fsl,mpc8544-immr\0simple-bus";
     char soc[128];
     char mpic[128];
@@ -158,14 +157,9 @@ static int ppce500_load_device_tree(CPUPPCState *env,
             0x0, 0xe1000000,
             0x0, 0x10000,
         };
-    QemuOpts *machine_opts;
-    const char *dtb_file = NULL;
-
-    machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (machine_opts) {
-        dtb_file = qemu_opt_get(machine_opts, "dtb");
-        toplevel_compat = qemu_opt_get(machine_opts, "dt_compatible");
-    }
+    QemuOpts *machine_opts = qemu_get_machine_opts();
+    const char *dtb_file = qemu_opt_get(machine_opts, "dtb");
+    const char *toplevel_compat = qemu_opt_get(machine_opts, "dt_compatible");
 
     if (dtb_file) {
         char *filename;
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index c040794..226ae70 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -676,27 +676,19 @@ static void spapr_cpu_reset(void *opaque)
 
 static void spapr_create_nvram(sPAPREnvironment *spapr)
 {
-    QemuOpts *machine_opts;
-    DeviceState *dev;
+    DeviceState *dev = qdev_create(&spapr->vio_bus->bus, "spapr-nvram");
+    const char *drivename = qemu_opt_get(qemu_get_machine_opts(), "nvram");
 
-    dev = qdev_create(&spapr->vio_bus->bus, "spapr-nvram");
+    if (drivename) {
+        BlockDriverState *bs;
 
-    machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (machine_opts) {
-        const char *drivename;
-
-        drivename = qemu_opt_get(machine_opts, "nvram");
-        if (drivename) {
-            BlockDriverState *bs;
-
-            bs = bdrv_find(drivename);
-            if (!bs) {
-                fprintf(stderr, "No such block device \"%s\" for nvram\n",
-                        drivename);
-                exit(1);
-            }
-            qdev_prop_set_drive_nofail(dev, "drive", bs);
+        bs = bdrv_find(drivename);
+        if (!bs) {
+            fprintf(stderr, "No such block device \"%s\" for nvram\n",
+                    drivename);
+            exit(1);
         }
+        qdev_prop_set_drive_nofail(dev, "drive", bs);
     }
 
     qdev_init_nofail(dev);
diff --git a/vl.c b/vl.c
index 6678765..fb69f22 100644
--- a/vl.c
+++ b/vl.c
@@ -1036,15 +1036,9 @@ static int parse_sandbox(QemuOpts *opts, void *opaque)
     return 0;
 }
 
-/*********QEMU USB setting******/
 bool usb_enabled(bool default_usb)
 {
-    QemuOpts *mach_opts;
-    mach_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (mach_opts) {
-        return qemu_opt_get_bool(mach_opts, "usb", default_usb);
-    }
-    return default_usb;
+    return qemu_opt_get_bool(qemu_get_machine_opts(), "usb", default_usb);
 }
 
 #ifndef _WIN32
@@ -4095,14 +4089,10 @@ int main(int argc, char **argv, char **envp)
         qtest_init();
     }
 
-    machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (machine_opts) {
-        kernel_filename = qemu_opt_get(machine_opts, "kernel");
-        initrd_filename = qemu_opt_get(machine_opts, "initrd");
-        kernel_cmdline = qemu_opt_get(machine_opts, "append");
-    } else {
-        kernel_filename = initrd_filename = kernel_cmdline = NULL;
-    }
+    machine_opts = qemu_get_machine_opts();
+    kernel_filename = qemu_opt_get(machine_opts, "kernel");
+    initrd_filename = qemu_opt_get(machine_opts, "initrd");
+    kernel_cmdline = qemu_opt_get(machine_opts, "append");
 
     if (!boot_order) {
         boot_order = machine->boot_order;
@@ -4145,7 +4135,7 @@ int main(int argc, char **argv, char **envp)
         exit(1);
     }
 
-    if (!linux_boot && machine_opts && qemu_opt_get(machine_opts, "dtb")) {
+    if (!linux_boot && qemu_opt_get(machine_opts, "dtb")) {
         fprintf(stderr, "-dtb only allowed with -kernel option\n");
         exit(1);
     }
commit 7bccd9402691e712305bc3b5cc6cf2fa1cc27631
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jul 4 15:09:21 2013 +0200

    microblaze: Fix latent bug with default DTB lookup
    
    microblaze_load_kernel() fails to call
    qemu_find_file(QEMU_FILE_TYPE_BIOS, dtb_filename) when no -machine
    options are given.  This can't normally happen, because -machine
    option kernel is mandatory for this target.  Fix it anyway, by using
    qemu_get_machine_opts().
    
    Cc: Peter Crosthwaite <peter.crosthwaite at petalogix.com>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372943363-24081-6-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/microblaze/boot.c b/hw/microblaze/boot.c
index 3f1d70e..5b057f7 100644
--- a/hw/microblaze/boot.c
+++ b/hw/microblaze/boot.c
@@ -28,6 +28,7 @@
 #include "qemu/config-file.h"
 #include "qemu-common.h"
 #include "sysemu/device_tree.h"
+#include "sysemu/sysemu.h"
 #include "hw/loader.h"
 #include "elf.h"
 
@@ -93,20 +94,18 @@ void microblaze_load_kernel(MicroBlazeCPU *cpu, hwaddr ddr_base,
                             void (*machine_cpu_reset)(MicroBlazeCPU *))
 {
     QemuOpts *machine_opts;
-    const char *kernel_filename = NULL;
-    const char *kernel_cmdline = NULL;
-
-    machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
-    if (machine_opts) {
-        const char *dtb_arg;
-        kernel_filename = qemu_opt_get(machine_opts, "kernel");
-        kernel_cmdline = qemu_opt_get(machine_opts, "append");
-        dtb_arg = qemu_opt_get(machine_opts, "dtb");
-        if (dtb_arg) { /* Preference a -dtb argument */
-            dtb_filename = dtb_arg;
-        } else { /* default to pcbios dtb as passed by machine_init */
-            dtb_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, dtb_filename);
-        }
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *dtb_arg;
+
+    machine_opts = qemu_get_machine_opts();
+    kernel_filename = qemu_opt_get(machine_opts, "kernel");
+    kernel_cmdline = qemu_opt_get(machine_opts, "append");
+    dtb_arg = qemu_opt_get(machine_opts, "dtb");
+    if (dtb_arg) { /* Preference a -dtb argument */
+        dtb_filename = dtb_arg;
+    } else { /* default to pcbios dtb as passed by machine_init */
+        dtb_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, dtb_filename);
     }
 
     boot_info.machine_cpu_reset = machine_cpu_reset;
commit 36ad0e948e15d8d86c8dec1c17a8588d87b0107d
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jul 4 15:09:20 2013 +0200

    Fix -machine options accel, kernel_irqchip, kvm_shadow_mem
    
    Multiple -machine options with the same ID are merged.  All but the
    one without an ID are to be silently ignored.
    
    In most places, we query these options with a null ID.  This is
    correct.
    
    In some places, we instead query whatever options come first in the
    list.  This is wrong.  When the -machine processed first happens to
    have an ID, options are taken from that ID, and the ones specified
    without ID are silently ignored.
    
    Example:
    
        $ upstream-qemu -nodefaults -S -display none -monitor stdio -machine id=foo -machine accel=kvm,usb=on
        $ upstream-qemu -nodefaults -S -display none -monitor stdio -machine id=foo,accel=kvm,usb=on -machine accel=xen
        $ upstream-qemu -nodefaults -S -display none -monitor stdio -machine accel=xen -machine id=foo,accel=kvm,usb=on
    
        $ qemu-system-x86_64 -nodefaults -S -display none -monitor stdio -machine accel=kvm,usb=on
        QEMU 1.5.50 monitor - type 'help' for more information
        (qemu) info kvm
        kvm support: enabled
        (qemu) info usb
        (qemu) q
        $ qemu-system-x86_64 -nodefaults -S -display none -monitor stdio -machine id=foo -machine accel=kvm,usb=on
        QEMU 1.5.50 monitor - type 'help' for more information
        (qemu) info kvm
        kvm support: disabled
        (qemu) info usb
        (qemu) q
        $ qemu-system-x86_64 -nodefaults -S -display none -monitor stdio -machine id=foo,accel=kvm,usb=on -machine accel=xen
        QEMU 1.5.50 monitor - type 'help' for more information
        (qemu) info kvm
        kvm support: enabled
        (qemu) info usb
        USB support not enabled
        (qemu) q
        $ qemu-system-x86_64 -nodefaults -S -display none -monitor stdio -machine accel=xen -machine id=foo,accel=kvm,usb=on
        xc: error: Could not obtain handle on privileged command interface (2 = No such file or directory): Internal error
        xen be core: can't open xen interface
        failed to initialize Xen: Operation not permitted
    
    Option usb is queried correctly, and the one without an ID wins,
    regardless of option order.
    
    Option accel is queried incorrectly, and which one wins depends on
    option order and ID.
    
    Affected options are accel (and its sugared forms -enable-kvm and
    -no-kvm), kernel_irqchip, kvm_shadow_mem.
    
    Additionally, option kernel_irqchip is normally on by default, except
    it's off when no -machine options are given.  Bug can't bite, because
    kernel_irqchip is used only when KVM is enabled, KVM is off by
    default, and enabling always creates -machine options.  Downstreams
    that enable KVM by default do get bitten, though.
    
    Use qemu_get_machine_opts() to fix these bugs.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372943363-24081-5-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 69837a5..2f3018d 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -528,7 +528,6 @@ static DeviceState *ppce500_init_mpic_kvm(PPCE500Params *params,
 static qemu_irq *ppce500_init_mpic(PPCE500Params *params, MemoryRegion *ccsr,
                                    qemu_irq **irqs)
 {
-    QemuOptsList *list;
     qemu_irq *mpic;
     DeviceState *dev = NULL;
     SysBusDevice *s;
@@ -537,15 +536,11 @@ static qemu_irq *ppce500_init_mpic(PPCE500Params *params, MemoryRegion *ccsr,
     mpic = g_new(qemu_irq, 256);
 
     if (kvm_enabled()) {
-        bool irqchip_allowed = true, irqchip_required = false;
-
-        list = qemu_find_opts("machine");
-        if (!QTAILQ_EMPTY(&list->head)) {
-            irqchip_allowed = qemu_opt_get_bool(QTAILQ_FIRST(&list->head),
+        QemuOpts *machine_opts = qemu_get_machine_opts();
+        bool irqchip_allowed = qemu_opt_get_bool(machine_opts,
                                                 "kernel_irqchip", true);
-            irqchip_required = qemu_opt_get_bool(QTAILQ_FIRST(&list->head),
-                                                 "kernel_irqchip", false);
-        }
+        bool irqchip_required = qemu_opt_get_bool(machine_opts,
+                                                  "kernel_irqchip", false);
 
         if (irqchip_allowed) {
             dev = ppce500_init_mpic_kvm(params, irqs);
diff --git a/kvm-all.c b/kvm-all.c
index de658de..a5cd3d3 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1288,12 +1288,9 @@ int kvm_irqchip_remove_irqfd_notifier(KVMState *s, EventNotifier *n, int virq)
 
 static int kvm_irqchip_create(KVMState *s)
 {
-    QemuOptsList *list = qemu_find_opts("machine");
     int ret;
 
-    if (QTAILQ_EMPTY(&list->head) ||
-        !qemu_opt_get_bool(QTAILQ_FIRST(&list->head),
-                           "kernel_irqchip", true) ||
+    if (!qemu_opt_get_bool(qemu_get_machine_opts(), "kernel_irqchip", true) ||
         !kvm_check_extension(s, KVM_CAP_IRQCHIP)) {
         return 0;
     }
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 4b557b3..15da3d7 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -741,7 +741,6 @@ static int kvm_get_supported_msrs(KVMState *s)
 
 int kvm_arch_init(KVMState *s)
 {
-    QemuOptsList *list = qemu_find_opts("machine");
     uint64_t identity_base = 0xfffbc000;
     uint64_t shadow_mem;
     int ret;
@@ -790,15 +789,13 @@ int kvm_arch_init(KVMState *s)
     }
     qemu_register_reset(kvm_unpoison_all, NULL);
 
-    if (!QTAILQ_EMPTY(&list->head)) {
-        shadow_mem = qemu_opt_get_size(QTAILQ_FIRST(&list->head),
-                                       "kvm_shadow_mem", -1);
-        if (shadow_mem != -1) {
-            shadow_mem /= 4096;
-            ret = kvm_vm_ioctl(s, KVM_SET_NR_MMU_PAGES, shadow_mem);
-            if (ret < 0) {
-                return ret;
-            }
+    shadow_mem = qemu_opt_get_size(qemu_get_machine_opts(),
+                                   "kvm_shadow_mem", -1);
+    if (shadow_mem != -1) {
+        shadow_mem /= 4096;
+        ret = kvm_vm_ioctl(s, KVM_SET_NR_MMU_PAGES, shadow_mem);
+        if (ret < 0) {
+            return ret;
         }
     }
     return 0;
diff --git a/vl.c b/vl.c
index e68d19c..6678765 100644
--- a/vl.c
+++ b/vl.c
@@ -2691,17 +2691,13 @@ static struct {
 
 static int configure_accelerator(void)
 {
-    const char *p = NULL;
+    const char *p;
     char buf[10];
     int i, ret;
     bool accel_initialised = false;
     bool init_failed = false;
 
-    QemuOptsList *list = qemu_find_opts("machine");
-    if (!QTAILQ_EMPTY(&list->head)) {
-        p = qemu_opt_get(QTAILQ_FIRST(&list->head), "accel");
-    }
-
+    p = qemu_opt_get(qemu_get_machine_opts(), "accel");
     if (p == NULL) {
         /* Use the default "accelerator", tcg */
         p = "tcg";
commit 7f9d6e540ec4f3bf4dc3501c4a1405998c2be4e7
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jul 4 15:09:19 2013 +0200

    vl: New qemu_get_machine_opts()
    
    To be used in the next few commits to fix or clean up queries of
    "machine" options (-machine and its sugared forms).
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372943363-24081-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index 2fb71af..d85bdc0 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -185,6 +185,8 @@ char *get_boot_devices_list(size_t *size);
 
 DeviceState *get_boot_device(uint32_t position);
 
+QemuOpts *qemu_get_machine_opts(void);
+
 bool usb_enabled(bool default_usb);
 
 extern QemuOptsList qemu_drive_opts;
diff --git a/vl.c b/vl.c
index 6d9fd7d..e68d19c 100644
--- a/vl.c
+++ b/vl.c
@@ -516,6 +516,25 @@ static QemuOptsList qemu_realtime_opts = {
     },
 };
 
+/**
+ * Get machine options
+ *
+ * Returns: machine options (never null).
+ */
+QemuOpts *qemu_get_machine_opts(void)
+{
+    QemuOptsList *list;
+    QemuOpts *opts;
+
+    list = qemu_find_opts("machine");
+    assert(list);
+    opts = qemu_opts_find(list, NULL);
+    if (!opts) {
+        opts = qemu_opts_create_nofail(list);
+    }
+    return opts;
+}
+
 const char *qemu_get_vm_name(void)
 {
     return qemu_name;
commit 6d4cd408686f5ae60b2b3b94b79f48ddedc2f39d
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jul 4 15:09:18 2013 +0200

    qemu-option: Fix qemu_opts_set_defaults() for corner cases
    
    Commit 4f6dd9a changed the initialization of opts in opts_parse() to
    this:
    
        if (defaults) {
            if (!id && !QTAILQ_EMPTY(&list->head)) {
                opts = qemu_opts_find(list, NULL);
            } else {
                opts = qemu_opts_create(list, id, 0);
            }
        } else {
            opts = qemu_opts_create(list, id, 1);
        }
    
    Same as before for !defaults.
    
    If defaults is true, and params has no ID, and options exist, we use
    the first assignment.  It sets opts to null if all options have an ID.
    opts_parse() then returns null.  qemu_opts_set_defaults() asserts the
    value is non-null.  It's the only caller that passes true for
    defaults.
    
    To reproduce, try "-M xenpv -machine id=foo" (yes, "id=foo" is silly,
    but it shouldn't crash).
    
    I believe the function attempts to do the following:
    
        If options don't yet exist, create new options
        Else, if defaults, modify the existing options
        Else, if list->merge_lists, modify the existing options
        Else, fail
    
    A straightforward call of qemu_opts_create() does exactly that.
    
    Cc: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1372943363-24081-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/util/qemu-option.c b/util/qemu-option.c
index 2715f27..e0ef426 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -914,15 +914,7 @@ static QemuOpts *opts_parse(QemuOptsList *list, const char *params,
         get_opt_value(value, sizeof(value), p+4);
         id = value;
     }
-    if (defaults) {
-        if (!id && !QTAILQ_EMPTY(&list->head)) {
-            opts = qemu_opts_find(list, NULL);
-        } else {
-            opts = qemu_opts_create(list, id, 0, &local_err);
-        }
-    } else {
-        opts = qemu_opts_create(list, id, 1, &local_err);
-    }
+    opts = qemu_opts_create(list, id, !defaults, &local_err);
     if (opts == NULL) {
         if (error_is_set(&local_err)) {
             qerror_report_err(local_err);
commit 96bc97ebf350ec480b69082819cedb8850f46a0f
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jul 4 15:09:17 2013 +0200

    qemu-option: Fix qemu_opts_find() for null id arguments
    
    Crashes when the first list member has an ID.  Admittedly nonsensical
    reproducer:
    
    $ qemu-system-x86_64 -nodefaults -machine id=foo -machine ""
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1372943363-24081-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/util/qemu-option.c b/util/qemu-option.c
index 412c425..2715f27 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -706,16 +706,12 @@ QemuOpts *qemu_opts_find(QemuOptsList *list, const char *id)
     QemuOpts *opts;
 
     QTAILQ_FOREACH(opts, &list->head, next) {
-        if (!opts->id) {
-            if (!id) {
-                return opts;
-            }
-            continue;
+        if (!opts->id && !id) {
+            return opts;
         }
-        if (strcmp(opts->id, id) != 0) {
-            continue;
+        if (opts->id && id && !strcmp(opts->id, id)) {
+            return opts;
         }
-        return opts;
     }
     return NULL;
 }
commit 154bb106dc195b4fbb76df0452ab6e3e24e80d72
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Jul 5 19:07:16 2013 +0200

    exec: Remove unused global variable phys_ram_fd
    
    It seems to be unused since several years (commit
    be995c27640a82c7056b6f53d02ec823570114e5 in 2006).
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1373044036-14443-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/exec.c b/exec.c
index 03fdf7e..485d811 100644
--- a/exec.c
+++ b/exec.c
@@ -53,7 +53,6 @@
 //#define DEBUG_SUBPAGE
 
 #if !defined(CONFIG_USER_ONLY)
-int phys_ram_fd;
 static int in_migration;
 
 RAMList ram_list = { .blocks = QTAILQ_HEAD_INITIALIZER(ram_list.blocks) };
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 35bdf85..e791c05 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -447,7 +447,6 @@ hwaddr cpu_get_phys_page_debug(CPUArchState *env, target_ulong addr);
 
 /* memory API */
 
-extern int phys_ram_fd;
 extern ram_addr_t ram_size;
 
 /* RAM is pre-allocated and passed into qemu_ram_alloc_from_ptr */
commit 92304bf3998cedcf3b1026a795edba7e1fd17c74
Author: M. Mohan Kumar <mohan at in.ibm.com>
Date:   Thu Jul 4 14:51:18 2013 +0530

    hw/9pfs: Fix memory leak in error path
    
    Fix few more memory leaks in virtio-9p-device.c detected using valgrind.
    
    Signed-off-by: M. Mohan Kumar <mohan at in.ibm.com>
    Message-id: 1372929678-14341-1-git-send-email-mohan at in.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index dc6f4e4..35e2af4 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -68,14 +68,14 @@ static int virtio_9p_device_init(VirtIODevice *vdev)
         fprintf(stderr, "Virtio-9p device couldn't find fsdev with the "
                 "id = %s\n",
                 s->fsconf.fsdev_id ? s->fsconf.fsdev_id : "NULL");
-        return -1;
+        goto out;
     }
 
     if (!s->fsconf.tag) {
         /* we haven't specified a mount_tag */
         fprintf(stderr, "fsdev with id %s needs mount_tag arguments\n",
                 s->fsconf.fsdev_id);
-        return -1;
+        goto out;
     }
 
     s->ctx.export_flags = fse->export_flags;
@@ -85,10 +85,10 @@ static int virtio_9p_device_init(VirtIODevice *vdev)
     if (len > MAX_TAG_LEN - 1) {
         fprintf(stderr, "mount tag '%s' (%d bytes) is longer than "
                 "maximum (%d bytes)", s->fsconf.tag, len, MAX_TAG_LEN - 1);
-        return -1;
+        goto out;
     }
 
-    s->tag = strdup(s->fsconf.tag);
+    s->tag = g_strdup(s->fsconf.tag);
     s->ctx.uid = -1;
 
     s->ops = fse->ops;
@@ -99,11 +99,11 @@ static int virtio_9p_device_init(VirtIODevice *vdev)
     if (s->ops->init(&s->ctx) < 0) {
         fprintf(stderr, "Virtio-9p Failed to initialize fs-driver with id:%s"
                 " and export path:%s\n", s->fsconf.fsdev_id, s->ctx.fs_root);
-        return -1;
+        goto out;
     }
     if (v9fs_init_worker_threads() < 0) {
         fprintf(stderr, "worker thread initialization failed\n");
-        return -1;
+        goto out;
     }
 
     /*
@@ -115,18 +115,26 @@ static int virtio_9p_device_init(VirtIODevice *vdev)
     if (s->ops->name_to_path(&s->ctx, NULL, "/", &path) < 0) {
         fprintf(stderr,
                 "error in converting name to path %s", strerror(errno));
-        return -1;
+        goto out;
     }
     if (s->ops->lstat(&s->ctx, &path, &stat)) {
         fprintf(stderr, "share path %s does not exist\n", fse->path);
-        return -1;
+        goto out;
     } else if (!S_ISDIR(stat.st_mode)) {
         fprintf(stderr, "share path %s is not a directory\n", fse->path);
-        return -1;
+        goto out;
     }
     v9fs_path_free(&path);
 
     return 0;
+out:
+    g_free(s->ctx.fs_root);
+    g_free(s->tag);
+    virtio_cleanup(vdev);
+    v9fs_path_free(&path);
+
+    return -1;
+
 }
 
 /* virtio-9p device */
commit b58c86e1e4cdf59373aad2ec25f99f772766374c
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 16 12:02:40 2013 +0200

    fsdev: Fix potential memory leak
    
    This leak was reported by cppcheck.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: M. Mohan Kumar <mohan at in.ibm.com>
    Message-id: 1371376960-18192-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/fsdev/qemu-fsdev.c b/fsdev/qemu-fsdev.c
index 6eaf36d..ccfec13 100644
--- a/fsdev/qemu-fsdev.c
+++ b/fsdev/qemu-fsdev.c
@@ -76,6 +76,8 @@ int qemu_fsdev_add(QemuOpts *opts)
 
     if (fsle->fse.ops->parse_opts) {
         if (fsle->fse.ops->parse_opts(opts, &fsle->fse)) {
+            g_free(fsle->fse.fsdev_id);
+            g_free(fsle);
             return -1;
         }
     }
commit edb5092c245d34e05ca410d4bf32cf0c2786c8e8
Author: MRatnikov <m.o.ratnikov at gmail.com>
Date:   Mon Jul 8 01:03:02 2013 +0400

    Extend support of SMBUS(module pm_smbus.c) HST_STS register.
    
    Previous realization doesn't consider flags in the status register.
    Add DS and INTR bits of HST_STS register set after transaction execution.
    Update bits resetting in HST_STS register. Update error processing:
    if DEV_ERR bit set transaction isn't execution.
    
    Signed-off-by: MRatnikov <m.o.ratnikov at gmail.com>
    Message-id: 1373230982-9190-1-git-send-email-m.o.ratnikov at gmail.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c
index 6df0fa9..c98e447 100644
--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -32,6 +32,18 @@
 #define SMBHSTDAT1      0x06
 #define SMBBLKDAT       0x07
 
+#define STS_HOST_BUSY   (1)
+#define STS_INTR        (1<<1)
+#define STS_DEV_ERR     (1<<2)
+#define STS_BUS_ERR     (1<<3)
+#define STS_FAILED      (1<<4)
+#define STS_SMBALERT    (1<<5)
+#define STS_INUSE_STS   (1<<6)
+#define STS_BYTE_DONE   (1<<7)
+/* Signs of successfully transaction end :
+*  ByteDoneStatus = 1 (STS_BYTE_DONE) and INTR = 1 (STS_INTR )
+*/
+
 //#define DEBUG
 
 #ifdef DEBUG
@@ -50,9 +62,14 @@ static void smb_transaction(PMSMBus *s)
     i2c_bus *bus = s->smbus;
 
     SMBUS_DPRINTF("SMBus trans addr=0x%02x prot=0x%02x\n", addr, prot);
+    /* Transaction isn't exec if STS_DEV_ERR bit set */
+    if ((s->smb_stat & STS_DEV_ERR) != 0)  {
+            goto error;
+        }
     switch(prot) {
     case 0x0:
         smbus_quick_command(bus, addr, read);
+        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
         break;
     case 0x1:
         if (read) {
@@ -60,6 +77,7 @@ static void smb_transaction(PMSMBus *s)
         } else {
             smbus_send_byte(bus, addr, cmd);
         }
+        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
         break;
     case 0x2:
         if (read) {
@@ -67,6 +85,7 @@ static void smb_transaction(PMSMBus *s)
         } else {
             smbus_write_byte(bus, addr, cmd, s->smb_data0);
         }
+        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
         break;
     case 0x3:
         if (read) {
@@ -77,6 +96,7 @@ static void smb_transaction(PMSMBus *s)
         } else {
             smbus_write_word(bus, addr, cmd, (s->smb_data1 << 8) | s->smb_data0);
         }
+        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
         break;
     case 0x5:
         if (read) {
@@ -84,6 +104,7 @@ static void smb_transaction(PMSMBus *s)
         } else {
             smbus_write_block(bus, addr, cmd, s->smb_data, s->smb_data0);
         }
+        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
         break;
     default:
         goto error;
@@ -91,7 +112,7 @@ static void smb_transaction(PMSMBus *s)
     return;
 
   error:
-    s->smb_stat |= 0x04;
+    s->smb_stat |= STS_DEV_ERR;
 }
 
 static void smb_ioport_writeb(void *opaque, hwaddr addr, uint64_t val,
@@ -102,7 +123,7 @@ static void smb_ioport_writeb(void *opaque, hwaddr addr, uint64_t val,
     SMBUS_DPRINTF("SMB writeb port=0x%04x val=0x%02x\n", addr, val);
     switch(addr) {
     case SMBHSTSTS:
-        s->smb_stat = 0;
+        s->smb_stat = (~(val & 0xff)) & s->smb_stat;
         s->smb_index = 0;
         break;
     case SMBHSTCNT:
commit 02c4bdf1d2ca8c02a9bae16398f260b5c08d08bf
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Jul 3 20:29:45 2013 +0400

    trap signals for "-serial mon:stdio"
    
    With mon:stdio you can exit the VM by switching to the monitor and
    sending the "quit" command.  It is then useful to pass Ctrl-C to the
    VM instead of exiting.
    
    This in turn lets us stop tying the default signal handling behavior
    to -nographic, removing gratuitous differences between "-display none"
    and "-nographic".
    
    This patch changes behavior for "-display none -serial mon:stdio", as
    expected, but not for "-display none -serial stdio".
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1372868986-25988-1-git-send-email-mjt at msgid.tls.msk.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index 6cec5d7..18c42a3 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -926,7 +926,6 @@ static void qemu_chr_set_echo_stdio(CharDriverState *chr, bool echo)
         tty.c_cc[VMIN] = 1;
         tty.c_cc[VTIME] = 0;
     }
-    /* if graphical mode, we allow Ctrl-C handling */
     if (!stdio_allow_signal)
         tty.c_lflag &= ~ISIG;
 
@@ -955,7 +954,6 @@ static CharDriverState *qemu_chr_open_stdio(ChardevStdio *opts)
     chr = qemu_chr_open_fd(0, 1);
     chr->chr_close = qemu_chr_close_stdio;
     chr->chr_set_echo = qemu_chr_set_echo_stdio;
-    stdio_allow_signal = display_type != DT_NOGRAPHIC;
     if (opts->has_signal) {
         stdio_allow_signal = opts->signal;
     }
@@ -2932,6 +2930,14 @@ QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename)
     if (strstart(filename, "mon:", &p)) {
         filename = p;
         qemu_opt_set(opts, "mux", "on");
+        if (strcmp(filename, "stdio") == 0) {
+            /* Monitor is muxed to stdio: do not exit on Ctrl+C by default
+             * but pass it to the guest.  Handle this only for compat syntax,
+             * for -chardev syntax we have special option for this.
+             * This is what -nographic did, redirecting+muxing serial+monitor
+             * to stdio causing Ctrl+C to be passed to guest. */
+            qemu_opt_set(opts, "signal", "off");
+        }
     }
 
     if (strcmp(filename, "null")    == 0 ||
@@ -3060,8 +3066,7 @@ static void qemu_chr_parse_stdio(QemuOpts *opts, ChardevBackend *backend,
 {
     backend->stdio = g_new0(ChardevStdio, 1);
     backend->stdio->has_signal = true;
-    backend->stdio->signal =
-        qemu_opt_get_bool(opts, "signal", display_type != DT_NOGRAPHIC);
+    backend->stdio->signal = qemu_opt_get_bool(opts, "signal", true);
 }
 
 static void qemu_chr_parse_serial(QemuOpts *opts, ChardevBackend *backend,
diff --git a/qemu-options.hx b/qemu-options.hx
index 137a39b..7cc4d8e 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -842,7 +842,8 @@ STEXI
 Normally, QEMU uses SDL to display the VGA output. With this option,
 you can totally disable graphical output so that QEMU is a simple
 command line application. The emulated serial port is redirected on
-the console. Therefore, you can still use QEMU to debug a Linux kernel
+the console and muxed with the monitor (unless redirected elsewhere
+explicitly). Therefore, you can still use QEMU to debug a Linux kernel
 with a serial console.
 ETEXI
 
@@ -2485,14 +2486,15 @@ same as if you had specified @code{-serial tcp} except the unix domain socket
 @item mon:@var{dev_string}
 This is a special option to allow the monitor to be multiplexed onto
 another serial port.  The monitor is accessed with key sequence of
- at key{Control-a} and then pressing @key{c}. See monitor access
- at ref{pcsys_keys} in the -nographic section for more keys.
+ at key{Control-a} and then pressing @key{c}.
 @var{dev_string} should be any one of the serial devices specified
 above.  An example to multiplex the monitor onto a telnet server
 listening on port 4444 would be:
 @table @code
 @item -serial mon:telnet::4444,server,nowait
 @end table
+When monitor is multiplexed to stdio this way, Ctrl+C will not terminate
+QEMU anymore but will be passed to the guest instead.
 
 @item braille
 Braille device.  This will use BrlAPI to display the braille output on a real
commit 964c6fa16f50a607f9da5068d6bf15ccc93872c0
Author: Richard Henderson <rth at twiddle.net>
Date:   Fri Jun 21 19:10:16 2013 -0700

    configure: Simplify alternate .text segment
    
    For bsd-user and linux-user emulation modes QEMU needs to be linked at an
    alternate .text segment address, so that it's out of the way of the guest
    executable.  Instead of including modified linker scripts for each arch,
    just set the address with -Ttext-segment if supported, or by using sed to
    edit the default linker script.
    
    Cc: Ed Maste <emaste at freebsd.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Ed Maste <emaste at freebsd.org>
    Signed-off-by: Ed Maste <emaste at freebsd.org>
    Message-id: 1371867016-7660-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/configure b/configure
index 0e0adde..cb0f870 100755
--- a/configure
+++ b/configure
@@ -3445,6 +3445,36 @@ if test "$cpu" = "s390x" ; then
   roms="$roms s390-ccw"
 fi
 
+# Probe for the need for relocating the user-only binary.
+if test "$pie" = "no" ; then
+  textseg_addr=
+  case "$cpu" in
+    arm | hppa | i386 | m68k | ppc | ppc64 | s390* | sparc | sparc64 | x86_64)
+      textseg_addr=0x60000000
+      ;;
+    mips)
+      textseg_addr=0x400000
+      ;;
+  esac
+  if [ -n "$textseg_addr" ]; then
+    cat > $TMPC <<EOF
+    int main(void) { return 0; }
+EOF
+    textseg_ldflags="-Wl,-Ttext-segment=$textseg_addr"
+    if ! compile_prog "" "$textseg_ldflags"; then
+      # In case ld does not support -Ttext-segment, edit the default linker
+      # script via sed to set the .text start addr.  This is needed on FreeBSD
+      # at least.
+      $ld --verbose | sed \
+        -e '1,/==================================================/d' \
+        -e '/==================================================/,$d' \
+        -e "s/[.] = [0-9a-fx]* [+] SIZEOF_HEADERS/. = $textseg_addr + SIZEOF_HEADERS/" \
+        -e "s/__executable_start = [0-9a-fx]*/__executable_start = $textseg_addr/" > config-host.ld
+      textseg_ldflags="-Wl,-T../config-host.ld"
+    fi
+  fi
+fi
+
 # add pixman flags after all config tests are done
 QEMU_CFLAGS="$QEMU_CFLAGS $pixman_cflags $fdt_cflags"
 libs_softmmu="$libs_softmmu $pixman_libs"
@@ -4073,9 +4103,6 @@ if test "$gcov" = "yes" ; then
   echo "GCOV=$gcov_tool" >> $config_host_mak
 fi
 
-# generate list of library paths for linker script
-$ld --verbose -v 2> /dev/null | grep SEARCH_DIR > config-host.ld
-
 # use included Linux headers
 if test "$linux" = "yes" ; then
   mkdir -p linux-headers
@@ -4438,21 +4465,8 @@ if test "$gprof" = "yes" ; then
   fi
 fi
 
-if test "$ARCH" = "tci"; then
-  linker_script=""
-else
-  linker_script="-Wl,-T../config-host.ld -Wl,-T,\$(SRC_PATH)/ldscripts/\$(ARCH).ld"
-fi
-
 if test "$target_linux_user" = "yes" -o "$target_bsd_user" = "yes" ; then
-  case "$ARCH" in
-  alpha | s390x | aarch64)
-    # The default placement of the application is fine.
-    ;;
-  *)
-    ldflags="$linker_script $ldflags"
-    ;;
-  esac
+  ldflags="$ldflags $textseg_ldflags"
 fi
 
 echo "LDFLAGS+=$ldflags" >> $config_target_mak
commit 071b3364e7995036816aa4ebf80ecfa04b1a31de
Author: Dongxue Zhang <elta.era at gmail.com>
Date:   Tue Jul 2 17:11:55 2013 +0800

    target-openrisc: Fix typename in openrisc_cpu_class_by_name()
    
    Commit 478032a93d908e59085c1ac56f10979942e7dc4f (target-openrisc:
    Rename CPU subtypes) suffixed CPU sub-types with "-or32-cpu" but forgot
    to update openrisc_cpu_class_by_name(), so that it was still looking for
    the types without suffix.
    
    Make target-openrisc running OK by adding the suffix to the model name.
    
    This means it is no longer possible to use -cpu or1200-or32-cpu or
    -cpu any-or32-cpu though.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Dongxue Zhang <elta.era at gmail.com>
    Tested-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index fd90d37..d38c28b 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -96,12 +96,14 @@ static void openrisc_cpu_initfn(Object *obj)
 static ObjectClass *openrisc_cpu_class_by_name(const char *cpu_model)
 {
     ObjectClass *oc;
+    char *typename;
 
     if (cpu_model == NULL) {
         return NULL;
     }
 
-    oc = object_class_by_name(cpu_model);
+    typename = g_strdup_printf("%s-" TYPE_OPENRISC_CPU, cpu_model);
+    oc = object_class_by_name(typename);
     if (oc != NULL && (!object_class_dynamic_cast(oc, TYPE_OPENRISC_CPU) ||
                        object_class_is_abstract(oc))) {
         return NULL;
commit 0caa91fe1f0a60269d7af032118639303e6eddd6
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Jun 5 07:55:33 2013 -0700

    tcg-arm: Implement tcg_register_jit
    
    Allows unwinding past the code_gen_buffer.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
index 4710046..6c4854d 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.c
@@ -2088,23 +2088,31 @@ static inline void tcg_out_movi(TCGContext *s, TCGType type,
     tcg_out_movi32(s, COND_AL, ret, arg);
 }
 
+/* Compute frame size via macros, to share between tcg_target_qemu_prologue
+   and tcg_register_jit.  */
+
+#define PUSH_SIZE  ((11 - 4 + 1 + 1) * sizeof(tcg_target_long))
+
+#define FRAME_SIZE \
+    ((PUSH_SIZE \
+      + TCG_STATIC_CALL_ARGS_SIZE \
+      + CPU_TEMP_BUF_NLONGS * sizeof(long) \
+      + TCG_TARGET_STACK_ALIGN - 1) \
+     & -TCG_TARGET_STACK_ALIGN)
+
 static void tcg_target_qemu_prologue(TCGContext *s)
 {
-    int frame_size;
+    int stack_addend;
 
     /* Calling convention requires us to save r4-r11 and lr.  */
     /* stmdb sp!, { r4 - r11, lr } */
     tcg_out32(s, (COND_AL << 28) | 0x092d4ff0);
 
-    /* Allocate the local stack frame.  */
-    frame_size = TCG_STATIC_CALL_ARGS_SIZE;
-    frame_size += CPU_TEMP_BUF_NLONGS * sizeof(long);
-    /* We saved an odd number of registers above; keep an 8 aligned stack.  */
-    frame_size = ((frame_size + TCG_TARGET_STACK_ALIGN - 1)
-                  & -TCG_TARGET_STACK_ALIGN) + 4;
+    /* Reserve callee argument and tcg temp space.  */
+    stack_addend = FRAME_SIZE - PUSH_SIZE;
 
     tcg_out_dat_rI(s, COND_AL, ARITH_SUB, TCG_REG_CALL_STACK,
-                   TCG_REG_CALL_STACK, frame_size, 1);
+                   TCG_REG_CALL_STACK, stack_addend, 1);
     tcg_set_frame(s, TCG_REG_CALL_STACK, TCG_STATIC_CALL_ARGS_SIZE,
                   CPU_TEMP_BUF_NLONGS * sizeof(long));
 
@@ -2115,8 +2123,58 @@ static void tcg_target_qemu_prologue(TCGContext *s)
 
     /* Epilogue.  We branch here via tb_ret_addr.  */
     tcg_out_dat_rI(s, COND_AL, ARITH_ADD, TCG_REG_CALL_STACK,
-                   TCG_REG_CALL_STACK, frame_size, 1);
+                   TCG_REG_CALL_STACK, stack_addend, 1);
 
     /* ldmia sp!, { r4 - r11, pc } */
     tcg_out32(s, (COND_AL << 28) | 0x08bd8ff0);
 }
+
+typedef struct {
+    DebugFrameCIE cie;
+    DebugFrameFDEHeader fde;
+    uint8_t fde_def_cfa[4];
+    uint8_t fde_reg_ofs[18];
+} DebugFrame;
+
+#define ELF_HOST_MACHINE EM_ARM
+
+/* We're expecting a 2 byte uleb128 encoded value.  */
+QEMU_BUILD_BUG_ON(FRAME_SIZE >= (1 << 14));
+
+static DebugFrame debug_frame = {
+    .cie.len = sizeof(DebugFrameCIE)-4, /* length after .len member */
+    .cie.id = -1,
+    .cie.version = 1,
+    .cie.code_align = 1,
+    .cie.data_align = 0x7c,             /* sleb128 -4 */
+    .cie.return_column = 14,
+
+    /* Total FDE size does not include the "len" member.  */
+    .fde.len = sizeof(DebugFrame) - offsetof(DebugFrame, fde.cie_offset),
+
+    .fde_def_cfa = {
+        12, 13,                         /* DW_CFA_def_cfa sp, ... */
+        (FRAME_SIZE & 0x7f) | 0x80,     /* ... uleb128 FRAME_SIZE */
+        (FRAME_SIZE >> 7)
+    },
+    .fde_reg_ofs = {
+        /* The following must match the stmdb in the prologue.  */
+        0x8e, 1,                        /* DW_CFA_offset, lr, -4 */
+        0x8b, 2,                        /* DW_CFA_offset, r11, -8 */
+        0x8a, 3,                        /* DW_CFA_offset, r10, -12 */
+        0x89, 4,                        /* DW_CFA_offset, r9, -16 */
+        0x88, 5,                        /* DW_CFA_offset, r8, -20 */
+        0x87, 6,                        /* DW_CFA_offset, r7, -24 */
+        0x86, 7,                        /* DW_CFA_offset, r6, -28 */
+        0x85, 8,                        /* DW_CFA_offset, r5, -32 */
+        0x84, 9,                        /* DW_CFA_offset, r4, -36 */
+    }
+};
+
+void tcg_register_jit(void *buf, size_t buf_size)
+{
+    debug_frame.fde.func_start = (tcg_target_long) buf;
+    debug_frame.fde.func_len = buf_size;
+
+    tcg_register_jit_int(buf, buf_size, &debug_frame, sizeof(debug_frame));
+}
commit b5cc476da7e71629d8d4ab77f691c70346368788
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Jun 5 07:56:29 2013 -0700

    tcg-i386: Use QEMU_BUILD_BUG_ON instead of assert for frame size
    
    We can check the condition at compile time, rather than run time.
    
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
index ae3de09..87eeab3 100644
--- a/tcg/i386/tcg-target.c
+++ b/tcg/i386/tcg-target.c
@@ -2318,6 +2318,9 @@ typedef struct {
     uint8_t fde_reg_ofs[14];
 } DebugFrame;
 
+/* We're expecting a 2 byte uleb128 encoded value.  */
+QEMU_BUILD_BUG_ON(FRAME_SIZE >= (1 << 14));
+
 #if !defined(__ELF__)
     /* Host machine without ELF. */
 #elif TCG_TARGET_REG_BITS == 64
@@ -2381,9 +2384,6 @@ static DebugFrame debug_frame = {
 #if defined(ELF_HOST_MACHINE)
 void tcg_register_jit(void *buf, size_t buf_size)
 {
-    /* We're expecting a 2 byte uleb128 encoded value.  */
-    assert(FRAME_SIZE >> 14 == 0);
-
     debug_frame.fde.func_start = (tcg_target_long) buf;
     debug_frame.fde.func_len = buf_size;
 
commit 497a22eb87da704c0a59ebebfde441849cd5189b
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Jun 5 07:39:57 2013 -0700

    tcg: Move the CIE and FDE header definitions to common code
    
    These will necessarily be the same layout for all hosts.  This limits
    the amount of boilerplate required to implement jit debug for a host.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/hppa/tcg-target.c b/tcg/hppa/tcg-target.c
index 656e736..68f77ba 100644
--- a/tcg/hppa/tcg-target.c
+++ b/tcg/hppa/tcg-target.c
@@ -1766,28 +1766,11 @@ static void tcg_target_init(TCGContext *s)
 }
 
 typedef struct {
-    uint32_t len __attribute__((aligned((sizeof(void *)))));
-    uint32_t id;
-    uint8_t version;
-    char augmentation[1];
-    uint8_t code_align;
-    uint8_t data_align;
-    uint8_t return_column;
-} DebugFrameCIE;
-
-typedef struct {
-    uint32_t len __attribute__((aligned((sizeof(void *)))));
-    uint32_t cie_offset;
-    tcg_target_long func_start __attribute__((packed));
-    tcg_target_long func_len __attribute__((packed));
-    uint8_t def_cfa[4];
-    uint8_t ret_ofs[3];
-    uint8_t reg_ofs[ARRAY_SIZE(tcg_target_callee_save_regs) * 2];
-} DebugFrameFDE;
-
-typedef struct {
     DebugFrameCIE cie;
-    DebugFrameFDE fde;
+    DebugFrameFDEHeader fde;
+    uint8_t fde_def_cfa[4];
+    uint8_t fde_ret_ofs[3];
+    uint8_t fde_reg_ofs[ARRAY_SIZE(tcg_target_callee_save_regs) * 2];
 } DebugFrame;
 
 #define ELF_HOST_MACHINE  EM_PARISC
@@ -1806,16 +1789,18 @@ static DebugFrame debug_frame = {
     .cie.data_align = 1,
     .cie.return_column = 2,
 
-    .fde.len = sizeof(DebugFrameFDE)-4, /* length after .len member */
-    .fde.def_cfa = {
+    /* Total FDE size does not include the "len" member.  */
+    .fde.len = sizeof(DebugFrame) - offsetof(DebugFrame, fde.cie_offset),
+
+    .fde_def_cfa = {
         0x12, 30,                       /* DW_CFA_def_cfa_sf sp, ... */
         (-FRAME_SIZE & 0x7f) | 0x80,     /* ... sleb128 -FRAME_SIZE */
         (-FRAME_SIZE >> 7) & 0x7f
     },
-    .fde.ret_ofs = {
+    .fde_ret_ofs = {
         0x11, 2, (-20 / 4) & 0x7f       /* DW_CFA_offset_extended_sf r2, 20 */
     },
-    .fde.reg_ofs = {
+    .fde_reg_ofs = {
         /* This must match the ordering in tcg_target_callee_save_regs.  */
         0x80 + 4, 0,                    /* DW_CFA_offset r4, 0 */
         0x80 + 5, 4,                    /* DW_CFA_offset r5, 4 */
diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
index 9e95477..ae3de09 100644
--- a/tcg/i386/tcg-target.c
+++ b/tcg/i386/tcg-target.c
@@ -2312,27 +2312,10 @@ static void tcg_target_init(TCGContext *s)
 }
 
 typedef struct {
-    uint32_t len __attribute__((aligned((sizeof(void *)))));
-    uint32_t id;
-    uint8_t version;
-    char augmentation[1];
-    uint8_t code_align;
-    uint8_t data_align;
-    uint8_t return_column;
-} DebugFrameCIE;
-
-typedef struct {
-    uint32_t len __attribute__((aligned((sizeof(void *)))));
-    uint32_t cie_offset;
-    tcg_target_long func_start __attribute__((packed));
-    tcg_target_long func_len __attribute__((packed));
-    uint8_t def_cfa[4];
-    uint8_t reg_ofs[14];
-} DebugFrameFDE;
-
-typedef struct {
     DebugFrameCIE cie;
-    DebugFrameFDE fde;
+    DebugFrameFDEHeader fde;
+    uint8_t fde_def_cfa[4];
+    uint8_t fde_reg_ofs[14];
 } DebugFrame;
 
 #if !defined(__ELF__)
@@ -2347,13 +2330,15 @@ static DebugFrame debug_frame = {
     .cie.data_align = 0x78,             /* sleb128 -8 */
     .cie.return_column = 16,
 
-    .fde.len = sizeof(DebugFrameFDE)-4, /* length after .len member */
-    .fde.def_cfa = {
+    /* Total FDE size does not include the "len" member.  */
+    .fde.len = sizeof(DebugFrame) - offsetof(DebugFrame, fde.cie_offset),
+
+    .fde_def_cfa = {
         12, 7,                          /* DW_CFA_def_cfa %rsp, ... */
         (FRAME_SIZE & 0x7f) | 0x80,     /* ... uleb128 FRAME_SIZE */
         (FRAME_SIZE >> 7)
     },
-    .fde.reg_ofs = {
+    .fde_reg_ofs = {
         0x90, 1,                        /* DW_CFA_offset, %rip, -8 */
         /* The following ordering must match tcg_target_callee_save_regs.  */
         0x86, 2,                        /* DW_CFA_offset, %rbp, -16 */
@@ -2374,13 +2359,15 @@ static DebugFrame debug_frame = {
     .cie.data_align = 0x7c,             /* sleb128 -4 */
     .cie.return_column = 8,
 
-    .fde.len = sizeof(DebugFrameFDE)-4, /* length after .len member */
-    .fde.def_cfa = {
+    /* Total FDE size does not include the "len" member.  */
+    .fde.len = sizeof(DebugFrame) - offsetof(DebugFrame, fde.cie_offset),
+
+    .fde_def_cfa = {
         12, 4,                          /* DW_CFA_def_cfa %esp, ... */
         (FRAME_SIZE & 0x7f) | 0x80,     /* ... uleb128 FRAME_SIZE */
         (FRAME_SIZE >> 7)
     },
-    .fde.reg_ofs = {
+    .fde_reg_ofs = {
         0x88, 1,                        /* DW_CFA_offset, %eip, -4 */
         /* The following ordering must match tcg_target_callee_save_regs.  */
         0x85, 2,                        /* DW_CFA_offset, %ebp, -8 */
diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
index 025af9b..5bfd29c 100644
--- a/tcg/sparc/tcg-target.c
+++ b/tcg/sparc/tcg-target.c
@@ -1647,28 +1647,11 @@ static void tcg_target_init(TCGContext *s)
 #endif
 
 typedef struct {
-    uint32_t len __attribute__((aligned((sizeof(void *)))));
-    uint32_t id;
-    uint8_t version;
-    char augmentation[1];
-    uint8_t code_align;
-    uint8_t data_align;
-    uint8_t return_column;
-} DebugFrameCIE;
-
-typedef struct {
-    uint32_t len __attribute__((aligned((sizeof(void *)))));
-    uint32_t cie_offset;
-    tcg_target_long func_start __attribute__((packed));
-    tcg_target_long func_len __attribute__((packed));
-    uint8_t def_cfa[TCG_TARGET_REG_BITS == 64 ? 4 : 2];
-    uint8_t win_save;
-    uint8_t ret_save[3];
-} DebugFrameFDE;
-
-typedef struct {
     DebugFrameCIE cie;
-    DebugFrameFDE fde;
+    DebugFrameFDEHeader fde;
+    uint8_t fde_def_cfa[TCG_TARGET_REG_BITS == 64 ? 4 : 2];
+    uint8_t fde_win_save;
+    uint8_t fde_ret_save[3];
 } DebugFrame;
 
 static DebugFrame debug_frame = {
@@ -1679,8 +1662,10 @@ static DebugFrame debug_frame = {
     .cie.data_align = -sizeof(void *) & 0x7f,
     .cie.return_column = 15,            /* o7 */
 
-    .fde.len = sizeof(DebugFrameFDE)-4, /* length after .len member */
-    .fde.def_cfa = {
+    /* Total FDE size does not include the "len" member.  */
+    .fde.len = sizeof(DebugFrame) - offsetof(DebugFrame, fde.cie_offset),
+
+    .fde_def_cfa = {
 #if TCG_TARGET_REG_BITS == 64
         12, 30,                         /* DW_CFA_def_cfa i6, 2047 */
         (2047 & 0x7f) | 0x80, (2047 >> 7)
@@ -1688,8 +1673,8 @@ static DebugFrame debug_frame = {
         13, 30                          /* DW_CFA_def_cfa_register i6 */
 #endif
     },
-    .fde.win_save = 0x2d,               /* DW_CFA_GNU_window_save */
-    .fde.ret_save = { 9, 15, 31 },      /* DW_CFA_register o7, i7 */
+    .fde_win_save = 0x2d,               /* DW_CFA_GNU_window_save */
+    .fde_ret_save = { 9, 15, 31 },      /* DW_CFA_register o7, i7 */
 };
 
 void tcg_register_jit(void *buf, size_t buf_size)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 42dc958..dac8224 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -68,6 +68,24 @@ static void tcg_target_qemu_prologue(TCGContext *s);
 static void patch_reloc(uint8_t *code_ptr, int type, 
                         tcg_target_long value, tcg_target_long addend);
 
+/* The CIE and FDE header definitions will be common to all hosts.  */
+typedef struct {
+    uint32_t len __attribute__((aligned((sizeof(void *)))));
+    uint32_t id;
+    uint8_t version;
+    char augmentation[1];
+    uint8_t code_align;
+    uint8_t data_align;
+    uint8_t return_column;
+} DebugFrameCIE;
+
+typedef struct QEMU_PACKED {
+    uint32_t len __attribute__((aligned((sizeof(void *)))));
+    uint32_t cie_offset;
+    tcg_target_long func_start;
+    tcg_target_long func_len;
+} DebugFrameFDEHeader;
+
 static void tcg_register_jit_int(void *buf, size_t size,
                                  void *debug_frame, size_t debug_frame_size)
     __attribute__((unused));
commit 45aba097d24544ed2d3244b3268a071750e4499b
Author: Richard Henderson <rth at twiddle.net>
Date:   Fri May 24 14:16:14 2013 -0700

    tcg: Fix high_pc fields in .debug_info
    
    I don't think the debugger actually looks at this for anything,
    using the correct .debug_frame contents, but might as well get
    it all correct.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/tcg.c b/tcg/tcg.c
index c7e6567..42dc958 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2657,9 +2657,9 @@ static void tcg_register_jit_int(void *buf_ptr, size_t buf_size,
     img->sym[1].st_size = buf_size;
 
     img->di.cu_low_pc = buf;
-    img->di.cu_high_pc = buf_size;
+    img->di.cu_high_pc = buf + buf_size;
     img->di.fn_low_pc = buf;
-    img->di.fn_high_pc = buf_size;
+    img->di.fn_high_pc = buf + buf_size;
 
 #ifdef DEBUG_JIT
     /* Enable this block to be able to debug the ELF image file creation.
commit 1e709f38331ef5bab76cd454c61d4af982cadf0b
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Jun 6 10:46:35 2013 -0700

    tcg-arm: Use AT_PLATFORM to detect the host ISA
    
    With this we can generate armv7 insns even when the OS compiles for a
    lower common denominator.  The macros are arranged so that when we do
    compile for a given ISA, all of the runtime checks for that ISA are
    optimized away.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
index fde1715..4710046 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.c
@@ -41,6 +41,8 @@
 # endif
 #endif
 
+static int arm_arch = __ARM_ARCH;
+
 #if defined(__ARM_ARCH_5T__) \
     || defined(__ARM_ARCH_5TE__) || defined(__ARM_ARCH_5TEJ__)
 # define use_armv5t_instructions 1
@@ -48,8 +50,8 @@
 # define use_armv5t_instructions use_armv6_instructions
 #endif
 
-#define use_armv6_instructions  (__ARM_ARCH >= 6)
-#define use_armv7_instructions  (__ARM_ARCH >= 7)
+#define use_armv6_instructions  (__ARM_ARCH >= 6 || arm_arch >= 6)
+#define use_armv7_instructions  (__ARM_ARCH >= 7 || arm_arch >= 7)
 
 #ifndef use_idiv_instructions
 bool use_idiv_instructions;
@@ -2028,12 +2030,22 @@ static const TCGTargetOpDef arm_op_defs[] = {
 
 static void tcg_target_init(TCGContext *s)
 {
-#if defined(CONFIG_GETAUXVAL) && !defined(use_idiv_instructions)
+#if defined(CONFIG_GETAUXVAL)
+    /* Only probe for the platform and capabilities if we havn't already
+       determined maximum values at compile time.  */
+# if !defined(use_idiv_instructions)
     {
         unsigned long hwcap = getauxval(AT_HWCAP);
         use_idiv_instructions = (hwcap & HWCAP_ARM_IDIVA) != 0;
     }
-#endif
+# endif
+    if (__ARM_ARCH < 7) {
+        const char *pl = (const char *)getauxval(AT_PLATFORM);
+        if (pl != NULL && pl[0] == 'v' && pl[1] >= '4' && pl[1] <= '9') {
+            arm_arch = pl[1] - '0';
+        }
+    }
+#endif /* GETAUXVAL */
 
     tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffff);
     tcg_regset_set32(tcg_target_call_clobber_regs, 0,
commit cb91021a4786efdd6e4ca1ebfd8729481466bbb8
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Jun 6 10:21:37 2013 -0700

    tcg-arm: Simplify logic in detecting the ARM ISA in use
    
    GCC 4.8 defines a handy __ARM_ARCH symbol that we can use, which
    will make us nicely forward compatible with ARMv8 AArch32.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
index cfb9afb..fde1715 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.c
@@ -22,50 +22,34 @@
  * THE SOFTWARE.
  */
 
-#if defined(__ARM_ARCH_7__) ||  \
-    defined(__ARM_ARCH_7A__) || \
-    defined(__ARM_ARCH_7EM__) || \
-    defined(__ARM_ARCH_7M__) || \
-    defined(__ARM_ARCH_7R__)
-#define USE_ARMV7_INSTRUCTIONS
+/* The __ARM_ARCH define is provided by gcc 4.8.  Construct it otherwise.  */
+#ifndef __ARM_ARCH
+# if defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__) \
+     || defined(__ARM_ARCH_7R__) || defined(__ARM_ARCH_7M__) \
+     || defined(__ARM_ARCH_7EM__)
+#  define __ARM_ARCH 7
+# elif defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) \
+       || defined(__ARM_ARCH_6Z__) || defined(__ARM_ARCH_6ZK__) \
+       || defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6T2__)
+#  define __ARM_ARCH 6
+# elif defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5E__) \
+       || defined(__ARM_ARCH_5T__) || defined(__ARM_ARCH_5TE__) \
+       || defined(__ARM_ARCH_5TEJ__)
+#  define __ARM_ARCH 5
+# else
+#  define __ARM_ARCH 4
+# endif
 #endif
 
-#if defined(USE_ARMV7_INSTRUCTIONS) || \
-    defined(__ARM_ARCH_6J__) || \
-    defined(__ARM_ARCH_6K__) || \
-    defined(__ARM_ARCH_6T2__) || \
-    defined(__ARM_ARCH_6Z__) || \
-    defined(__ARM_ARCH_6ZK__)
-#define USE_ARMV6_INSTRUCTIONS
-#endif
-
-#if defined(USE_ARMV6_INSTRUCTIONS) || \
-    defined(__ARM_ARCH_5T__) || \
-    defined(__ARM_ARCH_5TE__) || \
-    defined(__ARM_ARCH_5TEJ__)
-#define USE_ARMV5T_INSTRUCTIONS
-#endif
-
-#ifdef USE_ARMV5T_INSTRUCTIONS
-static const int use_armv5t_instructions = 1;
+#if defined(__ARM_ARCH_5T__) \
+    || defined(__ARM_ARCH_5TE__) || defined(__ARM_ARCH_5TEJ__)
+# define use_armv5t_instructions 1
 #else
-static const int use_armv5t_instructions = 0;
+# define use_armv5t_instructions use_armv6_instructions
 #endif
-#undef USE_ARMV5_INSTRUCTIONS
 
-#ifdef USE_ARMV6_INSTRUCTIONS
-static const int use_armv6_instructions = 1;
-#else
-static const int use_armv6_instructions = 0;
-#endif
-#undef USE_ARMV6_INSTRUCTIONS
-
-#ifdef USE_ARMV7_INSTRUCTIONS
-static const int use_armv7_instructions = 1;
-#else
-static const int use_armv7_instructions = 0;
-#endif
-#undef USE_ARMV7_INSTRUCTIONS
+#define use_armv6_instructions  (__ARM_ARCH >= 6)
+#define use_armv7_instructions  (__ARM_ARCH >= 7)
 
 #ifndef use_idiv_instructions
 bool use_idiv_instructions;
commit fb82273851a855e72248fcabe93bc43ab3a8efe4
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Jul 4 11:20:26 2013 -0700

    tcg-arm: Rename use_armv5_instructions to use_armvt5_instructions
    
    As it really controls the availability of a thumb interworking
    instruction on armv5t.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
index 648137f..cfb9afb 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.c
@@ -43,13 +43,13 @@
     defined(__ARM_ARCH_5T__) || \
     defined(__ARM_ARCH_5TE__) || \
     defined(__ARM_ARCH_5TEJ__)
-#define USE_ARMV5_INSTRUCTIONS
+#define USE_ARMV5T_INSTRUCTIONS
 #endif
 
-#ifdef USE_ARMV5_INSTRUCTIONS
-static const int use_armv5_instructions = 1;
+#ifdef USE_ARMV5T_INSTRUCTIONS
+static const int use_armv5t_instructions = 1;
 #else
-static const int use_armv5_instructions = 0;
+static const int use_armv5t_instructions = 0;
 #endif
 #undef USE_ARMV5_INSTRUCTIONS
 
@@ -1030,7 +1030,7 @@ static inline void tcg_out_call(TCGContext *s, uint32_t addr)
     if (val - 8 < 0x02000000 && val - 8 >= -0x02000000) {
         if (addr & 1) {
             /* Use BLX if the target is in Thumb mode */
-            if (!use_armv5_instructions) {
+            if (!use_armv5t_instructions) {
                 tcg_abort();
             }
             tcg_out_blx_imm(s, val);
@@ -1049,7 +1049,7 @@ static inline void tcg_out_call(TCGContext *s, uint32_t addr)
 
 static inline void tcg_out_callr(TCGContext *s, int cond, int arg)
 {
-    if (use_armv5_instructions) {
+    if (use_armv5t_instructions) {
         tcg_out_blx(s, cond, arg);
     } else {
         tcg_out_dat_reg(s, cond, ARITH_MOV, TCG_REG_R14, 0,
commit 72e1ccfc0cf32005e23d308edfe2d06c7472154e
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu May 2 12:18:38 2013 +0100

    tcg-arm: Make use of conditional availability of opcodes for divide
    
    We can now detect and use divide instructions at runtime, rather than
    having to restrict their availability to compile-time.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
index 8321f80..648137f 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.c
@@ -67,6 +67,13 @@ static const int use_armv7_instructions = 0;
 #endif
 #undef USE_ARMV7_INSTRUCTIONS
 
+#ifndef use_idiv_instructions
+bool use_idiv_instructions;
+#endif
+#ifdef CONFIG_GETAUXVAL
+# include <sys/auxv.h>
+#endif
+
 #ifndef NDEBUG
 static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "%r0",
@@ -2029,16 +2036,21 @@ static const TCGTargetOpDef arm_op_defs[] = {
 
     { INDEX_op_deposit_i32, { "r", "0", "rZ" } },
 
-#if TCG_TARGET_HAS_div_i32
     { INDEX_op_div_i32, { "r", "r", "r" } },
     { INDEX_op_divu_i32, { "r", "r", "r" } },
-#endif
 
     { -1 },
 };
 
 static void tcg_target_init(TCGContext *s)
 {
+#if defined(CONFIG_GETAUXVAL) && !defined(use_idiv_instructions)
+    {
+        unsigned long hwcap = getauxval(AT_HWCAP);
+        use_idiv_instructions = (hwcap & HWCAP_ARM_IDIVA) != 0;
+    }
+#endif
+
     tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffff);
     tcg_regset_set32(tcg_target_call_clobber_regs, 0,
                      (1 << TCG_REG_R0) |
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index 263ea03..5cd9d6a 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -49,6 +49,13 @@ typedef enum {
 
 #define TCG_TARGET_NB_REGS 16
 
+#ifdef __ARM_ARCH_EXT_IDIV__
+#define use_idiv_instructions  1
+#else
+extern bool use_idiv_instructions;
+#endif
+
+
 /* used for function call generation */
 #define TCG_REG_CALL_STACK		TCG_REG_R13
 #define TCG_TARGET_STACK_ALIGN		8
@@ -73,12 +80,7 @@ typedef enum {
 #define TCG_TARGET_HAS_deposit_i32      1
 #define TCG_TARGET_HAS_movcond_i32      1
 #define TCG_TARGET_HAS_muls2_i32        1
-
-#ifdef __ARM_ARCH_EXT_IDIV__
-#define TCG_TARGET_HAS_div_i32          1
-#else
-#define TCG_TARGET_HAS_div_i32          0
-#endif
+#define TCG_TARGET_HAS_div_i32          use_idiv_instructions
 #define TCG_TARGET_HAS_rem_i32          0
 
 extern bool tcg_target_deposit_valid(int ofs, int len);
commit c1a61f6c85f63d379b4a03d399986174371f5c2e
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu May 2 11:57:40 2013 +0100

    tcg: Simplify logic using TCG_OPF_NOT_PRESENT
    
    Expand the definition of "not present" to include "should not be present".
    This means we can simplify the logic surrounding the generic tcg opcodes
    for which the host backend ought not be providing definitions.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
index c94e255..a8af5b9 100644
--- a/tcg/tcg-opc.h
+++ b/tcg/tcg-opc.h
@@ -27,17 +27,21 @@
  */
 
 /* predefined ops */
-DEF(end, 0, 0, 0, 0) /* must be kept first */
-DEF(nop, 0, 0, 0, 0)
-DEF(nop1, 0, 0, 1, 0)
-DEF(nop2, 0, 0, 2, 0)
-DEF(nop3, 0, 0, 3, 0)
-DEF(nopn, 0, 0, 1, 0) /* variable number of parameters */
+DEF(end, 0, 0, 0, TCG_OPF_NOT_PRESENT) /* must be kept first */
+DEF(nop, 0, 0, 0, TCG_OPF_NOT_PRESENT)
+DEF(nop1, 0, 0, 1, TCG_OPF_NOT_PRESENT)
+DEF(nop2, 0, 0, 2, TCG_OPF_NOT_PRESENT)
+DEF(nop3, 0, 0, 3, TCG_OPF_NOT_PRESENT)
 
-DEF(discard, 1, 0, 0, 0)
+/* variable number of parameters */
+DEF(nopn, 0, 0, 1, TCG_OPF_NOT_PRESENT)
+
+DEF(discard, 1, 0, 0, TCG_OPF_NOT_PRESENT)
+DEF(set_label, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_NOT_PRESENT)
+
+/* variable number of parameters */
+DEF(call, 0, 1, 2, TCG_OPF_CALL_CLOBBER)
 
-DEF(set_label, 0, 0, 1, TCG_OPF_BB_END)
-DEF(call, 0, 1, 2, TCG_OPF_CALL_CLOBBER) /* variable number of parameters */
 DEF(br, 0, 0, 1, TCG_OPF_BB_END)
 
 #define IMPL(X) (__builtin_constant_p(X) && !(X) ? TCG_OPF_NOT_PRESENT : 0)
@@ -166,9 +170,9 @@ DEF(muls2_i64, 2, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_muls2_i64))
 
 /* QEMU specific */
 #if TARGET_LONG_BITS > TCG_TARGET_REG_BITS
-DEF(debug_insn_start, 0, 0, 2, 0)
+DEF(debug_insn_start, 0, 0, 2, TCG_OPF_NOT_PRESENT)
 #else
-DEF(debug_insn_start, 0, 0, 1, 0)
+DEF(debug_insn_start, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 #endif
 DEF(exit_tb, 0, 0, 1, TCG_OPF_BB_END)
 DEF(goto_tb, 0, 0, 1, TCG_OPF_BB_END)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 1d8099c..c7e6567 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1160,9 +1160,7 @@ void tcg_add_target_add_op_defs(const TCGTargetOpDef *tdefs)
     i = 0;
     for (op = 0; op < ARRAY_SIZE(tcg_op_defs); op++) {
         const TCGOpDef *def = &tcg_op_defs[op];
-        if (op < INDEX_op_call
-            || op == INDEX_op_debug_insn_start
-            || (def->flags & TCG_OPF_NOT_PRESENT)) {
+        if (def->flags & TCG_OPF_NOT_PRESENT) {
             /* Wrong entry in op definitions? */
             if (def->used) {
                 fprintf(stderr, "Invalid op definition for %s\n", def->name);
diff --git a/tcg/tcg.h b/tcg/tcg.h
index 28ca1bd..f3f9889 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -596,7 +596,8 @@ enum {
     TCG_OPF_SIDE_EFFECTS = 0x04,
     /* Instruction operands are 64-bits (otherwise 32-bits).  */
     TCG_OPF_64BIT        = 0x08,
-    /* Instruction is optional and not implemented by the host.  */
+    /* Instruction is optional and not implemented by the host, or insn
+       is generic and should not be implemened by the host.  */
     TCG_OPF_NOT_PRESENT  = 0x10,
 };
 
commit 4ef76952bd702d29ee4c021f068d85b063fdb928
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu May 2 11:35:08 2013 +0100

    tcg: Allow non-constant control macros
    
    This allows TCG_TARGET_HAS_* to be a variable rather than a constant,
    which allows easier support for differing ISA levels for the host.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
index 12967fb..c94e255 100644
--- a/tcg/tcg-opc.h
+++ b/tcg/tcg-opc.h
@@ -40,7 +40,7 @@ DEF(set_label, 0, 0, 1, TCG_OPF_BB_END)
 DEF(call, 0, 1, 2, TCG_OPF_CALL_CLOBBER) /* variable number of parameters */
 DEF(br, 0, 0, 1, TCG_OPF_BB_END)
 
-#define IMPL(X) (X ? 0 : TCG_OPF_NOT_PRESENT)
+#define IMPL(X) (__builtin_constant_p(X) && !(X) ? TCG_OPF_NOT_PRESENT : 0)
 #if TCG_TARGET_REG_BITS == 32
 # define IMPL64  TCG_OPF_64BIT | TCG_OPF_NOT_PRESENT
 #else
commit 5b9f72ab59ec9d57546cfc499ccc863327cb8a46
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Mar 11 23:24:55 2013 -0700

    tcg-ppc64: Don't implement rem
    
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ppc64/tcg-target.c b/tcg/ppc64/tcg-target.c
index 606b73d..0678de2 100644
--- a/tcg/ppc64/tcg-target.c
+++ b/tcg/ppc64/tcg-target.c
@@ -1617,18 +1617,6 @@ static void tcg_out_op (TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out32 (s, DIVWU | TAB (args[0], args[1], args[2]));
         break;
 
-    case INDEX_op_rem_i32:
-        tcg_out32 (s, DIVW | TAB (0, args[1], args[2]));
-        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
-        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
-        break;
-
-    case INDEX_op_remu_i32:
-        tcg_out32 (s, DIVWU | TAB (0, args[1], args[2]));
-        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
-        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
-        break;
-
     case INDEX_op_shl_i32:
         if (const_args[2]) {
             tcg_out_rlw(s, RLWINM, args[0], args[1], args[2], 0, 31 - args[2]);
@@ -1786,16 +1774,6 @@ static void tcg_out_op (TCGContext *s, TCGOpcode opc, const TCGArg *args,
     case INDEX_op_divu_i64:
         tcg_out32 (s, DIVDU | TAB (args[0], args[1], args[2]));
         break;
-    case INDEX_op_rem_i64:
-        tcg_out32 (s, DIVD | TAB (0, args[1], args[2]));
-        tcg_out32 (s, MULLD | TAB (0, 0, args[2]));
-        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
-        break;
-    case INDEX_op_remu_i64:
-        tcg_out32 (s, DIVDU | TAB (0, args[1], args[2]));
-        tcg_out32 (s, MULLD | TAB (0, 0, args[2]));
-        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
-        break;
 
     case INDEX_op_qemu_ld8u:
         tcg_out_qemu_ld (s, args, 0);
@@ -2064,8 +2042,6 @@ static const TCGTargetOpDef ppc_op_defs[] = {
     { INDEX_op_mul_i32, { "r", "r", "rI" } },
     { INDEX_op_div_i32, { "r", "r", "r" } },
     { INDEX_op_divu_i32, { "r", "r", "r" } },
-    { INDEX_op_rem_i32, { "r", "r", "r" } },
-    { INDEX_op_remu_i32, { "r", "r", "r" } },
     { INDEX_op_sub_i32, { "r", "rI", "ri" } },
     { INDEX_op_and_i32, { "r", "r", "ri" } },
     { INDEX_op_or_i32, { "r", "r", "ri" } },
@@ -2108,8 +2084,6 @@ static const TCGTargetOpDef ppc_op_defs[] = {
     { INDEX_op_mul_i64, { "r", "r", "rI" } },
     { INDEX_op_div_i64, { "r", "r", "r" } },
     { INDEX_op_divu_i64, { "r", "r", "r" } },
-    { INDEX_op_rem_i64, { "r", "r", "r" } },
-    { INDEX_op_remu_i64, { "r", "r", "r" } },
 
     { INDEX_op_neg_i64, { "r", "r" } },
     { INDEX_op_not_i64, { "r", "r" } },
diff --git a/tcg/ppc64/tcg-target.h b/tcg/ppc64/tcg-target.h
index 7c600f1..48fc6e2 100644
--- a/tcg/ppc64/tcg-target.h
+++ b/tcg/ppc64/tcg-target.h
@@ -76,7 +76,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
-#define TCG_TARGET_HAS_rem_i32          1
+#define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_ext8s_i32        1
 #define TCG_TARGET_HAS_ext16s_i32       1
@@ -97,7 +97,7 @@ typedef enum {
 #define TCG_TARGET_HAS_muls2_i32        0
 
 #define TCG_TARGET_HAS_div_i64          1
-#define TCG_TARGET_HAS_rem_i64          1
+#define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
commit 865a4671f97e3b52c3ba4167d4f2630e79927712
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Mar 11 23:24:15 2013 -0700

    tcg-ppc: Don't implement rem
    
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ppc/tcg-target.c b/tcg/ppc/tcg-target.c
index 29ca934..453ab6b 100644
--- a/tcg/ppc/tcg-target.c
+++ b/tcg/ppc/tcg-target.c
@@ -1671,18 +1671,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
         tcg_out32 (s, DIVWU | TAB (args[0], args[1], args[2]));
         break;
 
-    case INDEX_op_rem_i32:
-        tcg_out32 (s, DIVW | TAB (0, args[1], args[2]));
-        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
-        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
-        break;
-
-    case INDEX_op_remu_i32:
-        tcg_out32 (s, DIVWU | TAB (0, args[1], args[2]));
-        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
-        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
-        break;
-
     case INDEX_op_mulu2_i32:
         if (args[0] == args[2] || args[0] == args[3]) {
             tcg_out32 (s, MULLW | TAB (0, args[2], args[3]));
@@ -1992,8 +1980,6 @@ static const TCGTargetOpDef ppc_op_defs[] = {
     { INDEX_op_mul_i32, { "r", "r", "ri" } },
     { INDEX_op_div_i32, { "r", "r", "r" } },
     { INDEX_op_divu_i32, { "r", "r", "r" } },
-    { INDEX_op_rem_i32, { "r", "r", "r" } },
-    { INDEX_op_remu_i32, { "r", "r", "r" } },
     { INDEX_op_mulu2_i32, { "r", "r", "r", "r" } },
     { INDEX_op_sub_i32, { "r", "r", "ri" } },
     { INDEX_op_and_i32, { "r", "r", "ri" } },
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index 01b880e..b42d97c 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -78,7 +78,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
-#define TCG_TARGET_HAS_rem_i32          1
+#define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_ext8s_i32        1
 #define TCG_TARGET_HAS_ext16s_i32       1
commit 5e1108b3709d7bc04cae141f36d35cc11430a79b
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Mar 11 23:13:30 2013 -0700

    tcg-arm: Don't implement rem
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
index 6be736b..8321f80 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.c
@@ -1926,18 +1926,6 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_divu_i32:
         tcg_out_udiv(s, COND_AL, args[0], args[1], args[2]);
         break;
-    case INDEX_op_rem_i32:
-        tcg_out_sdiv(s, COND_AL, TCG_REG_TMP, args[1], args[2]);
-        tcg_out_mul32(s, COND_AL, TCG_REG_TMP, TCG_REG_TMP, args[2]);
-        tcg_out_dat_reg(s, COND_AL, ARITH_SUB, args[0], args[1], TCG_REG_TMP,
-                        SHIFT_IMM_LSL(0));
-        break;
-    case INDEX_op_remu_i32:
-        tcg_out_udiv(s, COND_AL, TCG_REG_TMP, args[1], args[2]);
-        tcg_out_mul32(s, COND_AL, TCG_REG_TMP, TCG_REG_TMP, args[2]);
-        tcg_out_dat_reg(s, COND_AL, ARITH_SUB, args[0], args[1], TCG_REG_TMP,
-                        SHIFT_IMM_LSL(0));
-        break;
 
     default:
         tcg_abort();
@@ -2043,9 +2031,7 @@ static const TCGTargetOpDef arm_op_defs[] = {
 
 #if TCG_TARGET_HAS_div_i32
     { INDEX_op_div_i32, { "r", "r", "r" } },
-    { INDEX_op_rem_i32, { "r", "r", "r" } },
     { INDEX_op_divu_i32, { "r", "r", "r" } },
-    { INDEX_op_remu_i32, { "r", "r", "r" } },
 #endif
 
     { -1 },
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index 2c5b4e7..263ea03 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -76,11 +76,10 @@ typedef enum {
 
 #ifdef __ARM_ARCH_EXT_IDIV__
 #define TCG_TARGET_HAS_div_i32          1
-#define TCG_TARGET_HAS_rem_i32          1
 #else
 #define TCG_TARGET_HAS_div_i32          0
-#define TCG_TARGET_HAS_rem_i32          0
 #endif
+#define TCG_TARGET_HAS_rem_i32          0
 
 extern bool tcg_target_deposit_valid(int ofs, int len);
 #define TCG_TARGET_deposit_i32_valid  tcg_target_deposit_valid
commit ca675f46e695bd49a1c21a5e82c6b8c77ee12edf
Author: Richard Henderson <rth at twiddle.net>
Date:   Mon Mar 11 22:41:47 2013 -0700

    tcg: Split rem requirement from div requirement
    
    There are several hosts with only a "div" insn.  Remainder is computed
    manually from the quotient and inputs.  We can do this generically.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index 97e4a5b..51e5092 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -40,6 +40,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          0
+#define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_ext8s_i32        1
 #define TCG_TARGET_HAS_ext16s_i32       1
 #define TCG_TARGET_HAS_ext8u_i32        1
@@ -62,6 +63,7 @@ typedef enum {
 #define TCG_TARGET_HAS_muls2_i32        0
 
 #define TCG_TARGET_HAS_div_i64          0
+#define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
 #define TCG_TARGET_HAS_ext32s_i64       1
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index 3be41cc..2c5b4e7 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -76,8 +76,10 @@ typedef enum {
 
 #ifdef __ARM_ARCH_EXT_IDIV__
 #define TCG_TARGET_HAS_div_i32          1
+#define TCG_TARGET_HAS_rem_i32          1
 #else
 #define TCG_TARGET_HAS_div_i32          0
+#define TCG_TARGET_HAS_rem_i32          0
 #endif
 
 extern bool tcg_target_deposit_valid(int ofs, int len);
diff --git a/tcg/hppa/tcg-target.h b/tcg/hppa/tcg-target.h
index ebd53d9..25467bd 100644
--- a/tcg/hppa/tcg-target.h
+++ b/tcg/hppa/tcg-target.h
@@ -85,6 +85,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          0
+#define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_ext8s_i32        1
 #define TCG_TARGET_HAS_ext16s_i32       1
diff --git a/tcg/ia64/tcg-target.h b/tcg/ia64/tcg-target.h
index e3d72ea..f32d519 100644
--- a/tcg/ia64/tcg-target.h
+++ b/tcg/ia64/tcg-target.h
@@ -104,7 +104,9 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          0
+#define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_div_i64          0
+#define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_andc_i64         1
 #define TCG_TARGET_HAS_bswap16_i32      1
diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index 6155327..a438950 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -79,6 +79,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
+#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_ext8s_i32        1
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index 17a6bb3..01b880e 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -78,6 +78,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
+#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_ext8s_i32        1
 #define TCG_TARGET_HAS_ext16s_i32       1
diff --git a/tcg/ppc64/tcg-target.h b/tcg/ppc64/tcg-target.h
index cb77634..7c600f1 100644
--- a/tcg/ppc64/tcg-target.h
+++ b/tcg/ppc64/tcg-target.h
@@ -76,6 +76,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
+#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_ext8s_i32        1
 #define TCG_TARGET_HAS_ext16s_i32       1
@@ -96,6 +97,7 @@ typedef enum {
 #define TCG_TARGET_HAS_muls2_i32        0
 
 #define TCG_TARGET_HAS_div_i64          1
+#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
index b5217be..dab52d7 100644
--- a/tcg/sparc/tcg-target.h
+++ b/tcg/sparc/tcg-target.h
@@ -86,6 +86,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32		1
+#define TCG_TARGET_HAS_rem_i32		1
 #define TCG_TARGET_HAS_rot_i32          0
 #define TCG_TARGET_HAS_ext8s_i32        0
 #define TCG_TARGET_HAS_ext16s_i32       0
@@ -109,6 +110,7 @@ typedef enum {
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_div_i64          1
+#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_ext8s_i64        0
 #define TCG_TARGET_HAS_ext16s_i64       0
diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index 94f6043..364964d 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -731,8 +731,14 @@ static inline void tcg_gen_div_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 static inline void tcg_gen_rem_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_div_i32) {
+    if (TCG_TARGET_HAS_rem_i32) {
         tcg_gen_op3_i32(INDEX_op_rem_i32, ret, arg1, arg2);
+    } else if (TCG_TARGET_HAS_div_i32) {
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        tcg_gen_op3_i32(INDEX_op_div_i32, t0, arg1, arg2);
+        tcg_gen_mul_i32(t0, t0, arg2);
+        tcg_gen_sub_i32(ret, arg1, t0);
+        tcg_temp_free_i32(t0);
     } else if (TCG_TARGET_HAS_div2_i32) {
         TCGv_i32 t0 = tcg_temp_new_i32();
         tcg_gen_sari_i32(t0, arg1, 31);
@@ -769,8 +775,14 @@ static inline void tcg_gen_divu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 static inline void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_div_i32) {
+    if (TCG_TARGET_HAS_rem_i32) {
         tcg_gen_op3_i32(INDEX_op_remu_i32, ret, arg1, arg2);
+    } else if (TCG_TARGET_HAS_div_i32) {
+        TCGv_i32 t0 = tcg_temp_new_i32();
+        tcg_gen_op3_i32(INDEX_op_divu_i32, t0, arg1, arg2);
+        tcg_gen_mul_i32(t0, t0, arg2);
+        tcg_gen_sub_i32(ret, arg1, t0);
+        tcg_temp_free_i32(t0);
     } else if (TCG_TARGET_HAS_div2_i32) {
         TCGv_i32 t0 = tcg_temp_new_i32();
         tcg_gen_movi_i32(t0, 0);
@@ -1361,8 +1373,14 @@ static inline void tcg_gen_div_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 static inline void tcg_gen_rem_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_div_i64) {
+    if (TCG_TARGET_HAS_rem_i64) {
         tcg_gen_op3_i64(INDEX_op_rem_i64, ret, arg1, arg2);
+    } else if (TCG_TARGET_HAS_div_i64) {
+        TCGv_i64 t0 = tcg_temp_new_i64();
+        tcg_gen_op3_i64(INDEX_op_div_i64, t0, arg1, arg2);
+        tcg_gen_mul_i64(t0, t0, arg2);
+        tcg_gen_sub_i64(ret, arg1, t0);
+        tcg_temp_free_i64(t0);
     } else if (TCG_TARGET_HAS_div2_i64) {
         TCGv_i64 t0 = tcg_temp_new_i64();
         tcg_gen_sari_i64(t0, arg1, 63);
@@ -1399,8 +1417,14 @@ static inline void tcg_gen_divu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 static inline void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_div_i64) {
+    if (TCG_TARGET_HAS_rem_i64) {
         tcg_gen_op3_i64(INDEX_op_remu_i64, ret, arg1, arg2);
+    } else if (TCG_TARGET_HAS_div_i64) {
+        TCGv_i64 t0 = tcg_temp_new_i64();
+        tcg_gen_op3_i64(INDEX_op_divu_i64, t0, arg1, arg2);
+        tcg_gen_mul_i64(t0, t0, arg2);
+        tcg_gen_sub_i64(ret, arg1, t0);
+        tcg_temp_free_i64(t0);
     } else if (TCG_TARGET_HAS_div2_i64) {
         TCGv_i64 t0 = tcg_temp_new_i64();
         tcg_gen_movi_i64(t0, 0);
diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
index 4246e9c..12967fb 100644
--- a/tcg/tcg-opc.h
+++ b/tcg/tcg-opc.h
@@ -66,8 +66,8 @@ DEF(sub_i32, 1, 2, 0, 0)
 DEF(mul_i32, 1, 2, 0, 0)
 DEF(div_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_div_i32))
 DEF(divu_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_div_i32))
-DEF(rem_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_div_i32))
-DEF(remu_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_div_i32))
+DEF(rem_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_rem_i32))
+DEF(remu_i32, 1, 2, 0, IMPL(TCG_TARGET_HAS_rem_i32))
 DEF(div2_i32, 2, 3, 0, IMPL(TCG_TARGET_HAS_div2_i32))
 DEF(divu2_i32, 2, 3, 0, IMPL(TCG_TARGET_HAS_div2_i32))
 DEF(and_i32, 1, 2, 0, 0)
@@ -126,8 +126,8 @@ DEF(sub_i64, 1, 2, 0, IMPL64)
 DEF(mul_i64, 1, 2, 0, IMPL64)
 DEF(div_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_div_i64))
 DEF(divu_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_div_i64))
-DEF(rem_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_div_i64))
-DEF(remu_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_div_i64))
+DEF(rem_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_rem_i64))
+DEF(remu_i64, 1, 2, 0, IMPL64 | IMPL(TCG_TARGET_HAS_rem_i64))
 DEF(div2_i64, 2, 3, 0, IMPL64 | IMPL(TCG_TARGET_HAS_div2_i64))
 DEF(divu2_i64, 2, 3, 0, IMPL64 | IMPL(TCG_TARGET_HAS_div2_i64))
 DEF(and_i64, 1, 2, 0, IMPL64)
diff --git a/tcg/tcg.h b/tcg/tcg.h
index df375cf..28ca1bd 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -60,6 +60,7 @@ typedef uint64_t TCGRegSet;
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_div_i64          0
+#define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_div2_i64         0
 #define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_ext8s_i64        0
@@ -102,11 +103,13 @@ typedef uint64_t TCGRegSet;
 #define TCG_TARGET_HAS_div2_i32         0
 #elif defined(TCG_TARGET_HAS_div2_i32)
 #define TCG_TARGET_HAS_div_i32          0
+#define TCG_TARGET_HAS_rem_i32          0
 #endif
 #if defined(TCG_TARGET_HAS_div_i64)
 #define TCG_TARGET_HAS_div2_i64         0
 #elif defined(TCG_TARGET_HAS_div2_i64)
 #define TCG_TARGET_HAS_div_i64          0
+#define TCG_TARGET_HAS_rem_i64          0
 #endif
 
 typedef enum TCGOpcode {
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index 0395bbb..d7fc14e 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -59,9 +59,8 @@
 
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-/* Not more than one of the next two defines must be 1. */
 #define TCG_TARGET_HAS_div_i32          1
-#define TCG_TARGET_HAS_div2_i32         0
+#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_ext8s_i32        1
 #define TCG_TARGET_HAS_ext16s_i32       1
 #define TCG_TARGET_HAS_ext8u_i32        1
@@ -83,9 +82,8 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_deposit_i64      1
-/* Not more than one of the next two defines must be 1. */
 #define TCG_TARGET_HAS_div_i64          0
-#define TCG_TARGET_HAS_div2_i64         0
+#define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
 #define TCG_TARGET_HAS_ext32s_i64       1
commit cc7772bdbe4cb0ff1bac538bda86260b871d8b1a
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Jul 3 11:09:03 2013 -0700

    tcg: Add myself to general TCG maintainership
    
    Acked-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/MAINTAINERS b/MAINTAINERS
index 780f480..93ad19d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -781,6 +781,7 @@ Tiny Code Generator (TCG)
 -------------------------
 Common code
 M: qemu-devel at nongnu.org
+M: Richard Henderson <rth at twiddle.net>
 S: Maintained
 F: tcg/
 
commit dc11549ec213f85f6a024c7df68d349464cd1688
Merge: 945dad6 7588e2b
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 8 08:00:23 2013 -0500

    Merge remote-tracking branch 'mst/tags/for_anthony' into staging
    
    pci,misc enhancements
    
    This includes some pci enhancements:
    
    Better support for systems with multiple PCI root buses
    FW cfg interface for more robust pci programming in BIOS
    Minor fixes/cleanups for fw cfg and cross-version migration -
        because of dependencies with other patches
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Sun 07 Jul 2013 03:11:18 PM CDT using RSA key ID D28D5469
    # gpg: Can't check signature: public key not found
    
    # By David Gibson (10) and others
    # Via Michael S. Tsirkin
    * mst/tags/for_anthony:
      pci: Fold host_buses list into PCIHostState functionality
      pci: Remove domain from PCIHostBus
      pci: Simpler implementation of primary PCI bus
      pci: Add root bus parameter to pci_nic_init()
      pci: Add root bus argument to pci_get_bus_devfn()
      pci: Replace pci_find_domain() with more general pci_root_bus_path()
      pci: Use helper to find device's root bus in pci_find_domain()
      pci: Abolish pci_find_root_bus()
      pci: Move pci_read_devaddr to pci-hotplug-old.c
      pci: Cleanup configuration for pci-hotplug.c
      pvpanic: fix fwcfg for big endian hosts
      pvpanic: initialization cleanup
      MAINTAINERS: s/Marcelo/Paolo/
      e1000: cleanup process_tx_desc
      pc_piix: cleanup init compat handling
      pc: pass PCI hole ranges to Guests
      pci: store PCI hole ranges in guestinfo structure
      range: add Range structure
    
    Message-id: 1373228271-31223-1-git-send-email-mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --cc hw/pci-host/q35.c
index 5661ace,13148ed..8c3ee53
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@@ -244,8 -253,16 +253,16 @@@ static int mch_init(PCIDevice *d
      hwaddr pci_hole64_size;
      MCHPCIState *mch = MCH_PCI_DEVICE(d);
  
+     /* Leave enough space for the biggest MCFG BAR */
+     /* TODO: this matches current bios behaviour, but
+      * it's not a power of two, which means an MTRR
+      * can't cover it exactly.
+      */
+     mch->guest_info->pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
+         MCH_HOST_BRIDGE_PCIEXBAR_MAX;
+ 
      /* setup pci memory regions */
 -    memory_region_init_alias(&mch->pci_hole, "pci-hole",
 +    memory_region_init_alias(&mch->pci_hole, OBJECT(mch), "pci-hole",
                               mch->pci_address_space,
                               mch->below_4g_mem_size,
                               0x100000000ULL - mch->below_4g_mem_size);
commit 7588e2b0559ae72d3c2952c7807fc05c03099970
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:54 2013 +1000

    pci: Fold host_buses list into PCIHostState functionality
    
    The host_buses list is an odd structure - a list of pointers to PCI root
    buses existing in parallel to the normal qdev tree structure.  This patch
    removes it, instead putting the link pointers into the PCIHostState
    structure, which have a 1:1 relationship to PCIHostBus structures anyway.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index d861b40..8680063 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -90,11 +90,7 @@ static void pci_del_option_rom(PCIDevice *pdev);
 static uint16_t pci_default_sub_vendor_id = PCI_SUBVENDOR_ID_REDHAT_QUMRANET;
 static uint16_t pci_default_sub_device_id = PCI_SUBDEVICE_ID_QEMU;
 
-struct PCIHostBus {
-    struct PCIBus *bus;
-    QLIST_ENTRY(PCIHostBus) next;
-};
-static QLIST_HEAD(, PCIHostBus) host_buses;
+static QLIST_HEAD(, PCIHostState) pci_host_bridges;
 
 static const VMStateDescription vmstate_pcibus = {
     .name = "PCIBUS",
@@ -237,20 +233,19 @@ static int pcibus_reset(BusState *qbus)
     return 1;
 }
 
-static void pci_host_bus_register(PCIBus *bus)
+static void pci_host_bus_register(PCIBus *bus, DeviceState *parent)
 {
-    struct PCIHostBus *host;
-    host = g_malloc0(sizeof(*host));
-    host->bus = bus;
-    QLIST_INSERT_HEAD(&host_buses, host, next);
+    PCIHostState *host_bridge = PCI_HOST_BRIDGE(parent);
+
+    QLIST_INSERT_HEAD(&pci_host_bridges, host_bridge, next);
 }
 
 PCIBus *pci_find_primary_bus(void)
 {
     PCIBus *primary_bus = NULL;
-    struct PCIHostBus *host;
+    PCIHostState *host;
 
-    QLIST_FOREACH(host, &host_buses, next) {
+    QLIST_FOREACH(host, &pci_host_bridges, next) {
         if (primary_bus) {
             /* We have multiple root buses, refuse to select a primary */
             return NULL;
@@ -302,7 +297,7 @@ static void pci_bus_init(PCIBus *bus, DeviceState *parent,
     /* host bridge */
     QLIST_INIT(&bus->child);
 
-    pci_host_bus_register(bus);
+    pci_host_bus_register(bus, parent);
 
     vmstate_register(NULL, -1, &vmstate_pcibus, bus);
 }
@@ -1533,11 +1528,11 @@ static PciInfo *qmp_query_pci_bus(PCIBus *bus, int bus_num)
 PciInfoList *qmp_query_pci(Error **errp)
 {
     PciInfoList *info, *head = NULL, *cur_item = NULL;
-    struct PCIHostBus *host;
+    PCIHostState *host_bridge;
 
-    QLIST_FOREACH(host, &host_buses, next) {
+    QLIST_FOREACH(host_bridge, &pci_host_bridges, next) {
         info = g_malloc0(sizeof(*info));
-        info->value = qmp_query_pci_bus(host->bus, 0);
+        info->value = qmp_query_pci_bus(host_bridge->bus, 0);
 
         /* XXX: waiting for the qapi to support GSList */
         if (!cur_item) {
@@ -2201,11 +2196,11 @@ static int pci_qdev_find_recursive(PCIBus *bus,
 
 int pci_qdev_find_device(const char *id, PCIDevice **pdev)
 {
-    struct PCIHostBus *host;
+    PCIHostState *host_bridge;
     int rc = -ENODEV;
 
-    QLIST_FOREACH(host, &host_buses, next) {
-        int tmp = pci_qdev_find_recursive(host->bus, id, pdev);
+    QLIST_FOREACH(host_bridge, &pci_host_bridges, next) {
+        int tmp = pci_qdev_find_recursive(host_bridge->bus, id, pdev);
         if (!tmp) {
             rc = 0;
             break;
diff --git a/include/hw/pci/pci_host.h b/include/hw/pci/pci_host.h
index 44052f2..ba31595 100644
--- a/include/hw/pci/pci_host.h
+++ b/include/hw/pci/pci_host.h
@@ -46,6 +46,8 @@ struct PCIHostState {
     MemoryRegion mmcfg;
     uint32_t config_reg;
     PCIBus *bus;
+
+    QLIST_ENTRY(PCIHostState) next;
 };
 
 typedef struct PCIHostBridgeClass {
commit 2b8cc89a5c4a8bccbef8c6862bae7371afbf3e76
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:53 2013 +1000

    pci: Remove domain from PCIHostBus
    
    There are now no users of the domain field of PCIHostBus, so remove it
    from the structure, and as a parameter from the pci_host_bus_register()
    function which sets it.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index e0995aa..d861b40 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -91,7 +91,6 @@ static uint16_t pci_default_sub_vendor_id = PCI_SUBVENDOR_ID_REDHAT_QUMRANET;
 static uint16_t pci_default_sub_device_id = PCI_SUBDEVICE_ID_QEMU;
 
 struct PCIHostBus {
-    int domain;
     struct PCIBus *bus;
     QLIST_ENTRY(PCIHostBus) next;
 };
@@ -238,11 +237,10 @@ static int pcibus_reset(BusState *qbus)
     return 1;
 }
 
-static void pci_host_bus_register(int domain, PCIBus *bus)
+static void pci_host_bus_register(PCIBus *bus)
 {
     struct PCIHostBus *host;
     host = g_malloc0(sizeof(*host));
-    host->domain = domain;
     host->bus = bus;
     QLIST_INSERT_HEAD(&host_buses, host, next);
 }
@@ -303,7 +301,8 @@ static void pci_bus_init(PCIBus *bus, DeviceState *parent,
 
     /* host bridge */
     QLIST_INIT(&bus->child);
-    pci_host_bus_register(0, bus); /* for now only pci domain 0 is supported */
+
+    pci_host_bus_register(bus);
 
     vmstate_register(NULL, -1, &vmstate_pcibus, bus);
 }
commit 9bc473057db773dd24be381ccbde4c686595d2e7
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:52 2013 +1000

    pci: Simpler implementation of primary PCI bus
    
    Currently pci_find_primary_bus() searches the list of root buses for one
    with domain 0.  But since host buses are always registered with domain 0,
    this just amounts to finding the only PCI host bus.  The only remaining
    users of pci_find_primary_bus() are in pci-hotplug-old.c, which implements
    the old style pci_add/pci_del commands.
    
    Therefore, this patch redefines pci_find_primary_bus() to find the only
    PCI root bus, returning an error if there are multiple roots.  The callers
    in pci-hotplug-old.c are updated correspondingly, to produce sensible
    error messages.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index 807260c..8077289 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -62,10 +62,17 @@ static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,
 {
     Error *local_err = NULL;
     QemuOpts *opts;
+    PCIBus *root = pci_find_primary_bus();
     PCIBus *bus;
     int ret, devfn;
 
-    bus = pci_get_bus_devfn(&devfn, pci_find_primary_bus(), devaddr);
+    if (!root) {
+        monitor_printf(mon, "no primary PCI bus (if there are multiple"
+                       " PCI roots, you must use device_add instead)");
+        return NULL;
+    }
+
+    bus = pci_get_bus_devfn(&devfn, root, devaddr);
     if (!bus) {
         monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
         return NULL;
@@ -92,8 +99,7 @@ static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,
         monitor_printf(mon, "Parameter addr not supported\n");
         return NULL;
     }
-    return pci_nic_init(&nd_table[ret], pci_find_primary_bus(),
-                        "rtl8139", devaddr);
+    return pci_nic_init(&nd_table[ret], root, "rtl8139", devaddr);
 }
 
 static int scsi_hot_add(Monitor *mon, DeviceState *adapter,
@@ -144,7 +150,8 @@ int pci_drive_hot_add(Monitor *mon, const QDict *qdict, DriveInfo *dinfo)
     switch (dinfo->type) {
     case IF_SCSI:
         if (!root) {
-            monitor_printf(mon, "no primary PCI bus\n");
+            monitor_printf(mon, "no primary PCI bus (if there are multiple"
+                           " PCI roots, you must use device_add instead)");
             goto err;
         }
         if (pci_read_devaddr(mon, pci_addr, &pci_bus, &slot)) {
@@ -177,6 +184,7 @@ static PCIDevice *qemu_pci_hot_add_storage(Monitor *mon,
     DriveInfo *dinfo = NULL;
     int type = -1;
     char buf[128];
+    PCIBus *root = pci_find_primary_bus();
     PCIBus *bus;
     int devfn;
 
@@ -206,7 +214,12 @@ static PCIDevice *qemu_pci_hot_add_storage(Monitor *mon,
         dinfo = NULL;
     }
 
-    bus = pci_get_bus_devfn(&devfn, pci_find_primary_bus(), devaddr);
+    if (!root) {
+        monitor_printf(mon, "no primary PCI bus (if there are multiple"
+                       " PCI roots, you must use device_add instead)");
+        return NULL;
+    }
+    bus = pci_get_bus_devfn(&devfn, root, devaddr);
     if (!bus) {
         monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
         return NULL;
@@ -293,7 +306,8 @@ static int pci_device_hot_remove(Monitor *mon, const char *pci_addr)
     Error *local_err = NULL;
 
     if (!root) {
-        monitor_printf(mon, "no primary PCI bus\n");
+        monitor_printf(mon, "no primary PCI bus (if there are multiple"
+                       " PCI roots, you must use device_del instead)");
         return -1;
     }
 
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 2f2db0f..e0995aa 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -249,15 +249,18 @@ static void pci_host_bus_register(int domain, PCIBus *bus)
 
 PCIBus *pci_find_primary_bus(void)
 {
+    PCIBus *primary_bus = NULL;
     struct PCIHostBus *host;
 
     QLIST_FOREACH(host, &host_buses, next) {
-        if (host->domain == 0) {
-            return host->bus;
+        if (primary_bus) {
+            /* We have multiple root buses, refuse to select a primary */
+            return NULL;
         }
+        primary_bus = host->bus;
     }
 
-    return NULL;
+    return primary_bus;
 }
 
 PCIBus *pci_device_root_bus(const PCIDevice *d)
commit 29b358f93a48a415853d11fc9b02f711b5ec8f76
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:51 2013 +1000

    pci: Add root bus parameter to pci_nic_init()
    
    At present, pci_nic_init() and pci_nic_init_nofail() assume that they will
    only create a NIC under the primary PCI root.  As we add support for
    multiple PCI roots, that may no longer be the case.  This patch adds a root
    bus parameter to pci_nic_init() (and updates callers accordingly) to allow
    the machine init code using it to specify the right PCI root for NICs
    created by old-style -net nic parameters.  NICs created new-style, with
    -device can of course be put anywhere.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/alpha/dp264.c b/hw/alpha/dp264.c
index 8695efb..8dad08f 100644
--- a/hw/alpha/dp264.c
+++ b/hw/alpha/dp264.c
@@ -89,7 +89,7 @@ static void clipper_init(QEMUMachineInitArgs *args)
 
     /* Network setup.  e1000 is good enough, failing Tulip support.  */
     for (i = 0; i < nb_nics; i++) {
-        pci_nic_init_nofail(&nd_table[i], "e1000", NULL);
+        pci_nic_init_nofail(&nd_table[i], pci_bus, "e1000", NULL);
     }
 
     /* IDE disk setup.  */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index d6f47bf..036a188 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -59,7 +59,7 @@ static void realview_init(QEMUMachineInitArgs *args,
     qemu_irq *irqp;
     qemu_irq pic[64];
     qemu_irq mmc_irq[2];
-    PCIBus *pci_bus;
+    PCIBus *pci_bus = NULL;
     NICInfo *nd;
     i2c_bus *i2c;
     int n;
@@ -250,7 +250,9 @@ static void realview_init(QEMUMachineInitArgs *args,
             }
             done_nic = 1;
         } else {
-            pci_nic_init_nofail(nd, "rtl8139", NULL);
+            if (pci_bus) {
+                pci_nic_init_nofail(nd, pci_bus, "rtl8139", NULL);
+            }
         }
     }
 
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 753757e..15eb086 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -244,7 +244,7 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
             smc91c111_init(nd, 0x10010000, sic[25]);
             done_smc = 1;
         } else {
-            pci_nic_init_nofail(nd, "rtl8139", NULL);
+            pci_nic_init_nofail(nd, pci_bus, "rtl8139", NULL);
         }
     }
     if (usb_enabled(false)) {
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 7c4794c..80c27d6 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1310,7 +1310,7 @@ void pc_nic_init(ISABus *isa_bus, PCIBus *pci_bus)
         if (!pci_bus || (nd->model && strcmp(nd->model, "ne2k_isa") == 0)) {
             pc_init_ne2k_isa(isa_bus, nd);
         } else {
-            pci_nic_init_nofail(nd, "e1000", NULL);
+            pci_nic_init_nofail(nd, pci_bus, "e1000", NULL);
         }
     }
 }
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index 00c9071..db67966 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -231,7 +231,7 @@ static void audio_init (PCIBus *pci_bus)
 }
 
 /* Network support */
-static void network_init (void)
+static void network_init (PCIBus *pci_bus)
 {
     int i;
 
@@ -244,7 +244,7 @@ static void network_init (void)
             default_devaddr = "07";
         }
 
-        pci_nic_init_nofail(nd, "rtl8139", default_devaddr);
+        pci_nic_init_nofail(nd, pci_bus, "rtl8139", default_devaddr);
     }
 }
 
@@ -393,7 +393,7 @@ static void mips_fulong2e_init(QEMUMachineInitArgs *args)
     /* Sound card */
     audio_init(pci_bus);
     /* Network card */
-    network_init();
+    network_init(pci_bus);
 }
 
 static QEMUMachine mips_fulong2e_machine = {
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 8a4459d..5843fad 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -468,7 +468,7 @@ static MaltaFPGAState *malta_fpga_init(MemoryRegion *address_space,
 }
 
 /* Network support */
-static void network_init(void)
+static void network_init(PCIBus *pci_bus)
 {
     int i;
 
@@ -480,7 +480,7 @@ static void network_init(void)
             /* The malta board has a PCNet card using PCI SLOT 11 */
             default_devaddr = "0b";
 
-        pci_nic_init_nofail(nd, "pcnet", default_devaddr);
+        pci_nic_init_nofail(nd, pci_bus, "pcnet", default_devaddr);
     }
 }
 
@@ -985,7 +985,7 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     fdctrl_init_isa(isa_bus, fd);
 
     /* Network card */
-    network_init();
+    network_init(pci_bus);
 
     /* Optional PCI video card */
     pci_vga_init(pci_bus);
diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index e92d646..807260c 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -92,7 +92,8 @@ static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,
         monitor_printf(mon, "Parameter addr not supported\n");
         return NULL;
     }
-    return pci_nic_init(&nd_table[ret], "rtl8139", devaddr);
+    return pci_nic_init(&nd_table[ret], pci_find_primary_bus(),
+                        "rtl8139", devaddr);
 }
 
 static int scsi_hot_add(Monitor *mon, DeviceState *adapter,
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c4f63ad..2f2db0f 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1575,7 +1575,8 @@ static const char * const pci_nic_names[] = {
 
 /* Initialize a PCI NIC.  */
 /* FIXME callers should check for failure, but don't */
-PCIDevice *pci_nic_init(NICInfo *nd, const char *default_model,
+PCIDevice *pci_nic_init(NICInfo *nd, PCIBus *rootbus,
+                        const char *default_model,
                         const char *default_devaddr)
 {
     const char *devaddr = nd->devaddr ? nd->devaddr : default_devaddr;
@@ -1589,7 +1590,7 @@ PCIDevice *pci_nic_init(NICInfo *nd, const char *default_model,
     if (i < 0)
         return NULL;
 
-    bus = pci_get_bus_devfn(&devfn, pci_find_primary_bus(), devaddr);
+    bus = pci_get_bus_devfn(&devfn, rootbus, devaddr);
     if (!bus) {
         error_report("Invalid PCI device address %s for device %s",
                      devaddr, pci_nic_names[i]);
@@ -1604,7 +1605,8 @@ PCIDevice *pci_nic_init(NICInfo *nd, const char *default_model,
     return pci_dev;
 }
 
-PCIDevice *pci_nic_init_nofail(NICInfo *nd, const char *default_model,
+PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus,
+                               const char *default_model,
                                const char *default_devaddr)
 {
     PCIDevice *res;
@@ -1612,7 +1614,7 @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, const char *default_model,
     if (qemu_show_nic_models(nd->model, pci_nic_models))
         exit(0);
 
-    res = pci_nic_init(nd, default_model, default_devaddr);
+    res = pci_nic_init(nd, rootbus, default_model, default_devaddr);
     if (!res)
         exit(1);
     return res;
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 38f7990..75b05a2 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -707,7 +707,7 @@ void ppce500_init(PPCE500Params *params)
     if (pci_bus) {
         /* Register network interfaces. */
         for (i = 0; i < nb_nics; i++) {
-            pci_nic_init_nofail(&nd_table[i], "virtio", NULL);
+            pci_nic_init_nofail(&nd_table[i], pci_bus, "virtio", NULL);
         }
     }
 
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 3badfa3..98b902e 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -375,7 +375,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
                              escc_mem, 0, memory_region_size(escc_mem));
 
     for(i = 0; i < nb_nics; i++)
-        pci_nic_init_nofail(&nd_table[i], "ne2k_pci", NULL);
+        pci_nic_init_nofail(&nd_table[i], pci_bus, "ne2k_pci", NULL);
 
     ide_drive_get(hd, MAX_IDE_BUS);
 
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 8faff30..1d73a73 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -259,7 +259,7 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
                              escc_mem, 0, memory_region_size(escc_mem));
 
     for(i = 0; i < nb_nics; i++)
-        pci_nic_init_nofail(&nd_table[i], "ne2k_pci", NULL);
+        pci_nic_init_nofail(&nd_table[i], pci_bus, "ne2k_pci", NULL);
 
 
     ide_drive_get(hd, MAX_IDE_BUS);
diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index b0c1c02..5b039ab 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -243,7 +243,7 @@ static void bamboo_init(QEMUMachineInitArgs *args)
         for (i = 0; i < nb_nics; i++) {
             /* There are no PCI NICs on the Bamboo board, but there are
              * PCI slots, so we can pick whatever default model we want. */
-            pci_nic_init_nofail(&nd_table[i], "e1000", NULL);
+            pci_nic_init_nofail(&nd_table[i], pcibus, "e1000", NULL);
         }
     }
 
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 90828f2..f674ab7 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -628,7 +628,7 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
             isa_ne2000_init(isa_bus, ne2000_io[i], ne2000_irq[i],
                             &nd_table[i]);
         } else {
-            pci_nic_init_nofail(&nd_table[i], "ne2k_pci", NULL);
+            pci_nic_init_nofail(&nd_table[i], pci_bus, "ne2k_pci", NULL);
         }
     }
 
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index fe34291..e2183d3 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -887,7 +887,7 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
         if (strcmp(nd->model, "ibmveth") == 0) {
             spapr_vlan_create(spapr->vio_bus, nd);
         } else {
-            pci_nic_init_nofail(&nd_table[i], nd->model, NULL);
+            pci_nic_init_nofail(&nd_table[i], phb->bus, nd->model, NULL);
         }
     }
 
diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index 3e4818e..dd81d75 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -236,6 +236,7 @@ static void r2d_init(QEMUMachineInitArgs *args)
     DeviceState *dev;
     SysBusDevice *busdev;
     MemoryRegion *address_space_mem = get_system_memory();
+    PCIBus *pci_bus;
 
     if (cpu_model == NULL) {
         cpu_model = "SH7751R";
@@ -264,6 +265,7 @@ static void r2d_init(QEMUMachineInitArgs *args)
     dev = qdev_create(NULL, "sh_pci");
     busdev = SYS_BUS_DEVICE(dev);
     qdev_init_nofail(dev);
+    pci_bus = PCI_BUS(qdev_get_child_bus(dev, "pci"));
     sysbus_mmio_map(busdev, 0, P4ADDR(0x1e200000));
     sysbus_mmio_map(busdev, 1, A7ADDR(0x1e200000));
     sysbus_connect_irq(busdev, 0, irq[PCI_INTA]);
@@ -295,7 +297,8 @@ static void r2d_init(QEMUMachineInitArgs *args)
 
     /* NIC: rtl8139 on-board, and 2 slots. */
     for (i = 0; i < nb_nics; i++)
-        pci_nic_init_nofail(&nd_table[i], "rtl8139", i==0 ? "2" : NULL);
+        pci_nic_init_nofail(&nd_table[i], pci_bus,
+                            "rtl8139", i==0 ? "2" : NULL);
 
     /* USB keyboard */
     usbdevice_create("keyboard");
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index a6a3b76..19dd954 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -854,7 +854,7 @@ static void sun4uv_init(MemoryRegion *address_space_mem,
     }
 
     for(i = 0; i < nb_nics; i++)
-        pci_nic_init_nofail(&nd_table[i], "ne2k_pci", NULL);
+        pci_nic_init_nofail(&nd_table[i], pci_bus, "ne2k_pci", NULL);
 
     ide_drive_get(hd, MAX_IDE_BUS);
 
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 3a43fba..209dda4 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -378,9 +378,11 @@ void pci_device_set_intx_routing_notifier(PCIDevice *dev,
 void pci_device_reset(PCIDevice *dev);
 void pci_bus_reset(PCIBus *bus);
 
-PCIDevice *pci_nic_init(NICInfo *nd, const char *default_model,
+PCIDevice *pci_nic_init(NICInfo *nd, PCIBus *rootbus,
+                        const char *default_model,
                         const char *default_devaddr);
-PCIDevice *pci_nic_init_nofail(NICInfo *nd, const char *default_model,
+PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus,
+                               const char *default_model,
                                const char *default_devaddr);
 
 PCIDevice *pci_vga_init(PCIBus *bus);
commit 85c6e4fabb4c26e5cd8a024415ed2f5bcdd578db
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:50 2013 +1000

    pci: Add root bus argument to pci_get_bus_devfn()
    
    pci_get_bus_devfn() interprets a full PCI address string to give a PCIBus *
    and device/function number within that bus.  Currently it assumes it is
    working on an address under the primary PCI root bus.  This patch extends
    it to allow the caller to specify a root bus.  This might seem a little odd
    since the supplied address can (theoretically) include a PCI domain number.
    However, attempting to use a non-zero domain number there is currently an
    error, so that shouldn't really cause problems.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index e251810..e92d646 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -65,7 +65,7 @@ static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,
     PCIBus *bus;
     int ret, devfn;
 
-    bus = pci_get_bus_devfn(&devfn, devaddr);
+    bus = pci_get_bus_devfn(&devfn, pci_find_primary_bus(), devaddr);
     if (!bus) {
         monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
         return NULL;
@@ -205,7 +205,7 @@ static PCIDevice *qemu_pci_hot_add_storage(Monitor *mon,
         dinfo = NULL;
     }
 
-    bus = pci_get_bus_devfn(&devfn, devaddr);
+    bus = pci_get_bus_devfn(&devfn, pci_find_primary_bus(), devaddr);
     if (!bus) {
         monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
         return NULL;
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 350b872..c4f63ad 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -589,12 +589,13 @@ int pci_parse_devaddr(const char *addr, int *domp, int *busp,
     return 0;
 }
 
-PCIBus *pci_get_bus_devfn(int *devfnp, const char *devaddr)
+PCIBus *pci_get_bus_devfn(int *devfnp, PCIBus *root, const char *devaddr)
 {
-    PCIBus *root = pci_find_primary_bus();
     int dom, bus;
     unsigned slot;
 
+    assert(!root->parent_dev);
+
     if (!root) {
         fprintf(stderr, "No primary PCI bus\n");
         return NULL;
@@ -1588,7 +1589,7 @@ PCIDevice *pci_nic_init(NICInfo *nd, const char *default_model,
     if (i < 0)
         return NULL;
 
-    bus = pci_get_bus_devfn(&devfn, devaddr);
+    bus = pci_get_bus_devfn(&devfn, pci_find_primary_bus(), devaddr);
     if (!bus) {
         error_report("Invalid PCI device address %s for device %s",
                      devaddr, pci_nic_names[i]);
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index e0597b7..3a43fba 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -394,7 +394,7 @@ PCIBus *pci_device_root_bus(const PCIDevice *d);
 const char *pci_root_bus_path(PCIDevice *dev);
 PCIDevice *pci_find_device(PCIBus *bus, int bus_num, uint8_t devfn);
 int pci_qdev_find_device(const char *id, PCIDevice **pdev);
-PCIBus *pci_get_bus_devfn(int *devfnp, const char *devaddr);
+PCIBus *pci_get_bus_devfn(int *devfnp, PCIBus *root, const char *devaddr);
 
 int pci_parse_devaddr(const char *addr, int *domp, int *busp,
                       unsigned int *slotp, unsigned int *funcp);
commit 568f0690fd9aa4d39d84b04c1a5dbb53a915c3fe
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:49 2013 +1000

    pci: Replace pci_find_domain() with more general pci_root_bus_path()
    
    pci_find_domain() is used in a number of places where we want an id for a
    whole PCI domain (i.e. the subtree under a PCI root bus).  The trouble is
    that many platforms may support multiple independent host bridges with no
    hardware supplied notion of domain number.
    
    This patch, therefore, replaces calls to pci_find_domain() with calls to
    a new pci_root_bus_path() returning a string.  The new call is implemented
    in terms of a new callback in the host bridge class, so it can be defined
    in some way that's well defined for the platform.  When no callback is
    available we fall back on the qbus name.
    
    Most current uses of pci_find_domain() are for error or informational
    messages, so the change in identifiers should be harmless.  The exception
    is pci_get_dev_path(), whose results form part of migration streams.  To
    maintain compatibility with old migration streams, the PIIX PCI host is
    altered to always supply "0000" for this path, which matches the old domain
    number (since the code didn't actually support domains other than 0).
    
    For the pseries (spapr) PCI bridge we use a different platform-unique
    identifier (pseries machines can routinely have dozens of PCI host
    bridges).  Theoretically that breaks migration streams, but given that we
    don't yet have migration support for pseries, it doesn't matter.
    
    Any other machines that have working migration support including PCI
    devices will need to be updated to maintain migration stream compatibility.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index f9e68c3..c36e725 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -629,11 +629,20 @@ static const TypeInfo i440fx_info = {
     .class_init    = i440fx_class_init,
 };
 
+static const char *i440fx_pcihost_root_bus_path(PCIHostState *host_bridge,
+                                                PCIBus *rootbus)
+{
+    /* For backwards compat with old device paths */
+    return "0000";
+}
+
 static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
 
+    hc->root_bus_path = i440fx_pcihost_root_bus_path;
     k->init = i440fx_pcihost_initfn;
     dc->fw_name = "pci";
     dc->no_user = 1;
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 3a5cff9..13148ed 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -63,6 +63,13 @@ static int q35_host_init(SysBusDevice *dev)
     return 0;
 }
 
+static const char *q35_host_root_bus_path(PCIHostState *host_bridge,
+                                          PCIBus *rootbus)
+{
+    /* For backwards compat with old device paths */
+    return "0000";
+}
+
 static Property mch_props[] = {
     DEFINE_PROP_UINT64("MCFG", Q35PCIHost, host.base_addr,
                         MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT),
@@ -73,7 +80,9 @@ static void q35_host_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
 
+    hc->root_bus_path = q35_host_root_bus_path;
     k->init = q35_host_init;
     dc->props = mch_props;
     dc->fw_name = "pci";
diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index 37e0720..e251810 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -275,8 +275,8 @@ void pci_device_hot_add(Monitor *mon, const QDict *qdict)
     }
 
     if (dev) {
-        monitor_printf(mon, "OK domain %d, bus %d, slot %d, function %d\n",
-                       pci_find_domain(dev),
+        monitor_printf(mon, "OK root bus %s, bus %d, slot %d, function %d\n",
+                       pci_root_bus_path(dev),
                        pci_bus_num(dev->bus), PCI_SLOT(dev->devfn),
                        PCI_FUNC(dev->devfn));
     } else
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 69a6995..350b872 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -25,6 +25,7 @@
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_bus.h"
+#include "hw/pci/pci_host.h"
 #include "monitor/monitor.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
@@ -270,19 +271,20 @@ PCIBus *pci_device_root_bus(const PCIDevice *d)
     return bus;
 }
 
-int pci_find_domain(const PCIDevice *dev)
+const char *pci_root_bus_path(PCIDevice *dev)
 {
-    const PCIBus *rootbus = pci_device_root_bus(dev);
-    struct PCIHostBus *host;
+    PCIBus *rootbus = pci_device_root_bus(dev);
+    PCIHostState *host_bridge = PCI_HOST_BRIDGE(rootbus->qbus.parent);
+    PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_GET_CLASS(host_bridge);
 
-    QLIST_FOREACH(host, &host_buses, next) {
-        if (host->bus == rootbus) {
-            return host->domain;
-        }
+    assert(!rootbus->parent_dev);
+    assert(host_bridge->bus == rootbus);
+
+    if (hc->root_bus_path) {
+        return (*hc->root_bus_path)(host_bridge, rootbus);
     }
 
-    abort();    /* should not be reached */
-    return -1;
+    return rootbus->qbus.name;
 }
 
 static void pci_bus_init(PCIBus *bus, DeviceState *parent,
@@ -2000,10 +2002,10 @@ int pci_add_capability(PCIDevice *pdev, uint8_t cap_id,
         for (i = offset; i < offset + size; i++) {
             overlapping_cap = pci_find_capability_at_offset(pdev, i);
             if (overlapping_cap) {
-                fprintf(stderr, "ERROR: %04x:%02x:%02x.%x "
+                fprintf(stderr, "ERROR: %s:%02x:%02x.%x "
                         "Attempt to add PCI capability %x at offset "
                         "%x overlaps existing capability %x at offset %x\n",
-                        pci_find_domain(pdev), pci_bus_num(pdev->bus),
+                        pci_root_bus_path(pdev), pci_bus_num(pdev->bus),
                         PCI_SLOT(pdev->devfn), PCI_FUNC(pdev->devfn),
                         cap_id, offset, overlapping_cap, i);
                 return -EINVAL;
@@ -2137,30 +2139,30 @@ static char *pcibus_get_dev_path(DeviceState *dev)
      * domain:Bus:Slot.Func for systems without nested PCI bridges.
      * Slot.Function list specifies the slot and function numbers for all
      * devices on the path from root to the specific device. */
-    char domain[] = "DDDD:00";
+    const char *root_bus_path;
+    int root_bus_len;
     char slot[] = ":SS.F";
-    int domain_len = sizeof domain - 1 /* For '\0' */;
     int slot_len = sizeof slot - 1 /* For '\0' */;
     int path_len;
     char *path, *p;
     int s;
 
+    root_bus_path = pci_root_bus_path(d);
+    root_bus_len = strlen(root_bus_path);
+
     /* Calculate # of slots on path between device and root. */;
     slot_depth = 0;
     for (t = d; t; t = t->bus->parent_dev) {
         ++slot_depth;
     }
 
-    path_len = domain_len + slot_len * slot_depth;
+    path_len = root_bus_len + slot_len * slot_depth;
 
     /* Allocate memory, fill in the terminating null byte. */
     path = g_malloc(path_len + 1 /* For '\0' */);
     path[path_len] = '\0';
 
-    /* First field is the domain. */
-    s = snprintf(domain, sizeof domain, "%04x:00", pci_find_domain(d));
-    assert(s == domain_len);
-    memcpy(path, domain, domain_len);
+    memcpy(path, root_bus_path, root_bus_len);
 
     /* Fill in slot numbers. We walk up from device to root, so need to print
      * them in the reverse order, last to first. */
diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index 12254b1..7dd9b25 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -169,6 +169,7 @@ static const TypeInfo pci_host_type_info = {
     .name = TYPE_PCI_HOST_BRIDGE,
     .parent = TYPE_SYS_BUS_DEVICE,
     .abstract = true,
+    .class_size = sizeof(PCIHostBridgeClass),
     .instance_size = sizeof(PCIHostState),
 };
 
diff --git a/hw/pci/pcie_aer.c b/hw/pci/pcie_aer.c
index 06f77ac..ca762ab 100644
--- a/hw/pci/pcie_aer.c
+++ b/hw/pci/pcie_aer.c
@@ -817,9 +817,9 @@ void pcie_aer_inject_error_print(Monitor *mon, const QObject *data)
     qdict = qobject_to_qdict(data);
 
     devfn = (int)qdict_get_int(qdict, "devfn");
-    monitor_printf(mon, "OK id: %s domain: %x, bus: %x devfn: %x.%x\n",
+    monitor_printf(mon, "OK id: %s root bus: %s, bus: %x devfn: %x.%x\n",
                    qdict_get_str(qdict, "id"),
-                   (int) qdict_get_int(qdict, "domain"),
+                   qdict_get_str(qdict, "root_bus"),
                    (int) qdict_get_int(qdict, "bus"),
                    PCI_SLOT(devfn), PCI_FUNC(devfn));
 }
@@ -1020,9 +1020,9 @@ int do_pcie_aer_inject_error(Monitor *mon,
 
     ret = pcie_aer_inject_error(dev, &err);
     *ret_data = qobject_from_jsonf("{'id': %s, "
-                                   "'domain': %d, 'bus': %d, 'devfn': %d, "
+                                   "'root_bus': %s, 'bus': %d, 'devfn': %d, "
                                    "'ret': %d}",
-                                   id, pci_find_domain(dev),
+                                   id, pci_root_bus_path(dev),
                                    pci_bus_num(dev->bus), dev->devfn,
                                    ret);
     assert(*ret_data);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index c8c12c8..f7be24c 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -696,11 +696,21 @@ static Property spapr_phb_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const char *spapr_phb_root_bus_path(PCIHostState *host_bridge,
+                                           PCIBus *rootbus)
+{
+    sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(host_bridge);
+
+    return sphb->dtbusname;
+}
+
 static void spapr_phb_class_init(ObjectClass *klass, void *data)
 {
+    PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
     SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    hc->root_bus_path = spapr_phb_root_bus_path;
     sdc->init = spapr_phb_init;
     dc->props = spapr_phb_properties;
     dc->reset = spapr_phb_reset;
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index f2bf1ed..e0597b7 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -391,7 +391,7 @@ void pci_for_each_device(PCIBus *bus, int bus_num,
                          void *opaque);
 PCIBus *pci_find_primary_bus(void);
 PCIBus *pci_device_root_bus(const PCIDevice *d);
-int pci_find_domain(const PCIDevice *dev);
+const char *pci_root_bus_path(PCIDevice *dev);
 PCIDevice *pci_find_device(PCIBus *bus, int bus_num, uint8_t devfn);
 int pci_qdev_find_device(const char *id, PCIDevice **pdev);
 PCIBus *pci_get_bus_devfn(int *devfnp, const char *devaddr);
diff --git a/include/hw/pci/pci_host.h b/include/hw/pci/pci_host.h
index 236cd0f..44052f2 100644
--- a/include/hw/pci/pci_host.h
+++ b/include/hw/pci/pci_host.h
@@ -33,6 +33,10 @@
 #define TYPE_PCI_HOST_BRIDGE "pci-host-bridge"
 #define PCI_HOST_BRIDGE(obj) \
     OBJECT_CHECK(PCIHostState, (obj), TYPE_PCI_HOST_BRIDGE)
+#define PCI_HOST_BRIDGE_CLASS(klass) \
+     OBJECT_CLASS_CHECK(PCIHostBridgeClass, (klass), TYPE_PCI_HOST_BRIDGE)
+#define PCI_HOST_BRIDGE_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(PCIHostBridgeClass, (obj), TYPE_PCI_HOST_BRIDGE)
 
 struct PCIHostState {
     SysBusDevice busdev;
@@ -44,6 +48,12 @@ struct PCIHostState {
     PCIBus *bus;
 };
 
+typedef struct PCIHostBridgeClass {
+    SysBusDeviceClass parent_class;
+
+    const char *(*root_bus_path)(PCIHostState *, PCIBus *);
+} PCIHostBridgeClass;
+
 /* common internal helpers for PCI/PCIe hosts, cut off overflows */
 void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr,
                                   uint32_t limit, uint32_t val, uint32_t len);
commit c473d18da1b73301c580115e527207b73dcd597f
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:48 2013 +1000

    pci: Use helper to find device's root bus in pci_find_domain()
    
    Currently pci_find_domain() performs two functions - it locates the PCI
    root bus above the given bus, then looks up that root bus's domain number.
    This patch adds a helper function to perform the first task, finding the
    root bus for a given PCI device.  This is then used in pci_find_domain().
    This changes pci_find_domain()'s signature slightly, taking a PCIDevice
    instead of a PCIBus - since all callers passed something of the form
    dev->bus, this simplifies things slightly.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index 7a47d6b..37e0720 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -276,7 +276,7 @@ void pci_device_hot_add(Monitor *mon, const QDict *qdict)
 
     if (dev) {
         monitor_printf(mon, "OK domain %d, bus %d, slot %d, function %d\n",
-                       pci_find_domain(dev->bus),
+                       pci_find_domain(dev),
                        pci_bus_num(dev->bus), PCI_SLOT(dev->devfn),
                        PCI_FUNC(dev->devfn));
     } else
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index fc99e3b..69a6995 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -259,18 +259,24 @@ PCIBus *pci_find_primary_bus(void)
     return NULL;
 }
 
-int pci_find_domain(const PCIBus *bus)
+PCIBus *pci_device_root_bus(const PCIDevice *d)
 {
-    PCIDevice *d;
-    struct PCIHostBus *host;
+    PCIBus *bus = d->bus;
 
-    /* obtain root bus */
     while ((d = bus->parent_dev) != NULL) {
         bus = d->bus;
     }
 
+    return bus;
+}
+
+int pci_find_domain(const PCIDevice *dev)
+{
+    const PCIBus *rootbus = pci_device_root_bus(dev);
+    struct PCIHostBus *host;
+
     QLIST_FOREACH(host, &host_buses, next) {
-        if (host->bus == bus) {
+        if (host->bus == rootbus) {
             return host->domain;
         }
     }
@@ -1997,7 +2003,7 @@ int pci_add_capability(PCIDevice *pdev, uint8_t cap_id,
                 fprintf(stderr, "ERROR: %04x:%02x:%02x.%x "
                         "Attempt to add PCI capability %x at offset "
                         "%x overlaps existing capability %x at offset %x\n",
-                        pci_find_domain(pdev->bus), pci_bus_num(pdev->bus),
+                        pci_find_domain(pdev), pci_bus_num(pdev->bus),
                         PCI_SLOT(pdev->devfn), PCI_FUNC(pdev->devfn),
                         cap_id, offset, overlapping_cap, i);
                 return -EINVAL;
@@ -2152,7 +2158,7 @@ static char *pcibus_get_dev_path(DeviceState *dev)
     path[path_len] = '\0';
 
     /* First field is the domain. */
-    s = snprintf(domain, sizeof domain, "%04x:00", pci_find_domain(d->bus));
+    s = snprintf(domain, sizeof domain, "%04x:00", pci_find_domain(d));
     assert(s == domain_len);
     memcpy(path, domain, domain_len);
 
diff --git a/hw/pci/pcie_aer.c b/hw/pci/pcie_aer.c
index 1ce72ce..06f77ac 100644
--- a/hw/pci/pcie_aer.c
+++ b/hw/pci/pcie_aer.c
@@ -1022,8 +1022,7 @@ int do_pcie_aer_inject_error(Monitor *mon,
     *ret_data = qobject_from_jsonf("{'id': %s, "
                                    "'domain': %d, 'bus': %d, 'devfn': %d, "
                                    "'ret': %d}",
-                                   id,
-                                   pci_find_domain(dev->bus),
+                                   id, pci_find_domain(dev),
                                    pci_bus_num(dev->bus), dev->devfn,
                                    ret);
     assert(*ret_data);
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 7b89d88..f2bf1ed 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -390,7 +390,8 @@ void pci_for_each_device(PCIBus *bus, int bus_num,
                          void (*fn)(PCIBus *bus, PCIDevice *d, void *opaque),
                          void *opaque);
 PCIBus *pci_find_primary_bus(void);
-int pci_find_domain(const PCIBus *bus);
+PCIBus *pci_device_root_bus(const PCIDevice *d);
+int pci_find_domain(const PCIDevice *dev);
 PCIDevice *pci_find_device(PCIBus *bus, int bus_num, uint8_t devfn);
 int pci_qdev_find_device(const char *id, PCIDevice **pdev);
 PCIBus *pci_get_bus_devfn(int *devfnp, const char *devaddr);
commit 1ef7a2a2afedbba47e06af5081a8b4bf6dc1cf71
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:47 2013 +1000

    pci: Abolish pci_find_root_bus()
    
    pci_find_root_bus() takes a domain parameter.  Currently PCI root buses
    with domain other than 0 can't be created, so this is more or less a long
    winded way of retrieving the main PCI root bus.  Numbered domains don't
    actually properly cover the (non x86) possibilities for multiple PCI root
    buses, so this patch for now enforces the domain == 0 restriction in other
    places to replace pci_find_root_bus() with an explicit
    pci_find_primary_bus().
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index e393022..0276694 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -342,7 +342,7 @@ static void pc_xen_hvm_init(QEMUMachineInitArgs *args)
 
     pc_init_pci(args);
 
-    bus = pci_find_root_bus(0);
+    bus = pci_find_primary_bus();
     if (bus != NULL) {
         pci_create_simple(bus, -1, "xen-platform");
     }
diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index a0b5558..7a47d6b 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -36,17 +36,23 @@
 #include "sysemu/blockdev.h"
 #include "qapi/error.h"
 
-static int pci_read_devaddr(Monitor *mon, const char *addr, int *domp,
+static int pci_read_devaddr(Monitor *mon, const char *addr,
                             int *busp, unsigned *slotp)
 {
+    int dom;
+
     /* strip legacy tag */
     if (!strncmp(addr, "pci_addr=", 9)) {
         addr += 9;
     }
-    if (pci_parse_devaddr(addr, domp, busp, slotp, NULL)) {
+    if (pci_parse_devaddr(addr, &dom, busp, slotp, NULL)) {
         monitor_printf(mon, "Invalid pci address\n");
         return -1;
     }
+    if (dom != 0) {
+        monitor_printf(mon, "Multiple PCI domains not supported, use device_add\n");
+        return -1;
+    }
     return 0;
 }
 
@@ -128,18 +134,22 @@ static int scsi_hot_add(Monitor *mon, DeviceState *adapter,
 
 int pci_drive_hot_add(Monitor *mon, const QDict *qdict, DriveInfo *dinfo)
 {
-    int dom, pci_bus;
+    int pci_bus;
     unsigned slot;
+    PCIBus *root = pci_find_primary_bus();
     PCIDevice *dev;
     const char *pci_addr = qdict_get_str(qdict, "pci_addr");
 
     switch (dinfo->type) {
     case IF_SCSI:
-        if (pci_read_devaddr(mon, pci_addr, &dom, &pci_bus, &slot)) {
+        if (!root) {
+            monitor_printf(mon, "no primary PCI bus\n");
+            goto err;
+        }
+        if (pci_read_devaddr(mon, pci_addr, &pci_bus, &slot)) {
             goto err;
         }
-        dev = pci_find_device(pci_find_root_bus(dom), pci_bus,
-                              PCI_DEVFN(slot, 0));
+        dev = pci_find_device(root, pci_bus, PCI_DEVFN(slot, 0));
         if (!dev) {
             monitor_printf(mon, "no pci device with address %s\n", pci_addr);
             goto err;
@@ -275,16 +285,22 @@ void pci_device_hot_add(Monitor *mon, const QDict *qdict)
 
 static int pci_device_hot_remove(Monitor *mon, const char *pci_addr)
 {
+    PCIBus *root = pci_find_primary_bus();
     PCIDevice *d;
-    int dom, bus;
+    int bus;
     unsigned slot;
     Error *local_err = NULL;
 
-    if (pci_read_devaddr(mon, pci_addr, &dom, &bus, &slot)) {
+    if (!root) {
+        monitor_printf(mon, "no primary PCI bus\n");
+        return -1;
+    }
+
+    if (pci_read_devaddr(mon, pci_addr, &bus, &slot)) {
         return -1;
     }
 
-    d = pci_find_device(pci_find_root_bus(dom), bus, PCI_DEVFN(slot, 0));
+    d = pci_find_device(root, bus, PCI_DEVFN(slot, 0));
     if (!d) {
         monitor_printf(mon, "slot %d empty\n", slot);
         return -1;
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index adf4da5..fc99e3b 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -246,12 +246,12 @@ static void pci_host_bus_register(int domain, PCIBus *bus)
     QLIST_INSERT_HEAD(&host_buses, host, next);
 }
 
-PCIBus *pci_find_root_bus(int domain)
+PCIBus *pci_find_primary_bus(void)
 {
     struct PCIHostBus *host;
 
     QLIST_FOREACH(host, &host_buses, next) {
-        if (host->domain == domain) {
+        if (host->domain == 0) {
             return host->bus;
         }
     }
@@ -583,20 +583,31 @@ int pci_parse_devaddr(const char *addr, int *domp, int *busp,
 
 PCIBus *pci_get_bus_devfn(int *devfnp, const char *devaddr)
 {
+    PCIBus *root = pci_find_primary_bus();
     int dom, bus;
     unsigned slot;
 
+    if (!root) {
+        fprintf(stderr, "No primary PCI bus\n");
+        return NULL;
+    }
+
     if (!devaddr) {
         *devfnp = -1;
-        return pci_find_bus_nr(pci_find_root_bus(0), 0);
+        return pci_find_bus_nr(root, 0);
     }
 
     if (pci_parse_devaddr(devaddr, &dom, &bus, &slot, NULL) < 0) {
         return NULL;
     }
 
+    if (dom != 0) {
+        fprintf(stderr, "No support for non-zero PCI domains\n");
+        return NULL;
+    }
+
     *devfnp = PCI_DEVFN(slot, 0);
-    return pci_find_bus_nr(pci_find_root_bus(dom), bus);
+    return pci_find_bus_nr(root, bus);
 }
 
 static void pci_init_cmask(PCIDevice *dev)
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index b5edef8..7b89d88 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -389,7 +389,7 @@ int pci_bus_num(PCIBus *s);
 void pci_for_each_device(PCIBus *bus, int bus_num,
                          void (*fn)(PCIBus *bus, PCIDevice *d, void *opaque),
                          void *opaque);
-PCIBus *pci_find_root_bus(int domain);
+PCIBus *pci_find_primary_bus(void);
 int pci_find_domain(const PCIBus *bus);
 PCIDevice *pci_find_device(PCIBus *bus, int bus_num, uint8_t devfn);
 int pci_qdev_find_device(const char *id, PCIDevice **pdev);
commit 945dad6d9d795f03fd839c6e36cc883b3839f5e5
Author: Jia Liu <proljc at gmail.com>
Date:   Tue Jul 2 20:55:17 2013 +0800

    MAINTAINERS: Add myself into MAINTAINERS file
    
    Add myself into MAINTAINERS file, I'll looking at target-openrisc
    and hw/openrisc.
    
    Signed-off-by: Jia Liu <proljc at gmail.com>
    Message-id: 1372769717-852-1-git-send-email-proljc at gmail.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index 780a281..1ef4821 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -104,6 +104,12 @@ M: Anthony Green <green at moxielogic.com>
 S: Maintained
 F: target-moxie/
 
+OpenRISC
+M: Jia Liu <proljc at gmail.com>
+S: Maintained
+F: target-openrisc/
+F: hw/openrisc/
+
 PowerPC
 M: Alexander Graf <agraf at suse.de>
 L: qemu-ppc at nongnu.org
@@ -368,6 +374,13 @@ M: Aurelien Jarno <aurelien at aurel32.net>
 S: Maintained
 F: hw/mips/mips_r4k.c
 
+OpenRISC Machines
+-----------------
+or1k-sim
+M: Jia Liu <proljc at gmail.com>
+S: Maintained
+F: hw/openrisc/openrisc_sim.c
+
 PowerPC Machines
 ----------------
 405
commit 6e481d5754a3ff4170e995f6ea0d2f73c55ab072
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jun 24 11:49:32 2013 +0100

    MAINTAINERS: fix bad F: patterns
    
    This patch fixes a number of incorrect F: patterns which didn't
    match any files in the source tree. This was caused by a mix
    of minor typos (- for _ and the like) and a few entries which
    hadn't been correctly updated following the rearrangement of hw/.
    
    Offending entries were located with the following shell rune:
    
     for pattern in $(sed -ne 's/^F: //p' MAINTAINERS); do
       if ! stat --printf='' $pattern 2>/dev/null; then
         echo bad pattern: $pattern
       fi
     done
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Message-id: 1372070972-30776-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index ad9c860..780a281 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -303,11 +303,7 @@ Axis Dev88
 M: Edgar E. Iglesias <edgar.iglesias at gmail.com>
 S: Maintained
 F: hw/cris/axis_dev88.c
-
-etraxfs
-M: Edgar E. Iglesias <edgar.iglesias at gmail.com>
-S: Maintained
-F: hw/cris/etraxfs.c
+F: hw/*/etraxfs_*.c
 
 LM32 Machines
 -------------
@@ -343,7 +339,7 @@ MicroBlaze Machines
 petalogix_s3adsp1800
 M: Edgar E. Iglesias <edgar.iglesias at gmail.com>
 S: Maintained
-F: hw/microblaze/petalogix_s3adsp1800.c
+F: hw/microblaze/petalogix_s3adsp1800_mmu.c
 
 petalogix_ml605
 M: Peter Crosthwaite <peter.crosthwaite at petalogix.com>
@@ -407,8 +403,8 @@ M: Alexander Graf <agraf at suse.de>
 L: qemu-ppc at nongnu.org
 S: Maintained
 F: hw/ppc/mac_newworld.c
-F: hw/pci/devices/host-uninorth.c
-F: hw/pci/devices/host-dec.[hc]
+F: hw/pci-host/uninorth.c
+F: hw/pci-bridge/dec.[hc]
 F: hw/misc/macio/
 
 Old World
@@ -416,7 +412,7 @@ M: Alexander Graf <agraf at suse.de>
 L: qemu-ppc at nongnu.org
 S: Maintained
 F: hw/ppc/mac_oldworld.c
-F: hw/pci/devices/host-grackle.c
+F: hw/pci-host/grackle.c
 F: hw/misc/macio/
 
 PReP
@@ -424,7 +420,7 @@ M: Andreas Färber <andreas.faerber at web.de>
 L: qemu-ppc at nongnu.org
 S: Odd Fixes
 F: hw/ppc/prep.c
-F: hw/pci/devices/host-prep.[hc]
+F: hw/pci-host/prep.[hc]
 F: hw/isa/pc87312.[hc]
 
 sPAPR
@@ -441,19 +437,19 @@ virtex_ml507
 M: Edgar E. Iglesias <edgar.iglesias at gmail.com>
 L: qemu-ppc at nongnu.org
 S: Odd Fixes
-F: hw/pci/virtex_ml507.c
+F: hw/ppc/virtex_ml507.c
 
 SH4 Machines
 ------------
 R2D
 M: Magnus Damm <magnus.damm at gmail.com>
 S: Maintained
-F: hw/sh/r2d.c
+F: hw/sh4/r2d.c
 
 Shix
 M: Magnus Damm <magnus.damm at gmail.com>
 S: Orphan
-F: hw/sh/shix.c
+F: hw/sh4/shix.c
 
 SPARC Machines
 --------------
@@ -478,7 +474,7 @@ S390 Machines
 S390 Virtio
 M: Alexander Graf <agraf at suse.de>
 S: Maintained
-F: hw/s390/s390-*.c
+F: hw/s390x/s390-*.c
 
 S390 Virtio-ccw
 M: Cornelia Huck <cornelia.huck at de.ibm.com>
@@ -547,7 +543,7 @@ M: Alexander Graf <agraf at suse.de>
 M: Scott Wood <scottwood at freescale.com>
 L: qemu-ppc at nongnu.org
 S: Supported
-F: hw/ppc/e500_*
+F: hw/ppc/e500*
 
 SCSI
 M: Paolo Bonzini <pbonzini at redhat.com>
@@ -575,7 +571,7 @@ F: hw/usb/*
 VFIO
 M: Alex Williamson <alex.williamson at redhat.com>
 S: Supported
-F: hw/pci/vfio.c
+F: hw/misc/vfio.c
 
 vhost
 M: Michael S. Tsirkin <mst at redhat.com>
@@ -649,7 +645,7 @@ CPU
 M: Andreas Färber <afaerber at suse.de>
 S: Supported
 F: qom/cpu.c
-F: include/qemu/cpu.h
+F: include/qom/cpu.h
 F: target-i386/cpu.c
 
 ICC Bus
@@ -662,7 +658,7 @@ Device Tree
 M: Peter Crosthwaite <peter.crosthwaite at petalogix.com>
 M: Alexander Graf <agraf at suse.de>
 S: Maintained
-F: device-tree.[ch]
+F: device_tree.[ch]
 
 GDB stub
 M: qemu-devel at nongnu.org
@@ -673,7 +669,7 @@ F: gdb-xml/
 SPICE
 M: Gerd Hoffmann <kraxel at redhat.com>
 S: Supported
-F: ui/qemu-spice.h
+F: include/ui/qemu-spice.h
 F: ui/spice-*.c
 F: audio/spiceaudio.c
 F: hw/display/qxl*
commit 9b4abb4677dd59a3bd83e65d2ca84414e7639a1a
Merge: c3ab4c9 58fda17
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Sun Jul 7 11:28:01 2013 -0500

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Fam Zheng (2) and Stefan Hajnoczi (1)
    # Via Stefan Hajnoczi
    * stefanha/block:
      block: fix bdrv_flush() ordering in bdrv_close()
      curl: refuse to open URL from HTTP server without range support
      vmdk: Implement .bdrv_has_zero_init
    
    Message-id: 1373023972-3587-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit c3ab4c9cf24ec9efb9c6d82b6027c0587d3081fa
Merge: ab8bf29 c7086b4
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Sun Jul 7 11:19:27 2013 -0500

    Merge remote-tracking branch 'bonzini/iommu-for-anthony' into staging
    
    # By Paolo Bonzini (50) and others
    # Via Paolo Bonzini
    * bonzini/iommu-for-anthony: (66 commits)
      exec: change some APIs to take AddressSpaceDispatch
      exec: remove cur_map
      exec: put memory map in AddressSpaceDispatch
      exec: separate current radix tree from the one being built
      exec: move listener from AddressSpaceDispatch to AddressSpace
      memory: move MemoryListener declaration earlier
      exec: separate current memory map from the one being built
      exec: change well-known physical sections to macros
      qom: Use atomics for object refcounting
      memory: add reference counting to FlatView
      memory: use a new FlatView pointer on every topology update
      memory: access FlatView from a local variable
      add a header file for atomic operations
      hw/[u-x]*: pass owner to memory_region_init* functions
      hw/t*: pass owner to memory_region_init* functions
      hw/s*: pass owner to memory_region_init* functions
      hw/p*: pass owner to memory_region_init* functions
      hw/n*: pass owner to memory_region_init* functions
      hw/m*: pass owner to memory_region_init* functions
      hw/i*: pass owner to memory_region_init* functions
      ...
    
    Message-id: 1372950842-32422-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 8384274eda1d7cb01f326143fa6118562c1eb5be
Author: Jürg Billeter <j at bitron.ch>
Date:   Sat Jun 29 11:41:32 2013 +0200

    linux-user: Do not ignore mmap failure from host
    
    File mapping may fail with EACCES.
    
    Signed-off-by: Jürg Billeter <j at bitron.ch>
    Message-id: 1372498892-23676-1-git-send-email-j at bitron.ch
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index b412e3f..de22197 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -483,6 +483,10 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
         if (!(flags & MAP_ANONYMOUS)) {
             p = mmap(g2h(start), len, prot,
                      flags | MAP_FIXED, fd, host_offset);
+            if (p == MAP_FAILED) {
+                munmap(g2h(start), host_len);
+                goto fail;
+            }
             host_start += offset - host_offset;
         }
         start = h2g(host_start);
commit f651e6ae55b047a8ac4b6b5891fe69ba4c66c57c
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Mon Jul 1 02:44:14 2013 +0200

    linux-user: improve target_to_host_sock_type conversion
    
    Previous implementation has failed to take into account different value of
    SOCK_NONBLOCK on target and host, and existence of SOCK_CLOEXEC.
    The same conversion has to be applied both for do_socket and do_socketpair,
    so the code has been isolated in a static inline function.
    
    enum sock_type in linux-user/socket.h has been extended to include
    TARGET_SOCK_CLOEXEC and TARGET_SOCK_NONBLOCK, similar to definition in libc.
    The patch also includes necessary code style changes (tab to spaces) in the
    header file since most of the file has been touched by this change.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Message-id: 1372639454-7560-1-git-send-email-petar.jovanovic at rt-rk.com
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/linux-user/socket.h b/linux-user/socket.h
index 339cae5..ae17959 100644
--- a/linux-user/socket.h
+++ b/linux-user/socket.h
@@ -1,91 +1,104 @@
 
 #if defined(TARGET_MIPS)
-	// MIPS special values for constants
-
-	/*
-	 * For setsockopt(2)
-	 *
-	 * This defines are ABI conformant as far as Linux supports these ...
-	 */
-	#define TARGET_SOL_SOCKET      0xffff
-
-	#define TARGET_SO_DEBUG        0x0001  /* Record debugging information.  */
-	#define TARGET_SO_REUSEADDR    0x0004  /* Allow reuse of local addresses.  */
-	#define TARGET_SO_KEEPALIVE    0x0008  /* Keep connections alive and send
-					  SIGPIPE when they die.  */
-	#define TARGET_SO_DONTROUTE    0x0010  /* Don't do local routing.  */
-	#define TARGET_SO_BROADCAST    0x0020  /* Allow transmission of
-					  broadcast messages.  */
-	#define TARGET_SO_LINGER       0x0080  /* Block on close of a reliable
-					  socket to transmit pending data.  */
-	#define TARGET_SO_OOBINLINE 0x0100     /* Receive out-of-band data in-band.  */
-	#if 0
-	To add: #define TARGET_SO_REUSEPORT 0x0200     /* Allow local address and port reuse.  */
-	#endif
-
-	#define TARGET_SO_TYPE         0x1008  /* Compatible name for SO_STYLE.  */
-	#define TARGET_SO_STYLE        SO_TYPE /* Synonym */
-	#define TARGET_SO_ERROR        0x1007  /* get error status and clear */
-	#define TARGET_SO_SNDBUF       0x1001  /* Send buffer size. */
-	#define TARGET_SO_RCVBUF       0x1002  /* Receive buffer. */
-	#define TARGET_SO_SNDLOWAT     0x1003  /* send low-water mark */
-	#define TARGET_SO_RCVLOWAT     0x1004  /* receive low-water mark */
-	#define TARGET_SO_SNDTIMEO     0x1005  /* send timeout */
-	#define TARGET_SO_RCVTIMEO     0x1006  /* receive timeout */
-	#define TARGET_SO_ACCEPTCONN   0x1009
-
-	/* linux-specific, might as well be the same as on i386 */
-	#define TARGET_SO_NO_CHECK     11
-	#define TARGET_SO_PRIORITY     12
-	#define TARGET_SO_BSDCOMPAT    14
-
-	#define TARGET_SO_PASSCRED     17
-	#define TARGET_SO_PEERCRED     18
-
-	/* Security levels - as per NRL IPv6 - don't actually do anything */
-	#define TARGET_SO_SECURITY_AUTHENTICATION              22
-	#define TARGET_SO_SECURITY_ENCRYPTION_TRANSPORT        23
-	#define TARGET_SO_SECURITY_ENCRYPTION_NETWORK          24
-
-	#define TARGET_SO_BINDTODEVICE         25
-
-	/* Socket filtering */
-	#define TARGET_SO_ATTACH_FILTER        26
-	#define TARGET_SO_DETACH_FILTER        27
-
-	#define TARGET_SO_PEERNAME             28
-	#define TARGET_SO_TIMESTAMP            29
-	#define SCM_TIMESTAMP          SO_TIMESTAMP
-
-	#define TARGET_SO_PEERSEC              30
-	#define TARGET_SO_SNDBUFFORCE          31
-	#define TARGET_SO_RCVBUFFORCE          33
-
-	/** sock_type - Socket types
-	 *
-	 * Please notice that for binary compat reasons MIPS has to
-	 * override the enum sock_type in include/linux/net.h, so
-	 * we define ARCH_HAS_SOCKET_TYPES here.
-	 *
-	 * @SOCK_DGRAM - datagram (conn.less) socket
-	 * @SOCK_STREAM - stream (connection) socket
-	 * @SOCK_RAW - raw socket
-	 * @SOCK_RDM - reliably-delivered message
-	 * @SOCK_SEQPACKET - sequential packet socket
-	 * @SOCK_PACKET - linux specific way of getting packets at the dev level.
-	 *               For writing rarp and other similar things on the user level.
-	 */
-	enum sock_type {
-	       TARGET_SOCK_DGRAM       = 1,
-	       TARGET_SOCK_STREAM      = 2,
-	       TARGET_SOCK_RAW = 3,
-	       TARGET_SOCK_RDM = 4,
-	       TARGET_SOCK_SEQPACKET   = 5,
-	       TARGET_SOCK_DCCP        = 6,
-	       TARGET_SOCK_PACKET      = 10,
-	};
-
-	#define TARGET_SOCK_MAX (SOCK_PACKET + 1)
+    /* MIPS special values for constants */
+
+    /*
+     * For setsockopt(2)
+     *
+     * This defines are ABI conformant as far as Linux supports these ...
+     */
+    #define TARGET_SOL_SOCKET      0xffff
+
+    #define TARGET_SO_DEBUG        0x0001  /* Record debugging information. */
+    #define TARGET_SO_REUSEADDR    0x0004  /* Allow reuse of local addresses. */
+    #define TARGET_SO_KEEPALIVE    0x0008  /* Keep connections alive and send
+                                              SIGPIPE when they die. */
+    #define TARGET_SO_DONTROUTE    0x0010  /* Don't do local routing. */
+    #define TARGET_SO_BROADCAST    0x0020  /* Allow transmission of
+                                              broadcast messages. */
+    #define TARGET_SO_LINGER       0x0080  /* Block on close of a reliable
+                                            * socket to transmit pending data.
+                                            */
+    #define TARGET_SO_OOBINLINE 0x0100     /* Receive out-of-band data in-band.
+                                            */
+    #if 0
+    /* To add: Allow local address and port reuse. */
+    #define TARGET_SO_REUSEPORT 0x0200
+    #endif
+
+    #define TARGET_SO_TYPE         0x1008  /* Compatible name for SO_STYLE. */
+    #define TARGET_SO_STYLE        SO_TYPE /* Synonym */
+    #define TARGET_SO_ERROR        0x1007  /* get error status and clear */
+    #define TARGET_SO_SNDBUF       0x1001  /* Send buffer size. */
+    #define TARGET_SO_RCVBUF       0x1002  /* Receive buffer. */
+    #define TARGET_SO_SNDLOWAT     0x1003  /* send low-water mark */
+    #define TARGET_SO_RCVLOWAT     0x1004  /* receive low-water mark */
+    #define TARGET_SO_SNDTIMEO     0x1005  /* send timeout */
+    #define TARGET_SO_RCVTIMEO     0x1006  /* receive timeout */
+    #define TARGET_SO_ACCEPTCONN   0x1009
+
+    /* linux-specific, might as well be the same as on i386 */
+    #define TARGET_SO_NO_CHECK     11
+    #define TARGET_SO_PRIORITY     12
+    #define TARGET_SO_BSDCOMPAT    14
+
+    #define TARGET_SO_PASSCRED     17
+    #define TARGET_SO_PEERCRED     18
+
+    /* Security levels - as per NRL IPv6 - don't actually do anything */
+    #define TARGET_SO_SECURITY_AUTHENTICATION              22
+    #define TARGET_SO_SECURITY_ENCRYPTION_TRANSPORT        23
+    #define TARGET_SO_SECURITY_ENCRYPTION_NETWORK          24
+
+    #define TARGET_SO_BINDTODEVICE         25
+
+    /* Socket filtering */
+    #define TARGET_SO_ATTACH_FILTER        26
+    #define TARGET_SO_DETACH_FILTER        27
+
+    #define TARGET_SO_PEERNAME             28
+    #define TARGET_SO_TIMESTAMP            29
+    #define SCM_TIMESTAMP          SO_TIMESTAMP
+
+    #define TARGET_SO_PEERSEC              30
+    #define TARGET_SO_SNDBUFFORCE          31
+    #define TARGET_SO_RCVBUFFORCE          33
+
+    /** sock_type - Socket types
+     *
+     * Please notice that for binary compat reasons MIPS has to
+     * override the enum sock_type in include/linux/net.h, so
+     * we define ARCH_HAS_SOCKET_TYPES here.
+     *
+     * @SOCK_DGRAM - datagram (conn.less) socket
+     * @SOCK_STREAM - stream (connection) socket
+     * @SOCK_RAW - raw socket
+     * @SOCK_RDM - reliably-delivered message
+     * @SOCK_SEQPACKET - sequential packet socket
+     * @SOCK_DCCP - Datagram Congestion Control Protocol socket
+     * @SOCK_PACKET - linux specific way of getting packets at the dev level.
+     *                For writing rarp and other similar things on the user
+     *                level.
+     * @SOCK_CLOEXEC - sets the close-on-exec (FD_CLOEXEC) flag.
+     * @SOCK_NONBLOCK - sets the O_NONBLOCK file status flag.
+     */
+
+    #define ARCH_HAS_SOCKET_TYPES          1
+
+    enum sock_type {
+           TARGET_SOCK_DGRAM       = 1,
+           TARGET_SOCK_STREAM      = 2,
+           TARGET_SOCK_RAW         = 3,
+           TARGET_SOCK_RDM         = 4,
+           TARGET_SOCK_SEQPACKET   = 5,
+           TARGET_SOCK_DCCP        = 6,
+           TARGET_SOCK_PACKET      = 10,
+           TARGET_SOCK_CLOEXEC     = 02000000,
+           TARGET_SOCK_NONBLOCK    = 0200,
+    };
+
+    #define TARGET_SOCK_MAX (TARGET_SOCK_PACKET + 1)
+    #define TARGET_SOCK_TYPE_MASK    0xf  /* Covers up to TARGET_SOCK_MAX-1. */
 
 #elif defined(TARGET_ALPHA)
 
@@ -156,61 +169,167 @@
     /* Instruct lower device to use last 4-bytes of skb data as FCS */
     #define TARGET_SO_NOFCS     43
 
+    /** sock_type - Socket types
+     *
+     * Please notice that for binary compat reasons ALPHA has to
+     * override the enum sock_type in include/linux/net.h, so
+     * we define ARCH_HAS_SOCKET_TYPES here.
+     *
+     * @SOCK_DGRAM - datagram (conn.less) socket
+     * @SOCK_STREAM - stream (connection) socket
+     * @SOCK_RAW - raw socket
+     * @SOCK_RDM - reliably-delivered message
+     * @SOCK_SEQPACKET - sequential packet socket
+     * @SOCK_DCCP - Datagram Congestion Control Protocol socket
+     * @SOCK_PACKET - linux specific way of getting packets at the dev level.
+     *                For writing rarp and other similar things on the user
+     *                level.
+     * @SOCK_CLOEXEC - sets the close-on-exec (FD_CLOEXEC) flag.
+     * @SOCK_NONBLOCK - sets the O_NONBLOCK file status flag.
+     */
+
+    #define ARCH_HAS_SOCKET_TYPES          1
+
+    enum sock_type {
+           TARGET_SOCK_STREAM      = 1,
+           TARGET_SOCK_DGRAM       = 2,
+           TARGET_SOCK_RAW         = 3,
+           TARGET_SOCK_RDM         = 4,
+           TARGET_SOCK_SEQPACKET   = 5,
+           TARGET_SOCK_DCCP        = 6,
+           TARGET_SOCK_PACKET      = 10,
+           TARGET_SOCK_CLOEXEC     = 010000000,
+           TARGET_SOCK_NONBLOCK    = 010000000000,
+    };
+
+    #define TARGET_SOCK_MAX (TARGET_SOCK_PACKET + 1)
+    #define TARGET_SOCK_TYPE_MASK    0xf  /* Covers up to TARGET_SOCK_MAX-1. */
 #else
 
-	/* For setsockopt(2) */
-	#define TARGET_SOL_SOCKET      1
-
-	#define TARGET_SO_DEBUG        1
-	#define TARGET_SO_REUSEADDR    2
-	#define TARGET_SO_TYPE         3
-	#define TARGET_SO_ERROR        4
-	#define TARGET_SO_DONTROUTE    5
-	#define TARGET_SO_BROADCAST    6
-	#define TARGET_SO_SNDBUF       7
-	#define TARGET_SO_RCVBUF       8
-	#define TARGET_SO_SNDBUFFORCE  32
-	#define TARGET_SO_RCVBUFFORCE  33
-	#define TARGET_SO_KEEPALIVE    9
-	#define TARGET_SO_OOBINLINE    10
-	#define TARGET_SO_NO_CHECK     11
-	#define TARGET_SO_PRIORITY     12
-	#define TARGET_SO_LINGER       13
-	#define TARGET_SO_BSDCOMPAT    14
-	/* To add :#define TARGET_SO_REUSEPORT 15 */
+#if defined(TARGET_SPARC)
+    /** sock_type - Socket types
+     *
+     * Please notice that for binary compat reasons SPARC has to
+     * override the enum sock_type in include/linux/net.h, so
+     * we define ARCH_HAS_SOCKET_TYPES here.
+     *
+     * @SOCK_DGRAM - datagram (conn.less) socket
+     * @SOCK_STREAM - stream (connection) socket
+     * @SOCK_RAW - raw socket
+     * @SOCK_RDM - reliably-delivered message
+     * @SOCK_SEQPACKET - sequential packet socket
+     * @SOCK_DCCP - Datagram Congestion Control Protocol socket
+     * @SOCK_PACKET - linux specific way of getting packets at the dev level.
+     *                For writing rarp and other similar things on the user
+     *                level.
+     * @SOCK_CLOEXEC - sets the close-on-exec (FD_CLOEXEC) flag.
+     * @SOCK_NONBLOCK - sets the O_NONBLOCK file status flag.
+     */
+
+    #define ARCH_HAS_SOCKET_TYPES          1
+
+    enum sock_type {
+           TARGET_SOCK_STREAM      = 1,
+           TARGET_SOCK_DGRAM       = 2,
+           TARGET_SOCK_RAW         = 3,
+           TARGET_SOCK_RDM         = 4,
+           TARGET_SOCK_SEQPACKET   = 5,
+           TARGET_SOCK_DCCP        = 6,
+           TARGET_SOCK_PACKET      = 10,
+           TARGET_SOCK_CLOEXEC     = 020000000,
+           TARGET_SOCK_NONBLOCK    = 040000,
+    };
+
+    #define TARGET_SOCK_MAX (TARGET_SOCK_PACKET + 1)
+    #define TARGET_SOCK_TYPE_MASK    0xf  /* Covers up to TARGET_SOCK_MAX-1. */
+#endif
+
+    /* For setsockopt(2) */
+    #define TARGET_SOL_SOCKET      1
+
+    #define TARGET_SO_DEBUG        1
+    #define TARGET_SO_REUSEADDR    2
+    #define TARGET_SO_TYPE         3
+    #define TARGET_SO_ERROR        4
+    #define TARGET_SO_DONTROUTE    5
+    #define TARGET_SO_BROADCAST    6
+    #define TARGET_SO_SNDBUF       7
+    #define TARGET_SO_RCVBUF       8
+    #define TARGET_SO_SNDBUFFORCE  32
+    #define TARGET_SO_RCVBUFFORCE  33
+    #define TARGET_SO_KEEPALIVE    9
+    #define TARGET_SO_OOBINLINE    10
+    #define TARGET_SO_NO_CHECK     11
+    #define TARGET_SO_PRIORITY     12
+    #define TARGET_SO_LINGER       13
+    #define TARGET_SO_BSDCOMPAT    14
+    /* To add :#define TARGET_SO_REUSEPORT 15 */
 #if defined(TARGET_PPC)
-	#define TARGET_SO_RCVLOWAT     16
-	#define TARGET_SO_SNDLOWAT     17
-	#define TARGET_SO_RCVTIMEO     18
-	#define TARGET_SO_SNDTIMEO     19
-	#define TARGET_SO_PASSCRED     20
-	#define TARGET_SO_PEERCRED     21
+    #define TARGET_SO_RCVLOWAT     16
+    #define TARGET_SO_SNDLOWAT     17
+    #define TARGET_SO_RCVTIMEO     18
+    #define TARGET_SO_SNDTIMEO     19
+    #define TARGET_SO_PASSCRED     20
+    #define TARGET_SO_PEERCRED     21
 #else
-	#define TARGET_SO_PASSCRED     16
-	#define TARGET_SO_PEERCRED     17
-	#define TARGET_SO_RCVLOWAT     18
-	#define TARGET_SO_SNDLOWAT     19
-	#define TARGET_SO_RCVTIMEO     20
-	#define TARGET_SO_SNDTIMEO     21
+    #define TARGET_SO_PASSCRED     16
+    #define TARGET_SO_PEERCRED     17
+    #define TARGET_SO_RCVLOWAT     18
+    #define TARGET_SO_SNDLOWAT     19
+    #define TARGET_SO_RCVTIMEO     20
+    #define TARGET_SO_SNDTIMEO     21
 #endif
 
-	/* Security levels - as per NRL IPv6 - don't actually do anything */
-	#define TARGET_SO_SECURITY_AUTHENTICATION              22
-	#define TARGET_SO_SECURITY_ENCRYPTION_TRANSPORT        23
-	#define TARGET_SO_SECURITY_ENCRYPTION_NETWORK          24
+    /* Security levels - as per NRL IPv6 - don't actually do anything */
+    #define TARGET_SO_SECURITY_AUTHENTICATION              22
+    #define TARGET_SO_SECURITY_ENCRYPTION_TRANSPORT        23
+    #define TARGET_SO_SECURITY_ENCRYPTION_NETWORK          24
 
-	#define TARGET_SO_BINDTODEVICE 25
+    #define TARGET_SO_BINDTODEVICE 25
 
-	/* Socket filtering */
-	#define TARGET_SO_ATTACH_FILTER        26
-	#define TARGET_SO_DETACH_FILTER        27
+    /* Socket filtering */
+    #define TARGET_SO_ATTACH_FILTER        26
+    #define TARGET_SO_DETACH_FILTER        27
+
+    #define TARGET_SO_PEERNAME             28
+    #define TARGET_SO_TIMESTAMP            29
+    #define TARGET_SCM_TIMESTAMP           TARGET_SO_TIMESTAMP
 
-	#define TARGET_SO_PEERNAME             28
-	#define TARGET_SO_TIMESTAMP            29
-	#define TARGET_SCM_TIMESTAMP           TARGET_SO_TIMESTAMP
+    #define TARGET_SO_ACCEPTCONN           30
 
-	#define TARGET_SO_ACCEPTCONN           30
+    #define TARGET_SO_PEERSEC              31
+
+#endif
 
-	#define TARGET_SO_PEERSEC              31
+#ifndef ARCH_HAS_SOCKET_TYPES
+    /** sock_type - Socket types - default values
+     *
+     *
+     * @SOCK_STREAM - stream (connection) socket
+     * @SOCK_DGRAM - datagram (conn.less) socket
+     * @SOCK_RAW - raw socket
+     * @SOCK_RDM - reliably-delivered message
+     * @SOCK_SEQPACKET - sequential packet socket
+     * @SOCK_DCCP - Datagram Congestion Control Protocol socket
+     * @SOCK_PACKET - linux specific way of getting packets at the dev level.
+     *                For writing rarp and other similar things on the user
+     *                level.
+     * @SOCK_CLOEXEC - sets the close-on-exec (FD_CLOEXEC) flag.
+     * @SOCK_NONBLOCK - sets the O_NONBLOCK file status flag.
+     */
+    enum sock_type {
+           TARGET_SOCK_STREAM      = 1,
+           TARGET_SOCK_DGRAM       = 2,
+           TARGET_SOCK_RAW         = 3,
+           TARGET_SOCK_RDM         = 4,
+           TARGET_SOCK_SEQPACKET   = 5,
+           TARGET_SOCK_DCCP        = 6,
+           TARGET_SOCK_PACKET      = 10,
+           TARGET_SOCK_CLOEXEC     = 02000000,
+           TARGET_SOCK_NONBLOCK    = 04000,
+    };
+
+    #define TARGET_SOCK_MAX (TARGET_SOCK_PACKET + 1)
+    #define TARGET_SOCK_TYPE_MASK    0xf  /* Covers up to TARGET_SOCK_MAX-1. */
 
 #endif
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index d74836a..a6a7828 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -1705,31 +1705,36 @@ static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
     free(vec);
 }
 
-/* do_socket() Must return target values and target errnos. */
-static abi_long do_socket(int domain, int type, int protocol)
+static inline void target_to_host_sock_type(int *type)
 {
-#if defined(TARGET_MIPS)
-    switch(type) {
+    int host_type = 0;
+    int target_type = *type;
+
+    switch (target_type & TARGET_SOCK_TYPE_MASK) {
     case TARGET_SOCK_DGRAM:
-        type = SOCK_DGRAM;
+        host_type = SOCK_DGRAM;
         break;
     case TARGET_SOCK_STREAM:
-        type = SOCK_STREAM;
-        break;
-    case TARGET_SOCK_RAW:
-        type = SOCK_RAW;
+        host_type = SOCK_STREAM;
         break;
-    case TARGET_SOCK_RDM:
-        type = SOCK_RDM;
-        break;
-    case TARGET_SOCK_SEQPACKET:
-        type = SOCK_SEQPACKET;
-        break;
-    case TARGET_SOCK_PACKET:
-        type = SOCK_PACKET;
+    default:
+        host_type = target_type & TARGET_SOCK_TYPE_MASK;
         break;
     }
-#endif
+    if (target_type & TARGET_SOCK_CLOEXEC) {
+        host_type |= SOCK_CLOEXEC;
+    }
+    if (target_type & TARGET_SOCK_NONBLOCK) {
+        host_type |= SOCK_NONBLOCK;
+    }
+    *type = host_type;
+}
+
+/* do_socket() Must return target values and target errnos. */
+static abi_long do_socket(int domain, int type, int protocol)
+{
+    target_to_host_sock_type(&type);
+
     if (domain == PF_NETLINK)
         return -EAFNOSUPPORT; /* do not NETLINK socket connections possible */
     return get_errno(socket(domain, type, protocol));
@@ -1962,6 +1967,8 @@ static abi_long do_socketpair(int domain, int type, int protocol,
     int tab[2];
     abi_long ret;
 
+    target_to_host_sock_type(&type);
+
     ret = get_errno(socketpair(domain, type, protocol, tab));
     if (!is_error(ret)) {
         if (put_user_s32(tab[0], target_tab_addr)
commit 023b0ae33be6ce2e60d75d2b54a3d2cea6b6020e
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 4 14:31:45 2013 +0100

    user-exec.c: Set is_write correctly in the ARM cpu_signal_handler()
    
    In the ARM implementation of cpu_signal_handler(), set is_write
    correctly using the FSR value which the kernel passes us in the
    error_code field of uc_mcontext. Since the WnR bit of the FSR was
    only introduced in ARMv6, this means that v5 cores will continue
    to behave as before this patch, but they are not really supported
    as hosts for linux-user mode anyway since they do not have the
    modern behaviour for unaligned accesses.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1370352705-27590-1-git-send-email-peter.maydell at linaro.org

diff --git a/user-exec.c b/user-exec.c
index fa7f1f1..57c8e8d 100644
--- a/user-exec.c
+++ b/user-exec.c
@@ -20,6 +20,7 @@
 #include "cpu.h"
 #include "disas/disas.h"
 #include "tcg.h"
+#include "qemu/bitops.h"
 
 #undef EAX
 #undef ECX
@@ -441,8 +442,11 @@ int cpu_signal_handler(int host_signum, void *pinfo,
 #else
     pc = uc->uc_mcontext.arm_pc;
 #endif
-    /* XXX: compute is_write */
-    is_write = 0;
+
+    /* error_code is the FSR value, in which bit 11 is WnR (assuming a v6 or
+     * later processor; on v5 we will always report this as a read).
+     */
+    is_write = extract32(uc->uc_mcontext.error_code, 11, 1);
     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
                              is_write,
                              &uc->uc_sigmask, puc);
commit 1acae9f22380a03b468a29a3cc035b280610b5e4
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 2 14:04:12 2013 +0100

    linux-user: Fix sys_utimensat (would not compile on old glibc)
    
    Commit c0d472b12e accidentally dropped the definition of
    __NR_SYS_utimensat even though its use is guarded by
    CONFIG_UTIMENSAT, not CONFIG_ATFILE. Some older glibc don't
    have utimensat() (even if they have the other *at() functions).
    Fix this by correctly cleaning up the sys_utimensat()
    implementation and #defines, so that we always provide the
    syscall if needed whether we're doing it via glibc or not.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Tested-by: Laurent Desnogues <laurent.desnogues at gmail.com>
    Message-id: 1371743841-26110-1-git-send-email-peter.maydell at linaro.org

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 4b134dd..d74836a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -339,6 +339,7 @@ static int sys_openat(int dirfd, const char *pathname, int flags, mode_t mode)
 }
 #endif
 
+#ifdef TARGET_NR_utimensat
 #ifdef CONFIG_UTIMENSAT
 static int sys_utimensat(int dirfd, const char *pathname,
     const struct timespec times[2], int flags)
@@ -348,12 +349,19 @@ static int sys_utimensat(int dirfd, const char *pathname,
     else
         return utimensat(dirfd, pathname, times, flags);
 }
-#else
-#if defined(TARGET_NR_utimensat) && defined(__NR_utimensat)
+#elif defined(__NR_utimensat)
+#define __NR_sys_utimensat __NR_utimensat
 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
           const struct timespec *,tsp,int,flags)
+#else
+static int sys_utimensat(int dirfd, const char *pathname,
+                         const struct timespec times[2], int flags)
+{
+    errno = ENOSYS;
+    return -1;
+}
 #endif
-#endif /* CONFIG_UTIMENSAT  */
+#endif /* TARGET_NR_utimensat */
 
 #ifdef CONFIG_INOTIFY
 #include <sys/inotify.h>
@@ -8627,7 +8635,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
         goto unimplemented_nowarn;
 #endif
 
-#if defined(TARGET_NR_utimensat) && defined(__NR_utimensat)
+#if defined(TARGET_NR_utimensat)
     case TARGET_NR_utimensat:
         {
             struct timespec *tsp, ts[2];
commit 167c50d8f94e0ffb880aa5cd2a232a3f32f0df1d
Author: Andreas Schwab <schwab at linux-m68k.org>
Date:   Tue Jul 2 14:04:12 2013 +0100

    linux-user: fix signal number range check
    
    When translating between host and target signal numbers keep negative
    numbers unchanged, avoiding access beyond array bounds.
    
    Signed-off-by: Andreas Schwab <schwab at linux-m68k.org>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 878v2b8sek.fsf at igel.home

diff --git a/linux-user/signal.c b/linux-user/signal.c
index c4e20dc..d84e189 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -102,14 +102,14 @@ static inline int sas_ss_flags(unsigned long sp)
 
 int host_to_target_signal(int sig)
 {
-    if (sig >= _NSIG)
+    if (sig < 0 || sig >= _NSIG)
         return sig;
     return host_to_target_signal_table[sig];
 }
 
 int target_to_host_signal(int sig)
 {
-    if (sig >= _NSIG)
+    if (sig < 0 || sig >= _NSIG)
         return sig;
     return target_to_host_signal_table[sig];
 }
commit 7ff7b666186a86f0121e6e7db6784222cefe22a2
Author: Laurent Vivier <laurent at vivier.eu>
Date:   Tue Jul 2 14:04:12 2013 +0100

    linux-user: add SIOCADDRT/SIOCDELRT support
    
    This allows to pass the device name.
    
    You can test this with the "route" command.
    
    WITHOUT this patch:
    
    $ sudo route add -net default gw 10.0.3.1 eth0
    SIOCADDRT: Bad address
    $ netstat -nr
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags   MSS Window  irtt Ifa
    10.0.3.0        0.0.0.0         255.255.255.0   U         0 0          0 eth
    
    WITH this patch:
    
    $ sudo route add -net default gw 10.0.3.1 eth0
    $ netstat -nr
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags   MSS Window  irtt Ifa
    0.0.0.0         10.0.3.1        0.0.0.0         UG        0 0          0 eth
    10.0.3.0        0.0.0.0         255.255.255.0   U         0 0          0 eth
    
    Signed-off-by: Laurent Vivier <laurent at vivier.eu>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h
index 8a47767..439c2a9 100644
--- a/linux-user/ioctls.h
+++ b/linux-user/ioctls.h
@@ -88,8 +88,6 @@
 #endif
 
   IOCTL(SIOCATMARK, 0, TYPE_NULL)
-  IOCTL(SIOCADDRT, IOC_W, MK_PTR(MK_STRUCT(STRUCT_rtentry)))
-  IOCTL(SIOCDELRT, IOC_W, MK_PTR(MK_STRUCT(STRUCT_rtentry)))
   IOCTL(SIOCGIFNAME, IOC_RW, MK_PTR(TYPE_INT))
   IOCTL(SIOCGIFFLAGS, IOC_W | IOC_R, MK_PTR(MK_STRUCT(STRUCT_short_ifreq)))
   IOCTL(SIOCSIFFLAGS, IOC_W, MK_PTR(MK_STRUCT(STRUCT_short_ifreq)))
@@ -379,3 +377,7 @@
                 MK_PTR(MK_STRUCT(STRUCT_dm_ioctl)))
   IOCTL_SPECIAL(DM_DEV_SET_GEOMETRY, IOC_RW, do_ioctl_dm,
                 MK_PTR(MK_STRUCT(STRUCT_dm_ioctl)))
+  IOCTL_SPECIAL(SIOCADDRT, IOC_W, do_ioctl_rt,
+                MK_PTR(MK_STRUCT(STRUCT_rtentry)))
+  IOCTL_SPECIAL(SIOCDELRT, IOC_W, do_ioctl_rt,
+                MK_PTR(MK_STRUCT(STRUCT_rtentry)))
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index ed2c930..4b134dd 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -105,6 +105,7 @@ int __clone2(int (*fn)(void *), void *child_stack_base,
 #include <linux/vt.h>
 #include <linux/dm-ioctl.h>
 #include <linux/reboot.h>
+#include <linux/route.h>
 #include "linux_loop.h"
 #include "cpu-uname.h"
 
@@ -3551,6 +3552,69 @@ out:
     return ret;
 }
 
+static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
+                                int fd, abi_long cmd, abi_long arg)
+{
+    const argtype *arg_type = ie->arg_type;
+    const StructEntry *se;
+    const argtype *field_types;
+    const int *dst_offsets, *src_offsets;
+    int target_size;
+    void *argptr;
+    abi_ulong *target_rt_dev_ptr;
+    unsigned long *host_rt_dev_ptr;
+    abi_long ret;
+    int i;
+
+    assert(ie->access == IOC_W);
+    assert(*arg_type == TYPE_PTR);
+    arg_type++;
+    assert(*arg_type == TYPE_STRUCT);
+    target_size = thunk_type_size(arg_type, 0);
+    argptr = lock_user(VERIFY_READ, arg, target_size, 1);
+    if (!argptr) {
+        return -TARGET_EFAULT;
+    }
+    arg_type++;
+    assert(*arg_type == (int)STRUCT_rtentry);
+    se = struct_entries + *arg_type++;
+    assert(se->convert[0] == NULL);
+    /* convert struct here to be able to catch rt_dev string */
+    field_types = se->field_types;
+    dst_offsets = se->field_offsets[THUNK_HOST];
+    src_offsets = se->field_offsets[THUNK_TARGET];
+    for (i = 0; i < se->nb_fields; i++) {
+        if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
+            assert(*field_types == TYPE_PTRVOID);
+            target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
+            host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
+            if (*target_rt_dev_ptr != 0) {
+                *host_rt_dev_ptr = (unsigned long)lock_user_string(
+                                                  tswapal(*target_rt_dev_ptr));
+                if (!*host_rt_dev_ptr) {
+                    unlock_user(argptr, arg, 0);
+                    return -TARGET_EFAULT;
+                }
+            } else {
+                *host_rt_dev_ptr = 0;
+            }
+            field_types++;
+            continue;
+        }
+        field_types = thunk_convert(buf_temp + dst_offsets[i],
+                                    argptr + src_offsets[i],
+                                    field_types, THUNK_HOST);
+    }
+    unlock_user(argptr, arg, 0);
+
+    ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
+    if (*host_rt_dev_ptr != 0) {
+        unlock_user((void *)*host_rt_dev_ptr,
+                    *target_rt_dev_ptr, 0);
+    }
+    return ret;
+}
+
 static IOCTLEntry ioctl_entries[] = {
 #define IOCTL(cmd, access, ...) \
     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
commit 463d8e7393681b300946d6bf9f9d5b7035d718c6
Author: Andreas Schwab <schwab at suse.de>
Date:   Tue Jul 2 14:04:12 2013 +0100

    linux-user: handle /proc/$$ like /proc/self
    
    Some applications use /proc/$$/... (where $$ is the own pid) instead of
    /proc/self/... to refer to their own proc files.  Extend the interception
    for open and readlink to handle this case.  Also, do the same interception
    in readlinkat.
    
    Signed-off-by: Andreas Schwab <schwab at suse.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index cdd0c28..ed2c930 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4973,6 +4973,30 @@ static int open_self_auxv(void *cpu_env, int fd)
     return 0;
 }
 
+static int is_proc_myself(const char *filename, const char *entry)
+{
+    if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
+        filename += strlen("/proc/");
+        if (!strncmp(filename, "self/", strlen("self/"))) {
+            filename += strlen("self/");
+        } else if (*filename >= '1' && *filename <= '9') {
+            char myself[80];
+            snprintf(myself, sizeof(myself), "%d/", getpid());
+            if (!strncmp(filename, myself, strlen(myself))) {
+                filename += strlen(myself);
+            } else {
+                return 0;
+            }
+        } else {
+            return 0;
+        }
+        if (!strcmp(filename, entry)) {
+            return 1;
+        }
+    }
+    return 0;
+}
+
 static int do_open(void *cpu_env, const char *pathname, int flags, mode_t mode)
 {
     struct fake_open {
@@ -4981,15 +5005,14 @@ static int do_open(void *cpu_env, const char *pathname, int flags, mode_t mode)
     };
     const struct fake_open *fake_open;
     static const struct fake_open fakes[] = {
-        { "/proc/self/maps", open_self_maps },
-        { "/proc/self/stat", open_self_stat },
-        { "/proc/self/auxv", open_self_auxv },
+        { "maps", open_self_maps },
+        { "stat", open_self_stat },
+        { "auxv", open_self_auxv },
         { NULL, NULL }
     };
 
     for (fake_open = fakes; fake_open->filename; fake_open++) {
-        if (!strncmp(pathname, fake_open->filename,
-                     strlen(fake_open->filename))) {
+        if (is_proc_myself(pathname, fake_open->filename)) {
             break;
         }
     }
@@ -6262,20 +6285,18 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
 #endif
     case TARGET_NR_readlink:
         {
-            void *p2, *temp;
+            void *p2;
             p = lock_user_string(arg1);
             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
-            if (!p || !p2)
+            if (!p || !p2) {
                 ret = -TARGET_EFAULT;
-            else {
-                if (strncmp((const char *)p, "/proc/self/exe", 14) == 0) {
-                    char real[PATH_MAX];
-                    temp = realpath(exec_path,real);
-                    ret = (temp==NULL) ? get_errno(-1) : strlen(real) ;
-                    snprintf((char *)p2, arg3, "%s", real);
-                    }
-                else
-                    ret = get_errno(readlink(path(p), p2, arg3));
+            } else if (is_proc_myself((const char *)p, "exe")) {
+                char real[PATH_MAX], *temp;
+                temp = realpath(exec_path, real);
+                ret = temp == NULL ? get_errno(-1) : strlen(real) ;
+                snprintf((char *)p2, arg3, "%s", real);
+            } else {
+                ret = get_errno(readlink(path(p), p2, arg3));
             }
             unlock_user(p2, arg2, ret);
             unlock_user(p, arg1, 0);
@@ -6287,10 +6308,16 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
             void *p2;
             p  = lock_user_string(arg2);
             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
-            if (!p || !p2)
-        	ret = -TARGET_EFAULT;
-            else
+            if (!p || !p2) {
+                ret = -TARGET_EFAULT;
+            } else if (is_proc_myself((const char *)p, "exe")) {
+                char real[PATH_MAX], *temp;
+                temp = realpath(exec_path, real);
+                ret = temp == NULL ? get_errno(-1) : strlen(real) ;
+                snprintf((char *)p2, arg4, "%s", real);
+            } else {
                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
+            }
             unlock_user(p2, arg3, ret);
             unlock_user(p, arg2, 0);
         }
commit 58fda173e1156d24e5ff62361774715152188a07
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Jul 2 15:36:25 2013 +0200

    block: fix bdrv_flush() ordering in bdrv_close()
    
    Since 80ccf93b we flush the block device during close.  The
    bdrv_drain_all() call should come before bdrv_flush() to ensure guest
    write requests have completed.  Otherwise we may miss pending writes
    when flushing.
    
    Call bdrv_drain_all() again for safety as the final step after
    bdrv_flush().  This should not be necessary but we can be paranoid here
    in case bdrv_flush() left I/O pending.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block.c b/block.c
index 6c493ad..183fec8 100644
--- a/block.c
+++ b/block.c
@@ -1358,11 +1358,12 @@ void bdrv_reopen_abort(BDRVReopenState *reopen_state)
 
 void bdrv_close(BlockDriverState *bs)
 {
-    bdrv_flush(bs);
     if (bs->job) {
         block_job_cancel_sync(bs->job);
     }
-    bdrv_drain_all();
+    bdrv_drain_all(); /* complete I/O */
+    bdrv_flush(bs);
+    bdrv_drain_all(); /* in case flush left pending I/O */
     notifier_list_notify(&bs->close_notifiers, bs);
 
     if (bs->drv) {
commit 3494d650273e619606c6cb2c38aa9b8b7bed98e2
Author: Fam Zheng <famz at redhat.com>
Date:   Tue Jul 2 15:19:21 2013 +0800

    curl: refuse to open URL from HTTP server without range support
    
    CURL driver requests partial data from server on guest IO req. For HTTP
    and HTTPS, it uses "Range: ***" in requests, and this will not work if
    server not accepting range. This patch does this check when open.
    
     * Removed curl_size_cb, which is not used: On one hand it's registered to
       libcurl as CURLOPT_WRITEFUNCTION, instead of CURLOPT_HEADERFUNCTION,
       which will get called with *data*, not *header*. On the other hand the
       s->len is assigned unconditionally later.
    
       In this gone function, the sscanf for "Content-Length: %zd", on
       (void *)ptr, which is not guaranteed to be zero-terminated, is
       potentially a security bug. So this patch fixes it as a side-effect. The
       bug is reported as: https://bugs.launchpad.net/qemu/+bug/1188943
       (Note the bug is marked "private" so you might not be able to see it)
    
     * Introduced curl_header_cb, which is used to parse header and mark the
       server as accepting range if "Accept-Ranges: bytes" line is seen from
       response header. If protocol is HTTP or HTTPS, but server response has
       no not this support, refuse to open this URL.
    
    Note that python builtin module SimpleHTTPServer is an example of not
    supporting range, if you need to test this driver, get a better server
    or use internet URLs.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/curl.c b/block/curl.c
index 6af8cb7..82d39ff 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -81,6 +81,7 @@ typedef struct BDRVCURLState {
     CURLState states[CURL_NUM_STATES];
     char *url;
     size_t readahead_size;
+    bool accept_range;
 } BDRVCURLState;
 
 static void curl_clean_state(CURLState *s);
@@ -110,14 +111,15 @@ static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
     return 0;
 }
 
-static size_t curl_size_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
+static size_t curl_header_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
 {
-    CURLState *s = ((CURLState*)opaque);
+    BDRVCURLState *s = opaque;
     size_t realsize = size * nmemb;
-    size_t fsize;
+    const char *accept_line = "Accept-Ranges: bytes";
 
-    if(sscanf(ptr, "Content-Length: %zd", &fsize) == 1) {
-        s->s->len = fsize;
+    if (realsize >= strlen(accept_line)
+        && strncmp((char *)ptr, accept_line, strlen(accept_line)) == 0) {
+        s->accept_range = true;
     }
 
     return realsize;
@@ -447,8 +449,11 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags)
 
     // Get file size
 
+    s->accept_range = false;
     curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1);
-    curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION, (void *)curl_size_cb);
+    curl_easy_setopt(state->curl, CURLOPT_HEADERFUNCTION,
+                     curl_header_cb);
+    curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s);
     if (curl_easy_perform(state->curl))
         goto out;
     curl_easy_getinfo(state->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &d);
@@ -456,6 +461,13 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags)
         s->len = (size_t)d;
     else if(!s->len)
         goto out;
+    if ((!strncasecmp(s->url, "http://", strlen("http://"))
+        || !strncasecmp(s->url, "https://", strlen("https://")))
+        && !s->accept_range) {
+        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
+                "Server does not support 'range' (byte ranges).");
+        goto out;
+    }
     DPRINTF("CURL: Size = %zd\n", s->len);
 
     curl_clean_state(state);
commit da7a50f938516d0f2302965eeb82940c32028ed8
Author: Fam Zheng <famz at redhat.com>
Date:   Mon Jul 1 11:33:17 2013 +0800

    vmdk: Implement .bdrv_has_zero_init
    
    Depending on the subformat, has_zero_init queries underlying storage for
    flat extent. If it has a flat extent and its underlying storage doesn't
    have zero init, return 0. Otherwise return 1.
    
    Aligns the operator assignments.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vmdk.c b/block/vmdk.c
index a28fb5e..3756333 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1724,6 +1724,23 @@ static int64_t vmdk_get_allocated_file_size(BlockDriverState *bs)
     return ret;
 }
 
+static int vmdk_has_zero_init(BlockDriverState *bs)
+{
+    int i;
+    BDRVVmdkState *s = bs->opaque;
+
+    /* If has a flat extent and its underlying storage doesn't have zero init,
+     * return 0. */
+    for (i = 0; i < s->num_extents; i++) {
+        if (s->extents[i].flat) {
+            if (!bdrv_has_zero_init(s->extents[i].file)) {
+                return 0;
+            }
+        }
+    }
+    return 1;
+}
+
 static QEMUOptionParameter vmdk_create_options[] = {
     {
         .name = BLOCK_OPT_SIZE,
@@ -1762,21 +1779,22 @@ static QEMUOptionParameter vmdk_create_options[] = {
 };
 
 static BlockDriver bdrv_vmdk = {
-    .format_name    = "vmdk",
-    .instance_size  = sizeof(BDRVVmdkState),
-    .bdrv_probe     = vmdk_probe,
-    .bdrv_open      = vmdk_open,
-    .bdrv_reopen_prepare = vmdk_reopen_prepare,
-    .bdrv_read      = vmdk_co_read,
-    .bdrv_write     = vmdk_co_write,
-    .bdrv_co_write_zeroes = vmdk_co_write_zeroes,
-    .bdrv_close     = vmdk_close,
-    .bdrv_create    = vmdk_create,
-    .bdrv_co_flush_to_disk  = vmdk_co_flush,
-    .bdrv_co_is_allocated   = vmdk_co_is_allocated,
-    .bdrv_get_allocated_file_size  = vmdk_get_allocated_file_size,
-
-    .create_options = vmdk_create_options,
+    .format_name                  = "vmdk",
+    .instance_size                = sizeof(BDRVVmdkState),
+    .bdrv_probe                   = vmdk_probe,
+    .bdrv_open                    = vmdk_open,
+    .bdrv_reopen_prepare          = vmdk_reopen_prepare,
+    .bdrv_read                    = vmdk_co_read,
+    .bdrv_write                   = vmdk_co_write,
+    .bdrv_co_write_zeroes         = vmdk_co_write_zeroes,
+    .bdrv_close                   = vmdk_close,
+    .bdrv_create                  = vmdk_create,
+    .bdrv_co_flush_to_disk        = vmdk_co_flush,
+    .bdrv_co_is_allocated         = vmdk_co_is_allocated,
+    .bdrv_get_allocated_file_size = vmdk_get_allocated_file_size,
+    .bdrv_has_zero_init           = vmdk_has_zero_init,
+
+    .create_options               = vmdk_create_options,
 };
 
 static void bdrv_vmdk_init(void)
commit c7086b4a237520d2bbe5146d8b1ace1894c2b2bf
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Sun Jun 2 15:27:39 2013 +0200

    exec: change some APIs to take AddressSpaceDispatch
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 7a6d969..03fdf7e 100644
--- a/exec.c
+++ b/exec.c
@@ -230,11 +230,10 @@ bool memory_region_is_unassigned(MemoryRegion *mr)
         && mr != &io_mem_watch;
 }
 
-static MemoryRegionSection *address_space_lookup_region(AddressSpace *as,
+static MemoryRegionSection *address_space_lookup_region(AddressSpaceDispatch *d,
                                                         hwaddr addr,
                                                         bool resolve_subpage)
 {
-    AddressSpaceDispatch *d = as->dispatch;
     MemoryRegionSection *section;
     subpage_t *subpage;
 
@@ -248,13 +247,13 @@ static MemoryRegionSection *address_space_lookup_region(AddressSpace *as,
 }
 
 static MemoryRegionSection *
-address_space_translate_internal(AddressSpace *as, hwaddr addr, hwaddr *xlat,
+address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *xlat,
                                  hwaddr *plen, bool resolve_subpage)
 {
     MemoryRegionSection *section;
     Int128 diff;
 
-    section = address_space_lookup_region(as, addr, resolve_subpage);
+    section = address_space_lookup_region(d, addr, resolve_subpage);
     /* Compute offset within MemoryRegionSection */
     addr -= section->offset_within_address_space;
 
@@ -276,7 +275,7 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,
     hwaddr len = *plen;
 
     for (;;) {
-        section = address_space_translate_internal(as, addr, &addr, plen, true);
+        section = address_space_translate_internal(as->dispatch, addr, &addr, plen, true);
         mr = section->mr;
 
         if (!mr->iommu_ops) {
@@ -305,7 +304,7 @@ address_space_translate_for_iotlb(AddressSpace *as, hwaddr addr, hwaddr *xlat,
                                   hwaddr *plen)
 {
     MemoryRegionSection *section;
-    section = address_space_translate_internal(as, addr, xlat, plen, false);
+    section = address_space_translate_internal(as->dispatch, addr, xlat, plen, false);
 
     assert(!section->mr->iommu_ops);
     return section;
commit 6092666ebdc68b2634db050689292c71a5c368c0
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed May 29 12:30:26 2013 +0200

    exec: remove cur_map
    
    cur_map is not used anymore; instead, each AddressSpaceDispatch
    has its own nodes/sections pair.  The priorities of the
    MemoryListeners, and in the future RCU, guarantee that the
    nodes/sections are not freed while they are still in use.
    
    (In fact, next_map itself is not needed except to free the data on the
    next update).
    
    To avoid incorrect use, replace cur_map with a temporary copy that
    is only valid while the topology is being updated.  If you use it,
    the name prev_map makes it clear that you're doing something weird.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 6d3492e..7a6d969 100644
--- a/exec.c
+++ b/exec.c
@@ -122,7 +122,7 @@ typedef struct PhysPageMap {
     MemoryRegionSection *sections;
 } PhysPageMap;
 
-static PhysPageMap cur_map;
+static PhysPageMap *prev_map;
 static PhysPageMap next_map;
 
 #define PHYS_MAP_NODE_NIL (((uint16_t)~0) >> 1)
@@ -790,7 +790,7 @@ static void phys_section_destroy(MemoryRegion *mr)
     }
 }
 
-static void phys_sections_clear(PhysPageMap *map)
+static void phys_sections_free(PhysPageMap *map)
 {
     while (map->sections_nb > 0) {
         MemoryRegionSection *section = &map->sections[--map->sections_nb];
@@ -798,6 +798,7 @@ static void phys_sections_clear(PhysPageMap *map)
     }
     g_free(map->sections);
     g_free(map->nodes);
+    g_free(map);
 }
 
 static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)
@@ -1731,6 +1732,9 @@ static void core_begin(MemoryListener *listener)
 {
     uint16_t n;
 
+    prev_map = g_new(PhysPageMap, 1);
+    *prev_map = next_map;
+
     memset(&next_map, 0, sizeof(next_map));
     n = dummy_section(&io_mem_unassigned);
     assert(n == PHYS_SECTION_UNASSIGNED);
@@ -1747,9 +1751,7 @@ static void core_begin(MemoryListener *listener)
  */
 static void core_commit(MemoryListener *listener)
 {
-    PhysPageMap info = cur_map;
-    cur_map = next_map;
-    phys_sections_clear(&info);
+    phys_sections_free(prev_map);
 }
 
 static void tcg_commit(MemoryListener *listener)
commit 0475d94fffe4e5fda59e0334b6dd53df00c5deb6
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed May 29 12:28:21 2013 +0200

    exec: put memory map in AddressSpaceDispatch
    
    After this patch, AddressSpaceDispatch holds a constistent tuple of
    (phys_map, nodes, sections).  This will be important when updates
    of the topology will run concurrently with reads.
    
    cur_map is not used anymore except for freeing it at the end of the
    topology update.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index bd05c40..6d3492e 100644
--- a/exec.c
+++ b/exec.c
@@ -88,11 +88,15 @@ struct PhysPageEntry {
     uint16_t ptr : 15;
 };
 
+typedef PhysPageEntry Node[L2_SIZE];
+
 struct AddressSpaceDispatch {
     /* This is a multi-level map on the physical address space.
      * The bottom level has pointers to MemoryRegionSections.
      */
     PhysPageEntry phys_map;
+    Node *nodes;
+    MemoryRegionSection *sections;
     AddressSpace *as;
 };
 
@@ -109,8 +113,6 @@ typedef struct subpage_t {
 #define PHYS_SECTION_ROM 2
 #define PHYS_SECTION_WATCH 3
 
-typedef PhysPageEntry Node[L2_SIZE];
-
 typedef struct PhysPageMap {
     unsigned sections_nb;
     unsigned sections_nb_alloc;
@@ -232,14 +234,15 @@ static MemoryRegionSection *address_space_lookup_region(AddressSpace *as,
                                                         hwaddr addr,
                                                         bool resolve_subpage)
 {
+    AddressSpaceDispatch *d = as->dispatch;
     MemoryRegionSection *section;
     subpage_t *subpage;
 
-    section = phys_page_find(as->dispatch->phys_map, addr >> TARGET_PAGE_BITS,
-                             cur_map.nodes, cur_map.sections);
+    section = phys_page_find(d->phys_map, addr >> TARGET_PAGE_BITS,
+                             d->nodes, d->sections);
     if (resolve_subpage && section->mr->subpage) {
         subpage = container_of(section->mr, subpage_t, iomem);
-        section = &cur_map.sections[subpage->sub_section[SUBPAGE_IDX(addr)]];
+        section = &d->sections[subpage->sub_section[SUBPAGE_IDX(addr)]];
     }
     return section;
 }
@@ -730,7 +733,7 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
             iotlb |= PHYS_SECTION_ROM;
         }
     } else {
-        iotlb = section - cur_map.sections;
+        iotlb = section - address_space_memory.dispatch->sections;
         iotlb += xlat;
     }
 
@@ -1687,7 +1690,7 @@ static uint16_t dummy_section(MemoryRegion *mr)
 
 MemoryRegion *iotlb_to_region(hwaddr index)
 {
-    return cur_map.sections[index & ~TARGET_PAGE_MASK].mr;
+    return address_space_memory.dispatch->sections[index & ~TARGET_PAGE_MASK].mr;
 }
 
 static void io_mem_init(void)
@@ -1714,11 +1717,14 @@ static void mem_begin(MemoryListener *listener)
 static void mem_commit(MemoryListener *listener)
 {
     AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
-    AddressSpaceDispatch *d = as->dispatch;
+    AddressSpaceDispatch *cur = as->dispatch;
+    AddressSpaceDispatch *next = as->next_dispatch;
 
-    /* cur_map will soon be switched to next_map, too.  */
-    as->dispatch = as->next_dispatch;
-    g_free(d);
+    next->nodes = next_map.nodes;
+    next->sections = next_map.sections;
+
+    as->dispatch = next;
+    g_free(cur);
 }
 
 static void core_begin(MemoryListener *listener)
commit 0075270317fbd37160bc40e481a1e9cb5cbdc2f6
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed May 29 12:13:54 2013 +0200

    exec: separate current radix tree from the one being built
    
    This same treatment previously done to phys_node_map and phys_sections
    is now applied to the dispatch field of AddressSpace.  Topology updates
    use as->next_dispatch while accesses use as->dispatch.
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 2eb279c..bd05c40 100644
--- a/exec.c
+++ b/exec.c
@@ -841,7 +841,7 @@ static void register_multipage(AddressSpaceDispatch *d,
 static void mem_add(MemoryListener *listener, MemoryRegionSection *section)
 {
     AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
-    AddressSpaceDispatch *d = as->dispatch;
+    AddressSpaceDispatch *d = as->next_dispatch;
     MemoryRegionSection now = *section, remain = *section;
     Int128 page_size = int128_make64(TARGET_PAGE_SIZE);
 
@@ -1704,9 +1704,21 @@ static void io_mem_init(void)
 static void mem_begin(MemoryListener *listener)
 {
     AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
+    AddressSpaceDispatch *d = g_new(AddressSpaceDispatch, 1);
+
+    d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .is_leaf = 0 };
+    d->as = as;
+    as->next_dispatch = d;
+}
+
+static void mem_commit(MemoryListener *listener)
+{
+    AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
     AddressSpaceDispatch *d = as->dispatch;
 
-    d->phys_map.ptr = PHYS_MAP_NODE_NIL;
+    /* cur_map will soon be switched to next_map, too.  */
+    as->dispatch = as->next_dispatch;
+    g_free(d);
 }
 
 static void core_begin(MemoryListener *listener)
@@ -1770,13 +1782,10 @@ static MemoryListener tcg_memory_listener = {
 
 void address_space_init_dispatch(AddressSpace *as)
 {
-    AddressSpaceDispatch *d = g_new(AddressSpaceDispatch, 1);
-
-    d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .is_leaf = 0 };
-    d->as = as;
-    as->dispatch = d;
+    as->dispatch = NULL;
     as->dispatch_listener = (MemoryListener) {
         .begin = mem_begin,
+        .commit = mem_commit,
         .region_add = mem_add,
         .region_nop = mem_add,
         .priority = 0,
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 248c89b..ebe0d24 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -209,6 +209,7 @@ struct AddressSpace {
     int ioeventfd_nb;
     struct MemoryRegionIoeventfd *ioeventfds;
     struct AddressSpaceDispatch *dispatch;
+    struct AddressSpaceDispatch *next_dispatch;
     MemoryListener dispatch_listener;
 
     QTAILQ_ENTRY(AddressSpace) address_spaces_link;
commit 89ae337acbe4dba5b2481007aec1277252d2b86c
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Sun Jun 2 10:39:07 2013 +0200

    exec: move listener from AddressSpaceDispatch to AddressSpace
    
    This will help having two copies of AddressSpaceDispatch during the
    recreation of the radix tree (one being built, and one that is complete
    and will be protected by RCU).  We do not want to have to unregister and
    re-register the listener.
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 598ac3a..2eb279c 100644
--- a/exec.c
+++ b/exec.c
@@ -93,7 +93,6 @@ struct AddressSpaceDispatch {
      * The bottom level has pointers to MemoryRegionSections.
      */
     PhysPageEntry phys_map;
-    MemoryListener listener;
     AddressSpace *as;
 };
 
@@ -841,7 +840,8 @@ static void register_multipage(AddressSpaceDispatch *d,
 
 static void mem_add(MemoryListener *listener, MemoryRegionSection *section)
 {
-    AddressSpaceDispatch *d = container_of(listener, AddressSpaceDispatch, listener);
+    AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
+    AddressSpaceDispatch *d = as->dispatch;
     MemoryRegionSection now = *section, remain = *section;
     Int128 page_size = int128_make64(TARGET_PAGE_SIZE);
 
@@ -1703,7 +1703,8 @@ static void io_mem_init(void)
 
 static void mem_begin(MemoryListener *listener)
 {
-    AddressSpaceDispatch *d = container_of(listener, AddressSpaceDispatch, listener);
+    AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
+    AddressSpaceDispatch *d = as->dispatch;
 
     d->phys_map.ptr = PHYS_MAP_NODE_NIL;
 }
@@ -1772,22 +1773,22 @@ void address_space_init_dispatch(AddressSpace *as)
     AddressSpaceDispatch *d = g_new(AddressSpaceDispatch, 1);
 
     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .is_leaf = 0 };
-    d->listener = (MemoryListener) {
+    d->as = as;
+    as->dispatch = d;
+    as->dispatch_listener = (MemoryListener) {
         .begin = mem_begin,
         .region_add = mem_add,
         .region_nop = mem_add,
         .priority = 0,
     };
-    d->as = as;
-    as->dispatch = d;
-    memory_listener_register(&d->listener, as);
+    memory_listener_register(&as->dispatch_listener, as);
 }
 
 void address_space_destroy_dispatch(AddressSpace *as)
 {
     AddressSpaceDispatch *d = as->dispatch;
 
-    memory_listener_unregister(&d->listener);
+    memory_listener_unregister(&as->dispatch_listener);
     g_free(d);
     as->dispatch = NULL;
 }
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 8355bdb..248c89b 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -209,6 +209,8 @@ struct AddressSpace {
     int ioeventfd_nb;
     struct MemoryRegionIoeventfd *ioeventfds;
     struct AddressSpaceDispatch *dispatch;
+    MemoryListener dispatch_listener;
+
     QTAILQ_ENTRY(AddressSpace) address_spaces_link;
 };
 
commit c2fc83e83d4fbc6f63b2b0f0be898374e6ddc78f
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Sun Jun 2 15:20:47 2013 +0200

    memory: move MemoryListener declaration earlier
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/exec/memory.h b/include/exec/memory.h
index c8d0bf4..8355bdb 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -165,6 +165,39 @@ struct MemoryRegion {
     NotifierList iommu_notify;
 };
 
+typedef struct MemoryListener MemoryListener;
+
+/**
+ * MemoryListener: callbacks structure for updates to the physical memory map
+ *
+ * Allows a component to adjust to changes in the guest-visible memory map.
+ * Use with memory_listener_register() and memory_listener_unregister().
+ */
+struct MemoryListener {
+    void (*begin)(MemoryListener *listener);
+    void (*commit)(MemoryListener *listener);
+    void (*region_add)(MemoryListener *listener, MemoryRegionSection *section);
+    void (*region_del)(MemoryListener *listener, MemoryRegionSection *section);
+    void (*region_nop)(MemoryListener *listener, MemoryRegionSection *section);
+    void (*log_start)(MemoryListener *listener, MemoryRegionSection *section);
+    void (*log_stop)(MemoryListener *listener, MemoryRegionSection *section);
+    void (*log_sync)(MemoryListener *listener, MemoryRegionSection *section);
+    void (*log_global_start)(MemoryListener *listener);
+    void (*log_global_stop)(MemoryListener *listener);
+    void (*eventfd_add)(MemoryListener *listener, MemoryRegionSection *section,
+                        bool match_data, uint64_t data, EventNotifier *e);
+    void (*eventfd_del)(MemoryListener *listener, MemoryRegionSection *section,
+                        bool match_data, uint64_t data, EventNotifier *e);
+    void (*coalesced_mmio_add)(MemoryListener *listener, MemoryRegionSection *section,
+                               hwaddr addr, hwaddr len);
+    void (*coalesced_mmio_del)(MemoryListener *listener, MemoryRegionSection *section,
+                               hwaddr addr, hwaddr len);
+    /* Lower = earlier (during add), later (during del) */
+    unsigned priority;
+    AddressSpace *address_space_filter;
+    QTAILQ_ENTRY(MemoryListener) link;
+};
+
 /**
  * AddressSpace: describes a mapping of addresses to #MemoryRegion objects
  */
@@ -199,39 +232,6 @@ struct MemoryRegionSection {
     bool readonly;
 };
 
-typedef struct MemoryListener MemoryListener;
-
-/**
- * MemoryListener: callbacks structure for updates to the physical memory map
- *
- * Allows a component to adjust to changes in the guest-visible memory map.
- * Use with memory_listener_register() and memory_listener_unregister().
- */
-struct MemoryListener {
-    void (*begin)(MemoryListener *listener);
-    void (*commit)(MemoryListener *listener);
-    void (*region_add)(MemoryListener *listener, MemoryRegionSection *section);
-    void (*region_del)(MemoryListener *listener, MemoryRegionSection *section);
-    void (*region_nop)(MemoryListener *listener, MemoryRegionSection *section);
-    void (*log_start)(MemoryListener *listener, MemoryRegionSection *section);
-    void (*log_stop)(MemoryListener *listener, MemoryRegionSection *section);
-    void (*log_sync)(MemoryListener *listener, MemoryRegionSection *section);
-    void (*log_global_start)(MemoryListener *listener);
-    void (*log_global_stop)(MemoryListener *listener);
-    void (*eventfd_add)(MemoryListener *listener, MemoryRegionSection *section,
-                        bool match_data, uint64_t data, EventNotifier *e);
-    void (*eventfd_del)(MemoryListener *listener, MemoryRegionSection *section,
-                        bool match_data, uint64_t data, EventNotifier *e);
-    void (*coalesced_mmio_add)(MemoryListener *listener, MemoryRegionSection *section,
-                               hwaddr addr, hwaddr len);
-    void (*coalesced_mmio_del)(MemoryListener *listener, MemoryRegionSection *section,
-                               hwaddr addr, hwaddr len);
-    /* Lower = earlier (during add), later (during del) */
-    unsigned priority;
-    AddressSpace *address_space_filter;
-    QTAILQ_ENTRY(MemoryListener) link;
-};
-
 /**
  * memory_region_init: Initialize a memory region
  *
commit 9affd6fc0e7904fb36d58d1992bbd7cae3649197
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed May 29 12:09:47 2013 +0200

    exec: separate current memory map from the one being built
    
    Currently, phys_node_map and phys_sections are shared by all
    of the AddressSpaceDispatch.  When updating mem topology, all
    AddressSpaceDispatch will rebuild dispatch tables sequentially
    on them.  In order to prepare for RCU access, leave the old
    memory map alive while the next one is being accessed.
    
    When rebuilding, the new dispatch tables will build and lookup
    next_map; after all dispatch tables are rebuilt, we can switch
    to next_* and free the previous table.
    
    Based on a patch from Liu Ping Fan.
    
    Signed-off-by: Liu Ping Fan <qemulist at gmail.com>
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index ada2ff2..598ac3a 100644
--- a/exec.c
+++ b/exec.c
@@ -105,16 +105,24 @@ typedef struct subpage_t {
     uint16_t sub_section[TARGET_PAGE_SIZE];
 } subpage_t;
 
-static MemoryRegionSection *phys_sections;
-static unsigned phys_sections_nb, phys_sections_nb_alloc;
 #define PHYS_SECTION_UNASSIGNED 0
 #define PHYS_SECTION_NOTDIRTY 1
 #define PHYS_SECTION_ROM 2
 #define PHYS_SECTION_WATCH 3
 
-/* Simple allocator for PhysPageEntry nodes */
-static PhysPageEntry (*phys_map_nodes)[L2_SIZE];
-static unsigned phys_map_nodes_nb, phys_map_nodes_nb_alloc;
+typedef PhysPageEntry Node[L2_SIZE];
+
+typedef struct PhysPageMap {
+    unsigned sections_nb;
+    unsigned sections_nb_alloc;
+    unsigned nodes_nb;
+    unsigned nodes_nb_alloc;
+    Node *nodes;
+    MemoryRegionSection *sections;
+} PhysPageMap;
+
+static PhysPageMap cur_map;
+static PhysPageMap next_map;
 
 #define PHYS_MAP_NODE_NIL (((uint16_t)~0) >> 1)
 
@@ -129,13 +137,13 @@ static MemoryRegion io_mem_watch;
 
 static void phys_map_node_reserve(unsigned nodes)
 {
-    if (phys_map_nodes_nb + nodes > phys_map_nodes_nb_alloc) {
-        typedef PhysPageEntry Node[L2_SIZE];
-        phys_map_nodes_nb_alloc = MAX(phys_map_nodes_nb_alloc * 2, 16);
-        phys_map_nodes_nb_alloc = MAX(phys_map_nodes_nb_alloc,
-                                      phys_map_nodes_nb + nodes);
-        phys_map_nodes = g_renew(Node, phys_map_nodes,
-                                 phys_map_nodes_nb_alloc);
+    if (next_map.nodes_nb + nodes > next_map.nodes_nb_alloc) {
+        next_map.nodes_nb_alloc = MAX(next_map.nodes_nb_alloc * 2,
+                                            16);
+        next_map.nodes_nb_alloc = MAX(next_map.nodes_nb_alloc,
+                                      next_map.nodes_nb + nodes);
+        next_map.nodes = g_renew(Node, next_map.nodes,
+                                 next_map.nodes_nb_alloc);
     }
 }
 
@@ -144,12 +152,12 @@ static uint16_t phys_map_node_alloc(void)
     unsigned i;
     uint16_t ret;
 
-    ret = phys_map_nodes_nb++;
+    ret = next_map.nodes_nb++;
     assert(ret != PHYS_MAP_NODE_NIL);
-    assert(ret != phys_map_nodes_nb_alloc);
+    assert(ret != next_map.nodes_nb_alloc);
     for (i = 0; i < L2_SIZE; ++i) {
-        phys_map_nodes[ret][i].is_leaf = 0;
-        phys_map_nodes[ret][i].ptr = PHYS_MAP_NODE_NIL;
+        next_map.nodes[ret][i].is_leaf = 0;
+        next_map.nodes[ret][i].ptr = PHYS_MAP_NODE_NIL;
     }
     return ret;
 }
@@ -164,7 +172,7 @@ static void phys_page_set_level(PhysPageEntry *lp, hwaddr *index,
 
     if (!lp->is_leaf && lp->ptr == PHYS_MAP_NODE_NIL) {
         lp->ptr = phys_map_node_alloc();
-        p = phys_map_nodes[lp->ptr];
+        p = next_map.nodes[lp->ptr];
         if (level == 0) {
             for (i = 0; i < L2_SIZE; i++) {
                 p[i].is_leaf = 1;
@@ -172,7 +180,7 @@ static void phys_page_set_level(PhysPageEntry *lp, hwaddr *index,
             }
         }
     } else {
-        p = phys_map_nodes[lp->ptr];
+        p = next_map.nodes[lp->ptr];
     }
     lp = &p[(*index >> (level * L2_BITS)) & (L2_SIZE - 1)];
 
@@ -199,20 +207,20 @@ static void phys_page_set(AddressSpaceDispatch *d,
     phys_page_set_level(&d->phys_map, &index, &nb, leaf, P_L2_LEVELS - 1);
 }
 
-static MemoryRegionSection *phys_page_find(AddressSpaceDispatch *d, hwaddr index)
+static MemoryRegionSection *phys_page_find(PhysPageEntry lp, hwaddr index,
+                                           Node *nodes, MemoryRegionSection *sections)
 {
-    PhysPageEntry lp = d->phys_map;
     PhysPageEntry *p;
     int i;
 
     for (i = P_L2_LEVELS - 1; i >= 0 && !lp.is_leaf; i--) {
         if (lp.ptr == PHYS_MAP_NODE_NIL) {
-            return &phys_sections[PHYS_SECTION_UNASSIGNED];
+            return &sections[PHYS_SECTION_UNASSIGNED];
         }
-        p = phys_map_nodes[lp.ptr];
+        p = nodes[lp.ptr];
         lp = p[(index >> (i * L2_BITS)) & (L2_SIZE - 1)];
     }
-    return &phys_sections[lp.ptr];
+    return &sections[lp.ptr];
 }
 
 bool memory_region_is_unassigned(MemoryRegion *mr)
@@ -228,10 +236,11 @@ static MemoryRegionSection *address_space_lookup_region(AddressSpace *as,
     MemoryRegionSection *section;
     subpage_t *subpage;
 
-    section = phys_page_find(as->dispatch, addr >> TARGET_PAGE_BITS);
+    section = phys_page_find(as->dispatch->phys_map, addr >> TARGET_PAGE_BITS,
+                             cur_map.nodes, cur_map.sections);
     if (resolve_subpage && section->mr->subpage) {
         subpage = container_of(section->mr, subpage_t, iomem);
-        section = &phys_sections[subpage->sub_section[SUBPAGE_IDX(addr)]];
+        section = &cur_map.sections[subpage->sub_section[SUBPAGE_IDX(addr)]];
     }
     return section;
 }
@@ -722,7 +731,7 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
             iotlb |= PHYS_SECTION_ROM;
         }
     } else {
-        iotlb = section - phys_sections;
+        iotlb = section - cur_map.sections;
         iotlb += xlat;
     }
 
@@ -755,16 +764,17 @@ static uint16_t phys_section_add(MemoryRegionSection *section)
      * pointer to produce the iotlb entries.  Thus it should
      * never overflow into the page-aligned value.
      */
-    assert(phys_sections_nb < TARGET_PAGE_SIZE);
+    assert(next_map.sections_nb < TARGET_PAGE_SIZE);
 
-    if (phys_sections_nb == phys_sections_nb_alloc) {
-        phys_sections_nb_alloc = MAX(phys_sections_nb_alloc * 2, 16);
-        phys_sections = g_renew(MemoryRegionSection, phys_sections,
-                                phys_sections_nb_alloc);
+    if (next_map.sections_nb == next_map.sections_nb_alloc) {
+        next_map.sections_nb_alloc = MAX(next_map.sections_nb_alloc * 2,
+                                         16);
+        next_map.sections = g_renew(MemoryRegionSection, next_map.sections,
+                                    next_map.sections_nb_alloc);
     }
-    phys_sections[phys_sections_nb] = *section;
+    next_map.sections[next_map.sections_nb] = *section;
     memory_region_ref(section->mr);
-    return phys_sections_nb++;
+    return next_map.sections_nb++;
 }
 
 static void phys_section_destroy(MemoryRegion *mr)
@@ -778,13 +788,14 @@ static void phys_section_destroy(MemoryRegion *mr)
     }
 }
 
-static void phys_sections_clear(void)
+static void phys_sections_clear(PhysPageMap *map)
 {
-    while (phys_sections_nb > 0) {
-        MemoryRegionSection *section = &phys_sections[--phys_sections_nb];
+    while (map->sections_nb > 0) {
+        MemoryRegionSection *section = &map->sections[--map->sections_nb];
         phys_section_destroy(section->mr);
     }
-    phys_map_nodes_nb = 0;
+    g_free(map->sections);
+    g_free(map->nodes);
 }
 
 static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)
@@ -792,7 +803,8 @@ static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *secti
     subpage_t *subpage;
     hwaddr base = section->offset_within_address_space
         & TARGET_PAGE_MASK;
-    MemoryRegionSection *existing = phys_page_find(d, base >> TARGET_PAGE_BITS);
+    MemoryRegionSection *existing = phys_page_find(d->phys_map, base >> TARGET_PAGE_BITS,
+                                                   next_map.nodes, next_map.sections);
     MemoryRegionSection subsection = {
         .offset_within_address_space = base,
         .size = int128_make64(TARGET_PAGE_SIZE),
@@ -1675,7 +1687,7 @@ static uint16_t dummy_section(MemoryRegion *mr)
 
 MemoryRegion *iotlb_to_region(hwaddr index)
 {
-    return phys_sections[index & ~TARGET_PAGE_MASK].mr;
+    return cur_map.sections[index & ~TARGET_PAGE_MASK].mr;
 }
 
 static void io_mem_init(void)
@@ -1700,7 +1712,7 @@ static void core_begin(MemoryListener *listener)
 {
     uint16_t n;
 
-    phys_sections_clear();
+    memset(&next_map, 0, sizeof(next_map));
     n = dummy_section(&io_mem_unassigned);
     assert(n == PHYS_SECTION_UNASSIGNED);
     n = dummy_section(&io_mem_notdirty);
@@ -1711,6 +1723,16 @@ static void core_begin(MemoryListener *listener)
     assert(n == PHYS_SECTION_WATCH);
 }
 
+/* This listener's commit run after the other AddressSpaceDispatch listeners'.
+ * All AddressSpaceDispatch instances have switched to the next map.
+ */
+static void core_commit(MemoryListener *listener)
+{
+    PhysPageMap info = cur_map;
+    cur_map = next_map;
+    phys_sections_clear(&info);
+}
+
 static void tcg_commit(MemoryListener *listener)
 {
     CPUArchState *env;
@@ -1735,6 +1757,7 @@ static void core_log_global_stop(MemoryListener *listener)
 
 static MemoryListener core_memory_listener = {
     .begin = core_begin,
+    .commit = core_commit,
     .log_global_start = core_log_global_start,
     .log_global_stop = core_log_global_stop,
     .priority = 1,
commit b41aac4f0d17000babd815e088699d58e59917b8
Author: Liu Ping Fan <qemulist at gmail.com>
Date:   Wed May 29 11:09:17 2013 +0200

    exec: change well-known physical sections to macros
    
    Sections like phys_section_unassigned always have fixed address
    in phys_sections.  Declared as macro, so we can use them
    when having more than one phys_sections array.
    
    Signed-off-by: Liu Ping Fan <pingfank at linux.vnet.ibm.com>
    Signed-off-by: Liu Ping Fan <qemulist at gmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index b339c23..ada2ff2 100644
--- a/exec.c
+++ b/exec.c
@@ -107,10 +107,10 @@ typedef struct subpage_t {
 
 static MemoryRegionSection *phys_sections;
 static unsigned phys_sections_nb, phys_sections_nb_alloc;
-static uint16_t phys_section_unassigned;
-static uint16_t phys_section_notdirty;
-static uint16_t phys_section_rom;
-static uint16_t phys_section_watch;
+#define PHYS_SECTION_UNASSIGNED 0
+#define PHYS_SECTION_NOTDIRTY 1
+#define PHYS_SECTION_ROM 2
+#define PHYS_SECTION_WATCH 3
 
 /* Simple allocator for PhysPageEntry nodes */
 static PhysPageEntry (*phys_map_nodes)[L2_SIZE];
@@ -168,7 +168,7 @@ static void phys_page_set_level(PhysPageEntry *lp, hwaddr *index,
         if (level == 0) {
             for (i = 0; i < L2_SIZE; i++) {
                 p[i].is_leaf = 1;
-                p[i].ptr = phys_section_unassigned;
+                p[i].ptr = PHYS_SECTION_UNASSIGNED;
             }
         }
     } else {
@@ -207,7 +207,7 @@ static MemoryRegionSection *phys_page_find(AddressSpaceDispatch *d, hwaddr index
 
     for (i = P_L2_LEVELS - 1; i >= 0 && !lp.is_leaf; i--) {
         if (lp.ptr == PHYS_MAP_NODE_NIL) {
-            return &phys_sections[phys_section_unassigned];
+            return &phys_sections[PHYS_SECTION_UNASSIGNED];
         }
         p = phys_map_nodes[lp.ptr];
         lp = p[(index >> (i * L2_BITS)) & (L2_SIZE - 1)];
@@ -717,9 +717,9 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
         iotlb = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
             + xlat;
         if (!section->readonly) {
-            iotlb |= phys_section_notdirty;
+            iotlb |= PHYS_SECTION_NOTDIRTY;
         } else {
-            iotlb |= phys_section_rom;
+            iotlb |= PHYS_SECTION_ROM;
         }
     } else {
         iotlb = section - phys_sections;
@@ -732,7 +732,7 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
         if (vaddr == (wp->vaddr & TARGET_PAGE_MASK)) {
             /* Avoid trapping reads of pages with a write breakpoint. */
             if ((prot & PAGE_WRITE) || (wp->flags & BP_MEM_READ)) {
-                iotlb = phys_section_watch + paddr;
+                iotlb = PHYS_SECTION_WATCH + paddr;
                 *address |= TLB_MMIO;
                 break;
             }
@@ -1656,7 +1656,7 @@ static subpage_t *subpage_init(AddressSpace *as, hwaddr base)
     printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
            mmio, base, TARGET_PAGE_SIZE, subpage_memory);
 #endif
-    subpage_register(mmio, 0, TARGET_PAGE_SIZE-1, phys_section_unassigned);
+    subpage_register(mmio, 0, TARGET_PAGE_SIZE-1, PHYS_SECTION_UNASSIGNED);
 
     return mmio;
 }
@@ -1698,11 +1698,17 @@ static void mem_begin(MemoryListener *listener)
 
 static void core_begin(MemoryListener *listener)
 {
+    uint16_t n;
+
     phys_sections_clear();
-    phys_section_unassigned = dummy_section(&io_mem_unassigned);
-    phys_section_notdirty = dummy_section(&io_mem_notdirty);
-    phys_section_rom = dummy_section(&io_mem_rom);
-    phys_section_watch = dummy_section(&io_mem_watch);
+    n = dummy_section(&io_mem_unassigned);
+    assert(n == PHYS_SECTION_UNASSIGNED);
+    n = dummy_section(&io_mem_notdirty);
+    assert(n == PHYS_SECTION_NOTDIRTY);
+    n = dummy_section(&io_mem_rom);
+    assert(n == PHYS_SECTION_ROM);
+    n = dummy_section(&io_mem_watch);
+    assert(n == PHYS_SECTION_WATCH);
 }
 
 static void tcg_commit(MemoryListener *listener)
commit f08c03f3c404e85a2b81890191ccb48dc1ecc157
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Tue Jul 2 11:36:39 2013 +0200

    qom: Use atomics for object refcounting
    
    Object reference counts will soon be changed outside the BQL. So we need
    to use atomics in object_ref/unref.
    
    Based on a patch by Liu Ping Fan.
    
    Signed-off-by: Liu Ping Fan <qemulist at gmail.com>
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/qom/object.c b/qom/object.c
index 803b94b..cbd7e86 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -683,16 +683,15 @@ GSList *object_class_get_list(const char *implements_type,
 
 void object_ref(Object *obj)
 {
-    obj->ref++;
+     atomic_inc(&obj->ref);
 }
 
 void object_unref(Object *obj)
 {
     g_assert(obj->ref > 0);
-    obj->ref--;
 
     /* parent always holds a reference to its children */
-    if (obj->ref == 0) {
+    if (atomic_fetch_dec(&obj->ref) == 1) {
         object_finalize(obj);
     }
 }
commit 856d72454f03aea26fd61c728762ef9cd1d71512
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 6 11:57:21 2013 +0200

    memory: add reference counting to FlatView
    
    With this change, a FlatView can be used even after a concurrent
    update has replaced it.  Because we do not yet have RCU, we use a
    mutex to protect the small critical sections that read/write the
    as->current_map pointer.  Accesses to the FlatView can be done
    outside the mutex.
    
    If a MemoryRegion will be used after the FlatView is unref-ed (or after
    a MemoryListener callback is returned), a reference has to be added to
    that MemoryRegion. memory_region_find already does it for the region
    that it returns.  The same will be done for address_space_translate
    as soon as the dispatch tree is also converted to RCU-style.
    
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/memory.c b/memory.c
index 2774cc8..35553b5 100644
--- a/memory.c
+++ b/memory.c
@@ -29,12 +29,26 @@ static unsigned memory_region_transaction_depth;
 static bool memory_region_update_pending;
 static bool global_dirty_log = false;
 
+/* flat_view_mutex is taken around reading as->current_map; the critical
+ * section is extremely short, so I'm using a single mutex for every AS.
+ * We could also RCU for the read-side.
+ *
+ * The BQL is taken around transaction commits, hence both locks are taken
+ * while writing to as->current_map (with the BQL taken outside).
+ */
+static QemuMutex flat_view_mutex;
+
 static QTAILQ_HEAD(memory_listeners, MemoryListener) memory_listeners
     = QTAILQ_HEAD_INITIALIZER(memory_listeners);
 
 static QTAILQ_HEAD(, AddressSpace) address_spaces
     = QTAILQ_HEAD_INITIALIZER(address_spaces);
 
+static void memory_init(void)
+{
+    qemu_mutex_init(&flat_view_mutex);
+}
+
 typedef struct AddrRange AddrRange;
 
 /*
@@ -225,6 +239,7 @@ struct FlatRange {
  * order.
  */
 struct FlatView {
+    unsigned ref;
     FlatRange *ranges;
     unsigned nr;
     unsigned nr_allocated;
@@ -246,6 +261,7 @@ static bool flatrange_equal(FlatRange *a, FlatRange *b)
 
 static void flatview_init(FlatView *view)
 {
+    view->ref = 1;
     view->ranges = NULL;
     view->nr = 0;
     view->nr_allocated = 0;
@@ -279,6 +295,18 @@ static void flatview_destroy(FlatView *view)
     g_free(view);
 }
 
+static void flatview_ref(FlatView *view)
+{
+    atomic_inc(&view->ref);
+}
+
+static void flatview_unref(FlatView *view)
+{
+    if (atomic_fetch_dec(&view->ref) == 1) {
+        flatview_destroy(view);
+    }
+}
+
 static bool can_merge(FlatRange *r1, FlatRange *r2)
 {
     return int128_eq(addrrange_end(r1->addr), r2->addr.start)
@@ -578,6 +606,17 @@ static void address_space_add_del_ioeventfds(AddressSpace *as,
     }
 }
 
+static FlatView *address_space_get_flatview(AddressSpace *as)
+{
+    FlatView *view;
+
+    qemu_mutex_lock(&flat_view_mutex);
+    view = as->current_map;
+    flatview_ref(view);
+    qemu_mutex_unlock(&flat_view_mutex);
+    return view;
+}
+
 static void address_space_update_ioeventfds(AddressSpace *as)
 {
     FlatView *view;
@@ -587,7 +626,7 @@ static void address_space_update_ioeventfds(AddressSpace *as)
     AddrRange tmp;
     unsigned i;
 
-    view = as->current_map;
+    view = address_space_get_flatview(as);
     FOR_EACH_FLAT_RANGE(fr, view) {
         for (i = 0; i < fr->mr->ioeventfd_nb; ++i) {
             tmp = addrrange_shift(fr->mr->ioeventfds[i].addr,
@@ -609,6 +648,7 @@ static void address_space_update_ioeventfds(AddressSpace *as)
     g_free(as->ioeventfds);
     as->ioeventfds = ioeventfds;
     as->ioeventfd_nb = ioeventfd_nb;
+    flatview_unref(view);
 }
 
 static void address_space_update_topology_pass(AddressSpace *as,
@@ -676,14 +716,25 @@ static void address_space_update_topology_pass(AddressSpace *as,
 
 static void address_space_update_topology(AddressSpace *as)
 {
-    FlatView *old_view = as->current_map;
+    FlatView *old_view = address_space_get_flatview(as);
     FlatView *new_view = generate_memory_topology(as->root);
 
     address_space_update_topology_pass(as, old_view, new_view, false);
     address_space_update_topology_pass(as, old_view, new_view, true);
 
+    qemu_mutex_lock(&flat_view_mutex);
+    flatview_unref(as->current_map);
     as->current_map = new_view;
-    flatview_destroy(old_view);
+    qemu_mutex_unlock(&flat_view_mutex);
+
+    /* Note that all the old MemoryRegions are still alive up to this
+     * point.  This relieves most MemoryListeners from the need to
+     * ref/unref the MemoryRegions they get---unless they use them
+     * outside the iothread mutex, in which case precise reference
+     * counting is necessary.
+     */
+    flatview_unref(old_view);
+
     address_space_update_ioeventfds(as);
 }
 
@@ -1148,12 +1199,13 @@ void memory_region_sync_dirty_bitmap(MemoryRegion *mr)
     FlatRange *fr;
 
     QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {
-        FlatView *view = as->current_map;
+        FlatView *view = address_space_get_flatview(as);
         FOR_EACH_FLAT_RANGE(fr, view) {
             if (fr->mr == mr) {
                 MEMORY_LISTENER_UPDATE_REGION(fr, as, Forward, log_sync);
             }
         }
+        flatview_unref(view);
     }
 }
 
@@ -1205,7 +1257,7 @@ static void memory_region_update_coalesced_range_as(MemoryRegion *mr, AddressSpa
     AddrRange tmp;
     MemoryRegionSection section;
 
-    view = as->current_map;
+    view = address_space_get_flatview(as);
     FOR_EACH_FLAT_RANGE(fr, view) {
         if (fr->mr == mr) {
             section = (MemoryRegionSection) {
@@ -1231,6 +1283,7 @@ static void memory_region_update_coalesced_range_as(MemoryRegion *mr, AddressSpa
             }
         }
     }
+    flatview_unref(view);
 }
 
 static void memory_region_update_coalesced_range(MemoryRegion *mr)
@@ -1532,7 +1585,7 @@ MemoryRegionSection memory_region_find(MemoryRegion *mr,
     as = memory_region_to_address_space(root);
     range = addrrange_make(int128_make64(addr), int128_make64(size));
 
-    view = as->current_map;
+    view = address_space_get_flatview(as);
     fr = flatview_lookup(view, range);
     if (!fr) {
         return ret;
@@ -1553,6 +1606,7 @@ MemoryRegionSection memory_region_find(MemoryRegion *mr,
     ret.readonly = fr->readonly;
     memory_region_ref(ret.mr);
 
+    flatview_unref(view);
     return ret;
 }
 
@@ -1561,10 +1615,11 @@ void address_space_sync_dirty_bitmap(AddressSpace *as)
     FlatView *view;
     FlatRange *fr;
 
-    view = as->current_map;
+    view = address_space_get_flatview(as);
     FOR_EACH_FLAT_RANGE(fr, view) {
         MEMORY_LISTENER_UPDATE_REGION(fr, as, Forward, log_sync);
     }
+    flatview_unref(view);
 }
 
 void memory_global_dirty_log_start(void)
@@ -1596,7 +1651,7 @@ static void listener_add_address_space(MemoryListener *listener,
         }
     }
 
-    view = as->current_map;
+    view = address_space_get_flatview(as);
     FOR_EACH_FLAT_RANGE(fr, view) {
         MemoryRegionSection section = {
             .mr = fr->mr,
@@ -1610,6 +1665,7 @@ static void listener_add_address_space(MemoryListener *listener,
             listener->region_add(listener, &section);
         }
     }
+    flatview_unref(view);
 }
 
 void memory_listener_register(MemoryListener *listener, AddressSpace *filter)
@@ -1643,6 +1699,10 @@ void memory_listener_unregister(MemoryListener *listener)
 
 void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name)
 {
+    if (QTAILQ_EMPTY(&address_spaces)) {
+        memory_init();
+    }
+
     memory_region_transaction_begin();
     as->root = root;
     as->current_map = g_new(FlatView, 1);
@@ -1664,9 +1724,8 @@ void address_space_destroy(AddressSpace *as)
     memory_region_transaction_commit();
     QTAILQ_REMOVE(&address_spaces, as, address_spaces_link);
     address_space_destroy_dispatch(as);
-    flatview_destroy(as->current_map);
+    flatview_unref(as->current_map);
     g_free(as->name);
-    g_free(as->current_map);
     g_free(as->ioeventfds);
 }
 
commit a9a0c06dd750cca982f21089099207874b960656
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 6 10:29:07 2013 +0200

    memory: use a new FlatView pointer on every topology update
    
    This is the first step towards converting as->current_map to
    RCU-style updates, where the FlatView updates run concurrently
    with uses of an old FlatView.
    
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/memory.c b/memory.c
index 4449462..2774cc8 100644
--- a/memory.c
+++ b/memory.c
@@ -276,6 +276,7 @@ static void flatview_destroy(FlatView *view)
         memory_region_unref(view->ranges[i].mr);
     }
     g_free(view->ranges);
+    g_free(view);
 }
 
 static bool can_merge(FlatRange *r1, FlatRange *r2)
@@ -512,17 +513,18 @@ static void render_memory_region(FlatView *view,
 }
 
 /* Render a memory topology into a list of disjoint absolute ranges. */
-static FlatView generate_memory_topology(MemoryRegion *mr)
+static FlatView *generate_memory_topology(MemoryRegion *mr)
 {
-    FlatView view;
+    FlatView *view;
 
-    flatview_init(&view);
+    view = g_new(FlatView, 1);
+    flatview_init(view);
 
     if (mr) {
-        render_memory_region(&view, mr, int128_zero(),
+        render_memory_region(view, mr, int128_zero(),
                              addrrange_make(int128_zero(), int128_2_64()), false);
     }
-    flatview_simplify(&view);
+    flatview_simplify(view);
 
     return view;
 }
@@ -610,8 +612,8 @@ static void address_space_update_ioeventfds(AddressSpace *as)
 }
 
 static void address_space_update_topology_pass(AddressSpace *as,
-                                               FlatView old_view,
-                                               FlatView new_view,
+                                               const FlatView *old_view,
+                                               const FlatView *new_view,
                                                bool adding)
 {
     unsigned iold, inew;
@@ -621,14 +623,14 @@ static void address_space_update_topology_pass(AddressSpace *as,
      * Kill ranges in the old map, and instantiate ranges in the new map.
      */
     iold = inew = 0;
-    while (iold < old_view.nr || inew < new_view.nr) {
-        if (iold < old_view.nr) {
-            frold = &old_view.ranges[iold];
+    while (iold < old_view->nr || inew < new_view->nr) {
+        if (iold < old_view->nr) {
+            frold = &old_view->ranges[iold];
         } else {
             frold = NULL;
         }
-        if (inew < new_view.nr) {
-            frnew = &new_view.ranges[inew];
+        if (inew < new_view->nr) {
+            frnew = &new_view->ranges[inew];
         } else {
             frnew = NULL;
         }
@@ -674,14 +676,14 @@ static void address_space_update_topology_pass(AddressSpace *as,
 
 static void address_space_update_topology(AddressSpace *as)
 {
-    FlatView old_view = *as->current_map;
-    FlatView new_view = generate_memory_topology(as->root);
+    FlatView *old_view = as->current_map;
+    FlatView *new_view = generate_memory_topology(as->root);
 
     address_space_update_topology_pass(as, old_view, new_view, false);
     address_space_update_topology_pass(as, old_view, new_view, true);
 
-    *as->current_map = new_view;
-    flatview_destroy(&old_view);
+    as->current_map = new_view;
+    flatview_destroy(old_view);
     address_space_update_ioeventfds(as);
 }
 
commit 99e86347fe960b95514531f84282438ae4e6ca64
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 6 10:26:13 2013 +0200

    memory: access FlatView from a local variable
    
    We will soon require accesses to as->current_map to be placed under
    a lock (with reference counting so as to keep the critical section
    small).  To simplify this change, always fetch as->current_map into
    a local variable and access it through that variable.
    
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/memory.c b/memory.c
index 543e0cc..4449462 100644
--- a/memory.c
+++ b/memory.c
@@ -578,13 +578,15 @@ static void address_space_add_del_ioeventfds(AddressSpace *as,
 
 static void address_space_update_ioeventfds(AddressSpace *as)
 {
+    FlatView *view;
     FlatRange *fr;
     unsigned ioeventfd_nb = 0;
     MemoryRegionIoeventfd *ioeventfds = NULL;
     AddrRange tmp;
     unsigned i;
 
-    FOR_EACH_FLAT_RANGE(fr, as->current_map) {
+    view = as->current_map;
+    FOR_EACH_FLAT_RANGE(fr, view) {
         for (i = 0; i < fr->mr->ioeventfd_nb; ++i) {
             tmp = addrrange_shift(fr->mr->ioeventfds[i].addr,
                                   int128_sub(fr->addr.start,
@@ -1144,7 +1146,8 @@ void memory_region_sync_dirty_bitmap(MemoryRegion *mr)
     FlatRange *fr;
 
     QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {
-        FOR_EACH_FLAT_RANGE(fr, as->current_map) {
+        FlatView *view = as->current_map;
+        FOR_EACH_FLAT_RANGE(fr, view) {
             if (fr->mr == mr) {
                 MEMORY_LISTENER_UPDATE_REGION(fr, as, Forward, log_sync);
             }
@@ -1194,12 +1197,14 @@ void *memory_region_get_ram_ptr(MemoryRegion *mr)
 
 static void memory_region_update_coalesced_range_as(MemoryRegion *mr, AddressSpace *as)
 {
+    FlatView *view;
     FlatRange *fr;
     CoalescedMemoryRange *cmr;
     AddrRange tmp;
     MemoryRegionSection section;
 
-    FOR_EACH_FLAT_RANGE(fr, as->current_map) {
+    view = as->current_map;
+    FOR_EACH_FLAT_RANGE(fr, view) {
         if (fr->mr == mr) {
             section = (MemoryRegionSection) {
                 .address_space = as,
@@ -1490,9 +1495,9 @@ static int cmp_flatrange_addr(const void *addr_, const void *fr_)
     return 0;
 }
 
-static FlatRange *address_space_lookup(AddressSpace *as, AddrRange addr)
+static FlatRange *flatview_lookup(FlatView *view, AddrRange addr)
 {
-    return bsearch(&addr, as->current_map->ranges, as->current_map->nr,
+    return bsearch(&addr, view->ranges, view->nr,
                    sizeof(FlatRange), cmp_flatrange_addr);
 }
 
@@ -1513,6 +1518,7 @@ MemoryRegionSection memory_region_find(MemoryRegion *mr,
     MemoryRegion *root;
     AddressSpace *as;
     AddrRange range;
+    FlatView *view;
     FlatRange *fr;
 
     addr += mr->addr;
@@ -1523,13 +1529,14 @@ MemoryRegionSection memory_region_find(MemoryRegion *mr,
 
     as = memory_region_to_address_space(root);
     range = addrrange_make(int128_make64(addr), int128_make64(size));
-    fr = address_space_lookup(as, range);
+
+    view = as->current_map;
+    fr = flatview_lookup(view, range);
     if (!fr) {
         return ret;
     }
 
-    while (fr > as->current_map->ranges
-           && addrrange_intersects(fr[-1].addr, range)) {
+    while (fr > view->ranges && addrrange_intersects(fr[-1].addr, range)) {
         --fr;
     }
 
@@ -1549,9 +1556,11 @@ MemoryRegionSection memory_region_find(MemoryRegion *mr,
 
 void address_space_sync_dirty_bitmap(AddressSpace *as)
 {
+    FlatView *view;
     FlatRange *fr;
 
-    FOR_EACH_FLAT_RANGE(fr, as->current_map) {
+    view = as->current_map;
+    FOR_EACH_FLAT_RANGE(fr, view) {
         MEMORY_LISTENER_UPDATE_REGION(fr, as, Forward, log_sync);
     }
 }
@@ -1571,6 +1580,7 @@ void memory_global_dirty_log_stop(void)
 static void listener_add_address_space(MemoryListener *listener,
                                        AddressSpace *as)
 {
+    FlatView *view;
     FlatRange *fr;
 
     if (listener->address_space_filter
@@ -1584,7 +1594,8 @@ static void listener_add_address_space(MemoryListener *listener,
         }
     }
 
-    FOR_EACH_FLAT_RANGE(fr, as->current_map) {
+    view = as->current_map;
+    FOR_EACH_FLAT_RANGE(fr, view) {
         MemoryRegionSection section = {
             .mr = fr->mr,
             .address_space = as,
commit 5444e768ee1abe6e021bece19a9a932351f88c88
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 13 13:29:47 2013 +0200

    add a header file for atomic operations
    
    We're already using them in several places, but __sync builtins are just
    too ugly to type, and do not provide seqcst load/store operations.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/docs/atomics.txt b/docs/atomics.txt
new file mode 100644
index 0000000..6f2997b
--- /dev/null
+++ b/docs/atomics.txt
@@ -0,0 +1,352 @@
+CPUs perform independent memory operations effectively in random order.
+but this can be a problem for CPU-CPU interaction (including interactions
+between QEMU and the guest).  Multi-threaded programs use various tools
+to instruct the compiler and the CPU to restrict the order to something
+that is consistent with the expectations of the programmer.
+
+The most basic tool is locking.  Mutexes, condition variables and
+semaphores are used in QEMU, and should be the default approach to
+synchronization.  Anything else is considerably harder, but it's
+also justified more often than one would like.  The two tools that
+are provided by qemu/atomic.h are memory barriers and atomic operations.
+
+Macros defined by qemu/atomic.h fall in three camps:
+
+- compiler barriers: barrier();
+
+- weak atomic access and manual memory barriers: atomic_read(),
+  atomic_set(), smp_rmb(), smp_wmb(), smp_mb(), smp_read_barrier_depends();
+
+- sequentially consistent atomic access: everything else.
+
+
+COMPILER MEMORY BARRIER
+=======================
+
+barrier() prevents the compiler from moving the memory accesses either
+side of it to the other side.  The compiler barrier has no direct effect
+on the CPU, which may then reorder things however it wishes.
+
+barrier() is mostly used within qemu/atomic.h itself.  On some
+architectures, CPU guarantees are strong enough that blocking compiler
+optimizations already ensures the correct order of execution.  In this
+case, qemu/atomic.h will reduce stronger memory barriers to simple
+compiler barriers.
+
+Still, barrier() can be useful when writing code that can be interrupted
+by signal handlers.
+
+
+SEQUENTIALLY CONSISTENT ATOMIC ACCESS
+=====================================
+
+Most of the operations in the qemu/atomic.h header ensure *sequential
+consistency*, where "the result of any execution is the same as if the
+operations of all the processors were executed in some sequential order,
+and the operations of each individual processor appear in this sequence
+in the order specified by its program".
+
+qemu/atomic.h provides the following set of atomic read-modify-write
+operations:
+
+    void atomic_inc(ptr)
+    void atomic_dec(ptr)
+    void atomic_add(ptr, val)
+    void atomic_sub(ptr, val)
+    void atomic_and(ptr, val)
+    void atomic_or(ptr, val)
+
+    typeof(*ptr) atomic_fetch_inc(ptr)
+    typeof(*ptr) atomic_fetch_dec(ptr)
+    typeof(*ptr) atomic_fetch_add(ptr, val)
+    typeof(*ptr) atomic_fetch_sub(ptr, val)
+    typeof(*ptr) atomic_fetch_and(ptr, val)
+    typeof(*ptr) atomic_fetch_or(ptr, val)
+    typeof(*ptr) atomic_xchg(ptr, val
+    typeof(*ptr) atomic_cmpxchg(ptr, old, new)
+
+all of which return the old value of *ptr.  These operations are
+polymorphic; they operate on any type that is as wide as an int.
+
+Sequentially consistent loads and stores can be done using:
+
+    atomic_fetch_add(ptr, 0) for loads
+    atomic_xchg(ptr, val) for stores
+
+However, they are quite expensive on some platforms, notably POWER and
+ARM.  Therefore, qemu/atomic.h provides two primitives with slightly
+weaker constraints:
+
+    typeof(*ptr) atomic_mb_read(ptr)
+    void         atomic_mb_set(ptr, val)
+
+The semantics of these primitives map to Java volatile variables,
+and are strongly related to memory barriers as used in the Linux
+kernel (see below).
+
+As long as you use atomic_mb_read and atomic_mb_set, accesses cannot
+be reordered with each other, and it is also not possible to reorder
+"normal" accesses around them.
+
+However, and this is the important difference between
+atomic_mb_read/atomic_mb_set and sequential consistency, it is important
+for both threads to access the same volatile variable.  It is not the
+case that everything visible to thread A when it writes volatile field f
+becomes visible to thread B after it reads volatile field g. The store
+and load have to "match" (i.e., be performed on the same volatile
+field) to achieve the right semantics.
+
+
+These operations operate on any type that is as wide as an int or smaller.
+
+
+WEAK ATOMIC ACCESS AND MANUAL MEMORY BARRIERS
+=============================================
+
+Compared to sequentially consistent atomic access, programming with
+weaker consistency models can be considerably more complicated.
+In general, if the algorithm you are writing includes both writes
+and reads on the same side, it is generally simpler to use sequentially
+consistent primitives.
+
+When using this model, variables are accessed with atomic_read() and
+atomic_set(), and restrictions to the ordering of accesses is enforced
+using the smp_rmb(), smp_wmb(), smp_mb() and smp_read_barrier_depends()
+memory barriers.
+
+atomic_read() and atomic_set() prevents the compiler from using
+optimizations that might otherwise optimize accesses out of existence
+on the one hand, or that might create unsolicited accesses on the other.
+In general this should not have any effect, because the same compiler
+barriers are already implied by memory barriers.  However, it is useful
+to do so, because it tells readers which variables are shared with
+other threads, and which are local to the current thread or protected
+by other, more mundane means.
+
+Memory barriers control the order of references to shared memory.
+They come in four kinds:
+
+- smp_rmb() guarantees that all the LOAD operations specified before
+  the barrier will appear to happen before all the LOAD operations
+  specified after the barrier with respect to the other components of
+  the system.
+
+  In other words, smp_rmb() puts a partial ordering on loads, but is not
+  required to have any effect on stores.
+
+- smp_wmb() guarantees that all the STORE operations specified before
+  the barrier will appear to happen before all the STORE operations
+  specified after the barrier with respect to the other components of
+  the system.
+
+  In other words, smp_wmb() puts a partial ordering on stores, but is not
+  required to have any effect on loads.
+
+- smp_mb() guarantees that all the LOAD and STORE operations specified
+  before the barrier will appear to happen before all the LOAD and
+  STORE operations specified after the barrier with respect to the other
+  components of the system.
+
+  smp_mb() puts a partial ordering on both loads and stores.  It is
+  stronger than both a read and a write memory barrier; it implies both
+  smp_rmb() and smp_wmb(), but it also prevents STOREs coming before the
+  barrier from overtaking LOADs coming after the barrier and vice versa.
+
+- smp_read_barrier_depends() is a weaker kind of read barrier.  On
+  most processors, whenever two loads are performed such that the
+  second depends on the result of the first (e.g., the first load
+  retrieves the address to which the second load will be directed),
+  the processor will guarantee that the first LOAD will appear to happen
+  before the second with respect to the other components of the system.
+  However, this is not always true---for example, it was not true on
+  Alpha processors.  Whenever this kind of access happens to shared
+  memory (that is not protected by a lock), a read barrier is needed,
+  and smp_read_barrier_depends() can be used instead of smp_rmb().
+
+  Note that the first load really has to have a _data_ dependency and not
+  a control dependency.  If the address for the second load is dependent
+  on the first load, but the dependency is through a conditional rather
+  than actually loading the address itself, then it's a _control_
+  dependency and a full read barrier or better is required.
+
+
+This is the set of barriers that is required *between* two atomic_read()
+and atomic_set() operations to achieve sequential consistency:
+
+                    |               2nd operation             |
+                    |-----------------------------------------|
+     1st operation  | (after last) | atomic_read | atomic_set |
+     ---------------+--------------+-------------+------------|
+     (before first) |              | none        | smp_wmb()  |
+     ---------------+--------------+-------------+------------|
+     atomic_read    | smp_rmb()    | smp_rmb()*  | **         |
+     ---------------+--------------+-------------+------------|
+     atomic_set     | none         | smp_mb()*** | smp_wmb()  |
+     ---------------+--------------+-------------+------------|
+
+       * Or smp_read_barrier_depends().
+
+      ** This requires a load-store barrier.  How to achieve this varies
+         depending on the machine, but in practice smp_rmb()+smp_wmb()
+         should have the desired effect.  For example, on PowerPC the
+         lwsync instruction is a combined load-load, load-store and
+         store-store barrier.
+
+     *** This requires a store-load barrier.  On most machines, the only
+         way to achieve this is a full barrier.
+
+
+You can see that the two possible definitions of atomic_mb_read()
+and atomic_mb_set() are the following:
+
+    1) atomic_mb_read(p)   = atomic_read(p); smp_rmb()
+       atomic_mb_set(p, v) = smp_wmb(); atomic_set(p, v); smp_mb()
+
+    2) atomic_mb_read(p)   = smp_mb() atomic_read(p); smp_rmb()
+       atomic_mb_set(p, v) = smp_wmb(); atomic_set(p, v);
+
+Usually the former is used, because smp_mb() is expensive and a program
+normally has more reads than writes.  Therefore it makes more sense to
+make atomic_mb_set() the more expensive operation.
+
+There are two common cases in which atomic_mb_read and atomic_mb_set
+generate too many memory barriers, and thus it can be useful to manually
+place barriers instead:
+
+- when a data structure has one thread that is always a writer
+  and one thread that is always a reader, manual placement of
+  memory barriers makes the write side faster.  Furthermore,
+  correctness is easy to check for in this case using the "pairing"
+  trick that is explained below:
+
+     thread 1                                thread 1
+     -------------------------               ------------------------
+     (other writes)
+                                             smp_wmb()
+     atomic_mb_set(&a, x)                    atomic_set(&a, x)
+                                             smp_wmb()
+     atomic_mb_set(&b, y)                    atomic_set(&b, y)
+
+                                       =>
+     thread 2                                thread 2
+     -------------------------               ------------------------
+     y = atomic_mb_read(&b)                  y = atomic_read(&b)
+                                             smp_rmb()
+     x = atomic_mb_read(&a)                  x = atomic_read(&a)
+                                             smp_rmb()
+
+- sometimes, a thread is accessing many variables that are otherwise
+  unrelated to each other (for example because, apart from the current
+  thread, exactly one other thread will read or write each of these
+  variables).  In this case, it is possible to "hoist" the implicit
+  barriers provided by atomic_mb_read() and atomic_mb_set() outside
+  a loop.  For example, the above definition atomic_mb_read() gives
+  the following transformation:
+
+     n = 0;                                  n = 0;
+     for (i = 0; i < 10; i++)          =>    for (i = 0; i < 10; i++)
+       n += atomic_mb_read(&a[i]);             n += atomic_read(&a[i]);
+                                             smp_rmb();
+
+  Similarly, atomic_mb_set() can be transformed as follows:
+  smp_mb():
+
+                                             smp_wmb();
+     for (i = 0; i < 10; i++)          =>    for (i = 0; i < 10; i++)
+       atomic_mb_set(&a[i], false);            atomic_set(&a[i], false);
+                                             smp_mb();
+
+
+The two tricks can be combined.  In this case, splitting a loop in
+two lets you hoist the barriers out of the loops _and_ eliminate the
+expensive smp_mb():
+
+                                             smp_wmb();
+     for (i = 0; i < 10; i++) {        =>    for (i = 0; i < 10; i++)
+       atomic_mb_set(&a[i], false);            atomic_set(&a[i], false);
+       atomic_mb_set(&b[i], false);          smb_wmb();
+     }                                       for (i = 0; i < 10; i++)
+                                               atomic_set(&a[i], false);
+                                             smp_mb();
+
+  The other thread can still use atomic_mb_read()/atomic_mb_set()
+
+
+Memory barrier pairing
+----------------------
+
+A useful rule of thumb is that memory barriers should always, or almost
+always, be paired with another barrier.  In the case of QEMU, however,
+note that the other barrier may actually be in a driver that runs in
+the guest!
+
+For the purposes of pairing, smp_read_barrier_depends() and smp_rmb()
+both count as read barriers.  A read barriers shall pair with a write
+barrier or a full barrier; a write barrier shall pair with a read
+barrier or a full barrier.  A full barrier can pair with anything.
+For example:
+
+        thread 1             thread 2
+        ===============      ===============
+        a = 1;
+        smp_wmb();
+        b = 2;               x = b;
+                             smp_rmb();
+                             y = a;
+
+Note that the "writing" thread are accessing the variables in the
+opposite order as the "reading" thread.  This is expected: stores
+before the write barrier will normally match the loads after the
+read barrier, and vice versa.  The same is true for more than 2
+access and for data dependency barriers:
+
+        thread 1             thread 2
+        ===============      ===============
+        b[2] = 1;
+        smp_wmb();
+        x->i = 2;
+        smp_wmb();
+        a = x;               x = a;
+                             smp_read_barrier_depends();
+                             y = x->i;
+                             smp_read_barrier_depends();
+                             z = b[y];
+
+smp_wmb() also pairs with atomic_mb_read(), and smp_rmb() also pairs
+with atomic_mb_set().
+
+
+COMPARISON WITH LINUX KERNEL MEMORY BARRIERS
+============================================
+
+Here is a list of differences between Linux kernel atomic operations
+and memory barriers, and the equivalents in QEMU:
+
+- atomic operations in Linux are always on a 32-bit int type and
+  use a boxed atomic_t type; atomic operations in QEMU are polymorphic
+  and use normal C types.
+
+- atomic_read and atomic_set in Linux give no guarantee at all;
+  atomic_read and atomic_set in QEMU include a compiler barrier
+  (similar to the ACCESS_ONCE macro in Linux).
+
+- most atomic read-modify-write operations in Linux return void;
+  in QEMU, all of them return the old value of the variable.
+
+- different atomic read-modify-write operations in Linux imply
+  a different set of memory barriers; in QEMU, all of them enforce
+  sequential consistency, which means they imply full memory barriers
+  before and after the operation.
+
+- Linux does not have an equivalent of atomic_mb_read() and
+  atomic_mb_set().  In particular, note that set_mb() is a little
+  weaker than atomic_mb_set().
+
+
+SOURCES
+=======
+
+* Documentation/memory-barriers.txt from the Linux kernel
+
+* "The JSR-133 Cookbook for Compiler Writers", available at
+  http://g.oswego.edu/dl/jmm/cookbook.html
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 3862d7a..ddefa06 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -23,6 +23,7 @@
 #include "qemu-common.h"
 #include "qemu/timer.h"
 #include "qemu/queue.h"
+#include "qemu/atomic.h"
 #include "monitor/monitor.h"
 #include "sysemu/sysemu.h"
 #include "trace.h"
@@ -1726,7 +1727,7 @@ static void qxl_send_events(PCIQXLDevice *d, uint32_t events)
         trace_qxl_send_events_vm_stopped(d->id, events);
         return;
     }
-    old_pending = __sync_fetch_and_or(&d->ram->int_pending, le_events);
+    old_pending = atomic_fetch_or(&d->ram->int_pending, le_events);
     if ((old_pending & le_events) == le_events) {
         return;
     }
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 96ab625..8f6ab13 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -16,6 +16,7 @@
 #include <sys/ioctl.h>
 #include "hw/virtio/vhost.h"
 #include "hw/hw.h"
+#include "qemu/atomic.h"
 #include "qemu/range.h"
 #include <linux/vhost.h>
 #include "exec/address-spaces.h"
@@ -47,11 +48,9 @@ static void vhost_dev_sync_region(struct vhost_dev *dev,
             addr += VHOST_LOG_CHUNK;
             continue;
         }
-        /* Data must be read atomically. We don't really
-         * need the barrier semantics of __sync
-         * builtins, but it's easier to use them than
-         * roll our own. */
-        log = __sync_fetch_and_and(from, 0);
+        /* Data must be read atomically. We don't really need barrier semantics
+         * but it's easier to use atomic_* than roll our own. */
+        log = atomic_xchg(from, 0);
         while ((bit = sizeof(log) > sizeof(int) ?
                 ffsll(log) : ffs(log))) {
             hwaddr page_addr;
diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index 10becb6..0aa8913 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -1,68 +1,202 @@
-#ifndef __QEMU_BARRIER_H
-#define __QEMU_BARRIER_H 1
+/*
+ * Simple interface for atomic operations.
+ *
+ * Copyright (C) 2013 Red Hat, Inc.
+ *
+ * Author: Paolo Bonzini <pbonzini at redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
 
-/* Compiler barrier */
-#define barrier()   asm volatile("" ::: "memory")
+#ifndef __QEMU_ATOMIC_H
+#define __QEMU_ATOMIC_H 1
 
-#if defined(__i386__)
+#include "qemu/compiler.h"
 
-#include "qemu/compiler.h"        /* QEMU_GNUC_PREREQ */
+/* For C11 atomic ops */
 
-/*
- * Because of the strongly ordered x86 storage model, wmb() and rmb() are nops
- * on x86(well, a compiler barrier only).  Well, at least as long as
- * qemu doesn't do accesses to write-combining memory or non-temporal
- * load/stores from C code.
- */
-#define smp_wmb()   barrier()
-#define smp_rmb()   barrier()
+/* Compiler barrier */
+#define barrier()   ({ asm volatile("" ::: "memory"); (void)0; })
+
+#ifndef __ATOMIC_RELAXED
 
 /*
- * We use GCC builtin if it's available, as that can use
- * mfence on 32 bit as well, e.g. if built with -march=pentium-m.
- * However, on i386, there seem to be known bugs as recently as 4.3.
- * */
-#if QEMU_GNUC_PREREQ(4, 4)
-#define smp_mb() __sync_synchronize()
+ * We use GCC builtin if it's available, as that can use mfence on
+ * 32-bit as well, e.g. if built with -march=pentium-m. However, on
+ * i386 the spec is buggy, and the implementation followed it until
+ * 4.3 (http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36793).
+ */
+#if defined(__i386__) || defined(__x86_64__)
+#if !QEMU_GNUC_PREREQ(4, 4)
+#if defined __x86_64__
+#define smp_mb()    ({ asm volatile("mfence" ::: "memory"); (void)0; })
 #else
-#define smp_mb() asm volatile("lock; addl $0,0(%%esp) " ::: "memory")
+#define smp_mb()    ({ asm volatile("lock; addl $0,0(%%esp) " ::: "memory"); (void)0; })
+#endif
+#endif
+#endif
+
+
+#ifdef __alpha__
+#define smp_read_barrier_depends()   asm volatile("mb":::"memory")
 #endif
 
-#elif defined(__x86_64__)
+#if defined(__i386__) || defined(__x86_64__) || defined(__s390x__)
 
+/*
+ * Because of the strongly ordered storage model, wmb() and rmb() are nops
+ * here (a compiler barrier only).  QEMU doesn't do accesses to write-combining
+ * qemu memory or non-temporal load/stores from C code.
+ */
 #define smp_wmb()   barrier()
 #define smp_rmb()   barrier()
-#define smp_mb() asm volatile("mfence" ::: "memory")
+
+/*
+ * __sync_lock_test_and_set() is documented to be an acquire barrier only,
+ * but it is a full barrier at the hardware level.  Add a compiler barrier
+ * to make it a full barrier also at the compiler level.
+ */
+#define atomic_xchg(ptr, i)    (barrier(), __sync_lock_test_and_set(ptr, i))
+
+/*
+ * Load/store with Java volatile semantics.
+ */
+#define atomic_mb_set(ptr, i)  ((void)atomic_xchg(ptr, i))
 
 #elif defined(_ARCH_PPC)
 
 /*
  * We use an eieio() for wmb() on powerpc.  This assumes we don't
  * need to order cacheable and non-cacheable stores with respect to
- * each other
+ * each other.
+ *
+ * smp_mb has the same problem as on x86 for not-very-new GCC
+ * (http://patchwork.ozlabs.org/patch/126184/, Nov 2011).
  */
-#define smp_wmb()   asm volatile("eieio" ::: "memory")
-
+#define smp_wmb()   ({ asm volatile("eieio" ::: "memory"); (void)0; })
 #if defined(__powerpc64__)
-#define smp_rmb()   asm volatile("lwsync" ::: "memory")
+#define smp_rmb()   ({ asm volatile("lwsync" ::: "memory"); (void)0; })
 #else
-#define smp_rmb()   asm volatile("sync" ::: "memory")
+#define smp_rmb()   ({ asm volatile("sync" ::: "memory"); (void)0; })
 #endif
+#define smp_mb()    ({ asm volatile("sync" ::: "memory"); (void)0; })
 
-#define smp_mb()   asm volatile("sync" ::: "memory")
+#endif /* _ARCH_PPC */
 
-#else
+#endif /* C11 atomics */
 
 /*
  * For (host) platforms we don't have explicit barrier definitions
  * for, we use the gcc __sync_synchronize() primitive to generate a
  * full barrier.  This should be safe on all platforms, though it may
- * be overkill for wmb() and rmb().
+ * be overkill for smp_wmb() and smp_rmb().
  */
+#ifndef smp_mb
+#define smp_mb()    __sync_synchronize()
+#endif
+
+#ifndef smp_wmb
+#ifdef __ATOMIC_RELEASE
+#define smp_wmb()   __atomic_thread_fence(__ATOMIC_RELEASE)
+#else
 #define smp_wmb()   __sync_synchronize()
-#define smp_mb()   __sync_synchronize()
+#endif
+#endif
+
+#ifndef smp_rmb
+#ifdef __ATOMIC_ACQUIRE
+#define smp_rmb()   __atomic_thread_fence(__ATOMIC_ACQUIRE)
+#else
 #define smp_rmb()   __sync_synchronize()
+#endif
+#endif
+
+#ifndef smp_read_barrier_depends
+#ifdef __ATOMIC_CONSUME
+#define smp_read_barrier_depends()   __atomic_thread_fence(__ATOMIC_CONSUME)
+#else
+#define smp_read_barrier_depends()   barrier()
+#endif
+#endif
 
+#ifndef atomic_read
+#define atomic_read(ptr)       (*(__typeof__(*ptr) *volatile) (ptr))
 #endif
 
+#ifndef atomic_set
+#define atomic_set(ptr, i)     ((*(__typeof__(*ptr) *volatile) (ptr)) = (i))
+#endif
+
+/* These have the same semantics as Java volatile variables.
+ * See http://gee.cs.oswego.edu/dl/jmm/cookbook.html:
+ * "1. Issue a StoreStore barrier (wmb) before each volatile store."
+ *  2. Issue a StoreLoad barrier after each volatile store.
+ *     Note that you could instead issue one before each volatile load, but
+ *     this would be slower for typical programs using volatiles in which
+ *     reads greatly outnumber writes. Alternatively, if available, you
+ *     can implement volatile store as an atomic instruction (for example
+ *     XCHG on x86) and omit the barrier. This may be more efficient if
+ *     atomic instructions are cheaper than StoreLoad barriers.
+ *  3. Issue LoadLoad and LoadStore barriers after each volatile load."
+ *
+ * If you prefer to think in terms of "pairing" of memory barriers,
+ * an atomic_mb_read pairs with an atomic_mb_set.
+ *
+ * And for the few ia64 lovers that exist, an atomic_mb_read is a ld.acq,
+ * while an atomic_mb_set is a st.rel followed by a memory barrier.
+ *
+ * These are a bit weaker than __atomic_load/store with __ATOMIC_SEQ_CST
+ * (see docs/atomics.txt), and I'm not sure that __ATOMIC_ACQ_REL is enough.
+ * Just always use the barriers manually by the rules above.
+ */
+#ifndef atomic_mb_read
+#define atomic_mb_read(ptr)    ({           \
+    typeof(*ptr) _val = atomic_read(ptr);   \
+    smp_rmb();                              \
+    _val;                                   \
+})
+#endif
+
+#ifndef atomic_mb_set
+#define atomic_mb_set(ptr, i)  do {         \
+    smp_wmb();                              \
+    atomic_set(ptr, i);                     \
+    smp_mb();                               \
+} while (0)
+#endif
+
+#ifndef atomic_xchg
+#ifdef __ATOMIC_SEQ_CST
+#define atomic_xchg(ptr, i)    ({                           \
+    typeof(*ptr) _new = (i), _old;                          \
+    __atomic_exchange(ptr, &_new, &_old, __ATOMIC_SEQ_CST); \
+    _old;                                                   \
+})
+#elif defined __clang__
+#define atomic_xchg(ptr, i)    __sync_exchange(ptr, i)
+#else
+/* __sync_lock_test_and_set() is documented to be an acquire barrier only.  */
+#define atomic_xchg(ptr, i)    (smp_mb(), __sync_lock_test_and_set(ptr, i))
+#endif
+#endif
+
+/* Provide shorter names for GCC atomic builtins.  */
+#define atomic_fetch_inc(ptr)  __sync_fetch_and_add(ptr, 1)
+#define atomic_fetch_dec(ptr)  __sync_fetch_and_add(ptr, -1)
+#define atomic_fetch_add       __sync_fetch_and_add
+#define atomic_fetch_sub       __sync_fetch_and_sub
+#define atomic_fetch_and       __sync_fetch_and_and
+#define atomic_fetch_or        __sync_fetch_and_or
+#define atomic_cmpxchg         __sync_val_compare_and_swap
+
+/* And even shorter names that return void.  */
+#define atomic_inc(ptr)        ((void) __sync_fetch_and_add(ptr, 1))
+#define atomic_dec(ptr)        ((void) __sync_fetch_and_add(ptr, -1))
+#define atomic_add(ptr, n)     ((void) __sync_fetch_and_add(ptr, n))
+#define atomic_sub(ptr, n)     ((void) __sync_fetch_and_sub(ptr, n))
+#define atomic_and(ptr, n)     ((void) __sync_fetch_and_and(ptr, n))
+#define atomic_or(ptr, n)      ((void) __sync_fetch_and_or(ptr, n))
+
 #endif
diff --git a/migration.c b/migration.c
index a704d48..635a7e7 100644
--- a/migration.c
+++ b/migration.c
@@ -293,8 +293,7 @@ static void migrate_fd_cleanup(void *opaque)
 
 static void migrate_finish_set_state(MigrationState *s, int new_state)
 {
-    if (__sync_val_compare_and_swap(&s->state, MIG_STATE_ACTIVE,
-                                    new_state) == new_state) {
+    if (atomic_cmpxchg(&s->state, MIG_STATE_ACTIVE, new_state) == new_state) {
         trace_migrate_set_state(new_state);
     }
 }
diff --git a/tests/test-thread-pool.c b/tests/test-thread-pool.c
index 22915aa..b62338f 100644
--- a/tests/test-thread-pool.c
+++ b/tests/test-thread-pool.c
@@ -17,15 +17,15 @@ typedef struct {
 static int worker_cb(void *opaque)
 {
     WorkerTestData *data = opaque;
-    return __sync_fetch_and_add(&data->n, 1);
+    return atomic_fetch_inc(&data->n);
 }
 
 static int long_cb(void *opaque)
 {
     WorkerTestData *data = opaque;
-    __sync_fetch_and_add(&data->n, 1);
+    atomic_inc(&data->n);
     g_usleep(2000000);
-    __sync_fetch_and_add(&data->n, 1);
+    atomic_inc(&data->n);
     return 0;
 }
 
@@ -169,7 +169,7 @@ static void test_cancel(void)
     /* Cancel the jobs that haven't been started yet.  */
     num_canceled = 0;
     for (i = 0; i < 100; i++) {
-        if (__sync_val_compare_and_swap(&data[i].n, 0, 3) == 0) {
+        if (atomic_cmpxchg(&data[i].n, 0, 3) == 0) {
             data[i].ret = -ECANCELED;
             bdrv_aio_cancel(data[i].aiocb);
             active--;
commit 22fc860b0a0b689eacf4a01f5aa2ccbf36043a12
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/[u-x]*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 76b4c05..54147b5 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -173,7 +173,7 @@ static void fusbh200_ehci_init(Object *obj)
     FUSBH200EHCIState *f = FUSBH200_EHCI(obj);
     EHCIState *s = &i->ehci;
 
-    memory_region_init_io(&f->mem_vendor, NULL, &fusbh200_ehci_mmio_ops, s,
+    memory_region_init_io(&f->mem_vendor, OBJECT(f), &fusbh200_ehci_mmio_ops, s,
                           "fusbh200", 0x4c);
     memory_region_add_subregion(&s->mem,
                                 s->opregbase + s->portscbase + 4 * s->portnr,
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 440c4c2..67e4b24 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2553,12 +2553,12 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
     QTAILQ_INIT(&s->pqueues);
     usb_packet_init(&s->ipacket);
 
-    memory_region_init(&s->mem, NULL, "ehci", MMIO_SIZE);
-    memory_region_init_io(&s->mem_caps, NULL, &ehci_mmio_caps_ops, s,
+    memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE);
+    memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s,
                           "capabilities", CAPA_SIZE);
-    memory_region_init_io(&s->mem_opreg, NULL, &ehci_mmio_opreg_ops, s,
+    memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s,
                           "operational", s->portscbase);
-    memory_region_init_io(&s->mem_ports, NULL, &ehci_mmio_port_ops, s,
+    memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s,
                           "ports", 4 * s->portnr);
 
     memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index aa51042..a096ecf 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1830,7 +1830,8 @@ static int usb_ohci_init(OHCIState *ohci, DeviceState *dev,
         }
     }
 
-    memory_region_init_io(&ohci->mem, NULL, &ohci_mem_ops, ohci, "ohci", 256);
+    memory_region_init_io(&ohci->mem, OBJECT(dev), &ohci_mem_ops,
+                          ohci, "ohci", 256);
     ohci->localmem_base = localmem_base;
 
     ohci->name = object_get_typename(OBJECT(dev));
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 502228b..066072e 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1259,7 +1259,9 @@ static int usb_uhci_common_initfn(PCIDevice *dev)
 
     qemu_register_reset(uhci_reset, s);
 
-    memory_region_init_io(&s->io_bar, NULL, &uhci_ioport_ops, s, "uhci", 0x20);
+    memory_region_init_io(&s->io_bar, OBJECT(s), &uhci_ioport_ops, s,
+                          "uhci", 0x20);
+
     /* Use region 4 for consistency with real hardware.  BSD guests seem
        to rely on this.  */
     pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 493d759..d7a54fd 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3342,14 +3342,14 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
 
     xhci->irq = xhci->pci_dev.irq[0];
 
-    memory_region_init(&xhci->mem, NULL, "xhci", LEN_REGS);
-    memory_region_init_io(&xhci->mem_cap, NULL, &xhci_cap_ops, xhci,
+    memory_region_init(&xhci->mem, OBJECT(xhci), "xhci", LEN_REGS);
+    memory_region_init_io(&xhci->mem_cap, OBJECT(xhci), &xhci_cap_ops, xhci,
                           "capabilities", LEN_CAP);
-    memory_region_init_io(&xhci->mem_oper, NULL, &xhci_oper_ops, xhci,
+    memory_region_init_io(&xhci->mem_oper, OBJECT(xhci), &xhci_oper_ops, xhci,
                           "operational", 0x400);
-    memory_region_init_io(&xhci->mem_runtime, NULL, &xhci_runtime_ops, xhci,
+    memory_region_init_io(&xhci->mem_runtime, OBJECT(xhci), &xhci_runtime_ops, xhci,
                           "runtime", LEN_RUNTIME);
-    memory_region_init_io(&xhci->mem_doorbell, NULL, &xhci_doorbell_ops, xhci,
+    memory_region_init_io(&xhci->mem_doorbell, OBJECT(xhci), &xhci_doorbell_ops, xhci,
                           "doorbell", LEN_DOORBELL);
 
     memory_region_add_subregion(&xhci->mem, 0,            &xhci->mem_cap);
@@ -3361,7 +3361,7 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
         XHCIPort *port = &xhci->ports[i];
         uint32_t offset = OFF_OPER + 0x400 + 0x10 * i;
         port->xhci = xhci;
-        memory_region_init_io(&port->mem, NULL, &xhci_port_ops, port,
+        memory_region_init_io(&port->mem, OBJECT(xhci), &xhci_port_ops, port,
                               port->name, 0x10);
         memory_region_add_subregion(&xhci->mem, offset, &port->mem);
     }
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index c8ecc8e..c38cfd1 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -966,8 +966,8 @@ static void virtio_pci_device_plugged(DeviceState *d)
         size = 1 << qemu_fls(size);
     }
 
-    memory_region_init_io(&proxy->bar, NULL, &virtio_pci_config_ops, proxy,
-                          "virtio-pci", size);
+    memory_region_init_io(&proxy->bar, OBJECT(proxy), &virtio_pci_config_ops,
+                          proxy, "virtio-pci", size);
     pci_register_bar(&proxy->pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO,
                      &proxy->bar);
 
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 2c75014..85aebc2 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -417,7 +417,8 @@ static int i6300esb_init(PCIDevice *dev)
     d->timer = qemu_new_timer_ns(vm_clock, i6300esb_timer_expired, d);
     d->previous_reboot_flag = 0;
 
-    memory_region_init_io(&d->io_mem, NULL, &i6300esb_ops, d, "i6300esb", 0x10);
+    memory_region_init_io(&d->io_mem, OBJECT(d), &i6300esb_ops, d,
+                          "i6300esb", 0x10);
     pci_register_bar(&d->dev, 0, 0, &d->io_mem);
     /* qemu_register_coalesced_mmio (addr, 0x10); ? */
 
diff --git a/hw/xen/xen_apic.c b/hw/xen/xen_apic.c
index 3526ffe..9f91e0f 100644
--- a/hw/xen/xen_apic.c
+++ b/hw/xen/xen_apic.c
@@ -38,8 +38,8 @@ static const MemoryRegionOps xen_apic_io_ops = {
 
 static void xen_apic_init(APICCommonState *s)
 {
-    memory_region_init_io(&s->io_memory, NULL, &xen_apic_io_ops, s, "xen-apic-msi",
-                          APIC_SPACE_SIZE);
+    memory_region_init_io(&s->io_memory, OBJECT(s), &xen_apic_io_ops, s,
+                          "xen-apic-msi", APIC_SPACE_SIZE);
 
 #if defined(CONFIG_XEN_CTRL_INTERFACE_VERSION) \
     && CONFIG_XEN_CTRL_INTERFACE_VERSION >= 420
diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index 8855309..15d7cf0 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -275,7 +275,7 @@ static const MemoryRegionOps platform_fixed_io_ops = {
 
 static void platform_fixed_ioport_init(PCIXenPlatformState* s)
 {
-    memory_region_init_io(&s->fixed_io, NULL, &platform_fixed_io_ops, s,
+    memory_region_init_io(&s->fixed_io, OBJECT(s), &platform_fixed_io_ops, s,
                           "xen-fixed", 16);
     memory_region_add_subregion(get_system_io(), XEN_PLATFORM_IOPORT,
                                 &s->fixed_io);
@@ -319,7 +319,8 @@ static const MemoryRegionOps xen_pci_io_ops = {
 
 static void platform_ioport_bar_setup(PCIXenPlatformState *d)
 {
-    memory_region_init_io(&d->bar, NULL, &xen_pci_io_ops, d, "xen-pci", 0x100);
+    memory_region_init_io(&d->bar, OBJECT(d), &xen_pci_io_ops, d,
+                          "xen-pci", 0x100);
 }
 
 static uint64_t platform_mmio_read(void *opaque, hwaddr addr,
@@ -347,7 +348,7 @@ static const MemoryRegionOps platform_mmio_handler = {
 
 static void platform_mmio_setup(PCIXenPlatformState *d)
 {
-    memory_region_init_io(&d->mmio_bar, NULL, &platform_mmio_handler, d,
+    memory_region_init_io(&d->mmio_bar, OBJECT(d), &platform_mmio_handler, d,
                           "xen-mmio", 0x1000000);
 }
 
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index c06a018..d7ee774 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -416,7 +416,7 @@ static int xen_pt_register_regions(XenPCIPassthroughState *s)
             }
         }
 
-        memory_region_init_io(&s->bar[i], NULL, &ops, &s->dev,
+        memory_region_init_io(&s->bar[i], OBJECT(s), &ops, &s->dev,
                               "xen-pci-pt-bar", r->size);
         pci_register_bar(&s->dev, i, type, &s->bar[i]);
 
@@ -440,7 +440,7 @@ static int xen_pt_register_regions(XenPCIPassthroughState *s)
 
         s->bases[PCI_ROM_SLOT].access.maddr = d->rom.base_addr;
 
-        memory_region_init_rom_device(&s->rom, NULL, NULL, NULL,
+        memory_region_init_rom_device(&s->rom, OBJECT(s), NULL, NULL,
                                       "xen-pci-pt-rom", d->rom.size);
         pci_register_bar(&s->dev, PCI_ROM_SLOT, PCI_BASE_ADDRESS_MEM_PREFETCH,
                          &s->rom);
diff --git a/hw/xen/xen_pt_msi.c b/hw/xen/xen_pt_msi.c
index 9c7d43b..6fbe0cc 100644
--- a/hw/xen/xen_pt_msi.c
+++ b/hw/xen/xen_pt_msi.c
@@ -544,7 +544,8 @@ int xen_pt_msix_init(XenPCIPassthroughState *s, uint32_t base)
         msix->msix_entry[i].pirq = XEN_PT_UNASSIGNED_PIRQ;
     }
 
-    memory_region_init_io(&msix->mmio, NULL, &pci_msix_ops, s, "xen-pci-pt-msix",
+    memory_region_init_io(&msix->mmio, OBJECT(s), &pci_msix_ops,
+                          s, "xen-pci-pt-msix",
                           (total_entries * PCI_MSIX_ENTRY_SIZE
                            + XC_PAGE_SIZE - 1)
                           & XC_PAGE_MASK);
diff --git a/hw/xtensa/xtensa_lx60.c b/hw/xtensa/xtensa_lx60.c
index 11c30c2..075daf1 100644
--- a/hw/xtensa/xtensa_lx60.c
+++ b/hw/xtensa/xtensa_lx60.c
@@ -139,7 +139,7 @@ static void lx60_net_init(MemoryRegion *address_space,
             sysbus_mmio_get_region(s, 1));
 
     ram = g_malloc(sizeof(*ram));
-    memory_region_init_ram(ram, NULL, "open_eth.ram", 16384);
+    memory_region_init_ram(ram, OBJECT(s), "open_eth.ram", 16384);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space, buffers, ram);
 }
commit 853dca12055ea74994629d06798165d811c5e1e2
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/t*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index e78f820..d23462d 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -236,14 +236,14 @@ static int arm_mptimer_init(SysBusDevice *dev)
      *  * timer for core 1
      * and so on.
      */
-    memory_region_init_io(&s->iomem, NULL, &arm_thistimer_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &arm_thistimer_ops, s,
                           "arm_mptimer_timer", 0x20);
     sysbus_init_mmio(dev, &s->iomem);
     for (i = 0; i < s->num_cpu; i++) {
         TimerBlock *tb = &s->timerblock[i];
         tb->timer = qemu_new_timer_ns(vm_clock, timerblock_tick, tb);
         sysbus_init_irq(dev, &tb->irq);
-        memory_region_init_io(&tb->iomem, NULL, &timerblock_ops, tb,
+        memory_region_init_io(&tb->iomem, OBJECT(s), &timerblock_ops, tb,
                               "arm_mptimer_timerblock", 0x20);
         sysbus_init_mmio(dev, &tb->iomem);
     }
diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index f1a501f..798a8da 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -284,7 +284,8 @@ static int sp804_init(SysBusDevice *dev)
     s->timer[1] = arm_timer_init(s->freq1);
     s->timer[0]->irq = qi[0];
     s->timer[1]->irq = qi[1];
-    memory_region_init_io(&s->iomem, NULL, &sp804_ops, s, "sp804", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &sp804_ops, s,
+                          "sp804", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     vmstate_register(&dev->qdev, -1, &vmstate_sp804, s);
     return 0;
@@ -347,7 +348,8 @@ static int icp_pit_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->timer[1]->irq);
     sysbus_init_irq(dev, &s->timer[2]->irq);
 
-    memory_region_init_io(&s->iomem, NULL, &icp_pit_ops, s, "icp_pit", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &icp_pit_ops, s,
+                          "icp_pit", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     /* This device has no state to save/restore.  The component timers will
        save themselves.  */
diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index 4879cb0..a861049 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -409,7 +409,8 @@ static int cadence_ttc_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->timer[i].irq);
     }
 
-    memory_region_init_io(&s->iomem, NULL, &cadence_ttc_ops, s, "timer", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &cadence_ttc_ops, s,
+                          "timer", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index 8a7b177..6dd1072 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -323,7 +323,8 @@ static int etraxfs_timer_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &t->irq);
     sysbus_init_irq(dev, &t->nmi);
 
-    memory_region_init_io(&t->mmio, NULL, &timer_ops, t, "etraxfs-timer", 0x5c);
+    memory_region_init_io(&t->mmio, OBJECT(t), &timer_ops, t,
+                          "etraxfs-timer", 0x5c);
     sysbus_init_mmio(dev, &t->mmio);
     qemu_register_reset(etraxfs_timer_reset, t);
     return 0;
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index ba74d2b..28ebe5d 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -1449,8 +1449,8 @@ static int exynos4210_mct_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->l_timer[i].irq);
     }
 
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_mct_ops, s, "exynos4210-mct",
-            MCT_SFR_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_mct_ops, s,
+                          "exynos4210-mct", MCT_SFR_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index 62c42b4..8fa0bb2 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -390,8 +390,8 @@ static int exynos4210_pwm_init(SysBusDevice *dev)
         s->timer[i].parent = s;
     }
 
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_pwm_ops, s, "exynos4210-pwm",
-            EXYNOS4210_PWM_REG_MEM_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_pwm_ops, s,
+                          "exynos4210-pwm", EXYNOS4210_PWM_REG_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index 779dc77..7fca071 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -559,8 +559,8 @@ static int exynos4210_rtc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->alm_irq);
     sysbus_init_irq(dev, &s->tick_irq);
 
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_rtc_ops, s, "exynos4210-rtc",
-            EXYNOS4210_RTC_REG_MEM_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_rtc_ops, s,
+                          "exynos4210-rtc", EXYNOS4210_RTC_REG_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index 749ed31..37ba47d 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -365,7 +365,8 @@ static int grlib_gptimer_init(SysBusDevice *dev)
         ptimer_set_freq(timer->ptimer, unit->freq_hz);
     }
 
-    memory_region_init_io(&unit->iomem, NULL, &grlib_gptimer_ops, unit, "gptimer",
+    memory_region_init_io(&unit->iomem, OBJECT(unit), &grlib_gptimer_ops,
+                          unit, "gptimer",
                           UNIT_REG_SIZE + GPTIMER_REG_SIZE * unit->nr_timers);
 
     sysbus_init_mmio(dev, &unit->iomem);
diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 2e7fdb5..90bd584 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -722,7 +722,7 @@ static int hpet_init(SysBusDevice *dev)
     qdev_init_gpio_out(&dev->qdev, &s->pit_enabled, 1);
 
     /* HPET Area */
-    memory_region_init_io(&s->iomem, NULL, &hpet_ram_ops, s, "hpet", 0x400);
+    memory_region_init_io(&s->iomem, OBJECT(s), &hpet_ram_ops, s, "hpet", 0x400);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index fdb23da..cd52140 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -333,7 +333,8 @@ static void pit_realizefn(DeviceState *dev, Error **err)
     s->irq_timer = qemu_new_timer_ns(vm_clock, pit_irq_timer, s);
     qdev_init_gpio_out(dev, &s->irq, 1);
 
-    memory_region_init_io(&pit->ioports, NULL, &pit_ioport_ops, pit, "pit", 4);
+    memory_region_init_io(&pit->ioports, OBJECT(pit), &pit_ioport_ops,
+                          pit, "pit", 4);
 
     qdev_init_gpio_in(dev, pit_irq_control, 1);
 
diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index d2e0895..e24e0c4 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -396,7 +396,7 @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
     DPRINTF("\n");
 
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, NULL, &imx_epit_ops, s, TYPE_IMX_EPIT,
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_epit_ops, s, TYPE_IMX_EPIT,
                           0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
 
diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index 6e6442d..97fbebb 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -514,7 +514,7 @@ static void imx_gpt_realize(DeviceState *dev, Error **errp)
     QEMUBH *bh;
 
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, NULL, &imx_gpt_ops, s, TYPE_IMX_GPT,
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_gpt_ops, s, TYPE_IMX_GPT,
                           0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
 
diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
index 2ab8588..016dade 100644
--- a/hw/timer/lm32_timer.c
+++ b/hw/timer/lm32_timer.c
@@ -180,7 +180,8 @@ static int lm32_timer_init(SysBusDevice *dev)
     s->ptimer = ptimer_init(s->bh);
     ptimer_set_freq(s->ptimer, s->freq_hz);
 
-    memory_region_init_io(&s->iomem, NULL, &timer_ops, s, "timer", R_MAX * 4);
+    memory_region_init_io(&s->iomem, OBJECT(s), &timer_ops, s,
+                          "timer", R_MAX * 4);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c
index fdda6d6..be3490b 100644
--- a/hw/timer/m48t59.c
+++ b/hw/timer/m48t59.c
@@ -655,7 +655,8 @@ M48t59State *m48t59_init(qemu_irq IRQ, hwaddr mem_base,
     d = FROM_SYSBUS(M48t59SysBusState, s);
     state = &d->state;
     sysbus_connect_irq(s, 0, IRQ);
-    memory_region_init_io(&d->io, NULL, &m48t59_io_ops, state, "m48t59", 4);
+    memory_region_init_io(&d->io, OBJECT(d), &m48t59_io_ops, state,
+                          "m48t59", 4);
     if (io_base != 0) {
         memory_region_add_subregion(get_system_io(), io_base, &d->io);
     }
@@ -683,7 +684,7 @@ M48t59State *m48t59_init_isa(ISABus *bus, uint32_t io_base, uint16_t size,
     d = ISA_M48T59(isadev);
     s = &d->state;
 
-    memory_region_init_io(&d->io, NULL, &m48t59_io_ops, s, "m48t59", 4);
+    memory_region_init_io(&d->io, OBJECT(d), &m48t59_io_ops, s, "m48t59", 4);
     if (io_base != 0) {
         isa_register_ioport(isadev, &d->io, io_base);
     }
@@ -721,7 +722,8 @@ static int m48t59_init1(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->IRQ);
 
-    memory_region_init_io(&s->iomem, NULL, &nvram_ops, s, "m48t59.nvram", s->size);
+    memory_region_init_io(&s->iomem, OBJECT(d), &nvram_ops, s,
+                          "m48t59.nvram", s->size);
     sysbus_init_mmio(dev, &s->iomem);
     m48t59_realize_common(s, &err);
     if (err != NULL) {
diff --git a/hw/timer/mc146818rtc.c b/hw/timer/mc146818rtc.c
index 4110a37..3c3baac 100644
--- a/hw/timer/mc146818rtc.c
+++ b/hw/timer/mc146818rtc.c
@@ -863,7 +863,7 @@ static void rtc_realizefn(DeviceState *dev, Error **errp)
     s->suspend_notifier.notify = rtc_notify_suspend;
     qemu_register_suspend_notifier(&s->suspend_notifier);
 
-    memory_region_init_io(&s->io, NULL, &cmos_ops, s, "rtc", 2);
+    memory_region_init_io(&s->io, OBJECT(s), &cmos_ops, s, "rtc", 2);
     isa_register_ioport(isadev, &s->io, base);
 
     qdev_set_legacy_instance_id(dev, base, 3);
diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
index f253f21..5009394 100644
--- a/hw/timer/milkymist-sysctl.c
+++ b/hw/timer/milkymist-sysctl.c
@@ -280,7 +280,7 @@ static int milkymist_sysctl_init(SysBusDevice *dev)
     ptimer_set_freq(s->ptimer0, s->freq_hz);
     ptimer_set_freq(s->ptimer1, s->freq_hz);
 
-    memory_region_init_io(&s->regs_region, NULL, &sysctl_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(s), &sysctl_mmio_ops, s,
             "milkymist-sysctl", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index cba4e87..3ce6ed8 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -192,7 +192,7 @@ static int pl031_init(SysBusDevice *dev)
     pl031_state *s = FROM_SYSBUS(pl031_state, dev);
     struct tm tm;
 
-    memory_region_init_io(&s->iomem, NULL, &pl031_ops, s, "pl031", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl031_ops, s, "pl031", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
index 375d368..63f2c9f 100644
--- a/hw/timer/puv3_ost.c
+++ b/hw/timer/puv3_ost.c
@@ -122,7 +122,7 @@ static int puv3_ost_init(SysBusDevice *dev)
     s->ptimer = ptimer_init(s->bh);
     ptimer_set_freq(s->ptimer, 50 * 1000 * 1000);
 
-    memory_region_init_io(&s->iomem, NULL, &puv3_ost_ops, s, "puv3_ost",
+    memory_region_init_io(&s->iomem, OBJECT(s), &puv3_ost_ops, s, "puv3_ost",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index dd41a10..4d28719 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -461,7 +461,7 @@ static int pxa2xx_timer_init(SysBusDevice *dev)
         }
     }
 
-    memory_region_init_io(&s->iomem, NULL, &pxa2xx_timer_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_timer_ops, s,
                           "pxa2xx-timer", 0x00001000);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index cad81a3..7f844d7 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -394,7 +394,7 @@ static int slavio_timer_init1(SysBusDevice *dev)
 
         size = i == 0 ? SYS_TIMER_SIZE : CPU_TIMER_SIZE;
         snprintf(timer_name, sizeof(timer_name), "timer-%i", i);
-        memory_region_init_io(&tc->iomem, NULL, &slavio_timer_mem_ops, tc,
+        memory_region_init_io(&tc->iomem, OBJECT(s), &slavio_timer_mem_ops, tc,
                               timer_name, size);
         sysbus_init_mmio(dev, &tc->iomem);
 
diff --git a/hw/timer/tusb6010.c b/hw/timer/tusb6010.c
index fcce4ac..47b6809 100644
--- a/hw/timer/tusb6010.c
+++ b/hw/timer/tusb6010.c
@@ -779,8 +779,8 @@ static int tusb6010_init(SysBusDevice *dev)
     TUSBState *s = FROM_SYSBUS(TUSBState, dev);
     s->otg_timer = qemu_new_timer_ns(vm_clock, tusb_otg_tick, s);
     s->pwr_timer = qemu_new_timer_ns(vm_clock, tusb_power_tick, s);
-    memory_region_init_io(&s->iomem[1], NULL, &tusb_async_ops, s, "tusb-async",
-                          UINT32_MAX);
+    memory_region_init_io(&s->iomem[1], OBJECT(s), &tusb_async_ops, s,
+                          "tusb-async", UINT32_MAX);
     sysbus_init_mmio(dev, &s->iomem[0]);
     sysbus_init_mmio(dev, &s->iomem[1]);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index f4b4fb5..ee53834 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -218,7 +218,7 @@ static int xilinx_timer_init(SysBusDevice *dev)
         ptimer_set_freq(xt->ptimer, t->freq_hz);
     }
 
-    memory_region_init_io(&t->mmio, NULL, &timer_ops, t, "xlnx.xps-timer",
+    memory_region_init_io(&t->mmio, OBJECT(t), &timer_ops, t, "xlnx.xps-timer",
                           R_MAX * 4 * num_timers(t));
     sysbus_init_mmio(dev, &t->mmio);
     return 0;
diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c
index 5504fb4..abe384b 100644
--- a/hw/tpm/tpm_tis.c
+++ b/hw/tpm/tpm_tis.c
@@ -888,7 +888,8 @@ static void tpm_tis_initfn(Object *obj)
     ISADevice *dev = ISA_DEVICE(obj);
     TPMState *s = TPM(obj);
 
-    memory_region_init_io(&s->mmio, NULL, &tpm_tis_memory_ops, s, "tpm-tis-mmio",
+    memory_region_init_io(&s->mmio, OBJECT(s), &tpm_tis_memory_ops,
+                          s, "tpm-tis-mmio",
                           TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
     memory_region_add_subregion(isa_address_space(dev), TPM_TIS_ADDR_BASE,
                                 &s->mmio);
commit 2977673992b7d363d0f402ee7c4217795fe13809
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/s*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 384224f..8f97c5a 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -349,7 +349,8 @@ static int esp_pci_scsi_init(PCIDevice *dev)
     s->dma_memory_write = esp_pci_dma_memory_write;
     s->dma_opaque = pci;
     s->chip_id = TCHI_AM53C974;
-    memory_region_init_io(&pci->io, NULL, &esp_pci_io_ops, pci, "esp-io", 0x80);
+    memory_region_init_io(&pci->io, OBJECT(pci), &esp_pci_io_ops, pci,
+                          "esp-io", 0x80);
 
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->io);
     s->irq = pci->dev.irq[0];
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 5da5d7a..c6166c5 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -675,8 +675,8 @@ static int sysbus_esp_init(SysBusDevice *dev)
     assert(sysbus->it_shift != -1);
 
     s->chip_id = TCHI_FAS100A;
-    memory_region_init_io(&sysbus->iomem, NULL, &sysbus_esp_mem_ops, sysbus,
-                          "esp", ESP_REGS << sysbus->it_shift);
+    memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
+                          sysbus, "esp", ESP_REGS << sysbus->it_shift);
     sysbus_init_mmio(dev, &sysbus->iomem);
 
     qdev_init_gpio_in(&dev->qdev, sysbus_esp_gpio_demux, 2);
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index b31f0b7..2c17ae5 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2090,9 +2090,12 @@ static int lsi_scsi_init(PCIDevice *dev)
     /* Interrupt pin A */
     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
 
-    memory_region_init_io(&s->mmio_io, NULL, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
-    memory_region_init_io(&s->ram_io, NULL, &lsi_ram_ops, s, "lsi-ram", 0x2000);
-    memory_region_init_io(&s->io_io, NULL, &lsi_io_ops, s, "lsi-io", 256);
+    memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
+                          "lsi-mmio", 0x400);
+    memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
+                          "lsi-ram", 0x2000);
+    memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
+                          "lsi-io", 256);
 
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
     pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index ba74f0b..45d0c77 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2098,11 +2098,11 @@ static int megasas_scsi_init(PCIDevice *dev)
     /* Interrupt pin 1 */
     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
 
-    memory_region_init_io(&s->mmio_io, NULL, &megasas_mmio_ops, s,
+    memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
                           "megasas-mmio", 0x4000);
-    memory_region_init_io(&s->port_io, NULL, &megasas_port_ops, s,
+    memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
                           "megasas-io", 256);
-    memory_region_init_io(&s->queue_io, NULL, &megasas_queue_ops, s,
+    memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
                           "megasas-queue", 0x40000);
 
 #ifdef USE_MSIX
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index b7a1275..97d3aa3 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1075,7 +1075,7 @@ pvscsi_init(PCIDevice *pci_dev)
     /* Interrupt pin A */
     pci_config_set_interrupt_pin(pci_dev->config, 1);
 
-    memory_region_init_io(&s->io_space, NULL, &pvscsi_ops, s,
+    memory_region_init_io(&s->io_space, OBJECT(s), &pvscsi_ops, s,
                           "pvscsi-io", PVSCSI_MEM_SPACE_SIZE);
     pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io_space);
 
diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index 6de050f..f69775c 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -253,7 +253,7 @@ static int milkymist_memcard_init(SysBusDevice *dev)
     s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     s->enabled = dinfo ? bdrv_is_inserted(dinfo->bdrv) : 0;
 
-    memory_region_init_io(&s->regs_region, NULL, &memcard_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(s), &memcard_mmio_ops, s,
             "milkymist-memcard", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index 15f7890..4b17234 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -479,7 +479,7 @@ static int pl181_init(SysBusDevice *dev)
     pl181_state *s = FROM_SYSBUS(pl181_state, dev);
     DriveInfo *dinfo;
 
-    memory_region_init_io(&s->iomem, NULL, &pl181_ops, s, "pl181", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl181_ops, s, "pl181", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq[0]);
     sysbus_init_irq(dev, &s->irq[1]);
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index ac219c0..d2dbddc 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1245,7 +1245,7 @@ static void sdhci_realize(DeviceState *dev, Error ** errp)
     s->buf_maxsz = sdhci_get_fifolen(s);
     s->fifo_buffer = g_malloc0(s->buf_maxsz);
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, NULL, &sdhci_mmio_ops, s, "sdhci",
+    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
             SDHC_REGISTERS_MAP_SIZE);
     sysbus_init_mmio(sbd, &s->iomem);
 }
diff --git a/hw/sh4/sh_pci.c b/hw/sh4/sh_pci.c
index 8b842bc..c33a72f 100644
--- a/hw/sh4/sh_pci.c
+++ b/hw/sh4/sh_pci.c
@@ -125,10 +125,10 @@ static int sh_pci_device_init(SysBusDevice *dev)
                               get_system_memory(),
                               get_system_io(),
                               PCI_DEVFN(0, 0), 4, TYPE_PCI_BUS);
-    memory_region_init_io(&s->memconfig_p4, NULL, &sh_pci_reg_ops, s,
+    memory_region_init_io(&s->memconfig_p4, OBJECT(s), &sh_pci_reg_ops, s,
                           "sh_pci", 0x224);
-    memory_region_init_alias(&s->memconfig_a7, NULL, "sh_pci.2", &s->memconfig_p4,
-                             0, 0x224);
+    memory_region_init_alias(&s->memconfig_a7, OBJECT(s), "sh_pci.2",
+                             &s->memconfig_p4, 0, 0x224);
     isa_mmio_setup(&s->isa, 0x40000);
     sysbus_init_mmio(dev, &s->memconfig_p4);
     sysbus_init_mmio(dev, &s->memconfig_a7);
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 1a16c82..90b7b60 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -582,7 +582,8 @@ static int idreg_init1(SysBusDevice *dev)
 {
     IDRegState *s = FROM_SYSBUS(IDRegState, dev);
 
-    memory_region_init_ram(&s->mem, NULL, "sun4m.idreg", sizeof(idreg_data));
+    memory_region_init_ram(&s->mem, OBJECT(s),
+                           "sun4m.idreg", sizeof(idreg_data));
     vmstate_register_ram_global(&s->mem);
     memory_region_set_readonly(&s->mem, true);
     sysbus_init_mmio(dev, &s->mem);
@@ -625,7 +626,7 @@ static int afx_init1(SysBusDevice *dev)
 {
     AFXState *s = FROM_SYSBUS(AFXState, dev);
 
-    memory_region_init_ram(&s->mem, NULL, "sun4m.afx", 4);
+    memory_region_init_ram(&s->mem, OBJECT(s), "sun4m.afx", 4);
     vmstate_register_ram_global(&s->mem);
     sysbus_init_mmio(dev, &s->mem);
     return 0;
@@ -695,7 +696,7 @@ static int prom_init1(SysBusDevice *dev)
 {
     PROMState *s = FROM_SYSBUS(PROMState, dev);
 
-    memory_region_init_ram(&s->prom, NULL, "sun4m.prom", PROM_SIZE_MAX);
+    memory_region_init_ram(&s->prom, OBJECT(s), "sun4m.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
     memory_region_set_readonly(&s->prom, true);
     sysbus_init_mmio(dev, &s->prom);
@@ -734,7 +735,7 @@ static int ram_init1(SysBusDevice *dev)
 {
     RamDevice *d = FROM_SYSBUS(RamDevice, dev);
 
-    memory_region_init_ram(&d->ram, NULL, "sun4m.ram", d->size);
+    memory_region_init_ram(&d->ram, OBJECT(d), "sun4m.ram", d->size);
     vmstate_register_ram_global(&d->ram);
     sysbus_init_mmio(dev, &d->ram);
     return 0;
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 4643a83..0df4dfc 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -680,7 +680,7 @@ static int prom_init1(SysBusDevice *dev)
 {
     PROMState *s = FROM_SYSBUS(PROMState, dev);
 
-    memory_region_init_ram(&s->prom, NULL, "sun4u.prom", PROM_SIZE_MAX);
+    memory_region_init_ram(&s->prom, OBJECT(s), "sun4u.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
     memory_region_set_readonly(&s->prom, true);
     sysbus_init_mmio(dev, &s->prom);
@@ -720,7 +720,7 @@ static int ram_init1(SysBusDevice *dev)
 {
     RamDevice *d = FROM_SYSBUS(RamDevice, dev);
 
-    memory_region_init_ram(&d->ram, NULL, "sun4u.ram", d->size);
+    memory_region_init_ram(&d->ram, OBJECT(d), "sun4u.ram", d->size);
     vmstate_register_ram_global(&d->ram);
     sysbus_init_mmio(dev, &d->ram);
     return 0;
diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index ab569d6..711a0c1 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -277,7 +277,7 @@ static int pl022_init(SysBusDevice *dev)
 {
     pl022_state *s = FROM_SYSBUS(pl022_state, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &pl022_ops, s, "pl022", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl022_ops, s, "pl022", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->ssi = ssi_create_bus(&dev->qdev, "ssi");
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index 7a3c356..7a9fd81 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -330,7 +330,8 @@ static int xilinx_spi_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->cs_lines[i]);
     }
 
-    memory_region_init_io(&s->mmio, NULL, &spi_ops, s, "xilinx-spi", R_MAX * 4);
+    memory_region_init_io(&s->mmio, OBJECT(s), &spi_ops, s,
+                          "xilinx-spi", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
     s->irqline = -1;
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index d7b5074..6a28746 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -663,7 +663,8 @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
         sysbus_init_irq(sbd, &s->cs_lines[i]);
     }
 
-    memory_region_init_io(&s->iomem, NULL, xsc->reg_ops, s, "spi", R_MAX*4);
+    memory_region_init_io(&s->iomem, OBJECT(s), xsc->reg_ops, s,
+                          "spi", R_MAX*4);
     sysbus_init_mmio(sbd, &s->iomem);
 
     s->irqline = -1;
@@ -685,7 +686,7 @@ static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
     s->num_txrx_bytes = 4;
 
     xilinx_spips_realize(dev, errp);
-    memory_region_init_io(&s->mmlqspi, NULL, &lqspi_ops, s, "lqspi",
+    memory_region_init_io(&s->mmlqspi, OBJECT(s), &lqspi_ops, s, "lqspi",
                           (1 << LQSPI_ADDRESS_BITS) * 2);
     sysbus_init_mmio(sbd, &s->mmlqspi);
 
commit 40c5dce99bac2d1d5f240c8c8ec53dc23ea46a89
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/p*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/pci-bridge/dec.c b/hw/pci-bridge/dec.c
index 3e84473..efc07c4 100644
--- a/hw/pci-bridge/dec.c
+++ b/hw/pci-bridge/dec.c
@@ -98,9 +98,9 @@ static int pci_dec_21154_device_init(SysBusDevice *dev)
 
     phb = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&phb->conf_mem, NULL, &pci_host_conf_le_ops,
+    memory_region_init_io(&phb->conf_mem, OBJECT(dev), &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&phb->data_mem, NULL, &pci_host_data_le_ops,
+    memory_region_init_io(&phb->data_mem, OBJECT(dev), &pci_host_data_le_ops,
                           dev, "pci-data-idx", 0x1000);
     sysbus_init_mmio(dev, &phb->conf_mem);
     sysbus_init_mmio(dev, &phb->data_mem);
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index c2660f1..5f11323 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -46,7 +46,7 @@ static int pci_bridge_dev_initfn(PCIDevice *dev)
     if (err) {
         goto bridge_error;
     }
-    memory_region_init(&bridge_dev->bar, NULL, "shpc-bar", shpc_bar_size(dev));
+    memory_region_init(&bridge_dev->bar, OBJECT(dev), "shpc-bar", shpc_bar_size(dev));
     err = shpc_init(dev, &br->sec_bus, &bridge_dev->bar, 0);
     if (err) {
         goto shpc_error;
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index 7a8ce25..06ace08 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -447,7 +447,7 @@ PCIBus *pci_apb_init(hwaddr special_base,
     sysbus_mmio_map(s, 2, special_base + 0x2000000ULL);
     d = FROM_SYSBUS(APBState, s);
 
-    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
+    memory_region_init(&d->pci_mmio, OBJECT(s), "pci-mmio", 0x100000000ULL);
     memory_region_add_subregion(get_system_memory(), mem_base, &d->pci_mmio);
 
     d->bus = pci_register_bus(&d->busdev.qdev, "pci",
@@ -525,18 +525,18 @@ static int pci_pbm_init_device(SysBusDevice *dev)
     s->pci_irq_in = 0ULL;
 
     /* apb_config */
-    memory_region_init_io(&s->apb_config, NULL, &apb_config_ops, s, "apb-config",
-                          0x10000);
+    memory_region_init_io(&s->apb_config, OBJECT(s), &apb_config_ops, s,
+                          "apb-config", 0x10000);
     /* at region 0 */
     sysbus_init_mmio(dev, &s->apb_config);
 
-    memory_region_init_io(&s->pci_config, NULL, &pci_config_ops, s, "apb-pci-config",
-                          0x1000000);
+    memory_region_init_io(&s->pci_config, OBJECT(s), &pci_config_ops, s,
+                          "apb-pci-config", 0x1000000);
     /* at region 1 */
     sysbus_init_mmio(dev, &s->pci_config);
 
     /* pci_ioport */
-    memory_region_init_io(&s->pci_ioport, NULL, &pci_ioport_ops, s,
+    memory_region_init_io(&s->pci_ioport, OBJECT(s), &pci_ioport_ops, s,
                           "apb-pci-ioport", 0x10000);
     /* at region 2 */
     sysbus_init_mmio(dev, &s->pci_ioport);
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index ae00775..592d666 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -722,29 +722,29 @@ static int bonito_initfn(PCIDevice *dev)
     pci_config_set_prog_interface(dev->config, 0x00);
 
     /* set the north bridge register mapping */
-    memory_region_init_io(&s->iomem, NULL, &bonito_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &bonito_ops, s,
                           "north-bridge-register", BONITO_INTERNAL_REG_SIZE);
     sysbus_init_mmio(sysbus, &s->iomem);
     sysbus_mmio_map(sysbus, 0, BONITO_INTERNAL_REG_BASE);
 
     /* set the north bridge pci configure  mapping */
-    memory_region_init_io(&phb->conf_mem, NULL, &bonito_pciconf_ops, s,
+    memory_region_init_io(&phb->conf_mem, OBJECT(s), &bonito_pciconf_ops, s,
                           "north-bridge-pci-config", BONITO_PCICONFIG_SIZE);
     sysbus_init_mmio(sysbus, &phb->conf_mem);
     sysbus_mmio_map(sysbus, 1, BONITO_PCICONFIG_BASE);
 
     /* set the south bridge pci configure  mapping */
-    memory_region_init_io(&phb->data_mem, NULL, &bonito_spciconf_ops, s,
+    memory_region_init_io(&phb->data_mem, OBJECT(s), &bonito_spciconf_ops, s,
                           "south-bridge-pci-config", BONITO_SPCICONFIG_SIZE);
     sysbus_init_mmio(sysbus, &phb->data_mem);
     sysbus_mmio_map(sysbus, 2, BONITO_SPCICONFIG_BASE);
 
-    memory_region_init_io(&s->iomem_ldma, NULL, &bonito_ldma_ops, s,
+    memory_region_init_io(&s->iomem_ldma, OBJECT(s), &bonito_ldma_ops, s,
                           "ldma", 0x100);
     sysbus_init_mmio(sysbus, &s->iomem_ldma);
     sysbus_mmio_map(sysbus, 3, 0xbfe00200);
 
-    memory_region_init_io(&s->iomem_cop, NULL, &bonito_cop_ops, s,
+    memory_region_init_io(&s->iomem_cop, OBJECT(s), &bonito_cop_ops, s,
                           "cop", 0x100);
     sysbus_init_mmio(sysbus, &s->iomem_cop);
     sysbus_mmio_map(sysbus, 4, 0xbfe00300);
diff --git a/hw/pci-host/grackle.c b/hw/pci-host/grackle.c
index da0fedb..4991ec4 100644
--- a/hw/pci-host/grackle.c
+++ b/hw/pci-host/grackle.c
@@ -76,8 +76,8 @@ PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic,
     phb = PCI_HOST_BRIDGE(dev);
     d = GRACKLE_PCI_HOST_BRIDGE(dev);
 
-    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
-    memory_region_init_alias(&d->pci_hole, NULL, "pci-hole", &d->pci_mmio,
+    memory_region_init(&d->pci_mmio, OBJECT(s), "pci-mmio", 0x100000000ULL);
+    memory_region_init_alias(&d->pci_hole, OBJECT(s), "pci-hole", &d->pci_mmio,
                              0x80000000ULL, 0x7e000000ULL);
     memory_region_add_subregion(address_space_mem, 0x80000000ULL,
                                 &d->pci_hole);
@@ -104,9 +104,9 @@ static int pci_grackle_init_device(SysBusDevice *dev)
 
     phb = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&phb->conf_mem, NULL, &pci_host_conf_le_ops,
+    memory_region_init_io(&phb->conf_mem, OBJECT(dev), &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&phb->data_mem, NULL, &pci_host_data_le_ops,
+    memory_region_init_io(&phb->data_mem, OBJECT(dev), &pci_host_data_le_ops,
                           dev, "pci-data-idx", 0x1000);
     sysbus_init_mmio(dev, &phb->conf_mem);
     sysbus_init_mmio(dev, &phb->data_mem);
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index e179912..2ab1599 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -201,12 +201,12 @@ static int i440fx_pcihost_initfn(SysBusDevice *dev)
 {
     PCIHostState *s = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&s->conf_mem, NULL, &pci_host_conf_le_ops, s,
+    memory_region_init_io(&s->conf_mem, OBJECT(dev), &pci_host_conf_le_ops, s,
                           "pci-conf-idx", 4);
     sysbus_add_io(dev, 0xcf8, &s->conf_mem);
     sysbus_init_ioports(&s->busdev, 0xcf8, 4);
 
-    memory_region_init_io(&s->data_mem, NULL, &pci_host_data_le_ops, s,
+    memory_region_init_io(&s->data_mem, OBJECT(dev), &pci_host_data_le_ops, s,
                           "pci-conf-data", 4);
     sysbus_add_io(dev, 0xcfc, &s->data_mem);
     sysbus_init_ioports(&s->busdev, 0xcfc, 4);
@@ -260,17 +260,17 @@ static PCIBus *i440fx_common_init(const char *device_name,
     f->system_memory = address_space_mem;
     f->pci_address_space = pci_address_space;
     f->ram_memory = ram_memory;
-    memory_region_init_alias(&f->pci_hole, NULL, "pci-hole", f->pci_address_space,
+    memory_region_init_alias(&f->pci_hole, OBJECT(d), "pci-hole", f->pci_address_space,
                              pci_hole_start, pci_hole_size);
     memory_region_add_subregion(f->system_memory, pci_hole_start, &f->pci_hole);
-    memory_region_init_alias(&f->pci_hole_64bit, NULL, "pci-hole64",
+    memory_region_init_alias(&f->pci_hole_64bit, OBJECT(d), "pci-hole64",
                              f->pci_address_space,
                              pci_hole64_start, pci_hole64_size);
     if (pci_hole64_size) {
         memory_region_add_subregion(f->system_memory, pci_hole64_start,
                                     &f->pci_hole_64bit);
     }
-    memory_region_init_alias(&f->smram_region, NULL, "smram-region",
+    memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
                              f->pci_address_space, 0xa0000, 0x20000);
     memory_region_add_subregion_overlap(f->system_memory, 0xa0000,
                                         &f->smram_region, 1);
@@ -549,7 +549,8 @@ static int piix3_initfn(PCIDevice *dev)
 
     isa_bus_new(DEVICE(d), pci_address_space_io(dev));
 
-    memory_region_init_io(&d->rcr_mem, NULL, &rcr_ops, d, "piix3-reset-control", 1);
+    memory_region_init_io(&d->rcr_mem, OBJECT(dev), &rcr_ops, d,
+                          "piix3-reset-control", 1);
     memory_region_add_subregion_overlap(pci_address_space_io(dev), RCR_IOPORT,
                                         &d->rcr_mem, 1);
 
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 7d8c59b..646204e 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -330,7 +330,7 @@ static int e500_pcihost_bridge_initfn(PCIDevice *d)
         (d->config[PCI_HEADER_TYPE] & PCI_HEADER_TYPE_MULTI_FUNCTION) |
         PCI_HEADER_TYPE_BRIDGE;
 
-    memory_region_init_alias(&b->bar0, NULL, "e500-pci-bar0", &ccsr->ccsr_space,
+    memory_region_init_alias(&b->bar0, OBJECT(ccsr), "e500-pci-bar0", &ccsr->ccsr_space,
                              0, int128_get64(ccsr->ccsr_space.size));
     pci_register_bar(d, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &b->bar0);
 
@@ -352,7 +352,7 @@ static int e500_pcihost_initfn(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->irq[i]);
     }
 
-    memory_region_init(&s->pio, NULL, "pci-pio", PCIE500_PCI_IOLEN);
+    memory_region_init(&s->pio, OBJECT(s), "pci-pio", PCIE500_PCI_IOLEN);
 
     b = pci_register_bus(DEVICE(dev), NULL, mpc85xx_pci_set_irq,
                          mpc85xx_pci_map_irq, s->irq, address_space_mem,
@@ -361,12 +361,12 @@ static int e500_pcihost_initfn(SysBusDevice *dev)
 
     pci_create_simple(b, 0, "e500-host-bridge");
 
-    memory_region_init(&s->container, NULL, "pci-container", PCIE500_ALL_SIZE);
-    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_be_ops, h,
+    memory_region_init(&s->container, OBJECT(h), "pci-container", PCIE500_ALL_SIZE);
+    memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_be_ops, h,
                           "pci-conf-idx", 4);
-    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops, h,
+    memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_le_ops, h,
                           "pci-conf-data", 4);
-    memory_region_init_io(&s->iomem, NULL, &e500_pci_reg_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &e500_pci_reg_ops, s,
                           "pci.reg", PCIE500_REG_SIZE);
     memory_region_add_subregion(&s->container, PCIE500_CFGADDR, &h->conf_mem);
     memory_region_add_subregion(&s->container, PCIE500_CFGDATA, &h->data_mem);
diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index 024cd51..b41d564 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -125,20 +125,20 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
 
     pci_bus_irqs(&s->pci_bus, prep_set_irq, prep_map_irq, s->irq, 4);
 
-    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_be_ops, s,
+    memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_be_ops, s,
                           "pci-conf-idx", 1);
     sysbus_add_io(dev, 0xcf8, &h->conf_mem);
     sysbus_init_ioports(&h->busdev, 0xcf8, 1);
 
-    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_be_ops, s,
+    memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_be_ops, s,
                           "pci-conf-data", 1);
     sysbus_add_io(dev, 0xcfc, &h->data_mem);
     sysbus_init_ioports(&h->busdev, 0xcfc, 1);
 
-    memory_region_init_io(&h->mmcfg, NULL, &PPC_PCIIO_ops, s, "pciio", 0x00400000);
+    memory_region_init_io(&h->mmcfg, OBJECT(s), &PPC_PCIIO_ops, s, "pciio", 0x00400000);
     memory_region_add_subregion(address_space_mem, 0x80800000, &h->mmcfg);
 
-    memory_region_init_io(&s->intack, NULL, &PPC_intack_ops, s, "pci-intack", 1);
+    memory_region_init_io(&s->intack, OBJECT(s), &PPC_intack_ops, s, "pci-intack", 1);
     memory_region_add_subregion(address_space_mem, 0xbffffff0, &s->intack);
 
     /* TODO Remove once realize propagates to child devices. */
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 49ccf80..5661ace 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -40,12 +40,12 @@ static int q35_host_init(SysBusDevice *dev)
     PCIHostState *pci = FROM_SYSBUS(PCIHostState, dev);
     Q35PCIHost *s = Q35_HOST_DEVICE(&dev->qdev);
 
-    memory_region_init_io(&pci->conf_mem, NULL, &pci_host_conf_le_ops, pci,
+    memory_region_init_io(&pci->conf_mem, OBJECT(pci), &pci_host_conf_le_ops, pci,
                           "pci-conf-idx", 4);
     sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_ADDR, &pci->conf_mem);
     sysbus_init_ioports(&pci->busdev, MCH_HOST_BRIDGE_CONFIG_ADDR, 4);
 
-    memory_region_init_io(&pci->data_mem, NULL, &pci_host_data_le_ops, pci,
+    memory_region_init_io(&pci->data_mem, OBJECT(pci), &pci_host_data_le_ops, pci,
                           "pci-conf-data", 4);
     sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_DATA, &pci->data_mem);
     sysbus_init_ioports(&pci->busdev, MCH_HOST_BRIDGE_CONFIG_DATA, 4);
@@ -245,7 +245,7 @@ static int mch_init(PCIDevice *d)
     MCHPCIState *mch = MCH_PCI_DEVICE(d);
 
     /* setup pci memory regions */
-    memory_region_init_alias(&mch->pci_hole, NULL, "pci-hole",
+    memory_region_init_alias(&mch->pci_hole, OBJECT(mch), "pci-hole",
                              mch->pci_address_space,
                              mch->below_4g_mem_size,
                              0x100000000ULL - mch->below_4g_mem_size);
@@ -253,7 +253,7 @@ static int mch_init(PCIDevice *d)
                                 &mch->pci_hole);
     pci_hole64_size = (sizeof(hwaddr) == 4 ? 0 :
                        ((uint64_t)1 << 62));
-    memory_region_init_alias(&mch->pci_hole_64bit, NULL, "pci-hole64",
+    memory_region_init_alias(&mch->pci_hole_64bit, OBJECT(mch), "pci-hole64",
                              mch->pci_address_space,
                              0x100000000ULL + mch->above_4g_mem_size,
                              pci_hole64_size);
@@ -264,7 +264,7 @@ static int mch_init(PCIDevice *d)
     }
     /* smram */
     cpu_smm_register(&mch_set_smm, mch);
-    memory_region_init_alias(&mch->smram_region, NULL, "smram-region",
+    memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-region",
                              mch->pci_address_space, 0xa0000, 0x20000);
     memory_region_add_subregion_overlap(mch->system_memory, 0xa0000,
                                         &mch->smram_region, 1);
diff --git a/hw/pci-host/uninorth.c b/hw/pci-host/uninorth.c
index b72659d..91530cd 100644
--- a/hw/pci-host/uninorth.c
+++ b/hw/pci-host/uninorth.c
@@ -152,9 +152,9 @@ static int pci_unin_main_init_device(SysBusDevice *dev)
     /* Uninorth main bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, NULL, &unin_data_ops, dev,
+    memory_region_init_io(&h->data_mem, OBJECT(h), &unin_data_ops, dev,
                           "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -170,9 +170,9 @@ static int pci_u3_agp_init_device(SysBusDevice *dev)
     /* Uninorth U3 AGP bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, NULL, &unin_data_ops, dev,
+    memory_region_init_io(&h->data_mem, OBJECT(h), &unin_data_ops, dev,
                           "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -187,9 +187,9 @@ static int pci_unin_agp_init_device(SysBusDevice *dev)
     /* Uninorth AGP bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops,
+    memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_le_ops,
                           dev, "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -203,9 +203,9 @@ static int pci_unin_internal_init_device(SysBusDevice *dev)
     /* Uninorth internal bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops,
+    memory_region_init_io(&h->data_mem, OBJECT(h), &pci_host_data_le_ops,
                           dev, "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -228,8 +228,8 @@ PCIBus *pci_pmac_init(qemu_irq *pic,
     s = SYS_BUS_DEVICE(dev);
     h = PCI_HOST_BRIDGE(s);
     d = UNI_NORTH_PCI_HOST_BRIDGE(dev);
-    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
-    memory_region_init_alias(&d->pci_hole, NULL, "pci-hole", &d->pci_mmio,
+    memory_region_init(&d->pci_mmio, OBJECT(d), "pci-mmio", 0x100000000ULL);
+    memory_region_init_alias(&d->pci_hole, OBJECT(d), "pci-hole", &d->pci_mmio,
                              0x80000000ULL, 0x70000000ULL);
     memory_region_add_subregion(address_space_mem, 0x80000000ULL,
                                 &d->pci_hole);
@@ -294,8 +294,8 @@ PCIBus *pci_pmac_u3_init(qemu_irq *pic,
     h = PCI_HOST_BRIDGE(dev);
     d = U3_AGP_HOST_BRIDGE(dev);
 
-    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
-    memory_region_init_alias(&d->pci_hole, NULL, "pci-hole", &d->pci_mmio,
+    memory_region_init(&d->pci_mmio, OBJECT(d), "pci-mmio", 0x100000000ULL);
+    memory_region_init_alias(&d->pci_hole, OBJECT(d), "pci-hole", &d->pci_mmio,
                              0x80000000ULL, 0x70000000ULL);
     memory_region_add_subregion(address_space_mem, 0x80000000ULL,
                                 &d->pci_hole);
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index f7df274..9238d39 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -381,8 +381,8 @@ static void pci_vpb_init(Object *obj)
     PCIHostState *h = PCI_HOST_BRIDGE(obj);
     PCIVPBState *s = PCI_VPB(obj);
 
-    memory_region_init(&s->pci_io_space, NULL, "pci_io", 1ULL << 32);
-    memory_region_init(&s->pci_mem_space, NULL, "pci_mem", 1ULL << 32);
+    memory_region_init(&s->pci_io_space, OBJECT(s), "pci_io", 1ULL << 32);
+    memory_region_init(&s->pci_mem_space, OBJECT(s), "pci_mem", 1ULL << 32);
 
     pci_bus_new_inplace(&s->pci_bus, DEVICE(obj), "pci",
                         &s->pci_mem_space, &s->pci_io_space,
@@ -424,20 +424,20 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
      * 3 : PCI IO window
      * 4..6 : PCI memory windows
      */
-    memory_region_init_io(&s->controlregs, NULL, &pci_vpb_reg_ops, s, "pci-vpb-regs",
-                          0x1000);
+    memory_region_init_io(&s->controlregs, OBJECT(s), &pci_vpb_reg_ops, s,
+                          "pci-vpb-regs", 0x1000);
     sysbus_init_mmio(sbd, &s->controlregs);
-    memory_region_init_io(&s->mem_config, NULL, &pci_vpb_config_ops, s,
+    memory_region_init_io(&s->mem_config, OBJECT(s), &pci_vpb_config_ops, s,
                           "pci-vpb-selfconfig", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config);
-    memory_region_init_io(&s->mem_config2, NULL, &pci_vpb_config_ops, s,
+    memory_region_init_io(&s->mem_config2, OBJECT(s), &pci_vpb_config_ops, s,
                           "pci-vpb-config", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config2);
 
     /* The window into I/O space is always into a fixed base address;
      * its size is the same for both realview and versatile.
      */
-    memory_region_init_alias(&s->pci_io_window, NULL, "pci-vbp-io-window",
+    memory_region_init_alias(&s->pci_io_window, OBJECT(s), "pci-vbp-io-window",
                              &s->pci_io_space, 0, 0x100000);
 
     sysbus_init_mmio(sbd, &s->pci_io_space);
@@ -447,7 +447,7 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
      * offsets are guest controllable via the IMAP registers.
      */
     for (i = 0; i < 3; i++) {
-        memory_region_init_alias(&s->pci_mem_window[i], NULL, "pci-vbp-window",
+        memory_region_init_alias(&s->pci_mem_window[i], OBJECT(s), "pci-vbp-window",
                                  &s->pci_mem_space, 0, s->mem_win_size[i]);
         sysbus_init_mmio(sbd, &s->pci_mem_window[i]);
     }
diff --git a/hw/pci/msix.c b/hw/pci/msix.c
index 83dfc7a..3430770 100644
--- a/hw/pci/msix.c
+++ b/hw/pci/msix.c
@@ -280,10 +280,10 @@ int msix_init(struct PCIDevice *dev, unsigned short nentries,
 
     msix_mask_all(dev, nentries);
 
-    memory_region_init_io(&dev->msix_table_mmio, NULL, &msix_table_mmio_ops, dev,
+    memory_region_init_io(&dev->msix_table_mmio, OBJECT(dev), &msix_table_mmio_ops, dev,
                           "msix-table", table_size);
     memory_region_add_subregion(table_bar, table_offset, &dev->msix_table_mmio);
-    memory_region_init_io(&dev->msix_pba_mmio, NULL, &msix_pba_mmio_ops, dev,
+    memory_region_init_io(&dev->msix_pba_mmio, OBJECT(dev), &msix_pba_mmio_ops, dev,
                           "msix-pba", pba_size);
     memory_region_add_subregion(pba_bar, pba_offset, &dev->msix_pba_mmio);
 
@@ -311,7 +311,7 @@ int msix_init_exclusive_bar(PCIDevice *dev, unsigned short nentries,
     }
 
     name = g_strdup_printf("%s-msix", dev->name);
-    memory_region_init(&dev->msix_exclusive_bar, NULL, name, MSIX_EXCLUSIVE_BAR_SIZE);
+    memory_region_init(&dev->msix_exclusive_bar, OBJECT(dev), name, MSIX_EXCLUSIVE_BAR_SIZE);
     g_free(name);
 
     ret = msix_init(dev, nentries, &dev->msix_exclusive_bar, bar_nr,
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index a29a385..ceb6a5d 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -811,7 +811,8 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
         dma_as = &address_space_memory;
     }
 
-    memory_region_init_alias(&pci_dev->bus_master_enable_region, NULL, "bus master",
+    memory_region_init_alias(&pci_dev->bus_master_enable_region,
+                             OBJECT(pci_dev), "bus master",
                              dma_as->root, 0, memory_region_size(dma_as->root));
     memory_region_set_enabled(&pci_dev->bus_master_enable_region, false);
     address_space_init(&pci_dev->bus_master_as, &pci_dev->bus_master_enable_region,
@@ -1945,7 +1946,7 @@ static int pci_add_option_rom(PCIDevice *pdev, bool is_default_rom)
         snprintf(name, sizeof(name), "%s.rom", object_get_typename(OBJECT(pdev)));
     }
     pdev->has_rom = true;
-    memory_region_init_ram(&pdev->rom, NULL, name, size);
+    memory_region_init_ram(&pdev->rom, OBJECT(pdev), name, size);
     vmstate_register_ram(&pdev->rom, &pdev->qdev);
     ptr = memory_region_get_ram_ptr(&pdev->rom);
     load_image(path, ptr);
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 28ae65e..ecdeab0 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -147,7 +147,7 @@ static void pci_bridge_init_alias(PCIBridge *bridge, MemoryRegion *alias,
      * Apparently no way to do this with existing memory APIs. */
     pcibus_t size = enabled && limit >= base ? limit + 1 - base : 0;
 
-    memory_region_init_alias(alias, NULL, name, space, base, size);
+    memory_region_init_alias(alias, OBJECT(bridge), name, space, base, size);
     memory_region_add_subregion_overlap(parent_space, base, alias, 1);
 }
 
@@ -156,13 +156,13 @@ static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
 {
     uint16_t brctl = pci_get_word(br->dev.config + PCI_BRIDGE_CONTROL);
 
-    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_LO], NULL,
+    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_LO], OBJECT(br),
                              "pci_bridge_vga_io_lo", &br->address_space_io,
                              QEMU_PCI_VGA_IO_LO_BASE, QEMU_PCI_VGA_IO_LO_SIZE);
-    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_HI], NULL,
+    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_HI], OBJECT(br),
                              "pci_bridge_vga_io_hi", &br->address_space_io,
                              QEMU_PCI_VGA_IO_HI_BASE, QEMU_PCI_VGA_IO_HI_SIZE);
-    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_MEM], NULL,
+    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_MEM], OBJECT(br),
                              "pci_bridge_vga_mem", &br->address_space_mem,
                              QEMU_PCI_VGA_MEM_BASE, QEMU_PCI_VGA_MEM_SIZE);
 
@@ -367,9 +367,9 @@ int pci_bridge_initfn(PCIDevice *dev, const char *typename)
     sec_bus->parent_dev = dev;
     sec_bus->map_irq = br->map_irq ? br->map_irq : pci_swizzle_map_irq_fn;
     sec_bus->address_space_mem = &br->address_space_mem;
-    memory_region_init(&br->address_space_mem, NULL, "pci_bridge_pci", INT64_MAX);
+    memory_region_init(&br->address_space_mem, OBJECT(br), "pci_bridge_pci", INT64_MAX);
     sec_bus->address_space_io = &br->address_space_io;
-    memory_region_init(&br->address_space_io, NULL, "pci_bridge_io", 65536);
+    memory_region_init(&br->address_space_io, OBJECT(br), "pci_bridge_io", 65536);
     br->windows = pci_bridge_region_init(br);
     QLIST_INIT(&sec_bus->child);
     QLIST_INSERT_HEAD(&parent->child, sec_bus, sibling);
diff --git a/hw/pci/pcie_host.c b/hw/pci/pcie_host.c
index 26f2007..b70e5ad 100644
--- a/hw/pci/pcie_host.c
+++ b/hw/pci/pcie_host.c
@@ -130,7 +130,8 @@ void pcie_host_mmcfg_map(PCIExpressHost *e, hwaddr addr,
     assert(size >= PCIE_MMCFG_SIZE_MIN);
     assert(size <= PCIE_MMCFG_SIZE_MAX);
     e->size = size;
-    memory_region_init_io(&e->mmio, NULL, &pcie_mmcfg_ops, e, "pcie-mmcfg", e->size);
+    memory_region_init_io(&e->mmio, OBJECT(e), &pcie_mmcfg_ops, e,
+                          "pcie-mmcfg", e->size);
     e->base_addr = addr;
     memory_region_add_subregion(get_system_memory(), e->base_addr, &e->mmio);
 }
diff --git a/hw/pci/shpc.c b/hw/pci/shpc.c
index c4eae07..eb092fd 100644
--- a/hw/pci/shpc.c
+++ b/hw/pci/shpc.c
@@ -612,8 +612,8 @@ int shpc_init(PCIDevice *d, PCIBus *sec_bus, MemoryRegion *bar, unsigned offset)
     }
 
     /* TODO: init cmask */
-    memory_region_init_io(&shpc->mmio, NULL, &shpc_mmio_ops, d, "shpc-mmio",
-                          SHPC_SIZEOF(d));
+    memory_region_init_io(&shpc->mmio, OBJECT(d), &shpc_mmio_ops,
+                          d, "shpc-mmio", SHPC_SIZEOF(d));
     shpc_cap_update_dword(d);
     memory_region_add_subregion(bar, offset, &shpc->mmio);
     pci_bus_hotplug(sec_bus, shpc_device_hotplug, &d->qdev);
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index b45fe91..a385b51 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -783,7 +783,7 @@ static int e500_ccsr_initfn(SysBusDevice *dev)
     PPCE500CCSRState *ccsr;
 
     ccsr = CCSR(dev);
-    memory_region_init(&ccsr->ccsr_space, NULL, "e500-ccsr",
+    memory_region_init(&ccsr->ccsr_space, OBJECT(ccsr), "e500-ccsr",
                        MPC8544_CCSRBAR_SIZE);
     return 0;
 }
diff --git a/hw/ppc/mpc8544_guts.c b/hw/ppc/mpc8544_guts.c
index 56249b4..2e2f2eb 100644
--- a/hw/ppc/mpc8544_guts.c
+++ b/hw/ppc/mpc8544_guts.c
@@ -119,7 +119,7 @@ static void mpc8544_guts_initfn(Object *obj)
     SysBusDevice *d = SYS_BUS_DEVICE(obj);
     GutsState *s = MPC8544_GUTS(obj);
 
-    memory_region_init_io(&s->iomem, NULL, &mpc8544_guts_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &mpc8544_guts_ops, s,
                           "mpc8544.guts", MPC8544_GUTS_MMIO_SIZE);
     sysbus_init_mmio(d, &s->iomem);
 }
diff --git a/hw/ppc/ppc4xx_pci.c b/hw/ppc/ppc4xx_pci.c
index f227043..d2d6f65 100644
--- a/hw/ppc/ppc4xx_pci.c
+++ b/hw/ppc/ppc4xx_pci.c
@@ -355,12 +355,12 @@ static int ppc4xx_pcihost_initfn(SysBusDevice *dev)
     pci_create_simple(b, 0, "ppc4xx-host-bridge");
 
     /* XXX split into 2 memory regions, one for config space, one for regs */
-    memory_region_init(&s->container, NULL, "pci-container", PCI_ALL_SIZE);
-    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops, h,
+    memory_region_init(&s->container, OBJECT(s), "pci-container", PCI_ALL_SIZE);
+    memory_region_init_io(&h->conf_mem, OBJECT(s), &pci_host_conf_le_ops, h,
                           "pci-conf-idx", 4);
-    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops, h,
+    memory_region_init_io(&h->data_mem, OBJECT(s), &pci_host_data_le_ops, h,
                           "pci-conf-data", 4);
-    memory_region_init_io(&s->iomem, NULL, &pci_reg_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &pci_reg_ops, s,
                           "pci.reg", PCI_REG_SIZE);
     memory_region_add_subregion(&s->container, PCIC0_CFGADDR, &h->conf_mem);
     memory_region_add_subregion(&s->container, PCIC0_CFGDATA, &h->data_mem);
diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index 0817f14..11b7de2 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -191,8 +191,8 @@ static int ppce500_spin_initfn(SysBusDevice *dev)
 
     s = FROM_SYSBUS(SpinState, SYS_BUS_DEVICE(dev));
 
-    memory_region_init_io(&s->iomem, NULL, &spin_rw_ops, s, "e500 spin pv device",
-                          sizeof(SpinInfo) * MAX_CPUS);
+    memory_region_init_io(&s->iomem, OBJECT(s), &spin_rw_ops, s,
+                          "e500 spin pv device", sizeof(SpinInfo) * MAX_CPUS);
     sysbus_init_mmio(dev, &s->iomem);
 
     qemu_register_reset(spin_reset, s);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 7710aa0..232b0a8 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -581,10 +581,11 @@ static int spapr_phb_init(SysBusDevice *s)
 
     /* Initialize memory regions */
     sprintf(namebuf, "%s.mmio", sphb->dtbusname);
-    memory_region_init(&sphb->memspace, NULL, namebuf, INT64_MAX);
+    memory_region_init(&sphb->memspace, OBJECT(sphb), namebuf, INT64_MAX);
 
     sprintf(namebuf, "%s.mmio-alias", sphb->dtbusname);
-    memory_region_init_alias(&sphb->memwindow, NULL, namebuf, &sphb->memspace,
+    memory_region_init_alias(&sphb->memwindow, OBJECT(sphb),
+                             namebuf, &sphb->memspace,
                              SPAPR_PCI_MEM_WIN_BUS_OFFSET, sphb->mem_win_size);
     memory_region_add_subregion(get_system_memory(), sphb->mem_win_addr,
                                 &sphb->memwindow);
@@ -598,12 +599,13 @@ static int spapr_phb_init(SysBusDevice *s)
      * system_io works around the problem until all the users of
      * old_portion are updated */
     sprintf(namebuf, "%s.io", sphb->dtbusname);
-    memory_region_init(&sphb->iospace, NULL, namebuf, SPAPR_PCI_IO_WIN_SIZE);
+    memory_region_init(&sphb->iospace, OBJECT(sphb),
+                       namebuf, SPAPR_PCI_IO_WIN_SIZE);
     /* FIXME: fix to support multiple PHBs */
     memory_region_add_subregion(get_system_io(), 0, &sphb->iospace);
 
     sprintf(namebuf, "%s.io-alias", sphb->dtbusname);
-    memory_region_init_io(&sphb->iowindow, NULL, &spapr_io_ops, sphb,
+    memory_region_init_io(&sphb->iowindow, OBJECT(sphb), &spapr_io_ops, sphb,
                           namebuf, SPAPR_PCI_IO_WIN_SIZE);
     memory_region_add_subregion(get_system_memory(), sphb->io_win_addr,
                                 &sphb->iowindow);
@@ -613,7 +615,7 @@ static int spapr_phb_init(SysBusDevice *s)
      * from msi_notify()/msix_notify() */
     if (msi_supported) {
         sprintf(namebuf, "%s.msi", sphb->dtbusname);
-        memory_region_init_io(&sphb->msiwindow, NULL, &spapr_msi_ops, sphb,
+        memory_region_init_io(&sphb->msiwindow, OBJECT(sphb), &spapr_msi_ops, sphb,
                               namebuf, SPAPR_MSIX_MAX_DEVS * 0x10000);
         memory_region_add_subregion(get_system_memory(), sphb->msi_win_addr,
                                     &sphb->msiwindow);
commit eedfac6f38b2ba8be827088cd3facd19d21af1e1
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/n*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index c94d3e7..ac929cb 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1163,7 +1163,8 @@ static int gem_init(SysBusDevice *dev)
 
     s = FROM_SYSBUS(GemState, dev);
     gem_init_register_masks(s);
-    memory_region_init_io(&s->iomem, NULL, &gem_ops, s, "enet", sizeof(s->regs));
+    memory_region_init_io(&s->iomem, OBJECT(s), &gem_ops, s,
+                          "enet", sizeof(s->regs));
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index e5c0978..c8c3a06 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1276,13 +1276,13 @@ e1000_mmio_setup(E1000State *d)
         E1000_IMC, E1000_TCTL, E1000_TDT, PNPMMIO_SIZE
     };
 
-    memory_region_init_io(&d->mmio, NULL, &e1000_mmio_ops, d, "e1000-mmio",
-                          PNPMMIO_SIZE);
+    memory_region_init_io(&d->mmio, OBJECT(d), &e1000_mmio_ops, d,
+                          "e1000-mmio", PNPMMIO_SIZE);
     memory_region_add_coalescing(&d->mmio, 0, excluded_regs[0]);
     for (i = 0; excluded_regs[i] != PNPMMIO_SIZE; i++)
         memory_region_add_coalescing(&d->mmio, excluded_regs[i] + 4,
                                      excluded_regs[i+1] - excluded_regs[i] - 4);
-    memory_region_init_io(&d->io, NULL, &e1000_io_ops, d, "e1000-io", IOPORT_SIZE);
+    memory_region_init_io(&d->io, OBJECT(d), &e1000_io_ops, d, "e1000-io", IOPORT_SIZE);
 }
 
 static void
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index abfcdbd..e0befb2 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -1876,15 +1876,15 @@ static int e100_nic_init(PCIDevice *pci_dev)
     s->eeprom = eeprom93xx_new(&pci_dev->qdev, EEPROM_SIZE);
 
     /* Handler for memory-mapped I/O */
-    memory_region_init_io(&s->mmio_bar, NULL, &eepro100_ops, s, "eepro100-mmio",
-                          PCI_MEM_SIZE);
+    memory_region_init_io(&s->mmio_bar, OBJECT(s), &eepro100_ops, s,
+                          "eepro100-mmio", PCI_MEM_SIZE);
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->mmio_bar);
-    memory_region_init_io(&s->io_bar, NULL, &eepro100_ops, s, "eepro100-io",
-                          PCI_IO_SIZE);
+    memory_region_init_io(&s->io_bar, OBJECT(s), &eepro100_ops, s,
+                          "eepro100-io", PCI_IO_SIZE);
     pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
     /* FIXME: flash aliases to mmio?! */
-    memory_region_init_io(&s->flash_bar, NULL, &eepro100_ops, s, "eepro100-flash",
-                          PCI_FLASH_SIZE);
+    memory_region_init_io(&s->flash_bar, OBJECT(s), &eepro100_ops, s,
+                          "eepro100-flash", PCI_FLASH_SIZE);
     pci_register_bar(&s->dev, 2, 0, &s->flash_bar);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/etraxfs_eth.c b/hw/net/etraxfs_eth.c
index 2ade0c0..ab9a215 100644
--- a/hw/net/etraxfs_eth.c
+++ b/hw/net/etraxfs_eth.c
@@ -610,7 +610,8 @@ static int fs_eth_init(SysBusDevice *dev)
     s->dma_in->client.opaque = s;
     s->dma_in->client.pull = NULL;
 
-    memory_region_init_io(&s->mmio, NULL, &eth_ops, s, "etraxfs-eth", 0x5c);
+    memory_region_init_io(&s->mmio, OBJECT(dev), &eth_ops, s,
+                          "etraxfs-eth", 0x5c);
     sysbus_init_mmio(dev, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index ce68399..3323f48 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -1328,7 +1328,8 @@ static int lan9118_init1(SysBusDevice *dev)
     const MemoryRegionOps *mem_ops =
             s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
 
-    memory_region_init_io(&s->mmio, NULL, mem_ops, s, "lan9118-mmio", 0x100);
+    memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
+                          "lan9118-mmio", 0x100);
     sysbus_init_mmio(dev, &s->mmio);
     sysbus_init_irq(dev, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/lance.c b/hw/net/lance.c
index 1d3999d..98bcdfc 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -117,7 +117,8 @@ static int lance_init(SysBusDevice *dev)
     SysBusPCNetState *d = FROM_SYSBUS(SysBusPCNetState, dev);
     PCNetState *s = &d->state;
 
-    memory_region_init_io(&s->mmio, NULL, &lance_mem_ops, d, "lance-mmio", 4);
+    memory_region_init_io(&s->mmio, OBJECT(d), &lance_mem_ops, d,
+                          "lance-mmio", 4);
 
     qdev_init_gpio_in(&dev->qdev, parent_lance_reset, 1);
 
diff --git a/hw/net/milkymist-minimac2.c b/hw/net/milkymist-minimac2.c
index 73fe307..2ef4ac3 100644
--- a/hw/net/milkymist-minimac2.c
+++ b/hw/net/milkymist-minimac2.c
@@ -461,12 +461,12 @@ static int milkymist_minimac2_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->rx_irq);
     sysbus_init_irq(dev, &s->tx_irq);
 
-    memory_region_init_io(&s->regs_region, NULL, &minimac2_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(dev), &minimac2_ops, s,
                           "milkymist-minimac2", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
     /* register buffers memory */
-    memory_region_init_ram(&s->buffers, NULL, "milkymist-minimac2.buffers",
+    memory_region_init_ram(&s->buffers, OBJECT(dev), "milkymist-minimac2.buffers",
                            buffers_size);
     vmstate_register_ram_global(&s->buffers);
     s->rx0_buf = memory_region_get_ram_ptr(&s->buffers);
diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index c973a21..9080850 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -235,7 +235,8 @@ static int mipsnet_sysbus_init(SysBusDevice *dev)
 {
     MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev, dev);
 
-    memory_region_init_io(&s->io, NULL, &mipsnet_ioport_ops, s, "mipsnet-io", 36);
+    memory_region_init_io(&s->io, OBJECT(dev), &mipsnet_ioport_ops, s,
+                          "mipsnet-io", 36);
     sysbus_init_mmio(dev, &s->io);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index a1baa3c..4637557 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -681,11 +681,11 @@ static int sysbus_open_eth_init(SysBusDevice *dev)
 {
     OpenEthState *s = DO_UPCAST(OpenEthState, dev, dev);
 
-    memory_region_init_io(&s->reg_io, NULL, &open_eth_reg_ops, s,
+    memory_region_init_io(&s->reg_io, OBJECT(dev), &open_eth_reg_ops, s,
             "open_eth.regs", 0x54);
     sysbus_init_mmio(dev, &s->reg_io);
 
-    memory_region_init_io(&s->desc_io, NULL, &open_eth_desc_ops, s,
+    memory_region_init_io(&s->desc_io, OBJECT(dev), &open_eth_desc_ops, s,
             "open_eth.desc", 0x400);
     sysbus_init_mmio(dev, &s->desc_io);
 
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index e098bf2..f4a5aef 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -315,10 +315,10 @@ static int pci_pcnet_init(PCIDevice *pci_dev)
     pci_conf[PCI_MAX_LAT] = 0xff;
 
     /* Handler for memory-mapped I/O */
-    memory_region_init_io(&d->state.mmio, NULL, &pcnet_mmio_ops, s, "pcnet-mmio",
-                          PCNET_PNPMMIO_SIZE);
+    memory_region_init_io(&d->state.mmio, OBJECT(d), &pcnet_mmio_ops, s,
+                          "pcnet-mmio", PCNET_PNPMMIO_SIZE);
 
-    memory_region_init_io(&d->io_bar, NULL, &pcnet_io_ops, s, "pcnet-io",
+    memory_region_init_io(&d->io_bar, OBJECT(d), &pcnet_io_ops, s, "pcnet-io",
                           PCNET_IOPORT_SIZE);
     pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &d->io_bar);
 
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index a96eb62..a00ff58 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3486,8 +3486,10 @@ static int pci_rtl8139_init(PCIDevice *dev)
      * list bit in status register, and offset 0xdc seems unused. */
     pci_conf[PCI_CAPABILITY_LIST] = 0xdc;
 
-    memory_region_init_io(&s->bar_io, NULL, &rtl8139_io_ops, s, "rtl8139", 0x100);
-    memory_region_init_io(&s->bar_mem, NULL, &rtl8139_mmio_ops, s, "rtl8139", 0x100);
+    memory_region_init_io(&s->bar_io, OBJECT(s), &rtl8139_io_ops, s,
+                          "rtl8139", 0x100);
+    memory_region_init_io(&s->bar_mem, OBJECT(s), &rtl8139_mmio_ops, s,
+                          "rtl8139", 0x100);
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->bar_io);
     pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar_mem);
 
diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index 6429709..c49e37a 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -747,7 +747,7 @@ static NetClientInfo net_smc91c111_info = {
 static int smc91c111_init1(SysBusDevice *dev)
 {
     smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);
-    memory_region_init_io(&s->mmio, NULL, &smc91c111_mem_ops, s,
+    memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
                           "smc91c111-mmio", 16);
     sysbus_init_mmio(dev, &s->mmio);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index b1394a2..aac7c76 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -405,8 +405,8 @@ static int stellaris_enet_init(SysBusDevice *dev)
 {
     stellaris_enet_state *s = FROM_SYSBUS(stellaris_enet_state, dev);
 
-    memory_region_init_io(&s->mmio, NULL, &stellaris_enet_ops, s, "stellaris_enet",
-                          0x1000);
+    memory_region_init_io(&s->mmio, OBJECT(s), &stellaris_enet_ops, s,
+                          "stellaris_enet", 0x1000);
     sysbus_init_mmio(dev, &s->mmio);
     sysbus_init_irq(dev, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 23a6b07..b39ff08 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2073,17 +2073,17 @@ static int vmxnet3_pci_init(PCIDevice *pci_dev)
 
     VMW_CBPRN("Starting init...");
 
-    memory_region_init_io(&s->bar0, NULL, &b0_ops, s,
+    memory_region_init_io(&s->bar0, OBJECT(s), &b0_ops, s,
                           "vmxnet3-b0", VMXNET3_PT_REG_SIZE);
     pci_register_bar(pci_dev, VMXNET3_BAR0_IDX,
                      PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar0);
 
-    memory_region_init_io(&s->bar1, NULL, &b1_ops, s,
+    memory_region_init_io(&s->bar1, OBJECT(s), &b1_ops, s,
                           "vmxnet3-b1", VMXNET3_VD_REG_SIZE);
     pci_register_bar(pci_dev, VMXNET3_BAR1_IDX,
                      PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar1);
 
-    memory_region_init(&s->msix_bar, NULL, "vmxnet3-msix-bar",
+    memory_region_init(&s->msix_bar, OBJECT(s), "vmxnet3-msix-bar",
                        VMXNET3_MSIX_BAR_SIZE);
     pci_register_bar(pci_dev, VMXNET3_MSIX_BAR_IDX,
                      PCI_BASE_ADDRESS_SPACE_MEMORY, &s->msix_bar);
diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index d334dc5..997a5b5 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -382,7 +382,8 @@ static int xgmac_enet_init(SysBusDevice *dev)
 {
     struct XgmacState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->iomem, NULL, &enet_mem_ops, s, "xgmac", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &enet_mem_ops, s,
+                          "xgmac", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->sbd_irq);
     sysbus_init_irq(dev, &s->pmt_irq);
diff --git a/hw/net/xilinx_axienet.c b/hw/net/xilinx_axienet.c
index 4a4fbd6..f173429 100644
--- a/hw/net/xilinx_axienet.c
+++ b/hw/net/xilinx_axienet.c
@@ -1001,7 +1001,7 @@ static void xilinx_enet_init(Object *obj)
 
     sysbus_init_irq(sbd, &s->irq);
 
-    memory_region_init_io(&s->iomem, NULL, &enet_ops, s, "enet", 0x40000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &enet_ops, s, "enet", 0x40000);
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index 9d7cb8f..2afc91a 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -221,8 +221,8 @@ static int xilinx_ethlite_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     s->rxbuf = 0;
 
-    memory_region_init_io(&s->mmio, NULL, &eth_ops, s, "xlnx.xps-ethernetlite",
-                                                                    R_MAX * 4);
+    memory_region_init_io(&s->mmio, OBJECT(s), &eth_ops, s,
+                          "xlnx.xps-ethernetlite", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index 1697562..fa218ce 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -117,7 +117,8 @@ static int nvram_sysbus_initfn(SysBusDevice *dev)
 
     s->contents = g_malloc0(s->chip_size);
 
-    memory_region_init_io(&s->iomem, NULL, &nvram_ops, s, "nvram", s->chip_size);
+    memory_region_init_io(&s->iomem, OBJECT(s), &nvram_ops, s,
+                          "nvram", s->chip_size);
     sysbus_init_mmio(dev, &s->iomem);
 
     /* Read current file */
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index a37db77..e455282 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -526,14 +526,14 @@ static int fw_cfg_init1(SysBusDevice *dev)
 {
     FWCfgState *s = FROM_SYSBUS(FWCfgState, dev);
 
-    memory_region_init_io(&s->ctl_iomem, NULL, &fw_cfg_ctl_mem_ops, s,
+    memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops, s,
                           "fwcfg.ctl", FW_CFG_SIZE);
     sysbus_init_mmio(dev, &s->ctl_iomem);
-    memory_region_init_io(&s->data_iomem, NULL, &fw_cfg_data_mem_ops, s,
+    memory_region_init_io(&s->data_iomem, OBJECT(s), &fw_cfg_data_mem_ops, s,
                           "fwcfg.data", FW_CFG_DATA_SIZE);
     sysbus_init_mmio(dev, &s->data_iomem);
     /* In case ctl and data overlap: */
-    memory_region_init_io(&s->comb_iomem, NULL, &fw_cfg_comb_mem_ops, s,
+    memory_region_init_io(&s->comb_iomem, OBJECT(s), &fw_cfg_comb_mem_ops, s,
                           "fwcfg", FW_CFG_SIZE);
 
     if (s->ctl_iobase + 1 == s->data_iobase) {
diff --git a/hw/nvram/mac_nvram.c b/hw/nvram/mac_nvram.c
index c91ee58..2eb0081 100644
--- a/hw/nvram/mac_nvram.c
+++ b/hw/nvram/mac_nvram.c
@@ -115,8 +115,8 @@ static void macio_nvram_realizefn(DeviceState *dev, Error **errp)
 
     s->data = g_malloc0(s->size);
 
-    memory_region_init_io(&s->mem, NULL, &macio_nvram_ops, s, "macio-nvram",
-                          s->size << s->it_shift);
+    memory_region_init_io(&s->mem, OBJECT(s), &macio_nvram_ops, s,
+                          "macio-nvram", s->size << s->it_shift);
     sysbus_init_mmio(d, &s->mem);
 }
 
commit 3c16154210ce6277bee553e72f7c7b2b2fecefbf
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/m*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/mips/gt64xxx_pci.c b/hw/mips/gt64xxx_pci.c
index d2739eb..5843417 100644
--- a/hw/mips/gt64xxx_pci.c
+++ b/hw/mips/gt64xxx_pci.c
@@ -1108,7 +1108,7 @@ PCIBus *gt64120_register(qemu_irq *pic)
                                 get_system_memory(),
                                 get_system_io(),
                                 PCI_DEVFN(18, 0), 4, TYPE_PCI_BUS);
-    memory_region_init_io(&d->ISD_mem, NULL, &isd_mem_ops, d, "isd-mem", 0x1000);
+    memory_region_init_io(&d->ISD_mem, OBJECT(dev), &isd_mem_ops, d, "isd-mem", 0x1000);
 
     pci_create_simple(phb->bus, PCI_DEVFN(0, 0), "gt64120_pci");
     return phb->bus;
diff --git a/hw/misc/a9scu.c b/hw/misc/a9scu.c
index c8f26f9..601b573 100644
--- a/hw/misc/a9scu.c
+++ b/hw/misc/a9scu.c
@@ -119,7 +119,8 @@ static void a9_scu_realize(DeviceState *dev, Error ** errp)
     A9SCUState *s = A9_SCU(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    memory_region_init_io(&s->iomem, NULL, &a9_scu_ops, s, "a9-scu", 0x100);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &a9_scu_ops, s,
+                          "a9-scu", 0x100);
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index ca4077f..bfafa51 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -230,12 +230,12 @@ static void applesmc_isa_realize(DeviceState *dev, Error **errp)
 {
     AppleSMCState *s = APPLE_SMC(dev);
 
-    memory_region_init_io(&s->io_data, NULL, &applesmc_data_io_ops, s,
+    memory_region_init_io(&s->io_data, OBJECT(s), &applesmc_data_io_ops, s,
                           "applesmc-data", 4);
     isa_register_ioport(&s->parent_obj, &s->io_data,
                         s->iobase + APPLESMC_DATA_PORT);
 
-    memory_region_init_io(&s->io_cmd, NULL, &applesmc_cmd_io_ops, s,
+    memory_region_init_io(&s->io_cmd, OBJECT(s), &applesmc_cmd_io_ops, s,
                           "applesmc-cmd", 4);
     isa_register_ioport(&s->parent_obj, &s->io_cmd,
                         s->iobase + APPLESMC_CMD_PORT);
diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index 954343f..3d6acee 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -157,7 +157,8 @@ static int l2x0_priv_init(SysBusDevice *dev)
 {
     l2x0_state *s = FROM_SYSBUS(l2x0_state, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &l2x0_mem_ops, s, "l2x0_cc", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &l2x0_mem_ops, s,
+                          "l2x0_cc", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c
index 9b07355..5906ae5 100644
--- a/hw/misc/arm_sysctl.c
+++ b/hw/misc/arm_sysctl.c
@@ -589,7 +589,8 @@ static void arm_sysctl_init(Object *obj)
     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
     arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, sd);
 
-    memory_region_init_io(&s->iomem, NULL, &arm_sysctl_ops, s, "arm-sysctl", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &arm_sysctl_ops, s,
+                          "arm-sysctl", 0x1000);
     sysbus_init_mmio(sd, &s->iomem);
     qdev_init_gpio_in(dev, arm_sysctl_gpio_set, 2);
     qdev_init_gpio_out(dev, &s->pl110_mux_ctrl, 1);
diff --git a/hw/misc/debugexit.c b/hw/misc/debugexit.c
index e3a13f0..d754cf1 100644
--- a/hw/misc/debugexit.c
+++ b/hw/misc/debugexit.c
@@ -40,7 +40,7 @@ static void debug_exit_realizefn(DeviceState *d, Error **errp)
     ISADevice *dev = ISA_DEVICE(d);
     ISADebugExitState *isa = ISA_DEBUG_EXIT_DEVICE(d);
 
-    memory_region_init_io(&isa->io, NULL, &debug_exit_ops, isa,
+    memory_region_init_io(&isa->io, OBJECT(dev), &debug_exit_ops, isa,
                           TYPE_ISA_DEBUG_EXIT_DEVICE, isa->iosize);
     memory_region_add_subregion(isa_address_space_io(dev),
                                 isa->iobase, &isa->io);
diff --git a/hw/misc/eccmemctl.c b/hw/misc/eccmemctl.c
index 71d62cc..3de9675 100644
--- a/hw/misc/eccmemctl.c
+++ b/hw/misc/eccmemctl.c
@@ -296,11 +296,11 @@ static int ecc_init1(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
     s->regs[0] = s->version;
-    memory_region_init_io(&s->iomem, NULL, &ecc_mem_ops, s, "ecc", ECC_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &ecc_mem_ops, s, "ecc", ECC_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
     if (s->version == ECC_MCC) { // SS-600MP only
-        memory_region_init_io(&s->iomem_diag, NULL, &ecc_diag_mem_ops, s,
+        memory_region_init_io(&s->iomem_diag, OBJECT(dev), &ecc_diag_mem_ops, s,
                               "ecc.diag", ECC_DIAG_SIZE);
         sysbus_init_mmio(dev, &s->iomem_diag);
     }
diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index 465e72f..28395ba 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -458,8 +458,8 @@ static int exynos4210_pmu_init(SysBusDevice *dev)
     Exynos4210PmuState *s = FROM_SYSBUS(Exynos4210PmuState, dev);
 
     /* memory mapping */
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_pmu_ops, s, "exynos4210.pmu",
-                          EXYNOS4210_PMU_REGS_MEM_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &exynos4210_pmu_ops, s,
+                          "exynos4210.pmu", EXYNOS4210_PMU_REGS_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
index 863c219..816d5e8 100644
--- a/hw/misc/imx_ccm.c
+++ b/hw/misc/imx_ccm.c
@@ -281,7 +281,8 @@ static int imx_ccm_init(SysBusDevice *dev)
 {
     IMXCCMState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->iomem, NULL, &imx_ccm_ops, s, "imx_ccm", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &imx_ccm_ops, s,
+                          "imx_ccm", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 522740d..3594b84 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -339,7 +339,7 @@ static void create_shared_memory_BAR(IVShmemState *s, int fd) {
 
     ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
 
-    memory_region_init_ram_ptr(&s->ivshmem, NULL, "ivshmem.bar2",
+    memory_region_init_ram_ptr(&s->ivshmem, OBJECT(s), "ivshmem.bar2",
                                s->ivshmem_size, ptr);
     vmstate_register_ram(&s->ivshmem, &s->dev.qdev);
     memory_region_add_subregion(&s->bar, 0, &s->ivshmem);
@@ -467,7 +467,7 @@ static void ivshmem_read(void *opaque, const uint8_t * buf, int flags)
         /* mmap the region and map into the BAR2 */
         map_ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED,
                                                             incoming_fd, 0);
-        memory_region_init_ram_ptr(&s->ivshmem, NULL,
+        memory_region_init_ram_ptr(&s->ivshmem, OBJECT(s),
                                    "ivshmem.bar2", s->ivshmem_size, map_ptr);
         vmstate_register_ram(&s->ivshmem, &s->dev.qdev);
 
@@ -685,14 +685,14 @@ static int pci_ivshmem_init(PCIDevice *dev)
 
     s->shm_fd = 0;
 
-    memory_region_init_io(&s->ivshmem_mmio, NULL, &ivshmem_mmio_ops, s,
+    memory_region_init_io(&s->ivshmem_mmio, OBJECT(s), &ivshmem_mmio_ops, s,
                           "ivshmem-mmio", IVSHMEM_REG_BAR_SIZE);
 
     /* region for registers*/
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
                      &s->ivshmem_mmio);
 
-    memory_region_init(&s->bar, NULL, "ivshmem-bar2-container", s->ivshmem_size);
+    memory_region_init(&s->bar, OBJECT(s), "ivshmem-bar2-container", s->ivshmem_size);
     s->ivshmem_attr = PCI_BASE_ADDRESS_SPACE_MEMORY |
         PCI_BASE_ADDRESS_MEM_PREFETCH;
     if (s->ivshmem_64bit) {
diff --git a/hw/misc/lm32_sys.c b/hw/misc/lm32_sys.c
index accfbe3..060a5bf 100644
--- a/hw/misc/lm32_sys.c
+++ b/hw/misc/lm32_sys.c
@@ -117,7 +117,8 @@ static int lm32_sys_init(SysBusDevice *dev)
 {
     LM32SysState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->iomem, NULL, &sys_ops , s, "sys", R_MAX * 4);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &sys_ops , s,
+                          "sys", R_MAX * 4);
     sysbus_init_mmio(dev, &s->iomem);
 
     /* Note: This device is not created in the board initialization,
diff --git a/hw/misc/milkymist-hpdmc.c b/hw/misc/milkymist-hpdmc.c
index f4826b9..a498881 100644
--- a/hw/misc/milkymist-hpdmc.c
+++ b/hw/misc/milkymist-hpdmc.c
@@ -127,7 +127,7 @@ static int milkymist_hpdmc_init(SysBusDevice *dev)
 {
     MilkymistHpdmcState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->regs_region, NULL, &hpdmc_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(dev), &hpdmc_mmio_ops, s,
             "milkymist-hpdmc", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/misc/milkymist-pfpu.c b/hw/misc/milkymist-pfpu.c
index 0051bc9..2b64ee7 100644
--- a/hw/misc/milkymist-pfpu.c
+++ b/hw/misc/milkymist-pfpu.c
@@ -497,7 +497,7 @@ static int milkymist_pfpu_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, NULL, &pfpu_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(dev), &pfpu_mmio_ops, s,
             "milkymist-pfpu", MICROCODE_END * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/misc/mst_fpga.c b/hw/misc/mst_fpga.c
index b727dab..604be5e 100644
--- a/hw/misc/mst_fpga.c
+++ b/hw/misc/mst_fpga.c
@@ -208,7 +208,7 @@ static int mst_fpga_init(SysBusDevice *dev)
 	/* alloc the external 16 irqs */
 	qdev_init_gpio_in(&dev->qdev, mst_fpga_set_irq, MST_NUM_IRQS);
 
-	memory_region_init_io(&s->iomem, NULL, &mst_fpga_ops, s,
+	memory_region_init_io(&s->iomem, OBJECT(s), &mst_fpga_ops, s,
 			    "fpga", 0x00100000);
 	sysbus_init_mmio(dev, &s->iomem);
 	return 0;
diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index 31c9878..699a16f 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -149,13 +149,13 @@ static void testdev_realizefn(DeviceState *d, Error **errp)
     MemoryRegion *mem = isa_address_space(isa);
     MemoryRegion *io = isa_address_space_io(isa);
 
-    memory_region_init_io(&dev->ioport, NULL, &test_ioport_ops, dev,
+    memory_region_init_io(&dev->ioport, OBJECT(dev), &test_ioport_ops, dev,
                           "pc-testdev-ioport", 4);
-    memory_region_init_io(&dev->flush, NULL, &test_flush_ops, dev,
+    memory_region_init_io(&dev->flush, OBJECT(dev), &test_flush_ops, dev,
                           "pc-testdev-flush-page", 4);
-    memory_region_init_io(&dev->irq, NULL, &test_irq_ops, dev,
+    memory_region_init_io(&dev->irq, OBJECT(dev), &test_irq_ops, dev,
                           "pc-testdev-irq-line", 24);
-    memory_region_init_io(&dev->iomem, NULL, &test_iomem_ops, dev,
+    memory_region_init_io(&dev->iomem, OBJECT(dev), &test_iomem_ops, dev,
                           "pc-testdev-iomem", IOMEM_LEN);
 
     memory_region_add_subregion(io,  0xe0,       &dev->ioport);
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index fb9a58c..8b0b73f 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -236,9 +236,9 @@ static int pci_testdev_init(PCIDevice *pci_dev)
 
     pci_conf[PCI_INTERRUPT_PIN] = 0; /* no interrupt pin */
 
-    memory_region_init_io(&d->mmio, NULL, &pci_testdev_mmio_ops, d,
+    memory_region_init_io(&d->mmio, OBJECT(d), &pci_testdev_mmio_ops, d,
                           "pci-testdev-mmio", IOTEST_MEMSIZE * 2);
-    memory_region_init_io(&d->portio, NULL, &pci_testdev_pio_ops, d,
+    memory_region_init_io(&d->portio, OBJECT(d), &pci_testdev_pio_ops, d,
                           "pci-testdev-portio", IOTEST_IOSIZE * 2);
     pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
     pci_register_bar(&d->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->portio);
diff --git a/hw/misc/puv3_pm.c b/hw/misc/puv3_pm.c
index d4a863f..5592560 100644
--- a/hw/misc/puv3_pm.c
+++ b/hw/misc/puv3_pm.c
@@ -120,7 +120,7 @@ static int puv3_pm_init(SysBusDevice *dev)
 
     s->reg_PCGR = 0x0;
 
-    memory_region_init_io(&s->iomem, NULL, &puv3_pm_ops, s, "puv3_pm",
+    memory_region_init_io(&s->iomem, OBJECT(s), &puv3_pm_ops, s, "puv3_pm",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index 00d6e63..a3be9e0 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -90,7 +90,7 @@ static void pvpanic_isa_initfn(Object *obj)
 {
     PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
 
-    memory_region_init_io(&s->io, NULL, &pvpanic_ops, s, "pvpanic", 1);
+    memory_region_init_io(&s->io, OBJECT(s), &pvpanic_ops, s, "pvpanic", 1);
 }
 
 static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index dbc6081..d274fb4 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -412,7 +412,7 @@ static int apc_init1(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->cpu_halt);
 
     /* Power management (APC) XXX: not a Slavio device */
-    memory_region_init_io(&s->iomem, NULL, &apc_mem_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &apc_mem_ops, s,
                           "apc", MISC_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -427,39 +427,39 @@ static int slavio_misc_init1(SysBusDevice *dev)
 
     /* 8 bit registers */
     /* Slavio control */
-    memory_region_init_io(&s->cfg_iomem, NULL, &slavio_cfg_mem_ops, s,
+    memory_region_init_io(&s->cfg_iomem, OBJECT(s), &slavio_cfg_mem_ops, s,
                           "configuration", MISC_SIZE);
     sysbus_init_mmio(dev, &s->cfg_iomem);
 
     /* Diagnostics */
-    memory_region_init_io(&s->diag_iomem, NULL, &slavio_diag_mem_ops, s,
+    memory_region_init_io(&s->diag_iomem, OBJECT(s), &slavio_diag_mem_ops, s,
                           "diagnostic", MISC_SIZE);
     sysbus_init_mmio(dev, &s->diag_iomem);
 
     /* Modem control */
-    memory_region_init_io(&s->mdm_iomem, NULL, &slavio_mdm_mem_ops, s,
+    memory_region_init_io(&s->mdm_iomem, OBJECT(s), &slavio_mdm_mem_ops, s,
                           "modem", MISC_SIZE);
     sysbus_init_mmio(dev, &s->mdm_iomem);
 
     /* 16 bit registers */
     /* ss600mp diag LEDs */
-    memory_region_init_io(&s->led_iomem, NULL, &slavio_led_mem_ops, s,
+    memory_region_init_io(&s->led_iomem, OBJECT(s), &slavio_led_mem_ops, s,
                           "leds", MISC_SIZE);
     sysbus_init_mmio(dev, &s->led_iomem);
 
     /* 32 bit registers */
     /* System control */
-    memory_region_init_io(&s->sysctrl_iomem, NULL, &slavio_sysctrl_mem_ops, s,
+    memory_region_init_io(&s->sysctrl_iomem, OBJECT(s), &slavio_sysctrl_mem_ops, s,
                           "system-control", MISC_SIZE);
     sysbus_init_mmio(dev, &s->sysctrl_iomem);
 
     /* AUX 1 (Misc System Functions) */
-    memory_region_init_io(&s->aux1_iomem, NULL, &slavio_aux1_mem_ops, s,
+    memory_region_init_io(&s->aux1_iomem, OBJECT(s), &slavio_aux1_mem_ops, s,
                           "misc-system-functions", MISC_SIZE);
     sysbus_init_mmio(dev, &s->aux1_iomem);
 
     /* AUX 2 (Software Powerdown Control) */
-    memory_region_init_io(&s->aux2_iomem, NULL, &slavio_aux2_mem_ops, s,
+    memory_region_init_io(&s->aux2_iomem, OBJECT(s), &slavio_aux2_mem_ops, s,
                           "software-powerdown-control", MISC_SIZE);
     sysbus_init_mmio(dev, &s->aux2_iomem);
 
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index 58013eb..540c377 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -1154,7 +1154,7 @@ static void vfio_vga_probe_ati_3c3_quirk(VFIODevice *vdev)
     quirk->vdev = vdev;
     quirk->data = (physbar >> 8) & 0xff;
 
-    memory_region_init_io(&quirk->mem, NULL, &vfio_ati_3c3_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_ati_3c3_quirk, quirk,
                           "vfio-ati-3c3-quirk", 1);
     memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem, 3,
                                 &quirk->mem);
@@ -1245,7 +1245,7 @@ static void vfio_probe_ati_4010_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, NULL, &vfio_ati_4010_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_ati_4010_quirk, quirk,
                           "vfio-ati-4010-quirk", 8);
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
 
@@ -1331,7 +1331,7 @@ static void vfio_probe_ati_f10_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, NULL, &vfio_ati_f10_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_ati_f10_quirk, quirk,
                           "vfio-ati-f10-quirk", 8);
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
 
@@ -1451,7 +1451,7 @@ static void vfio_vga_probe_nvidia_3d0_quirk(VFIODevice *vdev)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_3d0_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_3d0_quirk, quirk,
                           "vfio-nvidia-3d0-quirk", 6);
     memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem,
                                 0x10, &quirk->mem);
@@ -1566,7 +1566,7 @@ static void vfio_probe_nvidia_bar5_window_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_bar5_window_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_bar5_window_quirk, quirk,
                           "vfio-nvidia-bar5-window-quirk", 16);
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
 
@@ -1644,7 +1644,7 @@ static void vfio_probe_nvidia_bar0_88000_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_bar0_88000_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_bar0_88000_quirk, quirk,
                           "vfio-nvidia-bar0-88000-quirk",
                           TARGET_PAGE_ALIGN(PCIE_CONFIG_SPACE_SIZE));
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
@@ -1723,7 +1723,7 @@ static void vfio_probe_nvidia_bar0_1800_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_bar0_1800_quirk, quirk,
+    memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_nvidia_bar0_1800_quirk, quirk,
                           "vfio-nvidia-bar0-1800-quirk",
                           TARGET_PAGE_ALIGN(PCI_CONFIG_SPACE_SIZE));
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
@@ -2274,7 +2274,7 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
            ~PCI_BASE_ADDRESS_IO_MASK : ~PCI_BASE_ADDRESS_MEM_MASK);
 
     /* A "slow" read/write mapping underlies all BARs */
-    memory_region_init_io(&bar->mem, NULL, &vfio_bar_ops, bar, name, size);
+    memory_region_init_io(&bar->mem, OBJECT(vdev), &vfio_bar_ops, bar, name, size);
     pci_register_bar(&vdev->pdev, nr, type, &bar->mem);
 
     /*
@@ -2318,18 +2318,18 @@ static void vfio_map_bars(VFIODevice *vdev)
     }
 
     if (vdev->has_vga) {
-        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_MEM].mem, NULL,
-                              &vfio_vga_ops,
+        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_MEM].mem,
+                              OBJECT(vdev), &vfio_vga_ops,
                               &vdev->vga.region[QEMU_PCI_VGA_MEM],
                               "vfio-vga-mmio at 0xa0000",
                               QEMU_PCI_VGA_MEM_SIZE);
-        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_LO].mem, NULL,
-                              &vfio_vga_ops,
+        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_LO].mem,
+                              OBJECT(vdev), &vfio_vga_ops,
                               &vdev->vga.region[QEMU_PCI_VGA_IO_LO],
                               "vfio-vga-io at 0x3b0",
                               QEMU_PCI_VGA_IO_LO_SIZE);
-        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem, NULL,
-                              &vfio_vga_ops,
+        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem,
+                              OBJECT(vdev), &vfio_vga_ops,
                               &vdev->vga.region[QEMU_PCI_VGA_IO_HI],
                               "vfio-vga-io at 0x3c0",
                               QEMU_PCI_VGA_IO_HI_SIZE);
@@ -2591,7 +2591,7 @@ static int vfio_load_rom(VFIODevice *vdev)
     snprintf(name, sizeof(name), "vfio[%04x:%02x:%02x.%x].rom",
              vdev->host.domain, vdev->host.bus, vdev->host.slot,
              vdev->host.function);
-    memory_region_init_ram(&vdev->pdev.rom, NULL, name, size);
+    memory_region_init_ram(&vdev->pdev.rom, OBJECT(vdev), name, size);
     ptr = memory_region_get_ram_ptr(&vdev->pdev.rom);
     memset(ptr, 0xff, size);
 
diff --git a/hw/misc/vmport.c b/hw/misc/vmport.c
index 7f64ccd..7463776 100644
--- a/hw/misc/vmport.c
+++ b/hw/misc/vmport.c
@@ -142,7 +142,7 @@ static void vmport_realizefn(DeviceState *dev, Error **errp)
     ISADevice *isadev = ISA_DEVICE(dev);
     VMPortState *s = VMPORT(dev);
 
-    memory_region_init_io(&s->io, NULL, &vmport_ops, s, "vmport", 1);
+    memory_region_init_io(&s->io, OBJECT(s), &vmport_ops, s, "vmport", 1);
     isa_register_ioport(isadev, &s->io, 0x5658);
 
     port_state = s;
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index d7c2d19..fc7a85f 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -494,7 +494,7 @@ static int zynq_slcr_init(SysBusDevice *dev)
 {
     ZynqSLCRState *s = FROM_SYSBUS(ZynqSLCRState, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &slcr_ops, s, "slcr", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &slcr_ops, s, "slcr", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
commit 1437c94b2689c2010362f84d14f14feaa1d8dba3
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/i*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index f550ba4..5f8b972 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -209,7 +209,7 @@ static int gpio_i2c_init(SysBusDevice *dev)
     GPIOI2CState *s = FROM_SYSBUS(GPIOI2CState, dev);
     i2c_bus *bus;
 
-    memory_region_init(&s->dummy_iomem, NULL, "gpio_i2c", 0);
+    memory_region_init(&s->dummy_iomem, OBJECT(s), "gpio_i2c", 0);
     sysbus_init_mmio(dev, &s->dummy_iomem);
 
     bus = i2c_init_bus(&dev->qdev, "i2c");
diff --git a/hw/i2c/exynos4210_i2c.c b/hw/i2c/exynos4210_i2c.c
index bc6eb34..52bffa5 100644
--- a/hw/i2c/exynos4210_i2c.c
+++ b/hw/i2c/exynos4210_i2c.c
@@ -301,8 +301,8 @@ static int exynos4210_i2c_realize(SysBusDevice *dev)
 {
     Exynos4210I2CState *s = EXYNOS4_I2C(dev);
 
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_i2c_ops, s, TYPE_EXYNOS4_I2C,
-                          EXYNOS4_I2C_MEM_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_i2c_ops, s,
+                          TYPE_EXYNOS4_I2C, EXYNOS4_I2C_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->bus = i2c_init_bus(&dev->qdev, "i2c");
diff --git a/hw/i2c/omap_i2c.c b/hw/i2c/omap_i2c.c
index 1a8b39c..f0eb448 100644
--- a/hw/i2c/omap_i2c.c
+++ b/hw/i2c/omap_i2c.c
@@ -448,7 +448,7 @@ static int omap_i2c_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     sysbus_init_irq(dev, &s->drq[0]);
     sysbus_init_irq(dev, &s->drq[1]);
-    memory_region_init_io(&s->iomem, NULL, &omap_i2c_ops, s, "omap.i2c",
+    memory_region_init_io(&s->iomem, OBJECT(s), &omap_i2c_ops, s, "omap.i2c",
                           (s->revision < OMAP2_INTR_REV) ? 0x800 : 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     s->bus = i2c_init_bus(&dev->qdev, NULL);
diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c
index f425ad8..6df0fa9 100644
--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -181,5 +181,6 @@ static const MemoryRegionOps pm_smbus_ops = {
 void pm_smbus_init(DeviceState *parent, PMSMBus *smb)
 {
     smb->smbus = i2c_init_bus(parent, "i2c");
-    memory_region_init_io(&smb->io, NULL, &pm_smbus_ops, smb, "pm-smbus", 64);
+    memory_region_init_io(&smb->io, OBJECT(parent), &pm_smbus_ops, smb,
+                          "pm-smbus", 64);
 }
diff --git a/hw/i2c/versatile_i2c.c b/hw/i2c/versatile_i2c.c
index a239963..204dd3d 100644
--- a/hw/i2c/versatile_i2c.c
+++ b/hw/i2c/versatile_i2c.c
@@ -79,7 +79,7 @@ static int versatile_i2c_init(SysBusDevice *dev)
 
     bus = i2c_init_bus(&dev->qdev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
-    memory_region_init_io(&s->iomem, NULL, &versatile_i2c_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &versatile_i2c_ops, s,
                           "versatile_i2c", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index f1a5554..8e2c530 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -298,8 +298,8 @@ static void assigned_dev_iomem_setup(PCIDevice *pci_dev, int region_num,
     PCIRegion *real_region = &r_dev->real_device.regions[region_num];
 
     if (e_size > 0) {
-        memory_region_init(&region->container, NULL, "assigned-dev-container",
-                           e_size);
+        memory_region_init(&region->container, OBJECT(pci_dev),
+                           "assigned-dev-container", e_size);
         memory_region_add_subregion(&region->container, 0, &region->real_iomem);
 
         /* deal with MSI-X MMIO page */
@@ -329,9 +329,10 @@ static void assigned_dev_ioport_setup(PCIDevice *pci_dev, int region_num,
     AssignedDevRegion *region = &r_dev->v_addrs[region_num];
 
     region->e_size = size;
-    memory_region_init(&region->container, NULL, "assigned-dev-container", size);
-    memory_region_init_io(&region->real_iomem, NULL, &assigned_dev_ioport_ops,
-                          r_dev->v_addrs + region_num,
+    memory_region_init(&region->container, OBJECT(pci_dev),
+                       "assigned-dev-container", size);
+    memory_region_init_io(&region->real_iomem, OBJECT(pci_dev),
+                          &assigned_dev_ioport_ops, r_dev->v_addrs + region_num,
                           "assigned-dev-iomem", size);
     memory_region_add_subregion(&region->container, 0, &region->real_iomem);
 }
@@ -478,8 +479,9 @@ static int assigned_dev_register_regions(PCIRegion *io_regions,
                              "4K.  You might experience some performance hit "
                              "due to that.",
                              i, cur_region->base_addr, cur_region->size);
-                memory_region_init_io(&pci_dev->v_addrs[i].real_iomem, NULL,
-                                      &slow_bar_ops, &pci_dev->v_addrs[i],
+                memory_region_init_io(&pci_dev->v_addrs[i].real_iomem,
+                                      OBJECT(pci_dev), &slow_bar_ops,
+                                      &pci_dev->v_addrs[i],
                                       "assigned-dev-slow-bar",
                                       cur_region->size);
             } else {
@@ -487,9 +489,9 @@ static int assigned_dev_register_regions(PCIRegion *io_regions,
                 char name[32];
                 snprintf(name, sizeof(name), "%s.bar%d",
                          object_get_typename(OBJECT(pci_dev)), i);
-                memory_region_init_ram_ptr(&pci_dev->v_addrs[i].real_iomem, NULL,
-                                           name, cur_region->size,
-                                           virtbase);
+                memory_region_init_ram_ptr(&pci_dev->v_addrs[i].real_iomem,
+                                           OBJECT(pci_dev), name,
+                                           cur_region->size, virtbase);
                 vmstate_register_ram(&pci_dev->v_addrs[i].real_iomem,
                                      &pci_dev->dev.qdev);
             }
@@ -1650,8 +1652,8 @@ static int assigned_dev_register_msix_mmio(AssignedDevice *dev)
 
     assigned_dev_msix_reset(dev);
 
-    memory_region_init_io(&dev->mmio, NULL, &assigned_dev_msix_mmio_ops, dev,
-                          "assigned-dev-msix", MSIX_PAGE_SIZE);
+    memory_region_init_io(&dev->mmio, OBJECT(dev), &assigned_dev_msix_mmio_ops,
+                          dev, "assigned-dev-msix", MSIX_PAGE_SIZE);
     return 0;
 }
 
@@ -1916,7 +1918,7 @@ static void assigned_dev_load_option_rom(AssignedDevice *dev)
 
     snprintf(name, sizeof(name), "%s.rom",
             object_get_typename(OBJECT(dev)));
-    memory_region_init_ram(&dev->dev.rom, NULL, name, st.st_size);
+    memory_region_init_ram(&dev->dev.rom, OBJECT(dev), name, st.st_size);
     vmstate_register_ram(&dev->dev.rom, &dev->dev.qdev);
     ptr = memory_region_get_ram_ptr(&dev->dev.rom);
     memset(ptr, 0xff, st.st_size);
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 21b5912..9850a85 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -601,8 +601,8 @@ static void vapic_map_rom_writable(VAPICROMState *s)
     rom_paddr &= TARGET_PAGE_MASK;
     rom_size = TARGET_PAGE_ALIGN(rom_size);
 
-    memory_region_init_alias(&s->rom, NULL, "kvmvapic-rom", section.mr, rom_paddr,
-                             rom_size);
+    memory_region_init_alias(&s->rom, OBJECT(s), "kvmvapic-rom", section.mr,
+                             rom_paddr, rom_size);
     memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
     s->rom_mapped_writable = true;
     memory_region_unref(section.mr);
@@ -703,7 +703,7 @@ static int vapic_init(SysBusDevice *dev)
 {
     VAPICROMState *s = VAPIC(dev);
 
-    memory_region_init_io(&s->io, NULL, &vapic_ops, s, "kvmvapic", 2);
+    memory_region_init_io(&s->io, OBJECT(s), &vapic_ops, s, "kvmvapic", 2);
     sysbus_add_io(dev, VAPIC_IO_PORT, &s->io);
     sysbus_init_ioports(dev, VAPIC_IO_PORT, 2);
 
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 4345187..e7ad931 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -525,7 +525,7 @@ static void port92_initfn(Object *obj)
 {
     Port92State *s = PORT92(obj);
 
-    memory_region_init_io(&s->io, NULL, &port92_ops, s, "port92", 1);
+    memory_region_init_io(&s->io, OBJECT(s), &port92_ops, s, "port92", 1);
 
     s->outport = 0;
 }
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index e7734f3..97eddec 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1158,8 +1158,10 @@ void ahci_init(AHCIState *s, DeviceState *qdev, AddressSpace *as, int ports)
     s->dev = g_malloc0(sizeof(AHCIDevice) * ports);
     ahci_reg_init(s);
     /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
-    memory_region_init_io(&s->mem, NULL, &ahci_mem_ops, s, "ahci", AHCI_MEM_BAR_SIZE);
-    memory_region_init_io(&s->idp, NULL, &ahci_idp_ops, s, "ahci-idp", 32);
+    memory_region_init_io(&s->mem, OBJECT(qdev), &ahci_mem_ops, s,
+                          "ahci", AHCI_MEM_BAR_SIZE);
+    memory_region_init_io(&s->idp, OBJECT(qdev), &ahci_idp_ops, s,
+                          "ahci-idp", 32);
 
     irqs = qemu_allocate_irqs(ahci_irq_set, s, s->ports);
 
diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index a695dfb..33be386 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -117,8 +117,10 @@ static void setup_cmd646_bar(PCIIDEState *d, int bus_num)
 
     bar->bus = bus;
     bar->pci_dev = d;
-    memory_region_init_io(&bar->cmd, NULL, &cmd646_cmd_ops, bar, "cmd646-cmd", 4);
-    memory_region_init_io(&bar->data, NULL, &cmd646_data_ops, bar, "cmd646-data", 8);
+    memory_region_init_io(&bar->cmd, OBJECT(d), &cmd646_cmd_ops, bar,
+                          "cmd646-cmd", 4);
+    memory_region_init_io(&bar->data, OBJECT(d), &cmd646_data_ops, bar,
+                          "cmd646-data", 8);
 }
 
 static uint64_t bmdma_read(void *opaque, hwaddr addr,
@@ -203,13 +205,14 @@ static void bmdma_setup_bar(PCIIDEState *d)
     BMDMAState *bm;
     int i;
 
-    memory_region_init(&d->bmdma_bar, NULL, "cmd646-bmdma", 16);
+    memory_region_init(&d->bmdma_bar, OBJECT(d), "cmd646-bmdma", 16);
     for(i = 0;i < 2; i++) {
         bm = &d->bmdma[i];
-        memory_region_init_io(&bm->extra_io, NULL, &cmd646_bmdma_ops, bm,
+        memory_region_init_io(&bm->extra_io, OBJECT(d), &cmd646_bmdma_ops, bm,
                               "cmd646-bmdma-bus", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8, &bm->extra_io);
-        memory_region_init_io(&bm->addr_ioport, NULL, &bmdma_addr_ioport_ops, bm,
+        memory_region_init_io(&bm->addr_ioport, OBJECT(d),
+                              &bmdma_addr_ioport_ops, bm,
                               "cmd646-bmdma-ioport", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8 + 4, &bm->addr_ioport);
     }
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 0c14009..4798202 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -335,7 +335,7 @@ static void macio_ide_initfn(Object *obj)
     MACIOIDEState *s = MACIO_IDE(obj);
 
     ide_bus_new(&s->bus, DEVICE(obj), 0, 2);
-    memory_region_init_io(&s->mem, NULL, &pmac_ide_ops, s, "pmac-ide", 0x1000);
+    memory_region_init_io(&s->mem, obj, &pmac_ide_ops, s, "pmac-ide", 0x1000);
     sysbus_init_mmio(d, &s->mem);
     sysbus_init_irq(d, &s->irq);
     sysbus_init_irq(d, &s->dma_irq);
diff --git a/hw/ide/mmio.c b/hw/ide/mmio.c
index 8ae57d6..d251ff9 100644
--- a/hw/ide/mmio.c
+++ b/hw/ide/mmio.c
@@ -124,9 +124,9 @@ static void mmio_ide_realizefn(DeviceState *dev, Error **errp)
 
     ide_init2(&s->bus, s->irq);
 
-    memory_region_init_io(&s->iomem1, NULL, &mmio_ide_ops, s,
+    memory_region_init_io(&s->iomem1, OBJECT(s), &mmio_ide_ops, s,
                           "ide-mmio.1", 16 << s->shift);
-    memory_region_init_io(&s->iomem2, NULL, &mmio_ide_cs_ops, s,
+    memory_region_init_io(&s->iomem2, OBJECT(s), &mmio_ide_cs_ops, s,
                           "ide-mmio.2", 2 << s->shift);
     sysbus_init_mmio(d, &s->iomem1);
     sysbus_init_mmio(d, &s->iomem2);
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index af445db..58532fe 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -90,15 +90,15 @@ static void bmdma_setup_bar(PCIIDEState *d)
 {
     int i;
 
-    memory_region_init(&d->bmdma_bar, NULL, "piix-bmdma-container", 16);
+    memory_region_init(&d->bmdma_bar, OBJECT(d), "piix-bmdma-container", 16);
     for(i = 0;i < 2; i++) {
         BMDMAState *bm = &d->bmdma[i];
 
-        memory_region_init_io(&bm->extra_io, NULL, &piix_bmdma_ops, bm,
+        memory_region_init_io(&bm->extra_io, OBJECT(d), &piix_bmdma_ops, bm,
                               "piix-bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8, &bm->extra_io);
-        memory_region_init_io(&bm->addr_ioport, NULL, &bmdma_addr_ioport_ops, bm,
-                              "bmdma", 4);
+        memory_region_init_io(&bm->addr_ioport, OBJECT(d),
+                              &bmdma_addr_ioport_ops, bm, "bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8 + 4, &bm->addr_ioport);
     }
 }
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 1691717..5a83191 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -92,15 +92,15 @@ static void bmdma_setup_bar(PCIIDEState *d)
 {
     int i;
 
-    memory_region_init(&d->bmdma_bar, NULL, "via-bmdma-container", 16);
+    memory_region_init(&d->bmdma_bar, OBJECT(d), "via-bmdma-container", 16);
     for(i = 0;i < 2; i++) {
         BMDMAState *bm = &d->bmdma[i];
 
-        memory_region_init_io(&bm->extra_io, NULL, &via_bmdma_ops, bm,
+        memory_region_init_io(&bm->extra_io, OBJECT(d), &via_bmdma_ops, bm,
                               "via-bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8, &bm->extra_io);
-        memory_region_init_io(&bm->addr_ioport, NULL, &bmdma_addr_ioport_ops, bm,
-                              "bmdma", 4);
+        memory_region_init_io(&bm->addr_ioport, OBJECT(d),
+                              &bmdma_addr_ioport_ops, bm, "bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8 + 4, &bm->addr_ioport);
     }
 }
diff --git a/hw/input/milkymist-softusb.c b/hw/input/milkymist-softusb.c
index 69e6485..942cb79 100644
--- a/hw/input/milkymist-softusb.c
+++ b/hw/input/milkymist-softusb.c
@@ -265,17 +265,17 @@ static int milkymist_softusb_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, NULL, &softusb_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(s), &softusb_mmio_ops, s,
                           "milkymist-softusb", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
     /* register pmem and dmem */
-    memory_region_init_ram(&s->pmem, NULL, "milkymist-softusb.pmem",
+    memory_region_init_ram(&s->pmem, OBJECT(s), "milkymist-softusb.pmem",
                            s->pmem_size);
     vmstate_register_ram_global(&s->pmem);
     s->pmem_ptr = memory_region_get_ram_ptr(&s->pmem);
     sysbus_init_mmio(dev, &s->pmem);
-    memory_region_init_ram(&s->dmem, NULL, "milkymist-softusb.dmem",
+    memory_region_init_ram(&s->dmem, OBJECT(s), "milkymist-softusb.dmem",
                            s->dmem_size);
     vmstate_register_ram_global(&s->dmem);
     s->dmem_ptr = memory_region_get_ram_ptr(&s->dmem);
diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
index 8d1d6a7..ce86237 100644
--- a/hw/input/pckbd.c
+++ b/hw/input/pckbd.c
@@ -494,8 +494,10 @@ static void i8042_initfn(Object *obj)
     ISAKBDState *isa_s = I8042(obj);
     KBDState *s = &isa_s->kbd;
 
-    memory_region_init_io(isa_s->io + 0, NULL, &i8042_data_ops, s, "i8042-data", 1);
-    memory_region_init_io(isa_s->io + 1, NULL, &i8042_cmd_ops, s, "i8042-cmd", 1);
+    memory_region_init_io(isa_s->io + 0, obj, &i8042_data_ops, s,
+                          "i8042-data", 1);
+    memory_region_init_io(isa_s->io + 1, obj, &i8042_cmd_ops, s,
+                          "i8042-cmd", 1);
 }
 
 static void i8042_realizefn(DeviceState *dev, Error **errp)
diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 871ffba..2312ffc 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -137,7 +137,7 @@ static int pl050_init(SysBusDevice *dev, int is_mouse)
 {
     pl050_state *s = FROM_SYSBUS(pl050_state, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &pl050_ops, s, "pl050", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl050_ops, s, "pl050", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->is_mouse = is_mouse;
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index d15c8be..5e3b96e 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -873,7 +873,7 @@ static const MemoryRegionOps apic_io_ops = {
 
 static void apic_init(APICCommonState *s)
 {
-    memory_region_init_io(&s->io_memory, NULL, &apic_io_ops, s, "apic-msi",
+    memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
                           APIC_SPACE_SIZE);
 
     s->timer = qemu_new_timer_ns(vm_clock, apic_timer, s);
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index a5ff762..b59df06 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -656,7 +656,8 @@ void gic_init_irqs_and_distributor(GICState *s, int num_irq)
     for (i = 0; i < NUM_CPU(s); i++) {
         sysbus_init_irq(&s->busdev, &s->parent_irq[i]);
     }
-    memory_region_init_io(&s->iomem, NULL, &gic_dist_ops, s, "gic_dist", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &gic_dist_ops, s,
+                          "gic_dist", 0x1000);
 }
 
 static void arm_gic_realize(DeviceState *dev, Error **errp)
@@ -682,12 +683,12 @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
      * GIC v2 defines a larger memory region (0x1000) so this will need
      * to be extended when we implement A15.
      */
-    memory_region_init_io(&s->cpuiomem[0], NULL, &gic_thiscpu_ops, s,
+    memory_region_init_io(&s->cpuiomem[0], OBJECT(s), &gic_thiscpu_ops, s,
                           "gic_cpu", 0x100);
     for (i = 0; i < NUM_CPU(s); i++) {
         s->backref[i] = s;
-        memory_region_init_io(&s->cpuiomem[i+1], NULL, &gic_cpu_ops, &s->backref[i],
-                              "gic_cpu", 0x100);
+        memory_region_init_io(&s->cpuiomem[i+1], OBJECT(s), &gic_cpu_ops,
+                              &s->backref[i], "gic_cpu", 0x100);
     }
     /* Distributor */
     sysbus_init_mmio(sbd, &s->iomem);
diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index 687d1e2..f713975 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -120,7 +120,8 @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
         sysbus_init_irq(sbd, &s->parent_irq[i]);
     }
     /* Distributor */
-    memory_region_init_reservation(&s->iomem, NULL, "kvm-gic_dist", 0x1000);
+    memory_region_init_reservation(&s->iomem, OBJECT(s),
+                                   "kvm-gic_dist", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     kvm_arm_register_device(&s->iomem,
                             (KVM_ARM_DEVICE_VGIC_V2 << KVM_ARM_DEVICE_ID_SHIFT)
@@ -129,7 +130,8 @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
      * provide the "interface for core #N" memory regions, because
      * cores with a VGIC don't have those.
      */
-    memory_region_init_reservation(&s->cpuiomem[0], NULL, "kvm-gic_cpu", 0x1000);
+    memory_region_init_reservation(&s->cpuiomem[0], OBJECT(s),
+                                   "kvm-gic_cpu", 0x1000);
     sysbus_init_mmio(sbd, &s->cpuiomem[0]);
     kvm_arm_register_device(&s->cpuiomem[0],
                             (KVM_ARM_DEVICE_VGIC_V2 << KVM_ARM_DEVICE_ID_SHIFT)
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 74baa72..2a57f77 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -487,17 +487,18 @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
      * We use overlaying to put the GIC like registers
      * over the top of the system control register region.
      */
-    memory_region_init(&s->container, NULL, "nvic", 0x1000);
+    memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000);
     /* The system register region goes at the bottom of the priority
      * stack as it covers the whole page.
      */
-    memory_region_init_io(&s->sysregmem, NULL, &nvic_sysreg_ops, s,
+    memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
                           "nvic_sysregs", 0x1000);
     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
     /* Alias the GIC region so we can get only the section of it
      * we need, and layer it on top of the system register region.
      */
-    memory_region_init_alias(&s->gic_iomem_alias, NULL, "nvic-gic", &s->gic.iomem,
+    memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s),
+                             "nvic-gic", &s->gic.iomem,
                              0x100, 0xc00);
     memory_region_add_subregion_overlap(&s->container, 0x100,
                                         &s->gic_iomem_alias, 1);
diff --git a/hw/intc/etraxfs_pic.c b/hw/intc/etraxfs_pic.c
index 81e1ab9..ce3a3f6 100644
--- a/hw/intc/etraxfs_pic.c
+++ b/hw/intc/etraxfs_pic.c
@@ -146,7 +146,8 @@ static int etraxfs_pic_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->parent_irq);
     sysbus_init_irq(dev, &s->parent_nmi);
 
-    memory_region_init_io(&s->mmio, NULL, &pic_ops, s, "etraxfs-pic", R_MAX * 4);
+    memory_region_init_io(&s->mmio, OBJECT(s), &pic_ops, s,
+                          "etraxfs-pic", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
     return 0;
 }
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index 644d6b3..3b40976 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -417,7 +417,7 @@ static int exynos4210_combiner_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->output_irq[i]);
     }
 
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_combiner_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_combiner_ops, s,
             "exynos4210-combiner", IIC_REGION_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index f9c4218..6147f04 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -299,15 +299,15 @@ static int exynos4210_gic_init(SysBusDevice *dev)
     qdev_init_gpio_in(&s->busdev.qdev, exynos4210_gic_set_irq,
                       EXYNOS4210_GIC_NIRQ - 32);
 
-    memory_region_init(&s->cpu_container, NULL, "exynos4210-cpu-container",
+    memory_region_init(&s->cpu_container, OBJECT(s), "exynos4210-cpu-container",
             EXYNOS4210_EXT_GIC_CPU_REGION_SIZE);
-    memory_region_init(&s->dist_container, NULL, "exynos4210-dist-container",
+    memory_region_init(&s->dist_container, OBJECT(s), "exynos4210-dist-container",
             EXYNOS4210_EXT_GIC_DIST_REGION_SIZE);
 
     for (i = 0; i < s->num_cpu; i++) {
         /* Map CPU interface per SMP Core */
         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
-        memory_region_init_alias(&s->cpu_alias[i], NULL,
+        memory_region_init_alias(&s->cpu_alias[i], OBJECT(s),
                                  cpu_alias_name,
                                  sysbus_mmio_get_region(busdev, 1),
                                  0,
@@ -317,7 +317,7 @@ static int exynos4210_gic_init(SysBusDevice *dev)
 
         /* Map Distributor per SMP Core */
         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
-        memory_region_init_alias(&s->dist_alias[i], NULL,
+        memory_region_init_alias(&s->dist_alias[i], OBJECT(s),
                                  dist_alias_name,
                                  sysbus_mmio_get_region(busdev, 0),
                                  0,
diff --git a/hw/intc/grlib_irqmp.c b/hw/intc/grlib_irqmp.c
index f933e6a..181f614 100644
--- a/hw/intc/grlib_irqmp.c
+++ b/hw/intc/grlib_irqmp.c
@@ -344,7 +344,7 @@ static int grlib_irqmp_init(SysBusDevice *dev)
         return -1;
     }
 
-    memory_region_init_io(&irqmp->iomem, NULL, &grlib_irqmp_ops, irqmp,
+    memory_region_init_io(&irqmp->iomem, OBJECT(dev), &grlib_irqmp_ops, irqmp,
                           "irqmp", IRQMP_REG_SIZE);
 
     irqmp->state = g_malloc0(sizeof *irqmp->state);
diff --git a/hw/intc/i8259.c b/hw/intc/i8259.c
index 13250f1..1415bda 100644
--- a/hw/intc/i8259.c
+++ b/hw/intc/i8259.c
@@ -417,8 +417,10 @@ static void pic_realize(DeviceState *dev, Error **err)
     PICCommonState *s = PIC_COMMON(dev);
     PICClass *pc = PIC_GET_CLASS(dev);
 
-    memory_region_init_io(&s->base_io, NULL, &pic_base_ioport_ops, s, "pic", 2);
-    memory_region_init_io(&s->elcr_io, NULL, &pic_elcr_ioport_ops, s, "elcr", 1);
+    memory_region_init_io(&s->base_io, OBJECT(s), &pic_base_ioport_ops, s,
+                          "pic", 2);
+    memory_region_init_io(&s->elcr_io, OBJECT(s), &pic_elcr_ioport_ops, s,
+                          "elcr", 1);
 
     qdev_init_gpio_out(dev, s->int_out, ARRAY_SIZE(s->int_out));
     qdev_init_gpio_in(dev, pic_set_irq, 8);
diff --git a/hw/intc/imx_avic.c b/hw/intc/imx_avic.c
index 870d56f..75c8ffd 100644
--- a/hw/intc/imx_avic.c
+++ b/hw/intc/imx_avic.c
@@ -372,7 +372,8 @@ static int imx_avic_init(SysBusDevice *dev)
 {
     IMXAVICState *s = FROM_SYSBUS(IMXAVICState, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &imx_avic_ops, s, "imx_avic", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_avic_ops, s,
+                          "imx_avic", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     qdev_init_gpio_in(&dev->qdev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index 7299b50..5d064fe 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -227,7 +227,8 @@ static const MemoryRegionOps ioapic_io_ops = {
 
 static void ioapic_init(IOAPICCommonState *s, int instance_no)
 {
-    memory_region_init_io(&s->io_memory, NULL, &ioapic_io_ops, s, "ioapic", 0x1000);
+    memory_region_init_io(&s->io_memory, OBJECT(s), &ioapic_io_ops, s,
+                          "ioapic", 0x1000);
 
     qdev_init_gpio_in(&s->busdev.qdev, ioapic_set_irq, IOAPIC_NUM_PINS);
 
diff --git a/hw/intc/omap_intc.c b/hw/intc/omap_intc.c
index 00cb6ca..bca8585 100644
--- a/hw/intc/omap_intc.c
+++ b/hw/intc/omap_intc.c
@@ -367,7 +367,7 @@ static int omap_intc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->parent_intr[0]);
     sysbus_init_irq(dev, &s->parent_intr[1]);
     qdev_init_gpio_in(&dev->qdev, omap_set_intr, s->nbanks * 32);
-    memory_region_init_io(&s->mmio, NULL, &omap_inth_mem_ops, s,
+    memory_region_init_io(&s->mmio, OBJECT(s), &omap_inth_mem_ops, s,
                           "omap-intc", s->size);
     sysbus_init_mmio(dev, &s->mmio);
     return 0;
@@ -609,7 +609,7 @@ static int omap2_intc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->parent_intr[0]);
     sysbus_init_irq(dev, &s->parent_intr[1]);
     qdev_init_gpio_in(&dev->qdev, omap_set_intr_noedge, s->nbanks * 32);
-    memory_region_init_io(&s->mmio, NULL, &omap2_inth_mem_ops, s,
+    memory_region_init_io(&s->mmio, OBJECT(s), &omap2_inth_mem_ops, s,
                           "omap2-intc", 0x1000);
     sysbus_init_mmio(dev, &s->mmio);
     return 0;
diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index b9e025f..937e292 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -1516,8 +1516,8 @@ static void map_list(OpenPICState *opp, const MemReg *list, int *count)
     while (list->name) {
         assert(*count < ARRAY_SIZE(opp->sub_io_mem));
 
-        memory_region_init_io(&opp->sub_io_mem[*count], NULL, list->ops, opp,
-                              list->name, list->size);
+        memory_region_init_io(&opp->sub_io_mem[*count], OBJECT(opp), list->ops,
+                              opp, list->name, list->size);
 
         memory_region_add_subregion(&opp->mem, list->start_addr,
                                     &opp->sub_io_mem[*count]);
@@ -1531,7 +1531,7 @@ static void openpic_init(Object *obj)
 {
     OpenPICState *opp = OPENPIC(obj);
 
-    memory_region_init(&opp->mem, NULL, "openpic", 0x40000);
+    memory_region_init(&opp->mem, obj, "openpic", 0x40000);
 }
 
 static void openpic_realize(DeviceState *dev, Error **errp)
diff --git a/hw/intc/openpic_kvm.c b/hw/intc/openpic_kvm.c
index dc08031..c7f7b84 100644
--- a/hw/intc/openpic_kvm.c
+++ b/hw/intc/openpic_kvm.c
@@ -155,7 +155,7 @@ static void kvm_openpic_init(Object *obj)
 {
     KVMOpenPICState *opp = KVM_OPENPIC(obj);
 
-    memory_region_init_io(&opp->mem, NULL, &kvm_openpic_mem_ops, opp,
+    memory_region_init_io(&opp->mem, OBJECT(opp), &kvm_openpic_mem_ops, opp,
                           "kvm-openpic", 0x40000);
 }
 
diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index 5f0f9b7..fdb29d7 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -236,7 +236,7 @@ static int pl190_init(SysBusDevice *dev)
 {
     pl190_state *s = FROM_SYSBUS(pl190_state, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &pl190_ops, s, "pl190", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl190_ops, s, "pl190", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     qdev_init_gpio_in(&dev->qdev, pl190_set_irq, 32);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/intc/puv3_intc.c b/hw/intc/puv3_intc.c
index b327f0e..44b6651 100644
--- a/hw/intc/puv3_intc.c
+++ b/hw/intc/puv3_intc.c
@@ -106,7 +106,7 @@ static int puv3_intc_init(SysBusDevice *dev)
     s->reg_ICMR = 0;
     s->reg_ICPR = 0;
 
-    memory_region_init_io(&s->iomem, NULL, &puv3_intc_ops, s, "puv3_intc",
+    memory_region_init_io(&s->iomem, OBJECT(s), &puv3_intc_ops, s, "puv3_intc",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/intc/realview_gic.c b/hw/intc/realview_gic.c
index 1731a70..e122c2c 100644
--- a/hw/intc/realview_gic.c
+++ b/hw/intc/realview_gic.c
@@ -43,7 +43,8 @@ static int realview_gic_init(SysBusDevice *dev)
     /* Pass through inbound GPIO lines to the GIC */
     qdev_init_gpio_in(&s->busdev.qdev, realview_gic_set_irq, numirq - 32);
 
-    memory_region_init(&s->container, NULL, "realview-gic-container", 0x2000);
+    memory_region_init(&s->container, OBJECT(s),
+                       "realview-gic-container", 0x2000);
     memory_region_add_subregion(&s->container, 0,
                                 sysbus_mmio_get_region(busdev, 1));
     memory_region_add_subregion(&s->container, 0x1000,
diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index 716e36d..b47d0f0 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -426,7 +426,7 @@ static int slavio_intctl_init1(SysBusDevice *dev)
     char slave_name[45];
 
     qdev_init_gpio_in(&dev->qdev, slavio_set_irq_all, 32 + MAX_CPUS);
-    memory_region_init_io(&s->iomem, NULL, &slavio_intctlm_mem_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &slavio_intctlm_mem_ops, s,
                           "master-interrupt-controller", INTCTLM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -436,7 +436,8 @@ static int slavio_intctl_init1(SysBusDevice *dev)
         for (j = 0; j < MAX_PILS; j++) {
             sysbus_init_irq(dev, &s->cpu_irqs[i][j]);
         }
-        memory_region_init_io(&s->slaves[i].iomem, NULL, &slavio_intctl_mem_ops,
+        memory_region_init_io(&s->slaves[i].iomem, OBJECT(s),
+                              &slavio_intctl_mem_ops,
                               &s->slaves[i], slave_name, INTCTL_SIZE);
         sysbus_init_mmio(dev, &s->slaves[i].iomem);
         s->slaves[i].cpu = i;
diff --git a/hw/intc/xilinx_intc.c b/hw/intc/xilinx_intc.c
index 9ba35f6..25d2057 100644
--- a/hw/intc/xilinx_intc.c
+++ b/hw/intc/xilinx_intc.c
@@ -160,7 +160,8 @@ static int xilinx_intc_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
     sysbus_init_irq(dev, &p->parent_irq);
 
-    memory_region_init_io(&p->mmio, NULL, &pic_ops, p, "xlnx.xps-intc", R_MAX * 4);
+    memory_region_init_io(&p->mmio, OBJECT(p), &pic_ops, p, "xlnx.xps-intc",
+                          R_MAX * 4);
     sysbus_init_mmio(dev, &p->mmio);
     return 0;
 }
diff --git a/hw/isa/apm.c b/hw/isa/apm.c
index daed6f1..f97e7a0 100644
--- a/hw/isa/apm.c
+++ b/hw/isa/apm.c
@@ -96,7 +96,7 @@ void apm_init(PCIDevice *dev, APMState *apm, apm_ctrl_changed_t callback,
     apm->arg = arg;
 
     /* ioport 0xb2, 0xb3 */
-    memory_region_init_io(&apm->io, NULL, &apm_ops, apm, "apm-io", 2);
+    memory_region_init_io(&apm->io, OBJECT(dev), &apm_ops, apm, "apm-io", 2);
     memory_region_add_subregion(pci_address_space_io(dev), APM_CNT_IOPORT,
                                 &apm->io);
 }
diff --git a/hw/isa/i82378.c b/hw/isa/i82378.c
index 90f36d5..b25ed04 100644
--- a/hw/isa/i82378.c
+++ b/hw/isa/i82378.c
@@ -221,10 +221,12 @@ static int pci_i82378_init(PCIDevice *dev)
 
     pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin 0 */
 
-    memory_region_init_io(&s->io, NULL, &i82378_io_ops, s, "i82378-io", 0x00010000);
+    memory_region_init_io(&s->io, OBJECT(pci), &i82378_io_ops, s,
+                          "i82378-io", 0x00010000);
     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io);
 
-    memory_region_init_io(&s->mem, NULL, &i82378_mem_ops, s, "i82378-mem", 0x01000000);
+    memory_region_init_io(&s->mem, OBJECT(pci), &i82378_mem_ops, s,
+                          "i82378-mem", 0x01000000);
     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
 
     /* Make I/O address read only */
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index f704c42..b49be4d 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -535,7 +535,7 @@ static int ich9_lpc_initfn(PCIDevice *d)
     pci_set_long(d->wmask + ICH9_LPC_PMBASE,
                  ICH9_LPC_PMBASE_BASE_ADDRESS_MASK);
 
-    memory_region_init_io(&lpc->rbca_mem, NULL, &rbca_mmio_ops, lpc,
+    memory_region_init_io(&lpc->rbca_mem, OBJECT(d), &rbca_mmio_ops, lpc,
                             "lpc-rbca-mmio", ICH9_CC_SIZE);
 
     lpc->isa_bus = isa_bus;
@@ -546,7 +546,7 @@ static int ich9_lpc_initfn(PCIDevice *d)
     lpc->machine_ready.notify = ich9_lpc_machine_ready;
     qemu_add_machine_init_done_notifier(&lpc->machine_ready);
 
-    memory_region_init_io(&lpc->rst_cnt_mem, NULL, &ich9_rst_cnt_ops, lpc,
+    memory_region_init_io(&lpc->rst_cnt_mem, OBJECT(d), &ich9_rst_cnt_ops, lpc,
                           "lpc-reset-control", 1);
     memory_region_add_subregion_overlap(pci_address_space_io(d),
                                         ICH9_RST_CNT_IOPORT, &lpc->rst_cnt_mem,
diff --git a/hw/isa/pc87312.c b/hw/isa/pc87312.c
index 7b3e7fb..46a23fb 100644
--- a/hw/isa/pc87312.c
+++ b/hw/isa/pc87312.c
@@ -352,7 +352,7 @@ static void pc87312_initfn(Object *obj)
 {
     PC87312State *s = PC87312(obj);
 
-    memory_region_init_io(&s->io, NULL, &pc87312_io_ops, s, "pc87312", 2);
+    memory_region_init_io(&s->io, obj, &pc87312_io_ops, s, "pc87312", 2);
 }
 
 static const VMStateDescription vmstate_pc87312 = {
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 19c887d..2174eaa 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -356,7 +356,7 @@ static int vt82c686b_pm_initfn(PCIDevice *dev)
 
     apm_init(dev, &s->apm, NULL, s);
 
-    memory_region_init(&s->io, NULL, "vt82c686-pm", 64);
+    memory_region_init(&s->io, OBJECT(dev), "vt82c686-pm", 64);
     memory_region_set_enabled(&s->io, false);
     memory_region_add_subregion(get_system_io(), 0, &s->io);
 
commit b716368778aebdb523546d72a28706420a8c32ae
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/gpio: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 13399f9..855afae 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -677,7 +677,7 @@ static int omap_gpio_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, omap_gpio_set, 16);
     qdev_init_gpio_out(&dev->qdev, s->omap1.handler, 16);
     sysbus_init_irq(dev, &s->omap1.irq);
-    memory_region_init_io(&s->iomem, NULL, &omap_gpio_ops, &s->omap1,
+    memory_region_init_io(&s->iomem, OBJECT(s), &omap_gpio_ops, &s->omap1,
                           "omap.gpio", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -692,7 +692,7 @@ static int omap2_gpio_init(SysBusDevice *dev)
     }
     if (s->mpu_model < omap3430) {
         s->modulecount = (s->mpu_model < omap2430) ? 4 : 5;
-        memory_region_init_io(&s->iomem, NULL, &omap2_gpif_top_ops, s,
+        memory_region_init_io(&s->iomem, OBJECT(s), &omap2_gpif_top_ops, s,
                               "omap2.gpio", 0x1000);
         sysbus_init_mmio(dev, &s->iomem);
     } else {
@@ -712,7 +712,7 @@ static int omap2_gpio_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &m->irq[0]); /* mpu irq */
         sysbus_init_irq(dev, &m->irq[1]); /* dsp irq */
         sysbus_init_irq(dev, &m->wkup);
-        memory_region_init_io(&m->iomem, NULL, &omap2_gpio_module_ops, m,
+        memory_region_init_io(&m->iomem, OBJECT(s), &omap2_gpio_module_ops, m,
                               "omap.gpio-module", 0x1000);
         sysbus_init_mmio(dev, &m->iomem);
     }
diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index d0dd636..a0bbf08 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -276,7 +276,7 @@ static int pl061_init(SysBusDevice *dev, const unsigned char *id)
 {
     pl061_state *s = FROM_SYSBUS(pl061_state, dev);
     s->id = id;
-    memory_region_init_io(&s->iomem, NULL, &pl061_ops, s, "pl061", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl061_ops, s, "pl061", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     qdev_init_gpio_in(&dev->qdev, pl061_set_irq, 8);
diff --git a/hw/gpio/puv3_gpio.c b/hw/gpio/puv3_gpio.c
index 333c920..18671eb 100644
--- a/hw/gpio/puv3_gpio.c
+++ b/hw/gpio/puv3_gpio.c
@@ -112,7 +112,7 @@ static int puv3_gpio_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq[PUV3_IRQS_GPIOLOW7]);
     sysbus_init_irq(dev, &s->irq[PUV3_IRQS_GPIOHIGH]);
 
-    memory_region_init_io(&s->iomem, NULL, &puv3_gpio_ops, s, "puv3_gpio",
+    memory_region_init_io(&s->iomem, OBJECT(s), &puv3_gpio_ops, s, "puv3_gpio",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index a0e18c3..c235c3e 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -169,7 +169,7 @@ static int scoop_init(SysBusDevice *dev)
     s->status = 0x02;
     qdev_init_gpio_out(&s->busdev.qdev, s->handler, 16);
     qdev_init_gpio_in(&s->busdev.qdev, scoop_gpio_set, 16);
-    memory_region_init_io(&s->iomem, NULL, &scoop_ops, s, "scoop", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &scoop_ops, s, "scoop", 0x1000);
 
     sysbus_init_mmio(dev, &s->iomem);
 
commit 3eadad551d3d5901b75f8c53dbd57b9bec2f2b01
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/d*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 3d579e2..a440575 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2967,7 +2967,7 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
 
      /* setup PCI */
 
-    memory_region_init(&s->pci_bar, NULL, "cirrus-pci-bar0", 0x2000000);
+    memory_region_init(&s->pci_bar, OBJECT(dev), "cirrus-pci-bar0", 0x2000000);
 
     /* XXX: add byte swapping apertures */
     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index b520f52..eb168ea 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1908,7 +1908,7 @@ static int exynos4210_fimd_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq[1]);
     sysbus_init_irq(dev, &s->irq[2]);
 
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_fimd_mmio_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_fimd_mmio_ops, s,
             "exynos4210.fimd", FIMD_REGS_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     s->console = graphic_console_init(DEVICE(dev), &exynos4210_fimd_ops, s);
diff --git a/hw/display/jazz_led.c b/hw/display/jazz_led.c
index e6a508e..7f82037 100644
--- a/hw/display/jazz_led.c
+++ b/hw/display/jazz_led.c
@@ -264,7 +264,7 @@ static int jazz_led_init(SysBusDevice *dev)
 {
     LedState *s = FROM_SYSBUS(LedState, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &led_ops, s, "led", 1);
+    memory_region_init_io(&s->iomem, OBJECT(s), &led_ops, s, "led", 1);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->con = graphic_console_init(DEVICE(dev), &jazz_led_ops, s);
diff --git a/hw/display/milkymist-tmu2.c b/hw/display/milkymist-tmu2.c
index 31da796..efda082 100644
--- a/hw/display/milkymist-tmu2.c
+++ b/hw/display/milkymist-tmu2.c
@@ -447,7 +447,7 @@ static int milkymist_tmu2_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, NULL, &tmu2_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(s), &tmu2_mmio_ops, s,
             "milkymist-tmu2", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/display/milkymist-vgafb.c b/hw/display/milkymist-vgafb.c
index b1f9c16..870b339 100644
--- a/hw/display/milkymist-vgafb.c
+++ b/hw/display/milkymist-vgafb.c
@@ -279,7 +279,7 @@ static int milkymist_vgafb_init(SysBusDevice *dev)
 {
     MilkymistVgafbState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->regs_region, NULL, &vgafb_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(s), &vgafb_mmio_ops, s,
             "milkymist-vgafb", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 15c2f38..60afcf3 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -453,7 +453,7 @@ static int pl110_init(SysBusDevice *dev)
 {
     pl110_state *s = FROM_SYSBUS(pl110_state, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &pl110_ops, s, "pl110", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     qdev_init_gpio_in(&s->busdev.qdev, pl110_mux_ctrl_set, 1);
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 3804fe2..3862d7a 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1981,18 +1981,20 @@ static int qxl_init_common(PCIQXLDevice *qxl)
     pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);
 
     qxl->rom_size = qxl_rom_size();
-    memory_region_init_ram(&qxl->rom_bar, NULL, "qxl.vrom", qxl->rom_size);
+    memory_region_init_ram(&qxl->rom_bar, OBJECT(qxl), "qxl.vrom",
+                           qxl->rom_size);
     vmstate_register_ram(&qxl->rom_bar, &qxl->pci.qdev);
     init_qxl_rom(qxl);
     init_qxl_ram(qxl);
 
     qxl->guest_surfaces.cmds = g_new0(QXLPHYSICAL, qxl->ssd.num_surfaces);
-    memory_region_init_ram(&qxl->vram_bar, NULL, "qxl.vram", qxl->vram_size);
+    memory_region_init_ram(&qxl->vram_bar, OBJECT(qxl), "qxl.vram",
+                           qxl->vram_size);
     vmstate_register_ram(&qxl->vram_bar, &qxl->pci.qdev);
-    memory_region_init_alias(&qxl->vram32_bar, NULL, "qxl.vram32", &qxl->vram_bar,
-                             0, qxl->vram32_size);
+    memory_region_init_alias(&qxl->vram32_bar, OBJECT(qxl), "qxl.vram32",
+                             &qxl->vram_bar, 0, qxl->vram32_size);
 
-    memory_region_init_io(&qxl->io_bar, NULL, &qxl_io_ops, qxl,
+    memory_region_init_io(&qxl->io_bar, OBJECT(qxl), &qxl_io_ops, qxl,
                           "qxl-ioports", io_size);
     if (qxl->id == 0) {
         vga_dirty_log_start(&qxl->vga);
@@ -2095,7 +2097,8 @@ static int qxl_init_secondary(PCIDevice *dev)
 
     qxl->id = device_id++;
     qxl_init_ramsize(qxl);
-    memory_region_init_ram(&qxl->vga.vram, NULL, "qxl.vgavram", qxl->vga.vram_size);
+    memory_region_init_ram(&qxl->vga.vram, OBJECT(dev), "qxl.vgavram",
+                           qxl->vga.vram_size);
     vmstate_register_ram(&qxl->vga.vram, &qxl->pci.qdev);
     qxl->vga.vram_ptr = memory_region_get_ram_ptr(&qxl->vga.vram);
     qxl->vga.con = graphic_console_init(DEVICE(dev), &qxl_ops, qxl);
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 24b5478..9fd48b5 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -528,7 +528,7 @@ static int tcx_init1(SysBusDevice *dev)
     int size;
     uint8_t *vram_base;
 
-    memory_region_init_ram(&s->vram_mem, NULL, "tcx.vram",
+    memory_region_init_ram(&s->vram_mem, OBJECT(s), "tcx.vram",
                            s->vram_size * (1 + 4 + 4));
     vmstate_register_ram_global(&s->vram_mem);
     vram_base = memory_region_get_ram_ptr(&s->vram_mem);
@@ -536,21 +536,23 @@ static int tcx_init1(SysBusDevice *dev)
     /* 8-bit plane */
     s->vram = vram_base;
     size = s->vram_size;
-    memory_region_init_alias(&s->vram_8bit, NULL, "tcx.vram.8bit",
+    memory_region_init_alias(&s->vram_8bit, OBJECT(s), "tcx.vram.8bit",
                              &s->vram_mem, vram_offset, size);
     sysbus_init_mmio(dev, &s->vram_8bit);
     vram_offset += size;
     vram_base += size;
 
     /* DAC */
-    memory_region_init_io(&s->dac, NULL, &tcx_dac_ops, s, "tcx.dac", TCX_DAC_NREGS);
+    memory_region_init_io(&s->dac, OBJECT(s), &tcx_dac_ops, s,
+                          "tcx.dac", TCX_DAC_NREGS);
     sysbus_init_mmio(dev, &s->dac);
 
     /* TEC (dummy) */
-    memory_region_init_io(&s->tec, NULL, &dummy_ops, s, "tcx.tec", TCX_TEC_NREGS);
+    memory_region_init_io(&s->tec, OBJECT(s), &dummy_ops, s,
+                          "tcx.tec", TCX_TEC_NREGS);
     sysbus_init_mmio(dev, &s->tec);
     /* THC: NetBSD writes here even with 8-bit display: dummy */
-    memory_region_init_io(&s->thc24, NULL, &dummy_ops, s, "tcx.thc24",
+    memory_region_init_io(&s->thc24, OBJECT(s), &dummy_ops, s, "tcx.thc24",
                           TCX_THC_NREGS_24);
     sysbus_init_mmio(dev, &s->thc24);
 
@@ -559,7 +561,7 @@ static int tcx_init1(SysBusDevice *dev)
         size = s->vram_size * 4;
         s->vram24 = (uint32_t *)vram_base;
         s->vram24_offset = vram_offset;
-        memory_region_init_alias(&s->vram_24bit, NULL, "tcx.vram.24bit",
+        memory_region_init_alias(&s->vram_24bit, OBJECT(s), "tcx.vram.24bit",
                                  &s->vram_mem, vram_offset, size);
         sysbus_init_mmio(dev, &s->vram_24bit);
         vram_offset += size;
@@ -569,14 +571,14 @@ static int tcx_init1(SysBusDevice *dev)
         size = s->vram_size * 4;
         s->cplane = (uint32_t *)vram_base;
         s->cplane_offset = vram_offset;
-        memory_region_init_alias(&s->vram_cplane, NULL, "tcx.vram.cplane",
+        memory_region_init_alias(&s->vram_cplane, OBJECT(s), "tcx.vram.cplane",
                                  &s->vram_mem, vram_offset, size);
         sysbus_init_mmio(dev, &s->vram_cplane);
 
         s->con = graphic_console_init(DEVICE(dev), &tcx24_ops, s);
     } else {
         /* THC 8 bit (dummy) */
-        memory_region_init_io(&s->thc8, NULL, &dummy_ops, s, "tcx.thc8",
+        memory_region_init_io(&s->thc8, OBJECT(s), &dummy_ops, s, "tcx.thc8",
                               TCX_THC_NREGS_8);
         sysbus_init_mmio(dev, &s->thc8);
 
diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 588c7b2..7937c3e 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -359,7 +359,7 @@ static int pl08x_init(SysBusDevice *dev, int nchannels)
 {
     pl080_state *s = FROM_SYSBUS(pl080_state, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &pl080_ops, s, "pl080", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->nchannels = nchannels;
diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
index b366f8a..ddcc413 100644
--- a/hw/dma/pl330.c
+++ b/hw/dma/pl330.c
@@ -1528,7 +1528,8 @@ static void pl330_realize(DeviceState *dev, Error **errp)
     PL330State *s = PL330(dev);
 
     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq_abort);
-    memory_region_init_io(&s->iomem, NULL, &pl330_ops, s, "dma", PL330_IOMEM_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl330_ops, s,
+                          "dma", PL330_IOMEM_SIZE);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
 
     s->timer = qemu_new_timer_ns(vm_clock, pl330_exec_cycle_timer, s);
diff --git a/hw/dma/puv3_dma.c b/hw/dma/puv3_dma.c
index 787e9a1..36004ae 100644
--- a/hw/dma/puv3_dma.c
+++ b/hw/dma/puv3_dma.c
@@ -80,7 +80,7 @@ static int puv3_dma_init(SysBusDevice *dev)
         s->reg_CFG[i] = 0x0;
     }
 
-    memory_region_init_io(&s->iomem, NULL, &puv3_dma_ops, s, "puv3_dma",
+    memory_region_init_io(&s->iomem, OBJECT(s), &puv3_dma_ops, s, "puv3_dma",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/dma/pxa2xx_dma.c b/hw/dma/pxa2xx_dma.c
index 43e2dc3..bc7bf4c 100644
--- a/hw/dma/pxa2xx_dma.c
+++ b/hw/dma/pxa2xx_dma.c
@@ -465,7 +465,7 @@ static int pxa2xx_dma_init(SysBusDevice *dev)
 
     qdev_init_gpio_in(&dev->qdev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
 
-    memory_region_init_io(&s->iomem, NULL, &pxa2xx_dma_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_dma_ops, s,
                           "pxa2xx.dma", 0x00010000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/dma/sparc32_dma.c b/hw/dma/sparc32_dma.c
index 4abb024..be6275f 100644
--- a/hw/dma/sparc32_dma.c
+++ b/hw/dma/sparc32_dma.c
@@ -274,7 +274,8 @@ static int sparc32_dma_init1(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
 
     reg_size = s->is_ledma ? DMA_ETH_SIZE : DMA_SIZE;
-    memory_region_init_io(&s->iomem, NULL, &dma_mem_ops, s, "dma", reg_size);
+    memory_region_init_io(&s->iomem, OBJECT(s), &dma_mem_ops, s,
+                          "dma", reg_size);
     sysbus_init_mmio(dev, &s->iomem);
 
     qdev_init_gpio_in(&dev->qdev, dma_set_irq, 1);
diff --git a/hw/dma/sun4m_iommu.c b/hw/dma/sun4m_iommu.c
index eafb991..edb93f3 100644
--- a/hw/dma/sun4m_iommu.c
+++ b/hw/dma/sun4m_iommu.c
@@ -349,7 +349,7 @@ static int iommu_init1(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, NULL, &iommu_mem_ops, s, "iommu",
+    memory_region_init_io(&s->iomem, OBJECT(s), &iommu_mem_ops, s, "iommu",
                           IOMMU_NREGS * sizeof(uint32_t));
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index bdce635..a48e3ba 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -590,7 +590,7 @@ static void xilinx_axidma_init(Object *obj)
     sysbus_init_irq(sbd, &s->streams[0].irq);
     sysbus_init_irq(sbd, &s->streams[1].irq);
 
-    memory_region_init_io(&s->iomem, NULL, &axidma_ops, s,
+    memory_region_init_io(&s->iomem, obj, &axidma_ops, s,
                           "xlnx.axi-dma", R_MAX * 4 * 2);
     sysbus_init_mmio(sbd, &s->iomem);
 }
commit 300b1fc68c47478f36705f23a93dce77ac3e429a
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/c*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 36e8cd5..131370a 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -442,7 +442,7 @@ static int cadence_uart_init(SysBusDevice *dev)
 {
     UartState *s = FROM_SYSBUS(UartState, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &uart_ops, s, "uart", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &uart_ops, s, "uart", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index c62fead..03db12f 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -103,7 +103,7 @@ static void debugcon_isa_realizefn(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    memory_region_init_io(&s->io, NULL, &debugcon_ops, s,
+    memory_region_init_io(&s->io, OBJECT(dev), &debugcon_ops, s,
                           TYPE_ISA_DEBUGCON_DEVICE, 1);
     memory_region_add_subregion(isa_address_space_io(d),
                                 isa->iobase, &s->io);
diff --git a/hw/char/escc.c b/hw/char/escc.c
index 422adf2..4c42198 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -886,7 +886,7 @@ static int escc_init1(SysBusDevice *dev)
     s->chn[0].otherchn = &s->chn[1];
     s->chn[1].otherchn = &s->chn[0];
 
-    memory_region_init_io(&s->mmio, NULL, &escc_mem_ops, s, "escc",
+    memory_region_init_io(&s->mmio, OBJECT(s), &escc_mem_ops, s, "escc",
                           ESCC_SIZE << s->it_shift);
     sysbus_init_mmio(dev, &s->mmio);
 
diff --git a/hw/char/etraxfs_ser.c b/hw/char/etraxfs_ser.c
index ffd9767..d19af00 100644
--- a/hw/char/etraxfs_ser.c
+++ b/hw/char/etraxfs_ser.c
@@ -211,7 +211,8 @@ static int etraxfs_ser_init(SysBusDevice *dev)
     struct etrax_serial *s = FROM_SYSBUS(typeof (*s), dev);
 
     sysbus_init_irq(dev, &s->irq);
-    memory_region_init_io(&s->mmio, NULL, &ser_ops, s, "etraxfs-serial", R_MAX * 4);
+    memory_region_init_io(&s->mmio, OBJECT(s), &ser_ops, s,
+                          "etraxfs-serial", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
     s->chr = qemu_char_get_next_serial();
diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index b879ba4..855ce7a 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -630,8 +630,8 @@ static int exynos4210_uart_init(SysBusDevice *dev)
     Exynos4210UartState *s = FROM_SYSBUS(Exynos4210UartState, dev);
 
     /* memory mapping */
-    memory_region_init_io(&s->iomem, NULL, &exynos4210_uart_ops, s, "exynos4210.uart",
-                          EXYNOS4210_UART_REGS_MEM_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_uart_ops, s,
+                          "exynos4210.uart", EXYNOS4210_UART_REGS_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index a1587dc..82e1b95 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -242,7 +242,7 @@ static int grlib_apbuart_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &uart->irq);
 
-    memory_region_init_io(&uart->iomem, NULL, &grlib_apbuart_ops, uart,
+    memory_region_init_io(&uart->iomem, OBJECT(uart), &grlib_apbuart_ops, uart,
                           "uart", UART_REG_SIZE);
 
     sysbus_init_mmio(dev, &uart->iomem);
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 9fa4da7..69b9ed2 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -386,7 +386,8 @@ static int imx_serial_init(SysBusDevice *dev)
     IMXSerialState *s = FROM_SYSBUS(IMXSerialState, dev);
 
 
-    memory_region_init_io(&s->iomem, NULL, &imx_serial_ops, s, "imx-serial", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_serial_ops, s,
+                          "imx-serial", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/char/lm32_uart.c b/hw/char/lm32_uart.c
index e8fdbe4..37b38ba 100644
--- a/hw/char/lm32_uart.c
+++ b/hw/char/lm32_uart.c
@@ -250,7 +250,8 @@ static int lm32_uart_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, NULL, &uart_ops, s, "uart", R_MAX * 4);
+    memory_region_init_io(&s->iomem, OBJECT(s), &uart_ops, s,
+                          "uart", R_MAX * 4);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->chr = qemu_char_get_next_serial();
diff --git a/hw/char/milkymist-uart.c b/hw/char/milkymist-uart.c
index 22faf4c..46deab2 100644
--- a/hw/char/milkymist-uart.c
+++ b/hw/char/milkymist-uart.c
@@ -196,7 +196,7 @@ static int milkymist_uart_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, NULL, &uart_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(s), &uart_mmio_ops, s,
             "milkymist-uart", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index bd26e6d..ebec64f 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -265,7 +265,7 @@ static int pl011_init(SysBusDevice *dev, const unsigned char *id)
 {
     pl011_state *s = FROM_SYSBUS(pl011_state, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &pl011_ops, s, "pl011", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl011_ops, s, "pl011", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->id = id;
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index 0bce75b..cea8212 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -72,7 +72,7 @@ static void serial_isa_realizefn(DeviceState *dev, Error **errp)
     serial_realize_core(s, errp);
     qdev_set_legacy_instance_id(dev, isa->iobase, 3);
 
-    memory_region_init_io(&s->io, NULL, &serial_io_ops, s, "serial", 8);
+    memory_region_init_io(&s->io, OBJECT(isa), &serial_io_ops, s, "serial", 8);
     isa_register_ioport(isadev, &s->io, isa->iobase);
 }
 
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index 6adfbe6..a17c702 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -63,7 +63,7 @@ static int serial_pci_init(PCIDevice *dev)
     pci->dev.config[PCI_INTERRUPT_PIN] = 0x01;
     s->irq = pci->dev.irq[0];
 
-    memory_region_init_io(&s->io, NULL, &serial_io_ops, s, "serial", 8);
+    memory_region_init_io(&s->io, OBJECT(pci), &serial_io_ops, s, "serial", 8);
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
     return 0;
 }
@@ -102,7 +102,7 @@ static int multi_serial_pci_init(PCIDevice *dev)
     assert(pci->ports <= PCI_SERIAL_MAX_PORTS);
 
     pci->dev.config[PCI_INTERRUPT_PIN] = 0x01;
-    memory_region_init(&pci->iobar, NULL, "multiserial", 8 * pci->ports);
+    memory_region_init(&pci->iobar, OBJECT(pci), "multiserial", 8 * pci->ports);
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->iobar);
     pci->irqs = qemu_allocate_irqs(multi_serial_irq_mux, pci,
                                    pci->ports);
@@ -118,7 +118,8 @@ static int multi_serial_pci_init(PCIDevice *dev)
         }
         s->irq = pci->irqs[i];
         pci->name[i] = g_strdup_printf("uart #%d", i+1);
-        memory_region_init_io(&s->io, NULL, &serial_io_ops, s, pci->name[i], 8);
+        memory_region_init_io(&s->io, OBJECT(pci), &serial_io_ops, s,
+                              pci->name[i], 8);
         memory_region_add_subregion(&pci->iobar, 8 * i, &s->io);
     }
     return 0;
diff --git a/hw/char/tpci200.c b/hw/char/tpci200.c
index 9174042..a199e57 100644
--- a/hw/char/tpci200.c
+++ b/hw/char/tpci200.c
@@ -588,17 +588,17 @@ static int tpci200_initfn(PCIDevice *pci_dev)
     pci_set_long(c + 0x48, 0x00024C06);
     pci_set_long(c + 0x4C, 0x00000003);
 
-    memory_region_init_io(&s->mmio, NULL, &tpci200_cfg_ops,
+    memory_region_init_io(&s->mmio, OBJECT(s), &tpci200_cfg_ops,
                           s, "tpci200_mmio", 128);
-    memory_region_init_io(&s->io, NULL,   &tpci200_cfg_ops,
+    memory_region_init_io(&s->io, OBJECT(s),   &tpci200_cfg_ops,
                           s, "tpci200_io",   128);
-    memory_region_init_io(&s->las0, NULL, &tpci200_las0_ops,
+    memory_region_init_io(&s->las0, OBJECT(s), &tpci200_las0_ops,
                           s, "tpci200_las0", 256);
-    memory_region_init_io(&s->las1, NULL, &tpci200_las1_ops,
+    memory_region_init_io(&s->las1, OBJECT(s), &tpci200_las1_ops,
                           s, "tpci200_las1", 1024);
-    memory_region_init_io(&s->las2, NULL, &tpci200_las2_ops,
+    memory_region_init_io(&s->las2, OBJECT(s), &tpci200_las2_ops,
                           s, "tpci200_las2", 1024*1024*32);
-    memory_region_init_io(&s->las3, NULL, &tpci200_las3_ops,
+    memory_region_init_io(&s->las3, OBJECT(s), &tpci200_las3_ops,
                           s, "tpci200_las3", 1024*1024*16);
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio);
     pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_IO,     &s->io);
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 241bf1f..feca497 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -199,8 +199,8 @@ static int xilinx_uartlite_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
 
     uart_update_status(s);
-    memory_region_init_io(&s->mmio, NULL, &uart_ops, s, "xlnx.xps-uartlite",
-                                                                R_MAX * 4);
+    memory_region_init_io(&s->mmio, OBJECT(s), &uart_ops, s,
+                          "xlnx.xps-uartlite", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
     s->chr = qemu_char_get_next_serial();
diff --git a/hw/core/empty_slot.c b/hw/core/empty_slot.c
index 35e32f9..e624991 100644
--- a/hw/core/empty_slot.c
+++ b/hw/core/empty_slot.c
@@ -70,7 +70,7 @@ static int empty_slot_init1(SysBusDevice *dev)
 {
     EmptySlot *s = FROM_SYSBUS(EmptySlot, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &empty_slot_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &empty_slot_ops, s,
                           "empty-slot", s->size);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index 773c83a..967b080 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -68,7 +68,8 @@ static int a15mp_priv_init(SysBusDevice *dev)
      *  0x5000-0x5fff -- GIC virtual interface control (not modelled)
      *  0x6000-0x7fff -- GIC virtual CPU interface (not modelled)
      */
-    memory_region_init(&s->container, NULL, "a15mp-priv-container", 0x8000);
+    memory_region_init(&s->container, OBJECT(s),
+                       "a15mp-priv-container", 0x8000);
     memory_region_add_subregion(&s->container, 0x1000,
                                 sysbus_mmio_get_region(busdev, 0));
     memory_region_add_subregion(&s->container, 0x2000,
diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index 26a3858..6c00a59 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -71,7 +71,7 @@ static int a9mp_priv_init(SysBusDevice *dev)
      *
      * We should implement the global timer but don't currently do so.
      */
-    memory_region_init(&s->container, NULL, "a9mp-priv-container", 0x2000);
+    memory_region_init(&s->container, OBJECT(s), "a9mp-priv-container", 0x2000);
     memory_region_add_subregion(&s->container, 0,
                                 sysbus_mmio_get_region(scubusdev, 0));
     /* GIC CPU interface */
diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index 67e2828..8eeb53e 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -87,8 +87,10 @@ static void mpcore_priv_map_setup(ARM11MPCorePriveState *s)
     SysBusDevice *gicbusdev = SYS_BUS_DEVICE(s->gic);
     SysBusDevice *timerbusdev = SYS_BUS_DEVICE(s->mptimer);
     SysBusDevice *wdtbusdev = SYS_BUS_DEVICE(s->wdtimer);
-    memory_region_init(&s->container, NULL, "mpcode-priv-container", 0x2000);
-    memory_region_init_io(&s->iomem, NULL, &mpcore_scu_ops, s, "mpcore-scu", 0x100);
+    memory_region_init(&s->container, OBJECT(s),
+                       "mpcode-priv-container", 0x2000);
+    memory_region_init_io(&s->iomem, OBJECT(s),
+                          &mpcore_scu_ops, s, "mpcore-scu", 0x100);
     memory_region_add_subregion(&s->container, 0, &s->iomem);
     /* GIC CPU interfaces: "current CPU" at 0x100, then specific CPUs
      * at 0x200, 0x300...
diff --git a/hw/cpu/icc_bus.c b/hw/cpu/icc_bus.c
index 9e901e9..8788144 100644
--- a/hw/cpu/icc_bus.c
+++ b/hw/cpu/icc_bus.c
@@ -95,7 +95,7 @@ static void icc_bridge_init(Object *obj)
     /* Do not change order of registering regions,
      * APIC must be first registered region, board maps it by 0 index
      */
-    memory_region_init(&s->apic_container, NULL, "icc-apic-container",
+    memory_region_init(&s->apic_container, obj, "icc-apic-container",
                        APIC_SPACE_SIZE);
     sysbus_init_mmio(sb, &s->apic_container);
     s->icc_bus.apic_address_space = &s->apic_container;
commit 2d256e6f652b519c59d0bea926ebb1cb866d4241
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/block: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 1bec805..cdc00e5 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -2149,7 +2149,8 @@ static int sysbus_fdc_init1(SysBusDevice *dev)
     FDCtrl *fdctrl = &sys->state;
     int ret;
 
-    memory_region_init_io(&fdctrl->iomem, NULL, &fdctrl_mem_ops, fdctrl, "fdc", 0x08);
+    memory_region_init_io(&fdctrl->iomem, OBJECT(sys), &fdctrl_mem_ops, fdctrl,
+                          "fdc", 0x08);
     sysbus_init_mmio(dev, &fdctrl->iomem);
     sysbus_init_irq(dev, &fdctrl->irq);
     qdev_init_gpio_in(&dev->qdev, fdctrl_handle_tc, 1);
@@ -2165,8 +2166,8 @@ static int sun4m_fdc_init1(SysBusDevice *dev)
 {
     FDCtrl *fdctrl = &(FROM_SYSBUS(FDCtrlSysBus, dev)->state);
 
-    memory_region_init_io(&fdctrl->iomem, NULL, &fdctrl_mem_strict_ops, fdctrl,
-                          "fdctrl", 0x08);
+    memory_region_init_io(&fdctrl->iomem, OBJECT(dev), &fdctrl_mem_strict_ops,
+                          fdctrl, "fdctrl", 0x08);
     sysbus_init_mmio(dev, &fdctrl->iomem);
     sysbus_init_irq(dev, &fdctrl->irq);
     qdev_init_gpio_in(&dev->qdev, fdctrl_handle_tc, 1);
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index aa3d9a9..f15f04a 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -777,7 +777,8 @@ static int nvme_init(PCIDevice *pci_dev)
     n->sq = g_malloc0(sizeof(*n->sq)*n->num_queues);
     n->cq = g_malloc0(sizeof(*n->cq)*n->num_queues);
 
-    memory_region_init_io(&n->iomem, NULL, &nvme_mmio_ops, n, "nvme", n->reg_size);
+    memory_region_init_io(&n->iomem, OBJECT(n), &nvme_mmio_ops, n,
+                          "nvme", n->reg_size);
     pci_register_bar(&n->parent_obj, 0,
         PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64,
         &n->iomem);
diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index edbce3c..2776f64 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -113,9 +113,10 @@ static void onenand_mem_setup(OneNANDState *s)
     /* XXX: We should use IO_MEM_ROMD but we broke it earlier...
      * Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
      * write boot commands.  Also take note of the BWPS bit.  */
-    memory_region_init(&s->container, NULL, "onenand", 0x10000 << s->shift);
+    memory_region_init(&s->container, OBJECT(s), "onenand",
+                       0x10000 << s->shift);
     memory_region_add_subregion(&s->container, 0, &s->iomem);
-    memory_region_init_alias(&s->mapped_ram, NULL, "onenand-mapped-ram",
+    memory_region_init_alias(&s->mapped_ram, OBJECT(s), "onenand-mapped-ram",
                              &s->ram, 0x0200 << s->shift,
                              0xbe00 << s->shift);
     memory_region_add_subregion_overlap(&s->container,
@@ -768,7 +769,7 @@ static int onenand_initfn(SysBusDevice *dev)
     s->blockwp = g_malloc(s->blocks);
     s->density_mask = (s->id.dev & 0x08)
         ? (1 << (6 + ((s->id.dev >> 4) & 7))) : 0;
-    memory_region_init_io(&s->iomem, NULL, &onenand_ops, s, "onenand",
+    memory_region_init_io(&s->iomem, OBJECT(s), &onenand_ops, s, "onenand",
                           0x10000 << s->shift);
     if (!s->bdrv) {
         s->image = memset(g_malloc(size + (size >> 5)),
@@ -782,7 +783,8 @@ static int onenand_initfn(SysBusDevice *dev)
     }
     s->otp = memset(g_malloc((64 + 2) << PAGE_SHIFT),
                     0xff, (64 + 2) << PAGE_SHIFT);
-    memory_region_init_ram(&s->ram, NULL, "onenand.ram", 0xc000 << s->shift);
+    memory_region_init_ram(&s->ram, OBJECT(s), "onenand.ram",
+                           0xc000 << s->shift);
     vmstate_register_ram_global(&s->ram);
     ram = memory_region_get_ram_ptr(&s->ram);
     s->boot[0] = ram + (0x0000 << s->shift);
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 5d51e58..6898a25 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -579,7 +579,7 @@ static int pflash_cfi01_init(SysBusDevice *dev)
 #endif
 
     memory_region_init_rom_device(
-        &pfl->mem, NULL,
+        &pfl->mem, OBJECT(dev),
         pfl->be ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le, pfl,
         pfl->name, total_len);
     vmstate_register_ram(&pfl->mem, DEVICE(pfl));
diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index 8c1d570..d6cd3da 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -100,11 +100,11 @@ static void pflash_setup_mappings(pflash_t *pfl)
     unsigned i;
     hwaddr size = memory_region_size(&pfl->orig_mem);
 
-    memory_region_init(&pfl->mem, NULL, "pflash", pfl->mappings * size);
+    memory_region_init(&pfl->mem, OBJECT(pfl), "pflash", pfl->mappings * size);
     pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings);
     for (i = 0; i < pfl->mappings; ++i) {
-        memory_region_init_alias(&pfl->mem_mappings[i], NULL, "pflash-alias",
-                                 &pfl->orig_mem, 0, size);
+        memory_region_init_alias(&pfl->mem_mappings[i], OBJECT(pfl),
+                                 "pflash-alias", &pfl->orig_mem, 0, size);
         memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]);
     }
 }
@@ -600,7 +600,7 @@ static int pflash_cfi02_init(SysBusDevice *dev)
         return NULL;
 #endif
 
-    memory_region_init_rom_device(&pfl->orig_mem, NULL, pfl->be ?
+    memory_region_init_rom_device(&pfl->orig_mem, OBJECT(pfl), pfl->be ?
                                   &pflash_cfi02_ops_be : &pflash_cfi02_ops_le,
                                   pfl, pfl->name, chip_len);
     vmstate_register_ram(&pfl->orig_mem, DEVICE(pfl));
commit 64bde0f3e7170cc8a9b60da835b9b3cefd03a7a5
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:25:08 2013 -0400

    hw/a*: pass owner to memory_region_init* functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 7206e9c..b07feda 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -419,7 +419,8 @@ void acpi_pm1_evt_init(ACPIREGS *ar, acpi_update_sci_fn update_sci,
                        MemoryRegion *parent)
 {
     ar->pm1.evt.update_sci = update_sci;
-    memory_region_init_io(&ar->pm1.evt.io, NULL, &acpi_pm_evt_ops, ar, "acpi-evt", 4);
+    memory_region_init_io(&ar->pm1.evt.io, memory_region_owner(parent),
+                          &acpi_pm_evt_ops, ar, "acpi-evt", 4);
     memory_region_add_subregion(parent, 0, &ar->pm1.evt.io);
 }
 
@@ -481,7 +482,8 @@ void acpi_pm_tmr_init(ACPIREGS *ar, acpi_update_sci_fn update_sci,
 {
     ar->tmr.update_sci = update_sci;
     ar->tmr.timer = qemu_new_timer_ns(vm_clock, acpi_pm_tmr_timer, ar);
-    memory_region_init_io(&ar->tmr.io, NULL, &acpi_pm_tmr_ops, ar, "acpi-tmr", 4);
+    memory_region_init_io(&ar->tmr.io, memory_region_owner(parent),
+                          &acpi_pm_tmr_ops, ar, "acpi-tmr", 4);
     memory_region_add_subregion(parent, 8, &ar->tmr.io);
 }
 
@@ -552,7 +554,8 @@ void acpi_pm1_cnt_init(ACPIREGS *ar, MemoryRegion *parent, uint8_t s4_val)
     ar->pm1.cnt.s4_val = s4_val;
     ar->wakeup.notify = acpi_notify_wakeup;
     qemu_register_wakeup_notifier(&ar->wakeup);
-    memory_region_init_io(&ar->pm1.cnt.io, NULL, &acpi_pm_cnt_ops, ar, "acpi-cnt", 2);
+    memory_region_init_io(&ar->pm1.cnt.io, memory_region_owner(parent),
+                          &acpi_pm_cnt_ops, ar, "acpi-cnt", 2);
     memory_region_add_subregion(parent, 4, &ar->pm1.cnt.io);
 }
 
diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index 8ce52e7..3fb443d 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -205,7 +205,7 @@ static void pm_powerdown_req(Notifier *n, void *opaque)
 void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm,
                   qemu_irq sci_irq)
 {
-    memory_region_init(&pm->io, NULL, "ich9-pm", ICH9_PMIO_SIZE);
+    memory_region_init(&pm->io, OBJECT(lpc_pci), "ich9-pm", ICH9_PMIO_SIZE);
     memory_region_set_enabled(&pm->io, false);
     memory_region_add_subregion(pci_address_space_io(lpc_pci),
                                 0, &pm->io);
@@ -215,12 +215,12 @@ void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm,
     acpi_pm1_cnt_init(&pm->acpi_regs, &pm->io, 2);
 
     acpi_gpe_init(&pm->acpi_regs, ICH9_PMIO_GPE0_LEN);
-    memory_region_init_io(&pm->io_gpe, NULL, &ich9_gpe_ops, pm, "apci-gpe0",
-                          ICH9_PMIO_GPE0_LEN);
+    memory_region_init_io(&pm->io_gpe, OBJECT(lpc_pci), &ich9_gpe_ops, pm,
+                          "apci-gpe0", ICH9_PMIO_GPE0_LEN);
     memory_region_add_subregion(&pm->io, ICH9_PMIO_GPE0_STS, &pm->io_gpe);
 
-    memory_region_init_io(&pm->io_smi, NULL, &ich9_smi_ops, pm, "apci-smi",
-                          8);
+    memory_region_init_io(&pm->io_smi, OBJECT(lpc_pci), &ich9_smi_ops, pm,
+                          "apci-smi", 8);
     memory_region_add_subregion(&pm->io, ICH9_PMIO_SMI_EN, &pm->io_smi);
 
     pm->irq = sci_irq;
diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 10fc925..948ea87 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -424,7 +424,7 @@ static int piix4_pm_initfn(PCIDevice *dev)
     memory_region_add_subregion(pci_address_space_io(dev),
                                 s->smb_io_base, &s->smb.io);
 
-    memory_region_init(&s->io, NULL, "piix4-pm", 64);
+    memory_region_init(&s->io, OBJECT(s), "piix4-pm", 64);
     memory_region_set_enabled(&s->io, false);
     memory_region_add_subregion(pci_address_space_io(dev),
                                 0, &s->io);
@@ -671,19 +671,19 @@ static int piix4_device_hotplug(DeviceState *qdev, PCIDevice *dev,
 static void piix4_acpi_system_hot_add_init(MemoryRegion *parent,
                                            PCIBus *bus, PIIX4PMState *s)
 {
-    memory_region_init_io(&s->io_gpe, NULL, &piix4_gpe_ops, s, "apci-gpe0",
-                          GPE_LEN);
+    memory_region_init_io(&s->io_gpe, OBJECT(s), &piix4_gpe_ops, s,
+                          "acpi-gpe0", GPE_LEN);
     memory_region_add_subregion(parent, GPE_BASE, &s->io_gpe);
 
-    memory_region_init_io(&s->io_pci, NULL, &piix4_pci_ops, s, "apci-pci-hotplug",
-                          PCI_HOTPLUG_SIZE);
+    memory_region_init_io(&s->io_pci, OBJECT(s), &piix4_pci_ops, s,
+                          "acpi-pci-hotplug", PCI_HOTPLUG_SIZE);
     memory_region_add_subregion(parent, PCI_HOTPLUG_ADDR,
                                 &s->io_pci);
     pci_bus_hotplug(bus, piix4_device_hotplug, &s->dev.qdev);
 
     qemu_for_each_cpu(piix4_init_cpu_status, &s->gpe_cpu);
-    memory_region_init_io(&s->io_cpu, NULL, &cpu_hotplug_ops, s, "apci-cpu-hotplug",
-                          PIIX4_PROC_LEN);
+    memory_region_init_io(&s->io_cpu, OBJECT(s), &cpu_hotplug_ops, s,
+                          "acpi-cpu-hotplug", PIIX4_PROC_LEN);
     memory_region_add_subregion(parent, PIIX4_PROC_BASE, &s->io_cpu);
     s->cpu_added_notifier.notify = piix4_cpu_added_req;
     qemu_register_cpu_added_notifier(&s->cpu_added_notifier);
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 99427e8..63cc2cb 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -741,7 +741,7 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
 
     /* Main memory region, 0x00.0000.0000.  Real hardware supports 32GB,
        but the address space hole reserved at this point is 8TB.  */
-    memory_region_init_ram(&s->ram_region, NULL, "ram", ram_size);
+    memory_region_init_ram(&s->ram_region, OBJECT(s), "ram", ram_size);
     vmstate_register_ram_global(&s->ram_region);
     memory_region_add_subregion(addr_space, 0, &s->ram_region);
 
@@ -750,22 +750,25 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
        the flash ROM.  I'm not sure that we need to implement it at all.  */
 
     /* Pchip0 CSRs, 0x801.8000.0000, 256MB.  */
-    memory_region_init_io(&s->pchip.region, NULL, &pchip_ops, s, "pchip0", 256*MB);
+    memory_region_init_io(&s->pchip.region, OBJECT(s), &pchip_ops, s, "pchip0",
+                          256*MB);
     memory_region_add_subregion(addr_space, 0x80180000000ULL,
                                 &s->pchip.region);
 
     /* Cchip CSRs, 0x801.A000.0000, 256MB.  */
-    memory_region_init_io(&s->cchip.region, NULL, &cchip_ops, s, "cchip0", 256*MB);
+    memory_region_init_io(&s->cchip.region, OBJECT(s), &cchip_ops, s, "cchip0",
+                          256*MB);
     memory_region_add_subregion(addr_space, 0x801a0000000ULL,
                                 &s->cchip.region);
 
     /* Dchip CSRs, 0x801.B000.0000, 256MB.  */
-    memory_region_init_io(&s->dchip_region, NULL, &dchip_ops, s, "dchip0", 256*MB);
+    memory_region_init_io(&s->dchip_region, OBJECT(s), &dchip_ops, s, "dchip0",
+                          256*MB);
     memory_region_add_subregion(addr_space, 0x801b0000000ULL,
                                 &s->dchip_region);
 
     /* Pchip0 PCI memory, 0x800.0000.0000, 4GB.  */
-    memory_region_init(&s->pchip.reg_mem, NULL, "pci0-mem", 4*GB);
+    memory_region_init(&s->pchip.reg_mem, OBJECT(s), "pci0-mem", 4*GB);
     memory_region_add_subregion(addr_space, 0x80000000000ULL,
                                 &s->pchip.reg_mem);
 
@@ -773,8 +776,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
     /* ??? Ideally we drop the "system" i/o space on the floor and give the
        PCI subsystem the full address space reserved by the chipset.
        We can't do that until the MEM and IO paths in memory.c are unified.  */
-    memory_region_init_io(&s->pchip.reg_io, NULL, &alpha_pci_bw_io_ops, NULL,
-                          "pci0-io", 32*MB);
+    memory_region_init_io(&s->pchip.reg_io, OBJECT(s), &alpha_pci_bw_io_ops,
+                          NULL, "pci0-io", 32*MB);
     memory_region_add_subregion(addr_space, 0x801fc000000ULL,
                                 &s->pchip.reg_io);
 
@@ -784,13 +787,13 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
     phb->bus = b;
 
     /* Pchip0 PCI special/interrupt acknowledge, 0x801.F800.0000, 64MB.  */
-    memory_region_init_io(&s->pchip.reg_iack, NULL, &alpha_pci_iack_ops, b,
+    memory_region_init_io(&s->pchip.reg_iack, OBJECT(s), &alpha_pci_iack_ops, b,
                           "pci0-iack", 64*MB);
     memory_region_add_subregion(addr_space, 0x801f8000000ULL,
                                 &s->pchip.reg_iack);
 
     /* Pchip0 PCI configuration, 0x801.FE00.0000, 16MB.  */
-    memory_region_init_io(&s->pchip.reg_conf, NULL, &alpha_pci_conf1_ops, b,
+    memory_region_init_io(&s->pchip.reg_conf, OBJECT(s), &alpha_pci_conf1_ops, b,
                           "pci0-conf", 16*MB);
     memory_region_add_subregion(addr_space, 0x801fe000000ULL,
                                 &s->pchip.reg_conf);
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 4b82bba..5b22e84 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -124,8 +124,8 @@ static int bitband_init(SysBusDevice *dev)
 {
     BitBandState *s = FROM_SYSBUS(BitBandState, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &bitband_ops, &s->base, "bitband",
-                          0x02000000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &bitband_ops, &s->base,
+                          "bitband", 0x02000000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index c02afce..de6c98a 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -149,8 +149,8 @@ static int highbank_regs_init(SysBusDevice *dev)
     HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, dev);
 
     s->iomem = g_new(MemoryRegion, 1);
-    memory_region_init_io(s->iomem, NULL, &hb_mem_ops, s->regs, "highbank_regs",
-                          0x1000);
+    memory_region_init_io(s->iomem, OBJECT(s), &hb_mem_ops, s->regs,
+                          "highbank_regs", 0x1000);
     sysbus_init_mmio(dev, s->iomem);
 
     return 0;
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index 436d89b..249a430 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -249,10 +249,10 @@ static int integratorcm_init(SysBusDevice *dev)
     }
     memcpy(integrator_spd + 73, "QEMU-MEMORY", 11);
     s->cm_init = 0x00000112;
-    memory_region_init_ram(&s->flash, NULL, "integrator.flash", 0x100000);
+    memory_region_init_ram(&s->flash, OBJECT(s), "integrator.flash", 0x100000);
     vmstate_register_ram_global(&s->flash);
 
-    memory_region_init_io(&s->iomem, NULL, &integratorcm_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &integratorcm_ops, s,
                           "integratorcm", 0x00800000);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -374,7 +374,8 @@ static int icp_pic_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, icp_pic_set_irq, 32);
     sysbus_init_irq(dev, &s->parent_irq);
     sysbus_init_irq(dev, &s->parent_fiq);
-    memory_region_init_io(&s->iomem, NULL, &icp_pic_ops, s, "icp-pic", 0x00800000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &icp_pic_ops, s,
+                          "icp-pic", 0x00800000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index bca8fdf..b06d442 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -389,8 +389,8 @@ static int mv88w8618_eth_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     s->nic = qemu_new_nic(&net_mv88w8618_info, &s->conf,
                           object_get_typename(OBJECT(dev)), dev->qdev.id, s);
-    memory_region_init_io(&s->iomem, NULL, &mv88w8618_eth_ops, s, "mv88w8618-eth",
-                          MP_ETH_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_eth_ops, s,
+                          "mv88w8618-eth", MP_ETH_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
@@ -612,7 +612,7 @@ static int musicpal_lcd_init(SysBusDevice *dev)
 
     s->brightness = 7;
 
-    memory_region_init_io(&s->iomem, NULL, &musicpal_lcd_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_lcd_ops, s,
                           "musicpal-lcd", MP_LCD_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -740,7 +740,7 @@ static int mv88w8618_pic_init(SysBusDevice *dev)
 
     qdev_init_gpio_in(&dev->qdev, mv88w8618_pic_set_irq, 32);
     sysbus_init_irq(dev, &s->parent_irq);
-    memory_region_init_io(&s->iomem, NULL, &mv88w8618_pic_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_pic_ops, s,
                           "musicpal-pic", MP_PIC_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -905,7 +905,7 @@ static int mv88w8618_pit_init(SysBusDevice *dev)
         mv88w8618_timer_init(dev, &s->timer[i], 1000000);
     }
 
-    memory_region_init_io(&s->iomem, NULL, &mv88w8618_pit_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_pit_ops, s,
                           "musicpal-pit", MP_PIT_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -999,7 +999,7 @@ static int mv88w8618_flashcfg_init(SysBusDevice *dev)
     mv88w8618_flashcfg_state *s = FROM_SYSBUS(mv88w8618_flashcfg_state, dev);
 
     s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
-    memory_region_init_io(&s->iomem, NULL, &mv88w8618_flashcfg_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_flashcfg_ops, s,
                           "musicpal-flashcfg", MP_FLASHCFG_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -1074,7 +1074,7 @@ static void musicpal_misc_init(Object *obj)
     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
     MusicPalMiscState *s = MUSICPAL_MISC(obj);
 
-    memory_region_init_io(&s->iomem, NULL, &musicpal_misc_ops, NULL,
+    memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_misc_ops, NULL,
                           "musicpal-misc", MP_MISC_SIZE);
     sysbus_init_mmio(sd, &s->iomem);
 }
@@ -1121,7 +1121,7 @@ static int mv88w8618_wlan_init(SysBusDevice *dev)
 {
     MemoryRegion *iomem = g_new(MemoryRegion, 1);
 
-    memory_region_init_io(iomem, NULL, &mv88w8618_wlan_ops, NULL,
+    memory_region_init_io(iomem, OBJECT(dev), &mv88w8618_wlan_ops, NULL,
                           "musicpal-wlan", MP_WLAN_SIZE);
     sysbus_init_mmio(dev, iomem);
     return 0;
@@ -1327,7 +1327,7 @@ static int musicpal_gpio_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, NULL, &musicpal_gpio_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_gpio_ops, s,
                           "musicpal-gpio", MP_GPIO_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -1484,7 +1484,7 @@ static int musicpal_key_init(SysBusDevice *dev)
 {
     musicpal_key_state *s = FROM_SYSBUS(musicpal_key_state, dev);
 
-    memory_region_init(&s->iomem, NULL, "dummy", 0);
+    memory_region_init(&s->iomem, OBJECT(s), "dummy", 0);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->kbd_extended = 0;
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index d046edc..5a22654 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -764,7 +764,8 @@ static int pxa2xx_ssp_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, NULL, &pxa2xx_ssp_ops, s, "pxa2xx-ssp", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_ssp_ops, s,
+                          "pxa2xx-ssp", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     register_savevm(&dev->qdev, "pxa2xx_ssp", -1, 0,
                     pxa2xx_ssp_save, pxa2xx_ssp_load, s);
@@ -1131,7 +1132,8 @@ static int pxa2xx_rtc_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->rtc_irq);
 
-    memory_region_init_io(&s->iomem, NULL, &pxa2xx_rtc_ops, s, "pxa2xx-rtc", 0x10000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_rtc_ops, s,
+                          "pxa2xx-rtc", 0x10000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
@@ -1481,8 +1483,8 @@ static int pxa2xx_i2c_initfn(SysBusDevice *dev)
 
     s->bus = i2c_init_bus(&dev->qdev, "i2c");
 
-    memory_region_init_io(&s->iomem, NULL, &pxa2xx_i2c_ops, s,
-                          "pxa2xx-i2x", s->region_size);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_i2c_ops, s,
+                          "pxa2xx-i2c", s->region_size);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/arm/pxa2xx_gpio.c b/hw/arm/pxa2xx_gpio.c
index abf41dc..f8c3ee0 100644
--- a/hw/arm/pxa2xx_gpio.c
+++ b/hw/arm/pxa2xx_gpio.c
@@ -283,7 +283,7 @@ static int pxa2xx_gpio_initfn(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, pxa2xx_gpio_set, s->lines);
     qdev_init_gpio_out(&dev->qdev, s->handler, s->lines);
 
-    memory_region_init_io(&s->iomem, NULL, &pxa_gpio_ops, s, "pxa2xx-gpio", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pxa_gpio_ops, s, "pxa2xx-gpio", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq0);
     sysbus_init_irq(dev, &s->irq1);
diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
index 042d422..8929b6d 100644
--- a/hw/arm/pxa2xx_pic.c
+++ b/hw/arm/pxa2xx_pic.c
@@ -278,7 +278,7 @@ DeviceState *pxa2xx_pic_init(hwaddr base, ARMCPU *cpu)
     qdev_init_gpio_in(dev, pxa2xx_pic_set_irq, PXA2XX_PIC_SRCS);
 
     /* Enable IC memory-mapped registers access.  */
-    memory_region_init_io(&s->iomem, NULL, &pxa2xx_pic_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_pic_ops, s,
                           "pxa2xx-pic", 0x00100000);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index 60ad30d..593b75e 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -169,7 +169,7 @@ static int sl_nand_init(SysBusDevice *dev) {
     nand = drive_get(IF_MTD, 0, 0);
     s->nand = nand_init(nand ? nand->bdrv : NULL, s->manf_id, s->chip_id);
 
-    memory_region_init_io(&s->iomem, NULL, &sl_ops, s, "sl", 0x40);
+    memory_region_init_io(&s->iomem, OBJECT(s), &sl_ops, s, "sl", 0x40);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 30e7b76..a2b6b17 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -307,7 +307,7 @@ static int stellaris_gptm_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     qdev_init_gpio_out(&dev->qdev, &s->trigger, 1);
 
-    memory_region_init_io(&s->iomem, NULL, &gptm_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &gptm_ops, s,
                           "gptm", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -862,7 +862,7 @@ static int stellaris_i2c_init(SysBusDevice * dev)
     bus = i2c_init_bus(&dev->qdev, "i2c");
     s->bus = bus;
 
-    memory_region_init_io(&s->iomem, NULL, &stellaris_i2c_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_i2c_ops, s,
                           "i2c", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     /* ??? For now we only implement the master interface.  */
@@ -1145,7 +1145,7 @@ static int stellaris_adc_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->irq[n]);
     }
 
-    memory_region_init_io(&s->iomem, NULL, &stellaris_adc_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_adc_ops, s,
                           "adc", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     stellaris_adc_reset(s);
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 0f5a545..feaaf45 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -173,7 +173,8 @@ static int strongarm_pic_initfn(SysBusDevice *dev)
     StrongARMPICState *s = FROM_SYSBUS(StrongARMPICState, dev);
 
     qdev_init_gpio_in(&dev->qdev, strongarm_pic_set_irq, SA_PIC_SRCS);
-    memory_region_init_io(&s->iomem, NULL, &strongarm_pic_ops, s, "pic", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_pic_ops, s,
+                          "pic", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     sysbus_init_irq(dev, &s->fiq);
@@ -383,7 +384,8 @@ static int strongarm_rtc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->rtc_irq);
     sysbus_init_irq(dev, &s->rtc_hz_irq);
 
-    memory_region_init_io(&s->iomem, NULL, &strongarm_rtc_ops, s, "rtc", 0x10000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_rtc_ops, s,
+                          "rtc", 0x10000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
@@ -637,7 +639,8 @@ static int strongarm_gpio_initfn(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, strongarm_gpio_set, 28);
     qdev_init_gpio_out(&dev->qdev, s->handler, 28);
 
-    memory_region_init_io(&s->iomem, NULL, &strongarm_gpio_ops, s, "gpio", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_gpio_ops, s,
+                          "gpio", 0x1000);
 
     sysbus_init_mmio(dev, &s->iomem);
     for (i = 0; i < 11; i++) {
@@ -808,7 +811,8 @@ static int strongarm_ppc_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, strongarm_ppc_set, 22);
     qdev_init_gpio_out(&dev->qdev, s->handler, 22);
 
-    memory_region_init_io(&s->iomem, NULL, &strongarm_ppc_ops, s, "ppc", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ppc_ops, s,
+                          "ppc", 0x1000);
 
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -1204,7 +1208,8 @@ static int strongarm_uart_init(SysBusDevice *dev)
 {
     StrongARMUARTState *s = FROM_SYSBUS(StrongARMUARTState, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &strongarm_uart_ops, s, "uart", 0x10000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_uart_ops, s,
+                          "uart", 0x10000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
@@ -1496,7 +1501,8 @@ static int strongarm_ssp_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, NULL, &strongarm_ssp_ops, s, "ssp", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ssp_ops, s,
+                          "ssp", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->bus = ssi_create_bus(&dev->qdev, "ssi");
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index cc06165..08878b9 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -154,7 +154,8 @@ static int vpb_sic_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->parent[i]);
     }
     s->irq = 31;
-    memory_region_init_io(&s->iomem, NULL, &vpb_sic_ops, s, "vpb-sic", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &vpb_sic_ops, s,
+                          "vpb-sic", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 47e6f19..365b2f1 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1378,8 +1378,10 @@ static int ac97_initfn (PCIDevice *dev)
     c[PCI_INTERRUPT_LINE] = 0x00;      /* intr_ln interrupt line rw */
     c[PCI_INTERRUPT_PIN] = 0x01;      /* intr_pn interrupt pin ro */
 
-    memory_region_init_io (&s->io_nam, NULL, &ac97_io_nam_ops, s, "ac97-nam", 1024);
-    memory_region_init_io (&s->io_nabm, NULL, &ac97_io_nabm_ops, s, "ac97-nabm", 256);
+    memory_region_init_io (&s->io_nam, OBJECT(s), &ac97_io_nam_ops, s,
+                           "ac97-nam", 1024);
+    memory_region_init_io (&s->io_nabm, OBJECT(s), &ac97_io_nabm_ops, s,
+                           "ac97-nabm", 256);
     pci_register_bar (&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_nam);
     pci_register_bar (&s->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &s->io_nabm);
     qemu_register_reset (ac97_on_reset, s);
diff --git a/hw/audio/cs4231.c b/hw/audio/cs4231.c
index fb9b700..fabe9e6 100644
--- a/hw/audio/cs4231.c
+++ b/hw/audio/cs4231.c
@@ -144,7 +144,8 @@ static int cs4231_init1(SysBusDevice *dev)
 {
     CSState *s = FROM_SYSBUS(CSState, dev);
 
-    memory_region_init_io(&s->iomem, NULL, &cs_mem_ops, s, "cs4321", CS_SIZE);
+    memory_region_init_io(&s->iomem, OBJECT(s), &cs_mem_ops, s, "cs4321",
+                          CS_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index c31da2e..7365c3c 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -648,7 +648,8 @@ static void cs4231a_initfn (Object *obj)
 {
     CSState *s = CS4231A (obj);
 
-    memory_region_init_io (&s->ioports, NULL, &cs_ioport_ops, s, "cs4231a", 4);
+    memory_region_init_io (&s->ioports, OBJECT(s), &cs_ioport_ops, s,
+                           "cs4231a", 4);
 }
 
 static void cs4231a_realizefn (DeviceState *dev, Error **errp)
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index b953df2..f2c40da 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -1035,7 +1035,7 @@ static int es1370_initfn (PCIDevice *dev)
     c[PCI_MIN_GNT] = 0x0c;
     c[PCI_MAX_LAT] = 0x80;
 
-    memory_region_init_io (&s->io, NULL, &es1370_io_ops, s, "es1370", 256);
+    memory_region_init_io (&s->io, OBJECT(s), &es1370_io_ops, s, "es1370", 256);
     pci_register_bar (&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
     qemu_register_reset (es1370_on_reset, s);
 
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index e94602f..58984dc 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1135,7 +1135,7 @@ static int intel_hda_init(PCIDevice *pci)
     /* HDCTL off 0x40 bit 0 selects signaling mode (1-HDA, 0 - Ac97) 18.1.19 */
     conf[0x40] = 0x01;
 
-    memory_region_init_io(&d->mmio, NULL, &intel_hda_mmio_ops, d,
+    memory_region_init_io(&d->mmio, OBJECT(d), &intel_hda_mmio_ops, d,
                           "intel-hda", 0x4000);
     pci_register_bar(&d->pci, 0, 0, &d->mmio);
     if (d->msi) {
diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index e04e932..b40ea43 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -244,7 +244,7 @@ static int mv88w8618_audio_init(SysBusDevice *dev)
 
     wm8750_data_req_set(s->wm, mv88w8618_audio_callback, s);
 
-    memory_region_init_io(&s->iomem, NULL, &mv88w8618_audio_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_audio_ops, s,
                           "audio", MP_AUDIO_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/audio/milkymist-ac97.c b/hw/audio/milkymist-ac97.c
index 79a00fd..133de4e 100644
--- a/hw/audio/milkymist-ac97.c
+++ b/hw/audio/milkymist-ac97.c
@@ -300,7 +300,7 @@ static int milkymist_ac97_init(SysBusDevice *dev)
     s->voice_out = AUD_open_out(&s->card, s->voice_out,
             "mm_ac97.out", s, ac97_out_cb, &as);
 
-    memory_region_init_io(&s->regs_region, NULL, &ac97_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, OBJECT(s), &ac97_mmio_ops, s,
             "milkymist-ac97", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 123793b..7ad59a1 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -167,7 +167,7 @@ static void pcspk_initfn(Object *obj)
 {
     PCSpkState *s = PC_SPEAKER(obj);
 
-    memory_region_init_io(&s->ioport, NULL, &pcspk_io_ops, s, "elcr", 1);
+    memory_region_init_io(&s->ioport, OBJECT(s), &pcspk_io_ops, s, "elcr", 1);
 }
 
 static void pcspk_realizefn(DeviceState *dev, Error **errp)
diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index 5dd18c7..7d331b9 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -543,7 +543,7 @@ static int pl041_init(SysBusDevice *dev)
     }
 
     /* Connect the device to the sysbus */
-    memory_region_init_io(&s->iomem, NULL, &pl041_ops, s, "pl041", 0x1000);
+    memory_region_init_io(&s->iomem, OBJECT(s), &pl041_ops, s, "pl041", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
commit db10ca9057b11222408f708d5d99a3888eca4feb
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:19:53 2013 -0400

    piolist: add owner argument to initialization functions and pass devices
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 8b9b81e..f72e6ee 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -349,7 +349,7 @@ static void adlib_realizefn (DeviceState *dev, Error **errp)
 
     adlib_portio_list[1].offset = s->port;
     adlib_portio_list[2].offset = s->port + 8;
-    portio_list_init (port_list, adlib_portio_list, s, "adlib");
+    portio_list_init (port_list, OBJECT(s), adlib_portio_list, s, "adlib");
     portio_list_add (port_list, isa_address_space_io(&s->parent_obj), 0);
 }
 
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 59925ec..3804fe2 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2070,7 +2070,8 @@ static int qxl_init_primary(PCIDevice *dev)
     vga_common_init(vga, OBJECT(dev));
     vga_init(vga, OBJECT(dev),
              pci_address_space(dev), pci_address_space_io(dev), false);
-    portio_list_init(qxl_vga_port_list, qxl_vga_portio_list, vga, "vga");
+    portio_list_init(qxl_vga_port_list, OBJECT(dev), qxl_vga_portio_list,
+                     vga, "vga");
     portio_list_add(qxl_vga_port_list, pci_address_space_io(dev), 0x3b0);
 
     vga->con = graphic_console_init(DEVICE(dev), &qxl_ops, qxl);
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 1657356..06f44a8 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2372,11 +2372,11 @@ void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
                                         1);
     memory_region_set_coalescing(vga_io_memory);
     if (init_vga_ports) {
-        portio_list_init(vga_port_list, vga_ports, s, "vga");
+        portio_list_init(vga_port_list, obj, vga_ports, s, "vga");
         portio_list_add(vga_port_list, address_space_io, 0x3b0);
     }
     if (vbe_ports) {
-        portio_list_init(vbe_port_list, vbe_ports, s, "vbe");
+        portio_list_init(vbe_port_list, obj, vbe_ports, s, "vbe");
         portio_list_add(vbe_port_list, address_space_io, 0x1ce);
     }
 }
diff --git a/hw/dma/i82374.c b/hw/dma/i82374.c
index ecda5cb..a5b891f 100644
--- a/hw/dma/i82374.c
+++ b/hw/dma/i82374.c
@@ -139,7 +139,7 @@ static void i82374_isa_realize(DeviceState *dev, Error **errp)
     I82374State *s = &isa->state;
     PortioList *port_list = g_new(PortioList, 1);
 
-    portio_list_init(port_list, i82374_portio_list, s, "i82374");
+    portio_list_init(port_list, OBJECT(isa), i82374_portio_list, s, "i82374");
     portio_list_add(port_list, isa_address_space_io(&isa->parent_obj),
                     isa->iobase);
 
diff --git a/hw/isa/isa-bus.c b/hw/isa/isa-bus.c
index 136d17e..cfd610c 100644
--- a/hw/isa/isa-bus.c
+++ b/hw/isa/isa-bus.c
@@ -115,7 +115,7 @@ void isa_register_portio_list(ISADevice *dev, uint16_t start,
        actually handled e.g. the FDC device.  */
     isa_init_ioport(dev, start);
 
-    portio_list_init(piolist, pio_start, opaque, name);
+    portio_list_init(piolist, OBJECT(dev), pio_start, opaque, name);
     portio_list_add(piolist, isabus->address_space_io, start);
 }
 
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 1f63197..19c887d 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -443,7 +443,7 @@ static int vt82c686b_initfn(PCIDevice *d)
        }
     }
 
-    memory_region_init_io(&vt82c->superio, NULL, &superio_ops,
+    memory_region_init_io(&vt82c->superio, OBJECT(d), &superio_ops,
                           &vt82c->superio_conf, "superio", 2);
     memory_region_set_enabled(&vt82c->superio, false);
     /* The floppy also uses 0x3f0 and 0x3f1.
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 899aa30..0081c70 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -653,7 +653,7 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
 
     sysctrl->reset_irq = first_cpu->irq_inputs[PPC6xx_INPUT_HRESET];
 
-    portio_list_init(port_list, prep_portio_list, sysctrl, "prep");
+    portio_list_init(port_list, NULL, prep_portio_list, sysctrl, "prep");
     portio_list_add(port_list, get_system_io(), 0x0);
 
     /* PowerPC control and status register group */
diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index 597a923..c788554 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -112,7 +112,7 @@ static void wdt_ib700_realize(DeviceState *dev, Error **errp)
 
     s->timer = qemu_new_timer_ns(vm_clock, ib700_timer_expired, s);
 
-    portio_list_init(port_list, wdt_portio_list, s, "ib700");
+    portio_list_init(port_list, OBJECT(s), wdt_portio_list, s, "ib700");
     portio_list_add(port_list, isa_address_space_io(&s->parent_obj), 0);
 }
 
diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index 6fb237d..bdd4e96 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -25,6 +25,7 @@
 #define IOPORT_H
 
 #include "qemu-common.h"
+#include "qom/object.h"
 #include "exec/memory.h"
 
 typedef uint32_t pio_addr_t;
@@ -53,6 +54,7 @@ uint32_t cpu_inl(pio_addr_t addr);
 
 typedef struct PortioList {
     const struct MemoryRegionPortio *ports;
+    Object *owner;
     struct MemoryRegion *address_space;
     unsigned nr;
     struct MemoryRegion **regions;
@@ -60,7 +62,7 @@ typedef struct PortioList {
     const char *name;
 } PortioList;
 
-void portio_list_init(PortioList *piolist,
+void portio_list_init(PortioList *piolist, Object *owner,
                       const struct MemoryRegionPortio *callbacks,
                       void *opaque, const char *name);
 void portio_list_destroy(PortioList *piolist);
diff --git a/ioport.c b/ioport.c
index 3a6a73d..79b7f1a 100644
--- a/ioport.c
+++ b/ioport.c
@@ -106,6 +106,7 @@ uint32_t cpu_inl(pio_addr_t addr)
 }
 
 void portio_list_init(PortioList *piolist,
+                      Object *owner,
                       const MemoryRegionPortio *callbacks,
                       void *opaque, const char *name)
 {
@@ -120,6 +121,7 @@ void portio_list_init(PortioList *piolist,
     piolist->regions = g_new0(MemoryRegion *, n);
     piolist->address_space = NULL;
     piolist->opaque = opaque;
+    piolist->owner = owner;
     piolist->name = name;
 }
 
@@ -211,8 +213,8 @@ static void portio_list_add_1(PortioList *piolist,
      * Use an alias so that the callback is called with an absolute address,
      * rather than an offset relative to to start + off_low.
      */
-    memory_region_init_io(&mrpio->mr, NULL, &portio_ops, mrpio, piolist->name,
-                          off_high - off_low);
+    memory_region_init_io(&mrpio->mr, piolist->owner, &portio_ops, mrpio,
+                          piolist->name, off_high - off_low);
     memory_region_add_subregion(piolist->address_space,
                                 start + off_low, &mrpio->mr);
     piolist->regions[piolist->nr] = &mrpio->mr;
commit 3cd2cf4375993494bcf6195c1637a3d009aa6fae
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Jun 25 12:33:01 2013 +0200

    pam: pass device to init_pam and use it to set owner
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/pci-host/pam.c b/hw/pci-host/pam.c
index ec935f4..ec6be46 100644
--- a/hw/pci-host/pam.c
+++ b/hw/pci-host/pam.c
@@ -26,6 +26,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
+
+#include "qom/object.h"
 #include "sysemu/sysemu.h"
 #include "hw/pci-host/pam.h"
 
@@ -49,24 +51,24 @@ void smram_set_smm(uint8_t *host_smm_enabled, int smm, uint8_t smram,
     }
 }
 
-void init_pam(MemoryRegion *ram_memory, MemoryRegion *system_memory,
-              MemoryRegion *pci_address_space, PAMMemoryRegion *mem,
-              uint32_t start, uint32_t size)
+void init_pam(DeviceState *dev, MemoryRegion *ram_memory,
+              MemoryRegion *system_memory, MemoryRegion *pci_address_space,
+              PAMMemoryRegion *mem, uint32_t start, uint32_t size)
 {
     int i;
 
     /* RAM */
-    memory_region_init_alias(&mem->alias[3], NULL, "pam-ram", ram_memory,
+    memory_region_init_alias(&mem->alias[3], OBJECT(dev), "pam-ram", ram_memory,
                              start, size);
     /* ROM (XXX: not quite correct) */
-    memory_region_init_alias(&mem->alias[1], NULL, "pam-rom", ram_memory,
+    memory_region_init_alias(&mem->alias[1], OBJECT(dev), "pam-rom", ram_memory,
                              start, size);
     memory_region_set_readonly(&mem->alias[1], true);
 
     /* XXX: should distinguish read/write cases */
-    memory_region_init_alias(&mem->alias[0], NULL, "pam-pci", pci_address_space,
+    memory_region_init_alias(&mem->alias[0], OBJECT(dev), "pam-pci", pci_address_space,
                              start, size);
-    memory_region_init_alias(&mem->alias[2], NULL, "pam-pci", pci_address_space,
+    memory_region_init_alias(&mem->alias[2], OBJECT(dev), "pam-pci", pci_address_space,
                              start, size);
 
     for (i = 0; i < 4; ++i) {
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 4d77b1e..e179912 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -275,10 +275,10 @@ static PCIBus *i440fx_common_init(const char *device_name,
     memory_region_add_subregion_overlap(f->system_memory, 0xa0000,
                                         &f->smram_region, 1);
     memory_region_set_enabled(&f->smram_region, false);
-    init_pam(f->ram_memory, f->system_memory, f->pci_address_space,
+    init_pam(dev, f->ram_memory, f->system_memory, f->pci_address_space,
              &f->pam_regions[0], PAM_BIOS_BASE, PAM_BIOS_SIZE);
     for (i = 0; i < 12; ++i) {
-        init_pam(f->ram_memory, f->system_memory, f->pci_address_space,
+        init_pam(dev, f->ram_memory, f->system_memory, f->pci_address_space,
                  &f->pam_regions[i+1], PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE,
                  PAM_EXPAN_SIZE);
     }
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 70e7d8b..49ccf80 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -269,10 +269,10 @@ static int mch_init(PCIDevice *d)
     memory_region_add_subregion_overlap(mch->system_memory, 0xa0000,
                                         &mch->smram_region, 1);
     memory_region_set_enabled(&mch->smram_region, false);
-    init_pam(mch->ram_memory, mch->system_memory, mch->pci_address_space,
+    init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory, mch->pci_address_space,
              &mch->pam_regions[0], PAM_BIOS_BASE, PAM_BIOS_SIZE);
     for (i = 0; i < 12; ++i) {
-        init_pam(mch->ram_memory, mch->system_memory, mch->pci_address_space,
+        init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory, mch->pci_address_space,
                  &mch->pam_regions[i+1], PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE,
                  PAM_EXPAN_SIZE);
     }
diff --git a/include/hw/pci-host/pam.h b/include/hw/pci-host/pam.h
index 8e9e349..a8b87b8 100644
--- a/include/hw/pci-host/pam.h
+++ b/include/hw/pci-host/pam.h
@@ -90,8 +90,8 @@ void smram_update(MemoryRegion *smram_region, uint8_t smram,
                   uint8_t smm_enabled);
 void smram_set_smm(uint8_t *host_smm_enabled, int smm, uint8_t smram,
                    MemoryRegion *smram_region);
-void init_pam(MemoryRegion *ram, MemoryRegion *system, MemoryRegion *pci,
-              PAMMemoryRegion *mem, uint32_t start, uint32_t size);
+void init_pam(DeviceState *dev, MemoryRegion *ram, MemoryRegion *system,
+              MemoryRegion *pci, PAMMemoryRegion *mem, uint32_t start, uint32_t size);
 void pam_update(PAMMemoryRegion *mem, int idx, uint8_t val);
 
 #endif /* QEMU_PAM_H */
commit 84af6d9f97bb144bbebe688364431804a190074a
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Jun 25 12:32:25 2013 +0200

    spapr_iommu: pass device to spapr_tce_new_table and use it to set owner
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index 3976af6..89b33a5 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -116,7 +116,7 @@ static MemoryRegionIOMMUOps spapr_iommu_ops = {
     .translate = spapr_tce_translate_iommu,
 };
 
-sPAPRTCETable *spapr_tce_new_table(uint32_t liobn, size_t window_size)
+sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn, size_t window_size)
 {
     sPAPRTCETable *tcet;
 
@@ -151,7 +151,7 @@ sPAPRTCETable *spapr_tce_new_table(uint32_t liobn, size_t window_size)
             "table @ %p, fd=%d\n", tcet, liobn, tcet->table, tcet->fd);
 #endif
 
-    memory_region_init_iommu(&tcet->iommu, NULL, &spapr_iommu_ops,
+    memory_region_init_iommu(&tcet->iommu, OBJECT(owner), &spapr_iommu_ops,
                              "iommu-spapr", UINT64_MAX);
 
     QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 65e05d5..7710aa0 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -646,7 +646,8 @@ static int spapr_phb_init(SysBusDevice *s)
 
     sphb->dma_window_start = 0;
     sphb->dma_window_size = 0x40000000;
-    sphb->tcet = spapr_tce_new_table(sphb->dma_liobn, sphb->dma_window_size);
+    sphb->tcet = spapr_tce_new_table(DEVICE(sphb), sphb->dma_liobn,
+                                     sphb->dma_window_size);
     if (!sphb->tcet) {
         fprintf(stderr, "Unable to create TCE table for %s\n", sphb->dtbusname);
         return -1;
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 9c18741..7c6f6e4 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -455,7 +455,7 @@ static int spapr_vio_busdev_init(DeviceState *qdev)
 
     if (pc->rtce_window_size) {
         uint32_t liobn = SPAPR_VIO_BASE_LIOBN | dev->reg;
-        dev->tcet = spapr_tce_new_table(liobn, pc->rtce_window_size);
+        dev->tcet = spapr_tce_new_table(qdev, liobn, pc->rtce_window_size);
         address_space_init(&dev->as, spapr_tce_get_iommu(dev->tcet), qdev->id);
     }
 
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 09c4570..de95480 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -348,7 +348,8 @@ typedef struct sPAPRTCETable sPAPRTCETable;
 void spapr_iommu_init(void);
 void spapr_events_init(sPAPREnvironment *spapr);
 void spapr_events_fdt_skel(void *fdt, uint32_t epow_irq);
-sPAPRTCETable *spapr_tce_new_table(uint32_t liobn, size_t window_size);
+sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn,
+                                   size_t window_size);
 MemoryRegion *spapr_tce_get_iommu(sPAPRTCETable *tcet);
 void spapr_tce_free(sPAPRTCETable *tcet);
 void spapr_tce_reset(sPAPRTCETable *tcet);
commit 5cb022a1bfaa0c15a13d3266bc6d683cc1f44d7f
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Jun 25 12:31:46 2013 +0200

    vfio: pass device to vfio_mmap_bar and use it to set owner
    
    Cc: Alex Williamson <alex.williamson at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index 675bbfc..58013eb 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -2205,7 +2205,8 @@ static void vfio_unmap_bar(VFIODevice *vdev, int nr)
     memory_region_destroy(&bar->mem);
 }
 
-static int vfio_mmap_bar(VFIOBAR *bar, MemoryRegion *mem, MemoryRegion *submem,
+static int vfio_mmap_bar(VFIODevice *vdev, VFIOBAR *bar,
+                         MemoryRegion *mem, MemoryRegion *submem,
                          void **map, size_t size, off_t offset,
                          const char *name)
 {
@@ -2230,11 +2231,11 @@ static int vfio_mmap_bar(VFIOBAR *bar, MemoryRegion *mem, MemoryRegion *submem,
             goto empty_region;
         }
 
-        memory_region_init_ram_ptr(submem, NULL, name, size, *map);
+        memory_region_init_ram_ptr(submem, OBJECT(vdev), name, size, *map);
     } else {
 empty_region:
         /* Create a zero sized sub-region to make cleanup easy. */
-        memory_region_init(submem, NULL, name, 0);
+        memory_region_init(submem, OBJECT(vdev), name, 0);
     }
 
     memory_region_add_subregion(mem, offset, submem);
@@ -2285,7 +2286,7 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
     }
 
     strncat(name, " mmap", sizeof(name) - strlen(name) - 1);
-    if (vfio_mmap_bar(bar, &bar->mem,
+    if (vfio_mmap_bar(vdev, bar, &bar->mem,
                       &bar->mmap_mem, &bar->mmap, size, 0, name)) {
         error_report("%s unsupported. Performance may be slow", name);
     }
@@ -2299,7 +2300,7 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
         size = start < bar->size ? bar->size - start : 0;
         strncat(name, " msix-hi", sizeof(name) - strlen(name) - 1);
         /* VFIOMSIXInfo contains another MemoryRegion for this mapping */
-        if (vfio_mmap_bar(bar, &bar->mem, &vdev->msix->mmap_mem,
+        if (vfio_mmap_bar(vdev, bar, &bar->mem, &vdev->msix->mmap_mem,
                           &vdev->msix->mmap, size, start, name)) {
             error_report("%s unsupported. Performance may be slow", name);
         }
commit dcb117bfda5af6f6ceb7231778d36d8bce4aee93
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Jun 25 15:04:35 2013 +0200

    ne2000: pass device to ne2000_setup_io, use it as owner
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/net/ne2000-isa.c b/hw/net/ne2000-isa.c
index 9232abd..e3c8076 100644
--- a/hw/net/ne2000-isa.c
+++ b/hw/net/ne2000-isa.c
@@ -72,7 +72,7 @@ static void isa_ne2000_realizefn(DeviceState *dev, Error **errp)
     ISANE2000State *isa = ISA_NE2000(dev);
     NE2000State *s = &isa->ne2000;
 
-    ne2000_setup_io(s, 0x20);
+    ne2000_setup_io(s, DEVICE(isadev), 0x20);
     isa_register_ioport(isadev, &s->io, isa->iobase);
 
     isa_init_irq(isadev, &s->irq, isa->isairq);
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 00940af..8d43fd9 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -699,9 +699,9 @@ static const MemoryRegionOps ne2000_ops = {
 /***********************************************************/
 /* PCI NE2000 definitions */
 
-void ne2000_setup_io(NE2000State *s, unsigned size)
+void ne2000_setup_io(NE2000State *s, DeviceState *dev, unsigned size)
 {
-    memory_region_init_io(&s->io, NULL, &ne2000_ops, s, "ne2000", size);
+    memory_region_init_io(&s->io, OBJECT(dev), &ne2000_ops, s, "ne2000", size);
 }
 
 static void ne2000_cleanup(NetClientState *nc)
@@ -729,7 +729,7 @@ static int pci_ne2000_init(PCIDevice *pci_dev)
     pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
 
     s = &d->ne2000;
-    ne2000_setup_io(s, 0x100);
+    ne2000_setup_io(s, DEVICE(pci_dev), 0x100);
     pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
     s->irq = d->dev.irq[0];
 
diff --git a/hw/net/ne2000.h b/hw/net/ne2000.h
index b31ae03..e500306 100644
--- a/hw/net/ne2000.h
+++ b/hw/net/ne2000.h
@@ -31,7 +31,7 @@ typedef struct NE2000State {
     uint8_t mem[NE2000_MEM_SIZE];
 } NE2000State;
 
-void ne2000_setup_io(NE2000State *s, unsigned size);
+void ne2000_setup_io(NE2000State *s, DeviceState *dev, unsigned size);
 extern const VMStateDescription vmstate_ne2000;
 void ne2000_reset(NE2000State *s);
 int ne2000_can_receive(NetClientState *nc);
commit 42e038fe918f4eecdd84ef9ee406bba1deb15cec
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:21:13 2013 -0400

    vga: set owner in vga_update_memory_access
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/vga.c b/hw/display/vga.c
index 7a6e935..1657356 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -198,7 +198,8 @@ static void vga_update_memory_access(VGACommonState *s)
         }
         base += isa_mem_base;
         region = g_malloc(sizeof(*region));
-        memory_region_init_alias(region, NULL, "vga.chain4", &s->vram, offset, size);
+        memory_region_init_alias(region, memory_region_owner(&s->vram),
+                                 "vga.chain4", &s->vram, offset, size);
         memory_region_add_subregion_overlap(s->legacy_address_space, base,
                                             region, 2);
         s->chain4_alias = region;
commit c84b28eeea1ab3f90e619b6af63e7db770c579ec
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:21:13 2013 -0400

    vga: pass owner to vga_init_io
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index 5f253a9..8d560ec 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -58,7 +58,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
 
     vga_common_init(s, OBJECT(dev));
     s->legacy_address_space = isa_address_space(isadev);
-    vga_io_memory = vga_init_io(s, &vga_ports, &vbe_ports);
+    vga_io_memory = vga_init_io(s, OBJECT(dev), &vga_ports, &vbe_ports);
     isa_register_portio_list(isadev, 0x3b0, vga_ports, s, "vga");
     if (vbe_ports) {
         isa_register_portio_list(isadev, 0x1ce, vbe_ports, s, "vbe");
diff --git a/hw/display/vga.c b/hw/display/vga.c
index ce3ca7e..7a6e935 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2333,7 +2333,7 @@ static const MemoryRegionPortio vbe_portio_list[] = {
 };
 
 /* Used by both ISA and PCI */
-MemoryRegion *vga_init_io(VGACommonState *s,
+MemoryRegion *vga_init_io(VGACommonState *s, Object *obj,
                           const MemoryRegionPortio **vga_ports,
                           const MemoryRegionPortio **vbe_ports)
 {
@@ -2343,7 +2343,7 @@ MemoryRegion *vga_init_io(VGACommonState *s,
     *vbe_ports = vbe_portio_list;
 
     vga_mem = g_malloc(sizeof(*vga_mem));
-    memory_region_init_io(vga_mem, NULL, &vga_mem_ops, s,
+    memory_region_init_io(vga_mem, obj, &vga_mem_ops, s,
                           "vga-lowmem", 0x20000);
     memory_region_set_flush_coalesced(vga_mem);
 
@@ -2364,7 +2364,7 @@ void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
 
     s->legacy_address_space = address_space;
 
-    vga_io_memory = vga_init_io(s, &vga_ports, &vbe_ports);
+    vga_io_memory = vga_init_io(s, obj, &vga_ports, &vbe_ports);
     memory_region_add_subregion_overlap(address_space,
                                         isa_mem_base + 0x000a0000,
                                         vga_io_memory,
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index 5121a35..e641890 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -180,7 +180,7 @@ static inline int c6_to_8(int v)
 void vga_common_init(VGACommonState *s, Object *obj);
 void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
               MemoryRegion *address_space_io, bool init_vga_ports);
-MemoryRegion *vga_init_io(VGACommonState *s,
+MemoryRegion *vga_init_io(VGACommonState *s, Object *obj,
                           const MemoryRegionPortio **vga_ports,
                           const MemoryRegionPortio **vbe_ports);
 void vga_common_reset(VGACommonState *s);
commit 831183277318395ecd02f2fe2423f5fe983ed96a
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:21:13 2013 -0400

    vga: pass owner to vga_init_vbe
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/vga-isa-mm.c b/hw/display/vga-isa-mm.c
index 695c128..8b514cc 100644
--- a/hw/display/vga-isa-mm.c
+++ b/hw/display/vga-isa-mm.c
@@ -137,6 +137,6 @@ int isa_vga_mm_init(hwaddr vram_base,
 
     s->vga.con = graphic_console_init(NULL, s->vga.hw_ops, s);
 
-    vga_init_vbe(&s->vga, address_space);
+    vga_init_vbe(&s->vga, NULL, address_space);
     return 0;
 }
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index fbf6db5..5f253a9 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -69,7 +69,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
     memory_region_set_coalescing(vga_io_memory);
     s->con = graphic_console_init(DEVICE(dev), s->hw_ops, s);
 
-    vga_init_vbe(s, isa_address_space(isadev));
+    vga_init_vbe(s, OBJECT(dev), isa_address_space(isadev));
     /* ROM BIOS */
     rom_add_vga(VGABIOS_FILENAME);
 }
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 62652bd..3e150ab 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -173,7 +173,7 @@ static int pci_std_vga_initfn(PCIDevice *dev)
 
     if (!dev->rom_bar) {
         /* compatibility with pc-0.13 and older */
-        vga_init_vbe(s, pci_address_space(dev));
+        vga_init_vbe(s, OBJECT(dev), pci_address_space(dev));
     }
 
     return 0;
diff --git a/hw/display/vga.c b/hw/display/vga.c
index d3e0f33..ce3ca7e 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2380,12 +2380,12 @@ void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
     }
 }
 
-void vga_init_vbe(VGACommonState *s, MemoryRegion *system_memory)
+void vga_init_vbe(VGACommonState *s, Object *obj, MemoryRegion *system_memory)
 {
     /* With pc-0.12 and below we map both the PCI BAR and the fixed VBE region,
      * so use an alias to avoid double-mapping the same region.
      */
-    memory_region_init_alias(&s->vram_vbe, NULL, "vram.vbe",
+    memory_region_init_alias(&s->vram_vbe, obj, "vram.vbe",
                              &s->vram, 0, memory_region_size(&s->vram));
     /* XXX: use optimized standard vga accesses */
     memory_region_add_subregion(system_memory,
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index bac366c..5121a35 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -198,7 +198,7 @@ void vga_invalidate_scanlines(VGACommonState *s, int y1, int y2);
 
 int vga_ioport_invalid(VGACommonState *s, uint32_t addr);
 
-void vga_init_vbe(VGACommonState *s, MemoryRegion *address_space);
+void vga_init_vbe(VGACommonState *s, Object *obj, MemoryRegion *address_space);
 uint32_t vbe_ioport_read_data(void *opaque, uint32_t addr);
 void vbe_ioport_write_index(void *opaque, uint32_t addr, uint32_t val);
 void vbe_ioport_write_data(void *opaque, uint32_t addr, uint32_t val);
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index ce97870..714908f 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1272,7 +1272,7 @@ static int pci_vmsvga_initfn(PCIDevice *dev)
 
     if (!dev->rom_bar) {
         /* compatibility with pc-0.13 and older */
-        vga_init_vbe(&s->chip.vga, pci_address_space(dev));
+        vga_init_vbe(&s->chip.vga, OBJECT(dev), pci_address_space(dev));
     }
 
     return 0;
commit 9eb58a473b615d9d6d26ee8e568eeb2e67d8e274
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:21:13 2013 -0400

    vga: pass owner to cirrus_init_common
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 80510ac..3d579e2 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2805,7 +2805,8 @@ static const MemoryRegionOps cirrus_vga_io_ops = {
     },
 };
 
-static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
+static void cirrus_init_common(CirrusVGAState *s, Object *owner,
+                               int device_id, int is_pci,
                                MemoryRegion *system_memory,
                                MemoryRegion *system_io)
 {
@@ -2840,21 +2841,22 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
     }
 
     /* Register ioport 0x3b0 - 0x3df */
-    memory_region_init_io(&s->cirrus_vga_io, NULL, &cirrus_vga_io_ops, s,
+    memory_region_init_io(&s->cirrus_vga_io, owner, &cirrus_vga_io_ops, s,
                           "cirrus-io", 0x30);
     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
 
-    memory_region_init(&s->low_mem_container, NULL,
+    memory_region_init(&s->low_mem_container, owner,
                        "cirrus-lowmem-container",
                        0x20000);
 
-    memory_region_init_io(&s->low_mem, NULL, &cirrus_vga_mem_ops, s,
+    memory_region_init_io(&s->low_mem, owner, &cirrus_vga_mem_ops, s,
                           "cirrus-low-memory", 0x20000);
     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
     for (i = 0; i < 2; ++i) {
         static const char *names[] = { "vga.bank0", "vga.bank1" };
         MemoryRegion *bank = &s->cirrus_bank[i];
-        memory_region_init_alias(bank, NULL, names[i], &s->vga.vram, 0, 0x8000);
+        memory_region_init_alias(bank, owner, names[i], &s->vga.vram,
+                                 0, 0x8000);
         memory_region_set_enabled(bank, false);
         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
                                             bank, 1);
@@ -2866,13 +2868,13 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
     memory_region_set_coalescing(&s->low_mem);
 
     /* I/O handler for LFB */
-    memory_region_init_io(&s->cirrus_linear_io, NULL, &cirrus_linear_io_ops, s,
+    memory_region_init_io(&s->cirrus_linear_io, owner, &cirrus_linear_io_ops, s,
                           "cirrus-linear-io", s->vga.vram_size_mb
                                               * 1024 * 1024);
     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
 
     /* I/O handler for LFB */
-    memory_region_init_io(&s->cirrus_linear_bitblt_io, NULL,
+    memory_region_init_io(&s->cirrus_linear_bitblt_io, owner,
                           &cirrus_linear_bitblt_io_ops,
                           s,
                           "cirrus-bitblt-mmio",
@@ -2880,7 +2882,7 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
 
     /* I/O handler for memory-mapped I/O */
-    memory_region_init_io(&s->cirrus_mmio_io, NULL, &cirrus_mmio_io_ops, s,
+    memory_region_init_io(&s->cirrus_mmio_io, owner, &cirrus_mmio_io_ops, s,
                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
 
@@ -2913,7 +2915,7 @@ static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
     VGACommonState *s = &d->cirrus_vga.vga;
 
     vga_common_init(s, OBJECT(dev));
-    cirrus_init_common(&d->cirrus_vga, CIRRUS_ID_CLGD5430, 0,
+    cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
                        isa_address_space(isadev),
                        isa_address_space_io(isadev));
     s->con = graphic_console_init(dev, s->hw_ops, s);
@@ -2959,7 +2961,7 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
 
      /* setup VGA */
      vga_common_init(&s->vga, OBJECT(dev));
-     cirrus_init_common(s, device_id, 1, pci_address_space(dev),
+     cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
                         pci_address_space_io(dev));
      s->vga.con = graphic_console_init(DEVICE(dev), s->vga.hw_ops, &s->vga);
 
commit 270327feb2535f74379030e028b96b57fd60ca39
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:21:13 2013 -0400

    vga: pass owner to vga_common_init
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 00ac9a3..80510ac 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2912,7 +2912,7 @@ static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
     ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
     VGACommonState *s = &d->cirrus_vga.vga;
 
-    vga_common_init(s);
+    vga_common_init(s, OBJECT(dev));
     cirrus_init_common(&d->cirrus_vga, CIRRUS_ID_CLGD5430, 0,
                        isa_address_space(isadev),
                        isa_address_space_io(isadev));
@@ -2958,7 +2958,7 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
      int16_t device_id = pc->device_id;
 
      /* setup VGA */
-     vga_common_init(&s->vga);
+     vga_common_init(&s->vga, OBJECT(dev));
      cirrus_init_common(s, device_id, 1, pci_address_space(dev),
                         pci_address_space_io(dev));
      s->vga.con = graphic_console_init(DEVICE(dev), s->vga.hw_ops, &s->vga);
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 5754fdc..59925ec 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2067,7 +2067,7 @@ static int qxl_init_primary(PCIDevice *dev)
     qxl->id = 0;
     qxl_init_ramsize(qxl);
     vga->vram_size_mb = qxl->vga.vram_size >> 20;
-    vga_common_init(vga);
+    vga_common_init(vga, OBJECT(dev));
     vga_init(vga, OBJECT(dev),
              pci_address_space(dev), pci_address_space_io(dev), false);
     portio_list_init(qxl_vga_port_list, qxl_vga_portio_list, vga, "vga");
diff --git a/hw/display/vga-isa-mm.c b/hw/display/vga-isa-mm.c
index 95707a8..695c128 100644
--- a/hw/display/vga-isa-mm.c
+++ b/hw/display/vga-isa-mm.c
@@ -132,7 +132,7 @@ int isa_vga_mm_init(hwaddr vram_base,
     s = g_malloc0(sizeof(*s));
 
     s->vga.vram_size_mb = VGA_RAM_SIZE >> 20;
-    vga_common_init(&s->vga);
+    vga_common_init(&s->vga, NULL);
     vga_mm_init(s, vram_base, ctrl_base, it_shift, address_space);
 
     s->vga.con = graphic_console_init(NULL, s->vga.hw_ops, s);
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index d1691a9..fbf6db5 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -56,7 +56,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
     MemoryRegion *vga_io_memory;
     const MemoryRegionPortio *vga_ports, *vbe_ports;
 
-    vga_common_init(s);
+    vga_common_init(s, OBJECT(dev));
     s->legacy_address_space = isa_address_space(isadev);
     vga_io_memory = vga_init_io(s, &vga_ports, &vbe_ports);
     isa_register_portio_list(isadev, 0x3b0, vga_ports, s, "vga");
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 4716230..62652bd 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -147,7 +147,7 @@ static int pci_std_vga_initfn(PCIDevice *dev)
     VGACommonState *s = &d->vga;
 
     /* vga + console init */
-    vga_common_init(s);
+    vga_common_init(s, OBJECT(dev));
     vga_init(s, OBJECT(dev), pci_address_space(dev), pci_address_space_io(dev),
              true);
 
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 24b8b45..d3e0f33 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2256,7 +2256,7 @@ static const GraphicHwOps vga_ops = {
     .text_update = vga_update_text,
 };
 
-void vga_common_init(VGACommonState *s)
+void vga_common_init(VGACommonState *s, Object *obj)
 {
     int i, j, v, b;
 
@@ -2292,7 +2292,7 @@ void vga_common_init(VGACommonState *s)
     s->vram_size_mb = s->vram_size >> 20;
 
     s->is_vbe_vmstate = 1;
-    memory_region_init_ram(&s->vram, NULL, "vga.vram", s->vram_size);
+    memory_region_init_ram(&s->vram, obj, "vga.vram", s->vram_size);
     vmstate_register_ram_global(&s->vram);
     xen_register_framebuffer(&s->vram);
     s->vram_ptr = memory_region_get_ram_ptr(&s->vram);
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index accc9f5..bac366c 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -177,7 +177,7 @@ static inline int c6_to_8(int v)
     return (v << 2) | (b << 1) | b;
 }
 
-void vga_common_init(VGACommonState *s);
+void vga_common_init(VGACommonState *s, Object *obj);
 void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
               MemoryRegion *address_space_io, bool init_vga_ports);
 MemoryRegion *vga_init_io(VGACommonState *s,
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 358bcc0..ce97870 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1198,7 +1198,7 @@ static void vmsvga_init(DeviceState *dev, struct vmsvga_state_s *s,
     vmstate_register_ram_global(&s->fifo_ram);
     s->fifo_ptr = memory_region_get_ram_ptr(&s->fifo_ram);
 
-    vga_common_init(&s->vga);
+    vga_common_init(&s->vga, OBJECT(dev));
     vga_init(&s->vga, OBJECT(dev), address_space, io, true);
     vmstate_register(NULL, 0, &vmstate_vga_common, &s->vga);
     s->new_depth = 32;
commit 712f0cc777dc8abc1f43b8e2a5e65ab3ae563cbd
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 21:21:13 2013 -0400

    vga: pass owner to vga_init
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index bcfcce4..5754fdc 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2068,7 +2068,8 @@ static int qxl_init_primary(PCIDevice *dev)
     qxl_init_ramsize(qxl);
     vga->vram_size_mb = qxl->vga.vram_size >> 20;
     vga_common_init(vga);
-    vga_init(vga, pci_address_space(dev), pci_address_space_io(dev), false);
+    vga_init(vga, OBJECT(dev),
+             pci_address_space(dev), pci_address_space_io(dev), false);
     portio_list_init(qxl_vga_port_list, qxl_vga_portio_list, vga, "vga");
     portio_list_add(qxl_vga_port_list, pci_address_space_io(dev), 0x3b0);
 
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 23d5b56..4716230 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -148,7 +148,8 @@ static int pci_std_vga_initfn(PCIDevice *dev)
 
     /* vga + console init */
     vga_common_init(s);
-    vga_init(s, pci_address_space(dev), pci_address_space_io(dev), true);
+    vga_init(s, OBJECT(dev), pci_address_space(dev), pci_address_space_io(dev),
+             true);
 
     s->con = graphic_console_init(DEVICE(dev), s->hw_ops, s);
 
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 21e3763..24b8b45 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2350,7 +2350,7 @@ MemoryRegion *vga_init_io(VGACommonState *s,
     return vga_mem;
 }
 
-void vga_init(VGACommonState *s, MemoryRegion *address_space,
+void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
               MemoryRegion *address_space_io, bool init_vga_ports)
 {
     MemoryRegion *vga_io_memory;
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index 66f9f3c..accc9f5 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -178,7 +178,7 @@ static inline int c6_to_8(int v)
 }
 
 void vga_common_init(VGACommonState *s);
-void vga_init(VGACommonState *s, MemoryRegion *address_space,
+void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
               MemoryRegion *address_space_io, bool init_vga_ports);
 MemoryRegion *vga_init_io(VGACommonState *s,
                           const MemoryRegionPortio **vga_ports,
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 05be1fa..358bcc0 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1199,7 +1199,7 @@ static void vmsvga_init(DeviceState *dev, struct vmsvga_state_s *s,
     s->fifo_ptr = memory_region_get_ram_ptr(&s->fifo_ram);
 
     vga_common_init(&s->vga);
-    vga_init(&s->vga, address_space, io, true);
+    vga_init(&s->vga, OBJECT(dev), address_space, io, true);
     vmstate_register(NULL, 0, &vmstate_vga_common, &s->vga);
     s->new_depth = 32;
 }
commit 3cf63ff25c6f1bdac7cb153f87ff830e932ac2f5
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Jun 25 15:02:38 2013 +0200

    escc: rename struct to ESCCState
    
    We are using the same struct name for two devices.  8250 is widespread
    enough that this causes some confusion, rename the other instance.
    
    Reviewed-by: Andreas Faerber <afaerber at suse.de>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/char/escc.c b/hw/char/escc.c
index 29ecbaa..422adf2 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -96,14 +96,14 @@ typedef struct ChannelState {
     uint8_t rx, tx;
 } ChannelState;
 
-struct SerialState {
+typedef struct ESCCState {
     SysBusDevice busdev;
     struct ChannelState chn[2];
     uint32_t it_shift;
     MemoryRegion mmio;
     uint32_t disabled;
     uint32_t frequency;
-};
+} ESCCState;
 
 #define SERIAL_CTRL 0
 #define SERIAL_DATA 1
@@ -309,7 +309,7 @@ static void escc_reset_chn(ChannelState *s)
 
 static void escc_reset(DeviceState *d)
 {
-    SerialState *s = container_of(d, SerialState, busdev.qdev);
+    ESCCState *s = container_of(d, ESCCState, busdev.qdev);
 
     escc_reset_chn(&s->chn[0]);
     escc_reset_chn(&s->chn[1]);
@@ -466,7 +466,7 @@ static void escc_update_parameters(ChannelState *s)
 static void escc_mem_write(void *opaque, hwaddr addr,
                            uint64_t val, unsigned size)
 {
-    SerialState *serial = opaque;
+    ESCCState *serial = opaque;
     ChannelState *s;
     uint32_t saddr;
     int newreg, channel;
@@ -568,7 +568,7 @@ static void escc_mem_write(void *opaque, hwaddr addr,
 static uint64_t escc_mem_read(void *opaque, hwaddr addr,
                               unsigned size)
 {
-    SerialState *serial = opaque;
+    ESCCState *serial = opaque;
     ChannelState *s;
     uint32_t saddr;
     uint32_t ret;
@@ -677,7 +677,7 @@ static const VMStateDescription vmstate_escc = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField []) {
-        VMSTATE_STRUCT_ARRAY(chn, SerialState, 2, 2, vmstate_escc_chn,
+        VMSTATE_STRUCT_ARRAY(chn, ESCCState, 2, 2, vmstate_escc_chn,
                              ChannelState),
         VMSTATE_END_OF_LIST()
     }
@@ -689,7 +689,7 @@ MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
 {
     DeviceState *dev;
     SysBusDevice *s;
-    SerialState *d;
+    ESCCState *d;
 
     dev = qdev_create(NULL, "escc");
     qdev_prop_set_uint32(dev, "disabled", 0);
@@ -707,7 +707,7 @@ MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
         sysbus_mmio_map(s, 0, base);
     }
 
-    d = FROM_SYSBUS(SerialState, s);
+    d = FROM_SYSBUS(ESCCState, s);
     return &d->mmio;
 }
 
@@ -869,7 +869,7 @@ void slavio_serial_ms_kbd_init(hwaddr base, qemu_irq irq,
 
 static int escc_init1(SysBusDevice *dev)
 {
-    SerialState *s = FROM_SYSBUS(SerialState, dev);
+    ESCCState *s = FROM_SYSBUS(ESCCState, dev);
     unsigned int i;
 
     s->chn[0].disabled = s->disabled;
@@ -902,13 +902,13 @@ static int escc_init1(SysBusDevice *dev)
 }
 
 static Property escc_properties[] = {
-    DEFINE_PROP_UINT32("frequency", SerialState, frequency,   0),
-    DEFINE_PROP_UINT32("it_shift",  SerialState, it_shift,    0),
-    DEFINE_PROP_UINT32("disabled",  SerialState, disabled,    0),
-    DEFINE_PROP_UINT32("chnBtype",  SerialState, chn[0].type, 0),
-    DEFINE_PROP_UINT32("chnAtype",  SerialState, chn[1].type, 0),
-    DEFINE_PROP_CHR("chrB", SerialState, chn[0].chr),
-    DEFINE_PROP_CHR("chrA", SerialState, chn[1].chr),
+    DEFINE_PROP_UINT32("frequency", ESCCState, frequency,   0),
+    DEFINE_PROP_UINT32("it_shift",  ESCCState, it_shift,    0),
+    DEFINE_PROP_UINT32("disabled",  ESCCState, disabled,    0),
+    DEFINE_PROP_UINT32("chnBtype",  ESCCState, chn[0].type, 0),
+    DEFINE_PROP_UINT32("chnAtype",  ESCCState, chn[1].type, 0),
+    DEFINE_PROP_CHR("chrB", ESCCState, chn[0].chr),
+    DEFINE_PROP_CHR("chrA", ESCCState, chn[1].chr),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -926,7 +926,7 @@ static void escc_class_init(ObjectClass *klass, void *data)
 static const TypeInfo escc_info = {
     .name          = "escc",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(SerialState),
+    .instance_size = sizeof(ESCCState),
     .class_init    = escc_class_init,
 };
 
commit d3e71559a81ca7b6221465dd19282429101f983d
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Jun 28 17:33:29 2013 +0200

    memory: ref/unref memory across address_space_map/unmap
    
    The iothread mutex might be released between map and unmap, so the
    mapped region might disappear.
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index a994bc8..b339c23 100644
--- a/exec.c
+++ b/exec.c
@@ -1986,6 +1986,7 @@ void cpu_physical_memory_write_rom(hwaddr addr,
 }
 
 typedef struct {
+    MemoryRegion *mr;
     void *buffer;
     hwaddr addr;
     hwaddr len;
@@ -2083,6 +2084,9 @@ void *address_space_map(AddressSpace *as,
         bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
         bounce.addr = addr;
         bounce.len = l;
+
+        memory_region_ref(mr);
+        bounce.mr = mr;
         if (!is_write) {
             address_space_read(as, addr, bounce.buffer, l);
         }
@@ -2109,6 +2113,7 @@ void *address_space_map(AddressSpace *as,
         }
     }
 
+    memory_region_ref(mr);
     *plen = done;
     return qemu_ram_ptr_length(raddr + base, plen);
 }
@@ -2121,10 +2126,12 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
                          int is_write, hwaddr access_len)
 {
     if (buffer != bounce.buffer) {
+        MemoryRegion *mr;
+        ram_addr_t addr1;
+
+        mr = qemu_ram_addr_from_host(buffer, &addr1);
+        assert(mr != NULL);
         if (is_write) {
-            ram_addr_t addr1;
-            MemoryRegion *mr = qemu_ram_addr_from_host(buffer, &addr1);
-            assert(mr != NULL);
             while (access_len) {
                 unsigned l;
                 l = TARGET_PAGE_SIZE;
@@ -2138,6 +2145,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
         if (xen_enabled()) {
             xen_invalidate_map_cache_entry(buffer);
         }
+        memory_region_unref(mr);
         return;
     }
     if (is_write) {
@@ -2145,6 +2153,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
     }
     qemu_vfree(bounce.buffer);
     bounce.buffer = NULL;
+    memory_region_unref(bounce.mr);
     cpu_notify_map_clients();
 }
 
commit e3127ae0cdcde6b10a8643836f5bec197f2eff1a
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Jun 28 17:29:27 2013 +0200

    exec: reorganize address_space_map
    
    First of all, rename "todo" to "done".
    
    Second, clearly separate the case of done == 0 with the case of done != 0.
    This will help handling reference counting in the next patch.
    
    Third, this test:
    
                 if (memory_region_get_ram_addr(mr) + xlat != raddr + todo) {
    
    does not guarantee that the memory region is the same across two iterations
    of the while loop.  For example, you could have two blocks:
    
    A) size 640 K, mapped at physical address 0, ram_addr_t 0
    B) size 64 K, mapped at physical address 0xa0000, ram_addr_t 0xa0000
    
    then mapping 1 M starting at physical address zero will erroneously treat
    B as the continuation of block A.  qemu_ram_ptr_length ensures that no
    invalid memory is accessed, but it is still a pointless complication of
    the algorithm.  The patch makes the logic clearer with an explicit test
    that the memory region is the same.
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 307efea..a994bc8 100644
--- a/exec.c
+++ b/exec.c
@@ -2065,47 +2065,52 @@ void *address_space_map(AddressSpace *as,
                         bool is_write)
 {
     hwaddr len = *plen;
-    hwaddr todo = 0;
-    hwaddr l, xlat;
-    MemoryRegion *mr;
-    ram_addr_t raddr = RAM_ADDR_MAX;
-    ram_addr_t rlen;
-    void *ret;
+    hwaddr done = 0;
+    hwaddr l, xlat, base;
+    MemoryRegion *mr, *this_mr;
+    ram_addr_t raddr;
 
-    while (len > 0) {
-        l = len;
-        mr = address_space_translate(as, addr, &xlat, &l, is_write);
-
-        if (!memory_access_is_direct(mr, is_write)) {
-            if (todo || bounce.buffer) {
-                break;
-            }
-            bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
-            bounce.addr = addr;
-            bounce.len = l;
-            if (!is_write) {
-                address_space_read(as, addr, bounce.buffer, l);
-            }
+    if (len == 0) {
+        return NULL;
+    }
 
-            *plen = l;
-            return bounce.buffer;
+    l = len;
+    mr = address_space_translate(as, addr, &xlat, &l, is_write);
+    if (!memory_access_is_direct(mr, is_write)) {
+        if (bounce.buffer) {
+            return NULL;
         }
-        if (!todo) {
-            raddr = memory_region_get_ram_addr(mr) + xlat;
-        } else {
-            if (memory_region_get_ram_addr(mr) + xlat != raddr + todo) {
-                break;
-            }
+        bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
+        bounce.addr = addr;
+        bounce.len = l;
+        if (!is_write) {
+            address_space_read(as, addr, bounce.buffer, l);
         }
 
+        *plen = l;
+        return bounce.buffer;
+    }
+
+    base = xlat;
+    raddr = memory_region_get_ram_addr(mr);
+
+    for (;;) {
         len -= l;
         addr += l;
-        todo += l;
+        done += l;
+        if (len == 0) {
+            break;
+        }
+
+        l = len;
+        this_mr = address_space_translate(as, addr, &xlat, &l, is_write);
+        if (this_mr != mr || xlat != base + done) {
+            break;
+        }
     }
-    rlen = todo;
-    ret = qemu_ram_ptr_length(raddr, &rlen);
-    *plen = rlen;
-    return ret;
+
+    *plen = done;
+    return qemu_ram_ptr_length(raddr + base, plen);
 }
 
 /* Unmaps a memory region previously mapped by address_space_map().
commit 1b5ec2346703c060d26ada7d95fe9aaf476b1947
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 6 14:36:15 2013 +0200

    memory: return MemoryRegion from qemu_ram_addr_from_host
    
    It will be needed in the next patch.
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/cputlb.c b/cputlb.c
index be24080..828007c 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -162,7 +162,7 @@ static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
 {
     ram_addr_t ram_addr;
 
-    if (qemu_ram_addr_from_host(ptr, &ram_addr)) {
+    if (qemu_ram_addr_from_host(ptr, &ram_addr) == NULL) {
         fprintf(stderr, "Bad ram pointer %p\n", ptr);
         abort();
     }
diff --git a/exec.c b/exec.c
index 55c0750..307efea 100644
--- a/exec.c
+++ b/exec.c
@@ -1288,15 +1288,7 @@ void qemu_ram_remap(ram_addr_t addr, ram_addr_t length)
 }
 #endif /* !_WIN32 */
 
-/* Return a host pointer to ram allocated with qemu_ram_alloc.
-   With the exception of the softmmu code in this file, this should
-   only be used for local memory (e.g. video ram) that the device owns,
-   and knows it isn't going to access beyond the end of the block.
-
-   It should not be used for general purpose DMA.
-   Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
- */
-void *qemu_get_ram_ptr(ram_addr_t addr)
+static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
 {
     RAMBlock *block;
 
@@ -1316,6 +1308,21 @@ void *qemu_get_ram_ptr(ram_addr_t addr)
 
 found:
     ram_list.mru_block = block;
+    return block;
+}
+
+/* Return a host pointer to ram allocated with qemu_ram_alloc.
+   With the exception of the softmmu code in this file, this should
+   only be used for local memory (e.g. video ram) that the device owns,
+   and knows it isn't going to access beyond the end of the block.
+
+   It should not be used for general purpose DMA.
+   Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
+ */
+void *qemu_get_ram_ptr(ram_addr_t addr)
+{
+    RAMBlock *block = qemu_get_ram_block(addr);
+
     if (xen_enabled()) {
         /* We need to check if the requested address is in the RAM
          * because we don't want to map the entire memory in QEMU.
@@ -1392,14 +1399,14 @@ static void *qemu_ram_ptr_length(ram_addr_t addr, ram_addr_t *size)
 
 /* Some of the softmmu routines need to translate from a host pointer
    (typically a TLB entry) back to a ram offset.  */
-int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)
+MemoryRegion *qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)
 {
     RAMBlock *block;
     uint8_t *host = ptr;
 
     if (xen_enabled()) {
         *ram_addr = xen_ram_addr_from_mapcache(ptr);
-        return 0;
+        return qemu_get_ram_block(*ram_addr)->mr;
     }
 
     block = ram_list.mru_block;
@@ -1417,11 +1424,11 @@ int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)
         }
     }
 
-    return -1;
+    return NULL;
 
 found:
     *ram_addr = block->offset + (host - block->host);
-    return 0;
+    return block->mr;
 }
 
 static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
@@ -2111,8 +2118,8 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
     if (buffer != bounce.buffer) {
         if (is_write) {
             ram_addr_t addr1;
-            int rc = qemu_ram_addr_from_host(buffer, &addr1);
-            assert(rc == 0);
+            MemoryRegion *mr = qemu_ram_addr_from_host(buffer, &addr1);
+            assert(mr != NULL);
             while (access_len) {
                 unsigned l;
                 l = TARGET_PAGE_SIZE;
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 7abb70f..e4996e1 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -52,7 +52,7 @@ typedef uint32_t CPUReadMemoryFunc(void *opaque, hwaddr addr);
 
 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
 /* This should not be used by devices.  */
-int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr);
+MemoryRegion *qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr);
 void qemu_ram_set_idstr(ram_addr_t addr, const char *name, DeviceState *dev);
 
 void cpu_physical_memory_rw(hwaddr addr, uint8_t *buf,
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 39f4fbb..4b557b3 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -318,7 +318,7 @@ int kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
 
     if ((env->mcg_cap & MCG_SER_P) && addr
         && (code == BUS_MCEERR_AR || code == BUS_MCEERR_AO)) {
-        if (qemu_ram_addr_from_host(addr, &ram_addr) ||
+        if (qemu_ram_addr_from_host(addr, &ram_addr) == NULL ||
             !kvm_physical_memory_addr_from_host(c->kvm_state, addr, &paddr)) {
             fprintf(stderr, "Hardware memory error for memory used by "
                     "QEMU itself instead of guest system!\n");
@@ -350,7 +350,7 @@ int kvm_arch_on_sigbus(int code, void *addr)
         hwaddr paddr;
 
         /* Hope we are lucky for AO MCE */
-        if (qemu_ram_addr_from_host(addr, &ram_addr) ||
+        if (qemu_ram_addr_from_host(addr, &ram_addr) == NULL ||
             !kvm_physical_memory_addr_from_host(CPU(first_cpu)->kvm_state,
                                                 addr, &paddr)) {
             fprintf(stderr, "Hardware memory error for memory used by "
commit 7443b43758ba5eeca8f81ca15fe9fced8983be26
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jun 3 12:44:02 2013 +0200

    exec: move qemu_ram_addr_from_host_nofail to cputlb.c
    
    After the next patch it would not be used elsewhere anyway.  Also,
    the _nofail and the standard versions of this function return different
    things, which is confusing.  Removing the function from the public headers
    limits the confusion.
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/cputlb.c b/cputlb.c
index 80b2a94..be24080 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -158,6 +158,17 @@ void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,
     }
 }
 
+static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
+{
+    ram_addr_t ram_addr;
+
+    if (qemu_ram_addr_from_host(ptr, &ram_addr)) {
+        fprintf(stderr, "Bad ram pointer %p\n", ptr);
+        abort();
+    }
+    return ram_addr;
+}
+
 static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
 {
     ram_addr_t ram_addr;
diff --git a/exec.c b/exec.c
index 69af46e..55c0750 100644
--- a/exec.c
+++ b/exec.c
@@ -1390,6 +1390,8 @@ static void *qemu_ram_ptr_length(ram_addr_t addr, ram_addr_t *size)
     }
 }
 
+/* Some of the softmmu routines need to translate from a host pointer
+   (typically a TLB entry) back to a ram offset.  */
 int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)
 {
     RAMBlock *block;
@@ -1422,19 +1424,6 @@ found:
     return 0;
 }
 
-/* Some of the softmmu routines need to translate from a host pointer
-   (typically a TLB entry) back to a ram offset.  */
-ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
-{
-    ram_addr_t ram_addr;
-
-    if (qemu_ram_addr_from_host(ptr, &ram_addr)) {
-        fprintf(stderr, "Bad ram pointer %p\n", ptr);
-        abort();
-    }
-    return ram_addr;
-}
-
 static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
                                uint64_t val, unsigned size)
 {
@@ -2121,7 +2110,9 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
 {
     if (buffer != bounce.buffer) {
         if (is_write) {
-            ram_addr_t addr1 = qemu_ram_addr_from_host_nofail(buffer);
+            ram_addr_t addr1;
+            int rc = qemu_ram_addr_from_host(buffer, &addr1);
+            assert(rc == 0);
             while (access_len) {
                 unsigned l;
                 l = TARGET_PAGE_SIZE;
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 5240ae2..7abb70f 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -53,7 +53,6 @@ typedef uint32_t CPUReadMemoryFunc(void *opaque, hwaddr addr);
 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
 /* This should not be used by devices.  */
 int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr);
-ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
 void qemu_ram_set_idstr(ram_addr_t addr, const char *name, DeviceState *dev);
 
 void cpu_physical_memory_rw(hwaddr addr, uint8_t *buf,
commit 23887b79df2be53dc49166e1b677469abfb92147
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 6 14:28:39 2013 +0200

    exec: check MRU in qemu_ram_addr_from_host
    
    This function is not used outside the iothread mutex, so it
    can use ram_list.mru_block.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index e3ac1a1..69af46e 100644
--- a/exec.c
+++ b/exec.c
@@ -1400,18 +1400,26 @@ int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)
         return 0;
     }
 
+    block = ram_list.mru_block;
+    if (block && block->host && host - block->host < block->length) {
+        goto found;
+    }
+
     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
         /* This case append when the block is not mapped. */
         if (block->host == NULL) {
             continue;
         }
         if (host - block->host < block->length) {
-            *ram_addr = block->offset + (host - block->host);
-            return 0;
+            goto found;
         }
     }
 
     return -1;
+
+found:
+    *ram_addr = block->offset + (host - block->host);
+    return 0;
 }
 
 /* Some of the softmmu routines need to translate from a host pointer
commit dfde4e6e1a868f60033ece0590b1f75e6c57fa16
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 6 10:46:11 2013 +0200

    memory: add ref/unref calls
    
    Add ref/unref calls at the following places:
    
    - places where memory regions are stashed by a listener and
      used outside the BQL (including in Xen or KVM).
    
    - memory_region_find callsites
    
    - creation of aliases and containers (only the aliased/contained
      region gets a reference to avoid loops)
    
    - around calls to del_subregion/add_subregion, where the region
      could disappear after the first call
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index f926bd7..e3ac1a1 100644
--- a/exec.c
+++ b/exec.c
@@ -763,11 +763,14 @@ static uint16_t phys_section_add(MemoryRegionSection *section)
                                 phys_sections_nb_alloc);
     }
     phys_sections[phys_sections_nb] = *section;
+    memory_region_ref(section->mr);
     return phys_sections_nb++;
 }
 
 static void phys_section_destroy(MemoryRegion *mr)
 {
+    memory_region_unref(mr);
+
     if (mr->subpage) {
         subpage_t *subpage = container_of(mr, subpage_t, iomem);
         memory_region_destroy(&subpage->iomem);
diff --git a/hw/core/loader.c b/hw/core/loader.c
index d569636..44311ff 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -727,6 +727,7 @@ int rom_load_all(void)
         addr += rom->romsize;
         section = memory_region_find(get_system_memory(), rom->addr, 1);
         rom->isrom = int128_nz(section.size) && memory_region_is_rom(section.mr);
+        memory_region_unref(section.mr);
     }
     qemu_register_reset(rom_reset, NULL);
     roms_loaded = 1;
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index d9088d9..b520f52 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1126,6 +1126,11 @@ static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
     /* Total number of bytes of virtual screen used by current window */
     w->fb_len = fb_mapped_len = (w->virtpage_width + w->virtpage_offsize) *
             (w->rightbot_y - w->lefttop_y + 1);
+
+    /* TODO: add .exit and unref the region there.  Not needed yet since sysbus
+     * does not support hot-unplug.
+     */
+    memory_region_unref(w->mem_section.mr);
     w->mem_section = memory_region_find(sysbus_address_space(&s->busdev),
             fb_start_addr, w->fb_len);
     assert(w->mem_section.mr);
@@ -1154,6 +1159,7 @@ static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
     return;
 
 error_return:
+    memory_region_unref(w->mem_section.mr);
     w->mem_section.mr = NULL;
     w->mem_section.size = int128_zero();
     w->host_fb_addr = NULL;
diff --git a/hw/display/framebuffer.c b/hw/display/framebuffer.c
index 49c9e59..4546e42 100644
--- a/hw/display/framebuffer.c
+++ b/hw/display/framebuffer.c
@@ -54,11 +54,11 @@ void framebuffer_update_display(
     src_len = src_width * rows;
 
     mem_section = memory_region_find(address_space, base, src_len);
+    mem = mem_section.mr;
     if (int128_get64(mem_section.size) != src_len ||
             !memory_region_is_ram(mem_section.mr)) {
-        return;
+        goto out;
     }
-    mem = mem_section.mr;
     assert(mem);
     assert(mem_section.offset_within_address_space == base);
 
@@ -68,10 +68,10 @@ void framebuffer_update_display(
        but it's not really worth it as dirty flag tracking will probably
        already have failed above.  */
     if (!src_base)
-        return;
+        goto out;
     if (src_len != src_width * rows) {
         cpu_physical_memory_unmap(src_base, src_len, 0, 0);
-        return;
+        goto out;
     }
     src = src_base;
     dest = surface_data(ds);
@@ -102,10 +102,12 @@ void framebuffer_update_display(
     }
     cpu_physical_memory_unmap(src_base, src_len, 0, 0);
     if (first < 0) {
-        return;
+        goto out;
     }
     memory_region_reset_dirty(mem, mem_section.offset_within_region, src_len,
                               DIRTY_MEMORY_VGA);
     *first_row = first;
     *last_row = last;
+out:
+    memory_region_unref(mem);
 }
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 08da69e..21b5912 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -605,6 +605,7 @@ static void vapic_map_rom_writable(VAPICROMState *s)
                              rom_size);
     memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
     s->rom_mapped_writable = true;
+    memory_region_unref(section.mr);
 }
 
 static int vapic_prepare(VAPICROMState *s)
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index e2e957d..675bbfc 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -1969,6 +1969,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
     DPRINTF("region_add %"HWADDR_PRIx" - %"HWADDR_PRIx" [%p]\n",
             iova, end - 1, vaddr);
 
+    memory_region_ref(section->mr);
     ret = vfio_dma_map(container, iova, end - iova, vaddr, section->readonly);
     if (ret) {
         error_report("vfio_dma_map(%p, 0x%"HWADDR_PRIx", "
@@ -2010,6 +2011,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
             iova, end - 1);
 
     ret = vfio_dma_unmap(container, iova, end - iova);
+    memory_region_unref(section->mr);
     if (ret) {
         error_report("vfio_dma_unmap(%p, 0x%"HWADDR_PRIx", "
                      "0x%"HWADDR_PRIx") = %d (%m)",
diff --git a/hw/virtio/dataplane/hostmem.c b/hw/virtio/dataplane/hostmem.c
index 7e46723..901d98b 100644
--- a/hw/virtio/dataplane/hostmem.c
+++ b/hw/virtio/dataplane/hostmem.c
@@ -64,8 +64,12 @@ out:
 static void hostmem_listener_commit(MemoryListener *listener)
 {
     HostMem *hostmem = container_of(listener, HostMem, listener);
+    int i;
 
     qemu_mutex_lock(&hostmem->current_regions_lock);
+    for (i = 0; i < hostmem->num_current_regions; i++) {
+        memory_region_unref(hostmem->current_regions[i].mr);
+    }
     g_free(hostmem->current_regions);
     hostmem->current_regions = hostmem->new_regions;
     hostmem->num_current_regions = hostmem->num_new_regions;
@@ -92,8 +96,11 @@ static void hostmem_append_new_region(HostMem *hostmem,
         .guest_addr = section->offset_within_address_space,
         .size = int128_get64(section->size),
         .readonly = section->readonly,
+        .mr = section->mr,
     };
     hostmem->num_new_regions++;
+
+    memory_region_ref(section->mr);
 }
 
 static void hostmem_listener_append_region(MemoryListener *listener,
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index baf84ea..96ab625 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -497,6 +497,7 @@ static void vhost_region_add(MemoryListener *listener,
     dev->mem_sections = g_renew(MemoryRegionSection, dev->mem_sections,
                                 dev->n_mem_sections);
     dev->mem_sections[dev->n_mem_sections - 1] = *section;
+    memory_region_ref(section->mr);
     vhost_set_memory(listener, section, true);
 }
 
@@ -512,6 +513,7 @@ static void vhost_region_del(MemoryListener *listener,
     }
 
     vhost_set_memory(listener, section, false);
+    memory_region_unref(section->mr);
     for (i = 0; i < dev->n_mem_sections; ++i) {
         if (dev->mem_sections[i].offset_within_address_space
             == section->offset_within_address_space) {
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index a27051c..3fa72a9 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -205,6 +205,7 @@ static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
             addr = section.offset_within_region;
             balloon_page(memory_region_get_ram_ptr(section.mr) + addr,
                          !!(vq == s->dvq));
+            memory_region_unref(section.mr);
         }
 
         virtqueue_push(vq, &elem, offset);
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index 15b4896..c06a018 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -606,6 +606,7 @@ static void xen_pt_region_add(MemoryListener *l, MemoryRegionSection *sec)
     XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState,
                                              memory_listener);
 
+    memory_region_ref(sec->mr);
     xen_pt_region_update(s, sec, true);
 }
 
@@ -615,6 +616,7 @@ static void xen_pt_region_del(MemoryListener *l, MemoryRegionSection *sec)
                                              memory_listener);
 
     xen_pt_region_update(s, sec, false);
+    memory_region_unref(sec->mr);
 }
 
 static void xen_pt_io_region_add(MemoryListener *l, MemoryRegionSection *sec)
@@ -622,6 +624,7 @@ static void xen_pt_io_region_add(MemoryListener *l, MemoryRegionSection *sec)
     XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState,
                                              io_listener);
 
+    memory_region_ref(sec->mr);
     xen_pt_region_update(s, sec, true);
 }
 
@@ -631,6 +634,7 @@ static void xen_pt_io_region_del(MemoryListener *l, MemoryRegionSection *sec)
                                              io_listener);
 
     xen_pt_region_update(s, sec, false);
+    memory_region_unref(sec->mr);
 }
 
 static const MemoryListener xen_pt_memory_listener = {
diff --git a/include/hw/virtio/dataplane/hostmem.h b/include/hw/virtio/dataplane/hostmem.h
index b2cf093..2810f4b 100644
--- a/include/hw/virtio/dataplane/hostmem.h
+++ b/include/hw/virtio/dataplane/hostmem.h
@@ -18,6 +18,7 @@
 #include "qemu/thread.h"
 
 typedef struct {
+    MemoryRegion *mr;
     void *host_addr;
     hwaddr guest_addr;
     uint64_t size;
diff --git a/kvm-all.c b/kvm-all.c
index c757dd2..66a86c2 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -789,6 +789,7 @@ static void kvm_set_phys_mem(MemoryRegionSection *section, bool add)
 static void kvm_region_add(MemoryListener *listener,
                            MemoryRegionSection *section)
 {
+    memory_region_ref(section->mr);
     kvm_set_phys_mem(section, true);
 }
 
@@ -796,6 +797,7 @@ static void kvm_region_del(MemoryListener *listener,
                            MemoryRegionSection *section)
 {
     kvm_set_phys_mem(section, false);
+    memory_region_unref(section->mr);
 }
 
 static void kvm_log_sync(MemoryListener *listener,
diff --git a/memory.c b/memory.c
index 24027c5..543e0cc 100644
--- a/memory.c
+++ b/memory.c
@@ -148,6 +148,7 @@ static bool memory_listener_match(MemoryListener *listener,
         }                                                               \
     } while (0)
 
+/* No need to ref/unref .mr, the FlatRange keeps it alive.  */
 #define MEMORY_LISTENER_UPDATE_REGION(fr, as, dir, callback)            \
     MEMORY_LISTENER_CALL(callback, dir, (&(MemoryRegionSection) {       \
         .mr = (fr)->mr,                                                 \
@@ -263,11 +264,17 @@ static void flatview_insert(FlatView *view, unsigned pos, FlatRange *range)
     memmove(view->ranges + pos + 1, view->ranges + pos,
             (view->nr - pos) * sizeof(FlatRange));
     view->ranges[pos] = *range;
+    memory_region_ref(range->mr);
     ++view->nr;
 }
 
 static void flatview_destroy(FlatView *view)
 {
+    int i;
+
+    for (i = 0; i < view->nr; i++) {
+        memory_region_unref(view->ranges[i].mr);
+    }
     g_free(view->ranges);
 }
 
@@ -709,6 +716,11 @@ static void memory_region_destructor_ram(MemoryRegion *mr)
     qemu_ram_free(mr->ram_addr);
 }
 
+static void memory_region_destructor_alias(MemoryRegion *mr)
+{
+    memory_region_unref(mr->alias);
+}
+
 static void memory_region_destructor_ram_from_ptr(MemoryRegion *mr)
 {
     qemu_ram_free_from_ptr(mr->ram_addr);
@@ -964,6 +976,8 @@ void memory_region_init_alias(MemoryRegion *mr,
                               uint64_t size)
 {
     memory_region_init(mr, owner, name, size);
+    memory_region_ref(orig);
+    mr->destructor = memory_region_destructor_alias;
     mr->alias = orig;
     mr->alias_offset = offset;
 }
@@ -1342,6 +1356,7 @@ static void memory_region_add_subregion_common(MemoryRegion *mr,
     memory_region_transaction_begin();
 
     assert(!subregion->parent);
+    memory_region_ref(subregion);
     subregion->parent = mr;
     subregion->addr = offset;
     QTAILQ_FOREACH(other, &mr->subregions, subregions_link) {
@@ -1404,6 +1419,7 @@ void memory_region_del_subregion(MemoryRegion *mr,
     assert(subregion->parent == mr);
     subregion->parent = NULL;
     QTAILQ_REMOVE(&mr->subregions, subregion, subregions_link);
+    memory_region_unref(subregion);
     memory_region_update_pending |= mr->enabled && subregion->enabled;
     memory_region_transaction_commit();
 }
@@ -1431,12 +1447,14 @@ void memory_region_set_address(MemoryRegion *mr, hwaddr addr)
     }
 
     memory_region_transaction_begin();
+    memory_region_ref(mr);
     memory_region_del_subregion(parent, mr);
     if (may_overlap) {
         memory_region_add_subregion_overlap(parent, addr, mr, priority);
     } else {
         memory_region_add_subregion(parent, addr, mr);
     }
+    memory_region_unref(mr);
     memory_region_transaction_commit();
 }
 
@@ -1484,6 +1502,7 @@ bool memory_region_present(MemoryRegion *parent, hwaddr addr)
     if (!mr) {
         return false;
     }
+    memory_region_unref(mr);
     return true;
 }
 
@@ -1523,6 +1542,8 @@ MemoryRegionSection memory_region_find(MemoryRegion *mr,
     ret.size = range.size;
     ret.offset_within_address_space = int128_get64(range.start);
     ret.readonly = fr->readonly;
+    memory_region_ref(ret.mr);
+
     return ret;
 }
 
diff --git a/target-arm/kvm.c b/target-arm/kvm.c
index d3937a2..b92e00d 100644
--- a/target-arm/kvm.c
+++ b/target-arm/kvm.c
@@ -233,6 +233,7 @@ static void kvm_arm_machine_init_done(Notifier *notifier, void *data)
                 abort();
             }
         }
+        memory_region_unref(kd->mr);
         g_free(kd);
     }
 }
@@ -258,6 +259,7 @@ void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid)
     kd->kda.id = devid;
     kd->kda.addr = -1;
     QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);
+    memory_region_ref(kd->mr);
 }
 
 bool write_kvmstate_to_list(ARMCPU *cpu)
diff --git a/target-sparc/mmu_helper.c b/target-sparc/mmu_helper.c
index 3983c96..740cbe8 100644
--- a/target-sparc/mmu_helper.c
+++ b/target-sparc/mmu_helper.c
@@ -845,6 +845,7 @@ hwaddr cpu_get_phys_page_debug(CPUSPARCState *env, target_ulong addr)
         }
     }
     section = memory_region_find(get_system_memory(), phys_addr, 1);
+    memory_region_unref(section.mr);
     if (!int128_nz(section.size)) {
         return -1;
     }
diff --git a/xen-all.c b/xen-all.c
index 1f040c0..21246e0 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -459,6 +459,7 @@ static void xen_set_memory(struct MemoryListener *listener,
 static void xen_region_add(MemoryListener *listener,
                            MemoryRegionSection *section)
 {
+    memory_region_ref(section->mr);
     xen_set_memory(listener, section, true);
 }
 
@@ -466,6 +467,7 @@ static void xen_region_del(MemoryListener *listener,
                            MemoryRegionSection *section)
 {
     xen_set_memory(listener, section, false);
+    memory_region_unref(section->mr);
 }
 
 static void xen_sync_dirty_bitmap(XenIOState *state,
commit 3ce10901ca8da9142dcdcde198fda1a4c290934c
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Jul 2 13:40:48 2013 +0200

    memory: introduce memory_region_present
    
    This new API will avoid having too many memory_region_ref/unref
    in paths that currently use memory_region_find.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 3b95c69..10fc925 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -388,10 +388,10 @@ static void piix4_pm_machine_ready(Notifier *n, void *opaque)
 
     pci_conf = s->dev.config;
     pci_conf[0x5f] = 0x10 |
-        (memory_region_find(io_as, 0x378, 1).mr ? 0x80 : 0);
+        (memory_region_present(io_as, 0x378) ? 0x80 : 0);
     pci_conf[0x63] = 0x60;
-    pci_conf[0x67] = (memory_region_find(io_as, 0x3f8, 1).mr ? 0x08 : 0) |
-        (memory_region_find(io_as, 0x2f8, 1).mr ? 0x90 : 0);
+    pci_conf[0x67] = (memory_region_present(io_as, 0x3f8) ? 0x08 : 0) |
+        (memory_region_present(io_as, 0x2f8) ? 0x90 : 0);
 }
 
 static int piix4_pm_initfn(PCIDevice *dev)
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index 82f8ea6..f704c42 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -481,19 +481,19 @@ static void ich9_lpc_machine_ready(Notifier *n, void *opaque)
     uint8_t *pci_conf;
 
     pci_conf = s->d.config;
-    if (memory_region_find(io_as, 0x3f8, 1).mr) {
+    if (memory_region_present(io_as, 0x3f8)) {
         /* com1 */
         pci_conf[0x82] |= 0x01;
     }
-    if (memory_region_find(io_as, 0x2f8, 1).mr) {
+    if (memory_region_present(io_as, 0x2f8)) {
         /* com2 */
         pci_conf[0x82] |= 0x02;
     }
-    if (memory_region_find(io_as, 0x378, 1).mr) {
+    if (memory_region_present(io_as, 0x378)) {
         /* lpt */
         pci_conf[0x82] |= 0x04;
     }
-    if (memory_region_find(io_as, 0x3f0, 1).mr) {
+    if (memory_region_present(io_as, 0x3f0)) {
         /* floppy */
         pci_conf[0x82] |= 0x08;
     }
diff --git a/include/exec/memory.h b/include/exec/memory.h
index d2466a7..c8d0bf4 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -837,6 +837,18 @@ void memory_region_set_alias_offset(MemoryRegion *mr,
                                     hwaddr offset);
 
 /**
+ * memory_region_present: translate an address/size relative to a
+ * MemoryRegion into a #MemoryRegionSection.
+ *
+ * Answer whether a #MemoryRegion within @parent covers the address
+ * @addr.
+ *
+ * @parent: a MemoryRegion within which @addr is a relative address
+ * @addr: the area within @parent to be searched
+ */
+bool memory_region_present(MemoryRegion *parent, hwaddr addr);
+
+/**
  * memory_region_find: translate an address/size relative to a
  * MemoryRegion into a #MemoryRegionSection.
  *
diff --git a/memory.c b/memory.c
index e04d519..24027c5 100644
--- a/memory.c
+++ b/memory.c
@@ -1478,6 +1478,15 @@ static FlatRange *address_space_lookup(AddressSpace *as, AddrRange addr)
                    sizeof(FlatRange), cmp_flatrange_addr);
 }
 
+bool memory_region_present(MemoryRegion *parent, hwaddr addr)
+{
+    MemoryRegion *mr = memory_region_find(parent, addr, 1).mr;
+    if (!mr) {
+        return false;
+    }
+    return true;
+}
+
 MemoryRegionSection memory_region_find(MemoryRegion *mr,
                                        hwaddr addr, uint64_t size)
 {
commit 46637be269aaaceb9867ffdf176e906401138fff
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue May 7 09:06:00 2013 +0200

    memory: add ref/unref
    
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/exec/memory.h b/include/exec/memory.h
index 2f3e8e4..d2466a7 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -247,6 +247,36 @@ void memory_region_init(MemoryRegion *mr,
                         struct Object *owner,
                         const char *name,
                         uint64_t size);
+
+/**
+ * memory_region_ref: Add 1 to a memory region's reference count
+ *
+ * Whenever memory regions are accessed outside the BQL, they need to be
+ * preserved against hot-unplug.  MemoryRegions actually do not have their
+ * own reference count; they piggyback on a QOM object, their "owner".
+ * This function adds a reference to the owner.
+ *
+ * All MemoryRegions must have an owner if they can disappear, even if the
+ * device they belong to operates exclusively under the BQL.  This is because
+ * the region could be returned at any time by memory_region_find, and this
+ * is usually under guest control.
+ *
+ * @mr: the #MemoryRegion
+ */
+void memory_region_ref(MemoryRegion *mr);
+
+/**
+ * memory_region_unref: Remove 1 to a memory region's reference count
+ *
+ * Whenever memory regions are accessed outside the BQL, they need to be
+ * preserved against hot-unplug.  MemoryRegions actually do not have their
+ * own reference count; they piggyback on a QOM object, their "owner".
+ * This function removes a reference to the owner and possibly destroys it.
+ *
+ * @mr: the #MemoryRegion
+ */
+void memory_region_unref(MemoryRegion *mr);
+
 /**
  * memory_region_init_io: Initialize an I/O memory region.
  *
diff --git a/memory.c b/memory.c
index f85774a..e04d519 100644
--- a/memory.c
+++ b/memory.c
@@ -1019,6 +1019,20 @@ Object *memory_region_owner(MemoryRegion *mr)
     return mr->owner;
 }
 
+void memory_region_ref(MemoryRegion *mr)
+{
+    if (mr && mr->owner) {
+        object_ref(mr->owner);
+    }
+}
+
+void memory_region_unref(MemoryRegion *mr)
+{
+    if (mr && mr->owner) {
+        object_unref(mr->owner);
+    }
+}
+
 uint64_t memory_region_size(MemoryRegion *mr)
 {
     if (int128_eq(mr->size, int128_2_64())) {
commit 803c0816a7d3ab35460991ba5b7d1fccc070332b
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue May 7 06:59:09 2013 +0200

    memory: add getter for owner
    
    Whenever memory regions are accessed outside the BQL, they need to be
    preserved against hot-unplug.  MemoryRegions actually do not have their
    own reference count; they piggyback on a QOM object, their "owner".
    The owner is set at creation time, and there is a function to retrieve
    the owner.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/exec/memory.h b/include/exec/memory.h
index 3f48f07..2f3e8e4 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -382,6 +382,13 @@ void memory_region_init_iommu(MemoryRegion *mr,
 void memory_region_destroy(MemoryRegion *mr);
 
 /**
+ * memory_region_owner: get a memory region's owner.
+ *
+ * @mr: the memory region being queried.
+ */
+struct Object *memory_region_owner(MemoryRegion *mr);
+
+/**
  * memory_region_size: get a memory region's size.
  *
  * @mr: the memory region being queried.
diff --git a/memory.c b/memory.c
index 56ef4ba..f85774a 100644
--- a/memory.c
+++ b/memory.c
@@ -738,6 +738,7 @@ void memory_region_init(MemoryRegion *mr,
     mr->owner = owner;
     mr->iommu_ops = NULL;
     mr->parent = NULL;
+    mr->owner = NULL;
     mr->size = int128_make64(size);
     if (size == UINT64_MAX) {
         mr->size = int128_2_64();
@@ -1013,6 +1014,11 @@ void memory_region_destroy(MemoryRegion *mr)
     g_free(mr->ioeventfds);
 }
 
+Object *memory_region_owner(MemoryRegion *mr)
+{
+    return mr->owner;
+}
+
 uint64_t memory_region_size(MemoryRegion *mr)
 {
     if (int128_eq(mr->size, int128_2_64())) {
commit b7e95164d1a9969aa591b8a72e05b94d08c49738
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed May 29 12:07:03 2013 +0200

    exec: simplify destruction of the phys map
    
    Do not bother visiting the radix tree when an address space is destroyed.
    After the previous patch, this has become a pointless exercise.  When
    called from address_space_destroy_dispatch, all you're doing is zeroing
    out a structure that will be freed as soon as you come back.  When called
    from mem_begin, when phys_page_set_level will call phys_map_node_alloc the
    radix tree's array will be zeroed too.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 78be4f5..f926bd7 100644
--- a/exec.c
+++ b/exec.c
@@ -154,12 +154,6 @@ static uint16_t phys_map_node_alloc(void)
     return ret;
 }
 
-static void phys_map_nodes_reset(void)
-{
-    phys_map_nodes_nb = 0;
-}
-
-
 static void phys_page_set_level(PhysPageEntry *lp, hwaddr *index,
                                 hwaddr *nb, uint16_t leaf,
                                 int level)
@@ -755,31 +749,6 @@ static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
                              uint16_t section);
 static subpage_t *subpage_init(AddressSpace *as, hwaddr base);
 
-static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
-{
-    unsigned i;
-    PhysPageEntry *p;
-
-    if (lp->ptr == PHYS_MAP_NODE_NIL) {
-        return;
-    }
-
-    p = phys_map_nodes[lp->ptr];
-    for (i = 0; i < L2_SIZE; ++i) {
-        if (!p[i].is_leaf) {
-            destroy_l2_mapping(&p[i], level - 1);
-        }
-    }
-    lp->is_leaf = 0;
-    lp->ptr = PHYS_MAP_NODE_NIL;
-}
-
-static void destroy_all_mappings(AddressSpaceDispatch *d)
-{
-    destroy_l2_mapping(&d->phys_map, P_L2_LEVELS - 1);
-    phys_map_nodes_reset();
-}
-
 static uint16_t phys_section_add(MemoryRegionSection *section)
 {
     /* The physical section number is ORed with a page-aligned
@@ -812,6 +781,7 @@ static void phys_sections_clear(void)
         MemoryRegionSection *section = &phys_sections[--phys_sections_nb];
         phys_section_destroy(section->mr);
     }
+    phys_map_nodes_nb = 0;
 }
 
 static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)
@@ -1716,7 +1686,6 @@ static void mem_begin(MemoryListener *listener)
 {
     AddressSpaceDispatch *d = container_of(listener, AddressSpaceDispatch, listener);
 
-    destroy_all_mappings(d);
     d->phys_map.ptr = PHYS_MAP_NODE_NIL;
 }
 
@@ -1783,7 +1752,6 @@ void address_space_destroy_dispatch(AddressSpace *as)
     AddressSpaceDispatch *d = as->dispatch;
 
     memory_listener_unregister(&d->listener);
-    destroy_l2_mapping(&d->phys_map, P_L2_LEVELS - 1);
     g_free(d);
     as->dispatch = NULL;
 }
commit 058bc4b57f9d6b39d9a6748b4049e1be3fde3dac
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Jun 25 09:30:48 2013 +0200

    memory: destroy phys_sections one by one
    
    phys_sections_clear is invoked after the dispatch tree has been
    destroyed.  This leaves a window where phys_sections_nb > 0 but the
    subpages are not valid anymore, which is a recipe for use-after-free
    bugs.
    
    Move the destruction of subpages in phys_sections_clear.  We will
    still destroy the subpages when an address space is cleaned up,
    because address_space_destroy will clear as->root and commit the
    change before it calls address_space_destroy_dispatch.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 5094746..78be4f5 100644
--- a/exec.c
+++ b/exec.c
@@ -754,17 +754,6 @@ hwaddr memory_region_section_get_iotlb(CPUArchState *env,
 static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
                              uint16_t section);
 static subpage_t *subpage_init(AddressSpace *as, hwaddr base);
-static void destroy_page_desc(uint16_t section_index)
-{
-    MemoryRegionSection *section = &phys_sections[section_index];
-    MemoryRegion *mr = section->mr;
-
-    if (mr->subpage) {
-        subpage_t *subpage = container_of(mr, subpage_t, iomem);
-        memory_region_destroy(&subpage->iomem);
-        g_free(subpage);
-    }
-}
 
 static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
 {
@@ -779,8 +768,6 @@ static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
     for (i = 0; i < L2_SIZE; ++i) {
         if (!p[i].is_leaf) {
             destroy_l2_mapping(&p[i], level - 1);
-        } else {
-            destroy_page_desc(p[i].ptr);
         }
     }
     lp->is_leaf = 0;
@@ -810,9 +797,21 @@ static uint16_t phys_section_add(MemoryRegionSection *section)
     return phys_sections_nb++;
 }
 
+static void phys_section_destroy(MemoryRegion *mr)
+{
+    if (mr->subpage) {
+        subpage_t *subpage = container_of(mr, subpage_t, iomem);
+        memory_region_destroy(&subpage->iomem);
+        g_free(subpage);
+    }
+}
+
 static void phys_sections_clear(void)
 {
-    phys_sections_nb = 0;
+    while (phys_sections_nb > 0) {
+        MemoryRegionSection *section = &phys_sections[--phys_sections_nb];
+        phys_section_destroy(section->mr);
+    }
 }
 
 static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)
commit 2c9b15cab12c21e32dffb67c5e18f3dc407ca224
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 6 05:41:28 2013 -0400

    memory: add owner argument to initialization functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 5a55d2a..5094746 100644
--- a/exec.c
+++ b/exec.c
@@ -1673,7 +1673,7 @@ static subpage_t *subpage_init(AddressSpace *as, hwaddr base)
 
     mmio->as = as;
     mmio->base = base;
-    memory_region_init_io(&mmio->iomem, &subpage_ops, mmio,
+    memory_region_init_io(&mmio->iomem, NULL, &subpage_ops, mmio,
                           "subpage", TARGET_PAGE_SIZE);
     mmio->iomem.subpage = true;
 #if defined(DEBUG_SUBPAGE)
@@ -1704,12 +1704,12 @@ MemoryRegion *iotlb_to_region(hwaddr index)
 
 static void io_mem_init(void)
 {
-    memory_region_init_io(&io_mem_rom, &unassigned_mem_ops, NULL, "rom", UINT64_MAX);
-    memory_region_init_io(&io_mem_unassigned, &unassigned_mem_ops, NULL,
+    memory_region_init_io(&io_mem_rom, NULL, &unassigned_mem_ops, NULL, "rom", UINT64_MAX);
+    memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
                           "unassigned", UINT64_MAX);
-    memory_region_init_io(&io_mem_notdirty, &notdirty_mem_ops, NULL,
+    memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
                           "notdirty", UINT64_MAX);
-    memory_region_init_io(&io_mem_watch, &watch_mem_ops, NULL,
+    memory_region_init_io(&io_mem_watch, NULL, &watch_mem_ops, NULL,
                           "watch", UINT64_MAX);
 }
 
@@ -1792,11 +1792,11 @@ void address_space_destroy_dispatch(AddressSpace *as)
 static void memory_map_init(void)
 {
     system_memory = g_malloc(sizeof(*system_memory));
-    memory_region_init(system_memory, "system", INT64_MAX);
+    memory_region_init(system_memory, NULL, "system", INT64_MAX);
     address_space_init(&address_space_memory, system_memory, "memory");
 
     system_io = g_malloc(sizeof(*system_io));
-    memory_region_init(system_io, "io", 65536);
+    memory_region_init(system_io, NULL, "io", 65536);
     address_space_init(&address_space_io, system_io, "I/O");
 
     memory_listener_register(&core_memory_listener, &address_space_memory);
diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 42eeace..7206e9c 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -419,7 +419,7 @@ void acpi_pm1_evt_init(ACPIREGS *ar, acpi_update_sci_fn update_sci,
                        MemoryRegion *parent)
 {
     ar->pm1.evt.update_sci = update_sci;
-    memory_region_init_io(&ar->pm1.evt.io, &acpi_pm_evt_ops, ar, "acpi-evt", 4);
+    memory_region_init_io(&ar->pm1.evt.io, NULL, &acpi_pm_evt_ops, ar, "acpi-evt", 4);
     memory_region_add_subregion(parent, 0, &ar->pm1.evt.io);
 }
 
@@ -481,7 +481,7 @@ void acpi_pm_tmr_init(ACPIREGS *ar, acpi_update_sci_fn update_sci,
 {
     ar->tmr.update_sci = update_sci;
     ar->tmr.timer = qemu_new_timer_ns(vm_clock, acpi_pm_tmr_timer, ar);
-    memory_region_init_io(&ar->tmr.io, &acpi_pm_tmr_ops, ar, "acpi-tmr", 4);
+    memory_region_init_io(&ar->tmr.io, NULL, &acpi_pm_tmr_ops, ar, "acpi-tmr", 4);
     memory_region_add_subregion(parent, 8, &ar->tmr.io);
 }
 
@@ -552,7 +552,7 @@ void acpi_pm1_cnt_init(ACPIREGS *ar, MemoryRegion *parent, uint8_t s4_val)
     ar->pm1.cnt.s4_val = s4_val;
     ar->wakeup.notify = acpi_notify_wakeup;
     qemu_register_wakeup_notifier(&ar->wakeup);
-    memory_region_init_io(&ar->pm1.cnt.io, &acpi_pm_cnt_ops, ar, "acpi-cnt", 2);
+    memory_region_init_io(&ar->pm1.cnt.io, NULL, &acpi_pm_cnt_ops, ar, "acpi-cnt", 2);
     memory_region_add_subregion(parent, 4, &ar->pm1.cnt.io);
 }
 
diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index 4a17f32..8ce52e7 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -205,7 +205,7 @@ static void pm_powerdown_req(Notifier *n, void *opaque)
 void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm,
                   qemu_irq sci_irq)
 {
-    memory_region_init(&pm->io, "ich9-pm", ICH9_PMIO_SIZE);
+    memory_region_init(&pm->io, NULL, "ich9-pm", ICH9_PMIO_SIZE);
     memory_region_set_enabled(&pm->io, false);
     memory_region_add_subregion(pci_address_space_io(lpc_pci),
                                 0, &pm->io);
@@ -215,11 +215,11 @@ void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm,
     acpi_pm1_cnt_init(&pm->acpi_regs, &pm->io, 2);
 
     acpi_gpe_init(&pm->acpi_regs, ICH9_PMIO_GPE0_LEN);
-    memory_region_init_io(&pm->io_gpe, &ich9_gpe_ops, pm, "apci-gpe0",
+    memory_region_init_io(&pm->io_gpe, NULL, &ich9_gpe_ops, pm, "apci-gpe0",
                           ICH9_PMIO_GPE0_LEN);
     memory_region_add_subregion(&pm->io, ICH9_PMIO_GPE0_STS, &pm->io_gpe);
 
-    memory_region_init_io(&pm->io_smi, &ich9_smi_ops, pm, "apci-smi",
+    memory_region_init_io(&pm->io_smi, NULL, &ich9_smi_ops, pm, "apci-smi",
                           8);
     memory_region_add_subregion(&pm->io, ICH9_PMIO_SMI_EN, &pm->io_smi);
 
diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index ff559c0..3b95c69 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -424,7 +424,7 @@ static int piix4_pm_initfn(PCIDevice *dev)
     memory_region_add_subregion(pci_address_space_io(dev),
                                 s->smb_io_base, &s->smb.io);
 
-    memory_region_init(&s->io, "piix4-pm", 64);
+    memory_region_init(&s->io, NULL, "piix4-pm", 64);
     memory_region_set_enabled(&s->io, false);
     memory_region_add_subregion(pci_address_space_io(dev),
                                 0, &s->io);
@@ -671,18 +671,18 @@ static int piix4_device_hotplug(DeviceState *qdev, PCIDevice *dev,
 static void piix4_acpi_system_hot_add_init(MemoryRegion *parent,
                                            PCIBus *bus, PIIX4PMState *s)
 {
-    memory_region_init_io(&s->io_gpe, &piix4_gpe_ops, s, "apci-gpe0",
+    memory_region_init_io(&s->io_gpe, NULL, &piix4_gpe_ops, s, "apci-gpe0",
                           GPE_LEN);
     memory_region_add_subregion(parent, GPE_BASE, &s->io_gpe);
 
-    memory_region_init_io(&s->io_pci, &piix4_pci_ops, s, "apci-pci-hotplug",
+    memory_region_init_io(&s->io_pci, NULL, &piix4_pci_ops, s, "apci-pci-hotplug",
                           PCI_HOTPLUG_SIZE);
     memory_region_add_subregion(parent, PCI_HOTPLUG_ADDR,
                                 &s->io_pci);
     pci_bus_hotplug(bus, piix4_device_hotplug, &s->dev.qdev);
 
     qemu_for_each_cpu(piix4_init_cpu_status, &s->gpe_cpu);
-    memory_region_init_io(&s->io_cpu, &cpu_hotplug_ops, s, "apci-cpu-hotplug",
+    memory_region_init_io(&s->io_cpu, NULL, &cpu_hotplug_ops, s, "apci-cpu-hotplug",
                           PIIX4_PROC_LEN);
     memory_region_add_subregion(parent, PIIX4_PROC_BASE, &s->io_cpu);
     s->cpu_added_notifier.notify = piix4_cpu_added_req;
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 207dcad..99427e8 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -741,7 +741,7 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
 
     /* Main memory region, 0x00.0000.0000.  Real hardware supports 32GB,
        but the address space hole reserved at this point is 8TB.  */
-    memory_region_init_ram(&s->ram_region, "ram", ram_size);
+    memory_region_init_ram(&s->ram_region, NULL, "ram", ram_size);
     vmstate_register_ram_global(&s->ram_region);
     memory_region_add_subregion(addr_space, 0, &s->ram_region);
 
@@ -750,22 +750,22 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
        the flash ROM.  I'm not sure that we need to implement it at all.  */
 
     /* Pchip0 CSRs, 0x801.8000.0000, 256MB.  */
-    memory_region_init_io(&s->pchip.region, &pchip_ops, s, "pchip0", 256*MB);
+    memory_region_init_io(&s->pchip.region, NULL, &pchip_ops, s, "pchip0", 256*MB);
     memory_region_add_subregion(addr_space, 0x80180000000ULL,
                                 &s->pchip.region);
 
     /* Cchip CSRs, 0x801.A000.0000, 256MB.  */
-    memory_region_init_io(&s->cchip.region, &cchip_ops, s, "cchip0", 256*MB);
+    memory_region_init_io(&s->cchip.region, NULL, &cchip_ops, s, "cchip0", 256*MB);
     memory_region_add_subregion(addr_space, 0x801a0000000ULL,
                                 &s->cchip.region);
 
     /* Dchip CSRs, 0x801.B000.0000, 256MB.  */
-    memory_region_init_io(&s->dchip_region, &dchip_ops, s, "dchip0", 256*MB);
+    memory_region_init_io(&s->dchip_region, NULL, &dchip_ops, s, "dchip0", 256*MB);
     memory_region_add_subregion(addr_space, 0x801b0000000ULL,
                                 &s->dchip_region);
 
     /* Pchip0 PCI memory, 0x800.0000.0000, 4GB.  */
-    memory_region_init(&s->pchip.reg_mem, "pci0-mem", 4*GB);
+    memory_region_init(&s->pchip.reg_mem, NULL, "pci0-mem", 4*GB);
     memory_region_add_subregion(addr_space, 0x80000000000ULL,
                                 &s->pchip.reg_mem);
 
@@ -773,7 +773,7 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
     /* ??? Ideally we drop the "system" i/o space on the floor and give the
        PCI subsystem the full address space reserved by the chipset.
        We can't do that until the MEM and IO paths in memory.c are unified.  */
-    memory_region_init_io(&s->pchip.reg_io, &alpha_pci_bw_io_ops, NULL,
+    memory_region_init_io(&s->pchip.reg_io, NULL, &alpha_pci_bw_io_ops, NULL,
                           "pci0-io", 32*MB);
     memory_region_add_subregion(addr_space, 0x801fc000000ULL,
                                 &s->pchip.reg_io);
@@ -784,13 +784,13 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
     phb->bus = b;
 
     /* Pchip0 PCI special/interrupt acknowledge, 0x801.F800.0000, 64MB.  */
-    memory_region_init_io(&s->pchip.reg_iack, &alpha_pci_iack_ops, b,
+    memory_region_init_io(&s->pchip.reg_iack, NULL, &alpha_pci_iack_ops, b,
                           "pci0-iack", 64*MB);
     memory_region_add_subregion(addr_space, 0x801f8000000ULL,
                                 &s->pchip.reg_iack);
 
     /* Pchip0 PCI configuration, 0x801.FE00.0000, 16MB.  */
-    memory_region_init_io(&s->pchip.reg_conf, &alpha_pci_conf1_ops, b,
+    memory_region_init_io(&s->pchip.reg_conf, NULL, &alpha_pci_conf1_ops, b,
                           "pci0-conf", 16*MB);
     memory_region_add_subregion(addr_space, 0x801fe000000ULL,
                                 &s->pchip.reg_conf);
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 93422bc..4b82bba 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -124,7 +124,7 @@ static int bitband_init(SysBusDevice *dev)
 {
     BitBandState *s = FROM_SYSBUS(BitBandState, dev);
 
-    memory_region_init_io(&s->iomem, &bitband_ops, &s->base, "bitband",
+    memory_region_init_io(&s->iomem, NULL, &bitband_ops, &s->base, "bitband",
                           0x02000000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -203,11 +203,11 @@ qemu_irq *armv7m_init(MemoryRegion *address_space_mem,
 #endif
 
     /* Flash programming is done via the SCU, so pretend it is ROM.  */
-    memory_region_init_ram(flash, "armv7m.flash", flash_size);
+    memory_region_init_ram(flash, NULL, "armv7m.flash", flash_size);
     vmstate_register_ram_global(flash);
     memory_region_set_readonly(flash, true);
     memory_region_add_subregion(address_space_mem, 0, flash);
-    memory_region_init_ram(sram, "armv7m.sram", sram_size);
+    memory_region_init_ram(sram, NULL, "armv7m.sram", sram_size);
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, 0x20000000, sram);
     armv7m_bitband_init();
@@ -247,7 +247,7 @@ qemu_irq *armv7m_init(MemoryRegion *address_space_mem,
     /* Hack to map an additional page of ram at the top of the address
        space.  This stops qemu complaining about executing code outside RAM
        when returning from an exception.  */
-    memory_region_init_ram(hack, "armv7m.hack", 0x1000);
+    memory_region_init_ram(hack, NULL, "armv7m.hack", 0x1000);
     vmstate_register_ram_global(hack);
     memory_region_add_subregion(address_space_mem, 0xfffff000, hack);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index 8186f14..216b9b7 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -241,20 +241,20 @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
     /*** Memory ***/
 
     /* Chip-ID and OMR */
-    memory_region_init_io(&s->chipid_mem, &exynos4210_chipid_and_omr_ops,
+    memory_region_init_io(&s->chipid_mem, NULL, &exynos4210_chipid_and_omr_ops,
         NULL, "exynos4210.chipid", sizeof(chipid_and_omr));
     memory_region_add_subregion(system_mem, EXYNOS4210_CHIPID_ADDR,
                                 &s->chipid_mem);
 
     /* Internal ROM */
-    memory_region_init_ram(&s->irom_mem, "exynos4210.irom",
+    memory_region_init_ram(&s->irom_mem, NULL, "exynos4210.irom",
                            EXYNOS4210_IROM_SIZE);
     vmstate_register_ram_global(&s->irom_mem);
     memory_region_set_readonly(&s->irom_mem, true);
     memory_region_add_subregion(system_mem, EXYNOS4210_IROM_BASE_ADDR,
                                 &s->irom_mem);
     /* mirror of iROM */
-    memory_region_init_alias(&s->irom_alias_mem, "exynos4210.irom_alias",
+    memory_region_init_alias(&s->irom_alias_mem, NULL, "exynos4210.irom_alias",
                              &s->irom_mem,
                              0,
                              EXYNOS4210_IROM_SIZE);
@@ -263,7 +263,7 @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
                                 &s->irom_alias_mem);
 
     /* Internal RAM */
-    memory_region_init_ram(&s->iram_mem, "exynos4210.iram",
+    memory_region_init_ram(&s->iram_mem, NULL, "exynos4210.iram",
                            EXYNOS4210_IRAM_SIZE);
     vmstate_register_ram_global(&s->iram_mem);
     memory_region_add_subregion(system_mem, EXYNOS4210_IRAM_BASE_ADDR,
@@ -272,14 +272,14 @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
     /* DRAM */
     mem_size = ram_size;
     if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
-        memory_region_init_ram(&s->dram1_mem, "exynos4210.dram1",
+        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
                 mem_size - EXYNOS4210_DRAM_MAX_SIZE);
         vmstate_register_ram_global(&s->dram1_mem);
         memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
                 &s->dram1_mem);
         mem_size = EXYNOS4210_DRAM_MAX_SIZE;
     }
-    memory_region_init_ram(&s->dram0_mem, "exynos4210.dram0", mem_size);
+    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size);
     vmstate_register_ram_global(&s->dram0_mem);
     memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
             &s->dram0_mem);
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index 4405dbd..c02afce 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -149,7 +149,7 @@ static int highbank_regs_init(SysBusDevice *dev)
     HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, dev);
 
     s->iomem = g_new(MemoryRegion, 1);
-    memory_region_init_io(s->iomem, &hb_mem_ops, s->regs, "highbank_regs",
+    memory_region_init_io(s->iomem, NULL, &hb_mem_ops, s->regs, "highbank_regs",
                           0x1000);
     sysbus_init_mmio(dev, s->iomem);
 
@@ -227,12 +227,12 @@ static void highbank_init(QEMUMachineInitArgs *args)
 
     sysmem = get_system_memory();
     dram = g_new(MemoryRegion, 1);
-    memory_region_init_ram(dram, "highbank.dram", ram_size);
+    memory_region_init_ram(dram, NULL, "highbank.dram", ram_size);
     /* SDRAM at address zero.  */
     memory_region_add_subregion(sysmem, 0, dram);
 
     sysram = g_new(MemoryRegion, 1);
-    memory_region_init_ram(sysram, "highbank.sysram", 0x8000);
+    memory_region_init_ram(sysram, NULL, "highbank.sysram", 0x8000);
     memory_region_add_subregion(sysmem, 0xfff88000, sysram);
     if (bios_name != NULL) {
         sysboot_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index cca2971..436d89b 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -249,10 +249,10 @@ static int integratorcm_init(SysBusDevice *dev)
     }
     memcpy(integrator_spd + 73, "QEMU-MEMORY", 11);
     s->cm_init = 0x00000112;
-    memory_region_init_ram(&s->flash, "integrator.flash", 0x100000);
+    memory_region_init_ram(&s->flash, NULL, "integrator.flash", 0x100000);
     vmstate_register_ram_global(&s->flash);
 
-    memory_region_init_io(&s->iomem, &integratorcm_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &integratorcm_ops, s,
                           "integratorcm", 0x00800000);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -374,7 +374,7 @@ static int icp_pic_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, icp_pic_set_irq, 32);
     sysbus_init_irq(dev, &s->parent_irq);
     sysbus_init_irq(dev, &s->parent_fiq);
-    memory_region_init_io(&s->iomem, &icp_pic_ops, s, "icp-pic", 0x00800000);
+    memory_region_init_io(&s->iomem, NULL, &icp_pic_ops, s, "icp-pic", 0x00800000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
@@ -424,7 +424,7 @@ static void icp_control_init(hwaddr base)
     MemoryRegion *io;
 
     io = (MemoryRegion *)g_malloc0(sizeof(MemoryRegion));
-    memory_region_init_io(io, &icp_control_ops, NULL,
+    memory_region_init_io(io, NULL, &icp_control_ops, NULL,
                           "control", 0x00800000);
     memory_region_add_subregion(get_system_memory(), base, io);
     /* ??? Save/restore.  */
@@ -463,14 +463,14 @@ static void integratorcp_init(QEMUMachineInitArgs *args)
         exit(1);
     }
 
-    memory_region_init_ram(ram, "integrator.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "integrator.ram", ram_size);
     vmstate_register_ram_global(ram);
     /* ??? On a real system the first 1Mb is mapped as SSRAM or boot flash.  */
     /* ??? RAM should repeat to fill physical memory space.  */
     /* SDRAM at address zero*/
     memory_region_add_subregion(address_space_mem, 0, ram);
     /* And again at address 0x80000000 */
-    memory_region_init_alias(ram_alias, "ram.alias", ram, 0, ram_size);
+    memory_region_init_alias(ram_alias, NULL, "ram.alias", ram, 0, ram_size);
     memory_region_add_subregion(address_space_mem, 0x80000000, ram_alias);
 
     dev = qdev_create(NULL, "integrator_core");
diff --git a/hw/arm/kzm.c b/hw/arm/kzm.c
index cf90f5d..bd6c05c 100644
--- a/hw/arm/kzm.c
+++ b/hw/arm/kzm.c
@@ -98,14 +98,14 @@ static void kzm_init(QEMUMachineInitArgs *args)
 
     /* On a real system, the first 16k is a `secure boot rom' */
 
-    memory_region_init_ram(ram, "kzm.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "kzm.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, KZM_RAMADDRESS, ram);
 
-    memory_region_init_alias(ram_alias, "ram.alias", ram, 0, ram_size);
+    memory_region_init_alias(ram_alias, NULL, "ram.alias", ram, 0, ram_size);
     memory_region_add_subregion(address_space_mem, 0x88000000, ram_alias);
 
-    memory_region_init_ram(sram, "kzm.sram", 0x4000);
+    memory_region_init_ram(sram, NULL, "kzm.sram", 0x4000);
     memory_region_add_subregion(address_space_mem, 0x1FFFC000, sram);
 
     cpu_pic = arm_pic_init_cpu(cpu);
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index 260e314..8e5fc26 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -113,7 +113,7 @@ static void mainstone_common_init(MemoryRegion *address_space_mem,
 
     /* Setup CPU & memory */
     mpu = pxa270_init(address_space_mem, mainstone_binfo.ram_size, cpu_model);
-    memory_region_init_ram(rom, "mainstone.rom", MAINSTONE_ROM);
+    memory_region_init_ram(rom, NULL, "mainstone.rom", MAINSTONE_ROM);
     vmstate_register_ram_global(rom);
     memory_region_set_readonly(rom, true);
     memory_region_add_subregion(address_space_mem, 0, rom);
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index fbaf2be..bca8fdf 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -389,7 +389,7 @@ static int mv88w8618_eth_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     s->nic = qemu_new_nic(&net_mv88w8618_info, &s->conf,
                           object_get_typename(OBJECT(dev)), dev->qdev.id, s);
-    memory_region_init_io(&s->iomem, &mv88w8618_eth_ops, s, "mv88w8618-eth",
+    memory_region_init_io(&s->iomem, NULL, &mv88w8618_eth_ops, s, "mv88w8618-eth",
                           MP_ETH_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -612,7 +612,7 @@ static int musicpal_lcd_init(SysBusDevice *dev)
 
     s->brightness = 7;
 
-    memory_region_init_io(&s->iomem, &musicpal_lcd_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &musicpal_lcd_ops, s,
                           "musicpal-lcd", MP_LCD_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -740,7 +740,7 @@ static int mv88w8618_pic_init(SysBusDevice *dev)
 
     qdev_init_gpio_in(&dev->qdev, mv88w8618_pic_set_irq, 32);
     sysbus_init_irq(dev, &s->parent_irq);
-    memory_region_init_io(&s->iomem, &mv88w8618_pic_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &mv88w8618_pic_ops, s,
                           "musicpal-pic", MP_PIC_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -905,7 +905,7 @@ static int mv88w8618_pit_init(SysBusDevice *dev)
         mv88w8618_timer_init(dev, &s->timer[i], 1000000);
     }
 
-    memory_region_init_io(&s->iomem, &mv88w8618_pit_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &mv88w8618_pit_ops, s,
                           "musicpal-pit", MP_PIT_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -999,7 +999,7 @@ static int mv88w8618_flashcfg_init(SysBusDevice *dev)
     mv88w8618_flashcfg_state *s = FROM_SYSBUS(mv88w8618_flashcfg_state, dev);
 
     s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
-    memory_region_init_io(&s->iomem, &mv88w8618_flashcfg_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &mv88w8618_flashcfg_ops, s,
                           "musicpal-flashcfg", MP_FLASHCFG_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -1074,7 +1074,7 @@ static void musicpal_misc_init(Object *obj)
     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
     MusicPalMiscState *s = MUSICPAL_MISC(obj);
 
-    memory_region_init_io(&s->iomem, &musicpal_misc_ops, NULL,
+    memory_region_init_io(&s->iomem, NULL, &musicpal_misc_ops, NULL,
                           "musicpal-misc", MP_MISC_SIZE);
     sysbus_init_mmio(sd, &s->iomem);
 }
@@ -1121,7 +1121,7 @@ static int mv88w8618_wlan_init(SysBusDevice *dev)
 {
     MemoryRegion *iomem = g_new(MemoryRegion, 1);
 
-    memory_region_init_io(iomem, &mv88w8618_wlan_ops, NULL,
+    memory_region_init_io(iomem, NULL, &mv88w8618_wlan_ops, NULL,
                           "musicpal-wlan", MP_WLAN_SIZE);
     sysbus_init_mmio(dev, iomem);
     return 0;
@@ -1327,7 +1327,7 @@ static int musicpal_gpio_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, &musicpal_gpio_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &musicpal_gpio_ops, s,
                           "musicpal-gpio", MP_GPIO_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -1484,7 +1484,7 @@ static int musicpal_key_init(SysBusDevice *dev)
 {
     musicpal_key_state *s = FROM_SYSBUS(musicpal_key_state, dev);
 
-    memory_region_init(&s->iomem, "dummy", 0);
+    memory_region_init(&s->iomem, NULL, "dummy", 0);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->kbd_extended = 0;
@@ -1564,11 +1564,11 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     cpu_pic = arm_pic_init_cpu(cpu);
 
     /* For now we use a fixed - the original - RAM size */
-    memory_region_init_ram(ram, "musicpal.ram", MP_RAM_DEFAULT_SIZE);
+    memory_region_init_ram(ram, NULL, "musicpal.ram", MP_RAM_DEFAULT_SIZE);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, 0, ram);
 
-    memory_region_init_ram(sram, "musicpal.sram", MP_SRAM_SIZE);
+    memory_region_init_ram(sram, NULL, "musicpal.sram", MP_SRAM_SIZE);
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index c06c642..19be5fc 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -264,7 +264,7 @@ static struct omap_mpu_timer_s *omap_mpu_timer_init(MemoryRegion *system_memory,
     omap_mpu_timer_reset(s);
     omap_timer_clk_setup(s);
 
-    memory_region_init_io(&s->iomem, &omap_mpu_timer_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_mpu_timer_ops, s,
                           "omap-mpu-timer", 0x100);
 
     memory_region_add_subregion(system_memory, base, &s->iomem);
@@ -392,7 +392,7 @@ static struct omap_watchdog_timer_s *omap_wd_timer_init(MemoryRegion *memory,
     omap_wd_timer_reset(s);
     omap_timer_clk_setup(&s->timer);
 
-    memory_region_init_io(&s->iomem, &omap_wd_timer_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_wd_timer_ops, s,
                           "omap-wd-timer", 0x100);
     memory_region_add_subregion(memory, base, &s->iomem);
 
@@ -498,7 +498,7 @@ static struct omap_32khz_timer_s *omap_os_timer_init(MemoryRegion *memory,
     omap_os_timer_reset(s);
     omap_timer_clk_setup(&s->timer);
 
-    memory_region_init_io(&s->iomem, &omap_os_timer_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_os_timer_ops, s,
                           "omap-os-timer", 0x800);
     memory_region_add_subregion(memory, base, &s->iomem);
 
@@ -731,7 +731,7 @@ static void omap_ulpd_pm_init(MemoryRegion *system_memory,
                 hwaddr base,
                 struct omap_mpu_state_s *mpu)
 {
-    memory_region_init_io(&mpu->ulpd_pm_iomem, &omap_ulpd_pm_ops, mpu,
+    memory_region_init_io(&mpu->ulpd_pm_iomem, NULL, &omap_ulpd_pm_ops, mpu,
                           "omap-ulpd-pm", 0x800);
     memory_region_add_subregion(system_memory, base, &mpu->ulpd_pm_iomem);
     omap_ulpd_pm_reset(mpu);
@@ -949,7 +949,7 @@ static void omap_pin_cfg_init(MemoryRegion *system_memory,
                 hwaddr base,
                 struct omap_mpu_state_s *mpu)
 {
-    memory_region_init_io(&mpu->pin_cfg_iomem, &omap_pin_cfg_ops, mpu,
+    memory_region_init_io(&mpu->pin_cfg_iomem, NULL, &omap_pin_cfg_ops, mpu,
                           "omap-pin-cfg", 0x800);
     memory_region_add_subregion(system_memory, base, &mpu->pin_cfg_iomem);
     omap_pin_cfg_reset(mpu);
@@ -1021,16 +1021,16 @@ static const MemoryRegionOps omap_id_ops = {
 
 static void omap_id_init(MemoryRegion *memory, struct omap_mpu_state_s *mpu)
 {
-    memory_region_init_io(&mpu->id_iomem, &omap_id_ops, mpu,
+    memory_region_init_io(&mpu->id_iomem, NULL, &omap_id_ops, mpu,
                           "omap-id", 0x100000000ULL);
-    memory_region_init_alias(&mpu->id_iomem_e18, "omap-id-e18", &mpu->id_iomem,
+    memory_region_init_alias(&mpu->id_iomem_e18, NULL, "omap-id-e18", &mpu->id_iomem,
                              0xfffe1800, 0x800);
     memory_region_add_subregion(memory, 0xfffe1800, &mpu->id_iomem_e18);
-    memory_region_init_alias(&mpu->id_iomem_ed4, "omap-id-ed4", &mpu->id_iomem,
+    memory_region_init_alias(&mpu->id_iomem_ed4, NULL, "omap-id-ed4", &mpu->id_iomem,
                              0xfffed400, 0x100);
     memory_region_add_subregion(memory, 0xfffed400, &mpu->id_iomem_ed4);
     if (!cpu_is_omap15xx(mpu)) {
-        memory_region_init_alias(&mpu->id_iomem_ed4, "omap-id-e20",
+        memory_region_init_alias(&mpu->id_iomem_ed4, NULL, "omap-id-e20",
                                  &mpu->id_iomem, 0xfffe2000, 0x800);
         memory_region_add_subregion(memory, 0xfffe2000, &mpu->id_iomem_e20);
     }
@@ -1115,7 +1115,7 @@ static void omap_mpui_reset(struct omap_mpu_state_s *s)
 static void omap_mpui_init(MemoryRegion *memory, hwaddr base,
                 struct omap_mpu_state_s *mpu)
 {
-    memory_region_init_io(&mpu->mpui_iomem, &omap_mpui_ops, mpu,
+    memory_region_init_io(&mpu->mpui_iomem, NULL, &omap_mpui_ops, mpu,
                           "omap-mpui", 0x100);
     memory_region_add_subregion(memory, base, &mpu->mpui_iomem);
 
@@ -1227,7 +1227,7 @@ static struct omap_tipb_bridge_s *omap_tipb_bridge_init(
     s->abort = abort_irq;
     omap_tipb_bridge_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_tipb_bridge_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_tipb_bridge_ops, s,
                           "omap-tipb-bridge", 0x100);
     memory_region_add_subregion(memory, base, &s->iomem);
 
@@ -1336,7 +1336,7 @@ static void omap_tcmi_reset(struct omap_mpu_state_s *mpu)
 static void omap_tcmi_init(MemoryRegion *memory, hwaddr base,
                 struct omap_mpu_state_s *mpu)
 {
-    memory_region_init_io(&mpu->tcmi_iomem, &omap_tcmi_ops, mpu,
+    memory_region_init_io(&mpu->tcmi_iomem, NULL, &omap_tcmi_ops, mpu,
                           "omap-tcmi", 0x100);
     memory_region_add_subregion(memory, base, &mpu->tcmi_iomem);
     omap_tcmi_reset(mpu);
@@ -1418,7 +1418,7 @@ static struct dpll_ctl_s  *omap_dpll_init(MemoryRegion *memory,
                            hwaddr base, omap_clk clk)
 {
     struct dpll_ctl_s *s = g_malloc0(sizeof(*s));
-    memory_region_init_io(&s->iomem, &omap_dpll_ops, s, "omap-dpll", 0x100);
+    memory_region_init_io(&s->iomem, NULL, &omap_dpll_ops, s, "omap-dpll", 0x100);
 
     s->dpll = clk;
     omap_dpll_reset(s);
@@ -1831,9 +1831,9 @@ static void omap_clkm_reset(struct omap_mpu_state_s *s)
 static void omap_clkm_init(MemoryRegion *memory, hwaddr mpu_base,
                 hwaddr dsp_base, struct omap_mpu_state_s *s)
 {
-    memory_region_init_io(&s->clkm_iomem, &omap_clkm_ops, s,
+    memory_region_init_io(&s->clkm_iomem, NULL, &omap_clkm_ops, s,
                           "omap-clkm", 0x100);
-    memory_region_init_io(&s->clkdsp_iomem, &omap_clkdsp_ops, s,
+    memory_region_init_io(&s->clkdsp_iomem, NULL, &omap_clkdsp_ops, s,
                           "omap-clkdsp", 0x1000);
 
     s->clkm.arm_idlect1 = 0x03ff;
@@ -2090,7 +2090,7 @@ static struct omap_mpuio_s *omap_mpuio_init(MemoryRegion *memory,
     s->in = qemu_allocate_irqs(omap_mpuio_set, s, 16);
     omap_mpuio_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_mpuio_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_mpuio_ops, s,
                           "omap-mpuio", 0x800);
     memory_region_add_subregion(memory, base, &s->iomem);
 
@@ -2281,7 +2281,7 @@ static struct omap_uwire_s *omap_uwire_init(MemoryRegion *system_memory,
     s->txdrq = dma;
     omap_uwire_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_uwire_ops, s, "omap-uwire", 0x800);
+    memory_region_init_io(&s->iomem, NULL, &omap_uwire_ops, s, "omap-uwire", 0x800);
     memory_region_add_subregion(system_memory, base, &s->iomem);
 
     return s;
@@ -2393,7 +2393,7 @@ static struct omap_pwl_s *omap_pwl_init(MemoryRegion *system_memory,
 
     omap_pwl_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_pwl_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_pwl_ops, s,
                           "omap-pwl", 0x800);
     memory_region_add_subregion(system_memory, base, &s->iomem);
 
@@ -2500,7 +2500,7 @@ static struct omap_pwt_s *omap_pwt_init(MemoryRegion *system_memory,
     s->clk = clk;
     omap_pwt_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_pwt_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_pwt_ops, s,
                           "omap-pwt", 0x800);
     memory_region_add_subregion(system_memory, base, &s->iomem);
     return s;
@@ -2919,7 +2919,7 @@ static struct omap_rtc_s *omap_rtc_init(MemoryRegion *system_memory,
 
     omap_rtc_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_rtc_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &omap_rtc_ops, s,
                           "omap-rtc", 0x800);
     memory_region_add_subregion(system_memory, base, &s->iomem);
 
@@ -3452,7 +3452,7 @@ static struct omap_mcbsp_s *omap_mcbsp_init(MemoryRegion *system_memory,
     s->source_timer = qemu_new_timer_ns(vm_clock, omap_mcbsp_source_tick, s);
     omap_mcbsp_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_mcbsp_ops, s, "omap-mcbsp", 0x800);
+    memory_region_init_io(&s->iomem, NULL, &omap_mcbsp_ops, s, "omap-mcbsp", 0x800);
     memory_region_add_subregion(system_memory, base, &s->iomem);
 
     return s;
@@ -3627,7 +3627,7 @@ static struct omap_lpg_s *omap_lpg_init(MemoryRegion *system_memory,
 
     omap_lpg_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_lpg_ops, s, "omap-lpg", 0x800);
+    memory_region_init_io(&s->iomem, NULL, &omap_lpg_ops, s, "omap-lpg", 0x800);
     memory_region_add_subregion(system_memory, base, &s->iomem);
 
     omap_clk_adduser(clk, qemu_allocate_irqs(omap_lpg_clk_update, s, 1)[0]);
@@ -3666,7 +3666,7 @@ static const MemoryRegionOps omap_mpui_io_ops = {
 static void omap_setup_mpui_io(MemoryRegion *system_memory,
                                struct omap_mpu_state_s *mpu)
 {
-    memory_region_init_io(&mpu->mpui_io_iomem, &omap_mpui_io_ops, mpu,
+    memory_region_init_io(&mpu->mpui_io_iomem, NULL, &omap_mpui_io_ops, mpu,
                           "omap-mpui-io", 0x7fff);
     memory_region_add_subregion(system_memory, OMAP_MPUI_BASE,
                                 &mpu->mpui_io_iomem);
@@ -3747,7 +3747,7 @@ static void omap_setup_dsp_mapping(MemoryRegion *system_memory,
 
     for (; map->phys_dsp; map ++) {
         io = g_new(MemoryRegion, 1);
-        memory_region_init_alias(io, map->name,
+        memory_region_init_alias(io, NULL, map->name,
                                  system_memory, map->phys_mpu, map->size);
         memory_region_add_subregion(system_memory, map->phys_dsp, io);
     }
@@ -3851,10 +3851,10 @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
     omap_clk_init(s);
 
     /* Memory-mapped stuff */
-    memory_region_init_ram(&s->emiff_ram, "omap1.dram", s->sdram_size);
+    memory_region_init_ram(&s->emiff_ram, NULL, "omap1.dram", s->sdram_size);
     vmstate_register_ram_global(&s->emiff_ram);
     memory_region_add_subregion(system_memory, OMAP_EMIFF_BASE, &s->emiff_ram);
-    memory_region_init_ram(&s->imif_ram, "omap1.sram", s->sram_size);
+    memory_region_init_ram(&s->imif_ram, NULL, "omap1.sram", s->sram_size);
     vmstate_register_ram_global(&s->imif_ram);
     memory_region_add_subregion(system_memory, OMAP_IMIF_BASE, &s->imif_ram);
 
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index 2ff4371..ec9610b 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -603,7 +603,7 @@ static struct omap_eac_s *omap_eac_init(struct omap_target_agent_s *ta,
 
     AUD_register_card("OMAP EAC", &s->codec.card);
 
-    memory_region_init_io(&s->iomem, &omap_eac_ops, s, "omap.eac",
+    memory_region_init_io(&s->iomem, NULL, &omap_eac_ops, s, "omap.eac",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
 
@@ -791,11 +791,11 @@ static struct omap_sti_s *omap_sti_init(struct omap_target_agent_s *ta,
 
     s->chr = chr ?: qemu_chr_new("null", "null", NULL);
 
-    memory_region_init_io(&s->iomem, &omap_sti_ops, s, "omap.sti",
+    memory_region_init_io(&s->iomem, NULL, &omap_sti_ops, s, "omap.sti",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
 
-    memory_region_init_io(&s->iomem_fifo, &omap_sti_fifo_ops, s,
+    memory_region_init_io(&s->iomem_fifo, NULL, &omap_sti_fifo_ops, s,
                           "omap.sti.fifo", 0x10000);
     memory_region_add_subregion(sysmem, channel_base, &s->iomem_fifo);
 
@@ -1809,9 +1809,9 @@ static struct omap_prcm_s *omap_prcm_init(struct omap_target_agent_s *ta,
     s->mpu = mpu;
     omap_prcm_coldreset(s);
 
-    memory_region_init_io(&s->iomem0, &omap_prcm_ops, s, "omap.pcrm0",
+    memory_region_init_io(&s->iomem0, NULL, &omap_prcm_ops, s, "omap.pcrm0",
                           omap_l4_region_size(ta, 0));
-    memory_region_init_io(&s->iomem1, &omap_prcm_ops, s, "omap.pcrm1",
+    memory_region_init_io(&s->iomem1, NULL, &omap_prcm_ops, s, "omap.pcrm1",
                           omap_l4_region_size(ta, 1));
     omap_l4_attach(ta, 0, &s->iomem0);
     omap_l4_attach(ta, 1, &s->iomem1);
@@ -2185,7 +2185,7 @@ static struct omap_sysctl_s *omap_sysctl_init(struct omap_target_agent_s *ta,
     s->mpu = mpu;
     omap_sysctl_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_sysctl_ops, s, "omap.sysctl",
+    memory_region_init_io(&s->iomem, NULL, &omap_sysctl_ops, s, "omap.sysctl",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
 
@@ -2267,10 +2267,10 @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
     omap_clk_init(s);
 
     /* Memory-mapped stuff */
-    memory_region_init_ram(&s->sdram, "omap2.dram", s->sdram_size);
+    memory_region_init_ram(&s->sdram, NULL, "omap2.dram", s->sdram_size);
     vmstate_register_ram_global(&s->sdram);
     memory_region_add_subregion(sysmem, OMAP2_Q2_BASE, &s->sdram);
-    memory_region_init_ram(&s->sram, "omap2.sram", s->sram_size);
+    memory_region_init_ram(&s->sram, NULL, "omap2.sram", s->sram_size);
     vmstate_register_ram_global(&s->sram);
     memory_region_add_subregion(sysmem, OMAP2_SRAM_BASE, &s->sram);
 
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index e421ece..05b0353 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -120,23 +120,23 @@ static void sx1_init(QEMUMachineInitArgs *args, const int version)
     mpu = omap310_mpu_init(address_space, sx1_binfo.ram_size, args->cpu_model);
 
     /* External Flash (EMIFS) */
-    memory_region_init_ram(flash, "omap_sx1.flash0-0", flash_size);
+    memory_region_init_ram(flash, NULL, "omap_sx1.flash0-0", flash_size);
     vmstate_register_ram_global(flash);
     memory_region_set_readonly(flash, true);
     memory_region_add_subregion(address_space, OMAP_CS0_BASE, flash);
 
-    memory_region_init_io(&cs[0], &static_ops, &cs0val,
+    memory_region_init_io(&cs[0], NULL, &static_ops, &cs0val,
                           "sx1.cs0", OMAP_CS0_SIZE - flash_size);
     memory_region_add_subregion(address_space,
                                 OMAP_CS0_BASE + flash_size, &cs[0]);
 
 
-    memory_region_init_io(&cs[2], &static_ops, &cs2val,
+    memory_region_init_io(&cs[2], NULL, &static_ops, &cs2val,
                           "sx1.cs2", OMAP_CS2_SIZE);
     memory_region_add_subregion(address_space,
                                 OMAP_CS2_BASE, &cs[2]);
 
-    memory_region_init_io(&cs[3], &static_ops, &cs3val,
+    memory_region_init_io(&cs[3], NULL, &static_ops, &cs3val,
                           "sx1.cs3", OMAP_CS3_SIZE);
     memory_region_add_subregion(address_space,
                                 OMAP_CS2_BASE, &cs[3]);
@@ -162,12 +162,12 @@ static void sx1_init(QEMUMachineInitArgs *args, const int version)
 
     if ((version == 1) &&
             (dinfo = drive_get(IF_PFLASH, 0, fl_idx)) != NULL) {
-        memory_region_init_ram(flash_1, "omap_sx1.flash1-0", flash1_size);
+        memory_region_init_ram(flash_1, NULL, "omap_sx1.flash1-0", flash1_size);
         vmstate_register_ram_global(flash_1);
         memory_region_set_readonly(flash_1, true);
         memory_region_add_subregion(address_space, OMAP_CS1_BASE, flash_1);
 
-        memory_region_init_io(&cs[1], &static_ops, &cs1val,
+        memory_region_init_io(&cs[1], NULL, &static_ops, &cs1val,
                               "sx1.cs1", OMAP_CS1_SIZE - flash1_size);
         memory_region_add_subregion(address_space,
                                 OMAP_CS1_BASE + flash1_size, &cs[1]);
@@ -182,7 +182,7 @@ static void sx1_init(QEMUMachineInitArgs *args, const int version)
         }
         fl_idx++;
     } else {
-        memory_region_init_io(&cs[1], &static_ops, &cs1val,
+        memory_region_init_io(&cs[1], NULL, &static_ops, &cs1val,
                               "sx1.cs1", OMAP_CS1_SIZE);
         memory_region_add_subregion(address_space,
                                 OMAP_CS1_BASE, &cs[1]);
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index b13d810..cdc3c3a 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -211,22 +211,22 @@ static void palmte_init(QEMUMachineInitArgs *args)
     mpu = omap310_mpu_init(address_space_mem, sdram_size, cpu_model);
 
     /* External Flash (EMIFS) */
-    memory_region_init_ram(flash, "palmte.flash", flash_size);
+    memory_region_init_ram(flash, NULL, "palmte.flash", flash_size);
     vmstate_register_ram_global(flash);
     memory_region_set_readonly(flash, true);
     memory_region_add_subregion(address_space_mem, OMAP_CS0_BASE, flash);
 
-    memory_region_init_io(&cs[0], &static_ops, &cs0val, "palmte-cs0",
+    memory_region_init_io(&cs[0], NULL, &static_ops, &cs0val, "palmte-cs0",
                           OMAP_CS0_SIZE - flash_size);
     memory_region_add_subregion(address_space_mem, OMAP_CS0_BASE + flash_size,
                                 &cs[0]);
-    memory_region_init_io(&cs[1], &static_ops, &cs1val, "palmte-cs1",
+    memory_region_init_io(&cs[1], NULL, &static_ops, &cs1val, "palmte-cs1",
                           OMAP_CS1_SIZE);
     memory_region_add_subregion(address_space_mem, OMAP_CS1_BASE, &cs[1]);
-    memory_region_init_io(&cs[2], &static_ops, &cs2val, "palmte-cs2",
+    memory_region_init_io(&cs[2], NULL, &static_ops, &cs2val, "palmte-cs2",
                           OMAP_CS2_SIZE);
     memory_region_add_subregion(address_space_mem, OMAP_CS2_BASE, &cs[2]);
-    memory_region_init_io(&cs[3], &static_ops, &cs3val, "palmte-cs3",
+    memory_region_init_io(&cs[3], NULL, &static_ops, &cs3val, "palmte-cs3",
                           OMAP_CS3_SIZE);
     memory_region_add_subregion(address_space_mem, OMAP_CS3_BASE, &cs[3]);
 
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 24b03a0..d046edc 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -764,7 +764,7 @@ static int pxa2xx_ssp_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, &pxa2xx_ssp_ops, s, "pxa2xx-ssp", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_ssp_ops, s, "pxa2xx-ssp", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     register_savevm(&dev->qdev, "pxa2xx_ssp", -1, 0,
                     pxa2xx_ssp_save, pxa2xx_ssp_load, s);
@@ -1131,7 +1131,7 @@ static int pxa2xx_rtc_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->rtc_irq);
 
-    memory_region_init_io(&s->iomem, &pxa2xx_rtc_ops, s, "pxa2xx-rtc", 0x10000);
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_rtc_ops, s, "pxa2xx-rtc", 0x10000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
@@ -1481,7 +1481,7 @@ static int pxa2xx_i2c_initfn(SysBusDevice *dev)
 
     s->bus = i2c_init_bus(&dev->qdev, "i2c");
 
-    memory_region_init_io(&s->iomem, &pxa2xx_i2c_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_i2c_ops, s,
                           "pxa2xx-i2x", s->region_size);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
@@ -1720,7 +1720,7 @@ static PXA2xxI2SState *pxa2xx_i2s_init(MemoryRegion *sysmem,
 
     pxa2xx_i2s_reset(s);
 
-    memory_region_init_io(&s->iomem, &pxa2xx_i2s_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_i2s_ops, s,
                           "pxa2xx-i2s", 0x100000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
@@ -1978,7 +1978,7 @@ static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
 
     pxa2xx_fir_reset(s);
 
-    memory_region_init_io(&s->iomem, &pxa2xx_fir_ops, s, "pxa2xx-fir", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_fir_ops, s, "pxa2xx-fir", 0x1000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     if (chr) {
@@ -2027,10 +2027,10 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->reset = qemu_allocate_irqs(pxa2xx_reset, s, 1)[0];
 
     /* SDRAM & Internal Memory Storage */
-    memory_region_init_ram(&s->sdram, "pxa270.sdram", sdram_size);
+    memory_region_init_ram(&s->sdram, NULL, "pxa270.sdram", sdram_size);
     vmstate_register_ram_global(&s->sdram);
     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
-    memory_region_init_ram(&s->internal, "pxa270.internal", 0x40000);
+    memory_region_init_ram(&s->internal, NULL, "pxa270.internal", 0x40000);
     vmstate_register_ram_global(&s->internal);
     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
                                 &s->internal);
@@ -2083,7 +2083,7 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->cm_base = 0x41300000;
     s->cm_regs[CCCR >> 2] = 0x02000210;	/* 416.0 MHz */
     s->clkcfg = 0x00000009;		/* Turbo mode active */
-    memory_region_init_io(&s->cm_iomem, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
+    memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
 
@@ -2093,12 +2093,12 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->mm_regs[MDMRS >> 2] = 0x00020002;
     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
-    memory_region_init_io(&s->mm_iomem, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
+    memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
 
     s->pm_base = 0x40f00000;
-    memory_region_init_io(&s->pm_iomem, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
+    memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
@@ -2158,10 +2158,10 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->reset = qemu_allocate_irqs(pxa2xx_reset, s, 1)[0];
 
     /* SDRAM & Internal Memory Storage */
-    memory_region_init_ram(&s->sdram, "pxa255.sdram", sdram_size);
+    memory_region_init_ram(&s->sdram, NULL, "pxa255.sdram", sdram_size);
     vmstate_register_ram_global(&s->sdram);
     memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram);
-    memory_region_init_ram(&s->internal, "pxa255.internal",
+    memory_region_init_ram(&s->internal, NULL, "pxa255.internal",
                            PXA2XX_INTERNAL_SIZE);
     vmstate_register_ram_global(&s->internal);
     memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE,
@@ -2214,7 +2214,7 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->cm_base = 0x41300000;
     s->cm_regs[CCCR >> 2] = 0x02000210;	/* 416.0 MHz */
     s->clkcfg = 0x00000009;		/* Turbo mode active */
-    memory_region_init_io(&s->cm_iomem, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
+    memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, "pxa2xx-cm", 0x1000);
     memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem);
     vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s);
 
@@ -2224,12 +2224,12 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->mm_regs[MDMRS >> 2] = 0x00020002;
     s->mm_regs[MDREFR >> 2] = 0x03ca4000;
     s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */
-    memory_region_init_io(&s->mm_iomem, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
+    memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, "pxa2xx-mm", 0x1000);
     memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem);
     vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s);
 
     s->pm_base = 0x40f00000;
-    memory_region_init_io(&s->pm_iomem, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
+    memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, "pxa2xx-pm", 0x100);
     memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem);
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
diff --git a/hw/arm/pxa2xx_gpio.c b/hw/arm/pxa2xx_gpio.c
index fa31575..abf41dc 100644
--- a/hw/arm/pxa2xx_gpio.c
+++ b/hw/arm/pxa2xx_gpio.c
@@ -283,7 +283,7 @@ static int pxa2xx_gpio_initfn(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, pxa2xx_gpio_set, s->lines);
     qdev_init_gpio_out(&dev->qdev, s->handler, s->lines);
 
-    memory_region_init_io(&s->iomem, &pxa_gpio_ops, s, "pxa2xx-gpio", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pxa_gpio_ops, s, "pxa2xx-gpio", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq0);
     sysbus_init_irq(dev, &s->irq1);
diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
index 835d07c..042d422 100644
--- a/hw/arm/pxa2xx_pic.c
+++ b/hw/arm/pxa2xx_pic.c
@@ -278,7 +278,7 @@ DeviceState *pxa2xx_pic_init(hwaddr base, ARMCPU *cpu)
     qdev_init_gpio_in(dev, pxa2xx_pic_set_irq, PXA2XX_PIC_SRCS);
 
     /* Enable IC memory-mapped registers access.  */
-    memory_region_init_io(&s->iomem, &pxa2xx_pic_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_pic_ops, s,
                           "pxa2xx-pic", 0x00100000);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index d6f47bf..1e6c1dd 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -114,18 +114,18 @@ static void realview_init(QEMUMachineInitArgs *args,
         /* Core tile RAM.  */
         low_ram_size = ram_size - 0x20000000;
         ram_size = 0x20000000;
-        memory_region_init_ram(ram_lo, "realview.lowmem", low_ram_size);
+        memory_region_init_ram(ram_lo, NULL, "realview.lowmem", low_ram_size);
         vmstate_register_ram_global(ram_lo);
         memory_region_add_subregion(sysmem, 0x20000000, ram_lo);
     }
 
-    memory_region_init_ram(ram_hi, "realview.highmem", ram_size);
+    memory_region_init_ram(ram_hi, NULL, "realview.highmem", ram_size);
     vmstate_register_ram_global(ram_hi);
     low_ram_size = ram_size;
     if (low_ram_size > 0x10000000)
       low_ram_size = 0x10000000;
     /* SDRAM at address zero.  */
-    memory_region_init_alias(ram_alias, "realview.alias",
+    memory_region_init_alias(ram_alias, NULL, "realview.alias",
                              ram_hi, 0, low_ram_size);
     memory_region_add_subregion(sysmem, 0, ram_alias);
     if (is_pb) {
@@ -318,7 +318,7 @@ static void realview_init(QEMUMachineInitArgs *args,
        startup code.  I guess this works on real hardware because the
        BootROM happens to be in ROM/flash or in memory that isn't clobbered
        until after Linux boots the secondary CPUs.  */
-    memory_region_init_ram(ram_hack, "realview.hack", 0x1000);
+    memory_region_init_ram(ram_hack, NULL, "realview.hack", 0x1000);
     vmstate_register_ram_global(ram_hack);
     memory_region_add_subregion(sysmem, SMP_BOOT_ADDR, ram_hack);
 
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index b5ed109..60ad30d 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -169,7 +169,7 @@ static int sl_nand_init(SysBusDevice *dev) {
     nand = drive_get(IF_MTD, 0, 0);
     s->nand = nand_init(nand ? nand->bdrv : NULL, s->manf_id, s->chip_id);
 
-    memory_region_init_io(&s->iomem, &sl_ops, s, "sl", 0x40);
+    memory_region_init_io(&s->iomem, NULL, &sl_ops, s, "sl", 0x40);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
@@ -896,7 +896,7 @@ static void spitz_common_init(QEMUMachineInitArgs *args,
 
     sl_flash_register(mpu, (model == spitz) ? FLASH_128M : FLASH_1024M);
 
-    memory_region_init_ram(rom, "spitz.rom", SPITZ_ROM);
+    memory_region_init_ram(rom, NULL, "spitz.rom", SPITZ_ROM);
     vmstate_register_ram_global(rom);
     memory_region_set_readonly(rom, true);
     memory_region_add_subregion(address_space_mem, 0, rom);
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 2b61e3c..30e7b76 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -307,7 +307,7 @@ static int stellaris_gptm_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     qdev_init_gpio_out(&dev->qdev, &s->trigger, 1);
 
-    memory_region_init_io(&s->iomem, &gptm_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &gptm_ops, s,
                           "gptm", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -669,7 +669,7 @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
     s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
     s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
 
-    memory_region_init_io(&s->iomem, &ssys_ops, s, "ssys", 0x00001000);
+    memory_region_init_io(&s->iomem, NULL, &ssys_ops, s, "ssys", 0x00001000);
     memory_region_add_subregion(get_system_memory(), base, &s->iomem);
     ssys_reset(s);
     vmstate_register(NULL, -1, &vmstate_stellaris_sys, s);
@@ -862,7 +862,7 @@ static int stellaris_i2c_init(SysBusDevice * dev)
     bus = i2c_init_bus(&dev->qdev, "i2c");
     s->bus = bus;
 
-    memory_region_init_io(&s->iomem, &stellaris_i2c_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &stellaris_i2c_ops, s,
                           "i2c", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     /* ??? For now we only implement the master interface.  */
@@ -1145,7 +1145,7 @@ static int stellaris_adc_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->irq[n]);
     }
 
-    memory_region_init_io(&s->iomem, &stellaris_adc_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &stellaris_adc_ops, s,
                           "adc", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     stellaris_adc_reset(s);
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 4d49306..0f5a545 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -173,7 +173,7 @@ static int strongarm_pic_initfn(SysBusDevice *dev)
     StrongARMPICState *s = FROM_SYSBUS(StrongARMPICState, dev);
 
     qdev_init_gpio_in(&dev->qdev, strongarm_pic_set_irq, SA_PIC_SRCS);
-    memory_region_init_io(&s->iomem, &strongarm_pic_ops, s, "pic", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &strongarm_pic_ops, s, "pic", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     sysbus_init_irq(dev, &s->fiq);
@@ -383,7 +383,7 @@ static int strongarm_rtc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->rtc_irq);
     sysbus_init_irq(dev, &s->rtc_hz_irq);
 
-    memory_region_init_io(&s->iomem, &strongarm_rtc_ops, s, "rtc", 0x10000);
+    memory_region_init_io(&s->iomem, NULL, &strongarm_rtc_ops, s, "rtc", 0x10000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
@@ -637,7 +637,7 @@ static int strongarm_gpio_initfn(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, strongarm_gpio_set, 28);
     qdev_init_gpio_out(&dev->qdev, s->handler, 28);
 
-    memory_region_init_io(&s->iomem, &strongarm_gpio_ops, s, "gpio", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &strongarm_gpio_ops, s, "gpio", 0x1000);
 
     sysbus_init_mmio(dev, &s->iomem);
     for (i = 0; i < 11; i++) {
@@ -808,7 +808,7 @@ static int strongarm_ppc_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, strongarm_ppc_set, 22);
     qdev_init_gpio_out(&dev->qdev, s->handler, 22);
 
-    memory_region_init_io(&s->iomem, &strongarm_ppc_ops, s, "ppc", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &strongarm_ppc_ops, s, "ppc", 0x1000);
 
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -1204,7 +1204,7 @@ static int strongarm_uart_init(SysBusDevice *dev)
 {
     StrongARMUARTState *s = FROM_SYSBUS(StrongARMUARTState, dev);
 
-    memory_region_init_io(&s->iomem, &strongarm_uart_ops, s, "uart", 0x10000);
+    memory_region_init_io(&s->iomem, NULL, &strongarm_uart_ops, s, "uart", 0x10000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
@@ -1496,7 +1496,7 @@ static int strongarm_ssp_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, &strongarm_ssp_ops, s, "ssp", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &strongarm_ssp_ops, s, "ssp", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->bus = ssi_create_bus(&dev->qdev, "ssi");
@@ -1571,7 +1571,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
         exit(1);
     }
 
-    memory_region_init_ram(&s->sdram, "strongarm.sdram", sdram_size);
+    memory_region_init_ram(&s->sdram, NULL, "strongarm.sdram", sdram_size);
     vmstate_register_ram_global(&s->sdram);
     memory_region_add_subregion(sysmem, SA_SDCS0, &s->sdram);
 
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index 47818a5..47d1f4f 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -222,7 +222,7 @@ static void tosa_init(QEMUMachineInitArgs *args)
 
     mpu = pxa255_init(address_space_mem, tosa_binfo.ram_size);
 
-    memory_region_init_ram(rom, "tosa.rom", TOSA_ROM);
+    memory_region_init_ram(rom, NULL, "tosa.rom", TOSA_ROM);
     vmstate_register_ram_global(rom);
     memory_region_set_readonly(rom, true);
     memory_region_add_subregion(address_space_mem, 0, rom);
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 753757e..cc06165 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -154,7 +154,7 @@ static int vpb_sic_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->parent[i]);
     }
     s->irq = 31;
-    memory_region_init_io(&s->iomem, &vpb_sic_ops, s, "vpb-sic", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &vpb_sic_ops, s, "vpb-sic", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
@@ -193,7 +193,7 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    memory_region_init_ram(ram, "versatile.ram", args->ram_size);
+    memory_region_init_ram(ram, NULL, "versatile.ram", args->ram_size);
     vmstate_register_ram_global(ram);
     /* ??? RAM should repeat to fill physical memory space.  */
     /* SDRAM at address zero.  */
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index a077c62..710413e 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -196,7 +196,7 @@ static void a9_daughterboard_init(const VEDBoardInfo *daughterboard,
         exit(1);
     }
 
-    memory_region_init_ram(ram, "vexpress.highmem", ram_size);
+    memory_region_init_ram(ram, NULL, "vexpress.highmem", ram_size);
     vmstate_register_ram_global(ram);
     low_ram_size = ram_size;
     if (low_ram_size > 0x4000000) {
@@ -206,7 +206,7 @@ static void a9_daughterboard_init(const VEDBoardInfo *daughterboard,
      * address space should in theory be remappable to various
      * things including ROM or RAM; we always map the RAM there.
      */
-    memory_region_init_alias(lowram, "vexpress.lowmem", ram, 0, low_ram_size);
+    memory_region_init_alias(lowram, NULL, "vexpress.lowmem", ram, 0, low_ram_size);
     memory_region_add_subregion(sysmem, 0x0, lowram);
     memory_region_add_subregion(sysmem, 0x60000000, ram);
 
@@ -323,7 +323,7 @@ static void a15_daughterboard_init(const VEDBoardInfo *daughterboard,
         }
     }
 
-    memory_region_init_ram(ram, "vexpress.highmem", ram_size);
+    memory_region_init_ram(ram, NULL, "vexpress.highmem", ram_size);
     vmstate_register_ram_global(ram);
     /* RAM is from 0x80000000 upwards; there is no low-memory alias for it. */
     memory_region_add_subregion(sysmem, 0x80000000, ram);
@@ -357,7 +357,7 @@ static void a15_daughterboard_init(const VEDBoardInfo *daughterboard,
     /* 0x2b060000: SP805 watchdog: not modelled */
     /* 0x2b0a0000: PL341 dynamic memory controller: not modelled */
     /* 0x2e000000: system SRAM */
-    memory_region_init_ram(sram, "vexpress.a15sram", 0x10000);
+    memory_region_init_ram(sram, NULL, "vexpress.a15sram", 0x10000);
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(sysmem, 0x2e000000, sram);
 
@@ -491,12 +491,12 @@ static void vexpress_common_init(const VEDBoardInfo *daughterboard,
     }
 
     sram_size = 0x2000000;
-    memory_region_init_ram(sram, "vexpress.sram", sram_size);
+    memory_region_init_ram(sram, NULL, "vexpress.sram", sram_size);
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(sysmem, map[VE_SRAM], sram);
 
     vram_size = 0x800000;
-    memory_region_init_ram(vram, "vexpress.vram", vram_size);
+    memory_region_init_ram(vram, NULL, "vexpress.vram", vram_size);
     vmstate_register_ram_global(vram);
     memory_region_add_subregion(sysmem, map[VE_VIDEORAM], vram);
 
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index 4602a6f..0dc0871 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -132,12 +132,12 @@ static void zynq_init(QEMUMachineInitArgs *args)
     }
 
     /* DDR remapped to address zero.  */
-    memory_region_init_ram(ext_ram, "zynq.ext_ram", ram_size);
+    memory_region_init_ram(ext_ram, NULL, "zynq.ext_ram", ram_size);
     vmstate_register_ram_global(ext_ram);
     memory_region_add_subregion(address_space_mem, 0, ext_ram);
 
     /* 256K of on-chip memory */
-    memory_region_init_ram(ocm_ram, "zynq.ocm_ram", 256 << 10);
+    memory_region_init_ram(ocm_ram, NULL, "zynq.ocm_ram", 256 << 10);
     vmstate_register_ram_global(ocm_ram);
     memory_region_add_subregion(address_space_mem, 0xFFFC0000, ocm_ram);
 
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index baf138b..47e6f19 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1378,8 +1378,8 @@ static int ac97_initfn (PCIDevice *dev)
     c[PCI_INTERRUPT_LINE] = 0x00;      /* intr_ln interrupt line rw */
     c[PCI_INTERRUPT_PIN] = 0x01;      /* intr_pn interrupt pin ro */
 
-    memory_region_init_io (&s->io_nam, &ac97_io_nam_ops, s, "ac97-nam", 1024);
-    memory_region_init_io (&s->io_nabm, &ac97_io_nabm_ops, s, "ac97-nabm", 256);
+    memory_region_init_io (&s->io_nam, NULL, &ac97_io_nam_ops, s, "ac97-nam", 1024);
+    memory_region_init_io (&s->io_nabm, NULL, &ac97_io_nabm_ops, s, "ac97-nabm", 256);
     pci_register_bar (&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_nam);
     pci_register_bar (&s->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &s->io_nabm);
     qemu_register_reset (ac97_on_reset, s);
diff --git a/hw/audio/cs4231.c b/hw/audio/cs4231.c
index 2975336..fb9b700 100644
--- a/hw/audio/cs4231.c
+++ b/hw/audio/cs4231.c
@@ -144,7 +144,7 @@ static int cs4231_init1(SysBusDevice *dev)
 {
     CSState *s = FROM_SYSBUS(CSState, dev);
 
-    memory_region_init_io(&s->iomem, &cs_mem_ops, s, "cs4321", CS_SIZE);
+    memory_region_init_io(&s->iomem, NULL, &cs_mem_ops, s, "cs4321", CS_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 605dad4..c31da2e 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -648,7 +648,7 @@ static void cs4231a_initfn (Object *obj)
 {
     CSState *s = CS4231A (obj);
 
-    memory_region_init_io (&s->ioports, &cs_ioport_ops, s, "cs4231a", 4);
+    memory_region_init_io (&s->ioports, NULL, &cs_ioport_ops, s, "cs4231a", 4);
 }
 
 static void cs4231a_realizefn (DeviceState *dev, Error **errp)
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index c1cd169..b953df2 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -1035,7 +1035,7 @@ static int es1370_initfn (PCIDevice *dev)
     c[PCI_MIN_GNT] = 0x0c;
     c[PCI_MAX_LAT] = 0x80;
 
-    memory_region_init_io (&s->io, &es1370_io_ops, s, "es1370", 256);
+    memory_region_init_io (&s->io, NULL, &es1370_io_ops, s, "es1370", 256);
     pci_register_bar (&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
     qemu_register_reset (es1370_on_reset, s);
 
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 3ac90d5..e94602f 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1135,7 +1135,7 @@ static int intel_hda_init(PCIDevice *pci)
     /* HDCTL off 0x40 bit 0 selects signaling mode (1-HDA, 0 - Ac97) 18.1.19 */
     conf[0x40] = 0x01;
 
-    memory_region_init_io(&d->mmio, &intel_hda_mmio_ops, d,
+    memory_region_init_io(&d->mmio, NULL, &intel_hda_mmio_ops, d,
                           "intel-hda", 0x4000);
     pci_register_bar(&d->pci, 0, 0, &d->mmio);
     if (d->msi) {
diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index c5d88a7..e04e932 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -244,7 +244,7 @@ static int mv88w8618_audio_init(SysBusDevice *dev)
 
     wm8750_data_req_set(s->wm, mv88w8618_audio_callback, s);
 
-    memory_region_init_io(&s->iomem, &mv88w8618_audio_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &mv88w8618_audio_ops, s,
                           "audio", MP_AUDIO_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/audio/milkymist-ac97.c b/hw/audio/milkymist-ac97.c
index e08e9dc..79a00fd 100644
--- a/hw/audio/milkymist-ac97.c
+++ b/hw/audio/milkymist-ac97.c
@@ -300,7 +300,7 @@ static int milkymist_ac97_init(SysBusDevice *dev)
     s->voice_out = AUD_open_out(&s->card, s->voice_out,
             "mm_ac97.out", s, ac97_out_cb, &as);
 
-    memory_region_init_io(&s->regs_region, &ac97_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &ac97_mmio_ops, s,
             "milkymist-ac97", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 5dde0e7..123793b 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -167,7 +167,7 @@ static void pcspk_initfn(Object *obj)
 {
     PCSpkState *s = PC_SPEAKER(obj);
 
-    memory_region_init_io(&s->ioport, &pcspk_io_ops, s, "elcr", 1);
+    memory_region_init_io(&s->ioport, NULL, &pcspk_io_ops, s, "elcr", 1);
 }
 
 static void pcspk_realizefn(DeviceState *dev, Error **errp)
diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index 653ab4f..5dd18c7 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -543,7 +543,7 @@ static int pl041_init(SysBusDevice *dev)
     }
 
     /* Connect the device to the sysbus */
-    memory_region_init_io(&s->iomem, &pl041_ops, s, "pl041", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl041_ops, s, "pl041", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 930f191..1bec805 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -2149,7 +2149,7 @@ static int sysbus_fdc_init1(SysBusDevice *dev)
     FDCtrl *fdctrl = &sys->state;
     int ret;
 
-    memory_region_init_io(&fdctrl->iomem, &fdctrl_mem_ops, fdctrl, "fdc", 0x08);
+    memory_region_init_io(&fdctrl->iomem, NULL, &fdctrl_mem_ops, fdctrl, "fdc", 0x08);
     sysbus_init_mmio(dev, &fdctrl->iomem);
     sysbus_init_irq(dev, &fdctrl->irq);
     qdev_init_gpio_in(&dev->qdev, fdctrl_handle_tc, 1);
@@ -2165,7 +2165,7 @@ static int sun4m_fdc_init1(SysBusDevice *dev)
 {
     FDCtrl *fdctrl = &(FROM_SYSBUS(FDCtrlSysBus, dev)->state);
 
-    memory_region_init_io(&fdctrl->iomem, &fdctrl_mem_strict_ops, fdctrl,
+    memory_region_init_io(&fdctrl->iomem, NULL, &fdctrl_mem_strict_ops, fdctrl,
                           "fdctrl", 0x08);
     sysbus_init_mmio(dev, &fdctrl->iomem);
     sysbus_init_irq(dev, &fdctrl->irq);
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 58b0d91..aa3d9a9 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -777,7 +777,7 @@ static int nvme_init(PCIDevice *pci_dev)
     n->sq = g_malloc0(sizeof(*n->sq)*n->num_queues);
     n->cq = g_malloc0(sizeof(*n->cq)*n->num_queues);
 
-    memory_region_init_io(&n->iomem, &nvme_mmio_ops, n, "nvme", n->reg_size);
+    memory_region_init_io(&n->iomem, NULL, &nvme_mmio_ops, n, "nvme", n->reg_size);
     pci_register_bar(&n->parent_obj, 0,
         PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64,
         &n->iomem);
diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index 8b511a7..edbce3c 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -113,9 +113,9 @@ static void onenand_mem_setup(OneNANDState *s)
     /* XXX: We should use IO_MEM_ROMD but we broke it earlier...
      * Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
      * write boot commands.  Also take note of the BWPS bit.  */
-    memory_region_init(&s->container, "onenand", 0x10000 << s->shift);
+    memory_region_init(&s->container, NULL, "onenand", 0x10000 << s->shift);
     memory_region_add_subregion(&s->container, 0, &s->iomem);
-    memory_region_init_alias(&s->mapped_ram, "onenand-mapped-ram",
+    memory_region_init_alias(&s->mapped_ram, NULL, "onenand-mapped-ram",
                              &s->ram, 0x0200 << s->shift,
                              0xbe00 << s->shift);
     memory_region_add_subregion_overlap(&s->container,
@@ -768,7 +768,7 @@ static int onenand_initfn(SysBusDevice *dev)
     s->blockwp = g_malloc(s->blocks);
     s->density_mask = (s->id.dev & 0x08)
         ? (1 << (6 + ((s->id.dev >> 4) & 7))) : 0;
-    memory_region_init_io(&s->iomem, &onenand_ops, s, "onenand",
+    memory_region_init_io(&s->iomem, NULL, &onenand_ops, s, "onenand",
                           0x10000 << s->shift);
     if (!s->bdrv) {
         s->image = memset(g_malloc(size + (size >> 5)),
@@ -782,7 +782,7 @@ static int onenand_initfn(SysBusDevice *dev)
     }
     s->otp = memset(g_malloc((64 + 2) << PAGE_SHIFT),
                     0xff, (64 + 2) << PAGE_SHIFT);
-    memory_region_init_ram(&s->ram, "onenand.ram", 0xc000 << s->shift);
+    memory_region_init_ram(&s->ram, NULL, "onenand.ram", 0xc000 << s->shift);
     vmstate_register_ram_global(&s->ram);
     ram = memory_region_get_ram_ptr(&s->ram);
     s->boot[0] = ram + (0x0000 << s->shift);
diff --git a/hw/block/pc_sysfw.c b/hw/block/pc_sysfw.c
index 412d1b0..0669410 100644
--- a/hw/block/pc_sysfw.c
+++ b/hw/block/pc_sysfw.c
@@ -59,7 +59,7 @@ static void pc_isa_bios_init(MemoryRegion *rom_memory,
         isa_bios_size = 128 * 1024;
     }
     isa_bios = g_malloc(sizeof(*isa_bios));
-    memory_region_init_ram(isa_bios, "isa-bios", isa_bios_size);
+    memory_region_init_ram(isa_bios, NULL, "isa-bios", isa_bios_size);
     vmstate_register_ram_global(isa_bios);
     memory_region_add_subregion_overlap(rom_memory,
                                         0x100000 - isa_bios_size,
@@ -162,7 +162,7 @@ static void old_pc_system_rom_init(MemoryRegion *rom_memory, bool isapc_ram_fw)
         goto bios_error;
     }
     bios = g_malloc(sizeof(*bios));
-    memory_region_init_ram(bios, "pc.bios", bios_size);
+    memory_region_init_ram(bios, NULL, "pc.bios", bios_size);
     vmstate_register_ram_global(bios);
     if (!isapc_ram_fw) {
         memory_region_set_readonly(bios, true);
@@ -183,7 +183,7 @@ static void old_pc_system_rom_init(MemoryRegion *rom_memory, bool isapc_ram_fw)
         isa_bios_size = 128 * 1024;
     }
     isa_bios = g_malloc(sizeof(*isa_bios));
-    memory_region_init_alias(isa_bios, "isa-bios", bios,
+    memory_region_init_alias(isa_bios, NULL, "isa-bios", bios,
                              bios_size - isa_bios_size, isa_bios_size);
     memory_region_add_subregion_overlap(rom_memory,
                                         0x100000 - isa_bios_size,
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 63d7c99..5d51e58 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -579,7 +579,8 @@ static int pflash_cfi01_init(SysBusDevice *dev)
 #endif
 
     memory_region_init_rom_device(
-        &pfl->mem, pfl->be ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le, pfl,
+        &pfl->mem, NULL,
+        pfl->be ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le, pfl,
         pfl->name, total_len);
     vmstate_register_ram(&pfl->mem, DEVICE(pfl));
     pfl->storage = memory_region_get_ram_ptr(&pfl->mem);
diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index 5f25246..8c1d570 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -100,10 +100,10 @@ static void pflash_setup_mappings(pflash_t *pfl)
     unsigned i;
     hwaddr size = memory_region_size(&pfl->orig_mem);
 
-    memory_region_init(&pfl->mem, "pflash", pfl->mappings * size);
+    memory_region_init(&pfl->mem, NULL, "pflash", pfl->mappings * size);
     pfl->mem_mappings = g_new(MemoryRegion, pfl->mappings);
     for (i = 0; i < pfl->mappings; ++i) {
-        memory_region_init_alias(&pfl->mem_mappings[i], "pflash-alias",
+        memory_region_init_alias(&pfl->mem_mappings[i], NULL, "pflash-alias",
                                  &pfl->orig_mem, 0, size);
         memory_region_add_subregion(&pfl->mem, i * size, &pfl->mem_mappings[i]);
     }
@@ -600,7 +600,7 @@ static int pflash_cfi02_init(SysBusDevice *dev)
         return NULL;
 #endif
 
-    memory_region_init_rom_device(&pfl->orig_mem, pfl->be ?
+    memory_region_init_rom_device(&pfl->orig_mem, NULL, pfl->be ?
                                   &pflash_cfi02_ops_be : &pflash_cfi02_ops_le,
                                   pfl, pfl->name, chip_len);
     vmstate_register_ram(&pfl->orig_mem, DEVICE(pfl));
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 205e125..36e8cd5 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -442,7 +442,7 @@ static int cadence_uart_init(SysBusDevice *dev)
 {
     UartState *s = FROM_SYSBUS(UartState, dev);
 
-    memory_region_init_io(&s->iomem, &uart_ops, s, "uart", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &uart_ops, s, "uart", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index f254841..c62fead 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -103,7 +103,7 @@ static void debugcon_isa_realizefn(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    memory_region_init_io(&s->io, &debugcon_ops, s,
+    memory_region_init_io(&s->io, NULL, &debugcon_ops, s,
                           TYPE_ISA_DEBUGCON_DEVICE, 1);
     memory_region_add_subregion(isa_address_space_io(d),
                                 isa->iobase, &s->io);
diff --git a/hw/char/escc.c b/hw/char/escc.c
index c2cb07f..29ecbaa 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -886,7 +886,7 @@ static int escc_init1(SysBusDevice *dev)
     s->chn[0].otherchn = &s->chn[1];
     s->chn[1].otherchn = &s->chn[0];
 
-    memory_region_init_io(&s->mmio, &escc_mem_ops, s, "escc",
+    memory_region_init_io(&s->mmio, NULL, &escc_mem_ops, s, "escc",
                           ESCC_SIZE << s->it_shift);
     sysbus_init_mmio(dev, &s->mmio);
 
diff --git a/hw/char/etraxfs_ser.c b/hw/char/etraxfs_ser.c
index 11820f5..ffd9767 100644
--- a/hw/char/etraxfs_ser.c
+++ b/hw/char/etraxfs_ser.c
@@ -211,7 +211,7 @@ static int etraxfs_ser_init(SysBusDevice *dev)
     struct etrax_serial *s = FROM_SYSBUS(typeof (*s), dev);
 
     sysbus_init_irq(dev, &s->irq);
-    memory_region_init_io(&s->mmio, &ser_ops, s, "etraxfs-serial", R_MAX * 4);
+    memory_region_init_io(&s->mmio, NULL, &ser_ops, s, "etraxfs-serial", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
     s->chr = qemu_char_get_next_serial();
diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index 5751816..b879ba4 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -630,7 +630,7 @@ static int exynos4210_uart_init(SysBusDevice *dev)
     Exynos4210UartState *s = FROM_SYSBUS(Exynos4210UartState, dev);
 
     /* memory mapping */
-    memory_region_init_io(&s->iomem, &exynos4210_uart_ops, s, "exynos4210.uart",
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_uart_ops, s, "exynos4210.uart",
                           EXYNOS4210_UART_REGS_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index a64453f..a1587dc 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -242,7 +242,7 @@ static int grlib_apbuart_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &uart->irq);
 
-    memory_region_init_io(&uart->iomem, &grlib_apbuart_ops, uart,
+    memory_region_init_io(&uart->iomem, NULL, &grlib_apbuart_ops, uart,
                           "uart", UART_REG_SIZE);
 
     sysbus_init_mmio(dev, &uart->iomem);
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 2a2c230..9fa4da7 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -386,7 +386,7 @@ static int imx_serial_init(SysBusDevice *dev)
     IMXSerialState *s = FROM_SYSBUS(IMXSerialState, dev);
 
 
-    memory_region_init_io(&s->iomem, &imx_serial_ops, s, "imx-serial", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &imx_serial_ops, s, "imx-serial", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/char/lm32_uart.c b/hw/char/lm32_uart.c
index 99721ab..e8fdbe4 100644
--- a/hw/char/lm32_uart.c
+++ b/hw/char/lm32_uart.c
@@ -250,7 +250,7 @@ static int lm32_uart_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, &uart_ops, s, "uart", R_MAX * 4);
+    memory_region_init_io(&s->iomem, NULL, &uart_ops, s, "uart", R_MAX * 4);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->chr = qemu_char_get_next_serial();
diff --git a/hw/char/mcf_uart.c b/hw/char/mcf_uart.c
index 3ec4705..98fd44e 100644
--- a/hw/char/mcf_uart.c
+++ b/hw/char/mcf_uart.c
@@ -302,6 +302,6 @@ void mcf_uart_mm_init(MemoryRegion *sysmem,
     mcf_uart_state *s;
 
     s = mcf_uart_init(irq, chr);
-    memory_region_init_io(&s->iomem, &mcf_uart_ops, s, "uart", 0x40);
+    memory_region_init_io(&s->iomem, NULL, &mcf_uart_ops, s, "uart", 0x40);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 }
diff --git a/hw/char/milkymist-uart.c b/hw/char/milkymist-uart.c
index cbc7d73..22faf4c 100644
--- a/hw/char/milkymist-uart.c
+++ b/hw/char/milkymist-uart.c
@@ -196,7 +196,7 @@ static int milkymist_uart_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, &uart_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &uart_mmio_ops, s,
             "milkymist-uart", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/char/omap_uart.c b/hw/char/omap_uart.c
index 5bb36ed..0b91693 100644
--- a/hw/char/omap_uart.c
+++ b/hw/char/omap_uart.c
@@ -168,7 +168,7 @@ struct omap_uart_s *omap2_uart_init(MemoryRegion *sysmem,
     struct omap_uart_s *s = omap_uart_init(base, irq,
                     fclk, iclk, txdma, rxdma, label, chr);
 
-    memory_region_init_io(&s->iomem, &omap_uart_ops, s, "omap.uart", 0x100);
+    memory_region_init_io(&s->iomem, NULL, &omap_uart_ops, s, "omap.uart", 0x100);
 
     s->ta = ta;
 
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index caa9eb4..ad96ea5 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -587,7 +587,7 @@ bool parallel_mm_init(MemoryRegion *address_space,
     s->it_shift = it_shift;
     qemu_register_reset(parallel_reset, s);
 
-    memory_region_init_io(&s->iomem, &parallel_mm_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &parallel_mm_ops, s,
                           "parallel", 8 << it_shift);
     memory_region_add_subregion(address_space, base, &s->iomem);
     return true;
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index 7079ef6..bd26e6d 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -265,7 +265,7 @@ static int pl011_init(SysBusDevice *dev, const unsigned char *id)
 {
     pl011_state *s = FROM_SYSBUS(pl011_state, dev);
 
-    memory_region_init_io(&s->iomem, &pl011_ops, s, "pl011", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl011_ops, s, "pl011", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->id = id;
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index e06a802..0bce75b 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -72,7 +72,7 @@ static void serial_isa_realizefn(DeviceState *dev, Error **errp)
     serial_realize_core(s, errp);
     qdev_set_legacy_instance_id(dev, isa->iobase, 3);
 
-    memory_region_init_io(&s->io, &serial_io_ops, s, "serial", 8);
+    memory_region_init_io(&s->io, NULL, &serial_io_ops, s, "serial", 8);
     isa_register_ioport(isadev, &s->io, isa->iobase);
 }
 
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index 3bec8eb..6adfbe6 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -63,7 +63,7 @@ static int serial_pci_init(PCIDevice *dev)
     pci->dev.config[PCI_INTERRUPT_PIN] = 0x01;
     s->irq = pci->dev.irq[0];
 
-    memory_region_init_io(&s->io, &serial_io_ops, s, "serial", 8);
+    memory_region_init_io(&s->io, NULL, &serial_io_ops, s, "serial", 8);
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
     return 0;
 }
@@ -102,7 +102,7 @@ static int multi_serial_pci_init(PCIDevice *dev)
     assert(pci->ports <= PCI_SERIAL_MAX_PORTS);
 
     pci->dev.config[PCI_INTERRUPT_PIN] = 0x01;
-    memory_region_init(&pci->iobar, "multiserial", 8 * pci->ports);
+    memory_region_init(&pci->iobar, NULL, "multiserial", 8 * pci->ports);
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->iobar);
     pci->irqs = qemu_allocate_irqs(multi_serial_irq_mux, pci,
                                    pci->ports);
@@ -118,7 +118,7 @@ static int multi_serial_pci_init(PCIDevice *dev)
         }
         s->irq = pci->irqs[i];
         pci->name[i] = g_strdup_printf("uart #%d", i+1);
-        memory_region_init_io(&s->io, &serial_io_ops, s, pci->name[i], 8);
+        memory_region_init_io(&s->io, NULL, &serial_io_ops, s, pci->name[i], 8);
         memory_region_add_subregion(&pci->iobar, 8 * i, &s->io);
     }
     return 0;
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 6382f98..6025592 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -703,7 +703,7 @@ SerialState *serial_init(int base, qemu_irq irq, int baudbase,
 
     vmstate_register(NULL, base, &vmstate_serial, s);
 
-    memory_region_init_io(&s->io, &serial_io_ops, s, "serial", 8);
+    memory_region_init_io(&s->io, NULL, &serial_io_ops, s, "serial", 8);
     memory_region_add_subregion(system_io, base, &s->io);
 
     return s;
@@ -766,7 +766,7 @@ SerialState *serial_mm_init(MemoryRegion *address_space,
     }
     vmstate_register(NULL, base, &vmstate_serial, s);
 
-    memory_region_init_io(&s->io, &serial_mm_ops[end], s,
+    memory_region_init_io(&s->io, NULL, &serial_mm_ops[end], s,
                           "serial", 8 << it_shift);
     memory_region_add_subregion(address_space, base, &s->io);
 
diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index b328643..6223a55 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -383,14 +383,14 @@ void sh_serial_init(MemoryRegion *sysmem,
 
     sh_serial_clear_fifo(s);
 
-    memory_region_init_io(&s->iomem, &sh_serial_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &sh_serial_ops, s,
                           "serial", 0x100000000ULL);
 
-    memory_region_init_alias(&s->iomem_p4, "serial-p4", &s->iomem,
+    memory_region_init_alias(&s->iomem_p4, NULL, "serial-p4", &s->iomem,
                              0, 0x28);
     memory_region_add_subregion(sysmem, P4ADDR(base), &s->iomem_p4);
 
-    memory_region_init_alias(&s->iomem_a7, "serial-a7", &s->iomem,
+    memory_region_init_alias(&s->iomem_a7, NULL, "serial-a7", &s->iomem,
                              0, 0x28);
     memory_region_add_subregion(sysmem, A7ADDR(base), &s->iomem_a7);
 
diff --git a/hw/char/tpci200.c b/hw/char/tpci200.c
index 0170602..9174042 100644
--- a/hw/char/tpci200.c
+++ b/hw/char/tpci200.c
@@ -588,17 +588,17 @@ static int tpci200_initfn(PCIDevice *pci_dev)
     pci_set_long(c + 0x48, 0x00024C06);
     pci_set_long(c + 0x4C, 0x00000003);
 
-    memory_region_init_io(&s->mmio, &tpci200_cfg_ops,
+    memory_region_init_io(&s->mmio, NULL, &tpci200_cfg_ops,
                           s, "tpci200_mmio", 128);
-    memory_region_init_io(&s->io,   &tpci200_cfg_ops,
+    memory_region_init_io(&s->io, NULL,   &tpci200_cfg_ops,
                           s, "tpci200_io",   128);
-    memory_region_init_io(&s->las0, &tpci200_las0_ops,
+    memory_region_init_io(&s->las0, NULL, &tpci200_las0_ops,
                           s, "tpci200_las0", 256);
-    memory_region_init_io(&s->las1, &tpci200_las1_ops,
+    memory_region_init_io(&s->las1, NULL, &tpci200_las1_ops,
                           s, "tpci200_las1", 1024);
-    memory_region_init_io(&s->las2, &tpci200_las2_ops,
+    memory_region_init_io(&s->las2, NULL, &tpci200_las2_ops,
                           s, "tpci200_las2", 1024*1024*32);
-    memory_region_init_io(&s->las3, &tpci200_las3_ops,
+    memory_region_init_io(&s->las3, NULL, &tpci200_las3_ops,
                           s, "tpci200_las3", 1024*1024*16);
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio);
     pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_IO,     &s->io);
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 3f7e989..241bf1f 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -199,7 +199,7 @@ static int xilinx_uartlite_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
 
     uart_update_status(s);
-    memory_region_init_io(&s->mmio, &uart_ops, s, "xlnx.xps-uartlite",
+    memory_region_init_io(&s->mmio, NULL, &uart_ops, s, "xlnx.xps-uartlite",
                                                                 R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
diff --git a/hw/core/empty_slot.c b/hw/core/empty_slot.c
index 5234a4d..35e32f9 100644
--- a/hw/core/empty_slot.c
+++ b/hw/core/empty_slot.c
@@ -70,7 +70,7 @@ static int empty_slot_init1(SysBusDevice *dev)
 {
     EmptySlot *s = FROM_SYSBUS(EmptySlot, dev);
 
-    memory_region_init_io(&s->iomem, &empty_slot_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &empty_slot_ops, s,
                           "empty-slot", s->size);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index 648656d..773c83a 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -68,7 +68,7 @@ static int a15mp_priv_init(SysBusDevice *dev)
      *  0x5000-0x5fff -- GIC virtual interface control (not modelled)
      *  0x6000-0x7fff -- GIC virtual CPU interface (not modelled)
      */
-    memory_region_init(&s->container, "a15mp-priv-container", 0x8000);
+    memory_region_init(&s->container, NULL, "a15mp-priv-container", 0x8000);
     memory_region_add_subregion(&s->container, 0x1000,
                                 sysbus_mmio_get_region(busdev, 0));
     memory_region_add_subregion(&s->container, 0x2000,
diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index 0a1a10f..26a3858 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -71,7 +71,7 @@ static int a9mp_priv_init(SysBusDevice *dev)
      *
      * We should implement the global timer but don't currently do so.
      */
-    memory_region_init(&s->container, "a9mp-priv-container", 0x2000);
+    memory_region_init(&s->container, NULL, "a9mp-priv-container", 0x2000);
     memory_region_add_subregion(&s->container, 0,
                                 sysbus_mmio_get_region(scubusdev, 0));
     /* GIC CPU interface */
diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index 90dcead..67e2828 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -87,8 +87,8 @@ static void mpcore_priv_map_setup(ARM11MPCorePriveState *s)
     SysBusDevice *gicbusdev = SYS_BUS_DEVICE(s->gic);
     SysBusDevice *timerbusdev = SYS_BUS_DEVICE(s->mptimer);
     SysBusDevice *wdtbusdev = SYS_BUS_DEVICE(s->wdtimer);
-    memory_region_init(&s->container, "mpcode-priv-container", 0x2000);
-    memory_region_init_io(&s->iomem, &mpcore_scu_ops, s, "mpcore-scu", 0x100);
+    memory_region_init(&s->container, NULL, "mpcode-priv-container", 0x2000);
+    memory_region_init_io(&s->iomem, NULL, &mpcore_scu_ops, s, "mpcore-scu", 0x100);
     memory_region_add_subregion(&s->container, 0, &s->iomem);
     /* GIC CPU interfaces: "current CPU" at 0x100, then specific CPUs
      * at 0x200, 0x300...
diff --git a/hw/cpu/icc_bus.c b/hw/cpu/icc_bus.c
index 73a1dc9..9e901e9 100644
--- a/hw/cpu/icc_bus.c
+++ b/hw/cpu/icc_bus.c
@@ -95,7 +95,7 @@ static void icc_bridge_init(Object *obj)
     /* Do not change order of registering regions,
      * APIC must be first registered region, board maps it by 0 index
      */
-    memory_region_init(&s->apic_container, "icc-apic-container",
+    memory_region_init(&s->apic_container, NULL, "icc-apic-container",
                        APIC_SPACE_SIZE);
     sysbus_init_mmio(sb, &s->apic_container);
     s->icc_bus.apic_address_space = &s->apic_container;
diff --git a/hw/cris/axis_dev88.c b/hw/cris/axis_dev88.c
index 7475671..9104d61 100644
--- a/hw/cris/axis_dev88.c
+++ b/hw/cris/axis_dev88.c
@@ -269,13 +269,13 @@ void axisdev88_init(QEMUMachineInitArgs *args)
     env = &cpu->env;
 
     /* allocate RAM */
-    memory_region_init_ram(phys_ram, "axisdev88.ram", ram_size);
+    memory_region_init_ram(phys_ram, NULL, "axisdev88.ram", ram_size);
     vmstate_register_ram_global(phys_ram);
     memory_region_add_subregion(address_space_mem, 0x40000000, phys_ram);
 
     /* The ETRAX-FS has 128Kb on chip ram, the docs refer to it as the 
        internal memory.  */
-    memory_region_init_ram(phys_intmem, "axisdev88.chipram", INTMEM_SIZE);
+    memory_region_init_ram(phys_intmem, NULL, "axisdev88.chipram", INTMEM_SIZE);
     vmstate_register_ram_global(phys_intmem);
     memory_region_add_subregion(address_space_mem, 0x38000000, phys_intmem);
 
@@ -283,13 +283,13 @@ void axisdev88_init(QEMUMachineInitArgs *args)
     nand = drive_get(IF_MTD, 0, 0);
     nand_state.nand = nand_init(nand ? nand->bdrv : NULL,
                                 NAND_MFR_STMICRO, 0x39);
-    memory_region_init_io(&nand_state.iomem, &nand_ops, &nand_state,
+    memory_region_init_io(&nand_state.iomem, NULL, &nand_ops, &nand_state,
                           "nand", 0x05000000);
     memory_region_add_subregion(address_space_mem, 0x10000000,
                                 &nand_state.iomem);
 
     gpio_state.nand = &nand_state;
-    memory_region_init_io(&gpio_state.iomem, &gpio_ops, &gpio_state,
+    memory_region_init_io(&gpio_state.iomem, NULL, &gpio_ops, &gpio_state,
                           "gpio", 0x5c);
     memory_region_add_subregion(address_space_mem, 0x3001a000,
                                 &gpio_state.iomem);
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 0d9eee8..00ac9a3 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2840,21 +2840,21 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
     }
 
     /* Register ioport 0x3b0 - 0x3df */
-    memory_region_init_io(&s->cirrus_vga_io, &cirrus_vga_io_ops, s,
+    memory_region_init_io(&s->cirrus_vga_io, NULL, &cirrus_vga_io_ops, s,
                           "cirrus-io", 0x30);
     memory_region_add_subregion(system_io, 0x3b0, &s->cirrus_vga_io);
 
-    memory_region_init(&s->low_mem_container,
+    memory_region_init(&s->low_mem_container, NULL,
                        "cirrus-lowmem-container",
                        0x20000);
 
-    memory_region_init_io(&s->low_mem, &cirrus_vga_mem_ops, s,
+    memory_region_init_io(&s->low_mem, NULL, &cirrus_vga_mem_ops, s,
                           "cirrus-low-memory", 0x20000);
     memory_region_add_subregion(&s->low_mem_container, 0, &s->low_mem);
     for (i = 0; i < 2; ++i) {
         static const char *names[] = { "vga.bank0", "vga.bank1" };
         MemoryRegion *bank = &s->cirrus_bank[i];
-        memory_region_init_alias(bank, names[i], &s->vga.vram, 0, 0x8000);
+        memory_region_init_alias(bank, NULL, names[i], &s->vga.vram, 0, 0x8000);
         memory_region_set_enabled(bank, false);
         memory_region_add_subregion_overlap(&s->low_mem_container, i * 0x8000,
                                             bank, 1);
@@ -2866,13 +2866,13 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
     memory_region_set_coalescing(&s->low_mem);
 
     /* I/O handler for LFB */
-    memory_region_init_io(&s->cirrus_linear_io, &cirrus_linear_io_ops, s,
+    memory_region_init_io(&s->cirrus_linear_io, NULL, &cirrus_linear_io_ops, s,
                           "cirrus-linear-io", s->vga.vram_size_mb
                                               * 1024 * 1024);
     memory_region_set_flush_coalesced(&s->cirrus_linear_io);
 
     /* I/O handler for LFB */
-    memory_region_init_io(&s->cirrus_linear_bitblt_io,
+    memory_region_init_io(&s->cirrus_linear_bitblt_io, NULL,
                           &cirrus_linear_bitblt_io_ops,
                           s,
                           "cirrus-bitblt-mmio",
@@ -2880,7 +2880,7 @@ static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
     memory_region_set_flush_coalesced(&s->cirrus_linear_bitblt_io);
 
     /* I/O handler for memory-mapped I/O */
-    memory_region_init_io(&s->cirrus_mmio_io, &cirrus_mmio_io_ops, s,
+    memory_region_init_io(&s->cirrus_mmio_io, NULL, &cirrus_mmio_io_ops, s,
                           "cirrus-mmio", CIRRUS_PNPMMIO_SIZE);
     memory_region_set_flush_coalesced(&s->cirrus_mmio_io);
 
@@ -2965,7 +2965,7 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
 
      /* setup PCI */
 
-    memory_region_init(&s->pci_bar, "cirrus-pci-bar0", 0x2000000);
+    memory_region_init(&s->pci_bar, NULL, "cirrus-pci-bar0", 0x2000000);
 
     /* XXX: add byte swapping apertures */
     memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 0da00a9..d9088d9 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1902,7 +1902,7 @@ static int exynos4210_fimd_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq[1]);
     sysbus_init_irq(dev, &s->irq[2]);
 
-    memory_region_init_io(&s->iomem, &exynos4210_fimd_mmio_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_fimd_mmio_ops, s,
             "exynos4210.fimd", FIMD_REGS_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     s->console = graphic_console_init(DEVICE(dev), &exynos4210_fimd_ops, s);
diff --git a/hw/display/g364fb.c b/hw/display/g364fb.c
index 2a4047e..79a0a50 100644
--- a/hw/display/g364fb.c
+++ b/hw/display/g364fb.c
@@ -486,8 +486,8 @@ static void g364fb_init(DeviceState *dev, G364State *s)
 
     s->con = graphic_console_init(dev, &g364fb_ops, s);
 
-    memory_region_init_io(&s->mem_ctrl, &g364fb_ctrl_ops, s, "ctrl", 0x180000);
-    memory_region_init_ram_ptr(&s->mem_vram, "vram",
+    memory_region_init_io(&s->mem_ctrl, NULL, &g364fb_ctrl_ops, s, "ctrl", 0x180000);
+    memory_region_init_ram_ptr(&s->mem_vram, NULL, "vram",
                                s->vram_size, s->vram);
     vmstate_register_ram(&s->mem_vram, dev);
     memory_region_set_coalescing(&s->mem_vram);
diff --git a/hw/display/jazz_led.c b/hw/display/jazz_led.c
index 52035fc..e6a508e 100644
--- a/hw/display/jazz_led.c
+++ b/hw/display/jazz_led.c
@@ -264,7 +264,7 @@ static int jazz_led_init(SysBusDevice *dev)
 {
     LedState *s = FROM_SYSBUS(LedState, dev);
 
-    memory_region_init_io(&s->iomem, &led_ops, s, "led", 1);
+    memory_region_init_io(&s->iomem, NULL, &led_ops, s, "led", 1);
     sysbus_init_mmio(dev, &s->iomem);
 
     s->con = graphic_console_init(DEVICE(dev), &jazz_led_ops, s);
diff --git a/hw/display/milkymist-tmu2.c b/hw/display/milkymist-tmu2.c
index b723a04..31da796 100644
--- a/hw/display/milkymist-tmu2.c
+++ b/hw/display/milkymist-tmu2.c
@@ -447,7 +447,7 @@ static int milkymist_tmu2_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, &tmu2_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &tmu2_mmio_ops, s,
             "milkymist-tmu2", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/display/milkymist-vgafb.c b/hw/display/milkymist-vgafb.c
index 3828296..b1f9c16 100644
--- a/hw/display/milkymist-vgafb.c
+++ b/hw/display/milkymist-vgafb.c
@@ -279,7 +279,7 @@ static int milkymist_vgafb_init(SysBusDevice *dev)
 {
     MilkymistVgafbState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->regs_region, &vgafb_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &vgafb_mmio_ops, s,
             "milkymist-vgafb", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/display/omap_dss.c b/hw/display/omap_dss.c
index ea3afce..24ccbcc 100644
--- a/hw/display/omap_dss.c
+++ b/hw/display/omap_dss.c
@@ -1053,15 +1053,15 @@ struct omap_dss_s *omap_dss_init(struct omap_target_agent_s *ta,
     s->drq = drq;
     omap_dss_reset(s);
 
-    memory_region_init_io(&s->iomem_diss1, &omap_diss_ops, s, "omap.diss1",
+    memory_region_init_io(&s->iomem_diss1, NULL, &omap_diss_ops, s, "omap.diss1",
                           omap_l4_region_size(ta, 0));
-    memory_region_init_io(&s->iomem_disc1, &omap_disc_ops, s, "omap.disc1",
+    memory_region_init_io(&s->iomem_disc1, NULL, &omap_disc_ops, s, "omap.disc1",
                           omap_l4_region_size(ta, 1));
-    memory_region_init_io(&s->iomem_rfbi1, &omap_rfbi_ops, s, "omap.rfbi1",
+    memory_region_init_io(&s->iomem_rfbi1, NULL, &omap_rfbi_ops, s, "omap.rfbi1",
                           omap_l4_region_size(ta, 2));
-    memory_region_init_io(&s->iomem_venc1, &omap_venc_ops, s, "omap.venc1",
+    memory_region_init_io(&s->iomem_venc1, NULL, &omap_venc_ops, s, "omap.venc1",
                           omap_l4_region_size(ta, 3));
-    memory_region_init_io(&s->iomem_im3, &omap_im3_ops, s,
+    memory_region_init_io(&s->iomem_im3, NULL, &omap_im3_ops, s,
                           "omap.im3", 0x1000);
 
     omap_l4_attach(ta, 0, &s->iomem_diss1);
diff --git a/hw/display/omap_lcdc.c b/hw/display/omap_lcdc.c
index fb72ebe..c3b9b68 100644
--- a/hw/display/omap_lcdc.c
+++ b/hw/display/omap_lcdc.c
@@ -403,7 +403,7 @@ struct omap_lcd_panel_s *omap_lcdc_init(MemoryRegion *sysmem,
     s->sysmem = sysmem;
     omap_lcdc_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_lcdc_ops, s, "omap.lcdc", 0x100);
+    memory_region_init_io(&s->iomem, NULL, &omap_lcdc_ops, s, "omap.lcdc", 0x100);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     s->con = graphic_console_init(NULL, &omap_ops, s);
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index f259955..15c2f38 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -453,7 +453,7 @@ static int pl110_init(SysBusDevice *dev)
 {
     pl110_state *s = FROM_SYSBUS(pl110_state, dev);
 
-    memory_region_init_io(&s->iomem, &pl110_ops, s, "pl110", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl110_ops, s, "pl110", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     qdev_init_gpio_in(&s->busdev.qdev, pl110_mux_ctrl_set, 1);
diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
index 3b68f26..990931a 100644
--- a/hw/display/pxa2xx_lcd.c
+++ b/hw/display/pxa2xx_lcd.c
@@ -1009,7 +1009,7 @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
 
     pxa2xx_lcdc_orientation(s, graphic_rotate);
 
-    memory_region_init_io(&s->iomem, &pxa2xx_lcdc_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_lcdc_ops, s,
                           "pxa2xx-lcd-controller", 0x00100000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 937a402..bcfcce4 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1981,18 +1981,18 @@ static int qxl_init_common(PCIQXLDevice *qxl)
     pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);
 
     qxl->rom_size = qxl_rom_size();
-    memory_region_init_ram(&qxl->rom_bar, "qxl.vrom", qxl->rom_size);
+    memory_region_init_ram(&qxl->rom_bar, NULL, "qxl.vrom", qxl->rom_size);
     vmstate_register_ram(&qxl->rom_bar, &qxl->pci.qdev);
     init_qxl_rom(qxl);
     init_qxl_ram(qxl);
 
     qxl->guest_surfaces.cmds = g_new0(QXLPHYSICAL, qxl->ssd.num_surfaces);
-    memory_region_init_ram(&qxl->vram_bar, "qxl.vram", qxl->vram_size);
+    memory_region_init_ram(&qxl->vram_bar, NULL, "qxl.vram", qxl->vram_size);
     vmstate_register_ram(&qxl->vram_bar, &qxl->pci.qdev);
-    memory_region_init_alias(&qxl->vram32_bar, "qxl.vram32", &qxl->vram_bar,
+    memory_region_init_alias(&qxl->vram32_bar, NULL, "qxl.vram32", &qxl->vram_bar,
                              0, qxl->vram32_size);
 
-    memory_region_init_io(&qxl->io_bar, &qxl_io_ops, qxl,
+    memory_region_init_io(&qxl->io_bar, NULL, &qxl_io_ops, qxl,
                           "qxl-ioports", io_size);
     if (qxl->id == 0) {
         vga_dirty_log_start(&qxl->vga);
@@ -2093,7 +2093,7 @@ static int qxl_init_secondary(PCIDevice *dev)
 
     qxl->id = device_id++;
     qxl_init_ramsize(qxl);
-    memory_region_init_ram(&qxl->vga.vram, "qxl.vgavram", qxl->vga.vram_size);
+    memory_region_init_ram(&qxl->vga.vram, NULL, "qxl.vgavram", qxl->vga.vram_size);
     vmstate_register_ram(&qxl->vga.vram, &qxl->pci.qdev);
     qxl->vga.vram_ptr = memory_region_get_ram_ptr(&qxl->vga.vram);
     qxl->vga.con = graphic_console_init(DEVICE(dev), &qxl_ops, qxl);
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index f72e488..c75d6ac 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -1408,23 +1408,23 @@ void sm501_init(MemoryRegion *address_space_mem, uint32_t base,
     s->dc_crt_control = 0x00010000;
 
     /* allocate local memory */
-    memory_region_init_ram(&s->local_mem_region, "sm501.local",
+    memory_region_init_ram(&s->local_mem_region, NULL, "sm501.local",
                            local_mem_bytes);
     vmstate_register_ram_global(&s->local_mem_region);
     s->local_mem = memory_region_get_ram_ptr(&s->local_mem_region);
     memory_region_add_subregion(address_space_mem, base, &s->local_mem_region);
 
     /* map mmio */
-    memory_region_init_io(sm501_system_config, &sm501_system_config_ops, s,
+    memory_region_init_io(sm501_system_config, NULL, &sm501_system_config_ops, s,
                           "sm501-system-config", 0x6c);
     memory_region_add_subregion(address_space_mem, base + MMIO_BASE_OFFSET,
                                 sm501_system_config);
-    memory_region_init_io(sm501_disp_ctrl, &sm501_disp_ctrl_ops, s,
+    memory_region_init_io(sm501_disp_ctrl, NULL, &sm501_disp_ctrl_ops, s,
                           "sm501-disp-ctrl", 0x1000);
     memory_region_add_subregion(address_space_mem,
                                 base + MMIO_BASE_OFFSET + SM501_DC,
                                 sm501_disp_ctrl);
-    memory_region_init_io(sm501_2d_engine, &sm501_2d_engine_ops, s,
+    memory_region_init_io(sm501_2d_engine, NULL, &sm501_2d_engine_ops, s,
                           "sm501-2d-engine", 0x54);
     memory_region_add_subregion(address_space_mem,
                                 base + MMIO_BASE_OFFSET + SM501_2D_ENGINE,
diff --git a/hw/display/tc6393xb.c b/hw/display/tc6393xb.c
index 0cb87bc..3dd9b98 100644
--- a/hw/display/tc6393xb.c
+++ b/hw/display/tc6393xb.c
@@ -578,10 +578,10 @@ TC6393xbState *tc6393xb_init(MemoryRegion *sysmem, uint32_t base, qemu_irq irq)
     nand = drive_get(IF_MTD, 0, 0);
     s->flash = nand_init(nand ? nand->bdrv : NULL, NAND_MFR_TOSHIBA, 0x76);
 
-    memory_region_init_io(&s->iomem, &tc6393xb_ops, s, "tc6393xb", 0x10000);
+    memory_region_init_io(&s->iomem, NULL, &tc6393xb_ops, s, "tc6393xb", 0x10000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
-    memory_region_init_ram(&s->vram, "tc6393xb.vram", 0x100000);
+    memory_region_init_ram(&s->vram, NULL, "tc6393xb.vram", 0x100000);
     vmstate_register_ram_global(&s->vram);
     s->vram_ptr = memory_region_get_ram_ptr(&s->vram);
     memory_region_add_subregion(sysmem, base + 0x100000, &s->vram);
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 995641c..24b5478 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -528,7 +528,7 @@ static int tcx_init1(SysBusDevice *dev)
     int size;
     uint8_t *vram_base;
 
-    memory_region_init_ram(&s->vram_mem, "tcx.vram",
+    memory_region_init_ram(&s->vram_mem, NULL, "tcx.vram",
                            s->vram_size * (1 + 4 + 4));
     vmstate_register_ram_global(&s->vram_mem);
     vram_base = memory_region_get_ram_ptr(&s->vram_mem);
@@ -536,21 +536,21 @@ static int tcx_init1(SysBusDevice *dev)
     /* 8-bit plane */
     s->vram = vram_base;
     size = s->vram_size;
-    memory_region_init_alias(&s->vram_8bit, "tcx.vram.8bit",
+    memory_region_init_alias(&s->vram_8bit, NULL, "tcx.vram.8bit",
                              &s->vram_mem, vram_offset, size);
     sysbus_init_mmio(dev, &s->vram_8bit);
     vram_offset += size;
     vram_base += size;
 
     /* DAC */
-    memory_region_init_io(&s->dac, &tcx_dac_ops, s, "tcx.dac", TCX_DAC_NREGS);
+    memory_region_init_io(&s->dac, NULL, &tcx_dac_ops, s, "tcx.dac", TCX_DAC_NREGS);
     sysbus_init_mmio(dev, &s->dac);
 
     /* TEC (dummy) */
-    memory_region_init_io(&s->tec, &dummy_ops, s, "tcx.tec", TCX_TEC_NREGS);
+    memory_region_init_io(&s->tec, NULL, &dummy_ops, s, "tcx.tec", TCX_TEC_NREGS);
     sysbus_init_mmio(dev, &s->tec);
     /* THC: NetBSD writes here even with 8-bit display: dummy */
-    memory_region_init_io(&s->thc24, &dummy_ops, s, "tcx.thc24",
+    memory_region_init_io(&s->thc24, NULL, &dummy_ops, s, "tcx.thc24",
                           TCX_THC_NREGS_24);
     sysbus_init_mmio(dev, &s->thc24);
 
@@ -559,7 +559,7 @@ static int tcx_init1(SysBusDevice *dev)
         size = s->vram_size * 4;
         s->vram24 = (uint32_t *)vram_base;
         s->vram24_offset = vram_offset;
-        memory_region_init_alias(&s->vram_24bit, "tcx.vram.24bit",
+        memory_region_init_alias(&s->vram_24bit, NULL, "tcx.vram.24bit",
                                  &s->vram_mem, vram_offset, size);
         sysbus_init_mmio(dev, &s->vram_24bit);
         vram_offset += size;
@@ -569,14 +569,14 @@ static int tcx_init1(SysBusDevice *dev)
         size = s->vram_size * 4;
         s->cplane = (uint32_t *)vram_base;
         s->cplane_offset = vram_offset;
-        memory_region_init_alias(&s->vram_cplane, "tcx.vram.cplane",
+        memory_region_init_alias(&s->vram_cplane, NULL, "tcx.vram.cplane",
                                  &s->vram_mem, vram_offset, size);
         sysbus_init_mmio(dev, &s->vram_cplane);
 
         s->con = graphic_console_init(DEVICE(dev), &tcx24_ops, s);
     } else {
         /* THC 8 bit (dummy) */
-        memory_region_init_io(&s->thc8, &dummy_ops, s, "tcx.thc8",
+        memory_region_init_io(&s->thc8, NULL, &dummy_ops, s, "tcx.thc8",
                               TCX_THC_NREGS_8);
         sysbus_init_mmio(dev, &s->thc8);
 
diff --git a/hw/display/vga-isa-mm.c b/hw/display/vga-isa-mm.c
index ceeb92f..95707a8 100644
--- a/hw/display/vga-isa-mm.c
+++ b/hw/display/vga-isa-mm.c
@@ -105,13 +105,13 @@ static void vga_mm_init(ISAVGAMMState *s, hwaddr vram_base,
 
     s->it_shift = it_shift;
     s_ioport_ctrl = g_malloc(sizeof(*s_ioport_ctrl));
-    memory_region_init_io(s_ioport_ctrl, &vga_mm_ctrl_ops, s,
+    memory_region_init_io(s_ioport_ctrl, NULL, &vga_mm_ctrl_ops, s,
                           "vga-mm-ctrl", 0x100000);
     memory_region_set_flush_coalesced(s_ioport_ctrl);
 
     vga_io_memory = g_malloc(sizeof(*vga_io_memory));
     /* XXX: endianness? */
-    memory_region_init_io(vga_io_memory, &vga_mem_ops, &s->vga,
+    memory_region_init_io(vga_io_memory, NULL, &vga_mem_ops, &s->vga,
                           "vga-mem", 0x20000);
 
     vmstate_register(NULL, 0, &vmstate_vga_common, s);
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index cea8db7..23d5b56 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -157,10 +157,10 @@ static int pci_std_vga_initfn(PCIDevice *dev)
 
     /* mmio bar for vga register access */
     if (d->flags & (1 << PCI_VGA_FLAG_ENABLE_MMIO)) {
-        memory_region_init(&d->mmio, "vga.mmio", 4096);
-        memory_region_init_io(&d->ioport, &pci_vga_ioport_ops, d,
+        memory_region_init(&d->mmio, NULL, "vga.mmio", 4096);
+        memory_region_init_io(&d->ioport, NULL, &pci_vga_ioport_ops, d,
                               "vga ioports remapped", PCI_VGA_IOPORT_SIZE);
-        memory_region_init_io(&d->bochs, &pci_vga_bochs_ops, d,
+        memory_region_init_io(&d->bochs, NULL, &pci_vga_bochs_ops, d,
                               "bochs dispi interface", PCI_VGA_BOCHS_SIZE);
 
         memory_region_add_subregion(&d->mmio, PCI_VGA_IOPORT_OFFSET,
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 21a108d..21e3763 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -198,7 +198,7 @@ static void vga_update_memory_access(VGACommonState *s)
         }
         base += isa_mem_base;
         region = g_malloc(sizeof(*region));
-        memory_region_init_alias(region, "vga.chain4", &s->vram, offset, size);
+        memory_region_init_alias(region, NULL, "vga.chain4", &s->vram, offset, size);
         memory_region_add_subregion_overlap(s->legacy_address_space, base,
                                             region, 2);
         s->chain4_alias = region;
@@ -2292,7 +2292,7 @@ void vga_common_init(VGACommonState *s)
     s->vram_size_mb = s->vram_size >> 20;
 
     s->is_vbe_vmstate = 1;
-    memory_region_init_ram(&s->vram, "vga.vram", s->vram_size);
+    memory_region_init_ram(&s->vram, NULL, "vga.vram", s->vram_size);
     vmstate_register_ram_global(&s->vram);
     xen_register_framebuffer(&s->vram);
     s->vram_ptr = memory_region_get_ram_ptr(&s->vram);
@@ -2343,7 +2343,7 @@ MemoryRegion *vga_init_io(VGACommonState *s,
     *vbe_ports = vbe_portio_list;
 
     vga_mem = g_malloc(sizeof(*vga_mem));
-    memory_region_init_io(vga_mem, &vga_mem_ops, s,
+    memory_region_init_io(vga_mem, NULL, &vga_mem_ops, s,
                           "vga-lowmem", 0x20000);
     memory_region_set_flush_coalesced(vga_mem);
 
@@ -2385,7 +2385,7 @@ void vga_init_vbe(VGACommonState *s, MemoryRegion *system_memory)
     /* With pc-0.12 and below we map both the PCI BAR and the fixed VBE region,
      * so use an alias to avoid double-mapping the same region.
      */
-    memory_region_init_alias(&s->vram_vbe, "vram.vbe",
+    memory_region_init_alias(&s->vram_vbe, NULL, "vram.vbe",
                              &s->vram, 0, memory_region_size(&s->vram));
     /* XXX: use optimized standard vga accesses */
     memory_region_add_subregion(system_memory,
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index ec41681..05be1fa 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1194,7 +1194,7 @@ static void vmsvga_init(DeviceState *dev, struct vmsvga_state_s *s,
     s->vga.con = graphic_console_init(dev, &vmsvga_ops, s);
 
     s->fifo_size = SVGA_FIFO_SIZE;
-    memory_region_init_ram(&s->fifo_ram, "vmsvga.fifo", s->fifo_size);
+    memory_region_init_ram(&s->fifo_ram, NULL, "vmsvga.fifo", s->fifo_size);
     vmstate_register_ram_global(&s->fifo_ram);
     s->fifo_ptr = memory_region_get_ram_ptr(&s->fifo_ram);
 
@@ -1257,7 +1257,7 @@ static int pci_vmsvga_initfn(PCIDevice *dev)
     s->card.config[PCI_LATENCY_TIMER] = 0x40;           /* Latency timer */
     s->card.config[PCI_INTERRUPT_LINE] = 0xff;          /* End */
 
-    memory_region_init_io(&s->io_bar, &vmsvga_io_ops, &s->chip,
+    memory_region_init_io(&s->io_bar, NULL, &vmsvga_io_ops, &s->chip,
                           "vmsvga-io", 0x10);
     memory_region_set_flush_coalesced(&s->io_bar);
     pci_register_bar(&s->card, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
diff --git a/hw/dma/etraxfs_dma.c b/hw/dma/etraxfs_dma.c
index 6a8c222..3599513 100644
--- a/hw/dma/etraxfs_dma.c
+++ b/hw/dma/etraxfs_dma.c
@@ -773,7 +773,7 @@ void *etraxfs_dmac_init(hwaddr base, int nr_channels)
 	ctrl->nr_channels = nr_channels;
 	ctrl->channels = g_malloc0(sizeof ctrl->channels[0] * nr_channels);
 
-	memory_region_init_io(&ctrl->mmio, &dma_ops, ctrl, "etraxfs-dma",
+	memory_region_init_io(&ctrl->mmio, NULL, &dma_ops, ctrl, "etraxfs-dma",
 			      nr_channels * 0x2000);
 	memory_region_add_subregion(get_system_memory(), base, &ctrl->mmio);
 
diff --git a/hw/dma/i8257.c b/hw/dma/i8257.c
index eb60d45..4490372 100644
--- a/hw/dma/i8257.c
+++ b/hw/dma/i8257.c
@@ -523,7 +523,7 @@ static void dma_init2(struct dma_cont *d, int base, int dshift,
     d->dshift = dshift;
     d->cpu_request_exit = cpu_request_exit;
 
-    memory_region_init_io(&d->channel_io, &channel_io_ops, d,
+    memory_region_init_io(&d->channel_io, NULL, &channel_io_ops, d,
                           "dma-chan", 8 << d->dshift);
     memory_region_add_subregion(isa_address_space_io(NULL),
                                 base, &d->channel_io);
@@ -535,7 +535,7 @@ static void dma_init2(struct dma_cont *d, int base, int dshift,
                                  "dma-pageh");
     }
 
-    memory_region_init_io(&d->cont_io, &cont_io_ops, d, "dma-cont",
+    memory_region_init_io(&d->cont_io, NULL, &cont_io_ops, d, "dma-cont",
                           8 << d->dshift);
     memory_region_add_subregion(isa_address_space_io(NULL),
                                 base + (8 << d->dshift), &d->cont_io);
diff --git a/hw/dma/omap_dma.c b/hw/dma/omap_dma.c
index 184fcee..a81ffc4 100644
--- a/hw/dma/omap_dma.c
+++ b/hw/dma/omap_dma.c
@@ -1663,7 +1663,7 @@ struct soc_dma_s *omap_dma_init(hwaddr base, qemu_irq *irqs,
     omap_dma_reset(s->dma);
     omap_dma_clk_update(s, 0, 1);
 
-    memory_region_init_io(&s->iomem, &omap_dma_ops, s, "omap.dma", memsize);
+    memory_region_init_io(&s->iomem, NULL, &omap_dma_ops, s, "omap.dma", memsize);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     mpu->drq = s->dma->drq;
@@ -2085,7 +2085,7 @@ struct soc_dma_s *omap_dma4_init(hwaddr base, qemu_irq *irqs,
     omap_dma_reset(s->dma);
     omap_dma_clk_update(s, 0, !!s->dma->freq);
 
-    memory_region_init_io(&s->iomem, &omap_dma4_ops, s, "omap.dma4", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &omap_dma4_ops, s, "omap.dma4", 0x1000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     mpu->drq = s->dma->drq;
diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 00b66b4..588c7b2 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -359,7 +359,7 @@ static int pl08x_init(SysBusDevice *dev, int nchannels)
 {
     pl080_state *s = FROM_SYSBUS(pl080_state, dev);
 
-    memory_region_init_io(&s->iomem, &pl080_ops, s, "pl080", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl080_ops, s, "pl080", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->nchannels = nchannels;
diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
index 044c087..b366f8a 100644
--- a/hw/dma/pl330.c
+++ b/hw/dma/pl330.c
@@ -1528,7 +1528,7 @@ static void pl330_realize(DeviceState *dev, Error **errp)
     PL330State *s = PL330(dev);
 
     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq_abort);
-    memory_region_init_io(&s->iomem, &pl330_ops, s, "dma", PL330_IOMEM_SIZE);
+    memory_region_init_io(&s->iomem, NULL, &pl330_ops, s, "dma", PL330_IOMEM_SIZE);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
 
     s->timer = qemu_new_timer_ns(vm_clock, pl330_exec_cycle_timer, s);
diff --git a/hw/dma/puv3_dma.c b/hw/dma/puv3_dma.c
index 32844b5..787e9a1 100644
--- a/hw/dma/puv3_dma.c
+++ b/hw/dma/puv3_dma.c
@@ -80,7 +80,7 @@ static int puv3_dma_init(SysBusDevice *dev)
         s->reg_CFG[i] = 0x0;
     }
 
-    memory_region_init_io(&s->iomem, &puv3_dma_ops, s, "puv3_dma",
+    memory_region_init_io(&s->iomem, NULL, &puv3_dma_ops, s, "puv3_dma",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/dma/pxa2xx_dma.c b/hw/dma/pxa2xx_dma.c
index b60569f..43e2dc3 100644
--- a/hw/dma/pxa2xx_dma.c
+++ b/hw/dma/pxa2xx_dma.c
@@ -465,7 +465,7 @@ static int pxa2xx_dma_init(SysBusDevice *dev)
 
     qdev_init_gpio_in(&dev->qdev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
 
-    memory_region_init_io(&s->iomem, &pxa2xx_dma_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_dma_ops, s,
                           "pxa2xx.dma", 0x00010000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index 03f92f1..4ec433f 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -814,10 +814,10 @@ void *rc4030_init(qemu_irq timer, qemu_irq jazz_bus,
     register_savevm(NULL, "rc4030", 0, 2, rc4030_save, rc4030_load, s);
     rc4030_reset(s);
 
-    memory_region_init_io(&s->iomem_chipset, &rc4030_ops, s,
+    memory_region_init_io(&s->iomem_chipset, NULL, &rc4030_ops, s,
                           "rc4030.chipset", 0x300);
     memory_region_add_subregion(sysmem, 0x80000000, &s->iomem_chipset);
-    memory_region_init_io(&s->iomem_jazzio, &jazzio_ops, s,
+    memory_region_init_io(&s->iomem_jazzio, NULL, &jazzio_ops, s,
                           "rc4030.jazzio", 0x00001000);
     memory_region_add_subregion(sysmem, 0xf0000000, &s->iomem_jazzio);
 
diff --git a/hw/dma/sparc32_dma.c b/hw/dma/sparc32_dma.c
index fd21533..4abb024 100644
--- a/hw/dma/sparc32_dma.c
+++ b/hw/dma/sparc32_dma.c
@@ -274,7 +274,7 @@ static int sparc32_dma_init1(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
 
     reg_size = s->is_ledma ? DMA_ETH_SIZE : DMA_SIZE;
-    memory_region_init_io(&s->iomem, &dma_mem_ops, s, "dma", reg_size);
+    memory_region_init_io(&s->iomem, NULL, &dma_mem_ops, s, "dma", reg_size);
     sysbus_init_mmio(dev, &s->iomem);
 
     qdev_init_gpio_in(&dev->qdev, dma_set_irq, 1);
diff --git a/hw/dma/sun4m_iommu.c b/hw/dma/sun4m_iommu.c
index 8312bff..eafb991 100644
--- a/hw/dma/sun4m_iommu.c
+++ b/hw/dma/sun4m_iommu.c
@@ -349,7 +349,7 @@ static int iommu_init1(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->iomem, &iommu_mem_ops, s, "iommu",
+    memory_region_init_io(&s->iomem, NULL, &iommu_mem_ops, s, "iommu",
                           IOMMU_NREGS * sizeof(uint32_t));
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index 50054cf..bdce635 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -590,7 +590,7 @@ static void xilinx_axidma_init(Object *obj)
     sysbus_init_irq(sbd, &s->streams[0].irq);
     sysbus_init_irq(sbd, &s->streams[1].irq);
 
-    memory_region_init_io(&s->iomem, &axidma_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &axidma_ops, s,
                           "xlnx.axi-dma", R_MAX * 4 * 2);
     sysbus_init_mmio(sbd, &s->iomem);
 }
diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index f5eeaea..13399f9 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -677,7 +677,7 @@ static int omap_gpio_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, omap_gpio_set, 16);
     qdev_init_gpio_out(&dev->qdev, s->omap1.handler, 16);
     sysbus_init_irq(dev, &s->omap1.irq);
-    memory_region_init_io(&s->iomem, &omap_gpio_ops, &s->omap1,
+    memory_region_init_io(&s->iomem, NULL, &omap_gpio_ops, &s->omap1,
                           "omap.gpio", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -692,7 +692,7 @@ static int omap2_gpio_init(SysBusDevice *dev)
     }
     if (s->mpu_model < omap3430) {
         s->modulecount = (s->mpu_model < omap2430) ? 4 : 5;
-        memory_region_init_io(&s->iomem, &omap2_gpif_top_ops, s,
+        memory_region_init_io(&s->iomem, NULL, &omap2_gpif_top_ops, s,
                               "omap2.gpio", 0x1000);
         sysbus_init_mmio(dev, &s->iomem);
     } else {
@@ -712,7 +712,7 @@ static int omap2_gpio_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &m->irq[0]); /* mpu irq */
         sysbus_init_irq(dev, &m->irq[1]); /* dsp irq */
         sysbus_init_irq(dev, &m->wkup);
-        memory_region_init_io(&m->iomem, &omap2_gpio_module_ops, m,
+        memory_region_init_io(&m->iomem, NULL, &omap2_gpio_module_ops, m,
                               "omap.gpio-module", 0x1000);
         sysbus_init_mmio(dev, &m->iomem);
     }
diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index 74bc109..d0dd636 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -276,7 +276,7 @@ static int pl061_init(SysBusDevice *dev, const unsigned char *id)
 {
     pl061_state *s = FROM_SYSBUS(pl061_state, dev);
     s->id = id;
-    memory_region_init_io(&s->iomem, &pl061_ops, s, "pl061", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl061_ops, s, "pl061", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     qdev_init_gpio_in(&dev->qdev, pl061_set_irq, 8);
diff --git a/hw/gpio/puv3_gpio.c b/hw/gpio/puv3_gpio.c
index 5bab97e..333c920 100644
--- a/hw/gpio/puv3_gpio.c
+++ b/hw/gpio/puv3_gpio.c
@@ -112,7 +112,7 @@ static int puv3_gpio_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq[PUV3_IRQS_GPIOLOW7]);
     sysbus_init_irq(dev, &s->irq[PUV3_IRQS_GPIOHIGH]);
 
-    memory_region_init_io(&s->iomem, &puv3_gpio_ops, s, "puv3_gpio",
+    memory_region_init_io(&s->iomem, NULL, &puv3_gpio_ops, s, "puv3_gpio",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index c6cdef3..a0e18c3 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -169,7 +169,7 @@ static int scoop_init(SysBusDevice *dev)
     s->status = 0x02;
     qdev_init_gpio_out(&s->busdev.qdev, s->handler, 16);
     qdev_init_gpio_in(&s->busdev.qdev, scoop_gpio_set, 16);
-    memory_region_init_io(&s->iomem, &scoop_ops, s, "scoop", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &scoop_ops, s, "scoop", 0x1000);
 
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index 854b8e1..f550ba4 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -209,7 +209,7 @@ static int gpio_i2c_init(SysBusDevice *dev)
     GPIOI2CState *s = FROM_SYSBUS(GPIOI2CState, dev);
     i2c_bus *bus;
 
-    memory_region_init(&s->dummy_iomem, "gpio_i2c", 0);
+    memory_region_init(&s->dummy_iomem, NULL, "gpio_i2c", 0);
     sysbus_init_mmio(dev, &s->dummy_iomem);
 
     bus = i2c_init_bus(&dev->qdev, "i2c");
diff --git a/hw/i2c/exynos4210_i2c.c b/hw/i2c/exynos4210_i2c.c
index 196f889..bc6eb34 100644
--- a/hw/i2c/exynos4210_i2c.c
+++ b/hw/i2c/exynos4210_i2c.c
@@ -301,7 +301,7 @@ static int exynos4210_i2c_realize(SysBusDevice *dev)
 {
     Exynos4210I2CState *s = EXYNOS4_I2C(dev);
 
-    memory_region_init_io(&s->iomem, &exynos4210_i2c_ops, s, TYPE_EXYNOS4_I2C,
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_i2c_ops, s, TYPE_EXYNOS4_I2C,
                           EXYNOS4_I2C_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/i2c/omap_i2c.c b/hw/i2c/omap_i2c.c
index efb2254..1a8b39c 100644
--- a/hw/i2c/omap_i2c.c
+++ b/hw/i2c/omap_i2c.c
@@ -448,7 +448,7 @@ static int omap_i2c_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     sysbus_init_irq(dev, &s->drq[0]);
     sysbus_init_irq(dev, &s->drq[1]);
-    memory_region_init_io(&s->iomem, &omap_i2c_ops, s, "omap.i2c",
+    memory_region_init_io(&s->iomem, NULL, &omap_i2c_ops, s, "omap.i2c",
                           (s->revision < OMAP2_INTR_REV) ? 0x800 : 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     s->bus = i2c_init_bus(&dev->qdev, NULL);
diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c
index 0b5bb89..f425ad8 100644
--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -181,5 +181,5 @@ static const MemoryRegionOps pm_smbus_ops = {
 void pm_smbus_init(DeviceState *parent, PMSMBus *smb)
 {
     smb->smbus = i2c_init_bus(parent, "i2c");
-    memory_region_init_io(&smb->io, &pm_smbus_ops, smb, "pm-smbus", 64);
+    memory_region_init_io(&smb->io, NULL, &pm_smbus_ops, smb, "pm-smbus", 64);
 }
diff --git a/hw/i2c/versatile_i2c.c b/hw/i2c/versatile_i2c.c
index e09c83d..a239963 100644
--- a/hw/i2c/versatile_i2c.c
+++ b/hw/i2c/versatile_i2c.c
@@ -79,7 +79,7 @@ static int versatile_i2c_init(SysBusDevice *dev)
 
     bus = i2c_init_bus(&dev->qdev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
-    memory_region_init_io(&s->iomem, &versatile_i2c_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &versatile_i2c_ops, s,
                           "versatile_i2c", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index bd0bdd8..179b806 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -173,7 +173,7 @@ static const MemoryRegionOps kvm_apic_io_ops = {
 
 static void kvm_apic_init(APICCommonState *s)
 {
-    memory_region_init_io(&s->io_memory, &kvm_apic_io_ops, s, "kvm-apic-msi",
+    memory_region_init_io(&s->io_memory, NULL, &kvm_apic_io_ops, s, "kvm-apic-msi",
                           APIC_SPACE_SIZE);
 
     if (kvm_has_gsi_routing()) {
diff --git a/hw/i386/kvm/i8254.c b/hw/i386/kvm/i8254.c
index 93a3669..c1f4094 100644
--- a/hw/i386/kvm/i8254.c
+++ b/hw/i386/kvm/i8254.c
@@ -288,7 +288,7 @@ static void kvm_pit_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
-    memory_region_init_reservation(&pit->ioports, "kvm-pit", 4);
+    memory_region_init_reservation(&pit->ioports, NULL, "kvm-pit", 4);
 
     qdev_init_gpio_in(dev, kvm_pit_irq_control, 1);
 
diff --git a/hw/i386/kvm/i8259.c b/hw/i386/kvm/i8259.c
index 1250224..53e3ca8 100644
--- a/hw/i386/kvm/i8259.c
+++ b/hw/i386/kvm/i8259.c
@@ -119,8 +119,8 @@ static void kvm_pic_realize(DeviceState *dev, Error **errp)
     PICCommonState *s = PIC_COMMON(dev);
     KVMPICClass *kpc = KVM_PIC_GET_CLASS(dev);
 
-    memory_region_init_reservation(&s->base_io, "kvm-pic", 2);
-    memory_region_init_reservation(&s->elcr_io, "kvm-elcr", 1);
+    memory_region_init_reservation(&s->base_io, NULL, "kvm-pic", 2);
+    memory_region_init_reservation(&s->elcr_io, NULL, "kvm-elcr", 1);
 
     kpc->parent_realize(dev, errp);
 }
diff --git a/hw/i386/kvm/ioapic.c b/hw/i386/kvm/ioapic.c
index abfac3d..688cb5c 100644
--- a/hw/i386/kvm/ioapic.c
+++ b/hw/i386/kvm/ioapic.c
@@ -129,7 +129,7 @@ static void kvm_ioapic_set_irq(void *opaque, int irq, int level)
 
 static void kvm_ioapic_init(IOAPICCommonState *s, int instance_no)
 {
-    memory_region_init_reservation(&s->io_memory, "kvm-ioapic", 0x1000);
+    memory_region_init_reservation(&s->io_memory, NULL, "kvm-ioapic", 0x1000);
 
     qdev_init_gpio_in(&s->busdev.qdev, kvm_ioapic_set_irq, IOAPIC_NUM_PINS);
 }
diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index 1fb7ad4..f1a5554 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -298,7 +298,7 @@ static void assigned_dev_iomem_setup(PCIDevice *pci_dev, int region_num,
     PCIRegion *real_region = &r_dev->real_device.regions[region_num];
 
     if (e_size > 0) {
-        memory_region_init(&region->container, "assigned-dev-container",
+        memory_region_init(&region->container, NULL, "assigned-dev-container",
                            e_size);
         memory_region_add_subregion(&region->container, 0, &region->real_iomem);
 
@@ -329,8 +329,8 @@ static void assigned_dev_ioport_setup(PCIDevice *pci_dev, int region_num,
     AssignedDevRegion *region = &r_dev->v_addrs[region_num];
 
     region->e_size = size;
-    memory_region_init(&region->container, "assigned-dev-container", size);
-    memory_region_init_io(&region->real_iomem, &assigned_dev_ioport_ops,
+    memory_region_init(&region->container, NULL, "assigned-dev-container", size);
+    memory_region_init_io(&region->real_iomem, NULL, &assigned_dev_ioport_ops,
                           r_dev->v_addrs + region_num,
                           "assigned-dev-iomem", size);
     memory_region_add_subregion(&region->container, 0, &region->real_iomem);
@@ -478,7 +478,7 @@ static int assigned_dev_register_regions(PCIRegion *io_regions,
                              "4K.  You might experience some performance hit "
                              "due to that.",
                              i, cur_region->base_addr, cur_region->size);
-                memory_region_init_io(&pci_dev->v_addrs[i].real_iomem,
+                memory_region_init_io(&pci_dev->v_addrs[i].real_iomem, NULL,
                                       &slow_bar_ops, &pci_dev->v_addrs[i],
                                       "assigned-dev-slow-bar",
                                       cur_region->size);
@@ -487,7 +487,7 @@ static int assigned_dev_register_regions(PCIRegion *io_regions,
                 char name[32];
                 snprintf(name, sizeof(name), "%s.bar%d",
                          object_get_typename(OBJECT(pci_dev)), i);
-                memory_region_init_ram_ptr(&pci_dev->v_addrs[i].real_iomem,
+                memory_region_init_ram_ptr(&pci_dev->v_addrs[i].real_iomem, NULL,
                                            name, cur_region->size,
                                            virtbase);
                 vmstate_register_ram(&pci_dev->v_addrs[i].real_iomem,
@@ -1650,7 +1650,7 @@ static int assigned_dev_register_msix_mmio(AssignedDevice *dev)
 
     assigned_dev_msix_reset(dev);
 
-    memory_region_init_io(&dev->mmio, &assigned_dev_msix_mmio_ops, dev,
+    memory_region_init_io(&dev->mmio, NULL, &assigned_dev_msix_mmio_ops, dev,
                           "assigned-dev-msix", MSIX_PAGE_SIZE);
     return 0;
 }
@@ -1916,7 +1916,7 @@ static void assigned_dev_load_option_rom(AssignedDevice *dev)
 
     snprintf(name, sizeof(name), "%s.rom",
             object_get_typename(OBJECT(dev)));
-    memory_region_init_ram(&dev->dev.rom, name, st.st_size);
+    memory_region_init_ram(&dev->dev.rom, NULL, name, st.st_size);
     vmstate_register_ram(&dev->dev.rom, &dev->dev.qdev);
     ptr = memory_region_get_ram_ptr(&dev->dev.rom);
     memset(ptr, 0xff, st.st_size);
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index f93629f..08da69e 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -601,7 +601,7 @@ static void vapic_map_rom_writable(VAPICROMState *s)
     rom_paddr &= TARGET_PAGE_MASK;
     rom_size = TARGET_PAGE_ALIGN(rom_size);
 
-    memory_region_init_alias(&s->rom, "kvmvapic-rom", section.mr, rom_paddr,
+    memory_region_init_alias(&s->rom, NULL, "kvmvapic-rom", section.mr, rom_paddr,
                              rom_size);
     memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
     s->rom_mapped_writable = true;
@@ -702,7 +702,7 @@ static int vapic_init(SysBusDevice *dev)
 {
     VAPICROMState *s = VAPIC(dev);
 
-    memory_region_init_io(&s->io, &vapic_ops, s, "kvmvapic", 2);
+    memory_region_init_io(&s->io, NULL, &vapic_ops, s, "kvmvapic", 2);
     sysbus_add_io(dev, VAPIC_IO_PORT, &s->io);
     sysbus_init_ioports(dev, VAPIC_IO_PORT, 2);
 
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 78f92e2..4345187 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -525,7 +525,7 @@ static void port92_initfn(Object *obj)
 {
     Port92State *s = PORT92(obj);
 
-    memory_region_init_io(&s->io, &port92_ops, s, "port92", 1);
+    memory_region_init_io(&s->io, NULL, &port92_ops, s, "port92", 1);
 
     s->outport = 0;
 }
@@ -1044,17 +1044,17 @@ FWCfgState *pc_memory_init(MemoryRegion *system_memory,
      * with older qemus that used qemu_ram_alloc().
      */
     ram = g_malloc(sizeof(*ram));
-    memory_region_init_ram(ram, "pc.ram",
+    memory_region_init_ram(ram, NULL, "pc.ram",
                            below_4g_mem_size + above_4g_mem_size);
     vmstate_register_ram_global(ram);
     *ram_memory = ram;
     ram_below_4g = g_malloc(sizeof(*ram_below_4g));
-    memory_region_init_alias(ram_below_4g, "ram-below-4g", ram,
+    memory_region_init_alias(ram_below_4g, NULL, "ram-below-4g", ram,
                              0, below_4g_mem_size);
     memory_region_add_subregion(system_memory, 0, ram_below_4g);
     if (above_4g_mem_size > 0) {
         ram_above_4g = g_malloc(sizeof(*ram_above_4g));
-        memory_region_init_alias(ram_above_4g, "ram-above-4g", ram,
+        memory_region_init_alias(ram_above_4g, NULL, "ram-above-4g", ram,
                                  below_4g_mem_size, above_4g_mem_size);
         memory_region_add_subregion(system_memory, 0x100000000ULL,
                                     ram_above_4g);
@@ -1065,7 +1065,7 @@ FWCfgState *pc_memory_init(MemoryRegion *system_memory,
     pc_system_firmware_init(rom_memory);
 
     option_rom_mr = g_malloc(sizeof(*option_rom_mr));
-    memory_region_init_ram(option_rom_mr, "pc.rom", PC_ROM_SIZE);
+    memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE);
     vmstate_register_ram_global(option_rom_mr);
     memory_region_add_subregion_overlap(rom_memory,
                                         PC_ROM_MIN_VGA,
@@ -1150,10 +1150,10 @@ void pc_basic_device_init(ISABus *isa_bus, qemu_irq *gsi,
     MemoryRegion *ioport80_io = g_new(MemoryRegion, 1);
     MemoryRegion *ioportF0_io = g_new(MemoryRegion, 1);
 
-    memory_region_init_io(ioport80_io, &ioport80_io_ops, NULL, "ioport80", 1);
+    memory_region_init_io(ioport80_io, NULL, &ioport80_io_ops, NULL, "ioport80", 1);
     memory_region_add_subregion(isa_bus->address_space_io, 0x80, ioport80_io);
 
-    memory_region_init_io(ioportF0_io, &ioportF0_io_ops, NULL, "ioportF0", 1);
+    memory_region_init_io(ioportF0_io, NULL, &ioportF0_io_ops, NULL, "ioportF0", 1);
     memory_region_add_subregion(isa_bus->address_space_io, 0xf0, ioportF0_io);
 
     /*
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index fa59a0c..faf947e 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -117,7 +117,7 @@ static void pc_init1(MemoryRegion *system_memory,
 
     if (pci_enabled) {
         pci_memory = g_new(MemoryRegion, 1);
-        memory_region_init(pci_memory, "pci", INT64_MAX);
+        memory_region_init(pci_memory, NULL, "pci", INT64_MAX);
         rom_memory = pci_memory;
     } else {
         pci_memory = NULL;
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index bb0ce6a..e4cde04 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -98,7 +98,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     /* pci enabled */
     if (pci_enabled) {
         pci_memory = g_new(MemoryRegion, 1);
-        memory_region_init(pci_memory, "pci", INT64_MAX);
+        memory_region_init(pci_memory, NULL, "pci", INT64_MAX);
         rom_memory = pci_memory;
     } else {
         pci_memory = NULL;
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 931dacd..e7734f3 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1158,8 +1158,8 @@ void ahci_init(AHCIState *s, DeviceState *qdev, AddressSpace *as, int ports)
     s->dev = g_malloc0(sizeof(AHCIDevice) * ports);
     ahci_reg_init(s);
     /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
-    memory_region_init_io(&s->mem, &ahci_mem_ops, s, "ahci", AHCI_MEM_BAR_SIZE);
-    memory_region_init_io(&s->idp, &ahci_idp_ops, s, "ahci-idp", 32);
+    memory_region_init_io(&s->mem, NULL, &ahci_mem_ops, s, "ahci", AHCI_MEM_BAR_SIZE);
+    memory_region_init_io(&s->idp, NULL, &ahci_idp_ops, s, "ahci-idp", 32);
 
     irqs = qemu_allocate_irqs(ahci_irq_set, s, s->ports);
 
diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index 9916701..a695dfb 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -117,8 +117,8 @@ static void setup_cmd646_bar(PCIIDEState *d, int bus_num)
 
     bar->bus = bus;
     bar->pci_dev = d;
-    memory_region_init_io(&bar->cmd, &cmd646_cmd_ops, bar, "cmd646-cmd", 4);
-    memory_region_init_io(&bar->data, &cmd646_data_ops, bar, "cmd646-data", 8);
+    memory_region_init_io(&bar->cmd, NULL, &cmd646_cmd_ops, bar, "cmd646-cmd", 4);
+    memory_region_init_io(&bar->data, NULL, &cmd646_data_ops, bar, "cmd646-data", 8);
 }
 
 static uint64_t bmdma_read(void *opaque, hwaddr addr,
@@ -203,13 +203,13 @@ static void bmdma_setup_bar(PCIIDEState *d)
     BMDMAState *bm;
     int i;
 
-    memory_region_init(&d->bmdma_bar, "cmd646-bmdma", 16);
+    memory_region_init(&d->bmdma_bar, NULL, "cmd646-bmdma", 16);
     for(i = 0;i < 2; i++) {
         bm = &d->bmdma[i];
-        memory_region_init_io(&bm->extra_io, &cmd646_bmdma_ops, bm,
+        memory_region_init_io(&bm->extra_io, NULL, &cmd646_bmdma_ops, bm,
                               "cmd646-bmdma-bus", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8, &bm->extra_io);
-        memory_region_init_io(&bm->addr_ioport, &bmdma_addr_ioport_ops, bm,
+        memory_region_init_io(&bm->addr_ioport, NULL, &bmdma_addr_ioport_ops, bm,
                               "cmd646-bmdma-ioport", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8 + 4, &bm->addr_ioport);
     }
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 84288ae..0c14009 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -335,7 +335,7 @@ static void macio_ide_initfn(Object *obj)
     MACIOIDEState *s = MACIO_IDE(obj);
 
     ide_bus_new(&s->bus, DEVICE(obj), 0, 2);
-    memory_region_init_io(&s->mem, &pmac_ide_ops, s, "pmac-ide", 0x1000);
+    memory_region_init_io(&s->mem, NULL, &pmac_ide_ops, s, "pmac-ide", 0x1000);
     sysbus_init_mmio(d, &s->mem);
     sysbus_init_irq(d, &s->irq);
     sysbus_init_irq(d, &s->dma_irq);
diff --git a/hw/ide/mmio.c b/hw/ide/mmio.c
index e80e7e5..8ae57d6 100644
--- a/hw/ide/mmio.c
+++ b/hw/ide/mmio.c
@@ -124,9 +124,9 @@ static void mmio_ide_realizefn(DeviceState *dev, Error **errp)
 
     ide_init2(&s->bus, s->irq);
 
-    memory_region_init_io(&s->iomem1, &mmio_ide_ops, s,
+    memory_region_init_io(&s->iomem1, NULL, &mmio_ide_ops, s,
                           "ide-mmio.1", 16 << s->shift);
-    memory_region_init_io(&s->iomem2, &mmio_ide_cs_ops, s,
+    memory_region_init_io(&s->iomem2, NULL, &mmio_ide_cs_ops, s,
                           "ide-mmio.2", 2 << s->shift);
     sysbus_init_mmio(d, &s->iomem1);
     sysbus_init_mmio(d, &s->iomem2);
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index bf2856f..af445db 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -90,14 +90,14 @@ static void bmdma_setup_bar(PCIIDEState *d)
 {
     int i;
 
-    memory_region_init(&d->bmdma_bar, "piix-bmdma-container", 16);
+    memory_region_init(&d->bmdma_bar, NULL, "piix-bmdma-container", 16);
     for(i = 0;i < 2; i++) {
         BMDMAState *bm = &d->bmdma[i];
 
-        memory_region_init_io(&bm->extra_io, &piix_bmdma_ops, bm,
+        memory_region_init_io(&bm->extra_io, NULL, &piix_bmdma_ops, bm,
                               "piix-bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8, &bm->extra_io);
-        memory_region_init_io(&bm->addr_ioport, &bmdma_addr_ioport_ops, bm,
+        memory_region_init_io(&bm->addr_ioport, NULL, &bmdma_addr_ioport_ops, bm,
                               "bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8 + 4, &bm->addr_ioport);
     }
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 5fe053c..1691717 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -92,14 +92,14 @@ static void bmdma_setup_bar(PCIIDEState *d)
 {
     int i;
 
-    memory_region_init(&d->bmdma_bar, "via-bmdma-container", 16);
+    memory_region_init(&d->bmdma_bar, NULL, "via-bmdma-container", 16);
     for(i = 0;i < 2; i++) {
         BMDMAState *bm = &d->bmdma[i];
 
-        memory_region_init_io(&bm->extra_io, &via_bmdma_ops, bm,
+        memory_region_init_io(&bm->extra_io, NULL, &via_bmdma_ops, bm,
                               "via-bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8, &bm->extra_io);
-        memory_region_init_io(&bm->addr_ioport, &bmdma_addr_ioport_ops, bm,
+        memory_region_init_io(&bm->addr_ioport, NULL, &bmdma_addr_ioport_ops, bm,
                               "bmdma", 4);
         memory_region_add_subregion(&d->bmdma_bar, i * 8 + 4, &bm->addr_ioport);
     }
diff --git a/hw/input/milkymist-softusb.c b/hw/input/milkymist-softusb.c
index 3edab4f..69e6485 100644
--- a/hw/input/milkymist-softusb.c
+++ b/hw/input/milkymist-softusb.c
@@ -265,17 +265,17 @@ static int milkymist_softusb_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, &softusb_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &softusb_mmio_ops, s,
                           "milkymist-softusb", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
     /* register pmem and dmem */
-    memory_region_init_ram(&s->pmem, "milkymist-softusb.pmem",
+    memory_region_init_ram(&s->pmem, NULL, "milkymist-softusb.pmem",
                            s->pmem_size);
     vmstate_register_ram_global(&s->pmem);
     s->pmem_ptr = memory_region_get_ram_ptr(&s->pmem);
     sysbus_init_mmio(dev, &s->pmem);
-    memory_region_init_ram(&s->dmem, "milkymist-softusb.dmem",
+    memory_region_init_ram(&s->dmem, NULL, "milkymist-softusb.dmem",
                            s->dmem_size);
     vmstate_register_ram_global(&s->dmem);
     s->dmem_ptr = memory_region_get_ram_ptr(&s->dmem);
diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
index fff0a4d..8d1d6a7 100644
--- a/hw/input/pckbd.c
+++ b/hw/input/pckbd.c
@@ -424,7 +424,7 @@ void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
 
     vmstate_register(NULL, 0, &vmstate_kbd, s);
 
-    memory_region_init_io(region, &i8042_mmio_ops, s, "i8042", size);
+    memory_region_init_io(region, NULL, &i8042_mmio_ops, s, "i8042", size);
 
     s->kbd = ps2_kbd_init(kbd_update_kbd_irq, s);
     s->mouse = ps2_mouse_init(kbd_update_aux_irq, s);
@@ -494,8 +494,8 @@ static void i8042_initfn(Object *obj)
     ISAKBDState *isa_s = I8042(obj);
     KBDState *s = &isa_s->kbd;
 
-    memory_region_init_io(isa_s->io + 0, &i8042_data_ops, s, "i8042-data", 1);
-    memory_region_init_io(isa_s->io + 1, &i8042_cmd_ops, s, "i8042-cmd", 1);
+    memory_region_init_io(isa_s->io + 0, NULL, &i8042_data_ops, s, "i8042-data", 1);
+    memory_region_init_io(isa_s->io + 1, NULL, &i8042_cmd_ops, s, "i8042-cmd", 1);
 }
 
 static void i8042_realizefn(DeviceState *dev, Error **errp)
diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 7dd8a59..871ffba 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -137,7 +137,7 @@ static int pl050_init(SysBusDevice *dev, int is_mouse)
 {
     pl050_state *s = FROM_SYSBUS(pl050_state, dev);
 
-    memory_region_init_io(&s->iomem, &pl050_ops, s, "pl050", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl050_ops, s, "pl050", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->is_mouse = is_mouse;
diff --git a/hw/input/pxa2xx_keypad.c b/hw/input/pxa2xx_keypad.c
index 1fd5f20..846d137 100644
--- a/hw/input/pxa2xx_keypad.c
+++ b/hw/input/pxa2xx_keypad.c
@@ -313,7 +313,7 @@ PXA2xxKeyPadState *pxa27x_keypad_init(MemoryRegion *sysmem,
     s = (PXA2xxKeyPadState *) g_malloc0(sizeof(PXA2xxKeyPadState));
     s->irq = irq;
 
-    memory_region_init_io(&s->iomem, &pxa2xx_keypad_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_keypad_ops, s,
                           "pxa2xx-keypad", 0x00100000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index 46cb097..d15c8be 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -873,7 +873,7 @@ static const MemoryRegionOps apic_io_ops = {
 
 static void apic_init(APICCommonState *s)
 {
-    memory_region_init_io(&s->io_memory, &apic_io_ops, s, "apic-msi",
+    memory_region_init_io(&s->io_memory, NULL, &apic_io_ops, s, "apic-msi",
                           APIC_SPACE_SIZE);
 
     s->timer = qemu_new_timer_ns(vm_clock, apic_timer, s);
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index bae6572..a5ff762 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -656,7 +656,7 @@ void gic_init_irqs_and_distributor(GICState *s, int num_irq)
     for (i = 0; i < NUM_CPU(s); i++) {
         sysbus_init_irq(&s->busdev, &s->parent_irq[i]);
     }
-    memory_region_init_io(&s->iomem, &gic_dist_ops, s, "gic_dist", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &gic_dist_ops, s, "gic_dist", 0x1000);
 }
 
 static void arm_gic_realize(DeviceState *dev, Error **errp)
@@ -682,11 +682,11 @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
      * GIC v2 defines a larger memory region (0x1000) so this will need
      * to be extended when we implement A15.
      */
-    memory_region_init_io(&s->cpuiomem[0], &gic_thiscpu_ops, s,
+    memory_region_init_io(&s->cpuiomem[0], NULL, &gic_thiscpu_ops, s,
                           "gic_cpu", 0x100);
     for (i = 0; i < NUM_CPU(s); i++) {
         s->backref[i] = s;
-        memory_region_init_io(&s->cpuiomem[i+1], &gic_cpu_ops, &s->backref[i],
+        memory_region_init_io(&s->cpuiomem[i+1], NULL, &gic_cpu_ops, &s->backref[i],
                               "gic_cpu", 0x100);
     }
     /* Distributor */
diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index b756456..687d1e2 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -120,7 +120,7 @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
         sysbus_init_irq(sbd, &s->parent_irq[i]);
     }
     /* Distributor */
-    memory_region_init_reservation(&s->iomem, "kvm-gic_dist", 0x1000);
+    memory_region_init_reservation(&s->iomem, NULL, "kvm-gic_dist", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     kvm_arm_register_device(&s->iomem,
                             (KVM_ARM_DEVICE_VGIC_V2 << KVM_ARM_DEVICE_ID_SHIFT)
@@ -129,7 +129,7 @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
      * provide the "interface for core #N" memory regions, because
      * cores with a VGIC don't have those.
      */
-    memory_region_init_reservation(&s->cpuiomem[0], "kvm-gic_cpu", 0x1000);
+    memory_region_init_reservation(&s->cpuiomem[0], NULL, "kvm-gic_cpu", 0x1000);
     sysbus_init_mmio(sbd, &s->cpuiomem[0]);
     kvm_arm_register_device(&s->cpuiomem[0],
                             (KVM_ARM_DEVICE_VGIC_V2 << KVM_ARM_DEVICE_ID_SHIFT)
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 25fa43c..74baa72 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -487,17 +487,17 @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
      * We use overlaying to put the GIC like registers
      * over the top of the system control register region.
      */
-    memory_region_init(&s->container, "nvic", 0x1000);
+    memory_region_init(&s->container, NULL, "nvic", 0x1000);
     /* The system register region goes at the bottom of the priority
      * stack as it covers the whole page.
      */
-    memory_region_init_io(&s->sysregmem, &nvic_sysreg_ops, s,
+    memory_region_init_io(&s->sysregmem, NULL, &nvic_sysreg_ops, s,
                           "nvic_sysregs", 0x1000);
     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
     /* Alias the GIC region so we can get only the section of it
      * we need, and layer it on top of the system register region.
      */
-    memory_region_init_alias(&s->gic_iomem_alias, "nvic-gic", &s->gic.iomem,
+    memory_region_init_alias(&s->gic_iomem_alias, NULL, "nvic-gic", &s->gic.iomem,
                              0x100, 0xc00);
     memory_region_add_subregion_overlap(&s->container, 0x100,
                                         &s->gic_iomem_alias, 1);
diff --git a/hw/intc/etraxfs_pic.c b/hw/intc/etraxfs_pic.c
index 635103c..81e1ab9 100644
--- a/hw/intc/etraxfs_pic.c
+++ b/hw/intc/etraxfs_pic.c
@@ -146,7 +146,7 @@ static int etraxfs_pic_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->parent_irq);
     sysbus_init_irq(dev, &s->parent_nmi);
 
-    memory_region_init_io(&s->mmio, &pic_ops, s, "etraxfs-pic", R_MAX * 4);
+    memory_region_init_io(&s->mmio, NULL, &pic_ops, s, "etraxfs-pic", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
     return 0;
 }
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index 6874287..644d6b3 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -417,7 +417,7 @@ static int exynos4210_combiner_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->output_irq[i]);
     }
 
-    memory_region_init_io(&s->iomem, &exynos4210_combiner_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_combiner_ops, s,
             "exynos4210-combiner", IIC_REGION_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index bad6dde..f9c4218 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -299,15 +299,15 @@ static int exynos4210_gic_init(SysBusDevice *dev)
     qdev_init_gpio_in(&s->busdev.qdev, exynos4210_gic_set_irq,
                       EXYNOS4210_GIC_NIRQ - 32);
 
-    memory_region_init(&s->cpu_container, "exynos4210-cpu-container",
+    memory_region_init(&s->cpu_container, NULL, "exynos4210-cpu-container",
             EXYNOS4210_EXT_GIC_CPU_REGION_SIZE);
-    memory_region_init(&s->dist_container, "exynos4210-dist-container",
+    memory_region_init(&s->dist_container, NULL, "exynos4210-dist-container",
             EXYNOS4210_EXT_GIC_DIST_REGION_SIZE);
 
     for (i = 0; i < s->num_cpu; i++) {
         /* Map CPU interface per SMP Core */
         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
-        memory_region_init_alias(&s->cpu_alias[i],
+        memory_region_init_alias(&s->cpu_alias[i], NULL,
                                  cpu_alias_name,
                                  sysbus_mmio_get_region(busdev, 1),
                                  0,
@@ -317,7 +317,7 @@ static int exynos4210_gic_init(SysBusDevice *dev)
 
         /* Map Distributor per SMP Core */
         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
-        memory_region_init_alias(&s->dist_alias[i],
+        memory_region_init_alias(&s->dist_alias[i], NULL,
                                  dist_alias_name,
                                  sysbus_mmio_get_region(busdev, 0),
                                  0,
diff --git a/hw/intc/grlib_irqmp.c b/hw/intc/grlib_irqmp.c
index 68dfe6a..f933e6a 100644
--- a/hw/intc/grlib_irqmp.c
+++ b/hw/intc/grlib_irqmp.c
@@ -344,7 +344,7 @@ static int grlib_irqmp_init(SysBusDevice *dev)
         return -1;
     }
 
-    memory_region_init_io(&irqmp->iomem, &grlib_irqmp_ops, irqmp,
+    memory_region_init_io(&irqmp->iomem, NULL, &grlib_irqmp_ops, irqmp,
                           "irqmp", IRQMP_REG_SIZE);
 
     irqmp->state = g_malloc0(sizeof *irqmp->state);
diff --git a/hw/intc/heathrow_pic.c b/hw/intc/heathrow_pic.c
index beb9661..9818f24 100644
--- a/hw/intc/heathrow_pic.c
+++ b/hw/intc/heathrow_pic.c
@@ -205,7 +205,7 @@ qemu_irq *heathrow_pic_init(MemoryRegion **pmem,
     s = g_malloc0(sizeof(HeathrowPICS));
     /* only 1 CPU */
     s->irqs = irqs[0];
-    memory_region_init_io(&s->mem, &heathrow_pic_ops, s,
+    memory_region_init_io(&s->mem, NULL, &heathrow_pic_ops, s,
                           "heathrow-pic", 0x1000);
     *pmem = &s->mem;
 
diff --git a/hw/intc/i8259.c b/hw/intc/i8259.c
index 192a0ba..13250f1 100644
--- a/hw/intc/i8259.c
+++ b/hw/intc/i8259.c
@@ -417,8 +417,8 @@ static void pic_realize(DeviceState *dev, Error **err)
     PICCommonState *s = PIC_COMMON(dev);
     PICClass *pc = PIC_GET_CLASS(dev);
 
-    memory_region_init_io(&s->base_io, &pic_base_ioport_ops, s, "pic", 2);
-    memory_region_init_io(&s->elcr_io, &pic_elcr_ioport_ops, s, "elcr", 1);
+    memory_region_init_io(&s->base_io, NULL, &pic_base_ioport_ops, s, "pic", 2);
+    memory_region_init_io(&s->elcr_io, NULL, &pic_elcr_ioport_ops, s, "elcr", 1);
 
     qdev_init_gpio_out(dev, s->int_out, ARRAY_SIZE(s->int_out));
     qdev_init_gpio_in(dev, pic_set_irq, 8);
diff --git a/hw/intc/imx_avic.c b/hw/intc/imx_avic.c
index ff45dcd..870d56f 100644
--- a/hw/intc/imx_avic.c
+++ b/hw/intc/imx_avic.c
@@ -372,7 +372,7 @@ static int imx_avic_init(SysBusDevice *dev)
 {
     IMXAVICState *s = FROM_SYSBUS(IMXAVICState, dev);
 
-    memory_region_init_io(&s->iomem, &imx_avic_ops, s, "imx_avic", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &imx_avic_ops, s, "imx_avic", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     qdev_init_gpio_in(&dev->qdev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index c6f09f4..7299b50 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -227,7 +227,7 @@ static const MemoryRegionOps ioapic_io_ops = {
 
 static void ioapic_init(IOAPICCommonState *s, int instance_no)
 {
-    memory_region_init_io(&s->io_memory, &ioapic_io_ops, s, "ioapic", 0x1000);
+    memory_region_init_io(&s->io_memory, NULL, &ioapic_io_ops, s, "ioapic", 0x1000);
 
     qdev_init_gpio_in(&s->busdev.qdev, ioapic_set_irq, IOAPIC_NUM_PINS);
 
diff --git a/hw/intc/omap_intc.c b/hw/intc/omap_intc.c
index 875eba4..00cb6ca 100644
--- a/hw/intc/omap_intc.c
+++ b/hw/intc/omap_intc.c
@@ -367,7 +367,7 @@ static int omap_intc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->parent_intr[0]);
     sysbus_init_irq(dev, &s->parent_intr[1]);
     qdev_init_gpio_in(&dev->qdev, omap_set_intr, s->nbanks * 32);
-    memory_region_init_io(&s->mmio, &omap_inth_mem_ops, s,
+    memory_region_init_io(&s->mmio, NULL, &omap_inth_mem_ops, s,
                           "omap-intc", s->size);
     sysbus_init_mmio(dev, &s->mmio);
     return 0;
@@ -609,7 +609,7 @@ static int omap2_intc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->parent_intr[0]);
     sysbus_init_irq(dev, &s->parent_intr[1]);
     qdev_init_gpio_in(&dev->qdev, omap_set_intr_noedge, s->nbanks * 32);
-    memory_region_init_io(&s->mmio, &omap2_inth_mem_ops, s,
+    memory_region_init_io(&s->mmio, NULL, &omap2_inth_mem_ops, s,
                           "omap2-intc", 0x1000);
     sysbus_init_mmio(dev, &s->mmio);
     return 0;
diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index a26c641..b9e025f 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -1516,7 +1516,7 @@ static void map_list(OpenPICState *opp, const MemReg *list, int *count)
     while (list->name) {
         assert(*count < ARRAY_SIZE(opp->sub_io_mem));
 
-        memory_region_init_io(&opp->sub_io_mem[*count], list->ops, opp,
+        memory_region_init_io(&opp->sub_io_mem[*count], NULL, list->ops, opp,
                               list->name, list->size);
 
         memory_region_add_subregion(&opp->mem, list->start_addr,
@@ -1531,7 +1531,7 @@ static void openpic_init(Object *obj)
 {
     OpenPICState *opp = OPENPIC(obj);
 
-    memory_region_init(&opp->mem, "openpic", 0x40000);
+    memory_region_init(&opp->mem, NULL, "openpic", 0x40000);
 }
 
 static void openpic_realize(DeviceState *dev, Error **errp)
diff --git a/hw/intc/openpic_kvm.c b/hw/intc/openpic_kvm.c
index 6775879..dc08031 100644
--- a/hw/intc/openpic_kvm.c
+++ b/hw/intc/openpic_kvm.c
@@ -155,7 +155,7 @@ static void kvm_openpic_init(Object *obj)
 {
     KVMOpenPICState *opp = KVM_OPENPIC(obj);
 
-    memory_region_init_io(&opp->mem, &kvm_openpic_mem_ops, opp,
+    memory_region_init_io(&opp->mem, NULL, &kvm_openpic_mem_ops, opp,
                           "kvm-openpic", 0x40000);
 }
 
diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index 9610673..5f0f9b7 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -236,7 +236,7 @@ static int pl190_init(SysBusDevice *dev)
 {
     pl190_state *s = FROM_SYSBUS(pl190_state, dev);
 
-    memory_region_init_io(&s->iomem, &pl190_ops, s, "pl190", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl190_ops, s, "pl190", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     qdev_init_gpio_in(&dev->qdev, pl190_set_irq, 32);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/intc/puv3_intc.c b/hw/intc/puv3_intc.c
index 0cd5e9e..b327f0e 100644
--- a/hw/intc/puv3_intc.c
+++ b/hw/intc/puv3_intc.c
@@ -106,7 +106,7 @@ static int puv3_intc_init(SysBusDevice *dev)
     s->reg_ICMR = 0;
     s->reg_ICPR = 0;
 
-    memory_region_init_io(&s->iomem, &puv3_intc_ops, s, "puv3_intc",
+    memory_region_init_io(&s->iomem, NULL, &puv3_intc_ops, s, "puv3_intc",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/intc/realview_gic.c b/hw/intc/realview_gic.c
index 0ec30ca..1731a70 100644
--- a/hw/intc/realview_gic.c
+++ b/hw/intc/realview_gic.c
@@ -43,7 +43,7 @@ static int realview_gic_init(SysBusDevice *dev)
     /* Pass through inbound GPIO lines to the GIC */
     qdev_init_gpio_in(&s->busdev.qdev, realview_gic_set_irq, numirq - 32);
 
-    memory_region_init(&s->container, "realview-gic-container", 0x2000);
+    memory_region_init(&s->container, NULL, "realview-gic-container", 0x2000);
     memory_region_add_subregion(&s->container, 0,
                                 sysbus_mmio_get_region(busdev, 1));
     memory_region_add_subregion(&s->container, 0x1000,
diff --git a/hw/intc/sh_intc.c b/hw/intc/sh_intc.c
index 050bfb6..f397950 100644
--- a/hw/intc/sh_intc.c
+++ b/hw/intc/sh_intc.c
@@ -319,11 +319,11 @@ static unsigned int sh_intc_register(MemoryRegion *sysmem,
 
 #define SH_INTC_IOMEM_FORMAT "interrupt-controller-%s-%s-%s"
     snprintf(name, sizeof(name), SH_INTC_IOMEM_FORMAT, type, action, "p4");
-    memory_region_init_alias(iomem_p4, name, iomem, INTC_A7(address), 4);
+    memory_region_init_alias(iomem_p4, NULL, name, iomem, INTC_A7(address), 4);
     memory_region_add_subregion(sysmem, P4ADDR(address), iomem_p4);
 
     snprintf(name, sizeof(name), SH_INTC_IOMEM_FORMAT, type, action, "a7");
-    memory_region_init_alias(iomem_a7, name, iomem, INTC_A7(address), 4);
+    memory_region_init_alias(iomem_a7, NULL, name, iomem, INTC_A7(address), 4);
     memory_region_add_subregion(sysmem, A7ADDR(address), iomem_a7);
 #undef SH_INTC_IOMEM_FORMAT
 
@@ -466,7 +466,7 @@ int sh_intc_init(MemoryRegion *sysmem,
 
     desc->irqs = qemu_allocate_irqs(sh_intc_set_irq, desc, nr_sources);
  
-    memory_region_init_io(&desc->iomem, &sh_intc_ops, desc,
+    memory_region_init_io(&desc->iomem, NULL, &sh_intc_ops, desc,
                           "interrupt-controller", 0x100000000ULL);
 
 #define INT_REG_PARAMS(reg_struct, type, action, j) \
diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index b367752..716e36d 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -426,7 +426,7 @@ static int slavio_intctl_init1(SysBusDevice *dev)
     char slave_name[45];
 
     qdev_init_gpio_in(&dev->qdev, slavio_set_irq_all, 32 + MAX_CPUS);
-    memory_region_init_io(&s->iomem, &slavio_intctlm_mem_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &slavio_intctlm_mem_ops, s,
                           "master-interrupt-controller", INTCTLM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -436,7 +436,7 @@ static int slavio_intctl_init1(SysBusDevice *dev)
         for (j = 0; j < MAX_PILS; j++) {
             sysbus_init_irq(dev, &s->cpu_irqs[i][j]);
         }
-        memory_region_init_io(&s->slaves[i].iomem, &slavio_intctl_mem_ops,
+        memory_region_init_io(&s->slaves[i].iomem, NULL, &slavio_intctl_mem_ops,
                               &s->slaves[i], slave_name, INTCTL_SIZE);
         sysbus_init_mmio(dev, &s->slaves[i].iomem);
         s->slaves[i].cpu = i;
diff --git a/hw/intc/xilinx_intc.c b/hw/intc/xilinx_intc.c
index 297f537..9ba35f6 100644
--- a/hw/intc/xilinx_intc.c
+++ b/hw/intc/xilinx_intc.c
@@ -160,7 +160,7 @@ static int xilinx_intc_init(SysBusDevice *dev)
     qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
     sysbus_init_irq(dev, &p->parent_irq);
 
-    memory_region_init_io(&p->mmio, &pic_ops, p, "xlnx.xps-intc", R_MAX * 4);
+    memory_region_init_io(&p->mmio, NULL, &pic_ops, p, "xlnx.xps-intc", R_MAX * 4);
     sysbus_init_mmio(dev, &p->mmio);
     return 0;
 }
diff --git a/hw/isa/apm.c b/hw/isa/apm.c
index 5f21d21..daed6f1 100644
--- a/hw/isa/apm.c
+++ b/hw/isa/apm.c
@@ -96,7 +96,7 @@ void apm_init(PCIDevice *dev, APMState *apm, apm_ctrl_changed_t callback,
     apm->arg = arg;
 
     /* ioport 0xb2, 0xb3 */
-    memory_region_init_io(&apm->io, &apm_ops, apm, "apm-io", 2);
+    memory_region_init_io(&apm->io, NULL, &apm_ops, apm, "apm-io", 2);
     memory_region_add_subregion(pci_address_space_io(dev), APM_CNT_IOPORT,
                                 &apm->io);
 }
diff --git a/hw/isa/i82378.c b/hw/isa/i82378.c
index a24cb98..90f36d5 100644
--- a/hw/isa/i82378.c
+++ b/hw/isa/i82378.c
@@ -221,10 +221,10 @@ static int pci_i82378_init(PCIDevice *dev)
 
     pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin 0 */
 
-    memory_region_init_io(&s->io, &i82378_io_ops, s, "i82378-io", 0x00010000);
+    memory_region_init_io(&s->io, NULL, &i82378_io_ops, s, "i82378-io", 0x00010000);
     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io);
 
-    memory_region_init_io(&s->mem, &i82378_mem_ops, s, "i82378-mem", 0x01000000);
+    memory_region_init_io(&s->mem, NULL, &i82378_mem_ops, s, "i82378-mem", 0x01000000);
     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
 
     /* Make I/O address read only */
diff --git a/hw/isa/isa_mmio.c b/hw/isa/isa_mmio.c
index d4dbf13..00ae8eb 100644
--- a/hw/isa/isa_mmio.c
+++ b/hw/isa/isa_mmio.c
@@ -69,7 +69,7 @@ static const MemoryRegionOps isa_mmio_ops = {
 
 void isa_mmio_setup(MemoryRegion *mr, hwaddr size)
 {
-    memory_region_init_io(mr, &isa_mmio_ops, NULL, "isa-mmio", size);
+    memory_region_init_io(mr, NULL, &isa_mmio_ops, NULL, "isa-mmio", size);
 }
 
 void isa_mmio_init(hwaddr base, hwaddr size)
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index 461ab7c..82f8ea6 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -535,7 +535,7 @@ static int ich9_lpc_initfn(PCIDevice *d)
     pci_set_long(d->wmask + ICH9_LPC_PMBASE,
                  ICH9_LPC_PMBASE_BASE_ADDRESS_MASK);
 
-    memory_region_init_io(&lpc->rbca_mem, &rbca_mmio_ops, lpc,
+    memory_region_init_io(&lpc->rbca_mem, NULL, &rbca_mmio_ops, lpc,
                             "lpc-rbca-mmio", ICH9_CC_SIZE);
 
     lpc->isa_bus = isa_bus;
@@ -546,7 +546,7 @@ static int ich9_lpc_initfn(PCIDevice *d)
     lpc->machine_ready.notify = ich9_lpc_machine_ready;
     qemu_add_machine_init_done_notifier(&lpc->machine_ready);
 
-    memory_region_init_io(&lpc->rst_cnt_mem, &ich9_rst_cnt_ops, lpc,
+    memory_region_init_io(&lpc->rst_cnt_mem, NULL, &ich9_rst_cnt_ops, lpc,
                           "lpc-reset-control", 1);
     memory_region_add_subregion_overlap(pci_address_space_io(d),
                                         ICH9_RST_CNT_IOPORT, &lpc->rst_cnt_mem,
diff --git a/hw/isa/pc87312.c b/hw/isa/pc87312.c
index cc426df..7b3e7fb 100644
--- a/hw/isa/pc87312.c
+++ b/hw/isa/pc87312.c
@@ -352,7 +352,7 @@ static void pc87312_initfn(Object *obj)
 {
     PC87312State *s = PC87312(obj);
 
-    memory_region_init_io(&s->io, &pc87312_io_ops, s, "pc87312", 2);
+    memory_region_init_io(&s->io, NULL, &pc87312_io_ops, s, "pc87312", 2);
 }
 
 static const VMStateDescription vmstate_pc87312 = {
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index e5cd4cd..1f63197 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -356,7 +356,7 @@ static int vt82c686b_pm_initfn(PCIDevice *dev)
 
     apm_init(dev, &s->apm, NULL, s);
 
-    memory_region_init(&s->io, "vt82c686-pm", 64);
+    memory_region_init(&s->io, NULL, "vt82c686-pm", 64);
     memory_region_set_enabled(&s->io, false);
     memory_region_add_subregion(get_system_io(), 0, &s->io);
 
@@ -443,8 +443,8 @@ static int vt82c686b_initfn(PCIDevice *d)
        }
     }
 
-    memory_region_init_io(&vt82c->superio, &superio_ops, &vt82c->superio_conf,
-                          "superio", 2);
+    memory_region_init_io(&vt82c->superio, NULL, &superio_ops,
+                          &vt82c->superio_conf, "superio", 2);
     memory_region_set_enabled(&vt82c->superio, false);
     /* The floppy also uses 0x3f0 and 0x3f1.
      * But we do not emulate a floppy, so just set it here. */
diff --git a/hw/lm32/lm32_boards.c b/hw/lm32/lm32_boards.c
index 1ca9498..62003b8 100644
--- a/hw/lm32/lm32_boards.c
+++ b/hw/lm32/lm32_boards.c
@@ -106,7 +106,7 @@ static void lm32_evr_init(QEMUMachineInitArgs *args)
 
     reset_info->flash_base = flash_base;
 
-    memory_region_init_ram(phys_ram, "lm32_evr.sdram", ram_size);
+    memory_region_init_ram(phys_ram, NULL, "lm32_evr.sdram", ram_size);
     vmstate_register_ram_global(phys_ram);
     memory_region_add_subregion(address_space_mem, ram_base, phys_ram);
 
@@ -203,7 +203,7 @@ static void lm32_uclinux_init(QEMUMachineInitArgs *args)
 
     reset_info->flash_base = flash_base;
 
-    memory_region_init_ram(phys_ram, "lm32_uclinux.sdram", ram_size);
+    memory_region_init_ram(phys_ram, NULL, "lm32_uclinux.sdram", ram_size);
     vmstate_register_ram_global(phys_ram);
     memory_region_add_subregion(address_space_mem, ram_base, phys_ram);
 
diff --git a/hw/lm32/milkymist.c b/hw/lm32/milkymist.c
index cca9374..7ceedb8 100644
--- a/hw/lm32/milkymist.c
+++ b/hw/lm32/milkymist.c
@@ -112,7 +112,7 @@ milkymist_init(QEMUMachineInitArgs *args)
 
     cpu_lm32_set_phys_msb_ignore(env, 1);
 
-    memory_region_init_ram(phys_sdram, "milkymist.sdram", sdram_size);
+    memory_region_init_ram(phys_sdram, NULL, "milkymist.sdram", sdram_size);
     vmstate_register_ram_global(phys_sdram);
     memory_region_add_subregion(address_space_mem, sdram_base, phys_sdram);
 
diff --git a/hw/m68k/an5206.c b/hw/m68k/an5206.c
index c4a5626..0c03a87 100644
--- a/hw/m68k/an5206.c
+++ b/hw/m68k/an5206.c
@@ -49,12 +49,12 @@ static void an5206_init(QEMUMachineInitArgs *args)
     env->rambar0 = AN5206_RAMBAR_ADDR | 1;
 
     /* DRAM at address zero */
-    memory_region_init_ram(ram, "an5206.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "an5206.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, 0, ram);
 
     /* Internal SRAM.  */
-    memory_region_init_ram(sram, "an5206.sram", 512);
+    memory_region_init_ram(sram, NULL, "an5206.sram", 512);
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, AN5206_RAMBAR_ADDR, sram);
 
diff --git a/hw/m68k/dummy_m68k.c b/hw/m68k/dummy_m68k.c
index 544d56b..f4ed7c6 100644
--- a/hw/m68k/dummy_m68k.c
+++ b/hw/m68k/dummy_m68k.c
@@ -40,7 +40,7 @@ static void dummy_m68k_init(QEMUMachineInitArgs *args)
     env->vbr = 0;
 
     /* RAM at address zero */
-    memory_region_init_ram(ram, "dummy_m68k.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "dummy_m68k.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, 0, ram);
 
diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c
index bcc619d..1727a46 100644
--- a/hw/m68k/mcf5206.c
+++ b/hw/m68k/mcf5206.c
@@ -532,7 +532,7 @@ qemu_irq *mcf5206_init(MemoryRegion *sysmem, uint32_t base, M68kCPU *cpu)
 
     s = (m5206_mbar_state *)g_malloc0(sizeof(m5206_mbar_state));
 
-    memory_region_init_io(&s->iomem, &m5206_mbar_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &m5206_mbar_ops, s,
                           "mbar", 0x00001000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
index 05efde7..9cf000f 100644
--- a/hw/m68k/mcf5208.c
+++ b/hw/m68k/mcf5208.c
@@ -172,14 +172,14 @@ static void mcf5208_sys_init(MemoryRegion *address_space, qemu_irq *pic)
     int i;
 
     /* SDRAMC.  */
-    memory_region_init_io(iomem, &m5208_sys_ops, NULL, "m5208-sys", 0x00004000);
+    memory_region_init_io(iomem, NULL, &m5208_sys_ops, NULL, "m5208-sys", 0x00004000);
     memory_region_add_subregion(address_space, 0xfc0a8000, iomem);
     /* Timers.  */
     for (i = 0; i < 2; i++) {
         s = (m5208_timer_state *)g_malloc0(sizeof(m5208_timer_state));
         bh = qemu_bh_new(m5208_timer_trigger, s);
         s->timer = ptimer_init(bh);
-        memory_region_init_io(&s->iomem, &m5208_timer_ops, s,
+        memory_region_init_io(&s->iomem, NULL, &m5208_timer_ops, s,
                               "m5208-timer", 0x00004000);
         memory_region_add_subregion(address_space, 0xfc080000 + 0x4000 * i,
                                     &s->iomem);
@@ -217,12 +217,12 @@ static void mcf5208evb_init(QEMUMachineInitArgs *args)
     /* TODO: Configure BARs.  */
 
     /* DRAM at 0x40000000 */
-    memory_region_init_ram(ram, "mcf5208.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "mcf5208.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, 0x40000000, ram);
 
     /* Internal SRAM.  */
-    memory_region_init_ram(sram, "mcf5208.sram", 16384);
+    memory_region_init_ram(sram, NULL, "mcf5208.sram", 16384);
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, 0x80000000, sram);
 
diff --git a/hw/m68k/mcf_intc.c b/hw/m68k/mcf_intc.c
index cfe660d..621423c 100644
--- a/hw/m68k/mcf_intc.c
+++ b/hw/m68k/mcf_intc.c
@@ -147,7 +147,7 @@ qemu_irq *mcf_intc_init(MemoryRegion *sysmem,
     s->cpu = cpu;
     mcf_intc_reset(s);
 
-    memory_region_init_io(&s->iomem, &mcf_intc_ops, s, "mcf", 0x100);
+    memory_region_init_io(&s->iomem, NULL, &mcf_intc_ops, s, "mcf", 0x100);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     return qemu_allocate_irqs(mcf_intc_set_irq, s, 64);
diff --git a/hw/microblaze/petalogix_ml605_mmu.c b/hw/microblaze/petalogix_ml605_mmu.c
index 3340468..989da25 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -98,12 +98,12 @@ petalogix_ml605_init(QEMUMachineInitArgs *args)
     env = &cpu->env;
 
     /* Attach emulated BRAM through the LMB.  */
-    memory_region_init_ram(phys_lmb_bram, "petalogix_ml605.lmb_bram",
+    memory_region_init_ram(phys_lmb_bram, NULL, "petalogix_ml605.lmb_bram",
                            LMB_BRAM_SIZE);
     vmstate_register_ram_global(phys_lmb_bram);
     memory_region_add_subregion(address_space_mem, 0x00000000, phys_lmb_bram);
 
-    memory_region_init_ram(phys_ram, "petalogix_ml605.ram", ram_size);
+    memory_region_init_ram(phys_ram, NULL, "petalogix_ml605.ram", ram_size);
     vmstate_register_ram_global(phys_ram);
     memory_region_add_subregion(address_space_mem, ddr_base, phys_ram);
 
diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index b3bcd4e..a461494 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -80,12 +80,12 @@ petalogix_s3adsp1800_init(QEMUMachineInitArgs *args)
     env = &cpu->env;
 
     /* Attach emulated BRAM through the LMB.  */
-    memory_region_init_ram(phys_lmb_bram,
+    memory_region_init_ram(phys_lmb_bram, NULL,
                            "petalogix_s3adsp1800.lmb_bram", LMB_BRAM_SIZE);
     vmstate_register_ram_global(phys_lmb_bram);
     memory_region_add_subregion(sysmem, 0x00000000, phys_lmb_bram);
 
-    memory_region_init_ram(phys_ram, "petalogix_s3adsp1800.ram", ram_size);
+    memory_region_init_ram(phys_ram, NULL, "petalogix_s3adsp1800.ram", ram_size);
     vmstate_register_ram_global(phys_ram);
     memory_region_add_subregion(sysmem, ddr_base, phys_ram);
 
diff --git a/hw/mips/gt64xxx_pci.c b/hw/mips/gt64xxx_pci.c
index 189e865..d2739eb 100644
--- a/hw/mips/gt64xxx_pci.c
+++ b/hw/mips/gt64xxx_pci.c
@@ -1108,7 +1108,7 @@ PCIBus *gt64120_register(qemu_irq *pic)
                                 get_system_memory(),
                                 get_system_io(),
                                 PCI_DEVFN(18, 0), 4, TYPE_PCI_BUS);
-    memory_region_init_io(&d->ISD_mem, &isd_mem_ops, d, "isd-mem", 0x1000);
+    memory_region_init_io(&d->ISD_mem, NULL, &isd_mem_ops, d, "isd-mem", 0x1000);
 
     pci_create_simple(phb->bus, PCI_DEVFN(0, 0), "gt64120_pci");
     return phb->bus;
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index 00c9071..7d198e7 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -300,9 +300,9 @@ static void mips_fulong2e_init(QEMUMachineInitArgs *args)
     bios_size = 1024 * 1024;
 
     /* allocate RAM */
-    memory_region_init_ram(ram, "fulong2e.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "fulong2e.ram", ram_size);
     vmstate_register_ram_global(ram);
-    memory_region_init_ram(bios, "fulong2e.bios", bios_size);
+    memory_region_init_ram(bios, NULL, "fulong2e.bios", bios_size);
     vmstate_register_ram_global(bios);
     memory_region_set_readonly(bios, true);
 
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 2ad0c0b..3eac63b 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -152,14 +152,14 @@ static void mips_jazz_init(MemoryRegion *address_space,
     qemu_register_reset(main_cpu_reset, cpu);
 
     /* allocate RAM */
-    memory_region_init_ram(ram, "mips_jazz.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "mips_jazz.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space, 0, ram);
 
-    memory_region_init_ram(bios, "mips_jazz.bios", MAGNUM_BIOS_SIZE);
+    memory_region_init_ram(bios, NULL, "mips_jazz.bios", MAGNUM_BIOS_SIZE);
     vmstate_register_ram_global(bios);
     memory_region_set_readonly(bios, true);
-    memory_region_init_alias(bios2, "mips_jazz.bios", bios,
+    memory_region_init_alias(bios2, NULL, "mips_jazz.bios", bios,
                              0, MAGNUM_BIOS_SIZE);
     memory_region_add_subregion(address_space, 0x1fc00000LL, bios);
     memory_region_add_subregion(address_space, 0xfff00000LL, bios2);
@@ -188,7 +188,7 @@ static void mips_jazz_init(MemoryRegion *address_space,
     /* Chipset */
     rc4030_opaque = rc4030_init(env->irq[6], env->irq[3], &rc4030, &dmas,
                                 address_space);
-    memory_region_init_io(dma_dummy, &dma_dummy_ops, NULL, "dummy_dma", 0x1000);
+    memory_region_init_io(dma_dummy, NULL, &dma_dummy_ops, NULL, "dummy_dma", 0x1000);
     memory_region_add_subregion(address_space, 0x8000d000, dma_dummy);
 
     /* ISA devices */
@@ -216,7 +216,7 @@ static void mips_jazz_init(MemoryRegion *address_space,
         {
             /* Simple ROM, so user doesn't have to provide one */
             MemoryRegion *rom_mr = g_new(MemoryRegion, 1);
-            memory_region_init_ram(rom_mr, "g364fb.rom", 0x80000);
+            memory_region_init_ram(rom_mr, NULL, "g364fb.rom", 0x80000);
             vmstate_register_ram_global(rom_mr);
             memory_region_set_readonly(rom_mr, true);
             uint8_t *rom = memory_region_get_ram_ptr(rom_mr);
@@ -266,7 +266,7 @@ static void mips_jazz_init(MemoryRegion *address_space,
 
     /* Real time clock */
     rtc_init(isa_bus, 1980, NULL);
-    memory_region_init_io(rtc, &rtc_ops, NULL, "rtc", 0x1000);
+    memory_region_init_io(rtc, NULL, &rtc_ops, NULL, "rtc", 0x1000);
     memory_region_add_subregion(address_space, 0x80004000, rtc);
 
     /* Keyboard (i8042) */
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 8a4459d..c27ed0b 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -446,11 +446,11 @@ static MaltaFPGAState *malta_fpga_init(MemoryRegion *address_space,
 
     s = (MaltaFPGAState *)g_malloc0(sizeof(MaltaFPGAState));
 
-    memory_region_init_io(&s->iomem, &malta_fpga_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &malta_fpga_ops, s,
                           "malta-fpga", 0x100000);
-    memory_region_init_alias(&s->iomem_lo, "malta-fpga",
+    memory_region_init_alias(&s->iomem_lo, NULL, "malta-fpga",
                              &s->iomem, 0, 0x900);
-    memory_region_init_alias(&s->iomem_hi, "malta-fpga",
+    memory_region_init_alias(&s->iomem_hi, NULL, "malta-fpga",
                              &s->iomem, 0xa00, 0x10000-0xa00);
 
     memory_region_add_subregion(address_space, base, &s->iomem_lo);
@@ -853,7 +853,7 @@ void mips_malta_init(QEMUMachineInitArgs *args)
                 ((unsigned int)ram_size / (1 << 20)));
         exit(1);
     }
-    memory_region_init_ram(ram, "mips_malta.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "mips_malta.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(system_memory, 0, ram);
 
@@ -927,7 +927,7 @@ void mips_malta_init(QEMUMachineInitArgs *args)
     }
 
     /* Map the BIOS at a 2nd physical location, as on the real board. */
-    memory_region_init_alias(bios_alias, "bios.1fc", bios, 0, BIOS_SIZE);
+    memory_region_init_alias(bios_alias, NULL, "bios.1fc", bios, 0, BIOS_SIZE);
     memory_region_add_subregion(system_memory, RESET_ADDRESS, bios_alias);
 
     /* Board ID = 0x420 (Malta Board with CoreLV)
diff --git a/hw/mips/mips_mipssim.c b/hw/mips/mips_mipssim.c
index d1681ec..a10cf13 100644
--- a/hw/mips/mips_mipssim.c
+++ b/hw/mips/mips_mipssim.c
@@ -168,9 +168,9 @@ mips_mipssim_init(QEMUMachineInitArgs *args)
     qemu_register_reset(main_cpu_reset, reset_info);
 
     /* Allocate RAM. */
-    memory_region_init_ram(ram, "mips_mipssim.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "mips_mipssim.ram", ram_size);
     vmstate_register_ram_global(ram);
-    memory_region_init_ram(bios, "mips_mipssim.bios", BIOS_SIZE);
+    memory_region_init_ram(bios, NULL, "mips_mipssim.bios", BIOS_SIZE);
     vmstate_register_ram_global(bios);
     memory_region_set_readonly(bios, true);
 
diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index 4646ab6..22beb0a 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -202,12 +202,12 @@ void mips_r4k_init(QEMUMachineInitArgs *args)
                 ((unsigned int)ram_size / (1 << 20)));
         exit(1);
     }
-    memory_region_init_ram(ram, "mips_r4k.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "mips_r4k.ram", ram_size);
     vmstate_register_ram_global(ram);
 
     memory_region_add_subregion(address_space_mem, 0, ram);
 
-    memory_region_init_io(iomem, &mips_qemu_ops, NULL, "mips-qemu", 0x10000);
+    memory_region_init_io(iomem, NULL, &mips_qemu_ops, NULL, "mips-qemu", 0x10000);
     memory_region_add_subregion(address_space_mem, 0x1fbf0000, iomem);
 
     /* Try to load a BIOS image. If this fails, we continue regardless,
@@ -229,7 +229,7 @@ void mips_r4k_init(QEMUMachineInitArgs *args)
 #endif
     if ((bios_size > 0) && (bios_size <= BIOS_SIZE)) {
         bios = g_new(MemoryRegion, 1);
-        memory_region_init_ram(bios, "mips_r4k.bios", BIOS_SIZE);
+        memory_region_init_ram(bios, NULL, "mips_r4k.bios", BIOS_SIZE);
         vmstate_register_ram_global(bios);
         memory_region_set_readonly(bios, true);
         memory_region_add_subregion(get_system_memory(), 0x1fc00000, bios);
diff --git a/hw/misc/a9scu.c b/hw/misc/a9scu.c
index 05897c2..c8f26f9 100644
--- a/hw/misc/a9scu.c
+++ b/hw/misc/a9scu.c
@@ -119,7 +119,7 @@ static void a9_scu_realize(DeviceState *dev, Error ** errp)
     A9SCUState *s = A9_SCU(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    memory_region_init_io(&s->iomem, &a9_scu_ops, s, "a9-scu", 0x100);
+    memory_region_init_io(&s->iomem, NULL, &a9_scu_ops, s, "a9-scu", 0x100);
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index 83468dc..ca4077f 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -230,12 +230,12 @@ static void applesmc_isa_realize(DeviceState *dev, Error **errp)
 {
     AppleSMCState *s = APPLE_SMC(dev);
 
-    memory_region_init_io(&s->io_data, &applesmc_data_io_ops, s,
+    memory_region_init_io(&s->io_data, NULL, &applesmc_data_io_ops, s,
                           "applesmc-data", 4);
     isa_register_ioport(&s->parent_obj, &s->io_data,
                         s->iobase + APPLESMC_DATA_PORT);
 
-    memory_region_init_io(&s->io_cmd, &applesmc_cmd_io_ops, s,
+    memory_region_init_io(&s->io_cmd, NULL, &applesmc_cmd_io_ops, s,
                           "applesmc-cmd", 4);
     isa_register_ioport(&s->parent_obj, &s->io_cmd,
                         s->iobase + APPLESMC_CMD_PORT);
diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index eb4427d..954343f 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -157,7 +157,7 @@ static int l2x0_priv_init(SysBusDevice *dev)
 {
     l2x0_state *s = FROM_SYSBUS(l2x0_state, dev);
 
-    memory_region_init_io(&s->iomem, &l2x0_mem_ops, s, "l2x0_cc", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &l2x0_mem_ops, s, "l2x0_cc", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c
index c8b55a8..9b07355 100644
--- a/hw/misc/arm_sysctl.c
+++ b/hw/misc/arm_sysctl.c
@@ -589,7 +589,7 @@ static void arm_sysctl_init(Object *obj)
     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
     arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, sd);
 
-    memory_region_init_io(&s->iomem, &arm_sysctl_ops, s, "arm-sysctl", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &arm_sysctl_ops, s, "arm-sysctl", 0x1000);
     sysbus_init_mmio(sd, &s->iomem);
     qdev_init_gpio_in(dev, arm_sysctl_gpio_set, 2);
     qdev_init_gpio_out(dev, &s->pl110_mux_ctrl, 1);
diff --git a/hw/misc/debugexit.c b/hw/misc/debugexit.c
index ee254e4..e3a13f0 100644
--- a/hw/misc/debugexit.c
+++ b/hw/misc/debugexit.c
@@ -40,7 +40,7 @@ static void debug_exit_realizefn(DeviceState *d, Error **errp)
     ISADevice *dev = ISA_DEVICE(d);
     ISADebugExitState *isa = ISA_DEBUG_EXIT_DEVICE(d);
 
-    memory_region_init_io(&isa->io, &debug_exit_ops, isa,
+    memory_region_init_io(&isa->io, NULL, &debug_exit_ops, isa,
                           TYPE_ISA_DEBUG_EXIT_DEVICE, isa->iosize);
     memory_region_add_subregion(isa_address_space_io(dev),
                                 isa->iobase, &isa->io);
diff --git a/hw/misc/eccmemctl.c b/hw/misc/eccmemctl.c
index 6f4a407..71d62cc 100644
--- a/hw/misc/eccmemctl.c
+++ b/hw/misc/eccmemctl.c
@@ -296,11 +296,11 @@ static int ecc_init1(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
     s->regs[0] = s->version;
-    memory_region_init_io(&s->iomem, &ecc_mem_ops, s, "ecc", ECC_SIZE);
+    memory_region_init_io(&s->iomem, NULL, &ecc_mem_ops, s, "ecc", ECC_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
     if (s->version == ECC_MCC) { // SS-600MP only
-        memory_region_init_io(&s->iomem_diag, &ecc_diag_mem_ops, s,
+        memory_region_init_io(&s->iomem_diag, NULL, &ecc_diag_mem_ops, s,
                               "ecc.diag", ECC_DIAG_SIZE);
         sysbus_init_mmio(dev, &s->iomem_diag);
     }
diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index ba5aa8d..465e72f 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -458,7 +458,7 @@ static int exynos4210_pmu_init(SysBusDevice *dev)
     Exynos4210PmuState *s = FROM_SYSBUS(Exynos4210PmuState, dev);
 
     /* memory mapping */
-    memory_region_init_io(&s->iomem, &exynos4210_pmu_ops, s, "exynos4210.pmu",
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_pmu_ops, s, "exynos4210.pmu",
                           EXYNOS4210_PMU_REGS_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
index 427ce5c..863c219 100644
--- a/hw/misc/imx_ccm.c
+++ b/hw/misc/imx_ccm.c
@@ -281,7 +281,7 @@ static int imx_ccm_init(SysBusDevice *dev)
 {
     IMXCCMState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->iomem, &imx_ccm_ops, s, "imx_ccm", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &imx_ccm_ops, s, "imx_ccm", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 5658f73..522740d 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -339,7 +339,7 @@ static void create_shared_memory_BAR(IVShmemState *s, int fd) {
 
     ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
 
-    memory_region_init_ram_ptr(&s->ivshmem, "ivshmem.bar2",
+    memory_region_init_ram_ptr(&s->ivshmem, NULL, "ivshmem.bar2",
                                s->ivshmem_size, ptr);
     vmstate_register_ram(&s->ivshmem, &s->dev.qdev);
     memory_region_add_subregion(&s->bar, 0, &s->ivshmem);
@@ -467,7 +467,7 @@ static void ivshmem_read(void *opaque, const uint8_t * buf, int flags)
         /* mmap the region and map into the BAR2 */
         map_ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED,
                                                             incoming_fd, 0);
-        memory_region_init_ram_ptr(&s->ivshmem,
+        memory_region_init_ram_ptr(&s->ivshmem, NULL,
                                    "ivshmem.bar2", s->ivshmem_size, map_ptr);
         vmstate_register_ram(&s->ivshmem, &s->dev.qdev);
 
@@ -685,14 +685,14 @@ static int pci_ivshmem_init(PCIDevice *dev)
 
     s->shm_fd = 0;
 
-    memory_region_init_io(&s->ivshmem_mmio, &ivshmem_mmio_ops, s,
+    memory_region_init_io(&s->ivshmem_mmio, NULL, &ivshmem_mmio_ops, s,
                           "ivshmem-mmio", IVSHMEM_REG_BAR_SIZE);
 
     /* region for registers*/
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
                      &s->ivshmem_mmio);
 
-    memory_region_init(&s->bar, "ivshmem-bar2-container", s->ivshmem_size);
+    memory_region_init(&s->bar, NULL, "ivshmem-bar2-container", s->ivshmem_size);
     s->ivshmem_attr = PCI_BASE_ADDRESS_SPACE_MEMORY |
         PCI_BASE_ADDRESS_MEM_PREFETCH;
     if (s->ivshmem_64bit) {
diff --git a/hw/misc/lm32_sys.c b/hw/misc/lm32_sys.c
index aeaf2b7..accfbe3 100644
--- a/hw/misc/lm32_sys.c
+++ b/hw/misc/lm32_sys.c
@@ -117,7 +117,7 @@ static int lm32_sys_init(SysBusDevice *dev)
 {
     LM32SysState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->iomem, &sys_ops , s, "sys", R_MAX * 4);
+    memory_region_init_io(&s->iomem, NULL, &sys_ops , s, "sys", R_MAX * 4);
     sysbus_init_mmio(dev, &s->iomem);
 
     /* Note: This device is not created in the board initialization,
diff --git a/hw/misc/macio/cuda.c b/hw/misc/macio/cuda.c
index f797796..c0fd7da 100644
--- a/hw/misc/macio/cuda.c
+++ b/hw/misc/macio/cuda.c
@@ -703,7 +703,7 @@ static void cuda_initfn(Object *obj)
     CUDAState *s = CUDA(obj);
     int i;
 
-    memory_region_init_io(&s->mem, &cuda_ops, s, "cuda", 0x2000);
+    memory_region_init_io(&s->mem, NULL, &cuda_ops, s, "cuda", 0x2000);
     sysbus_init_mmio(d, &s->mem);
     sysbus_init_irq(d, &s->irq);
 
diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index 2fc7f87..a1d7862 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -848,7 +848,7 @@ void* DBDMA_init (MemoryRegion **dbdma_mem)
 
     s = g_malloc0(sizeof(DBDMAState));
 
-    memory_region_init_io(&s->mem, &dbdma_ops, s, "dbdma", 0x1000);
+    memory_region_init_io(&s->mem, NULL, &dbdma_ops, s, "dbdma", 0x1000);
     *dbdma_mem = &s->mem;
     vmstate_register(NULL, -1, &vmstate_dbdma, s);
     qemu_register_reset(dbdma_reset, s);
diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index fd4c8e5..76a1cfb 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -104,11 +104,11 @@ static void macio_escc_legacy_setup(MacIOState *macio_state)
         0xF0, 0xE0,
     };
 
-    memory_region_init(escc_legacy, "escc-legacy", 256);
+    memory_region_init(escc_legacy, NULL, "escc-legacy", 256);
     for (i = 0; i < ARRAY_SIZE(maps); i += 2) {
         MemoryRegion *port = g_new(MemoryRegion, 1);
-        memory_region_init_alias(port, "escc-legacy-port", macio_state->escc_mem,
-                                 maps[i+1], 0x2);
+        memory_region_init_alias(port, NULL, "escc-legacy-port",
+                                 macio_state->escc_mem, maps[i+1], 0x2);
         memory_region_add_subregion(escc_legacy, maps[i], port);
     }
 
@@ -269,7 +269,7 @@ static void macio_instance_init(Object *obj)
     MacIOState *s = MACIO(obj);
     MemoryRegion *dbdma_mem;
 
-    memory_region_init(&s->bar, "macio", 0x80000);
+    memory_region_init(&s->bar, NULL, "macio", 0x80000);
 
     object_initialize(&s->cuda, TYPE_CUDA);
     qdev_set_parent_bus(DEVICE(&s->cuda), sysbus_get_default());
diff --git a/hw/misc/milkymist-hpdmc.c b/hw/misc/milkymist-hpdmc.c
index d922f6f..f4826b9 100644
--- a/hw/misc/milkymist-hpdmc.c
+++ b/hw/misc/milkymist-hpdmc.c
@@ -127,7 +127,7 @@ static int milkymist_hpdmc_init(SysBusDevice *dev)
 {
     MilkymistHpdmcState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->regs_region, &hpdmc_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &hpdmc_mmio_ops, s,
             "milkymist-hpdmc", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/misc/milkymist-pfpu.c b/hw/misc/milkymist-pfpu.c
index fe1b039..0051bc9 100644
--- a/hw/misc/milkymist-pfpu.c
+++ b/hw/misc/milkymist-pfpu.c
@@ -497,7 +497,7 @@ static int milkymist_pfpu_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
 
-    memory_region_init_io(&s->regs_region, &pfpu_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &pfpu_mmio_ops, s,
             "milkymist-pfpu", MICROCODE_END * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/misc/mst_fpga.c b/hw/misc/mst_fpga.c
index 1dd1505..b727dab 100644
--- a/hw/misc/mst_fpga.c
+++ b/hw/misc/mst_fpga.c
@@ -208,7 +208,7 @@ static int mst_fpga_init(SysBusDevice *dev)
 	/* alloc the external 16 irqs */
 	qdev_init_gpio_in(&dev->qdev, mst_fpga_set_irq, MST_NUM_IRQS);
 
-	memory_region_init_io(&s->iomem, &mst_fpga_ops, s,
+	memory_region_init_io(&s->iomem, NULL, &mst_fpga_ops, s,
 			    "fpga", 0x00100000);
 	sysbus_init_mmio(dev, &s->iomem);
 	return 0;
diff --git a/hw/misc/omap_gpmc.c b/hw/misc/omap_gpmc.c
index 91adb66..2047274 100644
--- a/hw/misc/omap_gpmc.c
+++ b/hw/misc/omap_gpmc.c
@@ -413,7 +413,7 @@ static void omap_gpmc_cs_map(struct omap_gpmc_s *s, int cs)
      * constant), the mask should cause wrapping of the address space, so
      * that the same memory becomes accessible at every <i>size</i> bytes
      * starting from <i>base</i>.  */
-    memory_region_init(&f->container, "omap-gpmc-file", size);
+    memory_region_init(&f->container, NULL, "omap-gpmc-file", size);
     memory_region_add_subregion(&f->container, 0,
                                 omap_gpmc_cs_memregion(s, cs));
     memory_region_add_subregion(get_system_memory(), base,
@@ -826,7 +826,7 @@ struct omap_gpmc_s *omap_gpmc_init(struct omap_mpu_state_s *mpu,
     struct omap_gpmc_s *s = (struct omap_gpmc_s *)
             g_malloc0(sizeof(struct omap_gpmc_s));
 
-    memory_region_init_io(&s->iomem, &omap_gpmc_ops, s, "omap-gpmc", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &omap_gpmc_ops, s, "omap-gpmc", 0x1000);
     memory_region_add_subregion(get_system_memory(), base, &s->iomem);
 
     s->irq = irq;
@@ -843,14 +843,14 @@ struct omap_gpmc_s *omap_gpmc_init(struct omap_mpu_state_s *mpu,
      * guest-requested size.
      */
     for (cs = 0; cs < 8; cs++) {
-        memory_region_init_io(&s->cs_file[cs].nandiomem,
+        memory_region_init_io(&s->cs_file[cs].nandiomem, NULL,
                               &omap_nand_ops,
                               &s->cs_file[cs],
                               "omap-nand",
                               256 * 1024 * 1024);
     }
 
-    memory_region_init_io(&s->prefetch.iomem, &omap_prefetch_ops, s,
+    memory_region_init_io(&s->prefetch.iomem, NULL, &omap_prefetch_ops, s,
                           "omap-gpmc-prefetch", 256 * 1024 * 1024);
     return s;
 }
diff --git a/hw/misc/omap_l4.c b/hw/misc/omap_l4.c
index ac8251f..f237250 100644
--- a/hw/misc/omap_l4.c
+++ b/hw/misc/omap_l4.c
@@ -136,7 +136,7 @@ struct omap_target_agent_s *omap_l4ta_get(struct omap_l4_s *bus,
     ta->status = 0x00000000;
     ta->control = 0x00000200;	/* XXX 01000200 for L4TAO */
 
-    memory_region_init_io(&ta->iomem, &omap_l4ta_ops, ta, "omap.l4ta",
+    memory_region_init_io(&ta->iomem, NULL, &omap_l4ta_ops, ta, "omap.l4ta",
                           omap_l4_region_size(ta, info->ta_region));
     omap_l4_attach(ta, info->ta_region, &ta->iomem);
 
diff --git a/hw/misc/omap_sdrc.c b/hw/misc/omap_sdrc.c
index e38b571..ed62caf 100644
--- a/hw/misc/omap_sdrc.c
+++ b/hw/misc/omap_sdrc.c
@@ -161,7 +161,7 @@ struct omap_sdrc_s *omap_sdrc_init(MemoryRegion *sysmem,
 
     omap_sdrc_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_sdrc_ops, s, "omap.sdrc", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &omap_sdrc_ops, s, "omap.sdrc", 0x1000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     return s;
diff --git a/hw/misc/omap_tap.c b/hw/misc/omap_tap.c
index 99b70d5..9d2b710 100644
--- a/hw/misc/omap_tap.c
+++ b/hw/misc/omap_tap.c
@@ -110,7 +110,7 @@ static const MemoryRegionOps omap_tap_ops = {
 void omap_tap_init(struct omap_target_agent_s *ta,
                 struct omap_mpu_state_s *mpu)
 {
-    memory_region_init_io(&mpu->tap_iomem, &omap_tap_ops, mpu, "omap.tap",
+    memory_region_init_io(&mpu->tap_iomem, NULL, &omap_tap_ops, mpu, "omap.tap",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &mpu->tap_iomem);
 }
diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index e6707d6..31c9878 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -149,13 +149,13 @@ static void testdev_realizefn(DeviceState *d, Error **errp)
     MemoryRegion *mem = isa_address_space(isa);
     MemoryRegion *io = isa_address_space_io(isa);
 
-    memory_region_init_io(&dev->ioport, &test_ioport_ops, dev,
+    memory_region_init_io(&dev->ioport, NULL, &test_ioport_ops, dev,
                           "pc-testdev-ioport", 4);
-    memory_region_init_io(&dev->flush, &test_flush_ops, dev,
+    memory_region_init_io(&dev->flush, NULL, &test_flush_ops, dev,
                           "pc-testdev-flush-page", 4);
-    memory_region_init_io(&dev->irq, &test_irq_ops, dev,
+    memory_region_init_io(&dev->irq, NULL, &test_irq_ops, dev,
                           "pc-testdev-irq-line", 24);
-    memory_region_init_io(&dev->iomem, &test_iomem_ops, dev,
+    memory_region_init_io(&dev->iomem, NULL, &test_iomem_ops, dev,
                           "pc-testdev-iomem", IOMEM_LEN);
 
     memory_region_add_subregion(io,  0xe0,       &dev->ioport);
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index 71ce5a3..fb9a58c 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -236,9 +236,9 @@ static int pci_testdev_init(PCIDevice *pci_dev)
 
     pci_conf[PCI_INTERRUPT_PIN] = 0; /* no interrupt pin */
 
-    memory_region_init_io(&d->mmio, &pci_testdev_mmio_ops, d,
+    memory_region_init_io(&d->mmio, NULL, &pci_testdev_mmio_ops, d,
                           "pci-testdev-mmio", IOTEST_MEMSIZE * 2);
-    memory_region_init_io(&d->portio, &pci_testdev_pio_ops, d,
+    memory_region_init_io(&d->portio, NULL, &pci_testdev_pio_ops, d,
                           "pci-testdev-portio", IOTEST_IOSIZE * 2);
     pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
     pci_register_bar(&d->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->portio);
diff --git a/hw/misc/puv3_pm.c b/hw/misc/puv3_pm.c
index 0aacdc2..d4a863f 100644
--- a/hw/misc/puv3_pm.c
+++ b/hw/misc/puv3_pm.c
@@ -120,7 +120,7 @@ static int puv3_pm_init(SysBusDevice *dev)
 
     s->reg_PCGR = 0x0;
 
-    memory_region_init_io(&s->iomem, &puv3_pm_ops, s, "puv3_pm",
+    memory_region_init_io(&s->iomem, NULL, &puv3_pm_ops, s, "puv3_pm",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index 060099b..00d6e63 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -90,7 +90,7 @@ static void pvpanic_isa_initfn(Object *obj)
 {
     PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
 
-    memory_region_init_io(&s->io, &pvpanic_ops, s, "pvpanic", 1);
+    memory_region_init_io(&s->io, NULL, &pvpanic_ops, s, "pvpanic", 1);
 }
 
 static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
diff --git a/hw/misc/pxa2xx_pcmcia.c b/hw/misc/pxa2xx_pcmcia.c
index 323d458..ef71a2a 100644
--- a/hw/misc/pxa2xx_pcmcia.c
+++ b/hw/misc/pxa2xx_pcmcia.c
@@ -128,7 +128,7 @@ PXA2xxPCMCIAState *pxa2xx_pcmcia_init(MemoryRegion *sysmem,
             g_malloc0(sizeof(PXA2xxPCMCIAState));
 
     /* Socket I/O Memory Space */
-    memory_region_init_io(&s->iomem, &pxa2xx_pcmcia_io_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_pcmcia_io_ops, s,
                           "pxa2xx-pcmcia-io", 0x04000000);
     memory_region_add_subregion(sysmem, base | 0x00000000,
                                 &s->iomem);
@@ -136,13 +136,13 @@ PXA2xxPCMCIAState *pxa2xx_pcmcia_init(MemoryRegion *sysmem,
     /* Then next 64 MB is reserved */
 
     /* Socket Attribute Memory Space */
-    memory_region_init_io(&s->attr_iomem, &pxa2xx_pcmcia_attr_ops, s,
+    memory_region_init_io(&s->attr_iomem, NULL, &pxa2xx_pcmcia_attr_ops, s,
                           "pxa2xx-pcmcia-attribute", 0x04000000);
     memory_region_add_subregion(sysmem, base | 0x08000000,
                                 &s->attr_iomem);
 
     /* Socket Common Memory Space */
-    memory_region_init_io(&s->common_iomem, &pxa2xx_pcmcia_common_ops, s,
+    memory_region_init_io(&s->common_iomem, NULL, &pxa2xx_pcmcia_common_ops, s,
                           "pxa2xx-pcmcia-common", 0x04000000);
     memory_region_add_subregion(sysmem, base | 0x0c000000,
                                 &s->common_iomem);
diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index a7a9368..dbc6081 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -412,7 +412,7 @@ static int apc_init1(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->cpu_halt);
 
     /* Power management (APC) XXX: not a Slavio device */
-    memory_region_init_io(&s->iomem, &apc_mem_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &apc_mem_ops, s,
                           "apc", MISC_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
@@ -427,39 +427,39 @@ static int slavio_misc_init1(SysBusDevice *dev)
 
     /* 8 bit registers */
     /* Slavio control */
-    memory_region_init_io(&s->cfg_iomem, &slavio_cfg_mem_ops, s,
+    memory_region_init_io(&s->cfg_iomem, NULL, &slavio_cfg_mem_ops, s,
                           "configuration", MISC_SIZE);
     sysbus_init_mmio(dev, &s->cfg_iomem);
 
     /* Diagnostics */
-    memory_region_init_io(&s->diag_iomem, &slavio_diag_mem_ops, s,
+    memory_region_init_io(&s->diag_iomem, NULL, &slavio_diag_mem_ops, s,
                           "diagnostic", MISC_SIZE);
     sysbus_init_mmio(dev, &s->diag_iomem);
 
     /* Modem control */
-    memory_region_init_io(&s->mdm_iomem, &slavio_mdm_mem_ops, s,
+    memory_region_init_io(&s->mdm_iomem, NULL, &slavio_mdm_mem_ops, s,
                           "modem", MISC_SIZE);
     sysbus_init_mmio(dev, &s->mdm_iomem);
 
     /* 16 bit registers */
     /* ss600mp diag LEDs */
-    memory_region_init_io(&s->led_iomem, &slavio_led_mem_ops, s,
+    memory_region_init_io(&s->led_iomem, NULL, &slavio_led_mem_ops, s,
                           "leds", MISC_SIZE);
     sysbus_init_mmio(dev, &s->led_iomem);
 
     /* 32 bit registers */
     /* System control */
-    memory_region_init_io(&s->sysctrl_iomem, &slavio_sysctrl_mem_ops, s,
+    memory_region_init_io(&s->sysctrl_iomem, NULL, &slavio_sysctrl_mem_ops, s,
                           "system-control", MISC_SIZE);
     sysbus_init_mmio(dev, &s->sysctrl_iomem);
 
     /* AUX 1 (Misc System Functions) */
-    memory_region_init_io(&s->aux1_iomem, &slavio_aux1_mem_ops, s,
+    memory_region_init_io(&s->aux1_iomem, NULL, &slavio_aux1_mem_ops, s,
                           "misc-system-functions", MISC_SIZE);
     sysbus_init_mmio(dev, &s->aux1_iomem);
 
     /* AUX 2 (Software Powerdown Control) */
-    memory_region_init_io(&s->aux2_iomem, &slavio_aux2_mem_ops, s,
+    memory_region_init_io(&s->aux2_iomem, NULL, &slavio_aux2_mem_ops, s,
                           "software-powerdown-control", MISC_SIZE);
     sysbus_init_mmio(dev, &s->aux2_iomem);
 
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index 52fb036..e2e957d 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -1154,7 +1154,7 @@ static void vfio_vga_probe_ati_3c3_quirk(VFIODevice *vdev)
     quirk->vdev = vdev;
     quirk->data = (physbar >> 8) & 0xff;
 
-    memory_region_init_io(&quirk->mem, &vfio_ati_3c3_quirk, quirk,
+    memory_region_init_io(&quirk->mem, NULL, &vfio_ati_3c3_quirk, quirk,
                           "vfio-ati-3c3-quirk", 1);
     memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem, 3,
                                 &quirk->mem);
@@ -1245,7 +1245,7 @@ static void vfio_probe_ati_4010_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, &vfio_ati_4010_quirk, quirk,
+    memory_region_init_io(&quirk->mem, NULL, &vfio_ati_4010_quirk, quirk,
                           "vfio-ati-4010-quirk", 8);
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
 
@@ -1331,7 +1331,7 @@ static void vfio_probe_ati_f10_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, &vfio_ati_f10_quirk, quirk,
+    memory_region_init_io(&quirk->mem, NULL, &vfio_ati_f10_quirk, quirk,
                           "vfio-ati-f10-quirk", 8);
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
 
@@ -1451,7 +1451,7 @@ static void vfio_vga_probe_nvidia_3d0_quirk(VFIODevice *vdev)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, &vfio_nvidia_3d0_quirk, quirk,
+    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_3d0_quirk, quirk,
                           "vfio-nvidia-3d0-quirk", 6);
     memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem,
                                 0x10, &quirk->mem);
@@ -1566,7 +1566,7 @@ static void vfio_probe_nvidia_bar5_window_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, &vfio_nvidia_bar5_window_quirk, quirk,
+    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_bar5_window_quirk, quirk,
                           "vfio-nvidia-bar5-window-quirk", 16);
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem, 0, &quirk->mem, 1);
 
@@ -1644,7 +1644,7 @@ static void vfio_probe_nvidia_bar0_88000_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, &vfio_nvidia_bar0_88000_quirk, quirk,
+    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_bar0_88000_quirk, quirk,
                           "vfio-nvidia-bar0-88000-quirk",
                           TARGET_PAGE_ALIGN(PCIE_CONFIG_SPACE_SIZE));
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
@@ -1723,7 +1723,7 @@ static void vfio_probe_nvidia_bar0_1800_quirk(VFIODevice *vdev, int nr)
     quirk = g_malloc0(sizeof(*quirk));
     quirk->vdev = vdev;
 
-    memory_region_init_io(&quirk->mem, &vfio_nvidia_bar0_1800_quirk, quirk,
+    memory_region_init_io(&quirk->mem, NULL, &vfio_nvidia_bar0_1800_quirk, quirk,
                           "vfio-nvidia-bar0-1800-quirk",
                           TARGET_PAGE_ALIGN(PCI_CONFIG_SPACE_SIZE));
     memory_region_add_subregion_overlap(&vdev->bars[nr].mem,
@@ -2228,11 +2228,11 @@ static int vfio_mmap_bar(VFIOBAR *bar, MemoryRegion *mem, MemoryRegion *submem,
             goto empty_region;
         }
 
-        memory_region_init_ram_ptr(submem, name, size, *map);
+        memory_region_init_ram_ptr(submem, NULL, name, size, *map);
     } else {
 empty_region:
         /* Create a zero sized sub-region to make cleanup easy. */
-        memory_region_init(submem, name, 0);
+        memory_region_init(submem, NULL, name, 0);
     }
 
     memory_region_add_subregion(mem, offset, submem);
@@ -2271,7 +2271,7 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
            ~PCI_BASE_ADDRESS_IO_MASK : ~PCI_BASE_ADDRESS_MEM_MASK);
 
     /* A "slow" read/write mapping underlies all BARs */
-    memory_region_init_io(&bar->mem, &vfio_bar_ops, bar, name, size);
+    memory_region_init_io(&bar->mem, NULL, &vfio_bar_ops, bar, name, size);
     pci_register_bar(&vdev->pdev, nr, type, &bar->mem);
 
     /*
@@ -2315,17 +2315,17 @@ static void vfio_map_bars(VFIODevice *vdev)
     }
 
     if (vdev->has_vga) {
-        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_MEM].mem,
+        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_MEM].mem, NULL,
                               &vfio_vga_ops,
                               &vdev->vga.region[QEMU_PCI_VGA_MEM],
                               "vfio-vga-mmio at 0xa0000",
                               QEMU_PCI_VGA_MEM_SIZE);
-        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_LO].mem,
+        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_LO].mem, NULL,
                               &vfio_vga_ops,
                               &vdev->vga.region[QEMU_PCI_VGA_IO_LO],
                               "vfio-vga-io at 0x3b0",
                               QEMU_PCI_VGA_IO_LO_SIZE);
-        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem,
+        memory_region_init_io(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem, NULL,
                               &vfio_vga_ops,
                               &vdev->vga.region[QEMU_PCI_VGA_IO_HI],
                               "vfio-vga-io at 0x3c0",
@@ -2588,7 +2588,7 @@ static int vfio_load_rom(VFIODevice *vdev)
     snprintf(name, sizeof(name), "vfio[%04x:%02x:%02x.%x].rom",
              vdev->host.domain, vdev->host.bus, vdev->host.slot,
              vdev->host.function);
-    memory_region_init_ram(&vdev->pdev.rom, name, size);
+    memory_region_init_ram(&vdev->pdev.rom, NULL, name, size);
     ptr = memory_region_get_ram_ptr(&vdev->pdev.rom);
     memset(ptr, 0xff, size);
 
diff --git a/hw/misc/vmport.c b/hw/misc/vmport.c
index 8639072..7f64ccd 100644
--- a/hw/misc/vmport.c
+++ b/hw/misc/vmport.c
@@ -142,7 +142,7 @@ static void vmport_realizefn(DeviceState *dev, Error **errp)
     ISADevice *isadev = ISA_DEVICE(dev);
     VMPortState *s = VMPORT(dev);
 
-    memory_region_init_io(&s->io, &vmport_ops, s, "vmport", 1);
+    memory_region_init_io(&s->io, NULL, &vmport_ops, s, "vmport", 1);
     isa_register_ioport(isadev, &s->io, 0x5658);
 
     port_state = s;
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index 8418327..d7c2d19 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -494,7 +494,7 @@ static int zynq_slcr_init(SysBusDevice *dev)
 {
     ZynqSLCRState *s = FROM_SYSBUS(ZynqSLCRState, dev);
 
-    memory_region_init_io(&s->iomem, &slcr_ops, s, "slcr", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &slcr_ops, s, "slcr", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/moxie/moxiesim.c b/hw/moxie/moxiesim.c
index 649f9a7..ef4f3a8 100644
--- a/hw/moxie/moxiesim.c
+++ b/hw/moxie/moxiesim.c
@@ -136,11 +136,11 @@ static void moxiesim_init(QEMUMachineInitArgs *args)
     qemu_register_reset(main_cpu_reset, cpu);
 
     /* Allocate RAM. */
-    memory_region_init_ram(ram, "moxiesim.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "moxiesim.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, ram_base, ram);
 
-    memory_region_init_ram(rom, "moxie.rom", 128*0x1000);
+    memory_region_init_ram(rom, NULL, "moxie.rom", 128*0x1000);
     vmstate_register_ram_global(rom);
     memory_region_add_subregion(get_system_memory(), 0x1000, rom);
 
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index e177057..c94d3e7 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1163,7 +1163,7 @@ static int gem_init(SysBusDevice *dev)
 
     s = FROM_SYSBUS(GemState, dev);
     gem_init_register_masks(s);
-    memory_region_init_io(&s->iomem, &gem_ops, s, "enet", sizeof(s->regs));
+    memory_region_init_io(&s->iomem, NULL, &gem_ops, s, "enet", sizeof(s->regs));
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 2289f08..049aa70 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -908,7 +908,7 @@ void dp83932_init(NICInfo *nd, hwaddr base, int it_shift,
     qemu_register_reset(nic_reset, s);
     nic_reset(s);
 
-    memory_region_init_io(&s->mmio, &dp8393x_ops, s,
+    memory_region_init_io(&s->mmio, NULL, &dp8393x_ops, s,
                           "dp8393x", 0x40 << it_shift);
     memory_region_add_subregion(address_space, base, &s->mmio);
 }
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index e6f46f0..e5c0978 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1276,13 +1276,13 @@ e1000_mmio_setup(E1000State *d)
         E1000_IMC, E1000_TCTL, E1000_TDT, PNPMMIO_SIZE
     };
 
-    memory_region_init_io(&d->mmio, &e1000_mmio_ops, d, "e1000-mmio",
+    memory_region_init_io(&d->mmio, NULL, &e1000_mmio_ops, d, "e1000-mmio",
                           PNPMMIO_SIZE);
     memory_region_add_coalescing(&d->mmio, 0, excluded_regs[0]);
     for (i = 0; excluded_regs[i] != PNPMMIO_SIZE; i++)
         memory_region_add_coalescing(&d->mmio, excluded_regs[i] + 4,
                                      excluded_regs[i+1] - excluded_regs[i] - 4);
-    memory_region_init_io(&d->io, &e1000_io_ops, d, "e1000-io", IOPORT_SIZE);
+    memory_region_init_io(&d->io, NULL, &e1000_io_ops, d, "e1000-io", IOPORT_SIZE);
 }
 
 static void
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index dc99ea6..abfcdbd 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -1876,14 +1876,14 @@ static int e100_nic_init(PCIDevice *pci_dev)
     s->eeprom = eeprom93xx_new(&pci_dev->qdev, EEPROM_SIZE);
 
     /* Handler for memory-mapped I/O */
-    memory_region_init_io(&s->mmio_bar, &eepro100_ops, s, "eepro100-mmio",
+    memory_region_init_io(&s->mmio_bar, NULL, &eepro100_ops, s, "eepro100-mmio",
                           PCI_MEM_SIZE);
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->mmio_bar);
-    memory_region_init_io(&s->io_bar, &eepro100_ops, s, "eepro100-io",
+    memory_region_init_io(&s->io_bar, NULL, &eepro100_ops, s, "eepro100-io",
                           PCI_IO_SIZE);
     pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
     /* FIXME: flash aliases to mmio?! */
-    memory_region_init_io(&s->flash_bar, &eepro100_ops, s, "eepro100-flash",
+    memory_region_init_io(&s->flash_bar, NULL, &eepro100_ops, s, "eepro100-flash",
                           PCI_FLASH_SIZE);
     pci_register_bar(&s->dev, 2, 0, &s->flash_bar);
 
diff --git a/hw/net/etraxfs_eth.c b/hw/net/etraxfs_eth.c
index 1039913..2ade0c0 100644
--- a/hw/net/etraxfs_eth.c
+++ b/hw/net/etraxfs_eth.c
@@ -610,7 +610,7 @@ static int fs_eth_init(SysBusDevice *dev)
     s->dma_in->client.opaque = s;
     s->dma_in->client.pull = NULL;
 
-    memory_region_init_io(&s->mmio, &eth_ops, s, "etraxfs-eth", 0x5c);
+    memory_region_init_io(&s->mmio, NULL, &eth_ops, s, "etraxfs-eth", 0x5c);
     sysbus_init_mmio(dev, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index 403fb86..ce68399 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -1328,7 +1328,7 @@ static int lan9118_init1(SysBusDevice *dev)
     const MemoryRegionOps *mem_ops =
             s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
 
-    memory_region_init_io(&s->mmio, mem_ops, s, "lan9118-mmio", 0x100);
+    memory_region_init_io(&s->mmio, NULL, mem_ops, s, "lan9118-mmio", 0x100);
     sysbus_init_mmio(dev, &s->mmio);
     sysbus_init_irq(dev, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
diff --git a/hw/net/lance.c b/hw/net/lance.c
index 187497c..1d3999d 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -117,7 +117,7 @@ static int lance_init(SysBusDevice *dev)
     SysBusPCNetState *d = FROM_SYSBUS(SysBusPCNetState, dev);
     PCNetState *s = &d->state;
 
-    memory_region_init_io(&s->mmio, &lance_mem_ops, d, "lance-mmio", 4);
+    memory_region_init_io(&s->mmio, NULL, &lance_mem_ops, d, "lance-mmio", 4);
 
     qdev_init_gpio_in(&dev->qdev, parent_lance_reset, 1);
 
diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
index 2ef5a0d..4bff3de 100644
--- a/hw/net/mcf_fec.c
+++ b/hw/net/mcf_fec.c
@@ -468,7 +468,7 @@ void mcf_fec_init(MemoryRegion *sysmem, NICInfo *nd,
     s->sysmem = sysmem;
     s->irq = irq;
 
-    memory_region_init_io(&s->iomem, &mcf_fec_ops, s, "fec", 0x400);
+    memory_region_init_io(&s->iomem, NULL, &mcf_fec_ops, s, "fec", 0x400);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     s->conf.macaddr = nd->macaddr;
diff --git a/hw/net/milkymist-minimac2.c b/hw/net/milkymist-minimac2.c
index 4ef6318..73fe307 100644
--- a/hw/net/milkymist-minimac2.c
+++ b/hw/net/milkymist-minimac2.c
@@ -461,12 +461,12 @@ static int milkymist_minimac2_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->rx_irq);
     sysbus_init_irq(dev, &s->tx_irq);
 
-    memory_region_init_io(&s->regs_region, &minimac2_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &minimac2_ops, s,
                           "milkymist-minimac2", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
     /* register buffers memory */
-    memory_region_init_ram(&s->buffers, "milkymist-minimac2.buffers",
+    memory_region_init_ram(&s->buffers, NULL, "milkymist-minimac2.buffers",
                            buffers_size);
     vmstate_register_ram_global(&s->buffers);
     s->rx0_buf = memory_region_get_ram_ptr(&s->buffers);
diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index ac6193a..c973a21 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -235,7 +235,7 @@ static int mipsnet_sysbus_init(SysBusDevice *dev)
 {
     MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev, dev);
 
-    memory_region_init_io(&s->io, &mipsnet_ioport_ops, s, "mipsnet-io", 36);
+    memory_region_init_io(&s->io, NULL, &mipsnet_ioport_ops, s, "mipsnet-io", 36);
     sysbus_init_mmio(dev, &s->io);
     sysbus_init_irq(dev, &s->irq);
 
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 33ee03e..00940af 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -701,7 +701,7 @@ static const MemoryRegionOps ne2000_ops = {
 
 void ne2000_setup_io(NE2000State *s, unsigned size)
 {
-    memory_region_init_io(&s->io, &ne2000_ops, s, "ne2000", size);
+    memory_region_init_io(&s->io, NULL, &ne2000_ops, s, "ne2000", size);
 }
 
 static void ne2000_cleanup(NetClientState *nc)
diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index be64bf2..a1baa3c 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -681,11 +681,11 @@ static int sysbus_open_eth_init(SysBusDevice *dev)
 {
     OpenEthState *s = DO_UPCAST(OpenEthState, dev, dev);
 
-    memory_region_init_io(&s->reg_io, &open_eth_reg_ops, s,
+    memory_region_init_io(&s->reg_io, NULL, &open_eth_reg_ops, s,
             "open_eth.regs", 0x54);
     sysbus_init_mmio(dev, &s->reg_io);
 
-    memory_region_init_io(&s->desc_io, &open_eth_desc_ops, s,
+    memory_region_init_io(&s->desc_io, NULL, &open_eth_desc_ops, s,
             "open_eth.desc", 0x400);
     sysbus_init_mmio(dev, &s->desc_io);
 
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index 9df2b87..e098bf2 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -315,10 +315,10 @@ static int pci_pcnet_init(PCIDevice *pci_dev)
     pci_conf[PCI_MAX_LAT] = 0xff;
 
     /* Handler for memory-mapped I/O */
-    memory_region_init_io(&d->state.mmio, &pcnet_mmio_ops, s, "pcnet-mmio",
+    memory_region_init_io(&d->state.mmio, NULL, &pcnet_mmio_ops, s, "pcnet-mmio",
                           PCNET_PNPMMIO_SIZE);
 
-    memory_region_init_io(&d->io_bar, &pcnet_io_ops, s, "pcnet-io",
+    memory_region_init_io(&d->io_bar, NULL, &pcnet_io_ops, s, "pcnet-io",
                           PCNET_IOPORT_SIZE);
     pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &d->io_bar);
 
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 7993f9f..a96eb62 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3486,8 +3486,8 @@ static int pci_rtl8139_init(PCIDevice *dev)
      * list bit in status register, and offset 0xdc seems unused. */
     pci_conf[PCI_CAPABILITY_LIST] = 0xdc;
 
-    memory_region_init_io(&s->bar_io, &rtl8139_io_ops, s, "rtl8139", 0x100);
-    memory_region_init_io(&s->bar_mem, &rtl8139_mmio_ops, s, "rtl8139", 0x100);
+    memory_region_init_io(&s->bar_io, NULL, &rtl8139_io_ops, s, "rtl8139", 0x100);
+    memory_region_init_io(&s->bar_mem, NULL, &rtl8139_mmio_ops, s, "rtl8139", 0x100);
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->bar_io);
     pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar_mem);
 
diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index c2feae6..6429709 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -747,7 +747,7 @@ static NetClientInfo net_smc91c111_info = {
 static int smc91c111_init1(SysBusDevice *dev)
 {
     smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);
-    memory_region_init_io(&s->mmio, &smc91c111_mem_ops, s,
+    memory_region_init_io(&s->mmio, NULL, &smc91c111_mem_ops, s,
                           "smc91c111-mmio", 16);
     sysbus_init_mmio(dev, &s->mmio);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index 59b8456..b1394a2 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -405,7 +405,7 @@ static int stellaris_enet_init(SysBusDevice *dev)
 {
     stellaris_enet_state *s = FROM_SYSBUS(stellaris_enet_state, dev);
 
-    memory_region_init_io(&s->mmio, &stellaris_enet_ops, s, "stellaris_enet",
+    memory_region_init_io(&s->mmio, NULL, &stellaris_enet_ops, s, "stellaris_enet",
                           0x1000);
     sysbus_init_mmio(dev, &s->mmio);
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 4c575e5..23a6b07 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2073,17 +2073,17 @@ static int vmxnet3_pci_init(PCIDevice *pci_dev)
 
     VMW_CBPRN("Starting init...");
 
-    memory_region_init_io(&s->bar0, &b0_ops, s,
+    memory_region_init_io(&s->bar0, NULL, &b0_ops, s,
                           "vmxnet3-b0", VMXNET3_PT_REG_SIZE);
     pci_register_bar(pci_dev, VMXNET3_BAR0_IDX,
                      PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar0);
 
-    memory_region_init_io(&s->bar1, &b1_ops, s,
+    memory_region_init_io(&s->bar1, NULL, &b1_ops, s,
                           "vmxnet3-b1", VMXNET3_VD_REG_SIZE);
     pci_register_bar(pci_dev, VMXNET3_BAR1_IDX,
                      PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar1);
 
-    memory_region_init(&s->msix_bar, "vmxnet3-msix-bar",
+    memory_region_init(&s->msix_bar, NULL, "vmxnet3-msix-bar",
                        VMXNET3_MSIX_BAR_SIZE);
     pci_register_bar(pci_dev, VMXNET3_MSIX_BAR_IDX,
                      PCI_BASE_ADDRESS_SPACE_MEMORY, &s->msix_bar);
diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index 1d9074a..d334dc5 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -382,7 +382,7 @@ static int xgmac_enet_init(SysBusDevice *dev)
 {
     struct XgmacState *s = FROM_SYSBUS(typeof(*s), dev);
 
-    memory_region_init_io(&s->iomem, &enet_mem_ops, s, "xgmac", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &enet_mem_ops, s, "xgmac", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->sbd_irq);
     sysbus_init_irq(dev, &s->pmt_irq);
diff --git a/hw/net/xilinx_axienet.c b/hw/net/xilinx_axienet.c
index 2ca1511..4a4fbd6 100644
--- a/hw/net/xilinx_axienet.c
+++ b/hw/net/xilinx_axienet.c
@@ -1001,7 +1001,7 @@ static void xilinx_enet_init(Object *obj)
 
     sysbus_init_irq(sbd, &s->irq);
 
-    memory_region_init_io(&s->iomem, &enet_ops, s, "enet", 0x40000);
+    memory_region_init_io(&s->iomem, NULL, &enet_ops, s, "enet", 0x40000);
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index b2e3523..9d7cb8f 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -221,7 +221,7 @@ static int xilinx_ethlite_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq);
     s->rxbuf = 0;
 
-    memory_region_init_io(&s->mmio, &eth_ops, s, "xlnx.xps-ethernetlite",
+    memory_region_init_io(&s->mmio, NULL, &eth_ops, s, "xlnx.xps-ethernetlite",
                                                                     R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index 488f1d7..1697562 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -117,7 +117,7 @@ static int nvram_sysbus_initfn(SysBusDevice *dev)
 
     s->contents = g_malloc0(s->chip_size);
 
-    memory_region_init_io(&s->iomem, &nvram_ops, s, "nvram", s->chip_size);
+    memory_region_init_io(&s->iomem, NULL, &nvram_ops, s, "nvram", s->chip_size);
     sysbus_init_mmio(dev, &s->iomem);
 
     /* Read current file */
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index 3c255ce..a37db77 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -526,14 +526,14 @@ static int fw_cfg_init1(SysBusDevice *dev)
 {
     FWCfgState *s = FROM_SYSBUS(FWCfgState, dev);
 
-    memory_region_init_io(&s->ctl_iomem, &fw_cfg_ctl_mem_ops, s,
+    memory_region_init_io(&s->ctl_iomem, NULL, &fw_cfg_ctl_mem_ops, s,
                           "fwcfg.ctl", FW_CFG_SIZE);
     sysbus_init_mmio(dev, &s->ctl_iomem);
-    memory_region_init_io(&s->data_iomem, &fw_cfg_data_mem_ops, s,
+    memory_region_init_io(&s->data_iomem, NULL, &fw_cfg_data_mem_ops, s,
                           "fwcfg.data", FW_CFG_DATA_SIZE);
     sysbus_init_mmio(dev, &s->data_iomem);
     /* In case ctl and data overlap: */
-    memory_region_init_io(&s->comb_iomem, &fw_cfg_comb_mem_ops, s,
+    memory_region_init_io(&s->comb_iomem, NULL, &fw_cfg_comb_mem_ops, s,
                           "fwcfg", FW_CFG_SIZE);
 
     if (s->ctl_iobase + 1 == s->data_iobase) {
diff --git a/hw/nvram/mac_nvram.c b/hw/nvram/mac_nvram.c
index d76a06c..c91ee58 100644
--- a/hw/nvram/mac_nvram.c
+++ b/hw/nvram/mac_nvram.c
@@ -115,7 +115,7 @@ static void macio_nvram_realizefn(DeviceState *dev, Error **errp)
 
     s->data = g_malloc0(s->size);
 
-    memory_region_init_io(&s->mem, &macio_nvram_ops, s, "macio-nvram",
+    memory_region_init_io(&s->mem, NULL, &macio_nvram_ops, s, "macio-nvram",
                           s->size << s->it_shift);
     sysbus_init_mmio(d, &s->mem);
 }
diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 49bab1f..924438b 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -115,7 +115,7 @@ static void openrisc_sim_init(QEMUMachineInitArgs *args)
     }
 
     ram = g_malloc(sizeof(*ram));
-    memory_region_init_ram(ram, "openrisc.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "openrisc.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(get_system_memory(), 0, ram);
 
diff --git a/hw/pci-bridge/dec.c b/hw/pci-bridge/dec.c
index cff458b..3e84473 100644
--- a/hw/pci-bridge/dec.c
+++ b/hw/pci-bridge/dec.c
@@ -98,9 +98,9 @@ static int pci_dec_21154_device_init(SysBusDevice *dev)
 
     phb = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&phb->conf_mem, &pci_host_conf_le_ops,
+    memory_region_init_io(&phb->conf_mem, NULL, &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&phb->data_mem, &pci_host_data_le_ops,
+    memory_region_init_io(&phb->data_mem, NULL, &pci_host_data_le_ops,
                           dev, "pci-data-idx", 0x1000);
     sysbus_init_mmio(dev, &phb->conf_mem);
     sysbus_init_mmio(dev, &phb->data_mem);
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 971b432..c2660f1 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -46,7 +46,7 @@ static int pci_bridge_dev_initfn(PCIDevice *dev)
     if (err) {
         goto bridge_error;
     }
-    memory_region_init(&bridge_dev->bar, "shpc-bar", shpc_bar_size(dev));
+    memory_region_init(&bridge_dev->bar, NULL, "shpc-bar", shpc_bar_size(dev));
     err = shpc_init(dev, &br->sec_bus, &bridge_dev->bar, 0);
     if (err) {
         goto shpc_error;
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index e099655..7a8ce25 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -447,7 +447,7 @@ PCIBus *pci_apb_init(hwaddr special_base,
     sysbus_mmio_map(s, 2, special_base + 0x2000000ULL);
     d = FROM_SYSBUS(APBState, s);
 
-    memory_region_init(&d->pci_mmio, "pci-mmio", 0x100000000ULL);
+    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
     memory_region_add_subregion(get_system_memory(), mem_base, &d->pci_mmio);
 
     d->bus = pci_register_bus(&d->busdev.qdev, "pci",
@@ -525,18 +525,18 @@ static int pci_pbm_init_device(SysBusDevice *dev)
     s->pci_irq_in = 0ULL;
 
     /* apb_config */
-    memory_region_init_io(&s->apb_config, &apb_config_ops, s, "apb-config",
+    memory_region_init_io(&s->apb_config, NULL, &apb_config_ops, s, "apb-config",
                           0x10000);
     /* at region 0 */
     sysbus_init_mmio(dev, &s->apb_config);
 
-    memory_region_init_io(&s->pci_config, &pci_config_ops, s, "apb-pci-config",
+    memory_region_init_io(&s->pci_config, NULL, &pci_config_ops, s, "apb-pci-config",
                           0x1000000);
     /* at region 1 */
     sysbus_init_mmio(dev, &s->pci_config);
 
     /* pci_ioport */
-    memory_region_init_io(&s->pci_ioport, &pci_ioport_ops, s,
+    memory_region_init_io(&s->pci_ioport, NULL, &pci_ioport_ops, s,
                           "apb-pci-ioport", 0x10000);
     /* at region 2 */
     sysbus_init_mmio(dev, &s->pci_ioport);
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 974150b..ae00775 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -722,29 +722,29 @@ static int bonito_initfn(PCIDevice *dev)
     pci_config_set_prog_interface(dev->config, 0x00);
 
     /* set the north bridge register mapping */
-    memory_region_init_io(&s->iomem, &bonito_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &bonito_ops, s,
                           "north-bridge-register", BONITO_INTERNAL_REG_SIZE);
     sysbus_init_mmio(sysbus, &s->iomem);
     sysbus_mmio_map(sysbus, 0, BONITO_INTERNAL_REG_BASE);
 
     /* set the north bridge pci configure  mapping */
-    memory_region_init_io(&phb->conf_mem, &bonito_pciconf_ops, s,
+    memory_region_init_io(&phb->conf_mem, NULL, &bonito_pciconf_ops, s,
                           "north-bridge-pci-config", BONITO_PCICONFIG_SIZE);
     sysbus_init_mmio(sysbus, &phb->conf_mem);
     sysbus_mmio_map(sysbus, 1, BONITO_PCICONFIG_BASE);
 
     /* set the south bridge pci configure  mapping */
-    memory_region_init_io(&phb->data_mem, &bonito_spciconf_ops, s,
+    memory_region_init_io(&phb->data_mem, NULL, &bonito_spciconf_ops, s,
                           "south-bridge-pci-config", BONITO_SPCICONFIG_SIZE);
     sysbus_init_mmio(sysbus, &phb->data_mem);
     sysbus_mmio_map(sysbus, 2, BONITO_SPCICONFIG_BASE);
 
-    memory_region_init_io(&s->iomem_ldma, &bonito_ldma_ops, s,
+    memory_region_init_io(&s->iomem_ldma, NULL, &bonito_ldma_ops, s,
                           "ldma", 0x100);
     sysbus_init_mmio(sysbus, &s->iomem_ldma);
     sysbus_mmio_map(sysbus, 3, 0xbfe00200);
 
-    memory_region_init_io(&s->iomem_cop, &bonito_cop_ops, s,
+    memory_region_init_io(&s->iomem_cop, NULL, &bonito_cop_ops, s,
                           "cop", 0x100);
     sysbus_init_mmio(sysbus, &s->iomem_cop);
     sysbus_mmio_map(sysbus, 4, 0xbfe00300);
diff --git a/hw/pci-host/grackle.c b/hw/pci-host/grackle.c
index 69344d9..da0fedb 100644
--- a/hw/pci-host/grackle.c
+++ b/hw/pci-host/grackle.c
@@ -76,8 +76,8 @@ PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic,
     phb = PCI_HOST_BRIDGE(dev);
     d = GRACKLE_PCI_HOST_BRIDGE(dev);
 
-    memory_region_init(&d->pci_mmio, "pci-mmio", 0x100000000ULL);
-    memory_region_init_alias(&d->pci_hole, "pci-hole", &d->pci_mmio,
+    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
+    memory_region_init_alias(&d->pci_hole, NULL, "pci-hole", &d->pci_mmio,
                              0x80000000ULL, 0x7e000000ULL);
     memory_region_add_subregion(address_space_mem, 0x80000000ULL,
                                 &d->pci_hole);
@@ -104,9 +104,9 @@ static int pci_grackle_init_device(SysBusDevice *dev)
 
     phb = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&phb->conf_mem, &pci_host_conf_le_ops,
+    memory_region_init_io(&phb->conf_mem, NULL, &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&phb->data_mem, &pci_host_data_le_ops,
+    memory_region_init_io(&phb->data_mem, NULL, &pci_host_data_le_ops,
                           dev, "pci-data-idx", 0x1000);
     sysbus_init_mmio(dev, &phb->conf_mem);
     sysbus_init_mmio(dev, &phb->data_mem);
diff --git a/hw/pci-host/pam.c b/hw/pci-host/pam.c
index 7181bd6..ec935f4 100644
--- a/hw/pci-host/pam.c
+++ b/hw/pci-host/pam.c
@@ -56,17 +56,17 @@ void init_pam(MemoryRegion *ram_memory, MemoryRegion *system_memory,
     int i;
 
     /* RAM */
-    memory_region_init_alias(&mem->alias[3], "pam-ram", ram_memory,
+    memory_region_init_alias(&mem->alias[3], NULL, "pam-ram", ram_memory,
                              start, size);
     /* ROM (XXX: not quite correct) */
-    memory_region_init_alias(&mem->alias[1], "pam-rom", ram_memory,
+    memory_region_init_alias(&mem->alias[1], NULL, "pam-rom", ram_memory,
                              start, size);
     memory_region_set_readonly(&mem->alias[1], true);
 
     /* XXX: should distinguish read/write cases */
-    memory_region_init_alias(&mem->alias[0], "pam-pci", pci_address_space,
+    memory_region_init_alias(&mem->alias[0], NULL, "pam-pci", pci_address_space,
                              start, size);
-    memory_region_init_alias(&mem->alias[2], "pam-pci", pci_address_space,
+    memory_region_init_alias(&mem->alias[2], NULL, "pam-pci", pci_address_space,
                              start, size);
 
     for (i = 0; i < 4; ++i) {
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index f9e68c3..4d77b1e 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -201,12 +201,12 @@ static int i440fx_pcihost_initfn(SysBusDevice *dev)
 {
     PCIHostState *s = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&s->conf_mem, &pci_host_conf_le_ops, s,
+    memory_region_init_io(&s->conf_mem, NULL, &pci_host_conf_le_ops, s,
                           "pci-conf-idx", 4);
     sysbus_add_io(dev, 0xcf8, &s->conf_mem);
     sysbus_init_ioports(&s->busdev, 0xcf8, 4);
 
-    memory_region_init_io(&s->data_mem, &pci_host_data_le_ops, s,
+    memory_region_init_io(&s->data_mem, NULL, &pci_host_data_le_ops, s,
                           "pci-conf-data", 4);
     sysbus_add_io(dev, 0xcfc, &s->data_mem);
     sysbus_init_ioports(&s->busdev, 0xcfc, 4);
@@ -260,17 +260,17 @@ static PCIBus *i440fx_common_init(const char *device_name,
     f->system_memory = address_space_mem;
     f->pci_address_space = pci_address_space;
     f->ram_memory = ram_memory;
-    memory_region_init_alias(&f->pci_hole, "pci-hole", f->pci_address_space,
+    memory_region_init_alias(&f->pci_hole, NULL, "pci-hole", f->pci_address_space,
                              pci_hole_start, pci_hole_size);
     memory_region_add_subregion(f->system_memory, pci_hole_start, &f->pci_hole);
-    memory_region_init_alias(&f->pci_hole_64bit, "pci-hole64",
+    memory_region_init_alias(&f->pci_hole_64bit, NULL, "pci-hole64",
                              f->pci_address_space,
                              pci_hole64_start, pci_hole64_size);
     if (pci_hole64_size) {
         memory_region_add_subregion(f->system_memory, pci_hole64_start,
                                     &f->pci_hole_64bit);
     }
-    memory_region_init_alias(&f->smram_region, "smram-region",
+    memory_region_init_alias(&f->smram_region, NULL, "smram-region",
                              f->pci_address_space, 0xa0000, 0x20000);
     memory_region_add_subregion_overlap(f->system_memory, 0xa0000,
                                         &f->smram_region, 1);
@@ -549,7 +549,7 @@ static int piix3_initfn(PCIDevice *dev)
 
     isa_bus_new(DEVICE(d), pci_address_space_io(dev));
 
-    memory_region_init_io(&d->rcr_mem, &rcr_ops, d, "piix3-reset-control", 1);
+    memory_region_init_io(&d->rcr_mem, NULL, &rcr_ops, d, "piix3-reset-control", 1);
     memory_region_add_subregion_overlap(pci_address_space_io(dev), RCR_IOPORT,
                                         &d->rcr_mem, 1);
 
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 5e7ad94..7d8c59b 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -330,7 +330,7 @@ static int e500_pcihost_bridge_initfn(PCIDevice *d)
         (d->config[PCI_HEADER_TYPE] & PCI_HEADER_TYPE_MULTI_FUNCTION) |
         PCI_HEADER_TYPE_BRIDGE;
 
-    memory_region_init_alias(&b->bar0, "e500-pci-bar0", &ccsr->ccsr_space,
+    memory_region_init_alias(&b->bar0, NULL, "e500-pci-bar0", &ccsr->ccsr_space,
                              0, int128_get64(ccsr->ccsr_space.size));
     pci_register_bar(d, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &b->bar0);
 
@@ -352,7 +352,7 @@ static int e500_pcihost_initfn(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->irq[i]);
     }
 
-    memory_region_init(&s->pio, "pci-pio", PCIE500_PCI_IOLEN);
+    memory_region_init(&s->pio, NULL, "pci-pio", PCIE500_PCI_IOLEN);
 
     b = pci_register_bus(DEVICE(dev), NULL, mpc85xx_pci_set_irq,
                          mpc85xx_pci_map_irq, s->irq, address_space_mem,
@@ -361,12 +361,12 @@ static int e500_pcihost_initfn(SysBusDevice *dev)
 
     pci_create_simple(b, 0, "e500-host-bridge");
 
-    memory_region_init(&s->container, "pci-container", PCIE500_ALL_SIZE);
-    memory_region_init_io(&h->conf_mem, &pci_host_conf_be_ops, h,
+    memory_region_init(&s->container, NULL, "pci-container", PCIE500_ALL_SIZE);
+    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_be_ops, h,
                           "pci-conf-idx", 4);
-    memory_region_init_io(&h->data_mem, &pci_host_data_le_ops, h,
+    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops, h,
                           "pci-conf-data", 4);
-    memory_region_init_io(&s->iomem, &e500_pci_reg_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &e500_pci_reg_ops, s,
                           "pci.reg", PCIE500_REG_SIZE);
     memory_region_add_subregion(&s->container, PCIE500_CFGADDR, &h->conf_mem);
     memory_region_add_subregion(&s->container, PCIE500_CFGDATA, &h->data_mem);
diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index 6130253..024cd51 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -125,20 +125,20 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
 
     pci_bus_irqs(&s->pci_bus, prep_set_irq, prep_map_irq, s->irq, 4);
 
-    memory_region_init_io(&h->conf_mem, &pci_host_conf_be_ops, s,
+    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_be_ops, s,
                           "pci-conf-idx", 1);
     sysbus_add_io(dev, 0xcf8, &h->conf_mem);
     sysbus_init_ioports(&h->busdev, 0xcf8, 1);
 
-    memory_region_init_io(&h->data_mem, &pci_host_data_be_ops, s,
+    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_be_ops, s,
                           "pci-conf-data", 1);
     sysbus_add_io(dev, 0xcfc, &h->data_mem);
     sysbus_init_ioports(&h->busdev, 0xcfc, 1);
 
-    memory_region_init_io(&h->mmcfg, &PPC_PCIIO_ops, s, "pciio", 0x00400000);
+    memory_region_init_io(&h->mmcfg, NULL, &PPC_PCIIO_ops, s, "pciio", 0x00400000);
     memory_region_add_subregion(address_space_mem, 0x80800000, &h->mmcfg);
 
-    memory_region_init_io(&s->intack, &PPC_intack_ops, s, "pci-intack", 1);
+    memory_region_init_io(&s->intack, NULL, &PPC_intack_ops, s, "pci-intack", 1);
     memory_region_add_subregion(address_space_mem, 0xbffffff0, &s->intack);
 
     /* TODO Remove once realize propagates to child devices. */
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 24df6b5..70e7d8b 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -40,12 +40,12 @@ static int q35_host_init(SysBusDevice *dev)
     PCIHostState *pci = FROM_SYSBUS(PCIHostState, dev);
     Q35PCIHost *s = Q35_HOST_DEVICE(&dev->qdev);
 
-    memory_region_init_io(&pci->conf_mem, &pci_host_conf_le_ops, pci,
+    memory_region_init_io(&pci->conf_mem, NULL, &pci_host_conf_le_ops, pci,
                           "pci-conf-idx", 4);
     sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_ADDR, &pci->conf_mem);
     sysbus_init_ioports(&pci->busdev, MCH_HOST_BRIDGE_CONFIG_ADDR, 4);
 
-    memory_region_init_io(&pci->data_mem, &pci_host_data_le_ops, pci,
+    memory_region_init_io(&pci->data_mem, NULL, &pci_host_data_le_ops, pci,
                           "pci-conf-data", 4);
     sysbus_add_io(dev, MCH_HOST_BRIDGE_CONFIG_DATA, &pci->data_mem);
     sysbus_init_ioports(&pci->busdev, MCH_HOST_BRIDGE_CONFIG_DATA, 4);
@@ -245,7 +245,7 @@ static int mch_init(PCIDevice *d)
     MCHPCIState *mch = MCH_PCI_DEVICE(d);
 
     /* setup pci memory regions */
-    memory_region_init_alias(&mch->pci_hole, "pci-hole",
+    memory_region_init_alias(&mch->pci_hole, NULL, "pci-hole",
                              mch->pci_address_space,
                              mch->below_4g_mem_size,
                              0x100000000ULL - mch->below_4g_mem_size);
@@ -253,7 +253,7 @@ static int mch_init(PCIDevice *d)
                                 &mch->pci_hole);
     pci_hole64_size = (sizeof(hwaddr) == 4 ? 0 :
                        ((uint64_t)1 << 62));
-    memory_region_init_alias(&mch->pci_hole_64bit, "pci-hole64",
+    memory_region_init_alias(&mch->pci_hole_64bit, NULL, "pci-hole64",
                              mch->pci_address_space,
                              0x100000000ULL + mch->above_4g_mem_size,
                              pci_hole64_size);
@@ -264,7 +264,7 @@ static int mch_init(PCIDevice *d)
     }
     /* smram */
     cpu_smm_register(&mch_set_smm, mch);
-    memory_region_init_alias(&mch->smram_region, "smram-region",
+    memory_region_init_alias(&mch->smram_region, NULL, "smram-region",
                              mch->pci_address_space, 0xa0000, 0x20000);
     memory_region_add_subregion_overlap(mch->system_memory, 0xa0000,
                                         &mch->smram_region, 1);
diff --git a/hw/pci-host/uninorth.c b/hw/pci-host/uninorth.c
index fff235d..b72659d 100644
--- a/hw/pci-host/uninorth.c
+++ b/hw/pci-host/uninorth.c
@@ -152,9 +152,9 @@ static int pci_unin_main_init_device(SysBusDevice *dev)
     /* Uninorth main bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, &unin_data_ops, dev,
+    memory_region_init_io(&h->data_mem, NULL, &unin_data_ops, dev,
                           "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -170,9 +170,9 @@ static int pci_u3_agp_init_device(SysBusDevice *dev)
     /* Uninorth U3 AGP bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, &unin_data_ops, dev,
+    memory_region_init_io(&h->data_mem, NULL, &unin_data_ops, dev,
                           "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -187,9 +187,9 @@ static int pci_unin_agp_init_device(SysBusDevice *dev)
     /* Uninorth AGP bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, &pci_host_data_le_ops,
+    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops,
                           dev, "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -203,9 +203,9 @@ static int pci_unin_internal_init_device(SysBusDevice *dev)
     /* Uninorth internal bus */
     h = PCI_HOST_BRIDGE(dev);
 
-    memory_region_init_io(&h->conf_mem, &pci_host_conf_le_ops,
+    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops,
                           dev, "pci-conf-idx", 0x1000);
-    memory_region_init_io(&h->data_mem, &pci_host_data_le_ops,
+    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops,
                           dev, "pci-conf-data", 0x1000);
     sysbus_init_mmio(dev, &h->conf_mem);
     sysbus_init_mmio(dev, &h->data_mem);
@@ -228,8 +228,8 @@ PCIBus *pci_pmac_init(qemu_irq *pic,
     s = SYS_BUS_DEVICE(dev);
     h = PCI_HOST_BRIDGE(s);
     d = UNI_NORTH_PCI_HOST_BRIDGE(dev);
-    memory_region_init(&d->pci_mmio, "pci-mmio", 0x100000000ULL);
-    memory_region_init_alias(&d->pci_hole, "pci-hole", &d->pci_mmio,
+    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
+    memory_region_init_alias(&d->pci_hole, NULL, "pci-hole", &d->pci_mmio,
                              0x80000000ULL, 0x70000000ULL);
     memory_region_add_subregion(address_space_mem, 0x80000000ULL,
                                 &d->pci_hole);
@@ -294,8 +294,8 @@ PCIBus *pci_pmac_u3_init(qemu_irq *pic,
     h = PCI_HOST_BRIDGE(dev);
     d = U3_AGP_HOST_BRIDGE(dev);
 
-    memory_region_init(&d->pci_mmio, "pci-mmio", 0x100000000ULL);
-    memory_region_init_alias(&d->pci_hole, "pci-hole", &d->pci_mmio,
+    memory_region_init(&d->pci_mmio, NULL, "pci-mmio", 0x100000000ULL);
+    memory_region_init_alias(&d->pci_hole, NULL, "pci-hole", &d->pci_mmio,
                              0x80000000ULL, 0x70000000ULL);
     memory_region_add_subregion(address_space_mem, 0x80000000ULL,
                                 &d->pci_hole);
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 2f996d9..f7df274 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -381,8 +381,8 @@ static void pci_vpb_init(Object *obj)
     PCIHostState *h = PCI_HOST_BRIDGE(obj);
     PCIVPBState *s = PCI_VPB(obj);
 
-    memory_region_init(&s->pci_io_space, "pci_io", 1ULL << 32);
-    memory_region_init(&s->pci_mem_space, "pci_mem", 1ULL << 32);
+    memory_region_init(&s->pci_io_space, NULL, "pci_io", 1ULL << 32);
+    memory_region_init(&s->pci_mem_space, NULL, "pci_mem", 1ULL << 32);
 
     pci_bus_new_inplace(&s->pci_bus, DEVICE(obj), "pci",
                         &s->pci_mem_space, &s->pci_io_space,
@@ -424,20 +424,20 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
      * 3 : PCI IO window
      * 4..6 : PCI memory windows
      */
-    memory_region_init_io(&s->controlregs, &pci_vpb_reg_ops, s, "pci-vpb-regs",
+    memory_region_init_io(&s->controlregs, NULL, &pci_vpb_reg_ops, s, "pci-vpb-regs",
                           0x1000);
     sysbus_init_mmio(sbd, &s->controlregs);
-    memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, s,
+    memory_region_init_io(&s->mem_config, NULL, &pci_vpb_config_ops, s,
                           "pci-vpb-selfconfig", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config);
-    memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, s,
+    memory_region_init_io(&s->mem_config2, NULL, &pci_vpb_config_ops, s,
                           "pci-vpb-config", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config2);
 
     /* The window into I/O space is always into a fixed base address;
      * its size is the same for both realview and versatile.
      */
-    memory_region_init_alias(&s->pci_io_window, "pci-vbp-io-window",
+    memory_region_init_alias(&s->pci_io_window, NULL, "pci-vbp-io-window",
                              &s->pci_io_space, 0, 0x100000);
 
     sysbus_init_mmio(sbd, &s->pci_io_space);
@@ -447,7 +447,7 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
      * offsets are guest controllable via the IMAP registers.
      */
     for (i = 0; i < 3; i++) {
-        memory_region_init_alias(&s->pci_mem_window[i], "pci-vbp-window",
+        memory_region_init_alias(&s->pci_mem_window[i], NULL, "pci-vbp-window",
                                  &s->pci_mem_space, 0, s->mem_win_size[i]);
         sysbus_init_mmio(sbd, &s->pci_mem_window[i]);
     }
diff --git a/hw/pci/msix.c b/hw/pci/msix.c
index 6da75ec..83dfc7a 100644
--- a/hw/pci/msix.c
+++ b/hw/pci/msix.c
@@ -280,10 +280,10 @@ int msix_init(struct PCIDevice *dev, unsigned short nentries,
 
     msix_mask_all(dev, nentries);
 
-    memory_region_init_io(&dev->msix_table_mmio, &msix_table_mmio_ops, dev,
+    memory_region_init_io(&dev->msix_table_mmio, NULL, &msix_table_mmio_ops, dev,
                           "msix-table", table_size);
     memory_region_add_subregion(table_bar, table_offset, &dev->msix_table_mmio);
-    memory_region_init_io(&dev->msix_pba_mmio, &msix_pba_mmio_ops, dev,
+    memory_region_init_io(&dev->msix_pba_mmio, NULL, &msix_pba_mmio_ops, dev,
                           "msix-pba", pba_size);
     memory_region_add_subregion(pba_bar, pba_offset, &dev->msix_pba_mmio);
 
@@ -311,7 +311,7 @@ int msix_init_exclusive_bar(PCIDevice *dev, unsigned short nentries,
     }
 
     name = g_strdup_printf("%s-msix", dev->name);
-    memory_region_init(&dev->msix_exclusive_bar, name, MSIX_EXCLUSIVE_BAR_SIZE);
+    memory_region_init(&dev->msix_exclusive_bar, NULL, name, MSIX_EXCLUSIVE_BAR_SIZE);
     g_free(name);
 
     ret = msix_init(dev, nentries, &dev->msix_exclusive_bar, bar_nr,
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 61b681a..a29a385 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -811,7 +811,7 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
         dma_as = &address_space_memory;
     }
 
-    memory_region_init_alias(&pci_dev->bus_master_enable_region, "bus master",
+    memory_region_init_alias(&pci_dev->bus_master_enable_region, NULL, "bus master",
                              dma_as->root, 0, memory_region_size(dma_as->root));
     memory_region_set_enabled(&pci_dev->bus_master_enable_region, false);
     address_space_init(&pci_dev->bus_master_as, &pci_dev->bus_master_enable_region,
@@ -1945,7 +1945,7 @@ static int pci_add_option_rom(PCIDevice *pdev, bool is_default_rom)
         snprintf(name, sizeof(name), "%s.rom", object_get_typename(OBJECT(pdev)));
     }
     pdev->has_rom = true;
-    memory_region_init_ram(&pdev->rom, name, size);
+    memory_region_init_ram(&pdev->rom, NULL, name, size);
     vmstate_register_ram(&pdev->rom, &pdev->qdev);
     ptr = memory_region_get_ram_ptr(&pdev->rom);
     load_image(path, ptr);
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 24be6c5..28ae65e 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -147,7 +147,7 @@ static void pci_bridge_init_alias(PCIBridge *bridge, MemoryRegion *alias,
      * Apparently no way to do this with existing memory APIs. */
     pcibus_t size = enabled && limit >= base ? limit + 1 - base : 0;
 
-    memory_region_init_alias(alias, name, space, base, size);
+    memory_region_init_alias(alias, NULL, name, space, base, size);
     memory_region_add_subregion_overlap(parent_space, base, alias, 1);
 }
 
@@ -156,13 +156,13 @@ static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
 {
     uint16_t brctl = pci_get_word(br->dev.config + PCI_BRIDGE_CONTROL);
 
-    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_LO],
+    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_LO], NULL,
                              "pci_bridge_vga_io_lo", &br->address_space_io,
                              QEMU_PCI_VGA_IO_LO_BASE, QEMU_PCI_VGA_IO_LO_SIZE);
-    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_HI],
+    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_HI], NULL,
                              "pci_bridge_vga_io_hi", &br->address_space_io,
                              QEMU_PCI_VGA_IO_HI_BASE, QEMU_PCI_VGA_IO_HI_SIZE);
-    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_MEM],
+    memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_MEM], NULL,
                              "pci_bridge_vga_mem", &br->address_space_mem,
                              QEMU_PCI_VGA_MEM_BASE, QEMU_PCI_VGA_MEM_SIZE);
 
@@ -367,9 +367,9 @@ int pci_bridge_initfn(PCIDevice *dev, const char *typename)
     sec_bus->parent_dev = dev;
     sec_bus->map_irq = br->map_irq ? br->map_irq : pci_swizzle_map_irq_fn;
     sec_bus->address_space_mem = &br->address_space_mem;
-    memory_region_init(&br->address_space_mem, "pci_bridge_pci", INT64_MAX);
+    memory_region_init(&br->address_space_mem, NULL, "pci_bridge_pci", INT64_MAX);
     sec_bus->address_space_io = &br->address_space_io;
-    memory_region_init(&br->address_space_io, "pci_bridge_io", 65536);
+    memory_region_init(&br->address_space_io, NULL, "pci_bridge_io", 65536);
     br->windows = pci_bridge_region_init(br);
     QLIST_INIT(&sec_bus->child);
     QLIST_INSERT_HEAD(&parent->child, sec_bus, sibling);
diff --git a/hw/pci/pcie_host.c b/hw/pci/pcie_host.c
index b2d942b..26f2007 100644
--- a/hw/pci/pcie_host.c
+++ b/hw/pci/pcie_host.c
@@ -130,7 +130,7 @@ void pcie_host_mmcfg_map(PCIExpressHost *e, hwaddr addr,
     assert(size >= PCIE_MMCFG_SIZE_MIN);
     assert(size <= PCIE_MMCFG_SIZE_MAX);
     e->size = size;
-    memory_region_init_io(&e->mmio, &pcie_mmcfg_ops, e, "pcie-mmcfg", e->size);
+    memory_region_init_io(&e->mmio, NULL, &pcie_mmcfg_ops, e, "pcie-mmcfg", e->size);
     e->base_addr = addr;
     memory_region_add_subregion(get_system_memory(), e->base_addr, &e->mmio);
 }
diff --git a/hw/pci/shpc.c b/hw/pci/shpc.c
index d35c2ee..c4eae07 100644
--- a/hw/pci/shpc.c
+++ b/hw/pci/shpc.c
@@ -612,7 +612,7 @@ int shpc_init(PCIDevice *d, PCIBus *sec_bus, MemoryRegion *bar, unsigned offset)
     }
 
     /* TODO: init cmask */
-    memory_region_init_io(&shpc->mmio, &shpc_mmio_ops, d, "shpc-mmio",
+    memory_region_init_io(&shpc->mmio, NULL, &shpc_mmio_ops, d, "shpc-mmio",
                           SHPC_SIZEOF(d));
     shpc_cap_update_dword(d);
     memory_region_add_subregion(bar, offset, &shpc->mmio);
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 38f7990..b45fe91 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -651,7 +651,7 @@ void ppce500_init(PPCE500Params *params)
     params->ram_size = ram_size;
 
     /* Register Memory */
-    memory_region_init_ram(ram, "mpc8544ds.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "mpc8544ds.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, 0, ram);
 
@@ -783,7 +783,7 @@ static int e500_ccsr_initfn(SysBusDevice *dev)
     PPCE500CCSRState *ccsr;
 
     ccsr = CCSR(dev);
-    memory_region_init(&ccsr->ccsr_space, "e500-ccsr",
+    memory_region_init(&ccsr->ccsr_space, NULL, "e500-ccsr",
                        MPC8544_CCSRBAR_SIZE);
     return 0;
 }
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 3badfa3..2133e2d 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -196,12 +196,12 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     }
 
     /* allocate RAM */
-    memory_region_init_ram(ram, "ppc_core99.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "ppc_core99.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(get_system_memory(), 0, ram);
 
     /* allocate and load BIOS */
-    memory_region_init_ram(bios, "ppc_core99.bios", BIOS_SIZE);
+    memory_region_init_ram(bios, NULL, "ppc_core99.bios", BIOS_SIZE);
     vmstate_register_ram_global(bios);
     if (bios_name == NULL)
         bios_name = PROM_FILENAME;
@@ -290,10 +290,10 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     isa_mmio_init(0xf2000000, 0x00800000);
 
     /* UniN init: XXX should be a real device */
-    memory_region_init_io(unin_memory, &unin_ops, token, "unin", 0x1000);
+    memory_region_init_io(unin_memory, NULL, &unin_ops, token, "unin", 0x1000);
     memory_region_add_subregion(get_system_memory(), 0xf8000000, unin_memory);
 
-    memory_region_init_io(unin2_memory, &unin_ops, token, "unin", 0x1000);
+    memory_region_init_io(unin2_memory, NULL, &unin_ops, token, "unin", 0x1000);
     memory_region_add_subregion(get_system_memory(), 0xf3000000, unin2_memory);
 
     openpic_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
@@ -371,7 +371,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
 
     escc_mem = escc_init(0, pic[0x25], pic[0x24],
                          serial_hds[0], serial_hds[1], ESCC_CLOCK, 4);
-    memory_region_init_alias(escc_bar, "escc-bar",
+    memory_region_init_alias(escc_bar, NULL, "escc-bar",
                              escc_mem, 0, memory_region_size(escc_mem));
 
     for(i = 0; i < nb_nics; i++)
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 8faff30..d5e8178 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -126,12 +126,12 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
         exit(1);
     }
 
-    memory_region_init_ram(ram, "ppc_heathrow.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "ppc_heathrow.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(sysmem, 0, ram);
 
     /* allocate and load BIOS */
-    memory_region_init_ram(bios, "ppc_heathrow.bios", BIOS_SIZE);
+    memory_region_init_ram(bios, NULL, "ppc_heathrow.bios", BIOS_SIZE);
     vmstate_register_ram_global(bios);
     if (bios_name == NULL)
         bios_name = PROM_FILENAME;
@@ -255,7 +255,7 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
 
     escc_mem = escc_init(0, pic[0x0f], pic[0x10], serial_hds[0],
                                serial_hds[1], ESCC_CLOCK, 4);
-    memory_region_init_alias(escc_bar, "escc-bar",
+    memory_region_init_alias(escc_bar, NULL, "escc-bar",
                              escc_mem, 0, memory_region_size(escc_mem));
 
     for(i = 0; i < nb_nics; i++)
diff --git a/hw/ppc/mpc8544_guts.c b/hw/ppc/mpc8544_guts.c
index d41f615..56249b4 100644
--- a/hw/ppc/mpc8544_guts.c
+++ b/hw/ppc/mpc8544_guts.c
@@ -119,7 +119,7 @@ static void mpc8544_guts_initfn(Object *obj)
     SysBusDevice *d = SYS_BUS_DEVICE(obj);
     GutsState *s = MPC8544_GUTS(obj);
 
-    memory_region_init_io(&s->iomem, &mpc8544_guts_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &mpc8544_guts_ops, s,
                           "mpc8544.guts", MPC8544_GUTS_MMIO_SIZE);
     sysbus_init_mmio(d, &s->iomem);
 }
diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
index f0c7ee9..f74e5e5 100644
--- a/hw/ppc/ppc405_boards.c
+++ b/hw/ppc/ppc405_boards.c
@@ -164,7 +164,7 @@ static void ref405ep_fpga_init(MemoryRegion *sysmem, uint32_t base)
     MemoryRegion *fpga_memory = g_new(MemoryRegion, 1);
 
     fpga = g_malloc0(sizeof(ref405ep_fpga_t));
-    memory_region_init_io(fpga_memory, &ref405ep_fpga_ops, fpga,
+    memory_region_init_io(fpga_memory, NULL, &ref405ep_fpga_ops, fpga,
                           "fpga", 0x00000100);
     memory_region_add_subregion(sysmem, base, fpga_memory);
     qemu_register_reset(&ref405ep_fpga_reset, fpga);
@@ -197,11 +197,11 @@ static void ref405ep_init(QEMUMachineInitArgs *args)
     MemoryRegion *sysmem = get_system_memory();
 
     /* XXX: fix this */
-    memory_region_init_ram(&ram_memories[0], "ef405ep.ram", 0x08000000);
+    memory_region_init_ram(&ram_memories[0], NULL, "ef405ep.ram", 0x08000000);
     vmstate_register_ram_global(&ram_memories[0]);
     ram_bases[0] = 0;
     ram_sizes[0] = 0x08000000;
-    memory_region_init(&ram_memories[1], "ef405ep.ram1", 0);
+    memory_region_init(&ram_memories[1], NULL, "ef405ep.ram1", 0);
     ram_bases[1] = 0x00000000;
     ram_sizes[1] = 0x00000000;
     ram_size = 128 * 1024 * 1024;
@@ -212,7 +212,7 @@ static void ref405ep_init(QEMUMachineInitArgs *args)
                         33333333, &pic, kernel_filename == NULL ? 0 : 1);
     /* allocate SRAM */
     sram_size = 512 * 1024;
-    memory_region_init_ram(sram, "ef405ep.sram", sram_size);
+    memory_region_init_ram(sram, NULL, "ef405ep.sram", sram_size);
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(sysmem, 0xFFF00000, sram);
     /* allocate and load BIOS */
@@ -244,7 +244,7 @@ static void ref405ep_init(QEMUMachineInitArgs *args)
         printf("Load BIOS from file\n");
 #endif
         bios = g_new(MemoryRegion, 1);
-        memory_region_init_ram(bios, "ef405ep.bios", BIOS_SIZE);
+        memory_region_init_ram(bios, NULL, "ef405ep.bios", BIOS_SIZE);
         vmstate_register_ram_global(bios);
         if (bios_name == NULL)
             bios_name = BIOS_FILENAME;
@@ -490,7 +490,7 @@ static void taihu_cpld_init(MemoryRegion *sysmem, uint32_t base)
     MemoryRegion *cpld_memory = g_new(MemoryRegion, 1);
 
     cpld = g_malloc0(sizeof(taihu_cpld_t));
-    memory_region_init_io(cpld_memory, &taihu_cpld_ops, cpld, "cpld", 0x100);
+    memory_region_init_io(cpld_memory, NULL, &taihu_cpld_ops, cpld, "cpld", 0x100);
     memory_region_add_subregion(sysmem, base, cpld_memory);
     qemu_register_reset(&taihu_cpld_reset, cpld);
 }
@@ -514,12 +514,12 @@ static void taihu_405ep_init(QEMUMachineInitArgs *args)
     DriveInfo *dinfo;
 
     /* RAM is soldered to the board so the size cannot be changed */
-    memory_region_init_ram(&ram_memories[0],
+    memory_region_init_ram(&ram_memories[0], NULL,
                            "taihu_405ep.ram-0", 0x04000000);
     vmstate_register_ram_global(&ram_memories[0]);
     ram_bases[0] = 0;
     ram_sizes[0] = 0x04000000;
-    memory_region_init_ram(&ram_memories[1],
+    memory_region_init_ram(&ram_memories[1], NULL,
                            "taihu_405ep.ram-1", 0x04000000);
     vmstate_register_ram_global(&ram_memories[1]);
     ram_bases[1] = 0x04000000;
@@ -563,7 +563,7 @@ static void taihu_405ep_init(QEMUMachineInitArgs *args)
         if (bios_name == NULL)
             bios_name = BIOS_FILENAME;
         bios = g_new(MemoryRegion, 1);
-        memory_region_init_ram(bios, "taihu_405ep.bios", BIOS_SIZE);
+        memory_region_init_ram(bios, NULL, "taihu_405ep.bios", BIOS_SIZE);
         vmstate_register_ram_global(bios);
         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
         if (filename) {
diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c
index c6c909e..290f71a 100644
--- a/hw/ppc/ppc405_uc.c
+++ b/hw/ppc/ppc405_uc.c
@@ -390,7 +390,7 @@ static void ppc4xx_opba_init(hwaddr base)
 #ifdef DEBUG_OPBA
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
-    memory_region_init_io(&opba->io, &opba_ops, opba, "opba", 0x002);
+    memory_region_init_io(&opba->io, NULL, &opba_ops, opba, "opba", 0x002);
     memory_region_add_subregion(get_system_memory(), base, &opba->io);
     qemu_register_reset(ppc4xx_opba_reset, opba);
 }
@@ -812,7 +812,7 @@ static void ppc405_gpio_init(hwaddr base)
 #ifdef DEBUG_GPIO
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
-    memory_region_init_io(&gpio->io, &ppc405_gpio_ops, gpio, "pgio", 0x038);
+    memory_region_init_io(&gpio->io, NULL, &ppc405_gpio_ops, gpio, "pgio", 0x038);
     memory_region_add_subregion(get_system_memory(), base, &gpio->io);
     qemu_register_reset(&ppc405_gpio_reset, gpio);
 }
@@ -972,9 +972,9 @@ static void ppc405_ocm_init(CPUPPCState *env)
 
     ocm = g_malloc0(sizeof(ppc405_ocm_t));
     /* XXX: Size is 4096 or 0x04000000 */
-    memory_region_init_ram(&ocm->isarc_ram, "ppc405.ocm", 4096);
+    memory_region_init_ram(&ocm->isarc_ram, NULL, "ppc405.ocm", 4096);
     vmstate_register_ram_global(&ocm->isarc_ram);
-    memory_region_init_alias(&ocm->dsarc_ram, "ppc405.dsarc", &ocm->isarc_ram,
+    memory_region_init_alias(&ocm->dsarc_ram, NULL, "ppc405.dsarc", &ocm->isarc_ram,
                              0, 4096);
     qemu_register_reset(&ocm_reset, ocm);
     ppc_dcr_register(env, OCM0_ISARC,
@@ -1222,7 +1222,7 @@ static void ppc405_i2c_init(hwaddr base, qemu_irq irq)
 #ifdef DEBUG_I2C
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
-    memory_region_init_io(&i2c->iomem, &i2c_ops, i2c, "i2c", 0x011);
+    memory_region_init_io(&i2c->iomem, NULL, &i2c_ops, i2c, "i2c", 0x011);
     memory_region_add_subregion(get_system_memory(), base, &i2c->iomem);
     qemu_register_reset(ppc4xx_i2c_reset, i2c);
 }
@@ -1501,7 +1501,7 @@ static void ppc4xx_gpt_init(hwaddr base, qemu_irq irqs[5])
 #ifdef DEBUG_GPT
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
-    memory_region_init_io(&gpt->iomem, &gpt_ops, gpt, "gpt", 0x0d4);
+    memory_region_init_io(&gpt->iomem, NULL, &gpt_ops, gpt, "gpt", 0x0d4);
     memory_region_add_subregion(get_system_memory(), base, &gpt->iomem);
     qemu_register_reset(ppc4xx_gpt_reset, gpt);
 }
diff --git a/hw/ppc/ppc4xx_devs.c b/hw/ppc/ppc4xx_devs.c
index d8e3dae..239aada 100644
--- a/hw/ppc/ppc4xx_devs.c
+++ b/hw/ppc/ppc4xx_devs.c
@@ -431,7 +431,7 @@ static void sdram_set_bcr(ppc4xx_sdram_t *sdram,
         printf("%s: Map RAM area " TARGET_FMT_plx " " TARGET_FMT_lx "\n",
                __func__, sdram_base(bcr), sdram_size(bcr));
 #endif
-        memory_region_init(&sdram->containers[n], "sdram-containers",
+        memory_region_init(&sdram->containers[n], NULL, "sdram-containers",
                            sdram_size(bcr));
         memory_region_add_subregion(&sdram->containers[n], 0,
                                     &sdram->ram_memories[n]);
@@ -696,7 +696,7 @@ ram_addr_t ppc4xx_sdram_adjust(ram_addr_t ram_size, int nr_banks,
             if (bank_size <= size_left) {
                 char name[32];
                 snprintf(name, sizeof(name), "ppc4xx.sdram%d", i);
-                memory_region_init_ram(&ram_memories[i], name, bank_size);
+                memory_region_init_ram(&ram_memories[i], NULL, name, bank_size);
                 vmstate_register_ram_global(&ram_memories[i]);
                 ram_bases[i] = base;
                 ram_sizes[i] = bank_size;
diff --git a/hw/ppc/ppc4xx_pci.c b/hw/ppc/ppc4xx_pci.c
index 599539b..f227043 100644
--- a/hw/ppc/ppc4xx_pci.c
+++ b/hw/ppc/ppc4xx_pci.c
@@ -355,12 +355,12 @@ static int ppc4xx_pcihost_initfn(SysBusDevice *dev)
     pci_create_simple(b, 0, "ppc4xx-host-bridge");
 
     /* XXX split into 2 memory regions, one for config space, one for regs */
-    memory_region_init(&s->container, "pci-container", PCI_ALL_SIZE);
-    memory_region_init_io(&h->conf_mem, &pci_host_conf_le_ops, h,
+    memory_region_init(&s->container, NULL, "pci-container", PCI_ALL_SIZE);
+    memory_region_init_io(&h->conf_mem, NULL, &pci_host_conf_le_ops, h,
                           "pci-conf-idx", 4);
-    memory_region_init_io(&h->data_mem, &pci_host_data_le_ops, h,
+    memory_region_init_io(&h->data_mem, NULL, &pci_host_data_le_ops, h,
                           "pci-conf-data", 4);
-    memory_region_init_io(&s->iomem, &pci_reg_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pci_reg_ops, s,
                           "pci.reg", PCI_REG_SIZE);
     memory_region_add_subregion(&s->container, PCIC0_CFGADDR, &h->conf_mem);
     memory_region_add_subregion(&s->container, PCIC0_CFGDATA, &h->data_mem);
diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index ea65414..0817f14 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -191,7 +191,7 @@ static int ppce500_spin_initfn(SysBusDevice *dev)
 
     s = FROM_SYSBUS(SpinState, SYS_BUS_DEVICE(dev));
 
-    memory_region_init_io(&s->iomem, &spin_rw_ops, s, "e500 spin pv device",
+    memory_region_init_io(&s->iomem, NULL, &spin_rw_ops, s, "e500 spin pv device",
                           sizeof(SpinInfo) * MAX_CPUS);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 560a59a..899aa30 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -505,12 +505,12 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
     }
 
     /* allocate RAM */
-    memory_region_init_ram(ram, "ppc_prep.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "ppc_prep.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(sysmem, 0, ram);
 
     /* allocate and load BIOS */
-    memory_region_init_ram(bios, "ppc_prep.bios", BIOS_SIZE);
+    memory_region_init_ram(bios, NULL, "ppc_prep.bios", BIOS_SIZE);
     memory_region_set_readonly(bios, true);
     memory_region_add_subregion(sysmem, (uint32_t)(-BIOS_SIZE), bios);
     vmstate_register_ram_global(bios);
@@ -621,7 +621,7 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
     qdev_init_nofail(dev);
 
     /* Register 8 MB of ISA IO space (needed for non-contiguous map) */
-    memory_region_init_io(PPC_io_memory, &PPC_prep_io_ops, sysctrl,
+    memory_region_init_io(PPC_io_memory, NULL, &PPC_prep_io_ops, sysctrl,
                           "ppc-io", 0x00800000);
     memory_region_add_subregion(sysmem, 0x80000000, PPC_io_memory);
 
@@ -658,7 +658,7 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
 
     /* PowerPC control and status register group */
 #if 0
-    memory_region_init_io(xcsr, &PPC_XCSR_ops, NULL, "ppc-xcsr", 0x1000);
+    memory_region_init_io(xcsr, NULL, &PPC_XCSR_ops, NULL, "ppc-xcsr", 0x1000);
     memory_region_add_subregion(sysmem, 0xFEFF0000, xcsr);
 #endif
 
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index fe34291..c114276 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -835,7 +835,7 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
         ram_addr_t nonrma_base = rma_alloc_size;
         ram_addr_t nonrma_size = spapr->ram_limit - rma_alloc_size;
 
-        memory_region_init_ram(ram, "ppc_spapr.ram", nonrma_size);
+        memory_region_init_ram(ram, NULL, "ppc_spapr.ram", nonrma_size);
         vmstate_register_ram_global(ram);
         memory_region_add_subregion(sysmem, nonrma_base, ram);
     }
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index 91bc8e4..3976af6 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -151,7 +151,7 @@ sPAPRTCETable *spapr_tce_new_table(uint32_t liobn, size_t window_size)
             "table @ %p, fd=%d\n", tcet, liobn, tcet->table, tcet->fd);
 #endif
 
-    memory_region_init_iommu(&tcet->iommu, &spapr_iommu_ops,
+    memory_region_init_iommu(&tcet->iommu, NULL, &spapr_iommu_ops,
                              "iommu-spapr", UINT64_MAX);
 
     QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index c8c12c8..65e05d5 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -581,10 +581,10 @@ static int spapr_phb_init(SysBusDevice *s)
 
     /* Initialize memory regions */
     sprintf(namebuf, "%s.mmio", sphb->dtbusname);
-    memory_region_init(&sphb->memspace, namebuf, INT64_MAX);
+    memory_region_init(&sphb->memspace, NULL, namebuf, INT64_MAX);
 
     sprintf(namebuf, "%s.mmio-alias", sphb->dtbusname);
-    memory_region_init_alias(&sphb->memwindow, namebuf, &sphb->memspace,
+    memory_region_init_alias(&sphb->memwindow, NULL, namebuf, &sphb->memspace,
                              SPAPR_PCI_MEM_WIN_BUS_OFFSET, sphb->mem_win_size);
     memory_region_add_subregion(get_system_memory(), sphb->mem_win_addr,
                                 &sphb->memwindow);
@@ -598,12 +598,12 @@ static int spapr_phb_init(SysBusDevice *s)
      * system_io works around the problem until all the users of
      * old_portion are updated */
     sprintf(namebuf, "%s.io", sphb->dtbusname);
-    memory_region_init(&sphb->iospace, namebuf, SPAPR_PCI_IO_WIN_SIZE);
+    memory_region_init(&sphb->iospace, NULL, namebuf, SPAPR_PCI_IO_WIN_SIZE);
     /* FIXME: fix to support multiple PHBs */
     memory_region_add_subregion(get_system_io(), 0, &sphb->iospace);
 
     sprintf(namebuf, "%s.io-alias", sphb->dtbusname);
-    memory_region_init_io(&sphb->iowindow, &spapr_io_ops, sphb,
+    memory_region_init_io(&sphb->iowindow, NULL, &spapr_io_ops, sphb,
                           namebuf, SPAPR_PCI_IO_WIN_SIZE);
     memory_region_add_subregion(get_system_memory(), sphb->io_win_addr,
                                 &sphb->iowindow);
@@ -613,7 +613,7 @@ static int spapr_phb_init(SysBusDevice *s)
      * from msi_notify()/msix_notify() */
     if (msi_supported) {
         sprintf(namebuf, "%s.msi", sphb->dtbusname);
-        memory_region_init_io(&sphb->msiwindow, &spapr_msi_ops, sphb,
+        memory_region_init_io(&sphb->msiwindow, NULL, &spapr_msi_ops, sphb,
                               namebuf, SPAPR_MSIX_MAX_DEVS * 0x10000);
         memory_region_add_subregion(get_system_memory(), sphb->msi_win_addr,
                                     &sphb->msiwindow);
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index 709a707..08e77fb 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -190,7 +190,7 @@ static void virtex_init(QEMUMachineInitArgs *args)
     env = &cpu->env;
     qemu_register_reset(main_cpu_reset, cpu);
 
-    memory_region_init_ram(phys_ram, "ram", ram_size);
+    memory_region_init_ram(phys_ram, NULL, "ram", ram_size);
     vmstate_register_ram_global(phys_ram);
     memory_region_add_subregion(address_space_mem, ram_base, phys_ram);
 
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index eb774d9..aebbbf1 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -89,7 +89,7 @@ static void ccw_init(QEMUMachineInitArgs *args)
     virtio_ccw_register_hcalls();
 
     /* allocate RAM */
-    memory_region_init_ram(ram, "s390.ram", my_ram_size);
+    memory_region_init_ram(ram, NULL, "s390.ram", my_ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(sysmem, 0, ram);
 
diff --git a/hw/s390x/s390-virtio.c b/hw/s390x/s390-virtio.c
index 30d1118..edbde00 100644
--- a/hw/s390x/s390-virtio.c
+++ b/hw/s390x/s390-virtio.c
@@ -256,7 +256,7 @@ static void s390_init(QEMUMachineInitArgs *args)
     s390_virtio_register_hcalls();
 
     /* allocate RAM */
-    memory_region_init_ram(ram, "s390.ram", my_ram_size);
+    memory_region_init_ram(ram, NULL, "s390.ram", my_ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(sysmem, 0, ram);
 
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 029789a..384224f 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -349,7 +349,7 @@ static int esp_pci_scsi_init(PCIDevice *dev)
     s->dma_memory_write = esp_pci_dma_memory_write;
     s->dma_opaque = pci;
     s->chip_id = TCHI_AM53C974;
-    memory_region_init_io(&pci->io, &esp_pci_io_ops, pci, "esp-io", 0x80);
+    memory_region_init_io(&pci->io, NULL, &esp_pci_io_ops, pci, "esp-io", 0x80);
 
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->io);
     s->irq = pci->dev.irq[0];
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 0c81a50..5da5d7a 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -675,7 +675,7 @@ static int sysbus_esp_init(SysBusDevice *dev)
     assert(sysbus->it_shift != -1);
 
     s->chip_id = TCHI_FAS100A;
-    memory_region_init_io(&sysbus->iomem, &sysbus_esp_mem_ops, sysbus,
+    memory_region_init_io(&sysbus->iomem, NULL, &sysbus_esp_mem_ops, sysbus,
                           "esp", ESP_REGS << sysbus->it_shift);
     sysbus_init_mmio(dev, &sysbus->iomem);
 
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 22b8e98..b31f0b7 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2090,9 +2090,9 @@ static int lsi_scsi_init(PCIDevice *dev)
     /* Interrupt pin A */
     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
 
-    memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
-    memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
-    memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
+    memory_region_init_io(&s->mmio_io, NULL, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
+    memory_region_init_io(&s->ram_io, NULL, &lsi_ram_ops, s, "lsi-ram", 0x2000);
+    memory_region_init_io(&s->io_io, NULL, &lsi_io_ops, s, "lsi-io", 256);
 
     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
     pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 65ccb09..ba74f0b 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2098,11 +2098,11 @@ static int megasas_scsi_init(PCIDevice *dev)
     /* Interrupt pin 1 */
     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
 
-    memory_region_init_io(&s->mmio_io, &megasas_mmio_ops, s,
+    memory_region_init_io(&s->mmio_io, NULL, &megasas_mmio_ops, s,
                           "megasas-mmio", 0x4000);
-    memory_region_init_io(&s->port_io, &megasas_port_ops, s,
+    memory_region_init_io(&s->port_io, NULL, &megasas_port_ops, s,
                           "megasas-io", 256);
-    memory_region_init_io(&s->queue_io, &megasas_queue_ops, s,
+    memory_region_init_io(&s->queue_io, NULL, &megasas_queue_ops, s,
                           "megasas-queue", 0x40000);
 
 #ifdef USE_MSIX
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 7cf4044..b7a1275 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1075,7 +1075,7 @@ pvscsi_init(PCIDevice *pci_dev)
     /* Interrupt pin A */
     pci_config_set_interrupt_pin(pci_dev->config, 1);
 
-    memory_region_init_io(&s->io_space, &pvscsi_ops, s,
+    memory_region_init_io(&s->io_space, NULL, &pvscsi_ops, s,
                           "pvscsi-io", PVSCSI_MEM_SPACE_SIZE);
     pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io_space);
 
diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index 61a8aad..6de050f 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -253,7 +253,7 @@ static int milkymist_memcard_init(SysBusDevice *dev)
     s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     s->enabled = dinfo ? bdrv_is_inserted(dinfo->bdrv) : 0;
 
-    memory_region_init_io(&s->regs_region, &memcard_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &memcard_mmio_ops, s,
             "milkymist-memcard", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index ba9f4b3..bf5d1fb 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -588,7 +588,7 @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
 
     omap_mmc_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_mmc_ops, s, "omap.mmc", 0x800);
+    memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc", 0x800);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     /* Instantiate the storage */
@@ -612,7 +612,7 @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
 
     omap_mmc_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_mmc_ops, s, "omap.mmc",
+    memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
 
diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index e08fd04..15f7890 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -479,7 +479,7 @@ static int pl181_init(SysBusDevice *dev)
     pl181_state *s = FROM_SYSBUS(pl181_state, dev);
     DriveInfo *dinfo;
 
-    memory_region_init_io(&s->iomem, &pl181_ops, s, "pl181", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl181_ops, s, "pl181", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq[0]);
     sysbus_init_irq(dev, &s->irq[1]);
diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c
index 0574d6b..90c955f 100644
--- a/hw/sd/pxa2xx_mmci.c
+++ b/hw/sd/pxa2xx_mmci.c
@@ -533,7 +533,7 @@ PXA2xxMMCIState *pxa2xx_mmci_init(MemoryRegion *sysmem,
     s->rx_dma = rx_dma;
     s->tx_dma = tx_dma;
 
-    memory_region_init_io(&s->iomem, &pxa2xx_mmci_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_mmci_ops, s,
                           "pxa2xx-mmci", 0x00100000);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index b9dd4be..ac219c0 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1245,7 +1245,7 @@ static void sdhci_realize(DeviceState *dev, Error ** errp)
     s->buf_maxsz = sdhci_get_fifolen(s);
     s->fifo_buffer = g_malloc0(s->buf_maxsz);
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, &sdhci_mmio_ops, s, "sdhci",
+    memory_region_init_io(&s->iomem, NULL, &sdhci_mmio_ops, s, "sdhci",
             SDHC_REGISTERS_MAP_SIZE);
     sysbus_init_mmio(sbd, &s->iomem);
 }
diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index 3e4818e..e779416 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -186,7 +186,7 @@ static qemu_irq *r2d_fpga_init(MemoryRegion *sysmem,
 
     s->irl = irl;
 
-    memory_region_init_io(&s->iomem, &r2d_fpga_ops, s, "r2d-fpga", 0x40);
+    memory_region_init_io(&s->iomem, NULL, &r2d_fpga_ops, s, "r2d-fpga", 0x40);
     memory_region_add_subregion(sysmem, base, &s->iomem);
     return qemu_allocate_irqs(r2d_fpga_irq_set, s, NR_IRQS);
 }
@@ -254,7 +254,7 @@ static void r2d_init(QEMUMachineInitArgs *args)
     qemu_register_reset(main_cpu_reset, reset_info);
 
     /* Allocate memory space */
-    memory_region_init_ram(sdram, "r2d.sdram", SDRAM_SIZE);
+    memory_region_init_ram(sdram, NULL, "r2d.sdram", SDRAM_SIZE);
     vmstate_register_ram_global(sdram);
     memory_region_add_subregion(address_space_mem, SDRAM_BASE, sdram);
     /* Register peripherals */
diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c
index 03e8bd1..1439ba4 100644
--- a/hw/sh4/sh7750.c
+++ b/hw/sh4/sh7750.c
@@ -730,34 +730,34 @@ SH7750State *sh7750_init(SuperHCPU *cpu, MemoryRegion *sysmem)
     s = g_malloc0(sizeof(SH7750State));
     s->cpu = cpu;
     s->periph_freq = 60000000;	/* 60MHz */
-    memory_region_init_io(&s->iomem, &sh7750_mem_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &sh7750_mem_ops, s,
                           "memory", 0x1fc01000);
 
-    memory_region_init_alias(&s->iomem_1f0, "memory-1f0",
+    memory_region_init_alias(&s->iomem_1f0, NULL, "memory-1f0",
                              &s->iomem, 0x1f000000, 0x1000);
     memory_region_add_subregion(sysmem, 0x1f000000, &s->iomem_1f0);
 
-    memory_region_init_alias(&s->iomem_ff0, "memory-ff0",
+    memory_region_init_alias(&s->iomem_ff0, NULL, "memory-ff0",
                              &s->iomem, 0x1f000000, 0x1000);
     memory_region_add_subregion(sysmem, 0xff000000, &s->iomem_ff0);
 
-    memory_region_init_alias(&s->iomem_1f8, "memory-1f8",
+    memory_region_init_alias(&s->iomem_1f8, NULL, "memory-1f8",
                              &s->iomem, 0x1f800000, 0x1000);
     memory_region_add_subregion(sysmem, 0x1f800000, &s->iomem_1f8);
 
-    memory_region_init_alias(&s->iomem_ff8, "memory-ff8",
+    memory_region_init_alias(&s->iomem_ff8, NULL, "memory-ff8",
                              &s->iomem, 0x1f800000, 0x1000);
     memory_region_add_subregion(sysmem, 0xff800000, &s->iomem_ff8);
 
-    memory_region_init_alias(&s->iomem_1fc, "memory-1fc",
+    memory_region_init_alias(&s->iomem_1fc, NULL, "memory-1fc",
                              &s->iomem, 0x1fc00000, 0x1000);
     memory_region_add_subregion(sysmem, 0x1fc00000, &s->iomem_1fc);
 
-    memory_region_init_alias(&s->iomem_ffc, "memory-ffc",
+    memory_region_init_alias(&s->iomem_ffc, NULL, "memory-ffc",
                              &s->iomem, 0x1fc00000, 0x1000);
     memory_region_add_subregion(sysmem, 0xffc00000, &s->iomem_ffc);
 
-    memory_region_init_io(&s->mmct_iomem, &sh7750_mmct_ops, s,
+    memory_region_init_io(&s->mmct_iomem, NULL, &sh7750_mmct_ops, s,
                           "cache-and-tlb", 0x08000000);
     memory_region_add_subregion(sysmem, 0xf0000000, &s->mmct_iomem);
 
diff --git a/hw/sh4/sh_pci.c b/hw/sh4/sh_pci.c
index d213a90..8b842bc 100644
--- a/hw/sh4/sh_pci.c
+++ b/hw/sh4/sh_pci.c
@@ -125,9 +125,9 @@ static int sh_pci_device_init(SysBusDevice *dev)
                               get_system_memory(),
                               get_system_io(),
                               PCI_DEVFN(0, 0), 4, TYPE_PCI_BUS);
-    memory_region_init_io(&s->memconfig_p4, &sh_pci_reg_ops, s,
+    memory_region_init_io(&s->memconfig_p4, NULL, &sh_pci_reg_ops, s,
                           "sh_pci", 0x224);
-    memory_region_init_alias(&s->memconfig_a7, "sh_pci.2", &s->memconfig_p4,
+    memory_region_init_alias(&s->memconfig_a7, NULL, "sh_pci.2", &s->memconfig_p4,
                              0, 0x224);
     isa_mmio_setup(&s->isa, 0x40000);
     sysbus_init_mmio(dev, &s->memconfig_p4);
diff --git a/hw/sh4/shix.c b/hw/sh4/shix.c
index ffac621..84dd666 100644
--- a/hw/sh4/shix.c
+++ b/hw/sh4/shix.c
@@ -59,16 +59,16 @@ static void shix_init(QEMUMachineInitArgs *args)
 
     /* Allocate memory space */
     printf("Allocating ROM\n");
-    memory_region_init_ram(rom, "shix.rom", 0x4000);
+    memory_region_init_ram(rom, NULL, "shix.rom", 0x4000);
     vmstate_register_ram_global(rom);
     memory_region_set_readonly(rom, true);
     memory_region_add_subregion(sysmem, 0x00000000, rom);
     printf("Allocating SDRAM 1\n");
-    memory_region_init_ram(&sdram[0], "shix.sdram1", 0x01000000);
+    memory_region_init_ram(&sdram[0], NULL, "shix.sdram1", 0x01000000);
     vmstate_register_ram_global(&sdram[0]);
     memory_region_add_subregion(sysmem, 0x08000000, &sdram[0]);
     printf("Allocating SDRAM 2\n");
-    memory_region_init_ram(&sdram[1], "shix.sdram2", 0x01000000);
+    memory_region_init_ram(&sdram[1], NULL, "shix.sdram2", 0x01000000);
     vmstate_register_ram_global(&sdram[1]);
     memory_region_add_subregion(sysmem, 0x0c000000, &sdram[1]);
 
diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c
index 78c77ef..5ef282f 100644
--- a/hw/sparc/leon3.c
+++ b/hw/sparc/leon3.c
@@ -147,13 +147,13 @@ static void leon3_generic_hw_init(QEMUMachineInitArgs *args)
         exit(1);
     }
 
-    memory_region_init_ram(ram, "leon3.ram", ram_size);
+    memory_region_init_ram(ram, NULL, "leon3.ram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space_mem, 0x40000000, ram);
 
     /* Allocate BIOS */
     prom_size = 8 * 1024 * 1024; /* 8Mb */
-    memory_region_init_ram(prom, "Leon3.bios", prom_size);
+    memory_region_init_ram(prom, NULL, "Leon3.bios", prom_size);
     vmstate_register_ram_global(prom);
     memory_region_set_readonly(prom, true);
     memory_region_add_subregion(address_space_mem, 0x00000000, prom);
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 0e86ca7..1a16c82 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -582,7 +582,7 @@ static int idreg_init1(SysBusDevice *dev)
 {
     IDRegState *s = FROM_SYSBUS(IDRegState, dev);
 
-    memory_region_init_ram(&s->mem, "sun4m.idreg", sizeof(idreg_data));
+    memory_region_init_ram(&s->mem, NULL, "sun4m.idreg", sizeof(idreg_data));
     vmstate_register_ram_global(&s->mem);
     memory_region_set_readonly(&s->mem, true);
     sysbus_init_mmio(dev, &s->mem);
@@ -625,7 +625,7 @@ static int afx_init1(SysBusDevice *dev)
 {
     AFXState *s = FROM_SYSBUS(AFXState, dev);
 
-    memory_region_init_ram(&s->mem, "sun4m.afx", 4);
+    memory_region_init_ram(&s->mem, NULL, "sun4m.afx", 4);
     vmstate_register_ram_global(&s->mem);
     sysbus_init_mmio(dev, &s->mem);
     return 0;
@@ -695,7 +695,7 @@ static int prom_init1(SysBusDevice *dev)
 {
     PROMState *s = FROM_SYSBUS(PROMState, dev);
 
-    memory_region_init_ram(&s->prom, "sun4m.prom", PROM_SIZE_MAX);
+    memory_region_init_ram(&s->prom, NULL, "sun4m.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
     memory_region_set_readonly(&s->prom, true);
     sysbus_init_mmio(dev, &s->prom);
@@ -734,7 +734,7 @@ static int ram_init1(SysBusDevice *dev)
 {
     RamDevice *d = FROM_SYSBUS(RamDevice, dev);
 
-    memory_region_init_ram(&d->ram, "sun4m.ram", d->size);
+    memory_region_init_ram(&d->ram, NULL, "sun4m.ram", d->size);
     vmstate_register_ram_global(&d->ram);
     sysbus_init_mmio(dev, &d->ram);
     return 0;
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index a6a3b76..4643a83 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -680,7 +680,7 @@ static int prom_init1(SysBusDevice *dev)
 {
     PROMState *s = FROM_SYSBUS(PROMState, dev);
 
-    memory_region_init_ram(&s->prom, "sun4u.prom", PROM_SIZE_MAX);
+    memory_region_init_ram(&s->prom, NULL, "sun4u.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
     memory_region_set_readonly(&s->prom, true);
     sysbus_init_mmio(dev, &s->prom);
@@ -720,7 +720,7 @@ static int ram_init1(SysBusDevice *dev)
 {
     RamDevice *d = FROM_SYSBUS(RamDevice, dev);
 
-    memory_region_init_ram(&d->ram, "sun4u.ram", d->size);
+    memory_region_init_ram(&d->ram, NULL, "sun4u.ram", d->size);
     vmstate_register_ram_global(&d->ram);
     sysbus_init_mmio(dev, &d->ram);
     return 0;
diff --git a/hw/ssi/omap_spi.c b/hw/ssi/omap_spi.c
index 11403c4..0ed3b11 100644
--- a/hw/ssi/omap_spi.c
+++ b/hw/ssi/omap_spi.c
@@ -354,7 +354,7 @@ struct omap_mcspi_s *omap_mcspi_init(struct omap_target_agent_s *ta, int chnum,
     }
     omap_mcspi_reset(s);
 
-    memory_region_init_io(&s->iomem, &omap_mcspi_ops, s, "omap.mcspi",
+    memory_region_init_io(&s->iomem, NULL, &omap_mcspi_ops, s, "omap.mcspi",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
 
diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index 536c216..ab569d6 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -277,7 +277,7 @@ static int pl022_init(SysBusDevice *dev)
 {
     pl022_state *s = FROM_SYSBUS(pl022_state, dev);
 
-    memory_region_init_io(&s->iomem, &pl022_ops, s, "pl022", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl022_ops, s, "pl022", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
     s->ssi = ssi_create_bus(&dev->qdev, "ssi");
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index f6bd3ba..7a3c356 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -330,7 +330,7 @@ static int xilinx_spi_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->cs_lines[i]);
     }
 
-    memory_region_init_io(&s->mmio, &spi_ops, s, "xilinx-spi", R_MAX * 4);
+    memory_region_init_io(&s->mmio, NULL, &spi_ops, s, "xilinx-spi", R_MAX * 4);
     sysbus_init_mmio(dev, &s->mmio);
 
     s->irqline = -1;
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index 05a3ada..d7b5074 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -663,7 +663,7 @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
         sysbus_init_irq(sbd, &s->cs_lines[i]);
     }
 
-    memory_region_init_io(&s->iomem, xsc->reg_ops, s, "spi", R_MAX*4);
+    memory_region_init_io(&s->iomem, NULL, xsc->reg_ops, s, "spi", R_MAX*4);
     sysbus_init_mmio(sbd, &s->iomem);
 
     s->irqline = -1;
@@ -685,7 +685,7 @@ static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
     s->num_txrx_bytes = 4;
 
     xilinx_spips_realize(dev, errp);
-    memory_region_init_io(&s->mmlqspi, &lqspi_ops, s, "lqspi",
+    memory_region_init_io(&s->mmlqspi, NULL, &lqspi_ops, s, "lqspi",
                           (1 << LQSPI_ADDRESS_BITS) * 2);
     sysbus_init_mmio(sbd, &s->mmlqspi);
 
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index 317f5e4..e78f820 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -236,14 +236,14 @@ static int arm_mptimer_init(SysBusDevice *dev)
      *  * timer for core 1
      * and so on.
      */
-    memory_region_init_io(&s->iomem, &arm_thistimer_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &arm_thistimer_ops, s,
                           "arm_mptimer_timer", 0x20);
     sysbus_init_mmio(dev, &s->iomem);
     for (i = 0; i < s->num_cpu; i++) {
         TimerBlock *tb = &s->timerblock[i];
         tb->timer = qemu_new_timer_ns(vm_clock, timerblock_tick, tb);
         sysbus_init_irq(dev, &tb->irq);
-        memory_region_init_io(&tb->iomem, &timerblock_ops, tb,
+        memory_region_init_io(&tb->iomem, NULL, &timerblock_ops, tb,
                               "arm_mptimer_timerblock", 0x20);
         sysbus_init_mmio(dev, &tb->iomem);
     }
diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 6449870..f1a501f 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -284,7 +284,7 @@ static int sp804_init(SysBusDevice *dev)
     s->timer[1] = arm_timer_init(s->freq1);
     s->timer[0]->irq = qi[0];
     s->timer[1]->irq = qi[1];
-    memory_region_init_io(&s->iomem, &sp804_ops, s, "sp804", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &sp804_ops, s, "sp804", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     vmstate_register(&dev->qdev, -1, &vmstate_sp804, s);
     return 0;
@@ -347,7 +347,7 @@ static int icp_pit_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->timer[1]->irq);
     sysbus_init_irq(dev, &s->timer[2]->irq);
 
-    memory_region_init_io(&s->iomem, &icp_pit_ops, s, "icp_pit", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &icp_pit_ops, s, "icp_pit", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     /* This device has no state to save/restore.  The component timers will
        save themselves.  */
diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index ba584f4..4879cb0 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -409,7 +409,7 @@ static int cadence_ttc_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->timer[i].irq);
     }
 
-    memory_region_init_io(&s->iomem, &cadence_ttc_ops, s, "timer", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &cadence_ttc_ops, s, "timer", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index 3cd9476..8a7b177 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -323,7 +323,7 @@ static int etraxfs_timer_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &t->irq);
     sysbus_init_irq(dev, &t->nmi);
 
-    memory_region_init_io(&t->mmio, &timer_ops, t, "etraxfs-timer", 0x5c);
+    memory_region_init_io(&t->mmio, NULL, &timer_ops, t, "etraxfs-timer", 0x5c);
     sysbus_init_mmio(dev, &t->mmio);
     qemu_register_reset(etraxfs_timer_reset, t);
     return 0;
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index 38dcc1a..ba74d2b 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -1449,7 +1449,7 @@ static int exynos4210_mct_init(SysBusDevice *dev)
         sysbus_init_irq(dev, &s->l_timer[i].irq);
     }
 
-    memory_region_init_io(&s->iomem, &exynos4210_mct_ops, s, "exynos4210-mct",
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_mct_ops, s, "exynos4210-mct",
             MCT_SFR_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index 185ccb9..62c42b4 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -390,7 +390,7 @@ static int exynos4210_pwm_init(SysBusDevice *dev)
         s->timer[i].parent = s;
     }
 
-    memory_region_init_io(&s->iomem, &exynos4210_pwm_ops, s, "exynos4210-pwm",
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_pwm_ops, s, "exynos4210-pwm",
             EXYNOS4210_PWM_REG_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index 3ac77f9..779dc77 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -559,7 +559,7 @@ static int exynos4210_rtc_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->alm_irq);
     sysbus_init_irq(dev, &s->tick_irq);
 
-    memory_region_init_io(&s->iomem, &exynos4210_rtc_ops, s, "exynos4210-rtc",
+    memory_region_init_io(&s->iomem, NULL, &exynos4210_rtc_ops, s, "exynos4210-rtc",
             EXYNOS4210_RTC_REG_MEM_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index 7043a34..749ed31 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -365,7 +365,7 @@ static int grlib_gptimer_init(SysBusDevice *dev)
         ptimer_set_freq(timer->ptimer, unit->freq_hz);
     }
 
-    memory_region_init_io(&unit->iomem, &grlib_gptimer_ops, unit, "gptimer",
+    memory_region_init_io(&unit->iomem, NULL, &grlib_gptimer_ops, unit, "gptimer",
                           UNIT_REG_SIZE + GPTIMER_REG_SIZE * unit->nr_timers);
 
     sysbus_init_mmio(dev, &unit->iomem);
diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 95dd01d..2e7fdb5 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -722,7 +722,7 @@ static int hpet_init(SysBusDevice *dev)
     qdev_init_gpio_out(&dev->qdev, &s->pit_enabled, 1);
 
     /* HPET Area */
-    memory_region_init_io(&s->iomem, &hpet_ram_ops, s, "hpet", 0x400);
+    memory_region_init_io(&s->iomem, NULL, &hpet_ram_ops, s, "hpet", 0x400);
     sysbus_init_mmio(dev, &s->iomem);
     return 0;
 }
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index 16c8dd6..fdb23da 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -333,7 +333,7 @@ static void pit_realizefn(DeviceState *dev, Error **err)
     s->irq_timer = qemu_new_timer_ns(vm_clock, pit_irq_timer, s);
     qdev_init_gpio_out(dev, &s->irq, 1);
 
-    memory_region_init_io(&pit->ioports, &pit_ioport_ops, pit, "pit", 4);
+    memory_region_init_io(&pit->ioports, NULL, &pit_ioport_ops, pit, "pit", 4);
 
     qdev_init_gpio_in(dev, pit_irq_control, 1);
 
diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index 7cdb006..d2e0895 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -396,7 +396,7 @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
     DPRINTF("\n");
 
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, &imx_epit_ops, s, TYPE_IMX_EPIT,
+    memory_region_init_io(&s->iomem, NULL, &imx_epit_ops, s, TYPE_IMX_EPIT,
                           0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
 
diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index de53b13..6e6442d 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -514,7 +514,7 @@ static void imx_gpt_realize(DeviceState *dev, Error **errp)
     QEMUBH *bh;
 
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, &imx_gpt_ops, s, TYPE_IMX_GPT,
+    memory_region_init_io(&s->iomem, NULL, &imx_gpt_ops, s, TYPE_IMX_GPT,
                           0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
 
diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
index e06fac7..2ab8588 100644
--- a/hw/timer/lm32_timer.c
+++ b/hw/timer/lm32_timer.c
@@ -180,7 +180,7 @@ static int lm32_timer_init(SysBusDevice *dev)
     s->ptimer = ptimer_init(s->bh);
     ptimer_set_freq(s->ptimer, s->freq_hz);
 
-    memory_region_init_io(&s->iomem, &timer_ops, s, "timer", R_MAX * 4);
+    memory_region_init_io(&s->iomem, NULL, &timer_ops, s, "timer", R_MAX * 4);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c
index bf6c4c8..fdda6d6 100644
--- a/hw/timer/m48t59.c
+++ b/hw/timer/m48t59.c
@@ -655,7 +655,7 @@ M48t59State *m48t59_init(qemu_irq IRQ, hwaddr mem_base,
     d = FROM_SYSBUS(M48t59SysBusState, s);
     state = &d->state;
     sysbus_connect_irq(s, 0, IRQ);
-    memory_region_init_io(&d->io, &m48t59_io_ops, state, "m48t59", 4);
+    memory_region_init_io(&d->io, NULL, &m48t59_io_ops, state, "m48t59", 4);
     if (io_base != 0) {
         memory_region_add_subregion(get_system_io(), io_base, &d->io);
     }
@@ -683,7 +683,7 @@ M48t59State *m48t59_init_isa(ISABus *bus, uint32_t io_base, uint16_t size,
     d = ISA_M48T59(isadev);
     s = &d->state;
 
-    memory_region_init_io(&d->io, &m48t59_io_ops, s, "m48t59", 4);
+    memory_region_init_io(&d->io, NULL, &m48t59_io_ops, s, "m48t59", 4);
     if (io_base != 0) {
         isa_register_ioport(isadev, &d->io, io_base);
     }
@@ -721,7 +721,7 @@ static int m48t59_init1(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->IRQ);
 
-    memory_region_init_io(&s->iomem, &nvram_ops, s, "m48t59.nvram", s->size);
+    memory_region_init_io(&s->iomem, NULL, &nvram_ops, s, "m48t59.nvram", s->size);
     sysbus_init_mmio(dev, &s->iomem);
     m48t59_realize_common(s, &err);
     if (err != NULL) {
diff --git a/hw/timer/mc146818rtc.c b/hw/timer/mc146818rtc.c
index 9c4a7bd..4110a37 100644
--- a/hw/timer/mc146818rtc.c
+++ b/hw/timer/mc146818rtc.c
@@ -863,7 +863,7 @@ static void rtc_realizefn(DeviceState *dev, Error **errp)
     s->suspend_notifier.notify = rtc_notify_suspend;
     qemu_register_suspend_notifier(&s->suspend_notifier);
 
-    memory_region_init_io(&s->io, &cmos_ops, s, "rtc", 2);
+    memory_region_init_io(&s->io, NULL, &cmos_ops, s, "rtc", 2);
     isa_register_ioport(isadev, &s->io, base);
 
     qdev_set_legacy_instance_id(dev, base, 3);
diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
index e083a28..f253f21 100644
--- a/hw/timer/milkymist-sysctl.c
+++ b/hw/timer/milkymist-sysctl.c
@@ -280,7 +280,7 @@ static int milkymist_sysctl_init(SysBusDevice *dev)
     ptimer_set_freq(s->ptimer0, s->freq_hz);
     ptimer_set_freq(s->ptimer1, s->freq_hz);
 
-    memory_region_init_io(&s->regs_region, &sysctl_mmio_ops, s,
+    memory_region_init_io(&s->regs_region, NULL, &sysctl_mmio_ops, s,
             "milkymist-sysctl", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
diff --git a/hw/timer/omap_gptimer.c b/hw/timer/omap_gptimer.c
index 9b0e9dd..ac389d8 100644
--- a/hw/timer/omap_gptimer.c
+++ b/hw/timer/omap_gptimer.c
@@ -480,7 +480,7 @@ struct omap_gp_timer_s *omap_gp_timer_init(struct omap_target_agent_s *ta,
     omap_gp_timer_reset(s);
     omap_gp_timer_clk_setup(s);
 
-    memory_region_init_io(&s->iomem, &omap_gp_timer_ops, s, "omap.gptimer",
+    memory_region_init_io(&s->iomem, NULL, &omap_gp_timer_ops, s, "omap.gptimer",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
 
diff --git a/hw/timer/omap_synctimer.c b/hw/timer/omap_synctimer.c
index a24f35c..a12aca2 100644
--- a/hw/timer/omap_synctimer.c
+++ b/hw/timer/omap_synctimer.c
@@ -94,7 +94,7 @@ struct omap_synctimer_s *omap_synctimer_init(struct omap_target_agent_s *ta,
     struct omap_synctimer_s *s = g_malloc0(sizeof(*s));
 
     omap_synctimer_reset(s);
-    memory_region_init_io(&s->iomem, &omap_synctimer_ops, s, "omap.synctimer",
+    memory_region_init_io(&s->iomem, NULL, &omap_synctimer_ops, s, "omap.synctimer",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
 
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index 764940b..cba4e87 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -192,7 +192,7 @@ static int pl031_init(SysBusDevice *dev)
     pl031_state *s = FROM_SYSBUS(pl031_state, dev);
     struct tm tm;
 
-    memory_region_init_io(&s->iomem, &pl031_ops, s, "pl031", 0x1000);
+    memory_region_init_io(&s->iomem, NULL, &pl031_ops, s, "pl031", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
 
     sysbus_init_irq(dev, &s->irq);
diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
index 0c3d827..375d368 100644
--- a/hw/timer/puv3_ost.c
+++ b/hw/timer/puv3_ost.c
@@ -122,7 +122,7 @@ static int puv3_ost_init(SysBusDevice *dev)
     s->ptimer = ptimer_init(s->bh);
     ptimer_set_freq(s->ptimer, 50 * 1000 * 1000);
 
-    memory_region_init_io(&s->iomem, &puv3_ost_ops, s, "puv3_ost",
+    memory_region_init_io(&s->iomem, NULL, &puv3_ost_ops, s, "puv3_ost",
             PUV3_REGS_OFFSET);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index 8ea2416..dd41a10 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -461,7 +461,7 @@ static int pxa2xx_timer_init(SysBusDevice *dev)
         }
     }
 
-    memory_region_init_io(&s->iomem, &pxa2xx_timer_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &pxa2xx_timer_ops, s,
                           "pxa2xx-timer", 0x00001000);
     sysbus_init_mmio(dev, &s->iomem);
 
diff --git a/hw/timer/sh_timer.c b/hw/timer/sh_timer.c
index f92ff4f..251a10d 100644
--- a/hw/timer/sh_timer.c
+++ b/hw/timer/sh_timer.c
@@ -319,14 +319,14 @@ void tmu012_init(MemoryRegion *sysmem, hwaddr base,
         s->timer[2] = sh_timer_init(freq, timer_feat | TIMER_FEAT_CAPT,
 				    ch2_irq0); /* ch2_irq1 not supported */
 
-    memory_region_init_io(&s->iomem, &tmu012_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &tmu012_ops, s,
                           "timer", 0x100000000ULL);
 
-    memory_region_init_alias(&s->iomem_p4, "timer-p4",
+    memory_region_init_alias(&s->iomem_p4, NULL, "timer-p4",
                              &s->iomem, 0, 0x1000);
     memory_region_add_subregion(sysmem, P4ADDR(base), &s->iomem_p4);
 
-    memory_region_init_alias(&s->iomem_a7, "timer-a7",
+    memory_region_init_alias(&s->iomem_a7, NULL, "timer-a7",
                              &s->iomem, 0, 0x1000);
     memory_region_add_subregion(sysmem, A7ADDR(base), &s->iomem_a7);
     /* ??? Save/restore.  */
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index 1145a87..cad81a3 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -394,7 +394,7 @@ static int slavio_timer_init1(SysBusDevice *dev)
 
         size = i == 0 ? SYS_TIMER_SIZE : CPU_TIMER_SIZE;
         snprintf(timer_name, sizeof(timer_name), "timer-%i", i);
-        memory_region_init_io(&tc->iomem, &slavio_timer_mem_ops, tc,
+        memory_region_init_io(&tc->iomem, NULL, &slavio_timer_mem_ops, tc,
                               timer_name, size);
         sysbus_init_mmio(dev, &tc->iomem);
 
diff --git a/hw/timer/tusb6010.c b/hw/timer/tusb6010.c
index 50edc06..fcce4ac 100644
--- a/hw/timer/tusb6010.c
+++ b/hw/timer/tusb6010.c
@@ -779,7 +779,7 @@ static int tusb6010_init(SysBusDevice *dev)
     TUSBState *s = FROM_SYSBUS(TUSBState, dev);
     s->otg_timer = qemu_new_timer_ns(vm_clock, tusb_otg_tick, s);
     s->pwr_timer = qemu_new_timer_ns(vm_clock, tusb_power_tick, s);
-    memory_region_init_io(&s->iomem[1], &tusb_async_ops, s, "tusb-async",
+    memory_region_init_io(&s->iomem[1], NULL, &tusb_async_ops, s, "tusb-async",
                           UINT32_MAX);
     sysbus_init_mmio(dev, &s->iomem[0]);
     sysbus_init_mmio(dev, &s->iomem[1]);
diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index 0c39cff..f4b4fb5 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -218,7 +218,7 @@ static int xilinx_timer_init(SysBusDevice *dev)
         ptimer_set_freq(xt->ptimer, t->freq_hz);
     }
 
-    memory_region_init_io(&t->mmio, &timer_ops, t, "xlnx.xps-timer",
+    memory_region_init_io(&t->mmio, NULL, &timer_ops, t, "xlnx.xps-timer",
                           R_MAX * 4 * num_timers(t));
     sysbus_init_mmio(dev, &t->mmio);
     return 0;
diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c
index d4d8152..5504fb4 100644
--- a/hw/tpm/tpm_tis.c
+++ b/hw/tpm/tpm_tis.c
@@ -888,7 +888,7 @@ static void tpm_tis_initfn(Object *obj)
     ISADevice *dev = ISA_DEVICE(obj);
     TPMState *s = TPM(obj);
 
-    memory_region_init_io(&s->mmio, &tpm_tis_memory_ops, s, "tpm-tis-mmio",
+    memory_region_init_io(&s->mmio, NULL, &tpm_tis_memory_ops, s, "tpm-tis-mmio",
                           TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
     memory_region_add_subregion(isa_address_space(dev), TPM_TIS_ADDR_BASE,
                                 &s->mmio);
diff --git a/hw/unicore32/puv3.c b/hw/unicore32/puv3.c
index 56d1afa..5ff0dc9 100644
--- a/hw/unicore32/puv3.c
+++ b/hw/unicore32/puv3.c
@@ -73,7 +73,7 @@ static void puv3_board_init(CPUUniCore32State *env, ram_addr_t ram_size)
     MemoryRegion *ram_memory = g_new(MemoryRegion, 1);
 
     /* SDRAM at address zero.  */
-    memory_region_init_ram(ram_memory, "puv3.ram", ram_size);
+    memory_region_init_ram(ram_memory, NULL, "puv3.ram", ram_size);
     vmstate_register_ram_global(ram_memory);
     memory_region_add_subregion(get_system_memory(), 0, ram_memory);
 }
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index e7d4f74..76b4c05 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -173,7 +173,7 @@ static void fusbh200_ehci_init(Object *obj)
     FUSBH200EHCIState *f = FUSBH200_EHCI(obj);
     EHCIState *s = &i->ehci;
 
-    memory_region_init_io(&f->mem_vendor, &fusbh200_ehci_mmio_ops, s,
+    memory_region_init_io(&f->mem_vendor, NULL, &fusbh200_ehci_mmio_ops, s,
                           "fusbh200", 0x4c);
     memory_region_add_subregion(&s->mem,
                                 s->opregbase + s->portscbase + 4 * s->portnr,
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index f977a91..440c4c2 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2553,12 +2553,12 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
     QTAILQ_INIT(&s->pqueues);
     usb_packet_init(&s->ipacket);
 
-    memory_region_init(&s->mem, "ehci", MMIO_SIZE);
-    memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
+    memory_region_init(&s->mem, NULL, "ehci", MMIO_SIZE);
+    memory_region_init_io(&s->mem_caps, NULL, &ehci_mmio_caps_ops, s,
                           "capabilities", CAPA_SIZE);
-    memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
+    memory_region_init_io(&s->mem_opreg, NULL, &ehci_mmio_opreg_ops, s,
                           "operational", s->portscbase);
-    memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
+    memory_region_init_io(&s->mem_ports, NULL, &ehci_mmio_port_ops, s,
                           "ports", 4 * s->portnr);
 
     memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 5513924..aa51042 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1830,7 +1830,7 @@ static int usb_ohci_init(OHCIState *ohci, DeviceState *dev,
         }
     }
 
-    memory_region_init_io(&ohci->mem, &ohci_mem_ops, ohci, "ohci", 256);
+    memory_region_init_io(&ohci->mem, NULL, &ohci_mem_ops, ohci, "ohci", 256);
     ohci->localmem_base = localmem_base;
 
     ohci->name = object_get_typename(OBJECT(dev));
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index c85b203..502228b 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1259,7 +1259,7 @@ static int usb_uhci_common_initfn(PCIDevice *dev)
 
     qemu_register_reset(uhci_reset, s);
 
-    memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
+    memory_region_init_io(&s->io_bar, NULL, &uhci_ioport_ops, s, "uhci", 0x20);
     /* Use region 4 for consistency with real hardware.  BSD guests seem
        to rely on this.  */
     pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 91633ed..493d759 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3342,14 +3342,14 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
 
     xhci->irq = xhci->pci_dev.irq[0];
 
-    memory_region_init(&xhci->mem, "xhci", LEN_REGS);
-    memory_region_init_io(&xhci->mem_cap, &xhci_cap_ops, xhci,
+    memory_region_init(&xhci->mem, NULL, "xhci", LEN_REGS);
+    memory_region_init_io(&xhci->mem_cap, NULL, &xhci_cap_ops, xhci,
                           "capabilities", LEN_CAP);
-    memory_region_init_io(&xhci->mem_oper, &xhci_oper_ops, xhci,
+    memory_region_init_io(&xhci->mem_oper, NULL, &xhci_oper_ops, xhci,
                           "operational", 0x400);
-    memory_region_init_io(&xhci->mem_runtime, &xhci_runtime_ops, xhci,
+    memory_region_init_io(&xhci->mem_runtime, NULL, &xhci_runtime_ops, xhci,
                           "runtime", LEN_RUNTIME);
-    memory_region_init_io(&xhci->mem_doorbell, &xhci_doorbell_ops, xhci,
+    memory_region_init_io(&xhci->mem_doorbell, NULL, &xhci_doorbell_ops, xhci,
                           "doorbell", LEN_DOORBELL);
 
     memory_region_add_subregion(&xhci->mem, 0,            &xhci->mem_cap);
@@ -3361,7 +3361,7 @@ static int usb_xhci_initfn(struct PCIDevice *dev)
         XHCIPort *port = &xhci->ports[i];
         uint32_t offset = OFF_OPER + 0x400 + 0x10 * i;
         port->xhci = xhci;
-        memory_region_init_io(&port->mem, &xhci_port_ops, port,
+        memory_region_init_io(&port->mem, NULL, &xhci_port_ops, port,
                               port->name, 0x10);
         memory_region_add_subregion(&xhci->mem, offset, &port->mem);
     }
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index b070b64..c8ecc8e 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -966,7 +966,7 @@ static void virtio_pci_device_plugged(DeviceState *d)
         size = 1 << qemu_fls(size);
     }
 
-    memory_region_init_io(&proxy->bar, &virtio_pci_config_ops, proxy,
+    memory_region_init_io(&proxy->bar, NULL, &virtio_pci_config_ops, proxy,
                           "virtio-pci", size);
     pci_register_bar(&proxy->pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO,
                      &proxy->bar);
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 05af0b1..2c75014 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -417,7 +417,7 @@ static int i6300esb_init(PCIDevice *dev)
     d->timer = qemu_new_timer_ns(vm_clock, i6300esb_timer_expired, d);
     d->previous_reboot_flag = 0;
 
-    memory_region_init_io(&d->io_mem, &i6300esb_ops, d, "i6300esb", 0x10);
+    memory_region_init_io(&d->io_mem, NULL, &i6300esb_ops, d, "i6300esb", 0x10);
     pci_register_bar(&d->dev, 0, 0, &d->io_mem);
     /* qemu_register_coalesced_mmio (addr, 0x10); ? */
 
diff --git a/hw/xen/xen_apic.c b/hw/xen/xen_apic.c
index a958782..3526ffe 100644
--- a/hw/xen/xen_apic.c
+++ b/hw/xen/xen_apic.c
@@ -38,7 +38,7 @@ static const MemoryRegionOps xen_apic_io_ops = {
 
 static void xen_apic_init(APICCommonState *s)
 {
-    memory_region_init_io(&s->io_memory, &xen_apic_io_ops, s, "xen-apic-msi",
+    memory_region_init_io(&s->io_memory, NULL, &xen_apic_io_ops, s, "xen-apic-msi",
                           APIC_SPACE_SIZE);
 
 #if defined(CONFIG_XEN_CTRL_INTERFACE_VERSION) \
diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index f8f5dd5..8855309 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -275,7 +275,7 @@ static const MemoryRegionOps platform_fixed_io_ops = {
 
 static void platform_fixed_ioport_init(PCIXenPlatformState* s)
 {
-    memory_region_init_io(&s->fixed_io, &platform_fixed_io_ops, s,
+    memory_region_init_io(&s->fixed_io, NULL, &platform_fixed_io_ops, s,
                           "xen-fixed", 16);
     memory_region_add_subregion(get_system_io(), XEN_PLATFORM_IOPORT,
                                 &s->fixed_io);
@@ -319,7 +319,7 @@ static const MemoryRegionOps xen_pci_io_ops = {
 
 static void platform_ioport_bar_setup(PCIXenPlatformState *d)
 {
-    memory_region_init_io(&d->bar, &xen_pci_io_ops, d, "xen-pci", 0x100);
+    memory_region_init_io(&d->bar, NULL, &xen_pci_io_ops, d, "xen-pci", 0x100);
 }
 
 static uint64_t platform_mmio_read(void *opaque, hwaddr addr,
@@ -347,7 +347,7 @@ static const MemoryRegionOps platform_mmio_handler = {
 
 static void platform_mmio_setup(PCIXenPlatformState *d)
 {
-    memory_region_init_io(&d->mmio_bar, &platform_mmio_handler, d,
+    memory_region_init_io(&d->mmio_bar, NULL, &platform_mmio_handler, d,
                           "xen-mmio", 0x1000000);
 }
 
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index c31a28a..15b4896 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -416,7 +416,7 @@ static int xen_pt_register_regions(XenPCIPassthroughState *s)
             }
         }
 
-        memory_region_init_io(&s->bar[i], &ops, &s->dev,
+        memory_region_init_io(&s->bar[i], NULL, &ops, &s->dev,
                               "xen-pci-pt-bar", r->size);
         pci_register_bar(&s->dev, i, type, &s->bar[i]);
 
@@ -440,7 +440,7 @@ static int xen_pt_register_regions(XenPCIPassthroughState *s)
 
         s->bases[PCI_ROM_SLOT].access.maddr = d->rom.base_addr;
 
-        memory_region_init_rom_device(&s->rom, NULL, NULL,
+        memory_region_init_rom_device(&s->rom, NULL, NULL, NULL,
                                       "xen-pci-pt-rom", d->rom.size);
         pci_register_bar(&s->dev, PCI_ROM_SLOT, PCI_BASE_ADDRESS_MEM_PREFETCH,
                          &s->rom);
diff --git a/hw/xen/xen_pt_msi.c b/hw/xen/xen_pt_msi.c
index db2c842..9c7d43b 100644
--- a/hw/xen/xen_pt_msi.c
+++ b/hw/xen/xen_pt_msi.c
@@ -544,7 +544,7 @@ int xen_pt_msix_init(XenPCIPassthroughState *s, uint32_t base)
         msix->msix_entry[i].pirq = XEN_PT_UNASSIGNED_PIRQ;
     }
 
-    memory_region_init_io(&msix->mmio, &pci_msix_ops, s, "xen-pci-pt-msix",
+    memory_region_init_io(&msix->mmio, NULL, &pci_msix_ops, s, "xen-pci-pt-msix",
                           (total_entries * PCI_MSIX_ENTRY_SIZE
                            + XC_PAGE_SIZE - 1)
                           & XC_PAGE_MASK);
diff --git a/hw/xtensa/xtensa_lx60.c b/hw/xtensa/xtensa_lx60.c
index 650dd31..11c30c2 100644
--- a/hw/xtensa/xtensa_lx60.c
+++ b/hw/xtensa/xtensa_lx60.c
@@ -109,7 +109,7 @@ static Lx60FpgaState *lx60_fpga_init(MemoryRegion *address_space,
 {
     Lx60FpgaState *s = g_malloc(sizeof(Lx60FpgaState));
 
-    memory_region_init_io(&s->iomem, &lx60_fpga_ops, s,
+    memory_region_init_io(&s->iomem, NULL, &lx60_fpga_ops, s,
             "lx60.fpga", 0x10000);
     memory_region_add_subregion(address_space, base, &s->iomem);
     lx60_fpga_reset(s);
@@ -139,7 +139,7 @@ static void lx60_net_init(MemoryRegion *address_space,
             sysbus_mmio_get_region(s, 1));
 
     ram = g_malloc(sizeof(*ram));
-    memory_region_init_ram(ram, "open_eth.ram", 16384);
+    memory_region_init_ram(ram, NULL, "open_eth.ram", 16384);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(address_space, buffers, ram);
 }
@@ -195,12 +195,12 @@ static void lx_init(const LxBoardDesc *board, QEMUMachineInitArgs *args)
     }
 
     ram = g_malloc(sizeof(*ram));
-    memory_region_init_ram(ram, "lx60.dram", args->ram_size);
+    memory_region_init_ram(ram, NULL, "lx60.dram", args->ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(system_memory, 0, ram);
 
     system_io = g_malloc(sizeof(*system_io));
-    memory_region_init(system_io, "lx60.io", 224 * 1024 * 1024);
+    memory_region_init(system_io, NULL, "lx60.io", 224 * 1024 * 1024);
     memory_region_add_subregion(system_memory, 0xf0000000, system_io);
     lx60_fpga_init(system_io, 0x0d020000);
     if (nd_table[0].used) {
@@ -231,7 +231,7 @@ static void lx_init(const LxBoardDesc *board, QEMUMachineInitArgs *args)
     /* Use presence of kernel file name as 'boot from SRAM' switch. */
     if (kernel_filename) {
         rom = g_malloc(sizeof(*rom));
-        memory_region_init_ram(rom, "lx60.sram", board->sram_size);
+        memory_region_init_ram(rom, NULL, "lx60.sram", board->sram_size);
         vmstate_register_ram_global(rom);
         memory_region_add_subregion(system_memory, 0xfe000000, rom);
 
@@ -262,7 +262,7 @@ static void lx_init(const LxBoardDesc *board, QEMUMachineInitArgs *args)
             MemoryRegion *flash_mr = pflash_cfi01_get_memory(flash);
             MemoryRegion *flash_io = g_malloc(sizeof(*flash_io));
 
-            memory_region_init_alias(flash_io, "lx60.flash",
+            memory_region_init_alias(flash_io, NULL, "lx60.flash",
                     flash_mr, 0, board->flash_size);
             memory_region_add_subregion(system_memory, 0xfe000000,
                     flash_io);
diff --git a/hw/xtensa/xtensa_sim.c b/hw/xtensa/xtensa_sim.c
index 5241f8d..a88707e 100644
--- a/hw/xtensa/xtensa_sim.c
+++ b/hw/xtensa/xtensa_sim.c
@@ -75,12 +75,12 @@ static void xtensa_sim_init(QEMUMachineInitArgs *args)
     }
 
     ram = g_malloc(sizeof(*ram));
-    memory_region_init_ram(ram, "xtensa.sram", ram_size);
+    memory_region_init_ram(ram, NULL, "xtensa.sram", ram_size);
     vmstate_register_ram_global(ram);
     memory_region_add_subregion(get_system_memory(), 0, ram);
 
     rom = g_malloc(sizeof(*rom));
-    memory_region_init_ram(rom, "xtensa.rom", 0x1000);
+    memory_region_init_ram(rom, NULL, "xtensa.rom", 0x1000);
     vmstate_register_ram_global(rom);
     memory_region_add_subregion(get_system_memory(), 0xfe000000, rom);
 
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 4eec2f7..3f48f07 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -136,6 +136,7 @@ struct MemoryRegion {
     const MemoryRegionOps *ops;
     const MemoryRegionIOMMUOps *iommu_ops;
     void *opaque;
+    struct Object *owner;
     MemoryRegion *parent;
     Int128 size;
     hwaddr addr;
@@ -238,10 +239,12 @@ struct MemoryListener {
  * memory_region_add_subregion() to add subregions.
  *
  * @mr: the #MemoryRegion to be initialized
+ * @owner: the object that tracks the region's reference count
  * @name: used for debugging; not visible to the user or ABI
  * @size: size of the region; any subregions beyond this size will be clipped
  */
 void memory_region_init(MemoryRegion *mr,
+                        struct Object *owner,
                         const char *name,
                         uint64_t size);
 /**
@@ -251,6 +254,7 @@ void memory_region_init(MemoryRegion *mr,
  * if @size is nonzero, subregions will be clipped to @size.
  *
  * @mr: the #MemoryRegion to be initialized.
+ * @owner: the object that tracks the region's reference count
  * @ops: a structure containing read and write callbacks to be used when
  *       I/O is performed on the region.
  * @opaque: passed to to the read and write callbacks of the @ops structure.
@@ -258,6 +262,7 @@ void memory_region_init(MemoryRegion *mr,
  * @size: size of the region.
  */
 void memory_region_init_io(MemoryRegion *mr,
+                           struct Object *owner,
                            const MemoryRegionOps *ops,
                            void *opaque,
                            const char *name,
@@ -268,10 +273,12 @@ void memory_region_init_io(MemoryRegion *mr,
  *                          region will modify memory directly.
  *
  * @mr: the #MemoryRegion to be initialized.
+ * @owner: the object that tracks the region's reference count
  * @name: the name of the region.
  * @size: size of the region.
  */
 void memory_region_init_ram(MemoryRegion *mr,
+                            struct Object *owner,
                             const char *name,
                             uint64_t size);
 
@@ -281,11 +288,13 @@ void memory_region_init_ram(MemoryRegion *mr,
  *                              region will modify memory directly.
  *
  * @mr: the #MemoryRegion to be initialized.
+ * @owner: the object that tracks the region's reference count
  * @name: the name of the region.
  * @size: size of the region.
  * @ptr: memory to be mapped; must contain at least @size bytes.
  */
 void memory_region_init_ram_ptr(MemoryRegion *mr,
+                                struct Object *owner,
                                 const char *name,
                                 uint64_t size,
                                 void *ptr);
@@ -295,6 +304,7 @@ void memory_region_init_ram_ptr(MemoryRegion *mr,
  *                           part of another memory region.
  *
  * @mr: the #MemoryRegion to be initialized.
+ * @owner: the object that tracks the region's reference count
  * @name: used for debugging; not visible to the user or ABI
  * @orig: the region to be referenced; @mr will be equivalent to
  *        @orig between @offset and @offset + @size - 1.
@@ -302,6 +312,7 @@ void memory_region_init_ram_ptr(MemoryRegion *mr,
  * @size: size of the region.
  */
 void memory_region_init_alias(MemoryRegion *mr,
+                              struct Object *owner,
                               const char *name,
                               MemoryRegion *orig,
                               hwaddr offset,
@@ -312,11 +323,13 @@ void memory_region_init_alias(MemoryRegion *mr,
  *                                 handled via callbacks.
  *
  * @mr: the #MemoryRegion to be initialized.
+ * @owner: the object that tracks the region's reference count
  * @ops: callbacks for write access handling.
  * @name: the name of the region.
  * @size: size of the region.
  */
 void memory_region_init_rom_device(MemoryRegion *mr,
+                                   struct Object *owner,
                                    const MemoryRegionOps *ops,
                                    void *opaque,
                                    const char *name,
@@ -331,10 +344,12 @@ void memory_region_init_rom_device(MemoryRegion *mr,
  * the memory API will cause an abort().
  *
  * @mr: the #MemoryRegion to be initialized
+ * @owner: the object that tracks the region's reference count
  * @name: used for debugging; not visible to the user or ABI
  * @size: size of the region.
  */
 void memory_region_init_reservation(MemoryRegion *mr,
+                                    struct Object *owner,
                                     const char *name,
                                     uint64_t size);
 
@@ -346,11 +361,13 @@ void memory_region_init_reservation(MemoryRegion *mr,
  * memory region.
  *
  * @mr: the #MemoryRegion to be initialized
+ * @owner: the object that tracks the region's reference count
  * @ops: a function that translates addresses into the @target region
  * @name: used for debugging; not visible to the user or ABI
  * @size: size of the region.
  */
 void memory_region_init_iommu(MemoryRegion *mr,
+                              struct Object *owner,
                               const MemoryRegionIOMMUOps *ops,
                               const char *name,
                               uint64_t size);
diff --git a/ioport.c b/ioport.c
index ef6fb96..3a6a73d 100644
--- a/ioport.c
+++ b/ioport.c
@@ -211,7 +211,7 @@ static void portio_list_add_1(PortioList *piolist,
      * Use an alias so that the callback is called with an absolute address,
      * rather than an offset relative to to start + off_low.
      */
-    memory_region_init_io(&mrpio->mr, &portio_ops, mrpio, piolist->name,
+    memory_region_init_io(&mrpio->mr, NULL, &portio_ops, mrpio, piolist->name,
                           off_high - off_low);
     memory_region_add_subregion(piolist->address_space,
                                 start + off_low, &mrpio->mr);
diff --git a/memory.c b/memory.c
index 1431356..56ef4ba 100644
--- a/memory.c
+++ b/memory.c
@@ -17,6 +17,7 @@
 #include "exec/address-spaces.h"
 #include "exec/ioport.h"
 #include "qemu/bitops.h"
+#include "qom/object.h"
 #include "sysemu/kvm.h"
 #include <assert.h>
 
@@ -728,11 +729,13 @@ static bool memory_region_wrong_endianness(MemoryRegion *mr)
 }
 
 void memory_region_init(MemoryRegion *mr,
+                        Object *owner,
                         const char *name,
                         uint64_t size)
 {
     mr->ops = &unassigned_mem_ops;
     mr->opaque = NULL;
+    mr->owner = owner;
     mr->iommu_ops = NULL;
     mr->parent = NULL;
     mr->size = int128_make64(size);
@@ -914,12 +917,13 @@ static bool memory_region_dispatch_write(MemoryRegion *mr,
 }
 
 void memory_region_init_io(MemoryRegion *mr,
+                           Object *owner,
                            const MemoryRegionOps *ops,
                            void *opaque,
                            const char *name,
                            uint64_t size)
 {
-    memory_region_init(mr, name, size);
+    memory_region_init(mr, owner, name, size);
     mr->ops = ops;
     mr->opaque = opaque;
     mr->terminates = true;
@@ -927,10 +931,11 @@ void memory_region_init_io(MemoryRegion *mr,
 }
 
 void memory_region_init_ram(MemoryRegion *mr,
+                            Object *owner,
                             const char *name,
                             uint64_t size)
 {
-    memory_region_init(mr, name, size);
+    memory_region_init(mr, owner, name, size);
     mr->ram = true;
     mr->terminates = true;
     mr->destructor = memory_region_destructor_ram;
@@ -938,11 +943,12 @@ void memory_region_init_ram(MemoryRegion *mr,
 }
 
 void memory_region_init_ram_ptr(MemoryRegion *mr,
+                                Object *owner,
                                 const char *name,
                                 uint64_t size,
                                 void *ptr)
 {
-    memory_region_init(mr, name, size);
+    memory_region_init(mr, owner, name, size);
     mr->ram = true;
     mr->terminates = true;
     mr->destructor = memory_region_destructor_ram_from_ptr;
@@ -950,23 +956,25 @@ void memory_region_init_ram_ptr(MemoryRegion *mr,
 }
 
 void memory_region_init_alias(MemoryRegion *mr,
+                              Object *owner,
                               const char *name,
                               MemoryRegion *orig,
                               hwaddr offset,
                               uint64_t size)
 {
-    memory_region_init(mr, name, size);
+    memory_region_init(mr, owner, name, size);
     mr->alias = orig;
     mr->alias_offset = offset;
 }
 
 void memory_region_init_rom_device(MemoryRegion *mr,
+                                   Object *owner,
                                    const MemoryRegionOps *ops,
                                    void *opaque,
                                    const char *name,
                                    uint64_t size)
 {
-    memory_region_init(mr, name, size);
+    memory_region_init(mr, owner, name, size);
     mr->ops = ops;
     mr->opaque = opaque;
     mr->terminates = true;
@@ -976,21 +984,23 @@ void memory_region_init_rom_device(MemoryRegion *mr,
 }
 
 void memory_region_init_iommu(MemoryRegion *mr,
+                              Object *owner,
                               const MemoryRegionIOMMUOps *ops,
                               const char *name,
                               uint64_t size)
 {
-    memory_region_init(mr, name, size);
+    memory_region_init(mr, owner, name, size);
     mr->iommu_ops = ops,
     mr->terminates = true;  /* then re-forwards */
     notifier_list_init(&mr->iommu_notify);
 }
 
 void memory_region_init_reservation(MemoryRegion *mr,
+                                    Object *owner,
                                     const char *name,
                                     uint64_t size)
 {
-    memory_region_init_io(mr, &unassigned_mem_ops, mr, name, size);
+    memory_region_init_io(mr, owner, &unassigned_mem_ops, mr, name, size);
 }
 
 void memory_region_destroy(MemoryRegion *mr)
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index c89dd58..e95ad4a 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1560,7 +1560,7 @@ off_t kvmppc_alloc_rma(const char *name, MemoryRegion *sysmem)
     };
 
     rma_region = g_new(MemoryRegion, 1);
-    memory_region_init_ram_ptr(rma_region, name, size, rma);
+    memory_region_init_ram_ptr(rma_region, NULL, name, size, rma);
     vmstate_register_ram_global(rma_region);
     memory_region_add_subregion(sysmem, 0, rma_region);
 
diff --git a/xen-all.c b/xen-all.c
index dcb57a0..1f040c0 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -167,7 +167,7 @@ static void xen_ram_init(ram_addr_t ram_size)
          */
         block_len += HVM_BELOW_4G_MMIO_LENGTH;
     }
-    memory_region_init_ram(&ram_memory, "xen.ram", block_len);
+    memory_region_init_ram(&ram_memory, NULL, "xen.ram", block_len);
     vmstate_register_ram_global(&ram_memory);
 
     if (ram_size >= HVM_BELOW_4G_RAM_END) {
@@ -177,7 +177,7 @@ static void xen_ram_init(ram_addr_t ram_size)
         below_4g_mem_size = ram_size;
     }
 
-    memory_region_init_alias(&ram_640k, "xen.ram.640k",
+    memory_region_init_alias(&ram_640k, NULL, "xen.ram.640k",
                              &ram_memory, 0, 0xa0000);
     memory_region_add_subregion(sysmem, 0, &ram_640k);
     /* Skip of the VGA IO memory space, it will be registered later by the VGA
@@ -186,11 +186,11 @@ static void xen_ram_init(ram_addr_t ram_size)
      * The area between 0xc0000 and 0x100000 will be used by SeaBIOS to load
      * the Options ROM, so it is registered here as RAM.
      */
-    memory_region_init_alias(&ram_lo, "xen.ram.lo",
+    memory_region_init_alias(&ram_lo, NULL, "xen.ram.lo",
                              &ram_memory, 0xc0000, below_4g_mem_size - 0xc0000);
     memory_region_add_subregion(sysmem, 0xc0000, &ram_lo);
     if (above_4g_mem_size > 0) {
-        memory_region_init_alias(&ram_hi, "xen.ram.hi",
+        memory_region_init_alias(&ram_hi, NULL, "xen.ram.hi",
                                  &ram_memory, 0x100000000ULL,
                                  above_4g_mem_size);
         memory_region_add_subregion(sysmem, 0x100000000ULL, &ram_hi);
commit 5767e4e19835cd39de9945bba17438e368e253bb
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:07:07 2013 +0200

    ioport: Move portio types to ioport.h
    
    This decouples memory.h from ioport.h, concentrating all portio related
    types in a single header.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index ba3ebb8..6fb237d 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -25,6 +25,7 @@
 #define IOPORT_H
 
 #include "qemu-common.h"
+#include "exec/memory.h"
 
 typedef uint32_t pio_addr_t;
 #define FMT_pioaddr     PRIx32
@@ -32,9 +33,16 @@ typedef uint32_t pio_addr_t;
 #define MAX_IOPORTS     (64 * 1024)
 #define IOPORTS_MASK    (MAX_IOPORTS - 1)
 
-/* These should really be in isa.h, but are here to make pc.h happy.  */
-typedef void (IOPortWriteFunc)(void *opaque, uint32_t address, uint32_t data);
-typedef uint32_t (IOPortReadFunc)(void *opaque, uint32_t address);
+typedef struct MemoryRegionPortio {
+    uint32_t offset;
+    uint32_t len;
+    unsigned size;
+    uint32_t (*read)(void *opaque, uint32_t address);
+    void (*write)(void *opaque, uint32_t address, uint32_t data);
+    uint32_t base; /* private field */
+} MemoryRegionPortio;
+
+#define PORTIO_END_OF_LIST() { }
 
 void cpu_outb(pio_addr_t addr, uint8_t val);
 void cpu_outw(pio_addr_t addr, uint16_t val);
@@ -43,9 +51,6 @@ uint8_t cpu_inb(pio_addr_t addr);
 uint16_t cpu_inw(pio_addr_t addr);
 uint32_t cpu_inl(pio_addr_t addr);
 
-struct MemoryRegion;
-struct MemoryRegionPortio;
-
 typedef struct PortioList {
     const struct MemoryRegionPortio *ports;
     struct MemoryRegion *address_space;
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 2d7f49c..4eec2f7 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -24,7 +24,6 @@
 #include "exec/hwaddr.h"
 #endif
 #include "qemu/queue.h"
-#include "exec/ioport.h"
 #include "qemu/int128.h"
 #include "qemu/notify.h"
 
@@ -32,7 +31,6 @@
 #define MAX_PHYS_ADDR            (((hwaddr)1 << MAX_PHYS_ADDR_SPACE_BITS) - 1)
 
 typedef struct MemoryRegionOps MemoryRegionOps;
-typedef struct MemoryRegionPortio MemoryRegionPortio;
 typedef struct MemoryRegionMmio MemoryRegionMmio;
 
 /* Must match *_DIRTY_FLAGS in cpu-all.h.  To be replaced with dynamic
@@ -166,17 +164,6 @@ struct MemoryRegion {
     NotifierList iommu_notify;
 };
 
-struct MemoryRegionPortio {
-    uint32_t offset;
-    uint32_t len;
-    unsigned size;
-    IOPortReadFunc *read;
-    IOPortWriteFunc *write;
-    uint32_t base; /* private field */
-};
-
-#define PORTIO_END_OF_LIST() { }
-
 /**
  * AddressSpace: describes a mapping of addresses to #MemoryRegion objects
  */
commit d67f679d99778d9e07ec470ebf803249c2bea625
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:07:06 2013 +0200

    vmport: Disentangle read handler type from portio
    
    In case the latter may vanish one day, make sure the vmport read handler
    type will remain unaffected. This is also conceptually cleaner.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/misc/vmport.c b/hw/misc/vmport.c
index 8363dfd..8639072 100644
--- a/hw/misc/vmport.c
+++ b/hw/misc/vmport.c
@@ -43,13 +43,13 @@ typedef struct VMPortState
     ISADevice parent_obj;
 
     MemoryRegion io;
-    IOPortReadFunc *func[VMPORT_ENTRIES];
+    VMPortReadFunc *func[VMPORT_ENTRIES];
     void *opaque[VMPORT_ENTRIES];
 } VMPortState;
 
 static VMPortState *port_state;
 
-void vmport_register(unsigned char command, IOPortReadFunc *func, void *opaque)
+void vmport_register(unsigned char command, VMPortReadFunc *func, void *opaque)
 {
     if (command >= VMPORT_ENTRIES)
         return;
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index a417402..a350d8f 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -3,7 +3,6 @@
 
 #include "qemu-common.h"
 #include "exec/memory.h"
-#include "exec/ioport.h"
 #include "hw/isa/isa.h"
 #include "hw/block/fdc.h"
 #include "net/net.h"
@@ -56,11 +55,14 @@ typedef struct GSIState {
 void gsi_handler(void *opaque, int n, int level);
 
 /* vmport.c */
+typedef uint32_t (VMPortReadFunc)(void *opaque, uint32_t address);
+
 static inline void vmport_init(ISABus *bus)
 {
     isa_create_simple(bus, "vmport");
 }
-void vmport_register(unsigned char command, IOPortReadFunc *func, void *opaque);
+
+void vmport_register(unsigned char command, VMPortReadFunc *func, void *opaque);
 void vmmouse_get_data(uint32_t *data);
 void vmmouse_set_data(const uint32_t *data);
 
commit 0659097de2b47470b4d706c2634240f54700c807
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:07:05 2013 +0200

    ioport: Remove unused old dispatching services
    
    Remove unused ioport_register and isa_unassign_ioport along with
    everything that only those services used.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index b476857..ba3ebb8 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -25,7 +25,6 @@
 #define IOPORT_H
 
 #include "qemu-common.h"
-#include "exec/iorange.h"
 
 typedef uint32_t pio_addr_t;
 #define FMT_pioaddr     PRIx32
@@ -36,10 +35,6 @@ typedef uint32_t pio_addr_t;
 /* These should really be in isa.h, but are here to make pc.h happy.  */
 typedef void (IOPortWriteFunc)(void *opaque, uint32_t address, uint32_t data);
 typedef uint32_t (IOPortReadFunc)(void *opaque, uint32_t address);
-typedef void (IOPortDestructor)(void *opaque);
-
-void ioport_register(IORange *iorange);
-void isa_unassign_ioport(pio_addr_t start, int length);
 
 void cpu_outb(pio_addr_t addr, uint8_t val);
 void cpu_outw(pio_addr_t addr, uint16_t val);
diff --git a/include/exec/iorange.h b/include/exec/iorange.h
deleted file mode 100644
index cd980a8..0000000
--- a/include/exec/iorange.h
+++ /dev/null
@@ -1,31 +0,0 @@
-#ifndef IORANGE_H
-#define IORANGE_H
-
-#include <stdint.h>
-
-typedef struct IORange IORange;
-typedef struct IORangeOps IORangeOps;
-
-struct IORangeOps {
-    void (*read)(IORange *iorange, uint64_t offset, unsigned width,
-                 uint64_t *data);
-    void (*write)(IORange *iorange, uint64_t offset, unsigned width,
-                  uint64_t data);
-    void (*destructor)(IORange *iorange);
-};
-
-struct IORange {
-    const IORangeOps *ops;
-    uint64_t base;
-    uint64_t len;
-};
-
-static inline void iorange_init(IORange *iorange, const IORangeOps *ops,
-                                uint64_t base, uint64_t len)
-{
-    iorange->ops = ops;
-    iorange->base = base;
-    iorange->len = len;
-}
-
-#endif
diff --git a/include/exec/memory.h b/include/exec/memory.h
index cfdda3c..2d7f49c 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -24,7 +24,6 @@
 #include "exec/hwaddr.h"
 #endif
 #include "qemu/queue.h"
-#include "exec/iorange.h"
 #include "exec/ioport.h"
 #include "qemu/int128.h"
 #include "qemu/notify.h"
@@ -48,14 +47,6 @@ struct MemoryRegionMmio {
     CPUWriteMemoryFunc *write[3];
 };
 
-/* Internal use; thunks between old-style IORange and MemoryRegions. */
-typedef struct MemoryRegionIORange MemoryRegionIORange;
-struct MemoryRegionIORange {
-    IORange iorange;
-    MemoryRegion *mr;
-    hwaddr offset;
-};
-
 typedef struct IOMMUTLBEntry IOMMUTLBEntry;
 
 /* See address_space_translate: bit 0 is read, bit 1 is write.  */
diff --git a/ioport.c b/ioport.c
index 347da2c..ef6fb96 100644
--- a/ioport.c
+++ b/ioport.c
@@ -30,18 +30,8 @@
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
 
-/***********************************************************/
-/* IO Port */
-
-//#define DEBUG_UNUSED_IOPORT
 //#define DEBUG_IOPORT
 
-#ifdef DEBUG_UNUSED_IOPORT
-#  define LOG_UNUSED_IOPORT(fmt, ...) fprintf(stderr, fmt, ## __VA_ARGS__)
-#else
-#  define LOG_UNUSED_IOPORT(fmt, ...) do{ } while (0)
-#endif
-
 #ifdef DEBUG_IOPORT
 #  define LOG_IOPORT(...) qemu_log_mask(CPU_LOG_IOPORT, ## __VA_ARGS__)
 #else
@@ -54,234 +44,6 @@ typedef struct MemoryRegionPortioList {
     MemoryRegionPortio ports[];
 } MemoryRegionPortioList;
 
-/* XXX: use a two level table to limit memory usage */
-
-static void *ioport_opaque[MAX_IOPORTS];
-static IOPortReadFunc *ioport_read_table[3][MAX_IOPORTS];
-static IOPortWriteFunc *ioport_write_table[3][MAX_IOPORTS];
-static IOPortDestructor *ioport_destructor_table[MAX_IOPORTS];
-
-static IOPortReadFunc default_ioport_readb, default_ioport_readw, default_ioport_readl;
-static IOPortWriteFunc default_ioport_writeb, default_ioport_writew, default_ioport_writel;
-
-static uint32_t ioport_read(int index, uint32_t address)
-{
-    static IOPortReadFunc * const default_func[3] = {
-        default_ioport_readb,
-        default_ioport_readw,
-        default_ioport_readl
-    };
-    IOPortReadFunc *func = ioport_read_table[index][address];
-    if (!func)
-        func = default_func[index];
-    return func(ioport_opaque[address], address);
-}
-
-static void ioport_write(int index, uint32_t address, uint32_t data)
-{
-    static IOPortWriteFunc * const default_func[3] = {
-        default_ioport_writeb,
-        default_ioport_writew,
-        default_ioport_writel
-    };
-    IOPortWriteFunc *func = ioport_write_table[index][address];
-    if (!func)
-        func = default_func[index];
-    func(ioport_opaque[address], address, data);
-}
-
-static uint32_t default_ioport_readb(void *opaque, uint32_t address)
-{
-    LOG_UNUSED_IOPORT("unused inb: port=0x%04"PRIx32"\n", address);
-    return 0xff;
-}
-
-static void default_ioport_writeb(void *opaque, uint32_t address, uint32_t data)
-{
-    LOG_UNUSED_IOPORT("unused outb: port=0x%04"PRIx32" data=0x%02"PRIx32"\n",
-                      address, data);
-}
-
-/* default is to make two byte accesses */
-static uint32_t default_ioport_readw(void *opaque, uint32_t address)
-{
-    uint32_t data;
-    data = ioport_read(0, address);
-    address = (address + 1) & IOPORTS_MASK;
-    data |= ioport_read(0, address) << 8;
-    return data;
-}
-
-static void default_ioport_writew(void *opaque, uint32_t address, uint32_t data)
-{
-    ioport_write(0, address, data & 0xff);
-    address = (address + 1) & IOPORTS_MASK;
-    ioport_write(0, address, (data >> 8) & 0xff);
-}
-
-static uint32_t default_ioport_readl(void *opaque, uint32_t address)
-{
-    LOG_UNUSED_IOPORT("unused inl: port=0x%04"PRIx32"\n", address);
-    return 0xffffffff;
-}
-
-static void default_ioport_writel(void *opaque, uint32_t address, uint32_t data)
-{
-    LOG_UNUSED_IOPORT("unused outl: port=0x%04"PRIx32" data=0x%02"PRIx32"\n",
-                      address, data);
-}
-
-static int ioport_bsize(int size, int *bsize)
-{
-    if (size == 1) {
-        *bsize = 0;
-    } else if (size == 2) {
-        *bsize = 1;
-    } else if (size == 4) {
-        *bsize = 2;
-    } else {
-        return -1;
-    }
-    return 0;
-}
-
-/* size is the word size in byte */
-static int register_ioport_read(pio_addr_t start, int length, int size,
-                                IOPortReadFunc *func, void *opaque)
-{
-    int i, bsize;
-
-    if (ioport_bsize(size, &bsize)) {
-        hw_error("register_ioport_read: invalid size");
-        return -1;
-    }
-    for(i = start; i < start + length; ++i) {
-        ioport_read_table[bsize][i] = func;
-        if (ioport_opaque[i] != NULL && ioport_opaque[i] != opaque)
-            hw_error("register_ioport_read: invalid opaque for address 0x%x",
-                     i);
-        ioport_opaque[i] = opaque;
-    }
-    return 0;
-}
-
-/* size is the word size in byte */
-static int register_ioport_write(pio_addr_t start, int length, int size,
-                                 IOPortWriteFunc *func, void *opaque)
-{
-    int i, bsize;
-
-    if (ioport_bsize(size, &bsize)) {
-        hw_error("register_ioport_write: invalid size");
-        return -1;
-    }
-    for(i = start; i < start + length; ++i) {
-        ioport_write_table[bsize][i] = func;
-        if (ioport_opaque[i] != NULL && ioport_opaque[i] != opaque)
-            hw_error("register_ioport_write: invalid opaque for address 0x%x",
-                     i);
-        ioport_opaque[i] = opaque;
-    }
-    return 0;
-}
-
-static uint32_t ioport_readb_thunk(void *opaque, uint32_t addr)
-{
-    IORange *ioport = opaque;
-    uint64_t data;
-
-    ioport->ops->read(ioport, addr - ioport->base, 1, &data);
-    return data;
-}
-
-static uint32_t ioport_readw_thunk(void *opaque, uint32_t addr)
-{
-    IORange *ioport = opaque;
-    uint64_t data;
-
-    ioport->ops->read(ioport, addr - ioport->base, 2, &data);
-    return data;
-}
-
-static uint32_t ioport_readl_thunk(void *opaque, uint32_t addr)
-{
-    IORange *ioport = opaque;
-    uint64_t data;
-
-    ioport->ops->read(ioport, addr - ioport->base, 4, &data);
-    return data;
-}
-
-static void ioport_writeb_thunk(void *opaque, uint32_t addr, uint32_t data)
-{
-    IORange *ioport = opaque;
-
-    ioport->ops->write(ioport, addr - ioport->base, 1, data);
-}
-
-static void ioport_writew_thunk(void *opaque, uint32_t addr, uint32_t data)
-{
-    IORange *ioport = opaque;
-
-    ioport->ops->write(ioport, addr - ioport->base, 2, data);
-}
-
-static void ioport_writel_thunk(void *opaque, uint32_t addr, uint32_t data)
-{
-    IORange *ioport = opaque;
-
-    ioport->ops->write(ioport, addr - ioport->base, 4, data);
-}
-
-static void iorange_destructor_thunk(void *opaque)
-{
-    IORange *iorange = opaque;
-
-    if (iorange->ops->destructor) {
-        iorange->ops->destructor(iorange);
-    }
-}
-
-void ioport_register(IORange *ioport)
-{
-    register_ioport_read(ioport->base, ioport->len, 1,
-                         ioport_readb_thunk, ioport);
-    register_ioport_read(ioport->base, ioport->len, 2,
-                         ioport_readw_thunk, ioport);
-    register_ioport_read(ioport->base, ioport->len, 4,
-                         ioport_readl_thunk, ioport);
-    register_ioport_write(ioport->base, ioport->len, 1,
-                          ioport_writeb_thunk, ioport);
-    register_ioport_write(ioport->base, ioport->len, 2,
-                          ioport_writew_thunk, ioport);
-    register_ioport_write(ioport->base, ioport->len, 4,
-                          ioport_writel_thunk, ioport);
-    ioport_destructor_table[ioport->base] = iorange_destructor_thunk;
-}
-
-void isa_unassign_ioport(pio_addr_t start, int length)
-{
-    int i;
-
-    if (ioport_destructor_table[start]) {
-        ioport_destructor_table[start](ioport_opaque[start]);
-        ioport_destructor_table[start] = NULL;
-    }
-    for(i = start; i < start + length; i++) {
-        ioport_read_table[0][i] = NULL;
-        ioport_read_table[1][i] = NULL;
-        ioport_read_table[2][i] = NULL;
-
-        ioport_write_table[0][i] = NULL;
-        ioport_write_table[1][i] = NULL;
-        ioport_write_table[2][i] = NULL;
-
-        ioport_opaque[i] = NULL;
-    }
-}
-
-/***********************************************************/
-
 void cpu_outb(pio_addr_t addr, uint8_t val)
 {
     LOG_IOPORT("outb: %04"FMT_pioaddr" %02"PRIx8"\n", addr, val);
commit b40acf99bef69fa8ab0f9092ff162fde945eec12
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Mon Jun 24 10:45:09 2013 +0200

    ioport: Switch dispatching to memory core layer
    
    The current ioport dispatcher is a complex beast, mostly due to the
    need to deal with old portio interface users. But we can overcome it
    without converting all portio users by embedding the required base
    address of a MemoryRegionPortio access into that data structure. That
    removes the need to have the additional MemoryRegionIORange structure
    in the loop on every access.
    
    To handle old portio memory ops, we simply install dispatching handlers
    for portio memory regions when registering them with the memory core.
    This removes the need for the old_portio field.
    
    We can drop the additional aliasing of ioport regions and also the
    special address space listener. cpu_in and cpu_out now simply call
    address_space_read/write. And we can concentrate portio handling in a
    single source file.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index c49806c..5a55d2a 100644
--- a/exec.c
+++ b/exec.c
@@ -1752,26 +1752,6 @@ static void core_log_global_stop(MemoryListener *listener)
     cpu_physical_memory_set_dirty_tracking(0);
 }
 
-static void io_region_add(MemoryListener *listener,
-                          MemoryRegionSection *section)
-{
-    MemoryRegionIORange *mrio = g_new(MemoryRegionIORange, 1);
-
-    mrio->mr = section->mr;
-    mrio->offset = section->offset_within_region;
-    iorange_init(&mrio->iorange, &memory_region_iorange_ops,
-                 section->offset_within_address_space,
-                 int128_get64(section->size));
-    ioport_register(&mrio->iorange);
-}
-
-static void io_region_del(MemoryListener *listener,
-                          MemoryRegionSection *section)
-{
-    isa_unassign_ioport(section->offset_within_address_space,
-                        int128_get64(section->size));
-}
-
 static MemoryListener core_memory_listener = {
     .begin = core_begin,
     .log_global_start = core_log_global_start,
@@ -1779,12 +1759,6 @@ static MemoryListener core_memory_listener = {
     .priority = 1,
 };
 
-static MemoryListener io_memory_listener = {
-    .region_add = io_region_add,
-    .region_del = io_region_del,
-    .priority = 0,
-};
-
 static MemoryListener tcg_memory_listener = {
     .commit = tcg_commit,
 };
@@ -1826,7 +1800,6 @@ static void memory_map_init(void)
     address_space_init(&address_space_io, system_io, "I/O");
 
     memory_listener_register(&core_memory_listener, &address_space_memory);
-    memory_listener_register(&io_memory_listener, &address_space_io);
     memory_listener_register(&tcg_memory_listener, &address_space_memory);
 }
 
diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index eb99ffe..b476857 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -56,7 +56,6 @@ typedef struct PortioList {
     struct MemoryRegion *address_space;
     unsigned nr;
     struct MemoryRegion **regions;
-    struct MemoryRegion **aliases;
     void *opaque;
     const char *name;
 } PortioList;
diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
index 26689fe..d0e0633 100644
--- a/include/exec/memory-internal.h
+++ b/include/exec/memory-internal.h
@@ -119,8 +119,6 @@ static inline void cpu_physical_memory_mask_dirty_range(ram_addr_t start,
 void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
                                      int dirty_flags);
 
-extern const IORangeOps memory_region_iorange_ops;
-
 #endif
 
 #endif
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 2ddc3c5..cfdda3c 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -126,10 +126,6 @@ struct MemoryRegionOps {
          bool unaligned;
     } impl;
 
-    /* If .read and .write are not present, old_portio may be used for
-     * backwards compatibility with old portio registration
-     */
-    const MemoryRegionPortio *old_portio;
     /* If .read and .write are not present, old_mmio may be used for
      * backwards compatibility with old mmio registration
      */
@@ -185,6 +181,7 @@ struct MemoryRegionPortio {
     unsigned size;
     IOPortReadFunc *read;
     IOPortWriteFunc *write;
+    uint32_t base; /* private field */
 };
 
 #define PORTIO_END_OF_LIST() { }
diff --git a/ioport.c b/ioport.c
index 56470c5..347da2c 100644
--- a/ioport.c
+++ b/ioport.c
@@ -28,6 +28,7 @@
 #include "exec/ioport.h"
 #include "trace.h"
 #include "exec/memory.h"
+#include "exec/address-spaces.h"
 
 /***********************************************************/
 /* IO Port */
@@ -47,6 +48,12 @@
 #  define LOG_IOPORT(...) do { } while (0)
 #endif
 
+typedef struct MemoryRegionPortioList {
+    MemoryRegion mr;
+    void *portio_opaque;
+    MemoryRegionPortio ports[];
+} MemoryRegionPortioList;
+
 /* XXX: use a two level table to limit memory usage */
 
 static void *ioport_opaque[MAX_IOPORTS];
@@ -279,27 +286,34 @@ void cpu_outb(pio_addr_t addr, uint8_t val)
 {
     LOG_IOPORT("outb: %04"FMT_pioaddr" %02"PRIx8"\n", addr, val);
     trace_cpu_out(addr, val);
-    ioport_write(0, addr, val);
+    address_space_write(&address_space_io, addr, &val, 1);
 }
 
 void cpu_outw(pio_addr_t addr, uint16_t val)
 {
+    uint8_t buf[2];
+
     LOG_IOPORT("outw: %04"FMT_pioaddr" %04"PRIx16"\n", addr, val);
     trace_cpu_out(addr, val);
-    ioport_write(1, addr, val);
+    stw_p(buf, val);
+    address_space_write(&address_space_io, addr, buf, 2);
 }
 
 void cpu_outl(pio_addr_t addr, uint32_t val)
 {
+    uint8_t buf[4];
+
     LOG_IOPORT("outl: %04"FMT_pioaddr" %08"PRIx32"\n", addr, val);
     trace_cpu_out(addr, val);
-    ioport_write(2, addr, val);
+    stl_p(buf, val);
+    address_space_write(&address_space_io, addr, buf, 4);
 }
 
 uint8_t cpu_inb(pio_addr_t addr)
 {
     uint8_t val;
-    val = ioport_read(0, addr);
+
+    address_space_read(&address_space_io, addr, &val, 1);
     trace_cpu_in(addr, val);
     LOG_IOPORT("inb : %04"FMT_pioaddr" %02"PRIx8"\n", addr, val);
     return val;
@@ -307,8 +321,11 @@ uint8_t cpu_inb(pio_addr_t addr)
 
 uint16_t cpu_inw(pio_addr_t addr)
 {
+    uint8_t buf[2];
     uint16_t val;
-    val = ioport_read(1, addr);
+
+    address_space_read(&address_space_io, addr, buf, 2);
+    val = lduw_p(buf);
     trace_cpu_in(addr, val);
     LOG_IOPORT("inw : %04"FMT_pioaddr" %04"PRIx16"\n", addr, val);
     return val;
@@ -316,8 +333,11 @@ uint16_t cpu_inw(pio_addr_t addr)
 
 uint32_t cpu_inl(pio_addr_t addr)
 {
+    uint8_t buf[4];
     uint32_t val;
-    val = ioport_read(2, addr);
+
+    address_space_read(&address_space_io, addr, buf, 4);
+    val = ldl_p(buf);
     trace_cpu_in(addr, val);
     LOG_IOPORT("inl : %04"FMT_pioaddr" %08"PRIx32"\n", addr, val);
     return val;
@@ -336,7 +356,6 @@ void portio_list_init(PortioList *piolist,
     piolist->ports = callbacks;
     piolist->nr = 0;
     piolist->regions = g_new0(MemoryRegion *, n);
-    piolist->aliases = g_new0(MemoryRegion *, n);
     piolist->address_space = NULL;
     piolist->opaque = opaque;
     piolist->name = name;
@@ -345,46 +364,96 @@ void portio_list_init(PortioList *piolist,
 void portio_list_destroy(PortioList *piolist)
 {
     g_free(piolist->regions);
-    g_free(piolist->aliases);
 }
 
+static const MemoryRegionPortio *find_portio(MemoryRegionPortioList *mrpio,
+                                             uint64_t offset, unsigned size,
+                                             bool write)
+{
+    const MemoryRegionPortio *mrp;
+
+    for (mrp = mrpio->ports; mrp->size; ++mrp) {
+        if (offset >= mrp->offset && offset < mrp->offset + mrp->len &&
+            size == mrp->size &&
+            (write ? (bool)mrp->write : (bool)mrp->read)) {
+            return mrp;
+        }
+    }
+    return NULL;
+}
+
+static uint64_t portio_read(void *opaque, hwaddr addr, unsigned size)
+{
+    MemoryRegionPortioList *mrpio = opaque;
+    const MemoryRegionPortio *mrp = find_portio(mrpio, addr, size, false);
+    uint64_t data;
+
+    data = ((uint64_t)1 << (size * 8)) - 1;
+    if (mrp) {
+        data = mrp->read(mrpio->portio_opaque, mrp->base + addr);
+    } else if (size == 2) {
+        mrp = find_portio(mrpio, addr, 1, false);
+        assert(mrp);
+        data = mrp->read(mrpio->portio_opaque, mrp->base + addr) |
+                (mrp->read(mrpio->portio_opaque, mrp->base + addr + 1) << 8);
+    }
+    return data;
+}
+
+static void portio_write(void *opaque, hwaddr addr, uint64_t data,
+                         unsigned size)
+{
+    MemoryRegionPortioList *mrpio = opaque;
+    const MemoryRegionPortio *mrp = find_portio(mrpio, addr, size, true);
+
+    if (mrp) {
+        mrp->write(mrpio->portio_opaque, mrp->base + addr, data);
+    } else if (size == 2) {
+        mrp = find_portio(mrpio, addr, 1, true);
+        assert(mrp);
+        mrp->write(mrpio->portio_opaque, mrp->base + addr, data & 0xff);
+        mrp->write(mrpio->portio_opaque, mrp->base + addr + 1, data >> 8);
+    }
+}
+
+static const MemoryRegionOps portio_ops = {
+    .read = portio_read,
+    .write = portio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.unaligned = true,
+    .impl.unaligned = true,
+};
+
 static void portio_list_add_1(PortioList *piolist,
                               const MemoryRegionPortio *pio_init,
                               unsigned count, unsigned start,
                               unsigned off_low, unsigned off_high)
 {
-    MemoryRegionPortio *pio;
-    MemoryRegionOps *ops;
-    MemoryRegion *region, *alias;
+    MemoryRegionPortioList *mrpio;
     unsigned i;
 
     /* Copy the sub-list and null-terminate it.  */
-    pio = g_new(MemoryRegionPortio, count + 1);
-    memcpy(pio, pio_init, sizeof(MemoryRegionPortio) * count);
-    memset(pio + count, 0, sizeof(MemoryRegionPortio));
+    mrpio = g_malloc0(sizeof(MemoryRegionPortioList) +
+                      sizeof(MemoryRegionPortio) * (count + 1));
+    mrpio->portio_opaque = piolist->opaque;
+    memcpy(mrpio->ports, pio_init, sizeof(MemoryRegionPortio) * count);
+    memset(mrpio->ports + count, 0, sizeof(MemoryRegionPortio));
 
     /* Adjust the offsets to all be zero-based for the region.  */
     for (i = 0; i < count; ++i) {
-        pio[i].offset -= off_low;
+        mrpio->ports[i].offset -= off_low;
+        mrpio->ports[i].base = start + off_low;
     }
 
-    ops = g_new0(MemoryRegionOps, 1);
-    ops->old_portio = pio;
-
-    region = g_new(MemoryRegion, 1);
-    alias = g_new(MemoryRegion, 1);
     /*
      * Use an alias so that the callback is called with an absolute address,
      * rather than an offset relative to to start + off_low.
      */
-    memory_region_init_io(region, ops, piolist->opaque, piolist->name,
-                          INT64_MAX);
-    memory_region_init_alias(alias, piolist->name,
-                             region, start + off_low, off_high - off_low);
+    memory_region_init_io(&mrpio->mr, &portio_ops, mrpio, piolist->name,
+                          off_high - off_low);
     memory_region_add_subregion(piolist->address_space,
-                                start + off_low, alias);
-    piolist->regions[piolist->nr] = region;
-    piolist->aliases[piolist->nr] = alias;
+                                start + off_low, &mrpio->mr);
+    piolist->regions[piolist->nr] = &mrpio->mr;
     ++piolist->nr;
 }
 
@@ -427,19 +496,14 @@ void portio_list_add(PortioList *piolist,
 
 void portio_list_del(PortioList *piolist)
 {
-    MemoryRegion *mr, *alias;
+    MemoryRegionPortioList *mrpio;
     unsigned i;
 
     for (i = 0; i < piolist->nr; ++i) {
-        mr = piolist->regions[i];
-        alias = piolist->aliases[i];
-        memory_region_del_subregion(piolist->address_space, alias);
-        memory_region_destroy(alias);
-        memory_region_destroy(mr);
-        g_free((MemoryRegionOps *)mr->ops);
-        g_free(mr);
-        g_free(alias);
+        mrpio = container_of(piolist->regions[i], MemoryRegionPortioList, mr);
+        memory_region_del_subregion(piolist->address_space, &mrpio->mr);
+        memory_region_destroy(&mrpio->mr);
+        g_free(mrpio);
         piolist->regions[i] = NULL;
-        piolist->aliases[i] = NULL;
     }
 }
diff --git a/memory.c b/memory.c
index 757e9a5..1431356 100644
--- a/memory.c
+++ b/memory.c
@@ -401,94 +401,6 @@ static void access_with_adjusted_size(hwaddr addr,
     }
 }
 
-static const MemoryRegionPortio *find_portio(MemoryRegion *mr, uint64_t offset,
-                                             unsigned width, bool write)
-{
-    const MemoryRegionPortio *mrp;
-
-    for (mrp = mr->ops->old_portio; mrp->size; ++mrp) {
-        if (offset >= mrp->offset && offset < mrp->offset + mrp->len
-            && width == mrp->size
-            && (write ? (bool)mrp->write : (bool)mrp->read)) {
-            return mrp;
-        }
-    }
-    return NULL;
-}
-
-static void memory_region_iorange_read(IORange *iorange,
-                                       uint64_t offset,
-                                       unsigned width,
-                                       uint64_t *data)
-{
-    MemoryRegionIORange *mrio
-        = container_of(iorange, MemoryRegionIORange, iorange);
-    MemoryRegion *mr = mrio->mr;
-
-    offset += mrio->offset;
-    if (mr->ops->old_portio) {
-        const MemoryRegionPortio *mrp = find_portio(mr, offset - mrio->offset,
-                                                    width, false);
-
-        *data = ((uint64_t)1 << (width * 8)) - 1;
-        if (mrp) {
-            *data = mrp->read(mr->opaque, offset);
-        } else if (width == 2) {
-            mrp = find_portio(mr, offset - mrio->offset, 1, false);
-            assert(mrp);
-            *data = mrp->read(mr->opaque, offset) |
-                    (mrp->read(mr->opaque, offset + 1) << 8);
-        }
-        return;
-    }
-    *data = 0;
-    access_with_adjusted_size(offset, data, width,
-                              mr->ops->impl.min_access_size,
-                              mr->ops->impl.max_access_size,
-                              memory_region_read_accessor, mr);
-}
-
-static void memory_region_iorange_write(IORange *iorange,
-                                        uint64_t offset,
-                                        unsigned width,
-                                        uint64_t data)
-{
-    MemoryRegionIORange *mrio
-        = container_of(iorange, MemoryRegionIORange, iorange);
-    MemoryRegion *mr = mrio->mr;
-
-    offset += mrio->offset;
-    if (mr->ops->old_portio) {
-        const MemoryRegionPortio *mrp = find_portio(mr, offset - mrio->offset,
-                                                    width, true);
-
-        if (mrp) {
-            mrp->write(mr->opaque, offset, data);
-        } else if (width == 2) {
-            mrp = find_portio(mr, offset - mrio->offset, 1, true);
-            assert(mrp);
-            mrp->write(mr->opaque, offset, data & 0xff);
-            mrp->write(mr->opaque, offset + 1, data >> 8);
-        }
-        return;
-    }
-    access_with_adjusted_size(offset, &data, width,
-                              mr->ops->impl.min_access_size,
-                              mr->ops->impl.max_access_size,
-                              memory_region_write_accessor, mr);
-}
-
-static void memory_region_iorange_destructor(IORange *iorange)
-{
-    g_free(container_of(iorange, MemoryRegionIORange, iorange));
-}
-
-const IORangeOps memory_region_iorange_ops = {
-    .read = memory_region_iorange_read,
-    .write = memory_region_iorange_write,
-    .destructor = memory_region_iorange_destructor,
-};
-
 static AddressSpace *memory_region_to_address_space(MemoryRegion *mr)
 {
     AddressSpace *as;
commit 962b03fcf509db25c847aa67c4eff574c240dcfe
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:07:03 2013 +0200

    xen: Mark fixed platform I/O as unaligned
    
    Before switching to the memory core dispatcher, we need to make sure
    that this pv-device will continue to receive unaligned portio accesses.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index b6c6793..f8f5dd5 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -262,9 +262,13 @@ static void platform_fixed_ioport_write(void *opaque, hwaddr addr,
 static const MemoryRegionOps platform_fixed_io_ops = {
     .read = platform_fixed_ioport_read,
     .write = platform_fixed_ioport_write,
+    .valid = {
+        .unaligned = true,
+    },
     .impl = {
         .min_access_size = 1,
         .max_access_size = 4,
+        .unaligned = true,
     },
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
commit 04e8cd506a2a7b57084d7d7b823540c2baf9a1da
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:07:02 2013 +0200

    vmware-vga: Accept unaligned I/O accesses
    
    Before switching to the memory core dispatcher, we need to make sure
    that this pv-device will continue to receive unaligned portio accesses.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index fd3569d..ec41681 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1241,6 +1241,10 @@ static const MemoryRegionOps vmsvga_io_ops = {
     .valid = {
         .min_access_size = 4,
         .max_access_size = 4,
+        .unaligned = true,
+    },
+    .impl = {
+        .unaligned = true,
     },
 };
 
commit b6f3296292f027c9a87a12dddd736a7c344d0206
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:07:01 2013 +0200

    isa: implement isa_is_ioport_assigned via memory_region_find
    
    Open-code isa_is_ioport_assigned via a memory region lookup. As all IO
    ports are now directly or indirectly registered via the memory API, this
    becomes possible and will finally allow us to drop the ioport tables.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 756df3b..ff559c0 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -383,14 +383,15 @@ static void piix4_pm_powerdown_req(Notifier *n, void *opaque)
 static void piix4_pm_machine_ready(Notifier *n, void *opaque)
 {
     PIIX4PMState *s = container_of(n, PIIX4PMState, machine_ready);
+    MemoryRegion *io_as = pci_address_space_io(&s->dev);
     uint8_t *pci_conf;
 
     pci_conf = s->dev.config;
-    pci_conf[0x5f] = (isa_is_ioport_assigned(0x378) ? 0x80 : 0) | 0x10;
+    pci_conf[0x5f] = 0x10 |
+        (memory_region_find(io_as, 0x378, 1).mr ? 0x80 : 0);
     pci_conf[0x63] = 0x60;
-    pci_conf[0x67] = (isa_is_ioport_assigned(0x3f8) ? 0x08 : 0) |
-	(isa_is_ioport_assigned(0x2f8) ? 0x90 : 0);
-
+    pci_conf[0x67] = (memory_region_find(io_as, 0x3f8, 1).mr ? 0x08 : 0) |
+        (memory_region_find(io_as, 0x2f8, 1).mr ? 0x90 : 0);
 }
 
 static int piix4_pm_initfn(PCIDevice *dev)
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index 667e882..461ab7c 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -477,22 +477,23 @@ static const MemoryRegionOps rbca_mmio_ops = {
 static void ich9_lpc_machine_ready(Notifier *n, void *opaque)
 {
     ICH9LPCState *s = container_of(n, ICH9LPCState, machine_ready);
+    MemoryRegion *io_as = pci_address_space_io(&s->d);
     uint8_t *pci_conf;
 
     pci_conf = s->d.config;
-    if (isa_is_ioport_assigned(0x3f8)) {
+    if (memory_region_find(io_as, 0x3f8, 1).mr) {
         /* com1 */
         pci_conf[0x82] |= 0x01;
     }
-    if (isa_is_ioport_assigned(0x2f8)) {
+    if (memory_region_find(io_as, 0x2f8, 1).mr) {
         /* com2 */
         pci_conf[0x82] |= 0x02;
     }
-    if (isa_is_ioport_assigned(0x378)) {
+    if (memory_region_find(io_as, 0x378, 1).mr) {
         /* lpt */
         pci_conf[0x82] |= 0x04;
     }
-    if (isa_is_ioport_assigned(0x3f0)) {
+    if (memory_region_find(io_as, 0x3f0, 1).mr) {
         /* floppy */
         pci_conf[0x82] |= 0x08;
     }
diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index 4953892..eb99ffe 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -40,7 +40,6 @@ typedef void (IOPortDestructor)(void *opaque);
 
 void ioport_register(IORange *iorange);
 void isa_unassign_ioport(pio_addr_t start, int length);
-bool isa_is_ioport_assigned(pio_addr_t start);
 
 void cpu_outb(pio_addr_t addr, uint8_t val);
 void cpu_outw(pio_addr_t addr, uint16_t val);
diff --git a/ioport.c b/ioport.c
index d5b7fbd..56470c5 100644
--- a/ioport.c
+++ b/ioport.c
@@ -273,13 +273,6 @@ void isa_unassign_ioport(pio_addr_t start, int length)
     }
 }
 
-bool isa_is_ioport_assigned(pio_addr_t start)
-{
-    return (ioport_read_table[0][start] || ioport_write_table[0][start] ||
-	    ioport_read_table[1][start] || ioport_write_table[1][start] ||
-	    ioport_read_table[2][start] || ioport_write_table[2][start]);
-}
-
 /***********************************************************/
 
 void cpu_outb(pio_addr_t addr, uint8_t val)
commit 8ab9b41876c0ead43648b55576a8f17aa2c8b027
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:07:00 2013 +0200

    Privatize register_ioport_read/write
    
    No more users outside of ioport.c.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index fc28350..4953892 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -39,10 +39,6 @@ typedef uint32_t (IOPortReadFunc)(void *opaque, uint32_t address);
 typedef void (IOPortDestructor)(void *opaque);
 
 void ioport_register(IORange *iorange);
-int register_ioport_read(pio_addr_t start, int length, int size,
-                         IOPortReadFunc *func, void *opaque);
-int register_ioport_write(pio_addr_t start, int length, int size,
-                          IOPortWriteFunc *func, void *opaque);
 void isa_unassign_ioport(pio_addr_t start, int length);
 bool isa_is_ioport_assigned(pio_addr_t start);
 
diff --git a/ioport.c b/ioport.c
index a0ac2a0..d5b7fbd 100644
--- a/ioport.c
+++ b/ioport.c
@@ -139,8 +139,8 @@ static int ioport_bsize(int size, int *bsize)
 }
 
 /* size is the word size in byte */
-int register_ioport_read(pio_addr_t start, int length, int size,
-                         IOPortReadFunc *func, void *opaque)
+static int register_ioport_read(pio_addr_t start, int length, int size,
+                                IOPortReadFunc *func, void *opaque)
 {
     int i, bsize;
 
@@ -159,8 +159,8 @@ int register_ioport_read(pio_addr_t start, int length, int size,
 }
 
 /* size is the word size in byte */
-int register_ioport_write(pio_addr_t start, int length, int size,
-                          IOPortWriteFunc *func, void *opaque)
+static int register_ioport_write(pio_addr_t start, int length, int size,
+                                 IOPortWriteFunc *func, void *opaque)
 {
     int i, bsize;
 
commit bcc37e24bda4666e1ddd75e9c523641f8b8a1b7e
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:06:59 2013 +0200

    vt82c686: replace register_ioport*
    
    Convert over to memory regions to obsolete register_ioport*.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 391d90d..e5cd4cd 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -43,10 +43,12 @@ typedef struct SuperIOConfig
 
 typedef struct VT82C686BState {
     PCIDevice dev;
+    MemoryRegion superio;
     SuperIOConfig superio_conf;
 } VT82C686BState;
 
-static void superio_ioport_writeb(void *opaque, uint32_t addr, uint32_t data)
+static void superio_ioport_writeb(void *opaque, hwaddr addr, uint64_t data,
+                                  unsigned size)
 {
     int can_write;
     SuperIOConfig *superio_conf = opaque;
@@ -93,7 +95,7 @@ static void superio_ioport_writeb(void *opaque, uint32_t addr, uint32_t data)
     }
 }
 
-static uint32_t superio_ioport_readb(void *opaque, uint32_t addr)
+static uint64_t superio_ioport_readb(void *opaque, hwaddr addr, unsigned size)
 {
     SuperIOConfig *superio_conf = opaque;
 
@@ -101,6 +103,16 @@ static uint32_t superio_ioport_readb(void *opaque, uint32_t addr)
     return (superio_conf->config[superio_conf->index]);
 }
 
+static const MemoryRegionOps superio_ops = {
+    .read = superio_ioport_readb,
+    .write = superio_ioport_writeb,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
 static void vt82c686b_reset(void * opaque)
 {
     PCIDevice *d = opaque;
@@ -140,17 +152,7 @@ static void vt82c686b_write_config(PCIDevice * d, uint32_t address,
 
     pci_default_write_config(d, address, val, len);
     if (address == 0x85) {  /* enable or disable super IO configure */
-        if (val & 0x2) {
-            /* floppy also uses 0x3f0 and 0x3f1.
-             * But we do not emulate flopy,so just set it here. */
-            isa_unassign_ioport(0x3f0, 2);
-            register_ioport_read(0x3f0, 2, 1, superio_ioport_readb,
-                                 &vt686->superio_conf);
-            register_ioport_write(0x3f0, 2, 1, superio_ioport_writeb,
-                                  &vt686->superio_conf);
-        } else {
-            isa_unassign_ioport(0x3f0, 2);
-        }
+        memory_region_set_enabled(&vt686->superio, val & 0x2);
     }
 }
 
@@ -423,11 +425,13 @@ static const VMStateDescription vmstate_via = {
 /* init the PCI-to-ISA bridge */
 static int vt82c686b_initfn(PCIDevice *d)
 {
+    VT82C686BState *vt82c = DO_UPCAST(VT82C686BState, dev, d);
     uint8_t *pci_conf;
+    ISABus *isa_bus;
     uint8_t *wmask;
     int i;
 
-    isa_bus_new(&d->qdev, pci_address_space_io(d));
+    isa_bus = isa_bus_new(&d->qdev, pci_address_space_io(d));
 
     pci_conf = d->config;
     pci_config_set_prog_interface(pci_conf, 0x0);
@@ -439,6 +443,14 @@ static int vt82c686b_initfn(PCIDevice *d)
        }
     }
 
+    memory_region_init_io(&vt82c->superio, &superio_ops, &vt82c->superio_conf,
+                          "superio", 2);
+    memory_region_set_enabled(&vt82c->superio, false);
+    /* The floppy also uses 0x3f0 and 0x3f1.
+     * But we do not emulate a floppy, so just set it here. */
+    memory_region_add_subregion(isa_bus->address_space_io, 0x3f0,
+                                &vt82c->superio);
+
     qemu_register_reset(vt82c686b_reset, d);
 
     return 0;
commit fd533eb510bace3efabe3378caae4002eb941508
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:06:58 2013 +0200

    prep: replace register_ioport*
    
    Convert over to memory regions to obsolete register_ioport*.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 90828f2..560a59a 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -434,6 +434,16 @@ static void ppc_prep_reset(void *opaque)
     cpu->env.nip = 0xfffffffc;
 }
 
+static const MemoryRegionPortio prep_portio_list[] = {
+    /* System control ports */
+    { 0x0092, 1, 1, .read = PREP_io_800_readb, .write = PREP_io_800_writeb, },
+    { 0x0800, 0x52, 1,
+      .read = PREP_io_800_readb, .write = PREP_io_800_writeb, },
+    /* Special port to get debug messages from Open-Firmware */
+    { 0x0F00, 4, 1, .write = PPC_debug_write, },
+    PORTIO_END_OF_LIST(),
+};
+
 /* PowerPC PREP hardware initialisation */
 static void ppc_prep_init(QEMUMachineInitArgs *args)
 {
@@ -450,6 +460,7 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
     nvram_t nvram;
     M48t59State *m48t59;
     MemoryRegion *PPC_io_memory = g_new(MemoryRegion, 1);
+    PortioList *port_list = g_new(PortioList, 1);
 #if 0
     MemoryRegion *xcsr = g_new(MemoryRegion, 1);
 #endif
@@ -641,11 +652,10 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
     isa_create_simple(isa_bus, "i8042");
 
     sysctrl->reset_irq = first_cpu->irq_inputs[PPC6xx_INPUT_HRESET];
-    /* System control ports */
-    register_ioport_read(0x0092, 0x01, 1, &PREP_io_800_readb, sysctrl);
-    register_ioport_write(0x0092, 0x01, 1, &PREP_io_800_writeb, sysctrl);
-    register_ioport_read(0x0800, 0x52, 1, &PREP_io_800_readb, sysctrl);
-    register_ioport_write(0x0800, 0x52, 1, &PREP_io_800_writeb, sysctrl);
+
+    portio_list_init(port_list, prep_portio_list, sysctrl, "prep");
+    portio_list_add(port_list, get_system_io(), 0x0);
+
     /* PowerPC control and status register group */
 #if 0
     memory_region_init_io(xcsr, &PPC_XCSR_ops, NULL, "ppc-xcsr", 0x1000);
@@ -672,9 +682,6 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
                          /* XXX: need an option to load a NVRAM image */
                          0,
                          graphic_width, graphic_height, graphic_depth);
-
-    /* Special port to get debug messages from Open-Firmware */
-    register_ioport_write(0x0F00, 4, 1, &PPC_debug_write, NULL);
 }
 
 static QEMUMachine prep_machine = {
commit f94b64acb6ec2871676990ea5ba956a91b20cc75
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:06:57 2013 +0200

    i82374: replace register_ioport*
    
    Convert over to memory regions to obsolete register_ioport*.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/dma/i82374.c b/hw/dma/i82374.c
index 6192780..ecda5cb 100644
--- a/hw/dma/i82374.c
+++ b/hw/dma/i82374.c
@@ -124,16 +124,24 @@ static const VMStateDescription vmstate_isa_i82374 = {
     },
 };
 
+static const MemoryRegionPortio i82374_portio_list[] = {
+    { 0x0A, 1, 1, .read = i82374_read_isr, },
+    { 0x10, 8, 1, .write = i82374_write_command, },
+    { 0x18, 8, 1, .read = i82374_read_status, },
+    { 0x20, 0x20, 1,
+      .write = i82374_write_descriptor, .read = i82374_read_descriptor, },
+    PORTIO_END_OF_LIST(),
+};
+
 static void i82374_isa_realize(DeviceState *dev, Error **errp)
 {
     ISAi82374State *isa = I82374(dev);
     I82374State *s = &isa->state;
+    PortioList *port_list = g_new(PortioList, 1);
 
-    register_ioport_read(isa->iobase + 0x0A, 1, 1, i82374_read_isr, s);
-    register_ioport_write(isa->iobase + 0x10, 8, 1, i82374_write_command, s);
-    register_ioport_read(isa->iobase + 0x18, 8, 1, i82374_read_status, s);
-    register_ioport_write(isa->iobase + 0x20, 0x20, 1, i82374_write_descriptor, s);
-    register_ioport_read(isa->iobase + 0x20, 0x20, 1, i82374_read_descriptor, s);
+    portio_list_init(port_list, i82374_portio_list, s, "i82374");
+    portio_list_add(port_list, isa_address_space_io(&isa->parent_obj),
+                    isa->iobase);
 
     i82374_realize(s, errp);
 
commit 0c6c4e28b3e6a2d0d87b7ca87ffb19e03d44267b
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:06:56 2013 +0200

    wdt_ib700: replace register_ioport*
    
    Convert over to memory regions to obsolete register_ioport*.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index d85c894..597a923 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -97,15 +97,23 @@ static const VMStateDescription vmstate_ib700 = {
     }
 };
 
+static const MemoryRegionPortio wdt_portio_list[] = {
+    { 0x441, 2, 1, .write = ib700_write_disable_reg, },
+    { 0x443, 2, 1, .write = ib700_write_enable_reg, },
+    PORTIO_END_OF_LIST(),
+};
+
 static void wdt_ib700_realize(DeviceState *dev, Error **errp)
 {
     IB700State *s = IB700(dev);
+    PortioList *port_list = g_new(PortioList, 1);
 
     ib700_debug("watchdog init\n");
 
     s->timer = qemu_new_timer_ns(vm_clock, ib700_timer_expired, s);
-    register_ioport_write(0x441, 2, 1, ib700_write_disable_reg, s);
-    register_ioport_write(0x443, 2, 1, ib700_write_enable_reg, s);
+
+    portio_list_init(port_list, wdt_portio_list, s, "ib700");
+    portio_list_add(port_list, isa_address_space_io(&s->parent_obj), 0);
 }
 
 static void wdt_ib700_reset(DeviceState *dev)
commit e3914e3ad883cff0247da8471e9cb3051e88ab38
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:06:55 2013 +0200

    applesmc: replace register_ioport*
    
    Convert over to memory regions to obsolete register_ioport*.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index 46f4fbd..83468dc 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -73,6 +73,8 @@ typedef struct AppleSMCState AppleSMCState;
 struct AppleSMCState {
     ISADevice parent_obj;
 
+    MemoryRegion io_data;
+    MemoryRegion io_cmd;
     uint32_t iobase;
     uint8_t cmd;
     uint8_t status;
@@ -86,7 +88,8 @@ struct AppleSMCState {
     QLIST_HEAD(, AppleSMCData) data_def;
 };
 
-static void applesmc_io_cmd_writeb(void *opaque, uint32_t addr, uint32_t val)
+static void applesmc_io_cmd_write(void *opaque, hwaddr addr, uint64_t val,
+                                  unsigned size)
 {
     AppleSMCState *s = opaque;
 
@@ -115,7 +118,8 @@ static void applesmc_fill_data(AppleSMCState *s)
     }
 }
 
-static void applesmc_io_data_writeb(void *opaque, uint32_t addr, uint32_t val)
+static void applesmc_io_data_write(void *opaque, hwaddr addr, uint64_t val,
+                                   unsigned size)
 {
     AppleSMCState *s = opaque;
 
@@ -138,7 +142,8 @@ static void applesmc_io_data_writeb(void *opaque, uint32_t addr, uint32_t val)
     }
 }
 
-static uint32_t applesmc_io_data_readb(void *opaque, uint32_t addr1)
+static uint64_t applesmc_io_data_read(void *opaque, hwaddr addr1,
+                                      unsigned size)
 {
     AppleSMCState *s = opaque;
     uint8_t retval = 0;
@@ -162,7 +167,7 @@ static uint32_t applesmc_io_data_readb(void *opaque, uint32_t addr1)
     return retval;
 }
 
-static uint32_t applesmc_io_cmd_readb(void *opaque, uint32_t addr1)
+static uint64_t applesmc_io_cmd_read(void *opaque, hwaddr addr1, unsigned size)
 {
     AppleSMCState *s = opaque;
 
@@ -201,18 +206,39 @@ static void qdev_applesmc_isa_reset(DeviceState *dev)
     applesmc_add_key(s, "MSSD", 1, "\0x3");
 }
 
+static const MemoryRegionOps applesmc_data_io_ops = {
+    .write = applesmc_io_data_write,
+    .read = applesmc_io_data_read,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
+static const MemoryRegionOps applesmc_cmd_io_ops = {
+    .write = applesmc_io_cmd_write,
+    .read = applesmc_io_cmd_read,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
 static void applesmc_isa_realize(DeviceState *dev, Error **errp)
 {
     AppleSMCState *s = APPLE_SMC(dev);
 
-    register_ioport_read(s->iobase + APPLESMC_DATA_PORT, 4, 1,
-                         applesmc_io_data_readb, s);
-    register_ioport_read(s->iobase + APPLESMC_CMD_PORT, 4, 1,
-                         applesmc_io_cmd_readb, s);
-    register_ioport_write(s->iobase + APPLESMC_DATA_PORT, 4, 1,
-                          applesmc_io_data_writeb, s);
-    register_ioport_write(s->iobase + APPLESMC_CMD_PORT, 4, 1,
-                          applesmc_io_cmd_writeb, s);
+    memory_region_init_io(&s->io_data, &applesmc_data_io_ops, s,
+                          "applesmc-data", 4);
+    isa_register_ioport(&s->parent_obj, &s->io_data,
+                        s->iobase + APPLESMC_DATA_PORT);
+
+    memory_region_init_io(&s->io_cmd, &applesmc_cmd_io_ops, s,
+                          "applesmc-cmd", 4);
+    isa_register_ioport(&s->parent_obj, &s->io_cmd,
+                        s->iobase + APPLESMC_CMD_PORT);
 
     if (!s->osk || (strlen(s->osk) != 64)) {
         fprintf(stderr, "WARNING: Using AppleSMC with invalid key\n");
commit a8aec29569e8baa4d86ea2aac16f8c4d78ab2a2a
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sat Jun 22 08:06:54 2013 +0200

    adlib: replace register_ioport*
    
    Convert over to memory regions to obsolete register_ioport*.
    
    CC: malc <av1474 at comtv.ru>
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 6a7d377..8b9b81e 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -283,9 +283,17 @@ static void Adlib_fini (AdlibState *s)
     AUD_remove_card (&s->card);
 }
 
+static MemoryRegionPortio adlib_portio_list[] = {
+    { 0x388, 4, 1, .read = adlib_read, .write = adlib_write, },
+    { 0, 4, 1, .read = adlib_read, .write = adlib_write, },
+    { 0, 2, 1, .read = adlib_read, .write = adlib_write, },
+    PORTIO_END_OF_LIST(),
+};
+
 static void adlib_realizefn (DeviceState *dev, Error **errp)
 {
     AdlibState *s = ADLIB(dev);
+    PortioList *port_list = g_new(PortioList, 1);
     struct audsettings as;
 
     if (glob_adlib) {
@@ -339,14 +347,10 @@ static void adlib_realizefn (DeviceState *dev, Error **errp)
     s->samples = AUD_get_buffer_size_out (s->voice) >> SHIFT;
     s->mixbuf = g_malloc0 (s->samples << SHIFT);
 
-    register_ioport_read (0x388, 4, 1, adlib_read, s);
-    register_ioport_write (0x388, 4, 1, adlib_write, s);
-
-    register_ioport_read (s->port, 4, 1, adlib_read, s);
-    register_ioport_write (s->port, 4, 1, adlib_write, s);
-
-    register_ioport_read (s->port + 8, 2, 1, adlib_read, s);
-    register_ioport_write (s->port + 8, 2, 1, adlib_write, s);
+    adlib_portio_list[1].offset = s->port;
+    adlib_portio_list[2].offset = s->port + 8;
+    portio_list_init (port_list, adlib_portio_list, s, "adlib");
+    portio_list_add (port_list, isa_address_space_io(&s->parent_obj), 0);
 }
 
 static Property adlib_properties[] = {
commit f487b677c2dc15786dbe7c61326cc49e7c64daea
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jun 3 14:17:19 2013 +0200

    dma: keep a device alive while it has SGLists
    
    Reviewed-by: Anthony Liguori <aliguori at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/dma-helpers.c b/dma-helpers.c
index 5afba47..499550f 100644
--- a/dma-helpers.c
+++ b/dma-helpers.c
@@ -34,13 +34,16 @@ int dma_memory_set(AddressSpace *as, dma_addr_t addr, uint8_t c, dma_addr_t len)
     return error;
 }
 
-void qemu_sglist_init(QEMUSGList *qsg, int alloc_hint, AddressSpace *as)
+void qemu_sglist_init(QEMUSGList *qsg, DeviceState *dev, int alloc_hint,
+                      AddressSpace *as)
 {
     qsg->sg = g_malloc(alloc_hint * sizeof(ScatterGatherEntry));
     qsg->nsg = 0;
     qsg->nalloc = alloc_hint;
     qsg->size = 0;
     qsg->as = as;
+    qsg->dev = dev;
+    object_ref(OBJECT(dev));
 }
 
 void qemu_sglist_add(QEMUSGList *qsg, dma_addr_t base, dma_addr_t len)
@@ -57,6 +60,7 @@ void qemu_sglist_add(QEMUSGList *qsg, dma_addr_t base, dma_addr_t len)
 
 void qemu_sglist_destroy(QEMUSGList *qsg)
 {
+    object_unref(OBJECT(qsg->dev));
     g_free(qsg->sg);
     memset(qsg, 0, sizeof(*qsg));
 }
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 1adfa0b..931dacd 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -650,6 +650,8 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
     int off_idx = -1;
     int off_pos = -1;
     int tbl_entry_size;
+    IDEBus *bus = &ad->port;
+    BusState *qbus = BUS(bus);
 
     if (!sglist_alloc_hint) {
         DPRINTF(ad->port_no, "no sg list given by guest: 0x%08x\n", opts);
@@ -691,7 +693,8 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
             goto out;
         }
 
-        qemu_sglist_init(sglist, (sglist_alloc_hint - off_idx), ad->hba->as);
+        qemu_sglist_init(sglist, qbus->parent, (sglist_alloc_hint - off_idx),
+                         ad->hba->as);
         qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos),
                         le32_to_cpu(tbl[off_idx].flags_size) + 1 - off_pos);
 
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index a1952b0..84288ae 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -70,7 +70,7 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
 
     s->io_buffer_size = io->len;
 
-    qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1,
+    qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
                      &address_space_memory);
     qemu_sglist_add(&s->sg, io->addr, io->len);
     io->addr += io->len;
@@ -127,7 +127,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
     s->io_buffer_index = 0;
     s->io_buffer_size = io->len;
 
-    qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1,
+    qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
                      &address_space_memory);
     qemu_sglist_add(&s->sg, io->addr, io->len);
     io->addr += io->len;
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index b8a0abf..712f0ad 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -77,10 +77,12 @@ static void virtio_scsi_bad_req(void)
     exit(1);
 }
 
-static void qemu_sgl_init_external(QEMUSGList *qsgl, struct iovec *sg,
+static void qemu_sgl_init_external(VirtIOSCSIReq *req, struct iovec *sg,
                                    hwaddr *addr, int num)
 {
-    qemu_sglist_init(qsgl, num, &address_space_memory);
+    QEMUSGList *qsgl = &req->qsgl;
+
+    qemu_sglist_init(qsgl, DEVICE(req->dev), num, &address_space_memory);
     while (num--) {
         qemu_sglist_add(qsgl, *(addr++), (sg++)->iov_len);
     }
@@ -99,11 +101,11 @@ static void virtio_scsi_parse_req(VirtIOSCSI *s, VirtQueue *vq,
     req->resp.buf = req->elem.in_sg[0].iov_base;
 
     if (req->elem.out_num > 1) {
-        qemu_sgl_init_external(&req->qsgl, &req->elem.out_sg[1],
+        qemu_sgl_init_external(req, &req->elem.out_sg[1],
                                &req->elem.out_addr[1],
                                req->elem.out_num - 1);
     } else {
-        qemu_sgl_init_external(&req->qsgl, &req->elem.in_sg[1],
+        qemu_sgl_init_external(req, &req->elem.in_sg[1],
                                &req->elem.in_addr[1],
                                req->elem.in_num - 1);
     }
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 16d6356..f977a91 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1241,11 +1241,13 @@ static int ehci_init_transfer(EHCIPacket *p)
 {
     uint32_t cpage, offset, bytes, plen;
     dma_addr_t page;
+    USBBus *bus = &p->queue->ehci->bus;
+    BusState *qbus = BUS(bus);
 
     cpage  = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
     bytes  = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
     offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
-    qemu_sglist_init(&p->sgl, 5, p->queue->ehci->as);
+    qemu_sglist_init(&p->sgl, qbus->parent, 5, p->queue->ehci->as);
 
     while (bytes > 0) {
         if (cpage > 4) {
@@ -1484,7 +1486,7 @@ static int ehci_process_itd(EHCIState *ehci,
                 return -1;
             }
 
-            qemu_sglist_init(&ehci->isgl, 2, ehci->as);
+            qemu_sglist_init(&ehci->isgl, DEVICE(ehci), 2, ehci->as);
             if (off + len > 4096) {
                 /* transfer crosses page border */
                 uint32_t len2 = off + len - 4096;
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 6ef1f97..de406d6 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -702,7 +702,7 @@ static inline void pci_dma_unmap(PCIDevice *dev, void *buffer, dma_addr_t len,
 static inline void pci_dma_sglist_init(QEMUSGList *qsg, PCIDevice *dev,
                                        int alloc_hint)
 {
-    qemu_sglist_init(qsg, alloc_hint, pci_get_address_space(dev));
+    qemu_sglist_init(qsg, DEVICE(dev), alloc_hint, pci_get_address_space(dev));
 }
 
 extern const VMStateDescription vmstate_pci_device;
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 031d1f5..00f21f3 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -29,6 +29,7 @@ struct QEMUSGList {
     int nsg;
     int nalloc;
     size_t size;
+    DeviceState *dev;
     AddressSpace *as;
 };
 
@@ -189,7 +190,8 @@ struct ScatterGatherEntry {
     dma_addr_t len;
 };
 
-void qemu_sglist_init(QEMUSGList *qsg, int alloc_hint, AddressSpace *as);
+void qemu_sglist_init(QEMUSGList *qsg, DeviceState *dev, int alloc_hint,
+                      AddressSpace *as);
 void qemu_sglist_add(QEMUSGList *qsg, dma_addr_t base, dma_addr_t len);
 void qemu_sglist_destroy(QEMUSGList *qsg);
 #endif
commit cac3c384bb986f06a308e551641284586924813c
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jun 3 14:09:39 2013 +0200

    scsi: keep device alive while it has requests
    
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index 53ea906..a92b7c1 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -505,10 +505,12 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
                             uint32_t tag, uint32_t lun, void *hba_private)
 {
     SCSIRequest *req;
+    SCSIBus *bus = scsi_bus_from_device(d);
+    BusState *qbus = BUS(bus);
 
     req = g_malloc0(reqops->size);
     req->refcount = 1;
-    req->bus = scsi_bus_from_device(d);
+    req->bus = bus;
     req->dev = d;
     req->tag = tag;
     req->lun = lun;
@@ -516,6 +518,8 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
     req->status = -1;
     req->sense_len = 0;
     req->ops = reqops;
+    object_ref(OBJECT(d));
+    object_ref(OBJECT(qbus->parent));
     trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
     return req;
 }
@@ -1498,13 +1502,17 @@ void scsi_req_unref(SCSIRequest *req)
 {
     assert(req->refcount > 0);
     if (--req->refcount == 0) {
-        SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, req->dev->qdev.parent_bus);
+        BusState *qbus = req->dev->qdev.parent_bus;
+        SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus);
+
         if (bus->info->free_request && req->hba_private) {
             bus->info->free_request(bus, req->hba_private);
         }
         if (req->ops->free_req) {
             req->ops->free_req(req);
         }
+        object_unref(OBJECT(req->dev));
+        object_unref(OBJECT(qbus->parent));
         g_free(req);
     }
 }
commit 6ac363b50c569815786a795d806e068b3f6a07eb
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:46 2013 +1000

    pci: Move pci_read_devaddr to pci-hotplug-old.c
    
    pci_read_devaddr() is only used by the legacy functions for the old PCI
    hotplug interface in pci-hotplug-old.c.  So we move the function there,
    and make it static.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
index b3c233c..a0b5558 100644
--- a/hw/pci/pci-hotplug-old.c
+++ b/hw/pci/pci-hotplug-old.c
@@ -36,6 +36,20 @@
 #include "sysemu/blockdev.h"
 #include "qapi/error.h"
 
+static int pci_read_devaddr(Monitor *mon, const char *addr, int *domp,
+                            int *busp, unsigned *slotp)
+{
+    /* strip legacy tag */
+    if (!strncmp(addr, "pci_addr=", 9)) {
+        addr += 9;
+    }
+    if (pci_parse_devaddr(addr, domp, busp, slotp, NULL)) {
+        monitor_printf(mon, "Invalid pci address\n");
+        return -1;
+    }
+    return 0;
+}
+
 static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,
                                        const char *devaddr,
                                        const char *opts_str)
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 61b681a..adf4da5 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -522,7 +522,7 @@ static void pci_set_default_subsystem_id(PCIDevice *pci_dev)
  * Parse [[<domain>:]<bus>:]<slot>, return -1 on error if funcp == NULL
  *       [[<domain>:]<bus>:]<slot>.<func>, return -1 on error
  */
-static int pci_parse_devaddr(const char *addr, int *domp, int *busp,
+int pci_parse_devaddr(const char *addr, int *domp, int *busp,
                       unsigned int *slotp, unsigned int *funcp)
 {
     const char *p;
@@ -581,20 +581,6 @@ static int pci_parse_devaddr(const char *addr, int *domp, int *busp,
     return 0;
 }
 
-int pci_read_devaddr(Monitor *mon, const char *addr, int *domp, int *busp,
-                     unsigned *slotp)
-{
-    /* strip legacy tag */
-    if (!strncmp(addr, "pci_addr=", 9)) {
-        addr += 9;
-    }
-    if (pci_parse_devaddr(addr, domp, busp, slotp, NULL)) {
-        monitor_printf(mon, "Invalid pci address\n");
-        return -1;
-    }
-    return 0;
-}
-
 PCIBus *pci_get_bus_devfn(int *devfnp, const char *devaddr)
 {
     int dom, bus;
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 6ef1f97..b5edef8 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -395,8 +395,8 @@ PCIDevice *pci_find_device(PCIBus *bus, int bus_num, uint8_t devfn);
 int pci_qdev_find_device(const char *id, PCIDevice **pdev);
 PCIBus *pci_get_bus_devfn(int *devfnp, const char *devaddr);
 
-int pci_read_devaddr(Monitor *mon, const char *addr, int *domp, int *busp,
-                     unsigned *slotp);
+int pci_parse_devaddr(const char *addr, int *domp, int *busp,
+                      unsigned int *slotp, unsigned int *funcp);
 
 void pci_device_deassert_intx(PCIDevice *dev);
 
commit 79ca616f291124d166ca173e512c4ace1c2fe8b2
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jun 6 18:48:45 2013 +1000

    pci: Cleanup configuration for pci-hotplug.c
    
    pci-hotplug.c and the CONFIG_PCI_HOTPLUG variable which controls its
    compilation are misnamed.  They're not about PCI hotplug in general, but
    rather about the pci_add/pci_del interface which are now deprecated in
    favour of the more general device_add/device_del interface.  This patch
    therefore renames them to pci-hotplug-old.c and CONFIG_PCI_HOTPLUG_OLD.
    
    CONFIG_PCI_HOTPLUG=y was listed twice in {i386,x86_64}-softmmu.make for no
    particular reason, so we clean that up too.  In addition it was included in
    ppc64-softmmu.mak for which the old hotplug interface was never used and is
    unsuitable, so we remove that too.
    
    Most of pci-hotplug.c was additionaly protected by #ifdef TARGET_I386.  The
    small piece which wasn't is only called from the pci_add and pci_del hooks
    in hmp-commands.hx, which themselves were protected by #ifdef TARGET_I386.
    This patch therefore also removes the #ifdef from pci-hotplug-old.c,
    and changes the ifdefs in hmp-commands.hx to use CONFIG_PCI_HOTPLUG_OLD.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index 03deca2..4a0fc9c 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -28,11 +28,10 @@ CONFIG_APPLESMC=y
 CONFIG_I8259=y
 CONFIG_PFLASH_CFI01=y
 CONFIG_TPM_TIS=$(CONFIG_TPM)
-CONFIG_PCI_HOTPLUG=y
+CONFIG_PCI_HOTPLUG_OLD=y
 CONFIG_MC146818RTC=y
 CONFIG_PAM=y
 CONFIG_PCI_PIIX=y
-CONFIG_PCI_HOTPLUG=y
 CONFIG_WDT_IB700=y
 CONFIG_PC_SYSFW=y
 CONFIG_XEN_I386=$(CONFIG_XEN)
diff --git a/default-configs/ppc64-softmmu.mak b/default-configs/ppc64-softmmu.mak
index cb279cb..5a72b5f 100644
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -45,7 +45,5 @@ CONFIG_OPENPIC=y
 CONFIG_PSERIES=y
 CONFIG_E500=y
 CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
-# For pSeries
-CONFIG_PCI_HOTPLUG=y
 # For PReP
 CONFIG_MC146818RTC=y
diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
index 599b630..10bb0c6 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -28,11 +28,10 @@ CONFIG_APPLESMC=y
 CONFIG_I8259=y
 CONFIG_PFLASH_CFI01=y
 CONFIG_TPM_TIS=$(CONFIG_TPM)
-CONFIG_PCI_HOTPLUG=y
+CONFIG_PCI_HOTPLUG_OLD=y
 CONFIG_MC146818RTC=y
 CONFIG_PAM=y
 CONFIG_PCI_PIIX=y
-CONFIG_PCI_HOTPLUG=y
 CONFIG_WDT_IB700=y
 CONFIG_PC_SYSFW=y
 CONFIG_XEN_I386=$(CONFIG_XEN)
diff --git a/hmp-commands.hx b/hmp-commands.hx
index 915b0d1..d1cdcfb 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1077,7 +1077,7 @@ STEXI
 Add drive to PCI storage controller.
 ETEXI
 
-#if defined(TARGET_I386)
+#if defined(CONFIG_PCI_HOTPLUG_OLD)
     {
         .name       = "pci_add",
         .args_type  = "pci_addr:s,type:s,opts:s?",
@@ -1093,7 +1093,7 @@ STEXI
 Hot-add PCI device.
 ETEXI
 
-#if defined(TARGET_I386)
+#if defined(CONFIG_PCI_HOTPLUG_OLD)
     {
         .name       = "pci_del",
         .args_type  = "pci_addr:s",
diff --git a/hw/pci/Makefile.objs b/hw/pci/Makefile.objs
index a7fb9d0..720f438 100644
--- a/hw/pci/Makefile.objs
+++ b/hw/pci/Makefile.objs
@@ -8,4 +8,4 @@ common-obj-$(CONFIG_PCI) += pcie.o pcie_aer.o pcie_port.o
 common-obj-$(CONFIG_NO_PCI) += pci-stub.o
 common-obj-$(CONFIG_ALL) += pci-stub.o
 
-obj-$(CONFIG_PCI_HOTPLUG) += pci-hotplug.o
+common-obj-$(CONFIG_PCI_HOTPLUG_OLD) += pci-hotplug-old.o
diff --git a/hw/pci/pci-hotplug-old.c b/hw/pci/pci-hotplug-old.c
new file mode 100644
index 0000000..b3c233c
--- /dev/null
+++ b/hw/pci/pci-hotplug-old.c
@@ -0,0 +1,292 @@
+/*
+ * Deprecated PCI hotplug interface support
+ * This covers the old pci_add / pci_del command, whereas the more general
+ * device_add / device_del commands are now preferred.
+ *
+ * Copyright (c) 2004 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "hw/hw.h"
+#include "hw/boards.h"
+#include "hw/pci/pci.h"
+#include "net/net.h"
+#include "hw/i386/pc.h"
+#include "monitor/monitor.h"
+#include "hw/scsi/scsi.h"
+#include "hw/virtio/virtio-blk.h"
+#include "qemu/config-file.h"
+#include "sysemu/blockdev.h"
+#include "qapi/error.h"
+
+static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,
+                                       const char *devaddr,
+                                       const char *opts_str)
+{
+    Error *local_err = NULL;
+    QemuOpts *opts;
+    PCIBus *bus;
+    int ret, devfn;
+
+    bus = pci_get_bus_devfn(&devfn, devaddr);
+    if (!bus) {
+        monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
+        return NULL;
+    }
+    if (!((BusState*)bus)->allow_hotplug) {
+        monitor_printf(mon, "PCI bus doesn't support hotplug\n");
+        return NULL;
+    }
+
+    opts = qemu_opts_parse(qemu_find_opts("net"), opts_str ? opts_str : "", 0);
+    if (!opts) {
+        return NULL;
+    }
+
+    qemu_opt_set(opts, "type", "nic");
+
+    ret = net_client_init(opts, 0, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        return NULL;
+    }
+    if (nd_table[ret].devaddr) {
+        monitor_printf(mon, "Parameter addr not supported\n");
+        return NULL;
+    }
+    return pci_nic_init(&nd_table[ret], "rtl8139", devaddr);
+}
+
+static int scsi_hot_add(Monitor *mon, DeviceState *adapter,
+                        DriveInfo *dinfo, int printinfo)
+{
+    SCSIBus *scsibus;
+    SCSIDevice *scsidev;
+
+    scsibus = (SCSIBus *)
+        object_dynamic_cast(OBJECT(QLIST_FIRST(&adapter->child_bus)),
+                            TYPE_SCSI_BUS);
+    if (!scsibus) {
+	error_report("Device is not a SCSI adapter");
+	return -1;
+    }
+
+    /*
+     * drive_init() tries to find a default for dinfo->unit.  Doesn't
+     * work at all for hotplug though as we assign the device to a
+     * specific bus instead of the first bus with spare scsi ids.
+     *
+     * Ditch the calculated value and reload from option string (if
+     * specified).
+     */
+    dinfo->unit = qemu_opt_get_number(dinfo->opts, "unit", -1);
+    dinfo->bus = scsibus->busnr;
+    scsidev = scsi_bus_legacy_add_drive(scsibus, dinfo->bdrv, dinfo->unit,
+                                        false, -1, NULL);
+    if (!scsidev) {
+        return -1;
+    }
+    dinfo->unit = scsidev->id;
+
+    if (printinfo)
+        monitor_printf(mon, "OK bus %d, unit %d\n",
+                       scsibus->busnr, scsidev->id);
+    return 0;
+}
+
+int pci_drive_hot_add(Monitor *mon, const QDict *qdict, DriveInfo *dinfo)
+{
+    int dom, pci_bus;
+    unsigned slot;
+    PCIDevice *dev;
+    const char *pci_addr = qdict_get_str(qdict, "pci_addr");
+
+    switch (dinfo->type) {
+    case IF_SCSI:
+        if (pci_read_devaddr(mon, pci_addr, &dom, &pci_bus, &slot)) {
+            goto err;
+        }
+        dev = pci_find_device(pci_find_root_bus(dom), pci_bus,
+                              PCI_DEVFN(slot, 0));
+        if (!dev) {
+            monitor_printf(mon, "no pci device with address %s\n", pci_addr);
+            goto err;
+        }
+        if (scsi_hot_add(mon, &dev->qdev, dinfo, 1) != 0) {
+            goto err;
+        }
+        break;
+    default:
+        monitor_printf(mon, "Can't hot-add drive to type %d\n", dinfo->type);
+        goto err;
+    }
+
+    return 0;
+err:
+    return -1;
+}
+
+static PCIDevice *qemu_pci_hot_add_storage(Monitor *mon,
+                                           const char *devaddr,
+                                           const char *opts)
+{
+    PCIDevice *dev;
+    DriveInfo *dinfo = NULL;
+    int type = -1;
+    char buf[128];
+    PCIBus *bus;
+    int devfn;
+
+    if (get_param_value(buf, sizeof(buf), "if", opts)) {
+        if (!strcmp(buf, "scsi"))
+            type = IF_SCSI;
+        else if (!strcmp(buf, "virtio")) {
+            type = IF_VIRTIO;
+        } else {
+            monitor_printf(mon, "type %s not a hotpluggable PCI device.\n", buf);
+            return NULL;
+        }
+    } else {
+        monitor_printf(mon, "no if= specified\n");
+        return NULL;
+    }
+
+    if (get_param_value(buf, sizeof(buf), "file", opts)) {
+        dinfo = add_init_drive(opts);
+        if (!dinfo)
+            return NULL;
+        if (dinfo->devaddr) {
+            monitor_printf(mon, "Parameter addr not supported\n");
+            return NULL;
+        }
+    } else {
+        dinfo = NULL;
+    }
+
+    bus = pci_get_bus_devfn(&devfn, devaddr);
+    if (!bus) {
+        monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
+        return NULL;
+    }
+    if (!((BusState*)bus)->allow_hotplug) {
+        monitor_printf(mon, "PCI bus doesn't support hotplug\n");
+        return NULL;
+    }
+
+    switch (type) {
+    case IF_SCSI:
+        dev = pci_create(bus, devfn, "lsi53c895a");
+        if (qdev_init(&dev->qdev) < 0)
+            dev = NULL;
+        if (dev && dinfo) {
+            if (scsi_hot_add(mon, &dev->qdev, dinfo, 0) != 0) {
+                qdev_unplug(&dev->qdev, NULL);
+                dev = NULL;
+            }
+        }
+        break;
+    case IF_VIRTIO:
+        if (!dinfo) {
+            monitor_printf(mon, "virtio requires a backing file/device.\n");
+            return NULL;
+        }
+        dev = pci_create(bus, devfn, "virtio-blk-pci");
+        if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
+            qdev_free(&dev->qdev);
+            dev = NULL;
+            break;
+        }
+        if (qdev_init(&dev->qdev) < 0)
+            dev = NULL;
+        break;
+    default:
+        dev = NULL;
+    }
+    return dev;
+}
+
+void pci_device_hot_add(Monitor *mon, const QDict *qdict)
+{
+    PCIDevice *dev = NULL;
+    const char *pci_addr = qdict_get_str(qdict, "pci_addr");
+    const char *type = qdict_get_str(qdict, "type");
+    const char *opts = qdict_get_try_str(qdict, "opts");
+
+    /* strip legacy tag */
+    if (!strncmp(pci_addr, "pci_addr=", 9)) {
+        pci_addr += 9;
+    }
+
+    if (!opts) {
+        opts = "";
+    }
+
+    if (!strcmp(pci_addr, "auto"))
+        pci_addr = NULL;
+
+    if (strcmp(type, "nic") == 0) {
+        dev = qemu_pci_hot_add_nic(mon, pci_addr, opts);
+    } else if (strcmp(type, "storage") == 0) {
+        dev = qemu_pci_hot_add_storage(mon, pci_addr, opts);
+    } else {
+        monitor_printf(mon, "invalid type: %s\n", type);
+    }
+
+    if (dev) {
+        monitor_printf(mon, "OK domain %d, bus %d, slot %d, function %d\n",
+                       pci_find_domain(dev->bus),
+                       pci_bus_num(dev->bus), PCI_SLOT(dev->devfn),
+                       PCI_FUNC(dev->devfn));
+    } else
+        monitor_printf(mon, "failed to add %s\n", opts);
+}
+
+static int pci_device_hot_remove(Monitor *mon, const char *pci_addr)
+{
+    PCIDevice *d;
+    int dom, bus;
+    unsigned slot;
+    Error *local_err = NULL;
+
+    if (pci_read_devaddr(mon, pci_addr, &dom, &bus, &slot)) {
+        return -1;
+    }
+
+    d = pci_find_device(pci_find_root_bus(dom), bus, PCI_DEVFN(slot, 0));
+    if (!d) {
+        monitor_printf(mon, "slot %d empty\n", slot);
+        return -1;
+    }
+
+    qdev_unplug(&d->qdev, &local_err);
+    if (error_is_set(&local_err)) {
+        monitor_printf(mon, "%s\n", error_get_pretty(local_err));
+        error_free(local_err);
+        return -1;
+    }
+
+    return 0;
+}
+
+void do_pci_device_hot_remove(Monitor *mon, const QDict *qdict)
+{
+    pci_device_hot_remove(mon, qdict_get_str(qdict, "pci_addr"));
+}
diff --git a/hw/pci/pci-hotplug.c b/hw/pci/pci-hotplug.c
deleted file mode 100644
index 12287d1..0000000
--- a/hw/pci/pci-hotplug.c
+++ /dev/null
@@ -1,292 +0,0 @@
-/*
- * QEMU PCI hotplug support
- *
- * Copyright (c) 2004 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "hw/hw.h"
-#include "hw/boards.h"
-#include "hw/pci/pci.h"
-#include "net/net.h"
-#include "hw/i386/pc.h"
-#include "monitor/monitor.h"
-#include "hw/scsi/scsi.h"
-#include "hw/virtio/virtio-blk.h"
-#include "qemu/config-file.h"
-#include "sysemu/blockdev.h"
-#include "qapi/error.h"
-
-#if defined(TARGET_I386)
-static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,
-                                       const char *devaddr,
-                                       const char *opts_str)
-{
-    Error *local_err = NULL;
-    QemuOpts *opts;
-    PCIBus *bus;
-    int ret, devfn;
-
-    bus = pci_get_bus_devfn(&devfn, devaddr);
-    if (!bus) {
-        monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
-        return NULL;
-    }
-    if (!((BusState*)bus)->allow_hotplug) {
-        monitor_printf(mon, "PCI bus doesn't support hotplug\n");
-        return NULL;
-    }
-
-    opts = qemu_opts_parse(qemu_find_opts("net"), opts_str ? opts_str : "", 0);
-    if (!opts) {
-        return NULL;
-    }
-
-    qemu_opt_set(opts, "type", "nic");
-
-    ret = net_client_init(opts, 0, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        return NULL;
-    }
-    if (nd_table[ret].devaddr) {
-        monitor_printf(mon, "Parameter addr not supported\n");
-        return NULL;
-    }
-    return pci_nic_init(&nd_table[ret], "rtl8139", devaddr);
-}
-
-static int scsi_hot_add(Monitor *mon, DeviceState *adapter,
-                        DriveInfo *dinfo, int printinfo)
-{
-    SCSIBus *scsibus;
-    SCSIDevice *scsidev;
-
-    scsibus = (SCSIBus *)
-        object_dynamic_cast(OBJECT(QLIST_FIRST(&adapter->child_bus)),
-                            TYPE_SCSI_BUS);
-    if (!scsibus) {
-	error_report("Device is not a SCSI adapter");
-	return -1;
-    }
-
-    /*
-     * drive_init() tries to find a default for dinfo->unit.  Doesn't
-     * work at all for hotplug though as we assign the device to a
-     * specific bus instead of the first bus with spare scsi ids.
-     *
-     * Ditch the calculated value and reload from option string (if
-     * specified).
-     */
-    dinfo->unit = qemu_opt_get_number(dinfo->opts, "unit", -1);
-    dinfo->bus = scsibus->busnr;
-    scsidev = scsi_bus_legacy_add_drive(scsibus, dinfo->bdrv, dinfo->unit,
-                                        false, -1, NULL);
-    if (!scsidev) {
-        return -1;
-    }
-    dinfo->unit = scsidev->id;
-
-    if (printinfo)
-        monitor_printf(mon, "OK bus %d, unit %d\n",
-                       scsibus->busnr, scsidev->id);
-    return 0;
-}
-
-int pci_drive_hot_add(Monitor *mon, const QDict *qdict, DriveInfo *dinfo)
-{
-    int dom, pci_bus;
-    unsigned slot;
-    PCIDevice *dev;
-    const char *pci_addr = qdict_get_str(qdict, "pci_addr");
-
-    switch (dinfo->type) {
-    case IF_SCSI:
-        if (pci_read_devaddr(mon, pci_addr, &dom, &pci_bus, &slot)) {
-            goto err;
-        }
-        dev = pci_find_device(pci_find_root_bus(dom), pci_bus,
-                              PCI_DEVFN(slot, 0));
-        if (!dev) {
-            monitor_printf(mon, "no pci device with address %s\n", pci_addr);
-            goto err;
-        }
-        if (scsi_hot_add(mon, &dev->qdev, dinfo, 1) != 0) {
-            goto err;
-        }
-        break;
-    default:
-        monitor_printf(mon, "Can't hot-add drive to type %d\n", dinfo->type);
-        goto err;
-    }
-
-    return 0;
-err:
-    return -1;
-}
-
-static PCIDevice *qemu_pci_hot_add_storage(Monitor *mon,
-                                           const char *devaddr,
-                                           const char *opts)
-{
-    PCIDevice *dev;
-    DriveInfo *dinfo = NULL;
-    int type = -1;
-    char buf[128];
-    PCIBus *bus;
-    int devfn;
-
-    if (get_param_value(buf, sizeof(buf), "if", opts)) {
-        if (!strcmp(buf, "scsi"))
-            type = IF_SCSI;
-        else if (!strcmp(buf, "virtio")) {
-            type = IF_VIRTIO;
-        } else {
-            monitor_printf(mon, "type %s not a hotpluggable PCI device.\n", buf);
-            return NULL;
-        }
-    } else {
-        monitor_printf(mon, "no if= specified\n");
-        return NULL;
-    }
-
-    if (get_param_value(buf, sizeof(buf), "file", opts)) {
-        dinfo = add_init_drive(opts);
-        if (!dinfo)
-            return NULL;
-        if (dinfo->devaddr) {
-            monitor_printf(mon, "Parameter addr not supported\n");
-            return NULL;
-        }
-    } else {
-        dinfo = NULL;
-    }
-
-    bus = pci_get_bus_devfn(&devfn, devaddr);
-    if (!bus) {
-        monitor_printf(mon, "Invalid PCI device address %s\n", devaddr);
-        return NULL;
-    }
-    if (!((BusState*)bus)->allow_hotplug) {
-        monitor_printf(mon, "PCI bus doesn't support hotplug\n");
-        return NULL;
-    }
-
-    switch (type) {
-    case IF_SCSI:
-        dev = pci_create(bus, devfn, "lsi53c895a");
-        if (qdev_init(&dev->qdev) < 0)
-            dev = NULL;
-        if (dev && dinfo) {
-            if (scsi_hot_add(mon, &dev->qdev, dinfo, 0) != 0) {
-                qdev_unplug(&dev->qdev, NULL);
-                dev = NULL;
-            }
-        }
-        break;
-    case IF_VIRTIO:
-        if (!dinfo) {
-            monitor_printf(mon, "virtio requires a backing file/device.\n");
-            return NULL;
-        }
-        dev = pci_create(bus, devfn, "virtio-blk-pci");
-        if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
-            qdev_free(&dev->qdev);
-            dev = NULL;
-            break;
-        }
-        if (qdev_init(&dev->qdev) < 0)
-            dev = NULL;
-        break;
-    default:
-        dev = NULL;
-    }
-    return dev;
-}
-
-void pci_device_hot_add(Monitor *mon, const QDict *qdict)
-{
-    PCIDevice *dev = NULL;
-    const char *pci_addr = qdict_get_str(qdict, "pci_addr");
-    const char *type = qdict_get_str(qdict, "type");
-    const char *opts = qdict_get_try_str(qdict, "opts");
-
-    /* strip legacy tag */
-    if (!strncmp(pci_addr, "pci_addr=", 9)) {
-        pci_addr += 9;
-    }
-
-    if (!opts) {
-        opts = "";
-    }
-
-    if (!strcmp(pci_addr, "auto"))
-        pci_addr = NULL;
-
-    if (strcmp(type, "nic") == 0) {
-        dev = qemu_pci_hot_add_nic(mon, pci_addr, opts);
-    } else if (strcmp(type, "storage") == 0) {
-        dev = qemu_pci_hot_add_storage(mon, pci_addr, opts);
-    } else {
-        monitor_printf(mon, "invalid type: %s\n", type);
-    }
-
-    if (dev) {
-        monitor_printf(mon, "OK domain %d, bus %d, slot %d, function %d\n",
-                       pci_find_domain(dev->bus),
-                       pci_bus_num(dev->bus), PCI_SLOT(dev->devfn),
-                       PCI_FUNC(dev->devfn));
-    } else
-        monitor_printf(mon, "failed to add %s\n", opts);
-}
-#endif
-
-static int pci_device_hot_remove(Monitor *mon, const char *pci_addr)
-{
-    PCIDevice *d;
-    int dom, bus;
-    unsigned slot;
-    Error *local_err = NULL;
-
-    if (pci_read_devaddr(mon, pci_addr, &dom, &bus, &slot)) {
-        return -1;
-    }
-
-    d = pci_find_device(pci_find_root_bus(dom), bus, PCI_DEVFN(slot, 0));
-    if (!d) {
-        monitor_printf(mon, "slot %d empty\n", slot);
-        return -1;
-    }
-
-    qdev_unplug(&d->qdev, &local_err);
-    if (error_is_set(&local_err)) {
-        monitor_printf(mon, "%s\n", error_get_pretty(local_err));
-        error_free(local_err);
-        return -1;
-    }
-
-    return 0;
-}
-
-void do_pci_device_hot_remove(Monitor *mon, const QDict *qdict)
-{
-    pci_device_hot_remove(mon, qdict_get_str(qdict, "pci_addr"));
-}
commit fea7d5966a54a5e5400cd38897a95ea576b5af4d
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Jun 16 23:48:42 2013 +0300

    pvpanic: fix fwcfg for big endian hosts
    
    Convert port number to little endian when
    exposing it in fw cfg.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index 83ed226..792d8e4 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -104,10 +104,11 @@ static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
 static void pvpanic_fw_cfg(ISADevice *dev, FWCfgState *fw_cfg)
 {
     PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
+    uint16_t *pvpanic_port = g_malloc(sizeof(*pvpanic_port));
+    *pvpanic_port = cpu_to_le16(s->ioport);
 
-    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port",
-                    g_memdup(&s->ioport, sizeof(s->ioport)),
-                    sizeof(s->ioport));
+    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
+                    sizeof(*pvpanic_port));
 }
 
 void pvpanic_init(ISABus *bus)
commit bc3e6a0d6c8ab6cd7cd4b576ed567756f1dcabd2
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Jun 16 18:31:30 2013 +0300

    pvpanic: initialization cleanup
    
    Avoid use of static variables: PC systems
    initialize pvpanic device through pvpanic_init,
    so we can simply create the fw_cfg file at that point.
    This also makes it possible to skip device
    creation completely if fw_cfg is not there, e.g. for xen -
    so the ports it reserves are not discoverable by guests.
    
    Also, make pvpanic_init void since callers ignore return
    status anyway.
    
    Cc: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Cc: Laszlo Ersek <lersek at redhat.com>
    Cc: Paul Durrant <Paul.Durrant at citrix.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index 060099b..83ed226 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -97,26 +97,28 @@ static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
 {
     ISADevice *d = ISA_DEVICE(dev);
     PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
-    static bool port_configured;
-    FWCfgState *fw_cfg;
 
     isa_register_ioport(d, &s->io, s->ioport);
+}
 
-    if (!port_configured) {
-        fw_cfg = fw_cfg_find();
-        if (fw_cfg) {
-            fw_cfg_add_file(fw_cfg, "etc/pvpanic-port",
-                            g_memdup(&s->ioport, sizeof(s->ioport)),
-                            sizeof(s->ioport));
-            port_configured = true;
-        }
-    }
+static void pvpanic_fw_cfg(ISADevice *dev, FWCfgState *fw_cfg)
+{
+    PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
+
+    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port",
+                    g_memdup(&s->ioport, sizeof(s->ioport)),
+                    sizeof(s->ioport));
 }
 
-int pvpanic_init(ISABus *bus)
+void pvpanic_init(ISABus *bus)
 {
-    isa_create_simple(bus, TYPE_ISA_PVPANIC_DEVICE);
-    return 0;
+    ISADevice *dev;
+    FWCfgState *fw_cfg = fw_cfg_find();
+    if (!fw_cfg) {
+        return;
+    }
+    dev = isa_create_simple (bus, TYPE_ISA_PVPANIC_DEVICE);
+    pvpanic_fw_cfg(dev, fw_cfg);
 }
 
 static Property pvpanic_isa_properties[] = {
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index dbdd523..5949e7e 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -193,7 +193,7 @@ static inline bool isa_ne2000_init(ISABus *bus, int base, int irq, NICInfo *nd)
 void pc_system_firmware_init(MemoryRegion *rom_memory);
 
 /* pvpanic.c */
-int pvpanic_init(ISABus *bus);
+void pvpanic_init(ISABus *bus);
 
 /* e820 types */
 #define E820_RAM        1
commit c6d559d9cf8687d8378e888e7570c07ce53b94e2
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Jun 4 16:06:37 2013 +0300

    MAINTAINERS: s/Marcelo/Paolo/
    
    Marcelo doesn't maintain kvm anymore,
    Paolo is taking over the job.
    Update MAINTAINERS to stop flooding Marcelo with mail.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index ad9c860..11dffee 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -155,7 +155,7 @@ Guest CPU Cores (KVM):
 
 Overall
 M: Gleb Natapov <gleb at redhat.com>
-M: Marcelo Tosatti <mtosatti at redhat.com>
+M: Paolo Bonzini <pbonzini at redhat.com>
 L: kvm at vger.kernel.org
 S: Supported
 F: kvm-*
commit a0ae17a63e08a57a644eacc1f0fd89d535ed36bf
Author: Andrew Jones <drjones at redhat.com>
Date:   Tue Jun 4 10:49:48 2013 +0200

    e1000: cleanup process_tx_desc
    
    Coverity complains about two overruns in process_tx_desc(). The
    complaints are false positives, but we might as well eliminate
    them. The problem is that "hdr" is defined as an unsigned int,
    but then used to offset an array of size 65536, and another of
    size 256 bytes. hdr will actually never be greater than 255
    though, as it's assigned only once and to the value of
    tp->hdr_len, which is an uint8_t. This patch simply gets rid of
    hdr, replacing it with tp->hdr_len, which makes it consistent
    with all other tp member use in the function.
    
    v2:
     - also cleanup coding style issues in the touched lines
    
    Signed-off-by: Andrew Jones <drjones at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index e6f46f0..620f947 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -556,7 +556,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
     uint32_t txd_lower = le32_to_cpu(dp->lower.data);
     uint32_t dtype = txd_lower & (E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_D);
     unsigned int split_size = txd_lower & 0xffff, bytes, sz, op;
-    unsigned int msh = 0xfffff, hdr = 0;
+    unsigned int msh = 0xfffff;
     uint64_t addr;
     struct e1000_context_desc *xp = (struct e1000_context_desc *)dp;
     struct e1000_tx *tp = &s->tx;
@@ -603,8 +603,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         
     addr = le64_to_cpu(dp->buffer_addr);
     if (tp->tse && tp->cptse) {
-        hdr = tp->hdr_len;
-        msh = hdr + tp->mss;
+        msh = tp->hdr_len + tp->mss;
         do {
             bytes = split_size;
             if (tp->size + bytes > msh)
@@ -612,14 +611,16 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
 
             bytes = MIN(sizeof(tp->data) - tp->size, bytes);
             pci_dma_read(&s->dev, addr, tp->data + tp->size, bytes);
-            if ((sz = tp->size + bytes) >= hdr && tp->size < hdr)
-                memmove(tp->header, tp->data, hdr);
+            sz = tp->size + bytes;
+            if (sz >= tp->hdr_len && tp->size < tp->hdr_len) {
+                memmove(tp->header, tp->data, tp->hdr_len);
+            }
             tp->size = sz;
             addr += bytes;
             if (sz == msh) {
                 xmit_seg(s);
-                memmove(tp->data, tp->header, hdr);
-                tp->size = hdr;
+                memmove(tp->data, tp->header, tp->hdr_len);
+                tp->size = tp->hdr_len;
             }
         } while (split_size -= bytes);
     } else if (!tp->tse && tp->cptse) {
@@ -633,8 +634,9 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
 
     if (!(txd_lower & E1000_TXD_CMD_EOP))
         return;
-    if (!(tp->tse && tp->cptse && tp->size < hdr))
+    if (!(tp->tse && tp->cptse && tp->size < tp->hdr_len)) {
         xmit_seg(s);
+    }
     tp->tso_frames = 0;
     tp->sum_needed = 0;
     tp->vlan_needed = 0;
commit fcbe0a707a227ea25f06382e61ff9b2761c77661
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Jun 18 17:11:42 2013 +0300

    pc_piix: cleanup init compat handling
    
    Make sure 1.4 calls 1.5, 1.3 calls 1.4 etc.
    This way it's enough to add enough new compat hook
    in a single place in piix.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 8a18dbe..e393022 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -270,38 +270,28 @@ static void pc_init_pci_1_5(QEMUMachineInitArgs *args)
 
 static void pc_init_pci_1_4(QEMUMachineInitArgs *args)
 {
-    has_pci_info = false;
     has_pvpanic = false;
     x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE);
-    pc_init_pci(args);
+    pc_init_pci_1_5(args);
 }
 
 static void pc_init_pci_1_3(QEMUMachineInitArgs *args)
 {
-    has_pci_info = false;
     enable_compat_apic_id_mode();
-    has_pvpanic = false;
-    pc_init_pci(args);
+    pc_init_pci_1_4(args);
 }
 
 /* PC machine init function for pc-1.1 to pc-1.2 */
 static void pc_init_pci_1_2(QEMUMachineInitArgs *args)
 {
-    has_pci_info = false;
     disable_kvm_pv_eoi();
-    enable_compat_apic_id_mode();
-    has_pvpanic = false;
-    pc_init_pci(args);
+    pc_init_pci_1_3(args);
 }
 
 /* PC machine init function for pc-0.14 to pc-1.0 */
 static void pc_init_pci_1_0(QEMUMachineInitArgs *args)
 {
-    has_pci_info = false;
-    disable_kvm_pv_eoi();
-    enable_compat_apic_id_mode();
-    has_pvpanic = false;
-    pc_init_pci(args);
+    pc_init_pci_1_2(args);
 }
 
 /* PC init function for pc-0.10 to pc-0.13, and reused by xenfv */
commit f8c457b88d72a48989f190bc3d7b79f4f3b7d11c
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon May 13 20:00:23 2013 +0300

    pc: pass PCI hole ranges to Guests
    
    Guest currently has to jump through lots of hoops to guess the PCI hole
    ranges.  It's fragile, and makes us change BIOS each time we add a new
    chipset.  Let's report the window in a ROM file, to make BIOS do exactly
    what QEMU intends.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 8af1e4e..7c4794c 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -989,6 +989,31 @@ void pc_cpus_init(const char *cpu_model, DeviceState *icc_bridge)
     }
 }
 
+/* pci-info ROM file. Little endian format */
+typedef struct PcRomPciInfo {
+    uint64_t w32_min;
+    uint64_t w32_max;
+    uint64_t w64_min;
+    uint64_t w64_max;
+} PcRomPciInfo;
+
+static void pc_fw_cfg_guest_info(PcGuestInfo *guest_info)
+{
+    PcRomPciInfo *info;
+    if (!guest_info->has_pci_info) {
+        return;
+    }
+
+    info = g_malloc(sizeof *info);
+    info->w32_min = cpu_to_le64(guest_info->pci_info.w32.begin);
+    info->w32_max = cpu_to_le64(guest_info->pci_info.w32.end);
+    info->w64_min = cpu_to_le64(guest_info->pci_info.w64.begin);
+    info->w64_max = cpu_to_le64(guest_info->pci_info.w64.end);
+    /* Pass PCI hole info to guest via a side channel.
+     * Required so guest PCI enumeration does the right thing. */
+    fw_cfg_add_file(guest_info->fw_cfg, "etc/pci-info", info, sizeof *info);
+}
+
 typedef struct PcGuestInfoState {
     PcGuestInfo info;
     Notifier machine_done;
@@ -1000,6 +1025,7 @@ void pc_guest_info_machine_done(Notifier *notifier, void *data)
     PcGuestInfoState *guest_info_state = container_of(notifier,
                                                       PcGuestInfoState,
                                                       machine_done);
+    pc_fw_cfg_guest_info(&guest_info_state->info);
 }
 
 PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 4637bde..8a18dbe 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -57,6 +57,7 @@ static const int ide_iobase2[MAX_IDE_BUS] = { 0x3f6, 0x376 };
 static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
 
 static bool has_pvpanic = true;
+static bool has_pci_info = true;
 
 /* PC hardware initialisation */
 static void pc_init1(MemoryRegion *system_memory,
@@ -126,6 +127,7 @@ static void pc_init1(MemoryRegion *system_memory,
     }
 
     guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size);
+    guest_info->has_pci_info = has_pci_info;
 
     /* Set PCI window size the way seabios has always done it. */
     /* Power of 2 so bios can cover it with a single MTRR */
@@ -260,8 +262,15 @@ static void pc_init_pci(QEMUMachineInitArgs *args)
              initrd_filename, cpu_model, 1, 1);
 }
 
+static void pc_init_pci_1_5(QEMUMachineInitArgs *args)
+{
+    has_pci_info = false;
+    pc_init_pci(args);
+}
+
 static void pc_init_pci_1_4(QEMUMachineInitArgs *args)
 {
+    has_pci_info = false;
     has_pvpanic = false;
     x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE);
     pc_init_pci(args);
@@ -269,6 +278,7 @@ static void pc_init_pci_1_4(QEMUMachineInitArgs *args)
 
 static void pc_init_pci_1_3(QEMUMachineInitArgs *args)
 {
+    has_pci_info = false;
     enable_compat_apic_id_mode();
     has_pvpanic = false;
     pc_init_pci(args);
@@ -277,6 +287,7 @@ static void pc_init_pci_1_3(QEMUMachineInitArgs *args)
 /* PC machine init function for pc-1.1 to pc-1.2 */
 static void pc_init_pci_1_2(QEMUMachineInitArgs *args)
 {
+    has_pci_info = false;
     disable_kvm_pv_eoi();
     enable_compat_apic_id_mode();
     has_pvpanic = false;
@@ -286,6 +297,7 @@ static void pc_init_pci_1_2(QEMUMachineInitArgs *args)
 /* PC machine init function for pc-0.14 to pc-1.0 */
 static void pc_init_pci_1_0(QEMUMachineInitArgs *args)
 {
+    has_pci_info = false;
     disable_kvm_pv_eoi();
     enable_compat_apic_id_mode();
     has_pvpanic = false;
@@ -302,6 +314,7 @@ static void pc_init_pci_no_kvmclock(QEMUMachineInitArgs *args)
     const char *initrd_filename = args->initrd_filename;
     const char *boot_device = args->boot_device;
     has_pvpanic = false;
+    has_pci_info = false;
     disable_kvm_pv_eoi();
     enable_compat_apic_id_mode();
     pc_init1(get_system_memory(),
@@ -320,6 +333,7 @@ static void pc_init_isa(QEMUMachineInitArgs *args)
     const char *initrd_filename = args->initrd_filename;
     const char *boot_device = args->boot_device;
     has_pvpanic = false;
+    has_pci_info = false;
     if (cpu_model == NULL)
         cpu_model = "486";
     disable_kvm_pv_eoi();
@@ -359,7 +373,7 @@ static QEMUMachine pc_i440fx_machine_v1_6 = {
 static QEMUMachine pc_i440fx_machine_v1_5 = {
     .name = "pc-i440fx-1.5",
     .desc = "Standard PC (i440FX + PIIX, 1996)",
-    .init = pc_init_pci,
+    .init = pc_init_pci_1_5,
     .hot_add_cpu = pc_hot_add_cpu,
     .max_cpus = 255,
     .compat_props = (GlobalProperty[]) {
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index a13acf2..5b92160 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -47,6 +47,7 @@
 #define MAX_SATA_PORTS     6
 
 static bool has_pvpanic = true;
+static bool has_pci_info = true;
 
 /* PC hardware initialisation */
 static void pc_q35_init(QEMUMachineInitArgs *args)
@@ -107,6 +108,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     }
 
     guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size);
+    guest_info->has_pci_info = has_pci_info;
 
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
@@ -212,11 +214,17 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     }
 }
 
+static void pc_q35_init_1_5(QEMUMachineInitArgs *args)
+{
+    has_pci_info = false;
+    pc_q35_init(args);
+}
+
 static void pc_q35_init_1_4(QEMUMachineInitArgs *args)
 {
     has_pvpanic = false;
     x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE);
-    pc_q35_init(args);
+    pc_q35_init_1_5(args);
 }
 
 static QEMUMachine pc_q35_machine_v1_6 = {
@@ -232,7 +240,7 @@ static QEMUMachine pc_q35_machine_v1_6 = {
 static QEMUMachine pc_q35_machine_v1_5 = {
     .name = "pc-q35-1.5",
     .desc = "Standard PC (Q35 + ICH9, 2009)",
-    .init = pc_q35_init,
+    .init = pc_q35_init_1_5,
     .hot_add_cpu = pc_hot_add_cpu,
     .max_cpus = 255,
     .compat_props = (GlobalProperty[]) {
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index eaf6a5d..dbdd523 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -20,6 +20,7 @@ typedef struct PcPciInfo {
 
 struct PcGuestInfo {
     PcPciInfo pci_info;
+    bool has_pci_info;
     FWCfgState *fw_cfg;
 };
 
commit 3459a625215449b67b9c67d9151ff72892d0a42a
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu May 30 12:57:26 2013 +0300

    pci: store PCI hole ranges in guestinfo structure
    
    Will be used to pass hole ranges to guests.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 78f92e2..8af1e4e 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -989,6 +989,48 @@ void pc_cpus_init(const char *cpu_model, DeviceState *icc_bridge)
     }
 }
 
+typedef struct PcGuestInfoState {
+    PcGuestInfo info;
+    Notifier machine_done;
+} PcGuestInfoState;
+
+static
+void pc_guest_info_machine_done(Notifier *notifier, void *data)
+{
+    PcGuestInfoState *guest_info_state = container_of(notifier,
+                                                      PcGuestInfoState,
+                                                      machine_done);
+}
+
+PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
+                                ram_addr_t above_4g_mem_size)
+{
+    PcGuestInfoState *guest_info_state = g_malloc0(sizeof *guest_info_state);
+    PcGuestInfo *guest_info = &guest_info_state->info;
+
+    guest_info->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
+    if (sizeof(hwaddr) == 4) {
+        guest_info->pci_info.w64.begin = 0;
+        guest_info->pci_info.w64.end = 0;
+    } else {
+        /*
+         * BIOS does not set MTRR entries for the 64 bit window, so no need to
+         * align address to power of two.  Align address at 1G, this makes sure
+         * it can be exactly covered with a PAT entry even when using huge
+         * pages.
+         */
+        guest_info->pci_info.w64.begin =
+            ROUND_UP((0x1ULL << 32) + above_4g_mem_size, 0x1ULL << 30);
+        guest_info->pci_info.w64.end = guest_info->pci_info.w64.begin +
+            (0x1ULL << 62);
+        assert(guest_info->pci_info.w64.begin <= guest_info->pci_info.w64.end);
+    }
+
+    guest_info_state->machine_done.notify = pc_guest_info_machine_done;
+    qemu_add_machine_init_done_notifier(&guest_info_state->machine_done);
+    return guest_info;
+}
+
 void pc_acpi_init(const char *default_dsdt)
 {
     char *filename;
@@ -1030,7 +1072,8 @@ FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            ram_addr_t below_4g_mem_size,
                            ram_addr_t above_4g_mem_size,
                            MemoryRegion *rom_memory,
-                           MemoryRegion **ram_memory)
+                           MemoryRegion **ram_memory,
+                           PcGuestInfo *guest_info)
 {
     int linux_boot, i;
     MemoryRegion *ram, *option_rom_mr;
@@ -1082,6 +1125,7 @@ FWCfgState *pc_memory_init(MemoryRegion *system_memory,
     for (i = 0; i < nb_option_roms; i++) {
         rom_add_option(option_rom[i].name, option_rom[i].bootindex);
     }
+    guest_info->fw_cfg = fw_cfg;
     return fw_cfg;
 }
 
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index fa59a0c..4637bde 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -90,6 +90,7 @@ static void pc_init1(MemoryRegion *system_memory,
     MemoryRegion *rom_memory;
     DeviceState *icc_bridge;
     FWCfgState *fw_cfg = NULL;
+    PcGuestInfo *guest_info;
 
     if (xen_enabled() && xen_hvm_init() != 0) {
         fprintf(stderr, "xen hardware virtual machine initialisation failed\n");
@@ -124,12 +125,23 @@ static void pc_init1(MemoryRegion *system_memory,
         rom_memory = system_memory;
     }
 
+    guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size);
+
+    /* Set PCI window size the way seabios has always done it. */
+    /* Power of 2 so bios can cover it with a single MTRR */
+    if (ram_size <= 0x80000000)
+        guest_info->pci_info.w32.begin = 0x80000000;
+    else if (ram_size <= 0xc0000000)
+        guest_info->pci_info.w32.begin = 0xc0000000;
+    else
+        guest_info->pci_info.w32.begin = 0xe0000000;
+
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
         fw_cfg = pc_memory_init(system_memory,
                        kernel_filename, kernel_cmdline, initrd_filename,
                        below_4g_mem_size, above_4g_mem_size,
-                       rom_memory, &ram_memory);
+                       rom_memory, &ram_memory, guest_info);
     }
 
     gsi_state = g_malloc0(sizeof(*gsi_state));
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index bb0ce6a..a13acf2 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -77,6 +77,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     ICH9LPCState *ich9_lpc;
     PCIDevice *ahci;
     DeviceState *icc_bridge;
+    PcGuestInfo *guest_info;
 
     icc_bridge = qdev_create(NULL, TYPE_ICC_BRIDGE);
     object_property_add_child(qdev_get_machine(), "icc-bridge",
@@ -105,11 +106,13 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
         rom_memory = get_system_memory();
     }
 
+    guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size);
+
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
         pc_memory_init(get_system_memory(), kernel_filename, kernel_cmdline,
                        initrd_filename, below_4g_mem_size, above_4g_mem_size,
-                       rom_memory, &ram_memory);
+                       rom_memory, &ram_memory, guest_info);
     }
 
     /* irq lines */
@@ -131,6 +134,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     q35_host->mch.address_space_io = get_system_io();
     q35_host->mch.below_4g_mem_size = below_4g_mem_size;
     q35_host->mch.above_4g_mem_size = above_4g_mem_size;
+    q35_host->mch.guest_info = guest_info;
     /* pci */
     qdev_init_nofail(DEVICE(q35_host));
     host_bus = q35_host->host.pci.bus;
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 24df6b5..3a5cff9 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -244,6 +244,14 @@ static int mch_init(PCIDevice *d)
     hwaddr pci_hole64_size;
     MCHPCIState *mch = MCH_PCI_DEVICE(d);
 
+    /* Leave enough space for the biggest MCFG BAR */
+    /* TODO: this matches current bios behaviour, but
+     * it's not a power of two, which means an MTRR
+     * can't cover it exactly.
+     */
+    mch->guest_info->pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
+        MCH_HOST_BRIDGE_PCIEXBAR_MAX;
+
     /* setup pci memory regions */
     memory_region_init_alias(&mch->pci_hole, "pci-hole",
                              mch->pci_address_space,
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index a417402..eaf6a5d 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -9,8 +9,20 @@
 #include "net/net.h"
 #include "hw/i386/ioapic.h"
 
+#include "qemu/range.h"
+
 /* PC-style peripherals (also used by other machines).  */
 
+typedef struct PcPciInfo {
+    Range w32;
+    Range w64;
+} PcPciInfo;
+
+struct PcGuestInfo {
+    PcPciInfo pci_info;
+    FWCfgState *fw_cfg;
+};
+
 /* parallel.c */
 static inline bool parallel_init(ISABus *bus, int index, CharDriverState *chr)
 {
@@ -82,6 +94,10 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level);
 void pc_cpus_init(const char *cpu_model, DeviceState *icc_bridge);
 void pc_hot_add_cpu(const int64_t id, Error **errp);
 void pc_acpi_init(const char *default_dsdt);
+
+PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
+                                ram_addr_t above_4g_mem_size);
+
 FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            const char *kernel_filename,
                            const char *kernel_cmdline,
@@ -89,7 +105,8 @@ FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            ram_addr_t below_4g_mem_size,
                            ram_addr_t above_4g_mem_size,
                            MemoryRegion *rom_memory,
-                           MemoryRegion **ram_memory);
+                           MemoryRegion **ram_memory,
+                           PcGuestInfo *guest_info);
 qemu_irq *pc_allocate_cpu_irq(void);
 DeviceState *pc_vga_init(ISABus *isa_bus, PCIBus *pci_bus);
 void pc_basic_device_init(ISABus *isa_bus, qemu_irq *gsi,
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index e182c82..b083831 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -55,6 +55,7 @@ typedef struct MCHPCIState {
     uint8_t smm_enabled;
     ram_addr_t below_4g_mem_size;
     ram_addr_t above_4g_mem_size;
+    PcGuestInfo *guest_info;
 } MCHPCIState;
 
 typedef struct Q35PCIHost {
@@ -81,6 +82,7 @@ typedef struct Q35PCIHost {
 #define MCH_HOST_BRIDGE_PCIEXBAR               0x60    /* 64bit register */
 #define MCH_HOST_BRIDGE_PCIEXBAR_SIZE          8       /* 64bit register */
 #define MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT       0xb0000000
+#define MCH_HOST_BRIDGE_PCIEXBAR_MAX           (0x10000000) /* 256M */
 #define MCH_HOST_BRIDGE_PCIEXBAR_ADMSK         Q35_MASK(64, 35, 28)
 #define MCH_HOST_BRIDGE_PCIEXBAR_128ADMSK      ((uint64_t)(1 << 26))
 #define MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK       ((uint64_t)(1 << 25))
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index 698fc03..ac9f8d4 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -64,5 +64,6 @@ typedef struct VirtIODevice VirtIODevice;
 typedef struct QEMUSGList QEMUSGList;
 typedef struct SHPCDevice SHPCDevice;
 typedef struct FWCfgState FWCfgState;
+typedef struct PcGuestInfo PcGuestInfo;
 
 #endif /* QEMU_TYPEDEFS_H */
commit 620ac82eb0fc4218fb6a4937bcef3fdab3126703
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon May 13 17:13:15 2013 +0300

    range: add Range structure
    
    Sometimes we need to pass ranges around, add a
    handy structure for this purpose.
    
    Note: memory.c defines its own concept of AddrRange structure for
    working with 128 addresses.  It's necessary there for doing range math.
    This is not needed for most users: struct Range is
    much simpler, and is only used for passing the range around.
    
    Cc: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/include/qemu/range.h b/include/qemu/range.h
index 3502372..b76cc0d 100644
--- a/include/qemu/range.h
+++ b/include/qemu/range.h
@@ -1,6 +1,22 @@
 #ifndef QEMU_RANGE_H
 #define QEMU_RANGE_H
 
+#include <inttypes.h>
+
+/*
+ * Operations on 64 bit address ranges.
+ * Notes:
+ *   - ranges must not wrap around 0, but can include the last byte ~0x0LL.
+ *   - this can not represent a full 0 to ~0x0LL range.
+ */
+
+/* A structure representing a range of addresses. */
+struct Range {
+    uint64_t begin; /* First byte of the range, or 0 if empty. */
+    uint64_t end;   /* 1 + the last byte. 0 if range empty or ends at ~0x0LL. */
+};
+typedef struct Range Range;
+
 /* Get last byte of a range from offset + length.
  * Undefined for ranges that wrap around 0. */
 static inline uint64_t range_get_last(uint64_t offset, uint64_t len)
commit ab8bf29078e0ab8347e2ff8b4e5542f7a0c751cf
Merge: 1acd5a3 00f4d64
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Jul 3 08:36:59 2013 -0500

    Merge remote-tracking branch 'qemu-kvm/uq/master' into staging
    
    # By Michael S. Tsirkin (2) and others
    # Via Paolo Bonzini
    * qemu-kvm/uq/master:
      kvmclock: clock should count only if vm is running
      pci-assign: remove the duplicate function name in debug message
      kvm: skip system call when msi route is unchanged
      kvm: zero-initialize KVM_SET_GSI_ROUTING input
      kvm: add detail error message when fail to add ioeventfd
    
    Message-id: 1372841072-22265-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit b1f6dc0d2a03f0e114cc5ff08b0a133e24fd55ad
Author: Claudio Fontana <claudio.fontana at huawei.com>
Date:   Tue Jun 11 10:14:09 2013 +0200

    tcg/aarch64: implement ldst 12bit scaled uimm offset
    
    implement the 12bit scaled unsigned immediate offset
    variant of LDR/STR. This improves code size by avoiding
    the movi + ldst_r for naturally aligned offsets in range.
    
    Signed-off-by: Claudio Fontana <claudio.fontana at huawei.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/aarch64/tcg-target.c b/tcg/aarch64/tcg-target.c
index 562a549..cfd4081 100644
--- a/tcg/aarch64/tcg-target.c
+++ b/tcg/aarch64/tcg-target.c
@@ -315,6 +315,17 @@ static inline void tcg_out_ldst_9(TCGContext *s,
     tcg_out32(s, op_data << 24 | mod << 20 | off << 12 | rn << 5 | rd);
 }
 
+/* tcg_out_ldst_12 expects a scaled unsigned immediate offset */
+static inline void tcg_out_ldst_12(TCGContext *s,
+                                   enum aarch64_ldst_op_data op_data,
+                                   enum aarch64_ldst_op_type op_type,
+                                   TCGReg rd, TCGReg rn,
+                                   tcg_target_ulong scaled_uimm)
+{
+    tcg_out32(s, (op_data | 1) << 24
+              | op_type << 20 | scaled_uimm << 10 | rn << 5 | rd);
+}
+
 static inline void tcg_out_movr(TCGContext *s, int ext, TCGReg rd, TCGReg src)
 {
     /* register to register move using MOV (shifted register with no shift) */
@@ -374,10 +385,25 @@ static inline void tcg_out_ldst(TCGContext *s, enum aarch64_ldst_op_data data,
 {
     if (offset >= -256 && offset < 256) {
         tcg_out_ldst_9(s, data, type, rd, rn, offset);
-    } else {
-        tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP, offset);
-        tcg_out_ldst_r(s, data, type, rd, rn, TCG_REG_TMP);
+        return;
     }
+
+    if (offset >= 256) {
+        /* if the offset is naturally aligned and in range,
+           then we can use the scaled uimm12 encoding */
+        unsigned int s_bits = data >> 6;
+        if (!(offset & ((1 << s_bits) - 1))) {
+            tcg_target_ulong scaled_uimm = offset >> s_bits;
+            if (scaled_uimm <= 0xfff) {
+                tcg_out_ldst_12(s, data, type, rd, rn, scaled_uimm);
+                return;
+            }
+        }
+    }
+
+    /* worst-case scenario, move offset to temp register, use reg offset */
+    tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP, offset);
+    tcg_out_ldst_r(s, data, type, rd, rn, TCG_REG_TMP);
 }
 
 /* mov alias implemented with add immediate, useful to move to/from SP */
commit 00f4d64ee76e873be881a82d893a591487aa7950
Author: Marcelo Tosatti <mtosatti at redhat.com>
Date:   Tue Jun 18 20:38:25 2013 -0300

    kvmclock: clock should count only if vm is running
    
    kvmclock should not count while vm is paused, because:
    
    1) if the vm is paused for long periods, timekeeping
    math can overflow while converting the (large) clocksource
    delta to nanoseconds.
    
    2) Users rely on CLOCK_MONOTONIC to count run time, that is,
    time which OS has been in a runnable state (see CLOCK_BOOTTIME).
    
    Change kvmclock driver so as to save clock value when vm transitions
    from runnable to stopped state, and to restore clock value from stopped
    to runnable transition.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
index 87d4d0f..98e5ca5 100644
--- a/hw/i386/kvm/clock.c
+++ b/hw/i386/kvm/clock.c
@@ -28,38 +28,6 @@ typedef struct KVMClockState {
     bool clock_valid;
 } KVMClockState;
 
-static void kvmclock_pre_save(void *opaque)
-{
-    KVMClockState *s = opaque;
-    struct kvm_clock_data data;
-    int ret;
-
-    if (s->clock_valid) {
-        return;
-    }
-    ret = kvm_vm_ioctl(kvm_state, KVM_GET_CLOCK, &data);
-    if (ret < 0) {
-        fprintf(stderr, "KVM_GET_CLOCK failed: %s\n", strerror(ret));
-        data.clock = 0;
-    }
-    s->clock = data.clock;
-    /*
-     * If the VM is stopped, declare the clock state valid to avoid re-reading
-     * it on next vmsave (which would return a different value). Will be reset
-     * when the VM is continued.
-     */
-    s->clock_valid = !runstate_is_running();
-}
-
-static int kvmclock_post_load(void *opaque, int version_id)
-{
-    KVMClockState *s = opaque;
-    struct kvm_clock_data data;
-
-    data.clock = s->clock;
-    data.flags = 0;
-    return kvm_vm_ioctl(kvm_state, KVM_SET_CLOCK, &data);
-}
 
 static void kvmclock_vm_state_change(void *opaque, int running,
                                      RunState state)
@@ -70,8 +38,18 @@ static void kvmclock_vm_state_change(void *opaque, int running,
     int ret;
 
     if (running) {
+        struct kvm_clock_data data;
+
         s->clock_valid = false;
 
+        data.clock = s->clock;
+        data.flags = 0;
+        ret = kvm_vm_ioctl(kvm_state, KVM_SET_CLOCK, &data);
+        if (ret < 0) {
+            fprintf(stderr, "KVM_SET_CLOCK failed: %s\n", strerror(ret));
+            abort();
+        }
+
         if (!cap_clock_ctrl) {
             return;
         }
@@ -84,6 +62,26 @@ static void kvmclock_vm_state_change(void *opaque, int running,
                 return;
             }
         }
+    } else {
+        struct kvm_clock_data data;
+        int ret;
+
+        if (s->clock_valid) {
+            return;
+        }
+        ret = kvm_vm_ioctl(kvm_state, KVM_GET_CLOCK, &data);
+        if (ret < 0) {
+            fprintf(stderr, "KVM_GET_CLOCK failed: %s\n", strerror(ret));
+            abort();
+        }
+        s->clock = data.clock;
+
+        /*
+         * If the VM is stopped, declare the clock state valid to
+         * avoid re-reading it on next vmsave (which would return
+         * a different value). Will be reset when the VM is continued.
+         */
+        s->clock_valid = true;
     }
 }
 
@@ -100,8 +98,6 @@ static const VMStateDescription kvmclock_vmsd = {
     .version_id = 1,
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
-    .pre_save = kvmclock_pre_save,
-    .post_load = kvmclock_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT64(clock, KVMClockState),
         VMSTATE_END_OF_LIST()
commit bd50cbaa0f34e47c5b82eba1cd1e88143018fa19
Author: Wanlong Gao <gaowanlong at cn.fujitsu.com>
Date:   Wed Jun 19 11:18:39 2013 +0800

    pci-assign: remove the duplicate function name in debug message
    
    While DEBUG() already includes the function name.
    
    Signed-off-by: Wanlong Gao <gaowanlong at cn.fujitsu.com>
    Acked-by: Alex Williamson <alex.williamson at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index 1fb7ad4..eab2d3e 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -226,7 +226,7 @@ static uint32_t slow_bar_readb(void *opaque, hwaddr addr)
     uint32_t r;
 
     r = *in;
-    DEBUG("slow_bar_readl addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
+    DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
 
     return r;
 }
@@ -238,7 +238,7 @@ static uint32_t slow_bar_readw(void *opaque, hwaddr addr)
     uint32_t r;
 
     r = *in;
-    DEBUG("slow_bar_readl addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
+    DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
 
     return r;
 }
@@ -250,7 +250,7 @@ static uint32_t slow_bar_readl(void *opaque, hwaddr addr)
     uint32_t r;
 
     r = *in;
-    DEBUG("slow_bar_readl addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
+    DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
 
     return r;
 }
@@ -260,7 +260,7 @@ static void slow_bar_writeb(void *opaque, hwaddr addr, uint32_t val)
     AssignedDevRegion *d = opaque;
     uint8_t *out = d->u.r_virtbase + addr;
 
-    DEBUG("slow_bar_writeb addr=0x" TARGET_FMT_plx " val=0x%02x\n", addr, val);
+    DEBUG("addr=0x" TARGET_FMT_plx " val=0x%02x\n", addr, val);
     *out = val;
 }
 
@@ -269,7 +269,7 @@ static void slow_bar_writew(void *opaque, hwaddr addr, uint32_t val)
     AssignedDevRegion *d = opaque;
     uint16_t *out = (uint16_t *)(d->u.r_virtbase + addr);
 
-    DEBUG("slow_bar_writew addr=0x" TARGET_FMT_plx " val=0x%04x\n", addr, val);
+    DEBUG("addr=0x" TARGET_FMT_plx " val=0x%04x\n", addr, val);
     *out = val;
 }
 
@@ -278,7 +278,7 @@ static void slow_bar_writel(void *opaque, hwaddr addr, uint32_t val)
     AssignedDevRegion *d = opaque;
     uint32_t *out = (uint32_t *)(d->u.r_virtbase + addr);
 
-    DEBUG("slow_bar_writel addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, val);
+    DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, val);
     *out = val;
 }
 
commit 40509f7f52672fe41c2cce895e187352fc09f53a
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Jun 4 14:52:35 2013 +0300

    kvm: skip system call when msi route is unchanged
    
    Some guests do a large number of mask/unmask
    calls which currently trigger expensive route update
    system calls.
    Detect that route in unchanged and skip the system call.
    
    Reported-by: "Zhanghaoyu (A)" <haoyu.zhang at huawei.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/kvm-all.c b/kvm-all.c
index 745b501..3ee0ac7 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1034,6 +1034,10 @@ static int kvm_update_routing_entry(KVMState *s,
             continue;
         }
 
+        if(!memcmp(entry, new_entry, sizeof *entry)) {
+            return 0;
+        }
+
         *entry = *new_entry;
 
         kvm_irqchip_commit_routes(s);
commit 0fbc20740342713f282b118b4a446c4c43df3f4a
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Jun 4 14:52:32 2013 +0300

    kvm: zero-initialize KVM_SET_GSI_ROUTING input
    
    kvm_add_routing_entry makes an attempt to
    zero-initialize any new routing entry.
    However, it fails to initialize padding
    within the u field of the structure
    kvm_irq_routing_entry.
    
    Other functions like kvm_irqchip_update_msi_route
    also fail to initialize the padding field in
    kvm_irq_routing_entry.
    
    It's better to just make sure all input is initialized.
    
    Once it is, we can also drop complex field by field assignment and just
    do the simple *a = *b to update a route entry.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/kvm-all.c b/kvm-all.c
index 12042f7..745b501 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1016,11 +1016,8 @@ static void kvm_add_routing_entry(KVMState *s,
     }
     n = s->irq_routes->nr++;
     new = &s->irq_routes->entries[n];
-    memset(new, 0, sizeof(*new));
-    new->gsi = entry->gsi;
-    new->type = entry->type;
-    new->flags = entry->flags;
-    new->u = entry->u;
+
+    *new = *entry;
 
     set_gsi(s, entry->gsi);
 }
@@ -1037,9 +1034,7 @@ static int kvm_update_routing_entry(KVMState *s,
             continue;
         }
 
-        entry->type = new_entry->type;
-        entry->flags = new_entry->flags;
-        entry->u = new_entry->u;
+        *entry = *new_entry;
 
         kvm_irqchip_commit_routes(s);
 
@@ -1051,7 +1046,7 @@ static int kvm_update_routing_entry(KVMState *s,
 
 void kvm_irqchip_add_irq_route(KVMState *s, int irq, int irqchip, int pin)
 {
-    struct kvm_irq_routing_entry e;
+    struct kvm_irq_routing_entry e = {};
 
     assert(pin < s->gsi_count);
 
@@ -1164,7 +1159,7 @@ int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
             return virq;
         }
 
-        route = g_malloc(sizeof(KVMMSIRoute));
+        route = g_malloc0(sizeof(KVMMSIRoute));
         route->kroute.gsi = virq;
         route->kroute.type = KVM_IRQ_ROUTING_MSI;
         route->kroute.flags = 0;
@@ -1186,7 +1181,7 @@ int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
 
 int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg)
 {
-    struct kvm_irq_routing_entry kroute;
+    struct kvm_irq_routing_entry kroute = {};
     int virq;
 
     if (!kvm_gsi_routing_enabled()) {
@@ -1213,7 +1208,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg)
 
 int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg)
 {
-    struct kvm_irq_routing_entry kroute;
+    struct kvm_irq_routing_entry kroute = {};
 
     if (!kvm_irqchip_in_kernel()) {
         return -ENOSYS;
commit fa4ba923bd539647ace9d70d226a848bd6a89dac
Author: Amos Kong <akong at redhat.com>
Date:   Wed May 22 12:57:35 2013 +0800

    kvm: add detail error message when fail to add ioeventfd
    
    I try to hotplug 28 * 8 multiple-function devices to guest with
    old host kernel, ioeventfds in host kernel will be exhausted, then
    qemu fails to allocate ioeventfds for blk/nic devices.
    
    It's better to add detail error here.
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/kvm-all.c b/kvm-all.c
index c757dd2..12042f7 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -837,6 +837,8 @@ static void kvm_mem_ioeventfd_add(MemoryListener *listener,
                                data, true, int128_get64(section->size),
                                match_data);
     if (r < 0) {
+        fprintf(stderr, "%s: error adding ioeventfd: %s\n",
+                __func__, strerror(-r));
         abort();
     }
 }
@@ -869,6 +871,8 @@ static void kvm_io_ioeventfd_add(MemoryListener *listener,
                               data, true, int128_get64(section->size),
                               match_data);
     if (r < 0) {
+        fprintf(stderr, "%s: error adding ioeventfd: %s\n",
+                __func__, strerror(-r));
         abort();
     }
 }
commit 6046c620866f6f5c53eaece9f4ad8d44a12e1185
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jun 20 16:19:32 2013 +0200

    int128: optimize and add test cases
    
    For add, the carry only requires checking one of the arguments.
    For sub and neg, we can similarly optimize computation of the
    carry.
    
    For ge, we can just do lexicographic order.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/qemu/int128.h b/include/qemu/int128.h
index bfe7678..9ed47aa 100644
--- a/include/qemu/int128.h
+++ b/include/qemu/int128.h
@@ -1,6 +1,10 @@
 #ifndef INT128_H
 #define INT128_H
 
+#include <assert.h>
+#include <stdint.h>
+#include <stdbool.h>
+
 typedef struct Int128 Int128;
 
 struct Int128 {
@@ -55,21 +59,26 @@ static inline Int128 int128_rshift(Int128 a, int n)
 
 static inline Int128 int128_add(Int128 a, Int128 b)
 {
-    Int128 r = { a.lo + b.lo, a.hi + b.hi };
-    r.hi += (r.lo < a.lo) || (r.lo < b.lo);
-    return r;
+    uint64_t lo = a.lo + b.lo;
+
+    /* a.lo <= a.lo + b.lo < a.lo + k (k is the base, 2^64).  Hence,
+     * a.lo + b.lo >= k implies 0 <= lo = a.lo + b.lo - k < a.lo.
+     * Similarly, a.lo + b.lo < k implies a.lo <= lo = a.lo + b.lo < k.
+     *
+     * So the carry is lo < a.lo.
+     */
+    return (Int128) { lo, (uint64_t)a.hi + b.hi + (lo < a.lo) };
 }
 
 static inline Int128 int128_neg(Int128 a)
 {
-    a.lo = ~a.lo;
-    a.hi = ~a.hi;
-    return int128_add(a, int128_one());
+    uint64_t lo = -a.lo;
+    return (Int128) { lo, ~(uint64_t)a.hi + !lo };
 }
 
 static inline Int128 int128_sub(Int128 a, Int128 b)
 {
-    return int128_add(a, int128_neg(b));
+    return (Int128){ a.lo - b.lo, a.hi - b.hi - (a.lo < b.lo) };
 }
 
 static inline bool int128_nonneg(Int128 a)
@@ -89,7 +98,7 @@ static inline bool int128_ne(Int128 a, Int128 b)
 
 static inline bool int128_ge(Int128 a, Int128 b)
 {
-    return int128_nonneg(int128_sub(a, b));
+    return a.hi > b.hi || (a.hi == b.hi && a.lo >= b.lo);
 }
 
 static inline bool int128_lt(Int128 a, Int128 b)
diff --git a/tests/Makefile b/tests/Makefile
index c107489..279d5f8 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -44,6 +44,9 @@ check-unit-y += tests/test-cutils$(EXESUF)
 gcov-files-test-cutils-y += util/cutils.c
 check-unit-y += tests/test-mul64$(EXESUF)
 gcov-files-test-mul64-y = util/host-utils.c
+check-unit-y += tests/test-int128$(EXESUF)
+# all code tested by test-int128 is inside int128.h
+gcov-files-test-int128-y =
 
 check-block-$(CONFIG_POSIX) += tests/qemu-iotests-quick.sh
 
@@ -75,7 +78,7 @@ test-obj-y = tests/check-qint.o tests/check-qstring.o tests/check-qdict.o \
 	tests/test-string-input-visitor.o tests/test-qmp-output-visitor.o \
 	tests/test-qmp-input-visitor.o tests/test-qmp-input-strict.o \
 	tests/test-qmp-commands.o tests/test-visitor-serialization.o \
-	tests/test-x86-cpuid.o tests/test-mul64.o
+	tests/test-x86-cpuid.o tests/test-mul64.o tests/test-int128.o
 
 test-qapi-obj-y = tests/test-qapi-visit.o tests/test-qapi-types.o
 
@@ -98,6 +101,7 @@ tests/test-hbitmap$(EXESUF): tests/test-hbitmap.o libqemuutil.a libqemustub.a
 tests/test-x86-cpuid$(EXESUF): tests/test-x86-cpuid.o
 tests/test-xbzrle$(EXESUF): tests/test-xbzrle.o xbzrle.o page_cache.o libqemuutil.a
 tests/test-cutils$(EXESUF): tests/test-cutils.o util/cutils.o
+tests/test-int128$(EXESUF): tests/test-int128.o
 
 tests/test-qapi-types.c tests/test-qapi-types.h :\
 $(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
diff --git a/tests/test-int128.c b/tests/test-int128.c
new file mode 100644
index 0000000..5aca032
--- /dev/null
+++ b/tests/test-int128.c
@@ -0,0 +1,212 @@
+/*
+ * Test Int128 arithmetic
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include <glib.h>
+#include <stdio.h>
+#include "qemu/int128.h"
+#include "qemu/osdep.h"
+
+static uint32_t tests[8] = {
+    0x00000000, 0x00000001, 0x7FFFFFFE, 0x7FFFFFFF,
+    0x80000000, 0x80000001, 0xFFFFFFFE, 0xFFFFFFFF,
+};
+
+#define LOW    3ULL
+#define HIGH   (1ULL << 63)
+#define MIDDLE (-1ULL & ~LOW & ~HIGH)
+
+static uint64_t expand16(unsigned x)
+{
+    return (x & LOW) | ((x & 4) ? MIDDLE : 0) | (x & 0x8000 ? HIGH : 0);
+}
+
+static Int128 expand(uint32_t x)
+{
+    uint64_t l, h;
+    l = expand16(x & 65535);
+    h = expand16(x >> 16);
+    return (Int128) {l, h};
+};
+
+static void test_and(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            Int128 a = expand(tests[i]);
+            Int128 b = expand(tests[j]);
+            Int128 r = expand(tests[i] & tests[j]);
+            Int128 s = int128_and(a, b);
+            g_assert_cmpuint(r.lo, ==, s.lo);
+            g_assert_cmpuint(r.hi, ==, s.hi);
+        }
+    }
+}
+
+static void test_add(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            Int128 a = expand(tests[i]);
+            Int128 b = expand(tests[j]);
+            Int128 r = expand(tests[i] + tests[j]);
+            Int128 s = int128_add(a, b);
+            g_assert_cmpuint(r.lo, ==, s.lo);
+            g_assert_cmpuint(r.hi, ==, s.hi);
+        }
+    }
+}
+
+static void test_sub(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            Int128 a = expand(tests[i]);
+            Int128 b = expand(tests[j]);
+            Int128 r = expand(tests[i] - tests[j]);
+            Int128 s = int128_sub(a, b);
+            g_assert_cmpuint(r.lo, ==, s.lo);
+            g_assert_cmpuint(r.hi, ==, s.hi);
+        }
+    }
+}
+
+static void test_neg(void)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        Int128 a = expand(tests[i]);
+        Int128 r = expand(-tests[i]);
+        Int128 s = int128_neg(a);
+        g_assert_cmpuint(r.lo, ==, s.lo);
+        g_assert_cmpuint(r.hi, ==, s.hi);
+    }
+}
+
+static void test_nz(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            Int128 a = expand(tests[i]);
+            g_assert_cmpuint(int128_nz(a), ==, tests[i] != 0);
+        }
+    }
+}
+
+static void test_le(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            /* Signed comparison */
+            int32_t a = (int32_t) tests[i];
+            int32_t b = (int32_t) tests[j];
+            g_assert_cmpuint(int128_le(expand(a), expand(b)), ==, a <= b);
+        }
+    }
+}
+
+static void test_lt(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            /* Signed comparison */
+            int32_t a = (int32_t) tests[i];
+            int32_t b = (int32_t) tests[j];
+            g_assert_cmpuint(int128_lt(expand(a), expand(b)), ==, a < b);
+        }
+    }
+}
+
+static void test_ge(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            /* Signed comparison */
+            int32_t a = (int32_t) tests[i];
+            int32_t b = (int32_t) tests[j];
+            g_assert_cmpuint(int128_ge(expand(a), expand(b)), ==, a >= b);
+        }
+    }
+}
+
+static void test_gt(void)
+{
+    int i, j;
+
+    for (i = 0; i < ARRAY_SIZE(tests); ++i) {
+        for (j = 0; j < ARRAY_SIZE(tests); ++j) {
+            /* Signed comparison */
+            int32_t a = (int32_t) tests[i];
+            int32_t b = (int32_t) tests[j];
+            g_assert_cmpuint(int128_gt(expand(a), expand(b)), ==, a > b);
+        }
+    }
+}
+
+/* Make sure to test undefined behavior at runtime! */
+
+static void __attribute__((__noinline__, __noclone__))
+test_rshift_one(uint32_t x, int n, uint64_t h, uint64_t l)
+{
+    Int128 a = expand(x);
+    Int128 r = int128_rshift(a, n);
+    g_assert_cmpuint(r.lo, ==, l);
+    g_assert_cmpuint(r.hi, ==, h);
+}
+
+static void test_rshift(void)
+{
+    test_rshift_one(0x00010000U, 64, 0x0000000000000000ULL, 0x0000000000000001ULL);
+    test_rshift_one(0x80010000U, 64, 0xFFFFFFFFFFFFFFFFULL, 0x8000000000000001ULL);
+    test_rshift_one(0x7FFE0000U, 64, 0x0000000000000000ULL, 0x7FFFFFFFFFFFFFFEULL);
+    test_rshift_one(0xFFFE0000U, 64, 0xFFFFFFFFFFFFFFFFULL, 0xFFFFFFFFFFFFFFFEULL);
+    test_rshift_one(0x00010000U, 60, 0x0000000000000000ULL, 0x0000000000000010ULL);
+    test_rshift_one(0x80010000U, 60, 0xFFFFFFFFFFFFFFF8ULL, 0x0000000000000010ULL);
+    test_rshift_one(0x00018000U, 60, 0x0000000000000000ULL, 0x0000000000000018ULL);
+    test_rshift_one(0x80018000U, 60, 0xFFFFFFFFFFFFFFF8ULL, 0x0000000000000018ULL);
+    test_rshift_one(0x7FFE0000U, 60, 0x0000000000000007ULL, 0xFFFFFFFFFFFFFFE0ULL);
+    test_rshift_one(0xFFFE0000U, 60, 0xFFFFFFFFFFFFFFFFULL, 0xFFFFFFFFFFFFFFE0ULL);
+    test_rshift_one(0x7FFE8000U, 60, 0x0000000000000007ULL, 0xFFFFFFFFFFFFFFE8ULL);
+    test_rshift_one(0xFFFE8000U, 60, 0xFFFFFFFFFFFFFFFFULL, 0xFFFFFFFFFFFFFFE8ULL);
+    test_rshift_one(0x00018000U,  0, 0x0000000000000001ULL, 0x8000000000000000ULL);
+    test_rshift_one(0x80018000U,  0, 0x8000000000000001ULL, 0x8000000000000000ULL);
+    test_rshift_one(0x7FFE0000U,  0, 0x7FFFFFFFFFFFFFFEULL, 0x0000000000000000ULL);
+    test_rshift_one(0xFFFE0000U,  0, 0xFFFFFFFFFFFFFFFEULL, 0x0000000000000000ULL);
+    test_rshift_one(0x7FFE8000U,  0, 0x7FFFFFFFFFFFFFFEULL, 0x8000000000000000ULL);
+    test_rshift_one(0xFFFE8000U,  0, 0xFFFFFFFFFFFFFFFEULL, 0x8000000000000000ULL);
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+    g_test_add_func("/int128/int128_and", test_and);
+    g_test_add_func("/int128/int128_add", test_add);
+    g_test_add_func("/int128/int128_sub", test_sub);
+    g_test_add_func("/int128/int128_neg", test_neg);
+    g_test_add_func("/int128/int128_nz", test_nz);
+    g_test_add_func("/int128/int128_le", test_le);
+    g_test_add_func("/int128/int128_lt", test_lt);
+    g_test_add_func("/int128/int128_ge", test_ge);
+    g_test_add_func("/int128/int128_gt", test_gt);
+    g_test_add_func("/int128/int128_rshift", test_rshift);
+    return g_test_run();
+}
commit 1acd5a373905ddb28957842256a038956941f332
Merge: f7d1f9d 2345f1c
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 1 09:03:04 2013 -0500

    Merge remote-tracking branch 'agraf/ppc-for-upstream' into staging
    
    # By Alexander Graf (12) and others
    # Via Alexander Graf
    * agraf/ppc-for-upstream: (32 commits)
      PPC: Ignore writes to L2CR
      mac-io: Add escc-legacy memory alias region
      PPC: Newworld: Add second uninorth control register set
      PPC: Newworld: Add uninorth token register
      PPC: Add clock-frequency export for Mac machines
      PPC: Introduce an alias cache for faster lookups
      PPC: Fix GDB read on code area for PPC6xx
      PPC: Add dump_mmu() for 6xx
      target-ppc: Introduce unrealizefn for PowerPCCPU
      booke_ppc: limit booke timer to max when timeout overflow
      Graphics: Switch to 800x600x32 as default mode
      pseries: Update MAINTAINERS information
      target-ppc kvm: save cr register
      pseries: Fix compiler warning (conversion of pointer to integral value)
      spapr-rtas: add CPU argument to RTAS calls
      target-ppc: Change default machine for 64-bit
      ppc: do not register IABR SPR twice for 603e
      target-ppc: Drop redundant flags assignments from CPU families
      mpc8544_guts: Turn qdev initfn into instance_init
      mpc8544_guts: QOM'ify
      ...
    
    Message-id: 1372556709-23868-1-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit f7d1f9d4e74d66cc7c72de46575a61bd6b433360
Merge: d75416e cc3ac9c
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 1 09:02:30 2013 -0500

    Merge remote-tracking branch 'cohuck/virtio-ccw-upstr' into staging
    
    # By Cornelia Huck
    # Via Cornelia Huck
    * cohuck/virtio-ccw-upstr:
      virtio-ccw: fix build breakage on windows
    
    Message-id: 1372669523-4039-1-git-send-email-cornelia.huck at de.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit d75416ef29e477ebeadf9da41677be6f8166e8be
Merge: ffeec22 fbe2e26
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 1 09:02:25 2013 -0500

    Merge remote-tracking branch 'luiz/queue/qmp' into staging
    
    # By Kevin Wolf
    # Via Luiz Capitulino
    * luiz/queue/qmp:
      hmp: Make "info block" output more readable
    
    Message-id: 1372452199-23237-1-git-send-email-lcapitulino at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit cc3ac9c4a6fd0574b767c599e4a582be8f23260d
Author: Cornelia Huck <cornelia.huck at de.ibm.com>
Date:   Fri Jun 28 09:28:06 2013 +0200

    virtio-ccw: fix build breakage on windows
    
    event_notifier_get_fd() is not available on windows hosts. Fix this by
    moving the calls to event_notifier_get_fd() to the kvm code.
    
    Reported-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index faef5dd..e744957 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -79,8 +79,7 @@ static int virtio_ccw_set_guest2host_notifier(VirtioCcwDevice *dev, int n,
             return r;
         }
         virtio_queue_set_host_notifier_fd_handler(vq, true, set_handler);
-        r = s390_assign_subch_ioeventfd(event_notifier_get_fd(notifier), sch_id,
-                                        n, assign);
+        r = s390_assign_subch_ioeventfd(notifier, sch_id, n, assign);
         if (r < 0) {
             error_report("%s: unable to assign ioeventfd: %d", __func__, r);
             virtio_queue_set_host_notifier_fd_handler(vq, false, false);
@@ -89,8 +88,7 @@ static int virtio_ccw_set_guest2host_notifier(VirtioCcwDevice *dev, int n,
         }
     } else {
         virtio_queue_set_host_notifier_fd_handler(vq, false, false);
-        s390_assign_subch_ioeventfd(event_notifier_get_fd(notifier), sch_id,
-                                    n, assign);
+        s390_assign_subch_ioeventfd(notifier, sch_id, n, assign);
         event_notifier_cleanup(notifier);
     }
     return r;
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 918c819..741c4e4 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -1081,7 +1081,8 @@ void kvm_s390_io_interrupt(S390CPU *cpu, uint16_t subchannel_id,
 void kvm_s390_crw_mchk(S390CPU *cpu);
 void kvm_s390_enable_css_support(S390CPU *cpu);
 int kvm_s390_get_registers_partial(CPUState *cpu);
-int kvm_s390_assign_subch_ioeventfd(int fd, uint32_t sch, int vq, bool assign);
+int kvm_s390_assign_subch_ioeventfd(EventNotifier *notifier, uint32_t sch,
+                                    int vq, bool assign);
 #else
 static inline void kvm_s390_io_interrupt(S390CPU *cpu,
                                         uint16_t subchannel_id,
@@ -1100,7 +1101,8 @@ static inline int kvm_s390_get_registers_partial(CPUState *cpu)
 {
     return -ENOSYS;
 }
-static inline int kvm_s390_assign_subch_ioeventfd(int fd, uint32_t sch, int vq,
+static inline int kvm_s390_assign_subch_ioeventfd(EventNotifier *notifier,
+                                                  uint32_t sch, int vq,
                                                   bool assign)
 {
     return -ENOSYS;
@@ -1131,11 +1133,12 @@ static inline void s390_crw_mchk(S390CPU *cpu)
     }
 }
 
-static inline int s390_assign_subch_ioeventfd(int fd, uint32_t sch_id, int vq,
+static inline int s390_assign_subch_ioeventfd(EventNotifier *notifier,
+                                              uint32_t sch_id, int vq,
                                               bool assign)
 {
     if (kvm_enabled()) {
-        return kvm_s390_assign_subch_ioeventfd(fd, sch_id, vq, assign);
+        return kvm_s390_assign_subch_ioeventfd(notifier, sch_id, vq, assign);
     } else {
         return -ENOSYS;
     }
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index b524c35..42f758f 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -934,12 +934,13 @@ void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
 
-int kvm_s390_assign_subch_ioeventfd(int fd, uint32_t sch, int vq, bool assign)
+int kvm_s390_assign_subch_ioeventfd(EventNotifier *notifier, uint32_t sch,
+                                    int vq, bool assign)
 {
     struct kvm_ioeventfd kick = {
         .flags = KVM_IOEVENTFD_FLAG_VIRTIO_CCW_NOTIFY |
         KVM_IOEVENTFD_FLAG_DATAMATCH,
-        .fd = fd,
+        .fd = event_notifier_get_fd(notifier),
         .datamatch = vq,
         .addr = sch,
         .len = 8,
commit 2345f1c0146672ce6eb0025bd2cfa4afabdef5fd
Author: Alexander Graf <agraf at suse.de>
Date:   Thu Jun 27 00:31:42 2013 +0200

    PPC: Ignore writes to L2CR
    
    The L2CR register contains a number of bits that either impose configuration
    which we can't deal with or mean "something is in progress until the bit is
    0 again".
    
    Since we don't model the former and we do want to accomodate guests using the
    latter semantics, let's just ignore writes to L2CR. That way guests always read
    back 0 and are usually happy with that.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 937390a..50e0ee5 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -1381,7 +1381,7 @@ static void gen_spr_74xx (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Not strictly an SPR */
     vscr_init(env, 0x00010000);
@@ -5169,7 +5169,7 @@ static void init_proc_750 (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Time base */
     gen_tbl(env);
@@ -5232,7 +5232,7 @@ static void init_proc_750cl (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Time base */
     gen_tbl(env);
@@ -5418,7 +5418,7 @@ static void init_proc_750cx (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Time base */
     gen_tbl(env);
@@ -5485,7 +5485,7 @@ static void init_proc_750fx (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Time base */
     gen_tbl(env);
@@ -5557,7 +5557,7 @@ static void init_proc_750gx (CPUPPCState *env)
     /* XXX : not implemented (XXX: different from 750fx) */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Time base */
     gen_tbl(env);
@@ -5693,7 +5693,7 @@ static void init_proc_755 (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* XXX : not implemented */
     spr_register(env, SPR_L2PMCR, "L2PMCR",
@@ -6524,7 +6524,7 @@ static void init_proc_970 (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Memory management */
     /* XXX: not correct */
@@ -6624,7 +6624,7 @@ static void init_proc_970FX (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Memory management */
     /* XXX: not correct */
@@ -6736,7 +6736,7 @@ static void init_proc_970GX (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Memory management */
     /* XXX: not correct */
@@ -6836,7 +6836,7 @@ static void init_proc_970MP (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, NULL,
                  0x00000000);
     /* Memory management */
     /* XXX: not correct */
commit 0d54a5024f846ce7d53db25012fb4c7481e971ff
Author: Alexander Graf <agraf at suse.de>
Date:   Wed Jun 26 13:58:31 2013 +0200

    mac-io: Add escc-legacy memory alias region
    
    Mac OS X's debugging serial driver accesses the ESCC through a different
    register layout, called "escc-legacy". This layout differs from the normal
    escc register layout purely by the location of the respective registers.
    
    This patch adds a memory alias region that takes normal escc registers and
    maps them into the escc-legacy register space.
    
    With this patch applied, a Mac OS X guest successfully emits debug output
    on the serial port when run with debug parameters set, for example by running:
    
      $ qemu-system-ppc -prom-env -'boot-args=-v debug=0x8 io=0xff serial=0x3' \
                        -cdrom 10.4.iso -boot d
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index 2f389dd..fd4c8e5 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -69,12 +69,59 @@ typedef struct NewWorldMacIOState {
     MACIOIDEState ide[2];
 } NewWorldMacIOState;
 
+/*
+ * The mac-io has two interfaces to the ESCC. One is called "escc-legacy",
+ * while the other one is the normal, current ESCC interface.
+ *
+ * The magic below creates memory aliases to spawn the escc-legacy device
+ * purely by rerouting the respective registers to our escc region. This
+ * works because the only difference between the two memory regions is the
+ * register layout, not their semantics.
+ *
+ * Reference: ftp://ftp.software.ibm.com/rs6000/technology/spec/chrp/inwork/CHRP_IORef_1.0.pdf
+ */
+static void macio_escc_legacy_setup(MacIOState *macio_state)
+{
+    MemoryRegion *escc_legacy = g_new(MemoryRegion, 1);
+    MemoryRegion *bar = &macio_state->bar;
+    int i;
+    static const int maps[] = {
+        0x00, 0x00,
+        0x02, 0x20,
+        0x04, 0x10,
+        0x06, 0x30,
+        0x08, 0x40,
+        0x0A, 0x50,
+        0x60, 0x60,
+        0x70, 0x70,
+        0x80, 0x70,
+        0x90, 0x80,
+        0xA0, 0x90,
+        0xB0, 0xA0,
+        0xC0, 0xB0,
+        0xD0, 0xC0,
+        0xE0, 0xD0,
+        0xF0, 0xE0,
+    };
+
+    memory_region_init(escc_legacy, "escc-legacy", 256);
+    for (i = 0; i < ARRAY_SIZE(maps); i += 2) {
+        MemoryRegion *port = g_new(MemoryRegion, 1);
+        memory_region_init_alias(port, "escc-legacy-port", macio_state->escc_mem,
+                                 maps[i+1], 0x2);
+        memory_region_add_subregion(escc_legacy, maps[i], port);
+    }
+
+    memory_region_add_subregion(bar, 0x12000, escc_legacy);
+}
+
 static void macio_bar_setup(MacIOState *macio_state)
 {
     MemoryRegion *bar = &macio_state->bar;
 
     if (macio_state->escc_mem) {
         memory_region_add_subregion(bar, 0x13000, macio_state->escc_mem);
+        macio_escc_legacy_setup(macio_state);
     }
 }
 
commit 593c18116090237db96af6e50b902d790265ebc5
Author: Alexander Graf <agraf at suse.de>
Date:   Tue Jun 25 03:46:33 2013 +0200

    PPC: Newworld: Add second uninorth control register set
    
    Mac OS X requires a second uninorth register set to be mapped a few
    bytes above the first one. Let's just expose it to make it happy.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 7b512ca..3badfa3 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -152,6 +152,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     char *filename;
     qemu_irq *pic, **openpic_irqs;
     MemoryRegion *unin_memory = g_new(MemoryRegion, 1);
+    MemoryRegion *unin2_memory = g_new(MemoryRegion, 1);
     int linux_boot, i, j, k;
     MemoryRegion *ram = g_new(MemoryRegion, 1), *bios = g_new(MemoryRegion, 1);
     hwaddr kernel_base, initrd_base, cmdline_base = 0;
@@ -292,6 +293,9 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     memory_region_init_io(unin_memory, &unin_ops, token, "unin", 0x1000);
     memory_region_add_subregion(get_system_memory(), 0xf8000000, unin_memory);
 
+    memory_region_init_io(unin2_memory, &unin_ops, token, "unin", 0x1000);
+    memory_region_add_subregion(get_system_memory(), 0xf3000000, unin2_memory);
+
     openpic_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
     openpic_irqs[0] =
         g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
commit 4e46dcdbd31314c66fc19f73d9358852f77e8e2e
Author: Alexander Graf <agraf at suse.de>
Date:   Tue Jun 25 03:39:21 2013 +0200

    PPC: Newworld: Add uninorth token register
    
    Mac OS X expects the uninorth control register set to contain one
    register that always reads back what it writes in. Expose that.
    
    This is just a temporary hack. Eventually, we want to expose the
    uninorth (/uni-n in device tree) as a separate QOM device.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index c6889d1..7b512ca 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -87,6 +87,9 @@ static void unin_write(void *opaque, hwaddr addr, uint64_t value,
                        unsigned size)
 {
     UNIN_DPRINTF("write addr " TARGET_FMT_plx " val %"PRIx64"\n", addr, value);
+    if (addr == 0x0) {
+        *(int*)opaque = value;
+    }
 }
 
 static uint64_t unin_read(void *opaque, hwaddr addr, unsigned size)
@@ -94,6 +97,11 @@ static uint64_t unin_read(void *opaque, hwaddr addr, unsigned size)
     uint32_t value;
 
     value = 0;
+    switch (addr) {
+    case 0:
+        value = *(int*)opaque;
+    }
+
     UNIN_DPRINTF("readl addr " TARGET_FMT_plx " val %x\n", addr, value);
 
     return value;
@@ -162,6 +170,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     int machine_arch;
     SysBusDevice *s;
     DeviceState *dev;
+    int *token = g_new(int, 1);
 
     linux_boot = (kernel_filename != NULL);
 
@@ -279,8 +288,8 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     /* Register 8 MB of ISA IO space */
     isa_mmio_init(0xf2000000, 0x00800000);
 
-    /* UniN init */
-    memory_region_init_io(unin_memory, &unin_ops, NULL, "unin", 0x1000);
+    /* UniN init: XXX should be a real device */
+    memory_region_init_io(unin_memory, &unin_ops, token, "unin", 0x1000);
     memory_region_add_subregion(get_system_memory(), 0xf8000000, unin_memory);
 
     openpic_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
commit a1014f25ef54bbbdaf571873a1254f85d6dcf132
Author: Alexander Graf <agraf at suse.de>
Date:   Sun Jun 23 00:22:50 2013 +0200

    PPC: Add clock-frequency export for Mac machines
    
    Support in fwcfg has been around for exposure of the clock-frequency
    CPU property. OpenBIOS reads it, we just never exposed it.
    
    Since Mac OS X is very picky about its clock frequency values, let's
    just take a known good value and always expose that.
    
    Reported-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index d8e4db3..c6889d1 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -449,6 +449,8 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     } else {
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, get_ticks_per_sec());
     }
+    /* Mac OS X requires a "known good" clock-frequency value; pass it one. */
+    fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_CLOCKFREQ, 266000000);
 
     qemu_register_boot_set(fw_cfg_boot_set, fw_cfg);
 }
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 3acca94..8faff30 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -333,6 +333,8 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
     } else {
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, get_ticks_per_sec());
     }
+    /* Mac OS X requires a "known good" clock-frequency value; pass it one. */
+    fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_CLOCKFREQ, 266000000);
 
     qemu_register_boot_set(fw_cfg_boot_set, fw_cfg);
 }
diff --git a/include/hw/ppc/ppc.h b/include/hw/ppc/ppc.h
index acaf0d6..dfcad25 100644
--- a/include/hw/ppc/ppc.h
+++ b/include/hw/ppc/ppc.h
@@ -87,6 +87,7 @@ enum {
 #define FW_CFG_PPC_HEIGHT	(FW_CFG_ARCH_LOCAL + 0x01)
 #define FW_CFG_PPC_DEPTH	(FW_CFG_ARCH_LOCAL + 0x02)
 #define FW_CFG_PPC_TBFREQ	(FW_CFG_ARCH_LOCAL + 0x03)
+#define FW_CFG_PPC_CLOCKFREQ	(FW_CFG_ARCH_LOCAL + 0x04)
 #define FW_CFG_PPC_IS_KVM       (FW_CFG_ARCH_LOCAL + 0x05)
 #define FW_CFG_PPC_KVM_HC       (FW_CFG_ARCH_LOCAL + 0x06)
 #define FW_CFG_PPC_KVM_PID      (FW_CFG_ARCH_LOCAL + 0x07)
commit 9761ad757182be663fa31af99abad959ac63b17f
Author: Alexander Graf <agraf at suse.de>
Date:   Sat Jun 22 03:53:35 2013 +0200

    PPC: Introduce an alias cache for faster lookups
    
    When running QEMU with "-cpu ?" we walk through every alias for every
    target CPU we know about. This takes several seconds on my very fast
    host system.
    
    Let's introduce a class object cache in the alias table. Using that we
    don't have to go through the tedious work of finding our target class.
    Instead, we can just go directly from the alias name to the target class
    pointer.
    
    This patch brings -cpu "?" to reasonable times again.
    
    Before:
      real    0m4.716s
    
    After:
      real    0m0.025s
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/cpu-models.c b/target-ppc/cpu-models.c
index 17f56b7..9bb68c8 100644
--- a/target-ppc/cpu-models.c
+++ b/target-ppc/cpu-models.c
@@ -1227,7 +1227,7 @@
 /***************************************************************************/
 /* PowerPC CPU aliases                                                     */
 
-const PowerPCCPUAlias ppc_cpu_aliases[] = {
+PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "403", "403GC" },
     { "405", "405D4" },
     { "405CR", "405CRc" },
diff --git a/target-ppc/cpu-models.h b/target-ppc/cpu-models.h
index a94f835..ae8f7c7 100644
--- a/target-ppc/cpu-models.h
+++ b/target-ppc/cpu-models.h
@@ -31,9 +31,10 @@
 typedef struct PowerPCCPUAlias {
     const char *alias;
     const char *model;
+    ObjectClass *oc;
 } PowerPCCPUAlias;
 
-extern const PowerPCCPUAlias ppc_cpu_aliases[];
+extern PowerPCCPUAlias ppc_cpu_aliases[];
 
 /*****************************************************************************/
 /* PVR definitions for most known PowerPC                                    */
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index f01e9e7..937390a 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7934,6 +7934,28 @@ static gint ppc_cpu_compare_class_name(gconstpointer a, gconstpointer b)
 
 #include <ctype.h>
 
+static ObjectClass *ppc_cpu_class_by_name(const char *name);
+
+static ObjectClass *ppc_cpu_class_by_alias(PowerPCCPUAlias *alias)
+{
+    ObjectClass *invalid_class = (void*)ppc_cpu_class_by_alias;
+
+    /* Cache target class lookups in the alias table */
+    if (!alias->oc) {
+        alias->oc = ppc_cpu_class_by_name(alias->model);
+        if (!alias->oc) {
+            /* Fast check for non-existing aliases */
+            alias->oc = invalid_class;
+        }
+    }
+
+    if (alias->oc == invalid_class) {
+        return NULL;
+    } else {
+        return alias->oc;
+    }
+}
+
 static ObjectClass *ppc_cpu_class_by_name(const char *name)
 {
     GSList *list, *item;
@@ -7961,7 +7983,7 @@ static ObjectClass *ppc_cpu_class_by_name(const char *name)
 
     for (i = 0; ppc_cpu_aliases[i].alias != NULL; i++) {
         if (strcmp(ppc_cpu_aliases[i].alias, name) == 0) {
-            return ppc_cpu_class_by_name(ppc_cpu_aliases[i].model);
+            return ppc_cpu_class_by_alias(&ppc_cpu_aliases[i]);
         }
     }
 
@@ -8051,8 +8073,8 @@ static void ppc_cpu_list_entry(gpointer data, gpointer user_data)
     (*s->cpu_fprintf)(s->file, "PowerPC %-16s PVR %08x\n",
                       name, pcc->pvr);
     for (i = 0; ppc_cpu_aliases[i].alias != NULL; i++) {
-        const PowerPCCPUAlias *alias = &ppc_cpu_aliases[i];
-        ObjectClass *alias_oc = ppc_cpu_class_by_name(alias->model);
+        PowerPCCPUAlias *alias = &ppc_cpu_aliases[i];
+        ObjectClass *alias_oc = ppc_cpu_class_by_alias(alias);
 
         if (alias_oc != oc) {
             continue;
@@ -8119,12 +8141,12 @@ CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
     g_slist_free(list);
 
     for (i = 0; ppc_cpu_aliases[i].alias != NULL; i++) {
-        const PowerPCCPUAlias *alias = &ppc_cpu_aliases[i];
+        PowerPCCPUAlias *alias = &ppc_cpu_aliases[i];
         ObjectClass *oc;
         CpuDefinitionInfoList *entry;
         CpuDefinitionInfo *info;
 
-        oc = ppc_cpu_class_by_name(alias->model);
+        oc = ppc_cpu_class_by_alias(alias);
         if (oc == NULL) {
             continue;
         }
commit b177d8b77c7301da9b51b829b0edcff367e92023
Author: Fabien Chouteau <chouteau at adacore.com>
Date:   Tue Jun 18 16:53:01 2013 +0200

    PPC: Fix GDB read on code area for PPC6xx
    
    On PPC 6xx, data and code have separated TLBs. Until now QEMU was only
    looking at data TLBs, which is not good when GDB wants to read code.
    
    This patch adds a second call to get_physical_address() with an
    ACCESS_CODE type of access when the first call with ACCESS_INT fails.
    
    Signed-off-by: Fabien Chouteau <chouteau at adacore.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index 34330dc..385b67a 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -1431,7 +1431,15 @@ hwaddr cpu_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
     }
 
     if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {
-        return -1;
+
+        /* Some MMUs have separate TLBs for code and data. If we only try an
+         * ACCESS_INT, we may not be able to read instructions mapped by code
+         * TLBs, so we also try a ACCESS_CODE.
+         */
+        if (unlikely(get_physical_address(env, &ctx, addr, 0,
+                                          ACCESS_CODE) != 0)) {
+            return -1;
+        }
     }
 
     return ctx.raddr & TARGET_PAGE_MASK;
commit 886b75779104f38c30cc2594fcf2b214615a242d
Author: Fabien Chouteau <chouteau at adacore.com>
Date:   Fri Jun 21 15:26:57 2013 +0200

    PPC: Add dump_mmu() for 6xx
    
    "(qemu) info tlb" is a very useful tool for debugging, so I implemented
    the missing 6xx version.
    
    Signed-off-by: Fabien Chouteau <chouteau at adacore.com>
    [agraf: fix printfs on hwaddr to PRI]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index 68d5415..34330dc 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -1176,6 +1176,94 @@ static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
     }
 }
 
+static void mmu6xx_dump_BATs(FILE *f, fprintf_function cpu_fprintf,
+                             CPUPPCState *env, int type)
+{
+    target_ulong *BATlt, *BATut, *BATu, *BATl;
+    target_ulong BEPIl, BEPIu, bl;
+    int i;
+
+    switch (type) {
+    case ACCESS_CODE:
+        BATlt = env->IBAT[1];
+        BATut = env->IBAT[0];
+        break;
+    default:
+        BATlt = env->DBAT[1];
+        BATut = env->DBAT[0];
+        break;
+    }
+
+    for (i = 0; i < env->nb_BATs; i++) {
+        BATu = &BATut[i];
+        BATl = &BATlt[i];
+        BEPIu = *BATu & 0xF0000000;
+        BEPIl = *BATu & 0x0FFE0000;
+        bl = (*BATu & 0x00001FFC) << 15;
+        cpu_fprintf(f, "%s BAT%d BATu " TARGET_FMT_lx
+                    " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
+                    TARGET_FMT_lx " " TARGET_FMT_lx "\n",
+                    type == ACCESS_CODE ? "code" : "data", i,
+                    *BATu, *BATl, BEPIu, BEPIl, bl);
+    }
+}
+
+static void mmu6xx_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
+                            CPUPPCState *env)
+{
+    ppc6xx_tlb_t *tlb;
+    target_ulong sr;
+    int type, way, entry, i;
+
+    cpu_fprintf(f, "HTAB base = 0x%"HWADDR_PRIx"\n", env->htab_base);
+    cpu_fprintf(f, "HTAB mask = 0x%"HWADDR_PRIx"\n", env->htab_mask);
+
+    cpu_fprintf(f, "\nSegment registers:\n");
+    for (i = 0; i < 32; i++) {
+        sr = env->sr[i];
+        if (sr & 0x80000000) {
+            cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d BUID=0x%03x "
+                        "CNTLR_SPEC=0x%05x\n", i,
+                        sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
+                        sr & 0x20000000 ? 1 : 0, (uint32_t)((sr >> 20) & 0x1FF),
+                        (uint32_t)(sr & 0xFFFFF));
+        } else {
+            cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d N=%d VSID=0x%06x\n", i,
+                        sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
+                        sr & 0x20000000 ? 1 : 0, sr & 0x10000000 ? 1 : 0,
+                        (uint32_t)(sr & 0x00FFFFFF));
+        }
+    }
+
+    cpu_fprintf(f, "\nBATs:\n");
+    mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_INT);
+    mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_CODE);
+
+    if (env->id_tlbs != 1) {
+        cpu_fprintf(f, "ERROR: 6xx MMU should have separated TLB"
+                    " for code and data\n");
+    }
+
+    cpu_fprintf(f, "\nTLBs                       [EPN    EPN + SIZE]\n");
+
+    for (type = 0; type < 2; type++) {
+        for (way = 0; way < env->nb_ways; way++) {
+            for (entry = env->nb_tlb * type + env->tlb_per_way * way;
+                 entry < (env->nb_tlb * type + env->tlb_per_way * (way + 1));
+                 entry++) {
+
+                tlb = &env->tlb.tlb6[entry];
+                cpu_fprintf(f, "%s TLB %02d/%02d way:%d %s ["
+                            TARGET_FMT_lx " " TARGET_FMT_lx "]\n",
+                            type ? "code" : "data", entry % env->nb_tlb,
+                            env->nb_tlb, way,
+                            pte_is_valid(tlb->pte0) ? "valid" : "inval",
+                            tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE);
+            }
+        }
+    }
+}
+
 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
 {
     switch (env->mmu_model) {
@@ -1185,6 +1273,10 @@ void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
     case POWERPC_MMU_BOOKE206:
         mmubooke206_dump_mmu(f, cpu_fprintf, env);
         break;
+    case POWERPC_MMU_SOFT_6xx:
+    case POWERPC_MMU_SOFT_74xx:
+        mmu6xx_dump_mmu(f, cpu_fprintf, env);
+        break;
 #if defined(TARGET_PPC64)
     case POWERPC_MMU_64B:
     case POWERPC_MMU_2_06:
commit b048960f15dbedeceb4e1d7e469080cf68d4cf67
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 9 22:11:49 2013 +0200

    target-ppc: Introduce unrealizefn for PowerPCCPU
    
    Use it to clean up the opcode table, resolving a former TODO from Jocelyn.
    Also switch from malloc() to g_malloc().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index aa1d013..0ede077 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -886,6 +886,8 @@ struct ppc_segment_page_sizes {
 /* The whole PowerPC CPU context */
 #define NB_MMU_MODES 3
 
+#define PPC_CPU_OPCODES_LEN 0x40
+
 struct CPUPPCState {
     /* First are the most commonly used resources
      * during translated code execution
@@ -1039,7 +1041,7 @@ struct CPUPPCState {
 
     /* Those resources are used only during code translation */
     /* opcode handlers */
-    opc_handler_t *opcodes[0x40];
+    opc_handler_t *opcodes[PPC_CPU_OPCODES_LEN];
 
     /* Those resources are used only in QEMU core */
     target_ulong hflags;      /* hflags is a MSR & HFLAGS_MASK         */
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index f365ad8..f01e9e7 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7256,7 +7256,7 @@ static int create_new_table (opc_handler_t **table, unsigned char idx)
 {
     opc_handler_t **tmp;
 
-    tmp = malloc(0x20 * sizeof(opc_handler_t));
+    tmp = g_malloc(0x20 * sizeof(opc_handler_t));
     fill_new_table(tmp, 0x20);
     table[idx] = (opc_handler_t *)((uintptr_t)tmp | PPC_INDIRECT);
 
@@ -7864,6 +7864,19 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
 #endif
 }
 
+static void ppc_cpu_unrealizefn(DeviceState *dev, Error **errp)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(dev);
+    CPUPPCState *env = &cpu->env;
+    int i;
+
+    for (i = 0; i < PPC_CPU_OPCODES_LEN; i++) {
+        if (env->opcodes[i] != &invalid_handler) {
+            g_free(env->opcodes[i]);
+        }
+    }
+}
+
 static gint ppc_cpu_compare_class_pvr(gconstpointer a, gconstpointer b)
 {
     ObjectClass *oc = (ObjectClass *)a;
@@ -8251,6 +8264,7 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 
     pcc->parent_realize = dc->realize;
     dc->realize = ppc_cpu_realizefn;
+    dc->unrealize = ppc_cpu_unrealizefn;
 
     pcc->parent_reset = cc->reset;
     cc->reset = ppc_cpu_reset;
commit ab8131afee34d6aa427bd56ac18c4d3b6df80728
Author: Bharat Bhushan <r65777 at freescale.com>
Date:   Wed Jun 12 18:00:50 2013 +0530

    booke_ppc: limit booke timer to max when timeout overflow
    
    Limit watchdog and fit timer to maximum timeout value which
    qemu timer can support (INT64_MAX). This maximum timeout will be
    hundreds of years, so limiting to max timeout is pretty safe.
    
    Signed-off-by: Bharat Bhushan <bharat.bhushan at freescale.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c
index e41b036..000c27f 100644
--- a/hw/ppc/ppc_booke.c
+++ b/hw/ppc/ppc_booke.c
@@ -131,17 +131,33 @@ static void booke_update_fixed_timer(CPUPPCState         *env,
                                      struct QEMUTimer *timer)
 {
     ppc_tb_t *tb_env = env->tb_env;
-    uint64_t lapse;
+    uint64_t delta_tick, ticks = 0;
     uint64_t tb;
-    uint64_t period = 1 << (target_bit + 1);
+    uint64_t period;
     uint64_t now;
 
     now = qemu_get_clock_ns(vm_clock);
     tb  = cpu_ppc_get_tb(tb_env, now, tb_env->tb_offset);
+    period = 1ULL << target_bit;
+    delta_tick = period - (tb & (period - 1));
 
-    lapse = period - ((tb - (1 << target_bit)) & (period - 1));
+    /* the timer triggers only when the selected bit toggles from 0 to 1 */
+    if (tb & period) {
+        ticks = period;
+    }
 
-    *next = now + muldiv64(lapse, get_ticks_per_sec(), tb_env->tb_freq);
+    if (ticks + delta_tick < ticks) {
+        /* Overflow, so assume the biggest number we can express. */
+        ticks = UINT64_MAX;
+    } else {
+        ticks += delta_tick;
+    }
+
+    *next = now + muldiv64(ticks, get_ticks_per_sec(), tb_env->tb_freq);
+    if ((*next < now) || (*next > INT64_MAX)) {
+        /* Overflow, so assume the biggest number the qemu timer supports. */
+        *next = INT64_MAX;
+    }
 
     /* XXX: If expire time is now. We can't run the callback because we don't
      * have access to it. So we just set the timer one nanosecond later.
commit f1ff0e89c8287de79c804ec7a50d43f39a9f65dc
Author: Alexander Graf <agraf at suse.de>
Date:   Thu Jun 20 14:06:27 2013 +0200

    Graphics: Switch to 800x600x32 as default mode
    
    We have stayed at 800x600x15 as default graphics mode for the last 9 years.
    If there ever was a reason to be there, surely nobody remembers it.
    
    However, recently non-Linux PPC guests started to show bad effects on 15 bit
    color mode. They do work just fine with 32 bits however.
    
    So let's switch to 32 bit color as the default graphic mode.
    
    Reported-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/arch_init.c b/arch_init.c
index 4255db9..0e553c9 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -65,7 +65,7 @@ int graphic_depth = 8;
 #else
 int graphic_width = 800;
 int graphic_height = 600;
-int graphic_depth = 15;
+int graphic_depth = 32;
 #endif
 
 
commit f9de2da728d885c5c246d6ba94edea067ad00434
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Sat Jun 15 11:51:52 2013 +1000

    pseries: Update MAINTAINERS information
    
    I'm no longer at IBM, and therefore no long actively working on the pseries
    (aka sPAPR) qemu machine type.  This patch removes my information in the
    MAINTAINERS file.
    
    While we're at it, I've added some extra file patterns for pseries specific
    files that weren't included in the existing pattern.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    [agraf: Remove new maintainer addition]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index a015f68..ad9c860 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -428,11 +428,14 @@ F: hw/pci/devices/host-prep.[hc]
 F: hw/isa/pc87312.[hc]
 
 sPAPR
-M: David Gibson <david at gibson.dropbear.id.au>
 M: Alexander Graf <agraf at suse.de>
 L: qemu-ppc at nongnu.org
 S: Supported
 F: hw/*/spapr*
+F: include/hw/*/spapr*
+F: hw/*/xics*
+F: include/hw/*/xics*
+F: pc-bios/spapr-rtas/*
 
 virtex_ml507
 M: Edgar E. Iglesias <edgar.iglesias at gmail.com>
commit 4bddaf552c3a05e1fdd2c82d6b28ebc8f99269c9
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Sat Jun 15 11:51:51 2013 +1000

    target-ppc kvm: save cr register
    
    This adds a missing code to save CR (condition register) via
    kvm_arch_put_registers(). kvm_arch_get_registers() already has it.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 2bbc3b8..c89dd58 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -791,6 +791,11 @@ int kvm_arch_put_registers(CPUState *cs, int level)
     for (i = 0;i < 32; i++)
         regs.gpr[i] = env->gpr[i];
 
+    regs.cr = 0;
+    for (i = 0; i < 8; i++) {
+        regs.cr |= (env->crf[i] & 15) << (4 * (7 - i));
+    }
+
     ret = kvm_vcpu_ioctl(cs, KVM_SET_REGS, &regs);
     if (ret < 0)
         return ret;
commit ec4936e1a49ef2d7129a1813ed7a3ca826698bfb
Author: Stefan Weil <sw at weilnetz.de>
Date:   Wed Jun 19 23:08:29 2013 +0200

    pseries: Fix compiler warning (conversion of pointer to integral value)
    
    This kind of type cast must use uintptr_t or target_ulong to be portable
    for hosts with sizeof(void *) != sizeof(long).
    
    Here the value is assigned to a variable of type target_ulong.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    [agraf: fix compilation on 32bit hosts]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 5363c3f..fe34291 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -670,7 +670,7 @@ static void spapr_cpu_reset(void *opaque)
     env->external_htab = spapr->htab;
     env->htab_base = -1;
     env->htab_mask = HTAB_SIZE(spapr) - 1;
-    env->spr[SPR_SDR1] = (unsigned long)spapr->htab |
+    env->spr[SPR_SDR1] = (target_ulong)(uintptr_t)spapr->htab |
         (spapr->htab_shift - 18);
 }
 
commit 210b580b106fa798149e28aa13c66b325a43204e
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Jun 19 15:40:30 2013 -0500

    spapr-rtas: add CPU argument to RTAS calls
    
    RTAS is a hypervisor provided binary blob that a guest loads and
    calls into to execute certain functions.  It's similar to the
    vsyscall page in Linux or the short lived VMCI paravirt interface
    from VMware.
    
    The QEMU implementation of the RTAS blob is simply a passthrough
    that proxies all RTAS calls to the hypervisor via an hypercall.
    
    While we pass a CPU argument for hypercall handling in QEMU, we
    don't pass it for RTAS calls.  Since some RTAs calls require
    making hypercalls (normally RTAS is implemented as guest code) we
    have nasty hacks to allow that.
    
    Add a CPU argument to RTAS call handling so we can more easily
    invoke hypercalls just as guest code would.
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/nvram/spapr_nvram.c b/hw/nvram/spapr_nvram.c
index 1eb05c9..eb4500e 100644
--- a/hw/nvram/spapr_nvram.c
+++ b/hw/nvram/spapr_nvram.c
@@ -44,7 +44,7 @@ typedef struct sPAPRNVRAM {
 #define DEFAULT_NVRAM_SIZE 65536
 #define MAX_NVRAM_SIZE (UINT16_MAX * 16)
 
-static void rtas_nvram_fetch(sPAPREnvironment *spapr,
+static void rtas_nvram_fetch(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                              uint32_t token, uint32_t nargs,
                              target_ulong args,
                              uint32_t nret, target_ulong rets)
@@ -91,7 +91,7 @@ static void rtas_nvram_fetch(sPAPREnvironment *spapr,
     rtas_st(rets, 1, (alen < 0) ? 0 : alen);
 }
 
-static void rtas_nvram_store(sPAPREnvironment *spapr,
+static void rtas_nvram_store(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                              uint32_t token, uint32_t nargs,
                              target_ulong args,
                              uint32_t nret, target_ulong rets)
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index c0d7e62..a69390e 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -277,7 +277,7 @@ static void spapr_powerdown_req(Notifier *n, void *opaque)
     qemu_irq_pulse(xics_get_qirq(spapr->icp, spapr->epow_irq));
 }
 
-static void check_exception(sPAPREnvironment *spapr,
+static void check_exception(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                             uint32_t token, uint32_t nargs,
                             target_ulong args,
                             uint32_t nret, target_ulong rets)
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 8f0b7e8..e6f321d 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -525,7 +525,7 @@ static target_ulong h_rtas(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     uint32_t nargs = ldl_be_phys(rtas_r3 + 4);
     uint32_t nret = ldl_be_phys(rtas_r3 + 8);
 
-    return spapr_rtas_call(spapr, token, nargs, rtas_r3 + 12,
+    return spapr_rtas_call(cpu, spapr, token, nargs, rtas_r3 + 12,
                            nret, rtas_r3 + 12 + 4*nargs);
 }
 
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 04e8362..c8c12c8 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -119,7 +119,7 @@ static void finish_read_pci_config(sPAPREnvironment *spapr, uint64_t buid,
     rtas_st(rets, 1, val);
 }
 
-static void rtas_ibm_read_pci_config(sPAPREnvironment *spapr,
+static void rtas_ibm_read_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                      uint32_t token, uint32_t nargs,
                                      target_ulong args,
                                      uint32_t nret, target_ulong rets)
@@ -139,7 +139,7 @@ static void rtas_ibm_read_pci_config(sPAPREnvironment *spapr,
     finish_read_pci_config(spapr, buid, addr, size, rets);
 }
 
-static void rtas_read_pci_config(sPAPREnvironment *spapr,
+static void rtas_read_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                  uint32_t token, uint32_t nargs,
                                  target_ulong args,
                                  uint32_t nret, target_ulong rets)
@@ -185,7 +185,7 @@ static void finish_write_pci_config(sPAPREnvironment *spapr, uint64_t buid,
     rtas_st(rets, 0, 0);
 }
 
-static void rtas_ibm_write_pci_config(sPAPREnvironment *spapr,
+static void rtas_ibm_write_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                       uint32_t token, uint32_t nargs,
                                       target_ulong args,
                                       uint32_t nret, target_ulong rets)
@@ -206,7 +206,7 @@ static void rtas_ibm_write_pci_config(sPAPREnvironment *spapr,
     finish_write_pci_config(spapr, buid, addr, size, val, rets);
 }
 
-static void rtas_write_pci_config(sPAPREnvironment *spapr,
+static void rtas_write_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                   uint32_t token, uint32_t nargs,
                                   target_ulong args,
                                   uint32_t nret, target_ulong rets)
@@ -277,7 +277,7 @@ static void spapr_msi_setmsg(PCIDevice *pdev, hwaddr addr,
     }
 }
 
-static void rtas_ibm_change_msi(sPAPREnvironment *spapr,
+static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                 uint32_t token, uint32_t nargs,
                                 target_ulong args, uint32_t nret,
                                 target_ulong rets)
@@ -374,7 +374,8 @@ static void rtas_ibm_change_msi(sPAPREnvironment *spapr,
     trace_spapr_pci_rtas_ibm_change_msi(func, req_num);
 }
 
-static void rtas_ibm_query_interrupt_source_number(sPAPREnvironment *spapr,
+static void rtas_ibm_query_interrupt_source_number(PowerPCCPU *cpu,
+                                                   sPAPREnvironment *spapr,
                                                    uint32_t token,
                                                    uint32_t nargs,
                                                    target_ulong args,
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 42ed7dc..394ce05 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -38,7 +38,7 @@
 #define TOKEN_BASE      0x2000
 #define TOKEN_MAX       0x100
 
-static void rtas_display_character(sPAPREnvironment *spapr,
+static void rtas_display_character(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                    uint32_t token, uint32_t nargs,
                                    target_ulong args,
                                    uint32_t nret, target_ulong rets)
@@ -54,7 +54,7 @@ static void rtas_display_character(sPAPREnvironment *spapr,
     }
 }
 
-static void rtas_get_time_of_day(sPAPREnvironment *spapr,
+static void rtas_get_time_of_day(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                  uint32_t token, uint32_t nargs,
                                  target_ulong args,
                                  uint32_t nret, target_ulong rets)
@@ -78,7 +78,7 @@ static void rtas_get_time_of_day(sPAPREnvironment *spapr,
     rtas_st(rets, 7, 0); /* we don't do nanoseconds */
 }
 
-static void rtas_set_time_of_day(sPAPREnvironment *spapr,
+static void rtas_set_time_of_day(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                  uint32_t token, uint32_t nargs,
                                  target_ulong args,
                                  uint32_t nret, target_ulong rets)
@@ -99,7 +99,7 @@ static void rtas_set_time_of_day(sPAPREnvironment *spapr,
     rtas_st(rets, 0, 0); /* Success */
 }
 
-static void rtas_power_off(sPAPREnvironment *spapr,
+static void rtas_power_off(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                            uint32_t token, uint32_t nargs, target_ulong args,
                            uint32_t nret, target_ulong rets)
 {
@@ -111,7 +111,7 @@ static void rtas_power_off(sPAPREnvironment *spapr,
     rtas_st(rets, 0, 0);
 }
 
-static void rtas_system_reboot(sPAPREnvironment *spapr,
+static void rtas_system_reboot(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                                uint32_t token, uint32_t nargs,
                                target_ulong args,
                                uint32_t nret, target_ulong rets)
@@ -124,7 +124,8 @@ static void rtas_system_reboot(sPAPREnvironment *spapr,
     rtas_st(rets, 0, 0);
 }
 
-static void rtas_query_cpu_stopped_state(sPAPREnvironment *spapr,
+static void rtas_query_cpu_stopped_state(PowerPCCPU *cpu_,
+                                         sPAPREnvironment *spapr,
                                          uint32_t token, uint32_t nargs,
                                          target_ulong args,
                                          uint32_t nret, target_ulong rets)
@@ -154,7 +155,7 @@ static void rtas_query_cpu_stopped_state(sPAPREnvironment *spapr,
     rtas_st(rets, 0, -3);
 }
 
-static void rtas_start_cpu(sPAPREnvironment *spapr,
+static void rtas_start_cpu(PowerPCCPU *cpu_, sPAPREnvironment *spapr,
                            uint32_t token, uint32_t nargs,
                            target_ulong args,
                            uint32_t nret, target_ulong rets)
@@ -208,7 +209,7 @@ static struct rtas_call {
 
 struct rtas_call *rtas_next = rtas_table;
 
-target_ulong spapr_rtas_call(sPAPREnvironment *spapr,
+target_ulong spapr_rtas_call(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                              uint32_t token, uint32_t nargs, target_ulong args,
                              uint32_t nret, target_ulong rets)
 {
@@ -217,7 +218,7 @@ target_ulong spapr_rtas_call(sPAPREnvironment *spapr,
         struct rtas_call *call = rtas_table + (token - TOKEN_BASE);
 
         if (call->fn) {
-            call->fn(spapr, token, nargs, args, nret, rets);
+            call->fn(cpu, spapr, token, nargs, args, nret, rets);
             return H_SUCCESS;
         }
     }
@@ -227,7 +228,7 @@ target_ulong spapr_rtas_call(sPAPREnvironment *spapr,
      * machines) without looking it up in the device tree.  This
      * special case makes this work */
     if (token == 0xa) {
-        rtas_display_character(spapr, 0xa, nargs, args, nret, rets);
+        rtas_display_character(cpu, spapr, 0xa, nargs, args, nret, rets);
         return H_SUCCESS;
     }
 
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 3c5a655..9c18741 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -321,7 +321,8 @@ static void spapr_vio_quiesce_one(VIOsPAPRDevice *dev)
     free_crq(dev);
 }
 
-static void rtas_set_tce_bypass(sPAPREnvironment *spapr, uint32_t token,
+static void rtas_set_tce_bypass(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                                uint32_t token,
                                 uint32_t nargs, target_ulong args,
                                 uint32_t nret, target_ulong rets)
 {
@@ -351,7 +352,8 @@ static void rtas_set_tce_bypass(sPAPREnvironment *spapr, uint32_t token,
     rtas_st(rets, 0, 0);
 }
 
-static void rtas_quiesce(sPAPREnvironment *spapr, uint32_t token,
+static void rtas_quiesce(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                         uint32_t token,
                          uint32_t nargs, target_ulong args,
                          uint32_t nret, target_ulong rets)
 {
diff --git a/hw/ppc/xics.c b/hw/ppc/xics.c
index 1b25075..091912e 100644
--- a/hw/ppc/xics.c
+++ b/hw/ppc/xics.c
@@ -400,7 +400,8 @@ static target_ulong h_eoi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     return H_SUCCESS;
 }
 
-static void rtas_set_xive(sPAPREnvironment *spapr, uint32_t token,
+static void rtas_set_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                          uint32_t token,
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
@@ -427,7 +428,8 @@ static void rtas_set_xive(sPAPREnvironment *spapr, uint32_t token,
     rtas_st(rets, 0, 0); /* Success */
 }
 
-static void rtas_get_xive(sPAPREnvironment *spapr, uint32_t token,
+static void rtas_get_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                          uint32_t token,
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
@@ -451,7 +453,8 @@ static void rtas_get_xive(sPAPREnvironment *spapr, uint32_t token,
     rtas_st(rets, 2, ics->irqs[nr - ics->offset].priority);
 }
 
-static void rtas_int_off(sPAPREnvironment *spapr, uint32_t token,
+static void rtas_int_off(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                         uint32_t token,
                          uint32_t nargs, target_ulong args,
                          uint32_t nret, target_ulong rets)
 {
@@ -476,7 +479,8 @@ static void rtas_int_off(sPAPREnvironment *spapr, uint32_t token,
     rtas_st(rets, 0, 0); /* Success */
 }
 
-static void rtas_int_on(sPAPREnvironment *spapr, uint32_t token,
+static void rtas_int_on(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                        uint32_t token,
                         uint32_t nargs, target_ulong args,
                         uint32_t nret, target_ulong rets)
 {
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index a83720e..09c4570 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -319,11 +319,12 @@ static inline void rtas_st(target_ulong phys, int n, uint32_t val)
     stl_be_phys(phys + 4*n, val);
 }
 
-typedef void (*spapr_rtas_fn)(sPAPREnvironment *spapr, uint32_t token,
+typedef void (*spapr_rtas_fn)(PowerPCCPU *cpu, sPAPREnvironment *spapr,
+                              uint32_t token,
                               uint32_t nargs, target_ulong args,
                               uint32_t nret, target_ulong rets);
 int spapr_rtas_register(const char *name, spapr_rtas_fn fn);
-target_ulong spapr_rtas_call(sPAPREnvironment *spapr,
+target_ulong spapr_rtas_call(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                              uint32_t token, uint32_t nargs, target_ulong args,
                              uint32_t nret, target_ulong rets);
 int spapr_rtas_device_tree_setup(void *fdt, hwaddr rtas_addr,
commit 159f8286b760deace1008f5f68a46cadba337780
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Sat Jun 15 11:51:50 2013 +1000

    target-ppc: Change default machine for 64-bit
    
    Currently, for qemu-system-ppc64, the default machine type is 'mac99'.
    The mac99 machine is not being actively maintained, and represents a
    bizarre hybrid of components that never actually existed as a real system.
    This patch changes the default machine to 'pseries', which is actively
    maintained and works well with most modern ppc64 Linux distributions as a
    guest.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    [agraf: adjust commit message]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 61c25a4..d8e4db3 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -458,9 +458,6 @@ static QEMUMachine core99_machine = {
     .desc = "Mac99 based PowerMAC",
     .init = ppc_core99_init,
     .max_cpus = MAX_CPUS,
-#ifdef TARGET_PPC64
-    .is_default = 1,
-#endif
     DEFAULT_MACHINE_OPTIONS,
 };
 
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 218ea23..5363c3f 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -971,6 +971,7 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
 static QEMUMachine spapr_machine = {
     .name = "pseries",
     .desc = "pSeries Logical Partition (PAPR compliant)",
+    .is_default = 1,
     .init = ppc_spapr_init,
     .reset = ppc_spapr_reset,
     .block_default_type = IF_SCSI,
commit 9fea2ae25080ad790d7d904d01a1300a45a634eb
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Sat May 11 21:03:50 2013 +0200

    ppc: do not register IABR SPR twice for 603e
    
    IABR SPR is already registered in gen_spr_603(), called from init_proc_603E().
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 3811633..f365ad8 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -4957,11 +4957,6 @@ static void init_proc_603E (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_IABR, "IABR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
     /* Memory management */
     gen_low_BATs(env);
     gen_6xx_7xx_soft_tlb(env, 64, 2);
commit 1e3438df5a9e75355b36200f3bd8b94d1a32cc24
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Feb 22 18:35:46 2013 +0100

    target-ppc: Drop redundant flags assignments from CPU families
    
    Previous code has #define POWERPC_INSNS2_<family> PPC_NONE in some
    places for macrofied assignment to insns_flags2 field.
    
    PPC_NONE is defined as zero though and QOM classes are zero-initialized,
    so drop any pcc->insns_flags2 = PPC_NONE; assignments.
    
    PPC_NONE itself is still in use in translate.c.
    
    Suggested-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index fa5e09f..3811633 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -3147,7 +3147,6 @@ POWERPC_FAMILY(401)(ObjectClass *oc, void *data)
                        PPC_CACHE_DCBZ |
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_4xx_COMMON | PPC_40x_EXCP;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x00000000000FD201ULL;
     pcc->mmu_model = POWERPC_MMU_REAL;
     pcc->excp_model = POWERPC_EXCP_40x;
@@ -3195,7 +3194,6 @@ POWERPC_FAMILY(401x2)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC |
                        PPC_4xx_COMMON | PPC_40x_EXCP;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x00000000001FD231ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_4xx_Z;
     pcc->excp_model = POWERPC_EXCP_40x;
@@ -3237,7 +3235,6 @@ POWERPC_FAMILY(401x3)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC |
                        PPC_4xx_COMMON | PPC_40x_EXCP;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x00000000001FD631ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_4xx_Z;
     pcc->excp_model = POWERPC_EXCP_40x;
@@ -3285,7 +3282,6 @@ POWERPC_FAMILY(IOP480)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC |
                        PPC_4xx_COMMON | PPC_40x_EXCP;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x00000000001FD231ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_4xx_Z;
     pcc->excp_model = POWERPC_EXCP_40x;
@@ -3325,7 +3321,6 @@ POWERPC_FAMILY(403)(ObjectClass *oc, void *data)
                        PPC_CACHE_DCBZ |
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_4xx_COMMON | PPC_40x_EXCP;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000007D00DULL;
     pcc->mmu_model = POWERPC_MMU_REAL;
     pcc->excp_model = POWERPC_EXCP_40x;
@@ -3385,7 +3380,6 @@ POWERPC_FAMILY(403GCX)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC |
                        PPC_4xx_COMMON | PPC_40x_EXCP;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000007D00DULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_4xx_Z;
     pcc->excp_model = POWERPC_EXCP_40x;
@@ -3444,7 +3438,6 @@ POWERPC_FAMILY(405)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC |
                        PPC_4xx_COMMON | PPC_405_MAC | PPC_40x_EXCP;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006E630ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_4xx;
     pcc->excp_model = POWERPC_EXCP_40x;
@@ -3538,7 +3531,6 @@ POWERPC_FAMILY(440EP)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBSYNC | PPC_MFTB |
                        PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |
                        PPC_440_SPEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006FF30ULL;
     pcc->mmu_model = POWERPC_MMU_BOOKE;
     pcc->excp_model = POWERPC_EXCP_BOOKE;
@@ -3611,7 +3603,6 @@ POWERPC_FAMILY(440GP)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBSYNC | PPC_TLBIVA | PPC_MFTB |
                        PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |
                        PPC_440_SPEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006FF30ULL;
     pcc->mmu_model = POWERPC_MMU_BOOKE;
     pcc->excp_model = POWERPC_EXCP_BOOKE;
@@ -3684,7 +3675,6 @@ POWERPC_FAMILY(440x4)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBSYNC | PPC_MFTB |
                        PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |
                        PPC_440_SPEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006FF30ULL;
     pcc->mmu_model = POWERPC_MMU_BOOKE;
     pcc->excp_model = POWERPC_EXCP_BOOKE;
@@ -3775,7 +3765,6 @@ POWERPC_FAMILY(440x5)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBSYNC | PPC_MFTB |
                        PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |
                        PPC_440_SPEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006FF30ULL;
     pcc->mmu_model = POWERPC_MMU_BOOKE;
     pcc->excp_model = POWERPC_EXCP_BOOKE;
@@ -3872,7 +3861,6 @@ POWERPC_FAMILY(460)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBSYNC | PPC_TLBIVA |
                        PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |
                        PPC_440_SPEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006FF30ULL;
     pcc->mmu_model = POWERPC_MMU_BOOKE;
     pcc->excp_model = POWERPC_EXCP_BOOKE;
@@ -3972,7 +3960,6 @@ POWERPC_FAMILY(460F)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBSYNC | PPC_TLBIVA |
                        PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |
                        PPC_440_SPEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006FF30ULL;
     pcc->mmu_model = POWERPC_MMU_BOOKE;
     pcc->excp_model = POWERPC_EXCP_BOOKE;
@@ -4006,7 +3993,6 @@ POWERPC_FAMILY(MPC5xx)(ObjectClass *oc, void *data)
                        PPC_MEM_EIEIO | PPC_MEM_SYNC |
                        PPC_CACHE_ICBI | PPC_FLOAT | PPC_FLOAT_STFIWX |
                        PPC_MFTB;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000001FF43ULL;
     pcc->mmu_model = POWERPC_MMU_REAL;
     pcc->excp_model = POWERPC_EXCP_603;
@@ -4039,7 +4025,6 @@ POWERPC_FAMILY(MPC8xx)(ObjectClass *oc, void *data)
     pcc->insns_flags = PPC_INSNS_BASE | PPC_STRING  |
                        PPC_MEM_EIEIO | PPC_MEM_SYNC |
                        PPC_CACHE_ICBI | PPC_MFTB;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000001F673ULL;
     pcc->mmu_model = POWERPC_MMU_MPC8xx;
     pcc->excp_model = POWERPC_EXCP_603;
@@ -4106,7 +4091,6 @@ POWERPC_FAMILY(G2)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000006FFF2ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
     pcc->excp_model = POWERPC_EXCP_G2;
@@ -4198,7 +4182,6 @@ POWERPC_FAMILY(G2LE)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000007FFF3ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
     pcc->excp_model = POWERPC_EXCP_G2;
@@ -4339,7 +4322,6 @@ POWERPC_FAMILY(e200)(ObjectClass *oc, void *data)
                        PPC_CACHE_DCBZ | PPC_CACHE_DCBA |
                        PPC_MEM_TLBSYNC | PPC_TLBIVAX |
                        PPC_BOOKE;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000606FF30ULL;
     pcc->mmu_model = POWERPC_MMU_BOOKE206;
     pcc->excp_model = POWERPC_EXCP_BOOKE;
@@ -4398,7 +4380,6 @@ POWERPC_FAMILY(e300)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000007FFF3ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
     pcc->excp_model = POWERPC_EXCP_603;
@@ -4810,7 +4791,6 @@ POWERPC_FAMILY(601)(ObjectClass *oc, void *data)
                        PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |
                        PPC_MEM_SYNC | PPC_MEM_EIEIO | PPC_MEM_TLBIE |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000000FD70ULL;
     pcc->mmu_model = POWERPC_MMU_601;
 #if defined(CONFIG_SOFTMMU)
@@ -4847,7 +4827,6 @@ POWERPC_FAMILY(601v)(ObjectClass *oc, void *data)
                        PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |
                        PPC_MEM_SYNC | PPC_MEM_EIEIO | PPC_MEM_TLBIE |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000000FD70ULL;
     pcc->mmu_model = POWERPC_MMU_601;
 #if defined(CONFIG_SOFTMMU)
@@ -4900,7 +4879,6 @@ POWERPC_FAMILY(602)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_6xx_TLB | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_602_SPEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x0000000000C7FF73ULL;
     /* XXX: 602 MMU is quite specific. Should add a special case */
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
@@ -4953,7 +4931,6 @@ POWERPC_FAMILY(603)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000007FF73ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
     pcc->excp_model = POWERPC_EXCP_603;
@@ -5010,7 +4987,6 @@ POWERPC_FAMILY(603E)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000007FF73ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
     pcc->excp_model = POWERPC_EXCP_603E;
@@ -5056,7 +5032,6 @@ POWERPC_FAMILY(604)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5125,7 +5100,6 @@ POWERPC_FAMILY(604E)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5181,7 +5155,6 @@ POWERPC_FAMILY(740)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5245,7 +5218,6 @@ POWERPC_FAMILY(750)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5432,7 +5404,6 @@ POWERPC_FAMILY(750cl)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5500,7 +5471,6 @@ POWERPC_FAMILY(750cx)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5573,7 +5543,6 @@ POWERPC_FAMILY(750fx)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5646,7 +5615,6 @@ POWERPC_FAMILY(750gx)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5710,7 +5678,6 @@ POWERPC_FAMILY(745)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
     pcc->excp_model = POWERPC_EXCP_7x5;
@@ -5782,7 +5749,6 @@ POWERPC_FAMILY(755)(ObjectClass *oc, void *data)
                        PPC_MEM_SYNC | PPC_MEM_EIEIO |
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000005FF77ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
     pcc->excp_model = POWERPC_EXCP_7x5;
@@ -5841,7 +5807,6 @@ POWERPC_FAMILY(7400)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIA |
                        PPC_SEGMENT | PPC_EXTERN |
                        PPC_ALTIVEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000205FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -5910,7 +5875,6 @@ POWERPC_FAMILY(7410)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIA |
                        PPC_SEGMENT | PPC_EXTERN |
                        PPC_ALTIVEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000205FF77ULL;
     pcc->mmu_model = POWERPC_MMU_32B;
 #if defined(CONFIG_SOFTMMU)
@@ -6005,7 +5969,6 @@ POWERPC_FAMILY(7440)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIA | PPC_74xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN |
                        PPC_ALTIVEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000205FF77ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_74xx;
     pcc->excp_model = POWERPC_EXCP_74xx;
@@ -6123,7 +6086,6 @@ POWERPC_FAMILY(7450)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIA | PPC_74xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN |
                        PPC_ALTIVEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000205FF77ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_74xx;
     pcc->excp_model = POWERPC_EXCP_74xx;
@@ -6244,7 +6206,6 @@ POWERPC_FAMILY(7445)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIA | PPC_74xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN |
                        PPC_ALTIVEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000205FF77ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_74xx;
     pcc->excp_model = POWERPC_EXCP_74xx;
@@ -6367,7 +6328,6 @@ POWERPC_FAMILY(7455)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIA | PPC_74xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN |
                        PPC_ALTIVEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000205FF77ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_74xx;
     pcc->excp_model = POWERPC_EXCP_74xx;
@@ -6514,7 +6474,6 @@ POWERPC_FAMILY(7457)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIA | PPC_74xx_TLB |
                        PPC_SEGMENT | PPC_EXTERN |
                        PPC_ALTIVEC;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x000000000205FF77ULL;
     pcc->mmu_model = POWERPC_MMU_SOFT_74xx;
     pcc->excp_model = POWERPC_EXCP_74xx;
@@ -6619,7 +6578,6 @@ POWERPC_FAMILY(970)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_64B | PPC_ALTIVEC |
                        PPC_SEGMENT_64B | PPC_SLBI;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x900000000204FF36ULL;
     pcc->mmu_model = POWERPC_MMU_64B;
 #if defined(CONFIG_SOFTMMU)
@@ -6732,7 +6690,6 @@ POWERPC_FAMILY(970FX)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_64B | PPC_ALTIVEC |
                        PPC_SEGMENT_64B | PPC_SLBI;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x800000000204FF36ULL;
     pcc->mmu_model = POWERPC_MMU_64B;
 #if defined(CONFIG_SOFTMMU)
@@ -6833,7 +6790,6 @@ POWERPC_FAMILY(970GX)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_64B | PPC_ALTIVEC |
                        PPC_SEGMENT_64B | PPC_SLBI;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x800000000204FF36ULL;
     pcc->mmu_model = POWERPC_MMU_64B;
 #if defined(CONFIG_SOFTMMU)
@@ -6934,7 +6890,6 @@ POWERPC_FAMILY(970MP)(ObjectClass *oc, void *data)
                        PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
                        PPC_64B | PPC_ALTIVEC |
                        PPC_SEGMENT_64B | PPC_SLBI;
-    pcc->insns_flags2 = PPC_NONE;
     pcc->msr_mask = 0x900000000204FF36ULL;
     pcc->mmu_model = POWERPC_MMU_64B;
 #if defined(CONFIG_SOFTMMU)
commit 7587ea5bcbdeb08a204b4c1d5afe039d47d613fa
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 9 22:47:35 2013 +0200

    mpc8544_guts: Turn qdev initfn into instance_init
    
    SysBus can deal with NULL SysBusDeviceClass::init since 4ce5dae.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mpc8544_guts.c b/hw/ppc/mpc8544_guts.c
index f623b04..d41f615 100644
--- a/hw/ppc/mpc8544_guts.c
+++ b/hw/ppc/mpc8544_guts.c
@@ -114,29 +114,21 @@ static const MemoryRegionOps mpc8544_guts_ops = {
     },
 };
 
-static int mpc8544_guts_initfn(SysBusDevice *dev)
+static void mpc8544_guts_initfn(Object *obj)
 {
-    GutsState *s = MPC8544_GUTS(dev);
+    SysBusDevice *d = SYS_BUS_DEVICE(obj);
+    GutsState *s = MPC8544_GUTS(obj);
 
     memory_region_init_io(&s->iomem, &mpc8544_guts_ops, s,
                           "mpc8544.guts", MPC8544_GUTS_MMIO_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
-
-    return 0;
-}
-
-static void mpc8544_guts_class_init(ObjectClass *klass, void *data)
-{
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = mpc8544_guts_initfn;
+    sysbus_init_mmio(d, &s->iomem);
 }
 
 static const TypeInfo mpc8544_guts_info = {
     .name          = TYPE_MPC8544_GUTS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GutsState),
-    .class_init    = mpc8544_guts_class_init,
+    .instance_init = mpc8544_guts_initfn,
 };
 
 static void mpc8544_guts_register_types(void)
commit 43f691e9e248edca7b70680fd87b5be786cc4e01
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 9 22:47:34 2013 +0200

    mpc8544_guts: QOM'ify
    
    Introduce type constant, cast macro and rename parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mpc8544_guts.c b/hw/ppc/mpc8544_guts.c
index 98540a4..f623b04 100644
--- a/hw/ppc/mpc8544_guts.c
+++ b/hw/ppc/mpc8544_guts.c
@@ -51,8 +51,14 @@
 #define MPC8544_GUTS_ADDR_SRDS2CR1    0xF10
 #define MPC8544_GUTS_ADDR_SRDS2CR3    0xF18
 
+#define TYPE_MPC8544_GUTS "mpc8544-guts"
+#define MPC8544_GUTS(obj) OBJECT_CHECK(GutsState, (obj), TYPE_MPC8544_GUTS)
+
 struct GutsState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
 };
 
@@ -110,9 +116,7 @@ static const MemoryRegionOps mpc8544_guts_ops = {
 
 static int mpc8544_guts_initfn(SysBusDevice *dev)
 {
-    GutsState *s;
-
-    s = FROM_SYSBUS(GutsState, SYS_BUS_DEVICE(dev));
+    GutsState *s = MPC8544_GUTS(dev);
 
     memory_region_init_io(&s->iomem, &mpc8544_guts_ops, s,
                           "mpc8544.guts", MPC8544_GUTS_MMIO_SIZE);
@@ -129,7 +133,7 @@ static void mpc8544_guts_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mpc8544_guts_info = {
-    .name          = "mpc8544-guts",
+    .name          = TYPE_MPC8544_GUTS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GutsState),
     .class_init    = mpc8544_guts_class_init,
commit 1f1a83f459dab7fbec9c5866a4d6a1ae16549edd
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 9 22:47:33 2013 +0200

    mpc8544_guts: Fix MemoryRegion name
    
    6544 -> 8544
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/mpc8544_guts.c b/hw/ppc/mpc8544_guts.c
index 193beab..98540a4 100644
--- a/hw/ppc/mpc8544_guts.c
+++ b/hw/ppc/mpc8544_guts.c
@@ -115,7 +115,7 @@ static int mpc8544_guts_initfn(SysBusDevice *dev)
     s = FROM_SYSBUS(GutsState, SYS_BUS_DEVICE(dev));
 
     memory_region_init_io(&s->iomem, &mpc8544_guts_ops, s,
-                          "mpc6544.guts", MPC8544_GUTS_MMIO_SIZE);
+                          "mpc8544.guts", MPC8544_GUTS_MMIO_SIZE);
     sysbus_init_mmio(dev, &s->iomem);
 
     return 0;
commit dd49c038c373329dc9e98e591677978ff2277d9f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jun 16 21:30:40 2013 +0200

    intc/openpic_kvm: Fix QOM and build issues
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/intc/openpic_kvm.c b/hw/intc/openpic_kvm.c
index 17d0a35..6775879 100644
--- a/hw/intc/openpic_kvm.c
+++ b/hw/intc/openpic_kvm.c
@@ -31,8 +31,14 @@
 #include "sysemu/kvm.h"
 #include "qemu/log.h"
 
+#define KVM_OPENPIC(obj) \
+    OBJECT_CHECK(KVMOpenPICState, (obj), TYPE_KVM_OPENPIC)
+
 typedef struct KVMOpenPICState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion mem;
     MemoryListener mem_listener;
     uint32_t fd;
@@ -145,16 +151,26 @@ static void kvm_openpic_region_del(MemoryListener *listener,
     }
 }
 
-static int kvm_openpic_init(SysBusDevice *dev)
+static void kvm_openpic_init(Object *obj)
+{
+    KVMOpenPICState *opp = KVM_OPENPIC(obj);
+
+    memory_region_init_io(&opp->mem, &kvm_openpic_mem_ops, opp,
+                          "kvm-openpic", 0x40000);
+}
+
+static void kvm_openpic_realize(DeviceState *dev, Error **errp)
 {
+    SysBusDevice *d = SYS_BUS_DEVICE(dev);
+    KVMOpenPICState *opp = KVM_OPENPIC(dev);
     KVMState *s = kvm_state;
-    KVMOpenPICState *opp = FROM_SYSBUS(typeof(*opp), dev);
     int kvm_openpic_model;
     struct kvm_create_device cd = {0};
     int ret, i;
 
     if (!kvm_check_extension(s, KVM_CAP_DEVICE_CTRL)) {
-        return -EINVAL;
+        error_setg(errp, "Kernel is lacking Device Control API");
+        return;
     }
 
     switch (opp->model) {
@@ -167,23 +183,21 @@ static int kvm_openpic_init(SysBusDevice *dev)
         break;
 
     default:
-        return -EINVAL;
+        error_setg(errp, "Unsupported OpenPIC model %" PRIu32, opp->model);
+        return;
     }
 
     cd.type = kvm_openpic_model;
     ret = kvm_vm_ioctl(s, KVM_CREATE_DEVICE, &cd);
     if (ret < 0) {
-        qemu_log_mask(LOG_UNIMP, "%s: can't create device %d: %s\n",
-                      __func__, cd.type, strerror(errno));
-        return -EINVAL;
+        error_setg(errp, "Can't create device %d: %s",
+                   cd.type, strerror(errno));
+        return;
     }
     opp->fd = cd.fd;
 
-    memory_region_init_io(&opp->mem, &kvm_openpic_mem_ops, opp,
-                          "kvm-openpic", 0x40000);
-
-    sysbus_init_mmio(dev, &opp->mem);
-    qdev_init_gpio_in(&dev->qdev, kvm_openpic_set_irq, OPENPIC_MAX_IRQ);
+    sysbus_init_mmio(d, &opp->mem);
+    qdev_init_gpio_in(dev, kvm_openpic_set_irq, OPENPIC_MAX_IRQ);
 
     opp->mem_listener.region_add = kvm_openpic_region_add;
     opp->mem_listener.region_add = kvm_openpic_region_del;
@@ -205,13 +219,11 @@ static int kvm_openpic_init(SysBusDevice *dev)
     kvm_gsi_routing_allowed = true;
 
     kvm_irqchip_commit_routes(s);
-
-    return 0;
 }
 
 int kvm_openpic_connect_vcpu(DeviceState *d, CPUState *cs)
 {
-    KVMOpenPICState *opp = FROM_SYSBUS(typeof(*opp), SYS_BUS_DEVICE(d));
+    KVMOpenPICState *opp = KVM_OPENPIC(d);
     struct kvm_enable_cap encap = {};
 
     encap.cap = KVM_CAP_IRQ_MPIC;
@@ -227,20 +239,20 @@ static Property kvm_openpic_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static void kvm_openpic_class_init(ObjectClass *klass, void *data)
+static void kvm_openpic_class_init(ObjectClass *oc, void *data)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-    k->init = kvm_openpic_init;
+    dc->realize = kvm_openpic_realize;
     dc->props = kvm_openpic_properties;
     dc->reset = kvm_openpic_reset;
 }
 
 static const TypeInfo kvm_openpic_info = {
-    .name          = "kvm-openpic",
+    .name          = TYPE_KVM_OPENPIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(KVMOpenPICState),
+    .instance_init = kvm_openpic_init,
     .class_init    = kvm_openpic_class_init,
 };
 
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 3797fbc..38f7990 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -504,7 +504,7 @@ static DeviceState *ppce500_init_mpic_kvm(PPCE500Params *params,
     CPUState *cs;
     int r;
 
-    dev = qdev_create(NULL, "kvm-openpic");
+    dev = qdev_create(NULL, TYPE_KVM_OPENPIC);
     qdev_prop_set_uint32(dev, "model", params->mpic_version);
 
     r = qdev_init(dev);
diff --git a/include/hw/ppc/openpic.h b/include/hw/ppc/openpic.h
index ef3f5c3..ee67098 100644
--- a/include/hw/ppc/openpic.h
+++ b/include/hw/ppc/openpic.h
@@ -26,6 +26,7 @@ enum {
 #define OPENPIC_MAX_IRQ     (OPENPIC_MAX_SRC + OPENPIC_MAX_IPI + \
                              OPENPIC_MAX_TMR)
 
+#define TYPE_KVM_OPENPIC "kvm-openpic"
 int kvm_openpic_connect_vcpu(DeviceState *d, CPUState *cs);
 
 #endif /* __OPENPIC_H__ */
commit cbe72019b1432b368dde7c6cd3e270fc221de085
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jun 18 03:58:08 2013 +0200

    intc/openpic: Convert to QOM realize
    
    Split qdev initfn into instance_init and realize functions.
    Change one occurrence of "klass" while at it.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index fc2d104..a26c641 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -1527,8 +1527,16 @@ static void map_list(OpenPICState *opp, const MemReg *list, int *count)
     }
 }
 
-static int openpic_init(SysBusDevice *dev)
+static void openpic_init(Object *obj)
 {
+    OpenPICState *opp = OPENPIC(obj);
+
+    memory_region_init(&opp->mem, "openpic", 0x40000);
+}
+
+static void openpic_realize(DeviceState *dev, Error **errp)
+{
+    SysBusDevice *d = SYS_BUS_DEVICE(dev);
     OpenPICState *opp = OPENPIC(dev);
     int i, j;
     int list_count = 0;
@@ -1562,8 +1570,6 @@ static int openpic_init(SysBusDevice *dev)
         {NULL}
     };
 
-    memory_region_init(&opp->mem, "openpic", 0x40000);
-
     switch (opp->model) {
     case OPENPIC_MODEL_FSL_MPIC_20:
     default:
@@ -1606,9 +1612,9 @@ static int openpic_init(SysBusDevice *dev)
         opp->brr1 = -1;
         opp->mpic_mode_mask = GCR_MODE_MIXED;
 
-        /* Only UP supported today */
         if (opp->nb_cpus != 1) {
-            return -EINVAL;
+            error_setg(errp, "Only UP supported today");
+            return;
         }
 
         map_list(opp, list_le, &list_count);
@@ -1618,17 +1624,15 @@ static int openpic_init(SysBusDevice *dev)
     for (i = 0; i < opp->nb_cpus; i++) {
         opp->dst[i].irqs = g_new(qemu_irq, OPENPIC_OUTPUT_NB);
         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
-            sysbus_init_irq(dev, &opp->dst[i].irqs[j]);
+            sysbus_init_irq(d, &opp->dst[i].irqs[j]);
         }
     }
 
-    register_savevm(DEVICE(opp), "openpic", 0, 2,
+    register_savevm(dev, "openpic", 0, 2,
                     openpic_save, openpic_load, opp);
 
-    sysbus_init_mmio(dev, &opp->mem);
-    qdev_init_gpio_in(&dev->qdev, openpic_set_irq, opp->max_irq);
-
-    return 0;
+    sysbus_init_mmio(d, &opp->mem);
+    qdev_init_gpio_in(dev, openpic_set_irq, opp->max_irq);
 }
 
 static Property openpic_properties[] = {
@@ -1637,12 +1641,11 @@ static Property openpic_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static void openpic_class_init(ObjectClass *klass, void *data)
+static void openpic_class_init(ObjectClass *oc, void *data)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-    k->init = openpic_init;
+    dc->realize = openpic_realize;
     dc->props = openpic_properties;
     dc->reset = openpic_reset;
 }
@@ -1651,6 +1654,7 @@ static const TypeInfo openpic_info = {
     .name          = TYPE_OPENPIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OpenPICState),
+    .instance_init = openpic_init,
     .class_init    = openpic_class_init,
 };
 
commit e1766344fd1d3cb7421f734f89a9356fdec98398
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jun 18 03:58:07 2013 +0200

    intc/openpic: QOM'ify
    
    Introduce type constant and cast macro.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index ae42149..fc2d104 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -251,8 +251,13 @@ typedef struct IRQDest {
     uint32_t outputs_active[OPENPIC_OUTPUT_NB];
 } IRQDest;
 
+#define OPENPIC(obj) OBJECT_CHECK(OpenPICState, (obj), TYPE_OPENPIC)
+
 typedef struct OpenPICState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion mem;
 
     /* Behavior control */
@@ -533,7 +538,7 @@ static void openpic_set_irq(void *opaque, int n_IRQ, int level)
 
 static void openpic_reset(DeviceState *d)
 {
-    OpenPICState *opp = FROM_SYSBUS(typeof(*opp), SYS_BUS_DEVICE(d));
+    OpenPICState *opp = OPENPIC(d);
     int i;
 
     opp->gcr = GCR_RESET;
@@ -699,7 +704,7 @@ static void openpic_gcr_write(OpenPICState *opp, uint64_t val)
     bool mpic_proxy = false;
 
     if (val & GCR_RESET) {
-        openpic_reset(&opp->busdev.qdev);
+        openpic_reset(DEVICE(opp));
         return;
     }
 
@@ -1524,7 +1529,7 @@ static void map_list(OpenPICState *opp, const MemReg *list, int *count)
 
 static int openpic_init(SysBusDevice *dev)
 {
-    OpenPICState *opp = FROM_SYSBUS(typeof (*opp), dev);
+    OpenPICState *opp = OPENPIC(dev);
     int i, j;
     int list_count = 0;
     static const MemReg list_le[] = {
@@ -1617,7 +1622,7 @@ static int openpic_init(SysBusDevice *dev)
         }
     }
 
-    register_savevm(&opp->busdev.qdev, "openpic", 0, 2,
+    register_savevm(DEVICE(opp), "openpic", 0, 2,
                     openpic_save, openpic_load, opp);
 
     sysbus_init_mmio(dev, &opp->mem);
@@ -1643,7 +1648,7 @@ static void openpic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo openpic_info = {
-    .name          = "openpic",
+    .name          = TYPE_OPENPIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OpenPICState),
     .class_init    = openpic_class_init,
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index d38a688..3797fbc 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -479,7 +479,7 @@ static DeviceState *ppce500_init_mpic_qemu(PPCE500Params *params,
     SysBusDevice *s;
     int i, j, k;
 
-    dev = qdev_create(NULL, "openpic");
+    dev = qdev_create(NULL, TYPE_OPENPIC);
     qdev_prop_set_uint32(dev, "model", params->mpic_version);
     qdev_prop_set_uint32(dev, "nb_cpus", smp_cpus);
 
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index ce44e95..61c25a4 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -329,7 +329,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
 
     pic = g_new(qemu_irq, 64);
 
-    dev = qdev_create(NULL, "openpic");
+    dev = qdev_create(NULL, TYPE_OPENPIC);
     qdev_prop_set_uint32(dev, "model", OPENPIC_MODEL_RAVEN);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
diff --git a/include/hw/ppc/openpic.h b/include/hw/ppc/openpic.h
index 1fe4865..ef3f5c3 100644
--- a/include/hw/ppc/openpic.h
+++ b/include/hw/ppc/openpic.h
@@ -4,6 +4,8 @@
 #include "qemu-common.h"
 #include "hw/qdev.h"
 
+#define TYPE_OPENPIC "openpic"
+
 /* OpenPIC have 5 outputs per CPU connected and one IRQ out single output */
 enum {
     OPENPIC_OUTPUT_INT = 0, /* IRQ                       */
commit d85937e683f6ff4d68293cb24c780fb1f6820d2c
Author: Scott Wood <scottwood at freescale.com>
Date:   Wed Jun 12 15:32:51 2013 -0500

    kvm/openpic: in-kernel mpic support
    
    Enables support for the in-kernel MPIC that thas been merged into the
    KVM next branch.  This includes irqfd/KVM_IRQ_LINE support from Alex
    Graf (along with some other improvements).
    
    Note from Alex regarding kvm_irqchip_create():
    
      On x86, one would call kvm_irqchip_create() to initialize an
      in-kernel interrupt controller.  That function then goes ahead and
      initializes global capability variables as well as the default irq
      routing table.
    
      On ppc, we can't call kvm_irqchip_create() because we can have
      different types of interrupt controllers.  So we want to do all the
      things that function would do for us in the in-kernel device init
      handler.
    
    Signed-off-by: Scott Wood <scottwood at freescale.com>
    [agraf: squash in kvm_irqchip_commit_routes patch, fix non-kvm build,
            fix ppcemb]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/default-configs/ppc-softmmu.mak b/default-configs/ppc-softmmu.mak
index bcaa52f..73e4cc5 100644
--- a/default-configs/ppc-softmmu.mak
+++ b/default-configs/ppc-softmmu.mak
@@ -43,5 +43,6 @@ CONFIG_XILINX=y
 CONFIG_XILINX_ETHLITE=y
 CONFIG_OPENPIC=y
 CONFIG_E500=y
+CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 # For PReP
 CONFIG_MC146818RTC=y
diff --git a/default-configs/ppc64-softmmu.mak b/default-configs/ppc64-softmmu.mak
index 8b7874e..cb279cb 100644
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -44,6 +44,7 @@ CONFIG_XILINX_ETHLITE=y
 CONFIG_OPENPIC=y
 CONFIG_PSERIES=y
 CONFIG_E500=y
+CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 # For pSeries
 CONFIG_PCI_HOTPLUG=y
 # For PReP
diff --git a/default-configs/ppcemb-softmmu.mak b/default-configs/ppcemb-softmmu.mak
index 61920ff..e3b5e50 100644
--- a/default-configs/ppcemb-softmmu.mak
+++ b/default-configs/ppcemb-softmmu.mak
@@ -38,5 +38,6 @@ CONFIG_XILINX=y
 CONFIG_XILINX_ETHLITE=y
 CONFIG_OPENPIC=y
 CONFIG_E500=y
+CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 # For PReP
 CONFIG_MC146818RTC=y
diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index 3e68d2e..2ba49d0 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -20,4 +20,5 @@ obj-$(CONFIG_GRLIB) += grlib_irqmp.o
 obj-$(CONFIG_IOAPIC) += ioapic.o
 obj-$(CONFIG_OMAP) += omap_intc.o
 obj-$(CONFIG_OPENPIC) += openpic.o
+obj-$(CONFIG_OPENPIC_KVM) += openpic_kvm.o
 obj-$(CONFIG_SH4) += sh_intc.o
diff --git a/hw/intc/openpic_kvm.c b/hw/intc/openpic_kvm.c
new file mode 100644
index 0000000..17d0a35
--- /dev/null
+++ b/hw/intc/openpic_kvm.c
@@ -0,0 +1,252 @@
+/*
+ * KVM in-kernel OpenPIC
+ *
+ * Copyright 2013 Freescale Semiconductor, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include <sys/ioctl.h>
+#include "exec/address-spaces.h"
+#include "hw/hw.h"
+#include "hw/ppc/openpic.h"
+#include "hw/pci/msi.h"
+#include "hw/sysbus.h"
+#include "sysemu/kvm.h"
+#include "qemu/log.h"
+
+typedef struct KVMOpenPICState {
+    SysBusDevice busdev;
+    MemoryRegion mem;
+    MemoryListener mem_listener;
+    uint32_t fd;
+    uint32_t model;
+} KVMOpenPICState;
+
+static void kvm_openpic_set_irq(void *opaque, int n_IRQ, int level)
+{
+    kvm_set_irq(kvm_state, n_IRQ, level);
+}
+
+static void kvm_openpic_reset(DeviceState *d)
+{
+    qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__);
+}
+
+static void kvm_openpic_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned size)
+{
+    KVMOpenPICState *opp = opaque;
+    struct kvm_device_attr attr;
+    uint32_t val32 = val;
+    int ret;
+
+    attr.group = KVM_DEV_MPIC_GRP_REGISTER;
+    attr.attr = addr;
+    attr.addr = (uint64_t)(unsigned long)&val32;
+
+    ret = ioctl(opp->fd, KVM_SET_DEVICE_ATTR, &attr);
+    if (ret < 0) {
+        qemu_log_mask(LOG_UNIMP, "%s: %s %" PRIx64 "\n", __func__,
+                      strerror(errno), attr.attr);
+    }
+}
+
+static uint64_t kvm_openpic_read(void *opaque, hwaddr addr, unsigned size)
+{
+    KVMOpenPICState *opp = opaque;
+    struct kvm_device_attr attr;
+    uint32_t val = 0xdeadbeef;
+    int ret;
+
+    attr.group = KVM_DEV_MPIC_GRP_REGISTER;
+    attr.attr = addr;
+    attr.addr = (uint64_t)(unsigned long)&val;
+
+    ret = ioctl(opp->fd, KVM_GET_DEVICE_ATTR, &attr);
+    if (ret < 0) {
+        qemu_log_mask(LOG_UNIMP, "%s: %s %" PRIx64 "\n", __func__,
+                      strerror(errno), attr.attr);
+        return 0;
+    }
+
+    return val;
+}
+
+static const MemoryRegionOps kvm_openpic_mem_ops = {
+    .write = kvm_openpic_write,
+    .read  = kvm_openpic_read,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void kvm_openpic_region_add(MemoryListener *listener,
+                                   MemoryRegionSection *section)
+{
+    KVMOpenPICState *opp = container_of(listener, KVMOpenPICState,
+                                        mem_listener);
+    struct kvm_device_attr attr;
+    uint64_t reg_base;
+    int ret;
+
+    if (section->address_space != &address_space_memory) {
+        abort();
+    }
+
+    reg_base = section->offset_within_address_space;
+
+    attr.group = KVM_DEV_MPIC_GRP_MISC;
+    attr.attr = KVM_DEV_MPIC_BASE_ADDR;
+    attr.addr = (uint64_t)(unsigned long)&reg_base;
+
+    ret = ioctl(opp->fd, KVM_SET_DEVICE_ATTR, &attr);
+    if (ret < 0) {
+        fprintf(stderr, "%s: %s %" PRIx64 "\n", __func__,
+                strerror(errno), reg_base);
+    }
+}
+
+static void kvm_openpic_region_del(MemoryListener *listener,
+                                   MemoryRegionSection *section)
+{
+    KVMOpenPICState *opp = container_of(listener, KVMOpenPICState,
+                                        mem_listener);
+    struct kvm_device_attr attr;
+    uint64_t reg_base = 0;
+    int ret;
+
+    attr.group = KVM_DEV_MPIC_GRP_MISC;
+    attr.attr = KVM_DEV_MPIC_BASE_ADDR;
+    attr.addr = (uint64_t)(unsigned long)&reg_base;
+
+    ret = ioctl(opp->fd, KVM_SET_DEVICE_ATTR, &attr);
+    if (ret < 0) {
+        fprintf(stderr, "%s: %s %" PRIx64 "\n", __func__,
+                strerror(errno), reg_base);
+    }
+}
+
+static int kvm_openpic_init(SysBusDevice *dev)
+{
+    KVMState *s = kvm_state;
+    KVMOpenPICState *opp = FROM_SYSBUS(typeof(*opp), dev);
+    int kvm_openpic_model;
+    struct kvm_create_device cd = {0};
+    int ret, i;
+
+    if (!kvm_check_extension(s, KVM_CAP_DEVICE_CTRL)) {
+        return -EINVAL;
+    }
+
+    switch (opp->model) {
+    case OPENPIC_MODEL_FSL_MPIC_20:
+        kvm_openpic_model = KVM_DEV_TYPE_FSL_MPIC_20;
+        break;
+
+    case OPENPIC_MODEL_FSL_MPIC_42:
+        kvm_openpic_model = KVM_DEV_TYPE_FSL_MPIC_42;
+        break;
+
+    default:
+        return -EINVAL;
+    }
+
+    cd.type = kvm_openpic_model;
+    ret = kvm_vm_ioctl(s, KVM_CREATE_DEVICE, &cd);
+    if (ret < 0) {
+        qemu_log_mask(LOG_UNIMP, "%s: can't create device %d: %s\n",
+                      __func__, cd.type, strerror(errno));
+        return -EINVAL;
+    }
+    opp->fd = cd.fd;
+
+    memory_region_init_io(&opp->mem, &kvm_openpic_mem_ops, opp,
+                          "kvm-openpic", 0x40000);
+
+    sysbus_init_mmio(dev, &opp->mem);
+    qdev_init_gpio_in(&dev->qdev, kvm_openpic_set_irq, OPENPIC_MAX_IRQ);
+
+    opp->mem_listener.region_add = kvm_openpic_region_add;
+    opp->mem_listener.region_add = kvm_openpic_region_del;
+    memory_listener_register(&opp->mem_listener, &address_space_memory);
+
+    /* indicate pic capabilities */
+    msi_supported = true;
+    kvm_kernel_irqchip = true;
+    kvm_async_interrupts_allowed = true;
+
+    /* set up irq routing */
+    kvm_init_irq_routing(kvm_state);
+    for (i = 0; i < 256; ++i) {
+        kvm_irqchip_add_irq_route(kvm_state, i, 0, i);
+    }
+
+    kvm_irqfds_allowed = true;
+    kvm_msi_via_irqfd_allowed = true;
+    kvm_gsi_routing_allowed = true;
+
+    kvm_irqchip_commit_routes(s);
+
+    return 0;
+}
+
+int kvm_openpic_connect_vcpu(DeviceState *d, CPUState *cs)
+{
+    KVMOpenPICState *opp = FROM_SYSBUS(typeof(*opp), SYS_BUS_DEVICE(d));
+    struct kvm_enable_cap encap = {};
+
+    encap.cap = KVM_CAP_IRQ_MPIC;
+    encap.args[0] = opp->fd;
+    encap.args[1] = cs->cpu_index;
+
+    return kvm_vcpu_ioctl(cs, KVM_ENABLE_CAP, &encap);
+}
+
+static Property kvm_openpic_properties[] = {
+    DEFINE_PROP_UINT32("model", KVMOpenPICState, model,
+                       OPENPIC_MODEL_FSL_MPIC_20),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void kvm_openpic_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+
+    k->init = kvm_openpic_init;
+    dc->props = kvm_openpic_properties;
+    dc->reset = kvm_openpic_reset;
+}
+
+static const TypeInfo kvm_openpic_info = {
+    .name          = "kvm-openpic",
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(KVMOpenPICState),
+    .class_init    = kvm_openpic_class_init,
+};
+
+static void kvm_openpic_register_types(void)
+{
+    type_register_static(&kvm_openpic_info);
+}
+
+type_init(kvm_openpic_register_types)
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 2d57b29..d38a688 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -472,18 +472,17 @@ static void ppce500_cpu_reset(void *opaque)
     mmubooke_create_initial_mapping(env);
 }
 
-static qemu_irq *ppce500_init_mpic(PPCE500Params *params, MemoryRegion *ccsr,
-                                   qemu_irq **irqs)
+static DeviceState *ppce500_init_mpic_qemu(PPCE500Params *params,
+                                           qemu_irq **irqs)
 {
-    qemu_irq *mpic;
     DeviceState *dev;
     SysBusDevice *s;
     int i, j, k;
 
-    mpic = g_new(qemu_irq, 256);
     dev = qdev_create(NULL, "openpic");
-    qdev_prop_set_uint32(dev, "nb_cpus", smp_cpus);
     qdev_prop_set_uint32(dev, "model", params->mpic_version);
+    qdev_prop_set_uint32(dev, "nb_cpus", smp_cpus);
+
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -494,10 +493,80 @@ static qemu_irq *ppce500_init_mpic(PPCE500Params *params, MemoryRegion *ccsr,
         }
     }
 
+    return dev;
+}
+
+static DeviceState *ppce500_init_mpic_kvm(PPCE500Params *params,
+                                          qemu_irq **irqs)
+{
+    DeviceState *dev;
+    CPUPPCState *env;
+    CPUState *cs;
+    int r;
+
+    dev = qdev_create(NULL, "kvm-openpic");
+    qdev_prop_set_uint32(dev, "model", params->mpic_version);
+
+    r = qdev_init(dev);
+    if (r) {
+        return NULL;
+    }
+
+    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        cs = ENV_GET_CPU(env);
+
+        if (kvm_openpic_connect_vcpu(dev, cs)) {
+            fprintf(stderr, "%s: failed to connect vcpu to irqchip\n",
+                    __func__);
+            abort();
+        }
+    }
+
+    return dev;
+}
+
+static qemu_irq *ppce500_init_mpic(PPCE500Params *params, MemoryRegion *ccsr,
+                                   qemu_irq **irqs)
+{
+    QemuOptsList *list;
+    qemu_irq *mpic;
+    DeviceState *dev = NULL;
+    SysBusDevice *s;
+    int i;
+
+    mpic = g_new(qemu_irq, 256);
+
+    if (kvm_enabled()) {
+        bool irqchip_allowed = true, irqchip_required = false;
+
+        list = qemu_find_opts("machine");
+        if (!QTAILQ_EMPTY(&list->head)) {
+            irqchip_allowed = qemu_opt_get_bool(QTAILQ_FIRST(&list->head),
+                                                "kernel_irqchip", true);
+            irqchip_required = qemu_opt_get_bool(QTAILQ_FIRST(&list->head),
+                                                 "kernel_irqchip", false);
+        }
+
+        if (irqchip_allowed) {
+            dev = ppce500_init_mpic_kvm(params, irqs);
+        }
+
+        if (irqchip_required && !dev) {
+            fprintf(stderr, "%s: irqchip requested but unavailable\n",
+                    __func__);
+            abort();
+        }
+    }
+
+    if (!dev) {
+        dev = ppce500_init_mpic_qemu(params, irqs);
+    }
+
     for (i = 0; i < 256; i++) {
         mpic[i] = qdev_get_gpio_in(dev, i);
     }
 
+    s = SYS_BUS_DEVICE(dev);
     memory_region_add_subregion(ccsr, MPC8544_MPIC_REGS_OFFSET,
                                 s->mmio[0].memory);
 
diff --git a/include/hw/ppc/openpic.h b/include/hw/ppc/openpic.h
index d873bb6..1fe4865 100644
--- a/include/hw/ppc/openpic.h
+++ b/include/hw/ppc/openpic.h
@@ -24,6 +24,6 @@ enum {
 #define OPENPIC_MAX_IRQ     (OPENPIC_MAX_SRC + OPENPIC_MAX_IPI + \
                              OPENPIC_MAX_TMR)
 
-DeviceState *kvm_openpic_create(BusState *bus, int model);
+int kvm_openpic_connect_vcpu(DeviceState *d, CPUState *cs);
 
 #endif /* __OPENPIC_H__ */
diff --git a/target-ppc/kvm-stub.c b/target-ppc/kvm-stub.c
index 0f5c27d..ee3f5d2 100644
--- a/target-ppc/kvm-stub.c
+++ b/target-ppc/kvm-stub.c
@@ -10,3 +10,9 @@
  *
  */
 #include "qemu-common.h"
+#include "hw/ppc/openpic.h"
+
+int kvm_openpic_connect_vcpu(DeviceState *d, CPUState *cs)
+{
+    return -EINVAL;
+}
commit 4be1db86060d803f2335c08a483218eb6a8bd9eb
Author: Alexander Graf <agraf at suse.de>
Date:   Fri Jun 28 13:47:15 2013 +0200

    PPC: Add non-kvm stub file
    
    There are cases where a kvm provided function is called from generic
    hw code that doesn't know whether kvm is available or not. Provide
    a stub file which can provide simple replacement functions for those
    cases.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/target-ppc/Makefile.objs b/target-ppc/Makefile.objs
index 2c43c34..6e78cb3 100644
--- a/target-ppc/Makefile.objs
+++ b/target-ppc/Makefile.objs
@@ -5,6 +5,7 @@ obj-y += machine.o mmu_helper.o mmu-hash32.o
 obj-$(TARGET_PPC64) += mmu-hash64.o
 endif
 obj-$(CONFIG_KVM) += kvm.o kvm_ppc.o
+obj-$(CONFIG_NO_KVM) += kvm-stub.o
 obj-y += excp_helper.o
 obj-y += fpu_helper.o
 obj-y += int_helper.o
diff --git a/target-ppc/kvm-stub.c b/target-ppc/kvm-stub.c
new file mode 100644
index 0000000..0f5c27d
--- /dev/null
+++ b/target-ppc/kvm-stub.c
@@ -0,0 +1,12 @@
+/*
+ * QEMU KVM PPC specific function stubs
+ *
+ * Copyright Freescale Inc. 2013
+ *
+ * Author: Alexander Graf <agraf at suse.de>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+#include "qemu-common.h"
commit cb925cf9230f77c096dae4b159a9449bc306256c
Author: Alexander Graf <agraf at suse.de>
Date:   Wed Apr 17 01:11:55 2013 +0200

    KVM: PIC: Only commit irq routing when necessary
    
    The current logic updates KVM's view of our interrupt map every time we
    change it. While this is nice and bullet proof, it slows things down
    badly for me. QEMU spends about 3 seconds on every start telling KVM what
    news it has on its routing maps.
    
    Instead, let's just synchronize the whole irq routing map as a whole when
    we're done constructing it. For things that change during runtime, we can
    still update the routing table on demand.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/i386/kvm/ioapic.c b/hw/i386/kvm/ioapic.c
index a3bd519..abfac3d 100644
--- a/hw/i386/kvm/ioapic.c
+++ b/hw/i386/kvm/ioapic.c
@@ -40,6 +40,7 @@ void kvm_pc_setup_irq_routing(bool pci_enabled)
                 }
             }
         }
+        kvm_irqchip_commit_routes(s);
     }
 }
 
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 0a6e62a..a14cfe9 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -230,6 +230,7 @@ int kvm_set_irq(KVMState *s, int irq, int level);
 int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg);
 
 void kvm_irqchip_add_irq_route(KVMState *s, int gsi, int irqchip, int pin);
+void kvm_irqchip_commit_routes(KVMState *s);
 
 void kvm_put_apic_state(DeviceState *d, struct kvm_lapic_state *kapic);
 void kvm_get_apic_state(DeviceState *d, struct kvm_lapic_state *kapic);
diff --git a/kvm-all.c b/kvm-all.c
index 76435f5..c757dd2 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -985,7 +985,7 @@ void kvm_init_irq_routing(KVMState *s)
     kvm_arch_init_irq_routing(s);
 }
 
-static void kvm_irqchip_commit_routes(KVMState *s)
+void kvm_irqchip_commit_routes(KVMState *s)
 {
     int ret;
 
@@ -1019,8 +1019,6 @@ static void kvm_add_routing_entry(KVMState *s,
     new->u = entry->u;
 
     set_gsi(s, entry->gsi);
-
-    kvm_irqchip_commit_routes(s);
 }
 
 static int kvm_update_routing_entry(KVMState *s,
@@ -1171,6 +1169,7 @@ int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
         route->kroute.u.msi.data = le32_to_cpu(msg.data);
 
         kvm_add_routing_entry(s, &route->kroute);
+        kvm_irqchip_commit_routes(s);
 
         QTAILQ_INSERT_TAIL(&s->msi_hashtab[kvm_hash_msi(msg.data)], route,
                            entry);
@@ -1203,6 +1202,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg)
     kroute.u.msi.data = le32_to_cpu(msg.data);
 
     kvm_add_routing_entry(s, &kroute);
+    kvm_irqchip_commit_routes(s);
 
     return virq;
 }
commit 82fc73b65c19fed0ee28aeb655d27de5ac9e78d5
Author: Scott Wood <scottwood at freescale.com>
Date:   Mon Apr 15 13:19:33 2013 +0000

    PPC: e500: factor out mpic init code
    
    KVM in-kernel MPIC support is going to expand this even more,
    so let's keep it contained.
    
    Signed-off-by: Scott Wood <scottwood at freescale.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index c9ae512..2d57b29 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -472,6 +472,38 @@ static void ppce500_cpu_reset(void *opaque)
     mmubooke_create_initial_mapping(env);
 }
 
+static qemu_irq *ppce500_init_mpic(PPCE500Params *params, MemoryRegion *ccsr,
+                                   qemu_irq **irqs)
+{
+    qemu_irq *mpic;
+    DeviceState *dev;
+    SysBusDevice *s;
+    int i, j, k;
+
+    mpic = g_new(qemu_irq, 256);
+    dev = qdev_create(NULL, "openpic");
+    qdev_prop_set_uint32(dev, "nb_cpus", smp_cpus);
+    qdev_prop_set_uint32(dev, "model", params->mpic_version);
+    qdev_init_nofail(dev);
+    s = SYS_BUS_DEVICE(dev);
+
+    k = 0;
+    for (i = 0; i < smp_cpus; i++) {
+        for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
+            sysbus_connect_irq(s, k++, irqs[i][j]);
+        }
+    }
+
+    for (i = 0; i < 256; i++) {
+        mpic[i] = qdev_get_gpio_in(dev, i);
+    }
+
+    memory_region_add_subregion(ccsr, MPC8544_MPIC_REGS_OFFSET,
+                                s->mmio[0].memory);
+
+    return mpic;
+}
+
 void ppce500_init(PPCE500Params *params)
 {
     MemoryRegion *address_space_mem = get_system_memory();
@@ -487,7 +519,7 @@ void ppce500_init(PPCE500Params *params)
     target_ulong initrd_base = 0;
     target_long initrd_size = 0;
     target_ulong cur_base = 0;
-    int i = 0, j, k;
+    int i;
     unsigned int pci_irq_nrs[4] = {1, 2, 3, 4};
     qemu_irq **irqs, *mpic;
     DeviceState *dev;
@@ -563,27 +595,7 @@ void ppce500_init(PPCE500Params *params)
     memory_region_add_subregion(address_space_mem, MPC8544_CCSRBAR_BASE,
                                 ccsr_addr_space);
 
-    /* MPIC */
-    mpic = g_new(qemu_irq, 256);
-    dev = qdev_create(NULL, "openpic");
-    qdev_prop_set_uint32(dev, "nb_cpus", smp_cpus);
-    qdev_prop_set_uint32(dev, "model", params->mpic_version);
-    qdev_init_nofail(dev);
-    s = SYS_BUS_DEVICE(dev);
-
-    k = 0;
-    for (i = 0; i < smp_cpus; i++) {
-        for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
-            sysbus_connect_irq(s, k++, irqs[i][j]);
-        }
-    }
-
-    for (i = 0; i < 256; i++) {
-        mpic[i] = qdev_get_gpio_in(dev, i);
-    }
-
-    memory_region_add_subregion(ccsr_addr_space, MPC8544_MPIC_REGS_OFFSET,
-                                s->mmio[0].memory);
+    mpic = ppce500_init_mpic(params, ccsr_addr_space, irqs);
 
     /* Serial */
     if (serial_hds[0]) {
commit 8935a442cd3cf94f21fcc4386c1c07a7a5dd6887
Author: Scott Wood <scottwood at freescale.com>
Date:   Mon Apr 15 13:19:32 2013 +0000

    openpic: factor out some common defines into openpic.h
    
    ...for use by the KVM in-kernel irqchip stub.
    
    Signed-off-by: Scott Wood <scottwood at freescale.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index c788714..ae42149 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -57,11 +57,7 @@ static const int debug_openpic = 0;
     } while (0)
 
 #define MAX_CPU     32
-#define MAX_SRC     256
-#define MAX_TMR     4
-#define MAX_IPI     4
 #define MAX_MSI     8
-#define MAX_IRQ     (MAX_SRC + MAX_IPI + MAX_TMR)
 #define VID         0x03 /* MPIC version ID */
 
 /* OpenPIC capability flags */
@@ -78,7 +74,7 @@ static const int debug_openpic = 0;
 #define OPENPIC_SUMMARY_REG_START   0x3800
 #define OPENPIC_SUMMARY_REG_SIZE    0x800
 #define OPENPIC_SRC_REG_START        0x10000
-#define OPENPIC_SRC_REG_SIZE         (MAX_SRC * 0x20)
+#define OPENPIC_SRC_REG_SIZE         (OPENPIC_MAX_SRC * 0x20)
 #define OPENPIC_CPU_REG_START        0x20000
 #define OPENPIC_CPU_REG_SIZE         0x100 + ((MAX_CPU - 1) * 0x1000)
 
@@ -86,8 +82,8 @@ static const int debug_openpic = 0;
 #define RAVEN_MAX_CPU      2
 #define RAVEN_MAX_EXT     48
 #define RAVEN_MAX_IRQ     64
-#define RAVEN_MAX_TMR      MAX_TMR
-#define RAVEN_MAX_IPI      MAX_IPI
+#define RAVEN_MAX_TMR      OPENPIC_MAX_TMR
+#define RAVEN_MAX_IPI      OPENPIC_MAX_IPI
 
 /* Interrupt definitions */
 #define RAVEN_FE_IRQ     (RAVEN_MAX_EXT)     /* Internal functional IRQ */
@@ -209,7 +205,7 @@ typedef struct IRQQueue {
     /* Round up to the nearest 64 IRQs so that the queue length
      * won't change when moving between 32 and 64 bit hosts.
      */
-    unsigned long queue[BITS_TO_LONGS((MAX_IRQ + 63) & ~63)];
+    unsigned long queue[BITS_TO_LONGS((OPENPIC_MAX_IRQ + 63) & ~63)];
     int next;
     int priority;
 } IRQQueue;
@@ -283,7 +279,7 @@ typedef struct OpenPICState {
     uint32_t spve; /* Spurious vector register */
     uint32_t tfrr; /* Timer frequency reporting register */
     /* Source registers */
-    IRQSource src[MAX_IRQ];
+    IRQSource src[OPENPIC_MAX_IRQ];
     /* Local registers per output pin */
     IRQDest dst[MAX_CPU];
     uint32_t nb_cpus;
@@ -291,7 +287,7 @@ typedef struct OpenPICState {
     struct {
         uint32_t tccr;  /* Global timer current count register */
         uint32_t tbcr;  /* Global timer base count register */
-    } timers[MAX_TMR];
+    } timers[OPENPIC_MAX_TMR];
     /* Shared MSI registers */
     struct {
         uint32_t msir;   /* Shared Message Signaled Interrupt Register */
@@ -503,7 +499,7 @@ static void openpic_set_irq(void *opaque, int n_IRQ, int level)
     OpenPICState *opp = opaque;
     IRQSource *src;
 
-    if (n_IRQ >= MAX_IRQ) {
+    if (n_IRQ >= OPENPIC_MAX_IRQ) {
         fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
         abort();
     }
@@ -576,7 +572,7 @@ static void openpic_reset(DeviceState *d)
         opp->dst[i].servicing.next = -1;
     }
     /* Initialise timers */
-    for (i = 0; i < MAX_TMR; i++) {
+    for (i = 0; i < OPENPIC_MAX_TMR; i++) {
         opp->timers[i].tccr = 0;
         opp->timers[i].tbcr = TBCR_CI;
     }
@@ -1182,7 +1178,7 @@ static uint32_t openpic_iack(OpenPICState *opp, IRQDest *dst, int cpu)
         IRQ_resetbit(&dst->raised, irq);
     }
 
-    if ((irq >= opp->irq_ipi0) &&  (irq < (opp->irq_ipi0 + MAX_IPI))) {
+    if ((irq >= opp->irq_ipi0) &&  (irq < (opp->irq_ipi0 + OPENPIC_MAX_IPI))) {
         src->destmask &= ~(1 << cpu);
         if (src->destmask && !src->level) {
             /* trigger on CPUs that didn't know about it yet */
@@ -1381,7 +1377,7 @@ static void openpic_save(QEMUFile* f, void *opaque)
                         sizeof(opp->dst[i].outputs_active));
     }
 
-    for (i = 0; i < MAX_TMR; i++) {
+    for (i = 0; i < OPENPIC_MAX_TMR; i++) {
         qemu_put_be32s(f, &opp->timers[i].tccr);
         qemu_put_be32s(f, &opp->timers[i].tbcr);
     }
@@ -1440,7 +1436,7 @@ static int openpic_load(QEMUFile* f, void *opaque, int version_id)
                         sizeof(opp->dst[i].outputs_active));
     }
 
-    for (i = 0; i < MAX_TMR; i++) {
+    for (i = 0; i < OPENPIC_MAX_TMR; i++) {
         qemu_get_be32s(f, &opp->timers[i].tccr);
         qemu_get_be32s(f, &opp->timers[i].tbcr);
     }
@@ -1473,7 +1469,7 @@ typedef struct MemReg {
 static void fsl_common_init(OpenPICState *opp)
 {
     int i;
-    int virq = MAX_SRC;
+    int virq = OPENPIC_MAX_SRC;
 
     opp->vid = VID_REVISION_1_2;
     opp->vir = VIR_GENERIC;
@@ -1481,14 +1477,14 @@ static void fsl_common_init(OpenPICState *opp)
     opp->tfrr_reset = 0;
     opp->ivpr_reset = IVPR_MASK_MASK;
     opp->idr_reset = 1 << 0;
-    opp->max_irq = MAX_IRQ;
+    opp->max_irq = OPENPIC_MAX_IRQ;
 
     opp->irq_ipi0 = virq;
-    virq += MAX_IPI;
+    virq += OPENPIC_MAX_IPI;
     opp->irq_tim0 = virq;
-    virq += MAX_TMR;
+    virq += OPENPIC_MAX_TMR;
 
-    assert(virq <= MAX_IRQ);
+    assert(virq <= OPENPIC_MAX_IRQ);
 
     opp->irq_msi = 224;
 
@@ -1498,13 +1494,13 @@ static void fsl_common_init(OpenPICState *opp)
     }
 
     /* Internal interrupts, including message and MSI */
-    for (i = 16; i < MAX_SRC; i++) {
+    for (i = 16; i < OPENPIC_MAX_SRC; i++) {
         opp->src[i].type = IRQ_TYPE_FSLINT;
         opp->src[i].level = true;
     }
 
     /* timers and IPIs */
-    for (i = MAX_SRC; i < virq; i++) {
+    for (i = OPENPIC_MAX_SRC; i < virq; i++) {
         opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
         opp->src[i].level = false;
     }
diff --git a/include/hw/ppc/openpic.h b/include/hw/ppc/openpic.h
index 9dcaf0e..d873bb6 100644
--- a/include/hw/ppc/openpic.h
+++ b/include/hw/ppc/openpic.h
@@ -1,6 +1,9 @@
 #if !defined(__OPENPIC_H__)
 #define __OPENPIC_H__
 
+#include "qemu-common.h"
+#include "hw/qdev.h"
+
 /* OpenPIC have 5 outputs per CPU connected and one IRQ out single output */
 enum {
     OPENPIC_OUTPUT_INT = 0, /* IRQ                       */
@@ -15,4 +18,12 @@ enum {
 #define OPENPIC_MODEL_FSL_MPIC_20 1
 #define OPENPIC_MODEL_FSL_MPIC_42 2
 
+#define OPENPIC_MAX_SRC     256
+#define OPENPIC_MAX_TMR     4
+#define OPENPIC_MAX_IPI     4
+#define OPENPIC_MAX_IRQ     (OPENPIC_MAX_SRC + OPENPIC_MAX_IPI + \
+                             OPENPIC_MAX_TMR)
+
+DeviceState *kvm_openpic_create(BusState *bus, int model);
+
 #endif /* __OPENPIC_H__ */
commit d07cc1f12d8e15c167857852c39190d770763824
Author: Alexander Graf <agraf at suse.de>
Date:   Tue Apr 16 15:05:22 2013 +0200

    KVM: MSI: Swap payload to native endianness
    
    The usual MSI injection mechanism writes msi.data into memory using an
    le32 wrapper. So on big endian guests, this swaps msg.data into the
    expected byte order.
    
    For irqfd however, we don't swap the payload right now, rendering
    in-kernel MPIC emulation broken on PowerPC.
    
    Swap msg.data to the correct endianness whenever we touch it.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/kvm-all.c b/kvm-all.c
index a5ab2a3..76435f5 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1131,7 +1131,7 @@ static KVMMSIRoute *kvm_lookup_msi_route(KVMState *s, MSIMessage msg)
     QTAILQ_FOREACH(route, &s->msi_hashtab[hash], entry) {
         if (route->kroute.u.msi.address_lo == (uint32_t)msg.address &&
             route->kroute.u.msi.address_hi == (msg.address >> 32) &&
-            route->kroute.u.msi.data == msg.data) {
+            route->kroute.u.msi.data == le32_to_cpu(msg.data)) {
             return route;
         }
     }
@@ -1146,7 +1146,7 @@ int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
     if (s->direct_msi) {
         msi.address_lo = (uint32_t)msg.address;
         msi.address_hi = msg.address >> 32;
-        msi.data = msg.data;
+        msi.data = le32_to_cpu(msg.data);
         msi.flags = 0;
         memset(msi.pad, 0, sizeof(msi.pad));
 
@@ -1168,7 +1168,7 @@ int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
         route->kroute.flags = 0;
         route->kroute.u.msi.address_lo = (uint32_t)msg.address;
         route->kroute.u.msi.address_hi = msg.address >> 32;
-        route->kroute.u.msi.data = msg.data;
+        route->kroute.u.msi.data = le32_to_cpu(msg.data);
 
         kvm_add_routing_entry(s, &route->kroute);
 
@@ -1200,7 +1200,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg)
     kroute.flags = 0;
     kroute.u.msi.address_lo = (uint32_t)msg.address;
     kroute.u.msi.address_hi = msg.address >> 32;
-    kroute.u.msi.data = msg.data;
+    kroute.u.msi.data = le32_to_cpu(msg.data);
 
     kvm_add_routing_entry(s, &kroute);
 
@@ -1220,7 +1220,7 @@ int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg)
     kroute.flags = 0;
     kroute.u.msi.address_lo = (uint32_t)msg.address;
     kroute.u.msi.address_hi = msg.address >> 32;
-    kroute.u.msi.data = msg.data;
+    kroute.u.msi.data = le32_to_cpu(msg.data);
 
     return kvm_update_routing_entry(s, &kroute);
 }
commit 7b7745930b1f14057b41a257524c559e62c5faa7
Author: Alexander Graf <agraf at suse.de>
Date:   Tue Apr 16 15:58:13 2013 +0200

    KVM: Export kvm_init_irq_routing
    
    On PPC, we can have different types of interrupt controllers, so we really
    only know that we are going to use one when we created it.
    
    Export kvm_init_irq_routing() to common code, so that we don't have to call
    kvm_irqchip_create().
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 24c8e95..0a6e62a 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -312,4 +312,5 @@ int kvm_irqchip_add_irqfd_notifier(KVMState *s, EventNotifier *n, int virq);
 int kvm_irqchip_remove_irqfd_notifier(KVMState *s, EventNotifier *n, int virq);
 void kvm_pc_gsi_handler(void *opaque, int n, int level);
 void kvm_pc_setup_irq_routing(bool pci_enabled);
+void kvm_init_irq_routing(KVMState *s);
 #endif
diff --git a/kvm-all.c b/kvm-all.c
index 82ecebb..a5ab2a3 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -954,7 +954,7 @@ static void clear_gsi(KVMState *s, unsigned int gsi)
     s->used_gsi_bitmap[gsi / 32] &= ~(1U << (gsi % 32));
 }
 
-static void kvm_init_irq_routing(KVMState *s)
+void kvm_init_irq_routing(KVMState *s)
 {
     int gsi_count, i;
 
@@ -1242,7 +1242,7 @@ static int kvm_irqchip_assign_irqfd(KVMState *s, int fd, int virq, bool assign)
 
 #else /* !KVM_CAP_IRQ_ROUTING */
 
-static void kvm_init_irq_routing(KVMState *s)
+void kvm_init_irq_routing(KVMState *s)
 {
 }
 
diff --git a/kvm-stub.c b/kvm-stub.c
index 5457fe8..dec7a83 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -122,6 +122,10 @@ int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg)
     return -ENOSYS;
 }
 
+void kvm_init_irq_routing(KVMState *s)
+{
+}
+
 void kvm_irqchip_release_virq(KVMState *s, int virq)
 {
 }
commit 215e79c01c4e6f766eb9add56c56453e9ea1d948
Author: Alexander Graf <agraf at suse.de>
Date:   Wed Apr 24 22:24:12 2013 +0200

    KVM: Don't assume that mpstate exists with in-kernel PIC always
    
    On PPC, we don't support MP state. So far it's not necessary and I'm
    not convinced yet that we really need to support it ever.
    
    However, the current idle logic in QEMU assumes that an in-kernel PIC
    also means we support MP state. This assumption is not true anymore.
    
    Let's split up the two cases into two different variables. That way
    PPC can expose an in-kernel PIC, while not implementing MP state.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    CC: Jan Kiszka <jan.kiszka at siemens.com>

diff --git a/cpus.c b/cpus.c
index 86571f9..20958e5 100644
--- a/cpus.c
+++ b/cpus.c
@@ -71,7 +71,7 @@ static bool cpu_thread_is_idle(CPUState *cpu)
         return true;
     }
     if (!cpu->halted || qemu_cpu_has_work(cpu) ||
-        kvm_async_interrupts_enabled()) {
+        kvm_halt_in_kernel()) {
         return false;
     }
     return true;
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index fe8bc40..24c8e95 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -42,6 +42,7 @@
 extern bool kvm_allowed;
 extern bool kvm_kernel_irqchip;
 extern bool kvm_async_interrupts_allowed;
+extern bool kvm_halt_in_kernel_allowed;
 extern bool kvm_irqfds_allowed;
 extern bool kvm_msi_via_irqfd_allowed;
 extern bool kvm_gsi_routing_allowed;
@@ -73,6 +74,14 @@ extern bool kvm_readonly_mem_allowed;
 #define kvm_async_interrupts_enabled() (kvm_async_interrupts_allowed)
 
 /**
+ * kvm_halt_in_kernel
+ *
+ * Returns: true if halted cpus should still get a KVM_RUN ioctl to run
+ * inside of kernel space. This only works if MP state is implemented.
+ */
+#define kvm_halt_in_kernel() (kvm_halt_in_kernel_allowed)
+
+/**
  * kvm_irqfds_enabled:
  *
  * Returns: true if we can use irqfds to inject interrupts into
@@ -110,6 +119,7 @@ extern bool kvm_readonly_mem_allowed;
 #define kvm_enabled()           (0)
 #define kvm_irqchip_in_kernel() (false)
 #define kvm_async_interrupts_enabled() (false)
+#define kvm_halt_in_kernel() (false)
 #define kvm_irqfds_enabled() (false)
 #define kvm_msi_via_irqfd_enabled() (false)
 #define kvm_gsi_routing_allowed() (false)
diff --git a/kvm-all.c b/kvm-all.c
index 7a1684e..82ecebb 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -107,6 +107,7 @@ struct KVMState
 KVMState *kvm_state;
 bool kvm_kernel_irqchip;
 bool kvm_async_interrupts_allowed;
+bool kvm_halt_in_kernel_allowed;
 bool kvm_irqfds_allowed;
 bool kvm_msi_via_irqfd_allowed;
 bool kvm_gsi_routing_allowed;
@@ -1303,6 +1304,7 @@ static int kvm_irqchip_create(KVMState *s)
      * interrupt delivery (though the reverse is not necessarily true)
      */
     kvm_async_interrupts_allowed = true;
+    kvm_halt_in_kernel_allowed = true;
 
     kvm_init_irq_routing(s);
 
commit ffeec223b55ea696567ed544016824199cd7c7bc
Merge: 2ea3e2c a8ad415
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jun 28 15:48:35 2013 -0500

    Merge remote-tracking branch 'mjt/trivial-patches' into staging
    
    # By Gerd Hoffmann (13) and Michael Tokarev (1)
    # Via Michael Tokarev
    * mjt/trivial-patches:
      doc: we use seabios, not bochs bios
      qemu-socket: don't leak opts on error
      qemu-char: report udp backend errors
      qemu-char: add -chardev mux support
      qemu-char: minor mux chardev fixes
      qemu-char: use ChardevBackendKind in CharDriver
      qemu-char: don't leak opts on error
      qemu-char: fix documentation for telnet+wait socket flags
      qemu-char: print notification to stderr
      qemu-char: use more specific error_setg_* variants
      qemu-char: check optional fields using has_*
      qemu-socket: catch monitor_get_fd failures
      qemu-socket: drop pointless allocation
      qemu-socket: zero-initialize SocketAddress
    
    Message-id: 1372443465-22384-1-git-send-email-mjt at msgid.tls.msk.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit fbe2e26c15af35e4d157874dc80f6a19eebaa83b
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jun 19 16:10:55 2013 +0200

    hmp: Make "info block" output more readable
    
    HMP is meant for humans and you should notice it.
    
    This changes the output format to use a bit more space to display the
    information more readable and leaves out irrelevant information (e.g.
    mention only that an image is encrypted, but not when it's not; display
    I/O limits only if throttling is in effect; ...)
    
    Before:
    
        (qemu) info block
        ide0-hd0: removable=0 io-status=ok file=/tmp/overlay.qcow2
        backing_file=/tmp/backing.img backing_file_depth=1 ro=0 drv=qcow2
        encrypted=1 bps=0 bps_rd=0 bps_wr=0 iops=1024 iops_rd=0 iops_wr=0
        ide1-cd0: removable=1 locked=0 tray-open=0 io-status=ok
        file=/home/kwolf/images/iso/Fedora-18-x86_64-Live-Desktop.iso ro=1
        drv=raw encrypted=0 bps=0 bps_rd=0 bps_wr=0 iops=0 iops_rd=0 iops_wr=0
        floppy0: removable=1 locked=0 tray-open=0 [not inserted]
        sd0: removable=1 locked=0 tray-open=0 [not inserted]
    
    After:
    
        (qemu) info block
        ide0-hd0: /tmp/overlay.qcow2 (qcow2, encrypted)
            Backing file:     /tmp/backing.img (chain depth: 1)
            I/O limits:       bps=0 bps_rd=0 bps_wr=0 iops=1024 iops_rd=0 iops_wr=0
    
        ide1-cd0: /home/kwolf/images/iso/Fedora-18-x86_64-Live-Desktop.iso (raw, read-only)
            Removable device: not locked, tray closed
    
        floppy0: [not inserted]
            Removable device: not locked, tray closed
    
        sd0: [not inserted]
            Removable device: not locked, tray closed
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Fam Zheng <famz at redhat.com>
    Acked-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/hmp.c b/hmp.c
index 148a3fb..2daed43 100644
--- a/hmp.c
+++ b/hmp.c
@@ -291,62 +291,78 @@ void hmp_info_block(Monitor *mon, const QDict *qdict)
         if (device && strcmp(device, info->value->device)) {
             continue;
         }
-        monitor_printf(mon, "%s: removable=%d",
-                       info->value->device, info->value->removable);
 
-        if (info->value->removable) {
-            monitor_printf(mon, " locked=%d", info->value->locked);
-            monitor_printf(mon, " tray-open=%d", info->value->tray_open);
+        if (info != block_list) {
+            monitor_printf(mon, "\n");
+        }
+
+        monitor_printf(mon, "%s", info->value->device);
+        if (info->value->has_inserted) {
+            monitor_printf(mon, ": %s (%s%s%s)\n",
+                           info->value->inserted->file,
+                           info->value->inserted->drv,
+                           info->value->inserted->ro ? ", read-only" : "",
+                           info->value->inserted->encrypted ? ", encrypted" : "");
+        } else {
+            monitor_printf(mon, ": [not inserted]\n");
         }
 
-        if (info->value->has_io_status) {
-            monitor_printf(mon, " io-status=%s",
+        if (info->value->has_io_status && info->value->io_status != BLOCK_DEVICE_IO_STATUS_OK) {
+            monitor_printf(mon, "    I/O status:       %s\n",
                            BlockDeviceIoStatus_lookup[info->value->io_status]);
         }
 
-        if (info->value->has_inserted) {
-            monitor_printf(mon, " file=");
-            monitor_print_filename(mon, info->value->inserted->file);
-
-            if (info->value->inserted->has_backing_file) {
-                monitor_printf(mon, " backing_file=");
-                monitor_print_filename(mon, info->value->inserted->backing_file);
-                monitor_printf(mon, " backing_file_depth=%" PRId64,
-                    info->value->inserted->backing_file_depth);
-            }
-            monitor_printf(mon, " ro=%d drv=%s encrypted=%d",
-                           info->value->inserted->ro,
-                           info->value->inserted->drv,
-                           info->value->inserted->encrypted);
+        if (info->value->removable) {
+            monitor_printf(mon, "    Removable device: %slocked, tray %s\n",
+                           info->value->locked ? "" : "not ",
+                           info->value->tray_open ? "open" : "closed");
+        }
 
-            monitor_printf(mon, " bps=%" PRId64 " bps_rd=%" PRId64
-                            " bps_wr=%" PRId64 " iops=%" PRId64
-                            " iops_rd=%" PRId64 " iops_wr=%" PRId64,
+
+        if (!info->value->has_inserted) {
+            continue;
+        }
+
+        if (info->value->inserted->has_backing_file) {
+            monitor_printf(mon,
+                           "    Backing file:     %s "
+                           "(chain depth: %" PRId64 ")\n",
+                           info->value->inserted->backing_file,
+                           info->value->inserted->backing_file_depth);
+        }
+
+        if (info->value->inserted->bps
+            || info->value->inserted->bps_rd
+            || info->value->inserted->bps_wr
+            || info->value->inserted->iops
+            || info->value->inserted->iops_rd
+            || info->value->inserted->iops_wr)
+        {
+            monitor_printf(mon, "    I/O throttling:   bps=%" PRId64
+                            " bps_rd=%" PRId64  " bps_wr=%" PRId64
+                            " iops=%" PRId64 " iops_rd=%" PRId64
+                            " iops_wr=%" PRId64 "\n",
                             info->value->inserted->bps,
                             info->value->inserted->bps_rd,
                             info->value->inserted->bps_wr,
                             info->value->inserted->iops,
                             info->value->inserted->iops_rd,
                             info->value->inserted->iops_wr);
+        }
 
-            if (verbose) {
-                monitor_printf(mon, " images:\n");
-                image_info = info->value->inserted->image;
-                while (1) {
-                        bdrv_image_info_dump((fprintf_function)monitor_printf,
-                                             mon, image_info);
-                    if (image_info->has_backing_image) {
-                        image_info = image_info->backing_image;
-                    } else {
-                        break;
-                    }
+        if (verbose) {
+            monitor_printf(mon, "\nImages:\n");
+            image_info = info->value->inserted->image;
+            while (1) {
+                    bdrv_image_info_dump((fprintf_function)monitor_printf,
+                                         mon, image_info);
+                if (image_info->has_backing_image) {
+                    image_info = image_info->backing_image;
+                } else {
+                    break;
                 }
             }
-        } else {
-            monitor_printf(mon, " [not inserted]");
         }
-
-        monitor_printf(mon, "\n");
     }
 
     qapi_free_BlockInfoList(block_list);
commit 2ea3e2c1e85097c45a882dbc1fbba4a7fdb3ff1c
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jun 27 15:25:12 2013 +0200

    qemu-char: Fix ID reuse after chardev-remove for qapi-based init
    
    Commit 2c5f488 introduced qapi-based character device initialization
    as a new code path in qemu_chr_new_from_opts().  Unfortunately, it
    failed to store parameter opts in the new chardev.  Therefore,
    qemu_chr_delete() doesn't delete it.  Even though the device is gone,
    its options linger, and any attempt to create another one with the
    same ID fails.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
    Message-id: 1372339512-28149-1-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index a030e6b..63972ae 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3219,6 +3219,7 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
         }
 
         chr = qemu_chr_find(id);
+        chr->opts = opts;
 
     qapi_out:
         qapi_free_ChardevBackend(backend);
commit 43f420f8419866619bd107d5ee84c727b46967b8
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Tue Jun 25 10:49:31 2013 +0200

    console: Hook QemuConsoles into qom tree
    
    Put them named "console[$index]" below "/backend", so you can
    list & inspect them via QMP.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Message-id: 1372150171-8707-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ui/console.c b/ui/console.c
index 28bba6d..e3e8297 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -1580,6 +1580,8 @@ static DisplayState *get_alloc_displaystate(void)
  */
 DisplayState *init_displaystate(void)
 {
+    Error *local_err = NULL;
+    gchar *name;
     int i;
 
     if (!display_state) {
@@ -1591,6 +1593,14 @@ DisplayState *init_displaystate(void)
             consoles[i]->ds == NULL) {
             text_console_do_init(consoles[i]->chr, display_state);
         }
+
+        /* Hook up into the qom tree here (not in new_console()), once
+         * all QemuConsoles are created and the order / numbering
+         * doesn't change any more */
+        name = g_strdup_printf("console[%d]", i);
+        object_property_add_child(container_get(object_get_root(), "/backend"),
+                                  name, OBJECT(consoles[i]), &local_err);
+        g_free(name);
     }
 
     return display_state;
commit f087553653152fdae16ed7066d238677734e4902
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Tue Jun 25 10:48:54 2013 +0200

    gtk: add support for surface conversion
    
    Also use CAIRO_FORMAT_RGB24 unconditionally.  DisplaySurfaces will never
    ever see 8bpp surfaces.  And using CAIRO_FORMAT_RGB16_565 for the 16bpp
    case doesn't seem to be a good idea too.
    
    <quote src="/usr/include/cairo/cairo.h">
     * @CAIRO_FORMAT_RGB16_565: This format value is deprecated. It has
     *   never been properly implemented in cairo and should not be used
     *   by applications. (since 1.2)
    </quote>
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Message-id: 1372150134-8590-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ui/gtk.c b/ui/gtk.c
index 7310e20..4fb66a3 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -147,6 +147,7 @@ typedef struct GtkDisplayState
     GtkWidget *notebook;
     GtkWidget *drawing_area;
     cairo_surface_t *surface;
+    pixman_image_t *convert;
     DisplayChangeListener dcl;
     DisplaySurface *ds;
     int button_mask;
@@ -303,6 +304,11 @@ static void gd_update(DisplayChangeListener *dcl,
 
     DPRINTF("update(x=%d, y=%d, w=%d, h=%d)\n", x, y, w, h);
 
+    if (s->convert) {
+        pixman_image_composite(PIXMAN_OP_SRC, s->ds->image, NULL, s->convert,
+                               x, y, 0, 0, x, y, w, h);
+    }
+
     x1 = floor(x * s->scale_x);
     y1 = floor(y * s->scale_y);
 
@@ -388,9 +394,7 @@ static void gd_switch(DisplayChangeListener *dcl,
                       DisplaySurface *surface)
 {
     GtkDisplayState *s = container_of(dcl, GtkDisplayState, dcl);
-    cairo_format_t kind;
     bool resized = true;
-    int stride;
 
     DPRINTF("resize(width=%d, height=%d)\n",
             surface_width(surface), surface_height(surface));
@@ -405,29 +409,42 @@ static void gd_switch(DisplayChangeListener *dcl,
         resized = false;
     }
     s->ds = surface;
-    switch (surface_bits_per_pixel(surface)) {
-    case 8:
-        kind = CAIRO_FORMAT_A8;
-        break;
-    case 16:
-        kind = CAIRO_FORMAT_RGB16_565;
-        break;
-    case 32:
-        kind = CAIRO_FORMAT_RGB24;
-        break;
-    default:
-        g_assert_not_reached();
-        break;
-    }
 
-    stride = cairo_format_stride_for_width(kind, surface_width(surface));
-    g_assert(surface_stride(surface) == stride);
+    if (s->convert) {
+        pixman_image_unref(s->convert);
+        s->convert = NULL;
+    }
 
-    s->surface = cairo_image_surface_create_for_data(surface_data(surface),
-                                                     kind,
-                                                     surface_width(surface),
-                                                     surface_height(surface),
-                                                     surface_stride(surface));
+    if (surface->format == PIXMAN_x8r8g8b8) {
+        /*
+         * PIXMAN_x8r8g8b8 == CAIRO_FORMAT_RGB24
+         *
+         * No need to convert, use surface directly.  Should be the
+         * common case as this is qemu_default_pixelformat(32) too.
+         */
+        s->surface = cairo_image_surface_create_for_data
+            (surface_data(surface),
+             CAIRO_FORMAT_RGB24,
+             surface_width(surface),
+             surface_height(surface),
+             surface_stride(surface));
+    } else {
+        /* Must convert surface, use pixman to do it. */
+        s->convert = pixman_image_create_bits(PIXMAN_x8r8g8b8,
+                                              surface_width(surface),
+                                              surface_height(surface),
+                                              NULL, 0);
+        s->surface = cairo_image_surface_create_for_data
+            ((void *)pixman_image_get_data(s->convert),
+             CAIRO_FORMAT_RGB24,
+             pixman_image_get_width(s->convert),
+             pixman_image_get_height(s->convert),
+             pixman_image_get_stride(s->convert));
+        pixman_image_composite(PIXMAN_OP_SRC, s->ds->image, NULL, s->convert,
+                               0, 0, 0, 0, 0, 0,
+                               pixman_image_get_width(s->convert),
+                               pixman_image_get_height(s->convert));
+    }
 
     if (resized) {
         gd_update_windowsize(s);
commit 12b7f57e2cfcd665cf5a21b4ae3c23b9361c5c05
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Mon Jun 24 15:06:52 2013 +0400

    vl: convert -smp to qemu_opts_parse()
    
    This also introduces a new suboption, "cpus=",
    which is the default.  So after this patch,
    
     -smp n,sockets=y
    
    is the same as
    
      -smp cpus=n,sockets=y
    
    (with "cpu" being some generic thing, referring to
    either cores, or threads, or sockets, as before).
    
    We still don't validate relations between different
    numbers, for example it is still possible to say
    
      -smp 1,sockets=10
    
    and it will be accepted to mean sockets=1.
    
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>
    Message-id: 1372072012-30305-1-git-send-email-mjt at msgid.tls.msk.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index ca6fdf6..137a39b 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -73,7 +73,7 @@ Select CPU model (@code{-cpu help} for list and additional feature selection)
 ETEXI
 
 DEF("smp", HAS_ARG, QEMU_OPTION_smp,
-    "-smp n[,maxcpus=cpus][,cores=cores][,threads=threads][,sockets=sockets]\n"
+    "-smp [cpus=]n[,maxcpus=cpus][,cores=cores][,threads=threads][,sockets=sockets]\n"
     "                set the number of CPUs to 'n' [default=1]\n"
     "                maxcpus= maximum number of total cpus, including\n"
     "                offline CPUs for hotplug, etc\n"
@@ -82,7 +82,7 @@ DEF("smp", HAS_ARG, QEMU_OPTION_smp,
     "                sockets= number of discrete sockets in the system\n",
         QEMU_ARCH_ALL)
 STEXI
- at item -smp @var{n}[,cores=@var{cores}][,threads=@var{threads}][,sockets=@var{sockets}][,maxcpus=@var{maxcpus}]
+ at item -smp [cpus=]@var{n}[,cores=@var{cores}][,threads=@var{threads}][,sockets=@var{sockets}][,maxcpus=@var{maxcpus}]
 @findex -smp
 Simulate an SMP system with @var{n} CPUs. On the PC target, up to 255
 CPUs are supported. On Sparc32 target, Linux limits the number of usable CPUs
diff --git a/vl.c b/vl.c
index 0a8f056..6d9fd7d 100644
--- a/vl.c
+++ b/vl.c
@@ -1401,48 +1401,79 @@ static void numa_add(const char *optarg)
     }
 }
 
-static void smp_parse(const char *optarg)
+static QemuOptsList qemu_smp_opts = {
+    .name = "smp-opts",
+    .implied_opt_name = "cpus",
+    .merge_lists = true,
+    .head = QTAILQ_HEAD_INITIALIZER(qemu_smp_opts.head),
+    .desc = {
+        {
+            .name = "cpus",
+            .type = QEMU_OPT_NUMBER,
+        }, {
+            .name = "sockets",
+            .type = QEMU_OPT_NUMBER,
+        }, {
+            .name = "cores",
+            .type = QEMU_OPT_NUMBER,
+        }, {
+            .name = "threads",
+            .type = QEMU_OPT_NUMBER,
+        }, {
+            .name = "maxcpus",
+            .type = QEMU_OPT_NUMBER,
+        },
+        { /*End of list */ }
+    },
+};
+
+static void smp_parse(QemuOpts *opts)
 {
-    int smp, sockets = 0, threads = 0, cores = 0;
-    char *endptr;
-    char option[128];
+    if (opts) {
 
-    smp = strtoul(optarg, &endptr, 10);
-    if (endptr != optarg) {
-        if (*endptr == ',') {
-            endptr++;
-        }
-    }
-    if (get_param_value(option, 128, "sockets", endptr) != 0)
-        sockets = strtoull(option, NULL, 10);
-    if (get_param_value(option, 128, "cores", endptr) != 0)
-        cores = strtoull(option, NULL, 10);
-    if (get_param_value(option, 128, "threads", endptr) != 0)
-        threads = strtoull(option, NULL, 10);
-    if (get_param_value(option, 128, "maxcpus", endptr) != 0)
-        max_cpus = strtoull(option, NULL, 10);
-
-    /* compute missing values, prefer sockets over cores over threads */
-    if (smp == 0 || sockets == 0) {
-        sockets = sockets > 0 ? sockets : 1;
-        cores = cores > 0 ? cores : 1;
-        threads = threads > 0 ? threads : 1;
-        if (smp == 0) {
-            smp = cores * threads * sockets;
-        }
-    } else {
-        if (cores == 0) {
+        unsigned cpus    = qemu_opt_get_number(opts, "cpus", 0);
+        unsigned sockets = qemu_opt_get_number(opts, "sockets", 0);
+        unsigned cores   = qemu_opt_get_number(opts, "cores", 0);
+        unsigned threads = qemu_opt_get_number(opts, "threads", 0);
+
+        /* compute missing values, prefer sockets over cores over threads */
+        if (cpus == 0 || sockets == 0) {
+            sockets = sockets > 0 ? sockets : 1;
+            cores = cores > 0 ? cores : 1;
             threads = threads > 0 ? threads : 1;
-            cores = smp / (sockets * threads);
+            if (cpus == 0) {
+                cpus = cores * threads * sockets;
+            }
         } else {
-            threads = smp / (cores * sockets);
+            if (cores == 0) {
+                threads = threads > 0 ? threads : 1;
+                cores = cpus / (sockets * threads);
+            } else {
+                threads = cpus / (cores * sockets);
+            }
         }
+
+        max_cpus = qemu_opt_get_number(opts, "maxcpus", 0);
+
+        smp_cpus = cpus;
+        smp_cores = cores > 0 ? cores : 1;
+        smp_threads = threads > 0 ? threads : 1;
+
     }
-    smp_cpus = smp;
-    smp_cores = cores > 0 ? cores : 1;
-    smp_threads = threads > 0 ? threads : 1;
-    if (max_cpus == 0)
+
+    if (max_cpus == 0) {
         max_cpus = smp_cpus;
+    }
+
+    if (max_cpus > 255) {
+        fprintf(stderr, "Unsupported number of maxcpus\n");
+        exit(1);
+    }
+    if (max_cpus < smp_cpus) {
+        fprintf(stderr, "maxcpus must be equal to or greater than smp\n");
+        exit(1);
+    }
+
 }
 
 static void configure_realtime(QemuOpts *opts)
@@ -2895,6 +2926,7 @@ int main(int argc, char **argv, char **envp)
     qemu_add_opts(&qemu_trace_opts);
     qemu_add_opts(&qemu_option_rom_opts);
     qemu_add_opts(&qemu_machine_opts);
+    qemu_add_opts(&qemu_smp_opts);
     qemu_add_opts(&qemu_boot_opts);
     qemu_add_opts(&qemu_sandbox_opts);
     qemu_add_opts(&qemu_add_fd_opts);
@@ -3561,18 +3593,7 @@ int main(int argc, char **argv, char **envp)
                 }
                 break;
             case QEMU_OPTION_smp:
-                smp_parse(optarg);
-                if (smp_cpus < 1) {
-                    fprintf(stderr, "Invalid number of CPUs\n");
-                    exit(1);
-                }
-                if (max_cpus < smp_cpus) {
-                    fprintf(stderr, "maxcpus must be equal to or greater than "
-                            "smp\n");
-                    exit(1);
-                }
-                if (max_cpus > 255) {
-                    fprintf(stderr, "Unsupported number of maxcpus\n");
+                if (!qemu_opts_parse(qemu_find_opts("smp-opts"), optarg, 1)) {
                     exit(1);
                 }
                 break;
@@ -3896,12 +3917,7 @@ int main(int argc, char **argv, char **envp)
         data_dir[data_dir_idx++] = CONFIG_QEMU_DATADIR;
     }
 
-    /*
-     * Default to max_cpus = smp_cpus, in case the user doesn't
-     * specify a max_cpus value.
-     */
-    if (!max_cpus)
-        max_cpus = smp_cpus;
+    smp_parse(qemu_opts_find(qemu_find_opts("smp-opts"), NULL));
 
     machine->max_cpus = machine->max_cpus ?: 1; /* Default to UP */
     if (smp_cpus > machine->max_cpus) {
commit 8a27c6a067acd03cbd810585552df4818a4397f7
Author: Kevin Wolf <mail at kevin-wolf.de>
Date:   Sun Jun 23 22:07:46 2013 +0200

    multiboot: Updated ROM binary
    
    Signed-off-by: Kevin Wolf <mail at kevin-wolf.de>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1372018066-21822-4-git-send-email-mail at kevin-wolf.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/pc-bios/multiboot.bin b/pc-bios/multiboot.bin
old mode 100644
new mode 100755
index 7b3c174..e772713
Binary files a/pc-bios/multiboot.bin and b/pc-bios/multiboot.bin differ
commit 26a8ec07616df8eeb7ae5e76a4eade6809c426e3
Author: Kevin Wolf <mail at kevin-wolf.de>
Date:   Sun Jun 23 22:07:45 2013 +0200

    multiboot: Calculate upper_mem in the ROM
    
    The upper_mem field of the Multiboot information struct doesn't really
    contain the RAM size - 1 MB like we used to calculate it, but only the
    memory from 1 MB up to the first (upper) memory hole.
    
    In order to correctly retrieve this information, the multiboot ROM now
    looks at the mmap it creates anyway and tries to find the size of
    contiguous usable memory from 1 MB.
    
    Drop the multiboot.c definition of lower_mem and upper_mem because both
    are queried at runtime now.
    
    Signed-off-by: Kevin Wolf <mail at kevin-wolf.de>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1372018066-21822-3-git-send-email-mail at kevin-wolf.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index 09211e0..985ca1e 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -315,8 +315,6 @@ int load_multiboot(FWCfgState *fw_cfg,
                                 | MULTIBOOT_FLAGS_CMDLINE
                                 | MULTIBOOT_FLAGS_MODULES
                                 | MULTIBOOT_FLAGS_MMAP);
-    stl_p(bootinfo + MBI_MEM_LOWER,   640);
-    stl_p(bootinfo + MBI_MEM_UPPER,   (ram_size / 1024) - 1024);
     stl_p(bootinfo + MBI_BOOT_DEVICE, 0x8000ffff); /* XXX: use the -boot switch? */
     stl_p(bootinfo + MBI_MMAP_ADDR,   ADDR_E820_MAP);
 
diff --git a/pc-bios/optionrom/multiboot.S b/pc-bios/optionrom/multiboot.S
index a0f3602..b7efe4d 100644
--- a/pc-bios/optionrom/multiboot.S
+++ b/pc-bios/optionrom/multiboot.S
@@ -123,6 +123,46 @@ mmap_store_entry:
 	jnz		mmap_loop
 
 mmap_done:
+	/* Calculate upper_mem field: The amount of memory between 1 MB and
+	   the first upper memory hole. Get it from the mmap. */
+	xor		%di, %di
+	mov		$0x100000, %edx
+upper_mem_entry:
+	cmp		%fs:0x2c, %di
+	je		upper_mem_done
+	add		$4, %di
+
+	/* Skip if type != 1 */
+	cmpl		$1, %es:16(%di)
+	jne		upper_mem_next
+
+	/* Skip if > 4 GB */
+	movl		%es:4(%di), %eax
+	test		%eax, %eax
+	jnz		upper_mem_next
+
+	/* Check for contiguous extension (base <= %edx < base + length) */
+	movl		%es:(%di), %eax
+	cmp		%eax, %edx
+	jb		upper_mem_next
+	addl		%es:8(%di), %eax
+	cmp		%eax, %edx
+	jae		upper_mem_next
+
+	/* If so, update %edx, and restart the search (mmap isn't ordered) */
+	mov		%eax, %edx
+	xor		%di, %di
+	jmp		upper_mem_entry
+
+upper_mem_next:
+	addl		%es:-4(%di), %edi
+	jmp		upper_mem_entry
+
+upper_mem_done:
+	sub		$0x100000, %edx
+	shr		$10, %edx
+	mov		%edx, %fs:0x8
+
 real_to_prot:
 	/* Load the GDT before going into protected mode */
 lgdt:
commit 390fb6b47144adbad453cdf95c130854728c56f8
Author: Kevin Wolf <mail at kevin-wolf.de>
Date:   Sun Jun 23 22:07:44 2013 +0200

    multiboot: Don't forget last mmap entry
    
    When the BIOS returns ebx = 0, the current entry is still valid and
    needs to be included in the Multiboot memory map.
    
    Fixing this meant that using bx as the entry index doesn't work any
    more because it's 0 on the last entry (and it was SeaBIOS-specific
    anyway), so the whole loop had to change a bit and should be more
    generic as a result (ebx can be an arbitrary continuation number now,
    and the entry size returned by the BIOS is used instead of hard-coding
    20 bytes).
    
    Signed-off-by: Kevin Wolf <mail at kevin-wolf.de>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1372018066-21822-2-git-send-email-mail at kevin-wolf.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/pc-bios/optionrom/multiboot.S b/pc-bios/optionrom/multiboot.S
index 003bcfb..a0f3602 100644
--- a/pc-bios/optionrom/multiboot.S
+++ b/pc-bios/optionrom/multiboot.S
@@ -89,17 +89,14 @@ run_multiboot:
 
 	/* Initialize multiboot mmap structs using int 0x15(e820) */
 	xor		%ebx, %ebx
-	/* mmap start after first size */
-	movl		$4, %edi
+	/* Start storing mmap data at %es:0 */
+	xor		%edi, %edi
 
 mmap_loop:
+	/* The multiboot entry size has offset -4, so leave some space */
+	add		$4, %di
 	/* entry size (mmap struct) & max buffer size (int15) */
 	movl		$20, %ecx
-	/* store entry size */
-	/* old as(1) doesn't like this insn so emit the bytes instead:
-	movl		%ecx, %es:-4(%edi)
-	*/
-	.dc.b		0x26,0x67,0x66,0x89,0x4f,0xfc
 	/* e820 */
 	movl		$0x0000e820, %eax
 	/* 'SMAP' magic */
@@ -107,21 +104,23 @@ mmap_loop:
 	int		$0x15
 
 mmap_check_entry:
-	/* last entry? then we're done */
+	/* Error or last entry already done? */
 	jb		mmap_done
-	and		%bx, %bx
-	jz		mmap_done
-	/* valid entry, so let's loop on */
 
 mmap_store_entry:
-	/* %ax = entry_number * 24 */
-	mov		$24, %ax
-	mul		%bx
-	mov		%ax, %di
+	/* store entry size */
+	/* old as(1) doesn't like this insn so emit the bytes instead:
+	movl		%ecx, %es:-4(%edi)
+	*/
+	.dc.b		0x26,0x67,0x66,0x89,0x4f,0xfc
+
+	/* %edi += entry_size, store as mbs_mmap_length */
+	add		%ecx, %edi
 	movw		%di, %fs:0x2c
-	/* %di = 4 + (entry_number * 24) */
-	add		$4, %di
-	jmp		mmap_loop
+
+	/* Continuation value 0 means last entry */
+	test		%ebx, %ebx
+	jnz		mmap_loop
 
 mmap_done:
 real_to_prot:
commit 6bedfe94c96c5ba35fcb2a52b438fefcc682669e
Author: Stefan Weil <sw at weilnetz.de>
Date:   Thu Jun 27 21:00:06 2013 +0200

    arch_init: Fix format string by using RAM_ADDR_FMT
    
    length is a ram_addr_t, so RAM_ADDR_FMT must be used instead of %ld.
    This fixes a recently introduced regression for w64 builds.
    
    Using RAM_ADDR_FMT also changes decimal output to sedecimal.
    This is good here because length and block->length should both
    use the same base in the error message.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Message-id: 1372359606-2759-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/arch_init.c b/arch_init.c
index ea9ddad..4255db9 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -815,8 +815,9 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
                     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
                         if (!strncmp(id, block->idstr, sizeof(id))) {
                             if (block->length != length) {
-                                fprintf(stderr, "Length mismatch: %s: %ld "
-                                        "in != " RAM_ADDR_FMT "\n", id, length,
+                                fprintf(stderr,
+                                        "Length mismatch: %s: " RAM_ADDR_FMT
+                                        " in != " RAM_ADDR_FMT "\n", id, length,
                                         block->length);
                                 ret =  -EINVAL;
                                 goto done;
commit a8ad4159ed7d8a442a9c049a6fd0d47aa330c2aa
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Fri Jun 28 10:08:16 2013 +0400

    doc: we use seabios, not bochs bios
    
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-doc.texi b/qemu-doc.texi
index 8022890..185dd47 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -214,7 +214,7 @@ PCI UHCI USB controller and a virtual USB hub.
 
 SMP is supported with up to 255 CPUs.
 
-QEMU uses the PC BIOS from the Bochs project and the Plex86/Bochs LGPL
+QEMU uses the PC BIOS from the Seabios project and the Plex86/Bochs LGPL
 VGA BIOS.
 
 QEMU uses YM3812 emulation by Tatsuyuki Satoh.
commit 7a5b6af13a45ae7109900dee03a436819302126c
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:56 2013 +0200

    qemu-socket: don't leak opts on error
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 126cbb6..095716e 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -963,7 +963,7 @@ int socket_dgram(SocketAddress *remote, SocketAddress *local, Error **errp)
 
     default:
         error_setg(errp, "socket type unsupported for datagram");
-        return -1;
+        fd = -1;
     }
     qemu_opts_del(opts);
     return fd;
commit 58a3714c529b1b97ee078ea25b58f731aabcbfff
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:55 2013 +0200

    qemu-char: report udp backend errors
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index c097ca1..5a8f9c0 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2255,6 +2255,8 @@ static CharDriverState *qemu_chr_open_udp(QemuOpts *opts)
 
     fd = inet_dgram_opts(opts, &local_err);
     if (fd < 0) {
+        qerror_report_err(local_err);
+        error_free(local_err);
         return NULL;
     }
     return qemu_chr_open_udp_fd(fd);
commit bb6fb7c0857aeda7982ac14460328edf3c29cfc8
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:54 2013 +0200

    qemu-char: add -chardev mux support
    
    Allow to explicitly create mux chardevs on the command line,
    like you can using QMP.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index 392de29..c097ca1 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3115,6 +3115,19 @@ static void qemu_chr_parse_memory(QemuOpts *opts, ChardevBackend *backend,
     }
 }
 
+static void qemu_chr_parse_mux(QemuOpts *opts, ChardevBackend *backend,
+                               Error **errp)
+{
+    const char *chardev = qemu_opt_get(opts, "chardev");
+
+    if (chardev == NULL) {
+        error_setg(errp, "chardev: mux: no chardev given");
+        return;
+    }
+    backend->mux = g_new0(ChardevMux, 1);
+    backend->mux->chardev = g_strdup(chardev);
+}
+
 typedef struct CharDriver {
     const char *name;
     /* old, pre qapi */
@@ -3481,6 +3494,9 @@ QemuOptsList qemu_chardev_opts = {
         },{
             .name = "size",
             .type = QEMU_OPT_SIZE,
+        },{
+            .name = "chardev",
+            .type = QEMU_OPT_STRING,
         },
         { /* end of list */ }
     },
@@ -3771,6 +3787,8 @@ static void register_types(void)
     register_char_driver_qapi("console", CHARDEV_BACKEND_KIND_CONSOLE, NULL);
     register_char_driver_qapi("pipe", CHARDEV_BACKEND_KIND_PIPE,
                               qemu_chr_parse_pipe);
+    register_char_driver_qapi("mux", CHARDEV_BACKEND_KIND_MUX,
+                              qemu_chr_parse_mux);
 }
 
 type_init(register_types);
commit dc2c4eca89ec5ee7b7a4c2563c991a14a7c5ee84
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:53 2013 +0200

    qemu-char: minor mux chardev fixes
    
    mux failure path has a memory leak.  creating a mux chardev can't
    fail though, so just assert() that instead of fixing an error path
    which never ever runs anyway ...
    
    Also fix bid being leaked while being at it.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index 90754e6..392de29 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3186,7 +3186,7 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
         ChardevBackend *backend = g_new0(ChardevBackend, 1);
         ChardevReturn *ret = NULL;
         const char *id = qemu_opts_id(opts);
-        const char *bid = NULL;
+        char *bid = NULL;
 
         if (qemu_opt_get_bool(opts, "mux", 0)) {
             bid = g_strdup_printf("%s-base", id);
@@ -3213,9 +3213,7 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
             backend->kind = CHARDEV_BACKEND_KIND_MUX;
             backend->mux->chardev = g_strdup(bid);
             ret = qmp_chardev_add(id, backend, errp);
-            if (error_is_set(errp)) {
-                goto qapi_out;
-            }
+            assert(!error_is_set(errp));
         }
 
         chr = qemu_chr_find(id);
@@ -3223,6 +3221,7 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
     qapi_out:
         qapi_free_ChardevBackend(backend);
         qapi_free_ChardevReturn(ret);
+        g_free(bid);
         return chr;
     }
 
commit 99aec0123ce5ba307dc357c5bf1e0f22d2be0931
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:52 2013 +0200

    qemu-char: use ChardevBackendKind in CharDriver
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/include/sysemu/char.h b/include/sysemu/char.h
index 066c216..e65e4a4 100644
--- a/include/sysemu/char.h
+++ b/include/sysemu/char.h
@@ -281,7 +281,7 @@ CharDriverState *qemu_chr_find(const char *name);
 QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename);
 
 void register_char_driver(const char *name, CharDriverState *(*open)(QemuOpts *));
-void register_char_driver_qapi(const char *name, int kind,
+void register_char_driver_qapi(const char *name, ChardevBackendKind kind,
         void (*parse)(QemuOpts *opts, ChardevBackend *backend, Error **errp));
 
 /* add an eventfd to the qemu devices that are polled */
diff --git a/qemu-char.c b/qemu-char.c
index 0cda56c..90754e6 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3120,7 +3120,7 @@ typedef struct CharDriver {
     /* old, pre qapi */
     CharDriverState *(*open)(QemuOpts *opts);
     /* new, qapi-based */
-    int kind;
+    ChardevBackendKind kind;
     void (*parse)(QemuOpts *opts, ChardevBackend *backend, Error **errp);
 } CharDriver;
 
@@ -3137,7 +3137,7 @@ void register_char_driver(const char *name, CharDriverState *(*open)(QemuOpts *)
     backends = g_slist_append(backends, s);
 }
 
-void register_char_driver_qapi(const char *name, int kind,
+void register_char_driver_qapi(const char *name, ChardevBackendKind kind,
         void (*parse)(QemuOpts *opts, ChardevBackend *backend, Error **errp))
 {
     CharDriver *s;
commit e668287d4413395be1a0f9ef292bb6d0c1006e29
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:51 2013 +0200

    qemu-char: don't leak opts on error
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index 371f630..0cda56c 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3178,7 +3178,7 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
     if (i == NULL) {
         error_setg(errp, "chardev: backend \"%s\" not found",
                    qemu_opt_get(opts, "backend"));
-        return NULL;
+        goto err;
     }
 
     if (!cd->open) {
commit ef993ba7bc631b57f9ea70a7f6fc8c0fcbdfa19d
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:50 2013 +0200

    qemu-char: fix documentation for telnet+wait socket flags
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qapi-schema.json b/qapi-schema.json
index 6590307..5c32528 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3288,10 +3288,11 @@
 # @addr: socket address to listen on (server=true)
 #        or connect to (server=false)
 # @server: #optional create server socket (default: true)
-# @wait: #optional wait for connect (not used for server
-#        sockets, default: false)
+# @wait: #optional wait for incoming connection on server
+#        sockets (default: false).
 # @nodelay: #optional set TCP_NODELAY socket option (default: false)
-# @telnet: #optional enable telnet protocol (default: false)
+# @telnet: #optional enable telnet protocol on server
+#          sockets (default: false)
 #
 # Since: 1.4
 ##
commit fdca2124adc293f84f2b7aaf0df43faa6b6bf420
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:49 2013 +0200

    qemu-char: print notification to stderr
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index e3b3224..371f630 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2666,8 +2666,8 @@ static CharDriverState *qemu_chr_open_socket_fd(int fd, bool do_nodelay,
     }
 
     if (is_listen && is_waitconnect) {
-        printf("QEMU waiting for connection on: %s\n",
-               chr->filename);
+        fprintf(stderr, "QEMU waiting for connection on: %s\n",
+                chr->filename);
         tcp_chr_accept(s->listen_chan, G_IO_IN, chr);
         qemu_set_nonblock(s->listen_fd);
     }
commit 20c397607cb54905f452921259b4baa9c8a1d008
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:48 2013 +0200

    qemu-char: use more specific error_setg_* variants
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index a538217..e3b3224 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2604,7 +2604,7 @@ static CharDriverState *qemu_chr_open_socket_fd(int fd, bool do_nodelay,
 
     memset(&ss, 0, ss_len);
     if (getsockname(fd, (struct sockaddr *) &ss, &ss_len) != 0) {
-        error_setg(errp, "getsockname: %s", strerror(errno));
+        error_setg_errno(errp, errno, "getsockname");
         return NULL;
     }
 
@@ -3529,7 +3529,7 @@ static int qmp_chardev_open_file_source(char *src, int flags,
 
     TFR(fd = qemu_open(src, flags, 0666));
     if (fd == -1) {
-        error_setg(errp, "open %s: %s", src, strerror(errno));
+        error_setg_file_open(errp, errno, src);
     }
     return fd;
 }
commit e859eda58501cd20a2e6988fb4acc1756bc4d278
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:47 2013 +0200

    qemu-char: check optional fields using has_*
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index a030e6b..a538217 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3493,7 +3493,7 @@ static CharDriverState *qmp_chardev_open_file(ChardevFile *file, Error **errp)
 {
     HANDLE out;
 
-    if (file->in) {
+    if (file->has_in) {
         error_setg(errp, "input file not supported");
         return NULL;
     }
@@ -3544,7 +3544,7 @@ static CharDriverState *qmp_chardev_open_file(ChardevFile *file, Error **errp)
         return NULL;
     }
 
-    if (file->in) {
+    if (file->has_in) {
         flags = O_RDONLY;
         in = qmp_chardev_open_file_source(file->in, flags, errp);
         if (error_is_set(errp)) {
commit d1ec72a44e0a167f9e8254d6d1098d27f104571f
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:46 2013 +0200

    qemu-socket: catch monitor_get_fd failures
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 35023a8..126cbb6 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -903,7 +903,7 @@ int socket_connect(SocketAddress *addr, Error **errp,
 
     case SOCKET_ADDRESS_KIND_FD:
         fd = monitor_get_fd(cur_mon, addr->fd->str, errp);
-        if (callback) {
+        if (fd >= 0 && callback) {
             qemu_set_nonblock(fd);
             callback(fd, opaque);
         }
commit c1204afc7c048cf58b0a8f1c11886f36ca73ef28
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:45 2013 +0200

    qemu-socket: drop pointless allocation
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 86fb09c..35023a8 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -871,7 +871,6 @@ SocketAddress *socket_parse(const char *str, Error **errp)
         }
     } else {
         addr->kind = SOCKET_ADDRESS_KIND_INET;
-        addr->inet = g_new(InetSocketAddress, 1);
         addr->inet = inet_parse(str, errp);
         if (addr->inet == NULL) {
             goto fail;
commit afde3f8b9923892d21a735993f533e5d8b60e0b0
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 24 08:39:44 2013 +0200

    qemu-socket: zero-initialize SocketAddress
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 96eca2a..86fb09c 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -848,9 +848,9 @@ int unix_nonblocking_connect(const char *path,
 
 SocketAddress *socket_parse(const char *str, Error **errp)
 {
-    SocketAddress *addr = NULL;
+    SocketAddress *addr;
 
-    addr = g_new(SocketAddress, 1);
+    addr = g_new0(SocketAddress, 1);
     if (strstart(str, "unix:", NULL)) {
         if (str[5] == '\0') {
             error_setg(errp, "invalid Unix socket address");
commit 8a9c98aedc1a3fb4dfbebeccc926e273df54f2ba
Merge: 3612563 c658b94
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jun 28 11:48:09 2013 -0500

    Merge remote-tracking branch 'afaerber/qom-cpu' into staging
    
    # By Andreas Färber
    # Via Andreas Färber
    * afaerber/qom-cpu: (24 commits)
      cpu: Turn cpu_unassigned_access() into a CPUState hook
      hwaddr: Make hwaddr type usable beyond softmmu
      cpu: Change qemu_init_vcpu() argument to CPUState
      cpus: Change qemu_dummy_start_vcpu() argument to CPUState
      cpus: Change qemu_kvm_start_vcpu() argument to CPUState
      cpus: Change cpu_handle_guest_debug() argument to CPUState
      gdbstub: Set gdb_set_stop_cpu() argument to CPUState
      kvm: Change kvm_cpu_exec() argument to CPUState
      kvm: Change kvm_handle_internal_error() argument to CPUState
      cpu: Turn cpu_dump_{state,statistics}() into CPUState hooks
      cpus: Change qemu_kvm_init_cpu_signals() argument to CPUState
      kvm: Change kvm_set_signal_mask() argument to CPUState
      cpus: Change qemu_kvm_wait_io_event() argument to CPUState
      cpus: Change cpu_thread_is_idle() argument to CPUState
      cpu: Change cpu_exit() argument to CPUState
      kvm: Change cpu_synchronize_state() argument to CPUState
      kvm: Change kvm_cpu_synchronize_state() argument to CPUState
      gdbstub: Simplify find_cpu()
      cpu: Guard cpu_{save,load}() definitions
      target-openrisc: Register VMStateDescription for OpenRISCCPU
      ...

commit 36125631e79d53ffb9365740f43f386e2171d116
Merge: ec3f8c9 721da65
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Jun 28 10:37:33 2013 -0500

    Merge remote-tracking branch 'kwolf/for-anthony' into staging
    
    # By Stefan Hajnoczi (11) and others
    # Via Kevin Wolf
    * kwolf/for-anthony:
      cmd646: fix build when DEBUG_IDE is enabled.
      block: change default of .has_zero_init to 0
      vpc: Implement .bdrv_has_zero_init
      vmdk: remove wrong calculation of relative path
      gluster: Return bdrv_has_zero_init = 0
      block/ssh: Set bdrv_has_zero_init according to the file type.
      block: Make BlockJobTypes const
      qemu-iotests: add 055 drive-backup test case
      qemu-iotests: extract wait_until_completed() into iotests.py
      blockdev: add Abort transaction
      blockdev: add DriveBackup transaction
      blockdev: allow BdrvActionOps->commit() to be NULL
      blockdev: rename BlkTransactionStates to singular
      block: add drive-backup QMP command
      blockdev: use bdrv_getlength() in qmp_drive_mirror()
      blockdev: drop redundant proto_drv check
      block: add basic backup support to block driver
      block: add bdrv_add_before_write_notifier()
      notify: add NotiferWithReturn so notifier list can abort
      raw-posix: Fix /dev/cdrom magic on OS X
    
    Message-id: 1372429509-29642-1-git-send-email-kwolf at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 721da65c6eba9c053d73744ecaa882b0f7cd634a
Author: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
Date:   Fri Jun 28 14:43:16 2013 +0100

    cmd646: fix build when DEBUG_IDE is enabled.
    
    Make sure we use the correct TARGET/PRI macros in the debug statements.
    
    Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    CC: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index a73eb9a..9916701 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -154,7 +154,7 @@ static uint64_t bmdma_read(void *opaque, hwaddr addr,
         break;
     }
 #ifdef DEBUG_IDE
-    printf("bmdma: readb 0x%02x : 0x%02x\n", addr, val);
+    printf("bmdma: readb " TARGET_FMT_plx " : 0x%02x\n", addr, val);
 #endif
     return val;
 }
@@ -170,7 +170,7 @@ static void bmdma_write(void *opaque, hwaddr addr,
     }
 
 #ifdef DEBUG_IDE
-    printf("bmdma: writeb 0x%02x : 0x%02x\n", addr, val);
+    printf("bmdma: writeb " TARGET_FMT_plx " : 0x%" PRIx64 "\n", addr, val);
 #endif
     switch(addr & 3) {
     case 0:
commit 3ac216270a62418519c08e88c17005a8f1539cf2
Author: Peter Lieven <pl at kamp.de>
Date:   Fri Jun 28 12:47:42 2013 +0200

    block: change default of .has_zero_init to 0
    
    .has_zero_init defaults to 1 for all formats and protocols.
    
    this is a dangerous default since this means that all
    new added drivers need to manually overwrite it to 0 if
    they do not ensure that a device is zero initialized
    after bdrv_create().
    
    if a driver needs to explicitly set this value to
    1 its easier to verify the correctness in the review process.
    
    during review of the existing drivers it turned out
    that ssh and gluster had a wrong default of 1.
    both protocols support host_devices as backend
    which are not by default zero initialized. this
    wrong assumption will lead to possible corruption
    if qemu-img convert is used to write to such a backend.
    
    vpc and vmdk also defaulted to 1 altough they support
    fixed respectively flat extends. this has to be addresses
    in separate patches. both formats as well as the mentioned
    ssh and gluster are turned to the default of 0 with this
    patch for safety.
    
    a similar problem with the wrong default existed for
    iscsi most likely because the driver developer did
    oversee the default value of 1.
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block.c b/block.c
index 0898f6b..6c493ad 100644
--- a/block.c
+++ b/block.c
@@ -2911,6 +2911,11 @@ void bdrv_flush_all(void)
     }
 }
 
+int bdrv_has_zero_init_1(BlockDriverState *bs)
+{
+    return 1;
+}
+
 int bdrv_has_zero_init(BlockDriverState *bs)
 {
     assert(bs->drv);
@@ -2919,7 +2924,8 @@ int bdrv_has_zero_init(BlockDriverState *bs)
         return bs->drv->bdrv_has_zero_init(bs);
     }
 
-    return 1;
+    /* safe default */
+    return 0;
 }
 
 typedef struct BdrvCoIsAllocatedData {
diff --git a/block/cow.c b/block/cow.c
index 9f94599..1cc2e89 100644
--- a/block/cow.c
+++ b/block/cow.c
@@ -340,6 +340,7 @@ static BlockDriver bdrv_cow = {
     .bdrv_open      = cow_open,
     .bdrv_close     = cow_close,
     .bdrv_create    = cow_create,
+    .bdrv_has_zero_init     = bdrv_has_zero_init_1,
 
     .bdrv_read              = cow_co_read,
     .bdrv_write             = cow_co_write,
diff --git a/block/qcow.c b/block/qcow.c
index e2a64c7..5239bd6 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -892,6 +892,7 @@ static BlockDriver bdrv_qcow = {
     .bdrv_close		= qcow_close,
     .bdrv_reopen_prepare = qcow_reopen_prepare,
     .bdrv_create	= qcow_create,
+    .bdrv_has_zero_init     = bdrv_has_zero_init_1,
 
     .bdrv_co_readv          = qcow_co_readv,
     .bdrv_co_writev         = qcow_co_writev,
diff --git a/block/qcow2.c b/block/qcow2.c
index 9383990..0eceefe 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1785,6 +1785,7 @@ static BlockDriver bdrv_qcow2 = {
     .bdrv_close         = qcow2_close,
     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
     .bdrv_create        = qcow2_create,
+    .bdrv_has_zero_init = bdrv_has_zero_init_1,
     .bdrv_co_is_allocated = qcow2_co_is_allocated,
     .bdrv_set_key       = qcow2_set_key,
     .bdrv_make_empty    = qcow2_make_empty,
diff --git a/block/qed.c b/block/qed.c
index 4651403..f767b05 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -1574,6 +1574,7 @@ static BlockDriver bdrv_qed = {
     .bdrv_close               = bdrv_qed_close,
     .bdrv_reopen_prepare      = bdrv_qed_reopen_prepare,
     .bdrv_create              = bdrv_qed_create,
+    .bdrv_has_zero_init       = bdrv_has_zero_init_1,
     .bdrv_co_is_allocated     = bdrv_qed_co_is_allocated,
     .bdrv_make_empty          = bdrv_qed_make_empty,
     .bdrv_aio_readv           = bdrv_qed_aio_readv,
diff --git a/block/raw-posix.c b/block/raw-posix.c
index 90ce9f8..ba721d3 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -1199,6 +1199,7 @@ static BlockDriver bdrv_file = {
     .bdrv_reopen_abort = raw_reopen_abort,
     .bdrv_close = raw_close,
     .bdrv_create = raw_create,
+    .bdrv_has_zero_init = bdrv_has_zero_init_1,
     .bdrv_co_is_allocated = raw_co_is_allocated,
 
     .bdrv_aio_readv = raw_aio_readv,
@@ -1527,11 +1528,6 @@ static int hdev_create(const char *filename, QEMUOptionParameter *options)
     return ret;
 }
 
-static int hdev_has_zero_init(BlockDriverState *bs)
-{
-    return 0;
-}
-
 static BlockDriver bdrv_host_device = {
     .format_name        = "host_device",
     .protocol_name        = "host_device",
@@ -1544,7 +1540,6 @@ static BlockDriver bdrv_host_device = {
     .bdrv_reopen_abort   = raw_reopen_abort,
     .bdrv_create        = hdev_create,
     .create_options     = raw_create_options,
-    .bdrv_has_zero_init = hdev_has_zero_init,
 
     .bdrv_aio_readv	= raw_aio_readv,
     .bdrv_aio_writev	= raw_aio_writev,
@@ -1669,7 +1664,6 @@ static BlockDriver bdrv_host_floppy = {
     .bdrv_reopen_abort   = raw_reopen_abort,
     .bdrv_create        = hdev_create,
     .create_options     = raw_create_options,
-    .bdrv_has_zero_init = hdev_has_zero_init,
 
     .bdrv_aio_readv     = raw_aio_readv,
     .bdrv_aio_writev    = raw_aio_writev,
@@ -1771,7 +1765,6 @@ static BlockDriver bdrv_host_cdrom = {
     .bdrv_reopen_abort   = raw_reopen_abort,
     .bdrv_create        = hdev_create,
     .create_options     = raw_create_options,
-    .bdrv_has_zero_init = hdev_has_zero_init,
 
     .bdrv_aio_readv     = raw_aio_readv,
     .bdrv_aio_writev    = raw_aio_writev,
@@ -1893,7 +1886,6 @@ static BlockDriver bdrv_host_cdrom = {
     .bdrv_reopen_abort   = raw_reopen_abort,
     .bdrv_create        = hdev_create,
     .create_options     = raw_create_options,
-    .bdrv_has_zero_init = hdev_has_zero_init,
 
     .bdrv_aio_readv     = raw_aio_readv,
     .bdrv_aio_writev    = raw_aio_writev,
diff --git a/block/raw-win32.c b/block/raw-win32.c
index 7c03b6d..9b5b2af 100644
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -459,6 +459,7 @@ static BlockDriver bdrv_file = {
     .bdrv_file_open	= raw_open,
     .bdrv_close		= raw_close,
     .bdrv_create	= raw_create,
+    .bdrv_has_zero_init = bdrv_has_zero_init_1,
 
     .bdrv_aio_readv     = raw_aio_readv,
     .bdrv_aio_writev    = raw_aio_writev,
@@ -570,11 +571,6 @@ static int hdev_open(BlockDriverState *bs, QDict *options, int flags)
     return 0;
 }
 
-static int hdev_has_zero_init(BlockDriverState *bs)
-{
-    return 0;
-}
-
 static BlockDriver bdrv_host_device = {
     .format_name	= "host_device",
     .protocol_name	= "host_device",
@@ -582,7 +578,6 @@ static BlockDriver bdrv_host_device = {
     .bdrv_probe_device	= hdev_probe_device,
     .bdrv_file_open	= hdev_open,
     .bdrv_close		= raw_close,
-    .bdrv_has_zero_init = hdev_has_zero_init,
 
     .bdrv_aio_readv     = raw_aio_readv,
     .bdrv_aio_writev    = raw_aio_writev,
diff --git a/block/rbd.c b/block/rbd.c
index 0f2608b..cb71751 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -996,6 +996,7 @@ static BlockDriver bdrv_rbd = {
     .bdrv_file_open     = qemu_rbd_open,
     .bdrv_close         = qemu_rbd_close,
     .bdrv_create        = qemu_rbd_create,
+    .bdrv_has_zero_init = bdrv_has_zero_init_1,
     .bdrv_get_info      = qemu_rbd_getinfo,
     .create_options     = qemu_rbd_create_options,
     .bdrv_getlength     = qemu_rbd_getlength,
diff --git a/block/sheepdog.c b/block/sheepdog.c
index 1b7c3f1..b397b5b 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -2401,6 +2401,7 @@ static BlockDriver bdrv_sheepdog_unix = {
     .bdrv_file_open = sd_open,
     .bdrv_close     = sd_close,
     .bdrv_create    = sd_create,
+    .bdrv_has_zero_init = bdrv_has_zero_init_1,
     .bdrv_getlength = sd_getlength,
     .bdrv_truncate  = sd_truncate,
 
diff --git a/block/vdi.c b/block/vdi.c
index 2662d89..8a91525 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -779,6 +779,7 @@ static BlockDriver bdrv_vdi = {
     .bdrv_close = vdi_close,
     .bdrv_reopen_prepare = vdi_reopen_prepare,
     .bdrv_create = vdi_create,
+    .bdrv_has_zero_init = bdrv_has_zero_init_1,
     .bdrv_co_is_allocated = vdi_co_is_allocated,
     .bdrv_make_empty = vdi_make_empty,
 
diff --git a/include/block/block.h b/include/block/block.h
index 2307f67..dd8eca1 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -272,6 +272,7 @@ void bdrv_drain_all(void);
 
 int bdrv_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
 int bdrv_co_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
+int bdrv_has_zero_init_1(BlockDriverState *bs);
 int bdrv_has_zero_init(BlockDriverState *bs);
 int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
                       int *pnum);
commit c658b94f6e8c206c59d02aa6fbac285b86b53d2c
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 06:49:53 2013 +0200

    cpu: Turn cpu_unassigned_access() into a CPUState hook
    
    Use it for all targets, but be careful not to pass invalid CPUState.
    cpu_single_env can be NULL, e.g. on Xen.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cputlb.c b/cputlb.c
index 947f17c..80b2a94 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -331,12 +331,15 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
     pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;
     mr = iotlb_to_region(pd);
     if (memory_region_is_unassigned(mr)) {
-#if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SPARC)
-        cpu_unassigned_access(env1, addr, 0, 1, 0, 4);
-#else
-        cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x"
-                  TARGET_FMT_lx "\n", addr);
-#endif
+        CPUState *cpu = ENV_GET_CPU(env1);
+        CPUClass *cc = CPU_GET_CLASS(cpu);
+
+        if (cc->do_unassigned_access) {
+            cc->do_unassigned_access(cpu, addr, false, true, 0, 4);
+        } else {
+            cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x"
+                      TARGET_FMT_lx "\n", addr);
+        }
     }
     p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
     return qemu_ram_addr_from_host_nofail(p);
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 1ead187..207dcad 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -197,7 +197,8 @@ static uint64_t cchip_read(void *opaque, hwaddr addr, unsigned size)
         break;
 
     default:
-        cpu_unassigned_access(cpu_single_env, addr, 0, 0, 0, size);
+        cpu = CPU(alpha_env_get_cpu(cpu_single_env));
+        cpu_unassigned_access(cpu, addr, false, false, 0, size);
         return -1;
     }
 
@@ -214,6 +215,7 @@ static uint64_t dchip_read(void *opaque, hwaddr addr, unsigned size)
 static uint64_t pchip_read(void *opaque, hwaddr addr, unsigned size)
 {
     TyphoonState *s = opaque;
+    CPUState *cs;
     uint64_t ret = 0;
 
     if (addr & 4) {
@@ -300,7 +302,8 @@ static uint64_t pchip_read(void *opaque, hwaddr addr, unsigned size)
         break;
 
     default:
-        cpu_unassigned_access(cpu_single_env, addr, 0, 0, 0, size);
+        cs = CPU(alpha_env_get_cpu(cpu_single_env));
+        cpu_unassigned_access(cs, addr, false, false, 0, size);
         return -1;
     }
 
@@ -312,6 +315,7 @@ static void cchip_write(void *opaque, hwaddr addr,
                         uint64_t v32, unsigned size)
 {
     TyphoonState *s = opaque;
+    CPUState *cpu_single_cpu = CPU(alpha_env_get_cpu(cpu_single_env));
     uint64_t val, oldval, newval;
 
     if (addr & 4) {
@@ -461,7 +465,7 @@ static void cchip_write(void *opaque, hwaddr addr,
         break;
 
     default:
-        cpu_unassigned_access(cpu_single_env, addr, 1, 0, 0, size);
+        cpu_unassigned_access(cpu_single_cpu, addr, true, false, 0, size);
         return;
     }
 }
@@ -476,6 +480,7 @@ static void pchip_write(void *opaque, hwaddr addr,
                         uint64_t v32, unsigned size)
 {
     TyphoonState *s = opaque;
+    CPUState *cs;
     uint64_t val, oldval;
 
     if (addr & 4) {
@@ -577,7 +582,8 @@ static void pchip_write(void *opaque, hwaddr addr,
         break;
 
     default:
-        cpu_unassigned_access(cpu_single_env, addr, 1, 0, 0, size);
+        cs = CPU(alpha_env_get_cpu(cpu_single_env));
+        cpu_unassigned_access(cs, addr, true, false, 0, size);
         return;
     }
 }
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index d9b73db..7cb5e54 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -22,6 +22,7 @@
 
 #include <signal.h>
 #include "hw/qdev-core.h"
+#include "exec/hwaddr.h"
 #include "qemu/thread.h"
 #include "qemu/typedefs.h"
 
@@ -42,12 +43,17 @@ typedef int (*WriteCoreDumpFunction)(void *buf, size_t size, void *opaque);
 
 typedef struct CPUState CPUState;
 
+typedef void (*CPUUnassignedAccess)(CPUState *cpu, hwaddr addr,
+                                    bool is_write, bool is_exec, int opaque,
+                                    unsigned size);
+
 /**
  * CPUClass:
  * @class_by_name: Callback to map -cpu command line model name to an
  * instantiatable CPU type.
  * @reset: Callback to reset the #CPUState to its initial state.
  * @do_interrupt: Callback for interrupt handling.
+ * @do_unassigned_access: Callback for unassigned access handling.
  * @dump_state: Callback for dumping state.
  * @dump_statistics: Callback for dumping statistics.
  * @get_arch_id: Callback for getting architecture-dependent CPU ID.
@@ -66,6 +72,7 @@ typedef struct CPUClass {
 
     void (*reset)(CPUState *cpu);
     void (*do_interrupt)(CPUState *cpu);
+    CPUUnassignedAccess do_unassigned_access;
     void (*dump_state)(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                        int flags);
     void (*dump_statistics)(CPUState *cpu, FILE *f,
@@ -280,6 +287,17 @@ static inline void cpu_class_set_vmsd(CPUClass *cc,
 #define cpu_class_set_vmsd(cc, value) ((cc)->vmsd = NULL)
 #endif
 
+#ifndef CONFIG_USER_ONLY
+static inline void cpu_class_set_do_unassigned_access(CPUClass *cc,
+                                                      CPUUnassignedAccess value)
+{
+    cc->do_unassigned_access = value;
+}
+#else
+#define cpu_class_set_do_unassigned_access(cc, value) \
+    ((cc)->do_unassigned_access = NULL)
+#endif
+
 /**
  * device_class_set_vmsd:
  * @dc: Device class
@@ -403,6 +421,21 @@ void cpu_interrupt(CPUState *cpu, int mask);
 
 #endif /* USER_ONLY */
 
+#ifndef CONFIG_USER_ONLY
+
+static inline void cpu_unassigned_access(CPUState *cpu, hwaddr addr,
+                                         bool is_write, bool is_exec,
+                                         int opaque, unsigned size)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (cc->do_unassigned_access) {
+        cc->do_unassigned_access(cpu, addr, is_write, is_exec, opaque, size);
+    }
+}
+
+#endif
+
 /**
  * cpu_reset_interrupt:
  * @cpu: The CPU to clear the interrupt on.
diff --git a/memory.c b/memory.c
index 47b005a..757e9a5 100644
--- a/memory.c
+++ b/memory.c
@@ -855,9 +855,10 @@ static uint64_t unassigned_mem_read(void *opaque, hwaddr addr,
 #ifdef DEBUG_UNASSIGNED
     printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
 #endif
-#if defined(TARGET_ALPHA) || defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
-    cpu_unassigned_access(cpu_single_env, addr, 0, 0, 0, size);
-#endif
+    if (cpu_single_env != NULL) {
+        cpu_unassigned_access(ENV_GET_CPU(cpu_single_env),
+                              addr, false, false, 0, size);
+    }
     return 0;
 }
 
@@ -867,9 +868,10 @@ static void unassigned_mem_write(void *opaque, hwaddr addr,
 #ifdef DEBUG_UNASSIGNED
     printf("Unassigned mem write " TARGET_FMT_plx " = 0x%"PRIx64"\n", addr, val);
 #endif
-#if defined(TARGET_ALPHA) || defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
-    cpu_unassigned_access(cpu_single_env, addr, 1, 0, 0, size);
-#endif
+    if (cpu_single_env != NULL) {
+        cpu_unassigned_access(ENV_GET_CPU(cpu_single_env),
+                              addr, true, false, 0, size);
+    }
 }
 
 static bool unassigned_mem_accepts(void *opaque, hwaddr addr,
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 4e62eaf..2670805 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -263,6 +263,7 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->do_interrupt = alpha_cpu_do_interrupt;
     cc->dump_state = alpha_cpu_dump_state;
+    cpu_class_set_do_unassigned_access(cc, alpha_cpu_unassigned_access);
     device_class_set_vmsd(dc, &vmstate_alpha_cpu);
 }
 
diff --git a/target-alpha/cpu.h b/target-alpha/cpu.h
index 2156a1e..01f4ebb 100644
--- a/target-alpha/cpu.h
+++ b/target-alpha/cpu.h
@@ -457,9 +457,9 @@ uint64_t cpu_alpha_load_fpcr (CPUAlphaState *env);
 void cpu_alpha_store_fpcr (CPUAlphaState *env, uint64_t val);
 #ifndef CONFIG_USER_ONLY
 void swap_shadow_regs(CPUAlphaState *env);
-QEMU_NORETURN void cpu_unassigned_access(CPUAlphaState *env1,
-                                         hwaddr addr, int is_write,
-                                         int is_exec, int unused, int size);
+QEMU_NORETURN void alpha_cpu_unassigned_access(CPUState *cpu, hwaddr addr,
+                                               bool is_write, bool is_exec,
+                                               int unused, unsigned size);
 #endif
 
 /* Bits in TB->FLAGS that control how translation is processed.  */
diff --git a/target-alpha/mem_helper.c b/target-alpha/mem_helper.c
index 3d2cd61..7160a1c 100644
--- a/target-alpha/mem_helper.c
+++ b/target-alpha/mem_helper.c
@@ -109,11 +109,15 @@ static void do_unaligned_access(CPUAlphaState *env, target_ulong addr,
     cpu_loop_exit(env);
 }
 
-void cpu_unassigned_access(CPUAlphaState *env, hwaddr addr,
-                           int is_write, int is_exec, int unused, int size)
+void alpha_cpu_unassigned_access(CPUState *cs, hwaddr addr,
+                                 bool is_write, bool is_exec, int unused,
+                                 unsigned size)
 {
+    AlphaCPU *cpu = ALPHA_CPU(cs);
+    CPUAlphaState *env = &cpu->env;
+
     env->trap_arg0 = addr;
-    env->trap_arg1 = is_write;
+    env->trap_arg1 = is_write ? 1 : 0;
     dynamic_excp(env, 0, EXCP_MCHK, 0);
 }
 
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index b9a097c..a0fcdf4 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -138,8 +138,8 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = mb_cpu_do_interrupt;
     cc->dump_state = mb_cpu_dump_state;
+    cpu_class_set_do_unassigned_access(cc, mb_cpu_unassigned_access);
     dc->vmsd = &vmstate_mb_cpu;
-
     dc->props = mb_properties;
 }
 
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 1813939..75ae5ba 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -367,8 +367,9 @@ static inline void cpu_get_tb_cpu_state(CPUMBState *env, target_ulong *pc,
 }
 
 #if !defined(CONFIG_USER_ONLY)
-void cpu_unassigned_access(CPUMBState *env1, hwaddr addr,
-                           int is_write, int is_exec, int is_asi, int size);
+void mb_cpu_unassigned_access(CPUState *cpu, hwaddr addr,
+                              bool is_write, bool is_exec, int is_asi,
+                              unsigned size);
 #endif
 
 static inline bool cpu_has_work(CPUState *cpu)
diff --git a/target-microblaze/op_helper.c b/target-microblaze/op_helper.c
index f2cb88b..14baa84 100644
--- a/target-microblaze/op_helper.c
+++ b/target-microblaze/op_helper.c
@@ -495,12 +495,21 @@ void helper_mmu_write(CPUMBState *env, uint32_t rn, uint32_t v)
     mmu_write(env, rn, v);
 }
 
-void cpu_unassigned_access(CPUMBState *env, hwaddr addr,
-                           int is_write, int is_exec, int is_asi, int size)
+void mb_cpu_unassigned_access(CPUState *cs, hwaddr addr,
+                              bool is_write, bool is_exec, int is_asi,
+                              unsigned size)
 {
+    MicroBlazeCPU *cpu;
+    CPUMBState *env;
+
     qemu_log_mask(CPU_LOG_INT, "Unassigned " TARGET_FMT_plx " wr=%d exe=%d\n",
-             addr, is_write, is_exec);
-    if (!env || !(env->sregs[SR_MSR] & MSR_EE)) {
+             addr, is_write ? 1 : 0, is_exec ? 1 : 0);
+    if (cs == NULL) {
+        return;
+    }
+    cpu = MICROBLAZE_CPU(cs);
+    env = &cpu->env;
+    if (!(env->sregs[SR_MSR] & MSR_EE)) {
         return;
     }
 
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 0fdc316..b61e207 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -80,6 +80,7 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
 
     cc->do_interrupt = mips_cpu_do_interrupt;
     cc->dump_state = mips_cpu_dump_state;
+    cpu_class_set_do_unassigned_access(cc, mips_cpu_unassigned_access);
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 6e761e0..fa0f0d1 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -493,8 +493,9 @@ void r4k_helper_tlbwr(CPUMIPSState *env);
 void r4k_helper_tlbp(CPUMIPSState *env);
 void r4k_helper_tlbr(CPUMIPSState *env);
 
-void cpu_unassigned_access(CPUMIPSState *env, hwaddr addr,
-                           int is_write, int is_exec, int unused, int size);
+void mips_cpu_unassigned_access(CPUState *cpu, hwaddr addr,
+                                bool is_write, bool is_exec, int unused,
+                                unsigned size);
 #endif
 
 void mips_cpu_list (FILE *f, fprintf_function cpu_fprintf);
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 3fa0d00..f6838ec 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -2147,13 +2147,18 @@ void tlb_fill(CPUMIPSState *env, target_ulong addr, int is_write, int mmu_idx,
     }
 }
 
-void cpu_unassigned_access(CPUMIPSState *env, hwaddr addr,
-                           int is_write, int is_exec, int unused, int size)
+void mips_cpu_unassigned_access(CPUState *cs, hwaddr addr,
+                                bool is_write, bool is_exec, int unused,
+                                unsigned size)
 {
-    if (is_exec)
+    MIPSCPU *cpu = MIPS_CPU(cs);
+    CPUMIPSState *env = &cpu->env;
+
+    if (is_exec) {
         helper_raise_exception(env, EXCP_IBE);
-    else
+    } else {
         helper_raise_exception(env, EXCP_DBE);
+    }
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index ff1200c..65ae6f7 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -771,6 +771,7 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->do_interrupt = sparc_cpu_do_interrupt;
     cc->dump_state = sparc_cpu_dump_state;
+    cpu_class_set_do_unassigned_access(cc, sparc_cpu_unassigned_access);
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 6fa7778..021eb157 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -582,8 +582,9 @@ static inline int tlb_compare_context(const SparcTLBEntry *tlb,
 
 /* cpu-exec.c */
 #if !defined(CONFIG_USER_ONLY)
-void cpu_unassigned_access(CPUSPARCState *env1, hwaddr addr,
-                           int is_write, int is_exec, int is_asi, int size);
+void sparc_cpu_unassigned_access(CPUState *cpu, hwaddr addr,
+                                 bool is_write, bool is_exec, int is_asi,
+                                 unsigned size);
 #if defined(TARGET_SPARC64)
 hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr,
                                            int mmu_idx);
diff --git a/target-sparc/ldst_helper.c b/target-sparc/ldst_helper.c
index 6d767fb..2936b58 100644
--- a/target-sparc/ldst_helper.c
+++ b/target-sparc/ldst_helper.c
@@ -686,7 +686,8 @@ uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr, int asi, int size,
         break;
     case 8: /* User code access, XXX */
     default:
-        cpu_unassigned_access(env, addr, 0, 0, asi, size);
+        cpu_unassigned_access(CPU(sparc_env_get_cpu(env)),
+                              addr, false, false, asi, size);
         ret = 0;
         break;
     }
@@ -1088,7 +1089,8 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val, int asi,
     case 8: /* User code access, XXX */
     case 9: /* Supervisor code access, XXX */
     default:
-        cpu_unassigned_access(env, addr, 1, 0, asi, size);
+        cpu_unassigned_access(CPU(sparc_env_get_cpu(env)),
+                              addr, true, false, asi, size);
         break;
     }
 #ifdef DEBUG_ASI
@@ -1594,7 +1596,8 @@ uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr, int asi, int size,
     case 0x5f: /* D-MMU demap, WO */
     case 0x77: /* Interrupt vector, WO */
     default:
-        cpu_unassigned_access(env, addr, 0, 0, 1, size);
+        cpu_unassigned_access(CPU(sparc_env_get_cpu(env)),
+                              addr, false, false, 1, size);
         ret = 0;
         break;
     }
@@ -2027,7 +2030,8 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, target_ulong val,
     case 0x8a: /* Primary no-fault LE, RO */
     case 0x8b: /* Secondary no-fault LE, RO */
     default:
-        cpu_unassigned_access(env, addr, 1, 0, 1, size);
+        cpu_unassigned_access(CPU(sparc_env_get_cpu(env)),
+                              addr, true, false, 1, size);
         return;
     }
 }
@@ -2322,9 +2326,12 @@ void helper_stqf(CPUSPARCState *env, target_ulong addr, int mem_idx)
 
 #if !defined(CONFIG_USER_ONLY)
 #ifndef TARGET_SPARC64
-void cpu_unassigned_access(CPUSPARCState *env, hwaddr addr,
-                           int is_write, int is_exec, int is_asi, int size)
+void sparc_cpu_unassigned_access(CPUState *cs, hwaddr addr,
+                                 bool is_write, bool is_exec, int is_asi,
+                                 unsigned size)
 {
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    CPUSPARCState *env = &cpu->env;
     int fault_type;
 
 #ifdef DEBUG_UNASSIGNED
@@ -2382,9 +2389,13 @@ void cpu_unassigned_access(CPUSPARCState *env, hwaddr addr,
     }
 }
 #else
-void cpu_unassigned_access(CPUSPARCState *env, hwaddr addr,
-                           int is_write, int is_exec, int is_asi, int size)
+void sparc_cpu_unassigned_access(CPUState *cs, hwaddr addr,
+                                 bool is_write, bool is_exec, int is_asi,
+                                 unsigned size)
 {
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    CPUSPARCState *env = &cpu->env;
+
 #ifdef DEBUG_UNASSIGNED
     printf("Unassigned mem access to " TARGET_FMT_plx " from " TARGET_FMT_lx
            "\n", addr, env->pc);
commit ce927ed9e40e25008453eb8f130661514b633341
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue May 28 14:02:38 2013 +0200

    hwaddr: Make hwaddr type usable beyond softmmu
    
    While not normally needed for *-user, it can safely be used there since
    always based on uint64_t, to avoid ifdeffery.
    
    To avoid accidental uses, move the guards from exec/hwaddr.h to its
    inclusion sites.  No need for them in include/hw/.
    
    Prepares for hwaddr use in qom/cpu.h.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 92a4223..5240ae2 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -3,7 +3,9 @@
 
 /* CPU interfaces that are target independent.  */
 
+#ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
+#endif
 
 #ifndef NEED_CPU_H
 #include "exec/poison.h"
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 2e5a9ba..c4ac929 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -28,7 +28,9 @@
 #include <inttypes.h>
 #include "qemu/osdep.h"
 #include "qemu/queue.h"
+#ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
+#endif
 
 #ifndef TARGET_LONG_BITS
 #error TARGET_LONG_BITS must be defined before including this header
diff --git a/include/exec/hwaddr.h b/include/exec/hwaddr.h
index 251cf92..c9eb78f 100644
--- a/include/exec/hwaddr.h
+++ b/include/exec/hwaddr.h
@@ -3,8 +3,6 @@
 #ifndef HWADDR_H
 #define HWADDR_H
 
-#ifndef CONFIG_USER_ONLY
-
 #define HWADDR_BITS 64
 /* hwaddr is the type of a physical address (its size can
    be different from 'target_ulong').  */
@@ -20,5 +18,3 @@ typedef uint64_t hwaddr;
 #define HWADDR_PRIX PRIX64
 
 #endif
-
-#endif
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 3598c4f..2ddc3c5 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -20,7 +20,9 @@
 #include <stdbool.h>
 #include "qemu-common.h"
 #include "exec/cpu-common.h"
+#ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
+#endif
 #include "qemu/queue.h"
 #include "exec/iorange.h"
 #include "exec/ioport.h"
commit c643bed99fcde661b034623722004562b7953669
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 03:23:24 2013 +0200

    cpu: Change qemu_init_vcpu() argument to CPUState
    
    This allows to move the call into CPUState's realizefn.
    Therefore move the stub into libqemustub.a.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 06ab567..86571f9 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1053,11 +1053,8 @@ static void qemu_dummy_start_vcpu(CPUState *cpu)
     }
 }
 
-void qemu_init_vcpu(void *_env)
+void qemu_init_vcpu(CPUState *cpu)
 {
-    CPUArchState *env = _env;
-    CPUState *cpu = ENV_GET_CPU(env);
-
     cpu->nr_cores = smp_cores;
     cpu->nr_threads = smp_threads;
     cpu->stopped = true;
diff --git a/include/qemu-common.h b/include/qemu-common.h
index 6010bba..f439738 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -295,14 +295,6 @@ struct qemu_work_item {
     int done;
 };
 
-#ifdef CONFIG_USER_ONLY
-static inline void qemu_init_vcpu(void *env)
-{
-}
-#else
-void qemu_init_vcpu(void *env);
-#endif
-
 
 /**
  * Sends a (part of) iovec down a socket, yielding when the socket is full, or
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 12b5099..d9b73db 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -428,6 +428,14 @@ void cpu_exit(CPUState *cpu);
  */
 void cpu_resume(CPUState *cpu);
 
+/**
+ * qemu_init_vcpu:
+ * @cpu: The vCPU to initialize.
+ *
+ * Initializes a vCPU.
+ */
+void qemu_init_vcpu(CPUState *cpu);
+
 #ifdef CONFIG_SOFTMMU
 extern const struct VMStateDescription vmstate_cpu_common;
 #else
diff --git a/qom/cpu.c b/qom/cpu.c
index 4da6332..ee8f632 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -209,6 +209,8 @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
 {
     CPUState *cpu = CPU(dev);
 
+    qemu_init_vcpu(cpu);
+
     if (dev->hotplugged) {
         cpu_synchronize_post_init(cpu);
         notifier_list_notify(&cpu_added_notifiers, dev);
diff --git a/stubs/cpus.c b/stubs/cpus.c
index f0d56c5..8e6f06b 100644
--- a/stubs/cpus.c
+++ b/stubs/cpus.c
@@ -4,3 +4,7 @@
 void cpu_resume(CPUState *cpu)
 {
 }
+
+void qemu_init_vcpu(CPUState *cpu)
+{
+}
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 7d7fdab..4e62eaf 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -26,11 +26,8 @@
 
 static void alpha_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    AlphaCPU *cpu = ALPHA_CPU(dev);
     AlphaCPUClass *acc = ALPHA_CPU_GET_CLASS(dev);
 
-    qemu_init_vcpu(&cpu->env);
-
     acc->parent_realize(dev, errp);
 }
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 645c961..1bc227e 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -208,7 +208,6 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     init_cpreg_list(cpu);
 
     cpu_reset(CPU(cpu));
-    qemu_init_vcpu(env);
 
     acc->parent_realize(dev, errp);
 }
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 82271f7..6a3bdf0 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -139,7 +139,6 @@ static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
     CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(dev);
 
     cpu_reset(CPU(cpu));
-    qemu_init_vcpu(&cpu->env);
 
     ccc->parent_realize(dev, errp);
 }
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 48c062f..b7416fe 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2392,7 +2392,6 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 #endif
 
     mce_init(cpu);
-    qemu_init_vcpu(&cpu->env);
 
     x86_cpu_apic_realize(cpu, &local_err);
     if (local_err != NULL) {
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 2366152..02f8436 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -49,8 +49,6 @@ static void lm32_cpu_realizefn(DeviceState *dev, Error **errp)
 
     cpu_reset(CPU(cpu));
 
-    qemu_init_vcpu(&cpu->env);
-
     lcc->parent_realize(dev, errp);
 }
 
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index d501027..799869f 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -147,7 +147,6 @@ static void m68k_cpu_realizefn(DeviceState *dev, Error **errp)
     m68k_cpu_init_gdb(cpu);
 
     cpu_reset(CPU(cpu));
-    qemu_init_vcpu(&cpu->env);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index e8104d1..b9a097c 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -92,7 +92,6 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
     MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
 
     cpu_reset(CPU(cpu));
-    qemu_init_vcpu(&cpu->env);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index b685d39..0fdc316 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -48,7 +48,6 @@ static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
     MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);
 
     cpu_reset(CPU(cpu));
-    qemu_init_vcpu(&cpu->env);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 3c3932c..f3c0d22 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -44,12 +44,11 @@ static void moxie_cpu_reset(CPUState *s)
 static void moxie_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     MoxieCPU *cpu = MOXIE_CPU(dev);
-    MoxieCPUClass *occ = MOXIE_CPU_GET_CLASS(dev);
+    MoxieCPUClass *mcc = MOXIE_CPU_GET_CLASS(dev);
 
-    qemu_init_vcpu(&cpu->env);
     cpu_reset(CPU(cpu));
 
-    occ->parent_realize(dev, errp);
+    mcc->parent_realize(dev, errp);
 }
 
 static void moxie_cpu_initfn(Object *obj)
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index a401706..fd90d37 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -67,7 +67,6 @@ static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)
     OpenRISCCPU *cpu = OPENRISC_CPU(dev);
     OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(dev);
 
-    qemu_init_vcpu(&cpu->env);
     cpu_reset(CPU(cpu));
 
     occ->parent_realize(dev, errp);
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 0edb336..fa5e09f 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7752,8 +7752,6 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
                                  34, "power-spe.xml", 0);
     }
 
-    qemu_init_vcpu(env);
-
     pcc->parent_realize(dev, errp);
 
 #if defined(PPC_DUMP_CPU)
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 8ec2f9b..c3697cd 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -102,7 +102,6 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
     S390CPU *cpu = S390_CPU(dev);
     S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
 
-    qemu_init_vcpu(&cpu->env);
     cpu_reset(CPU(cpu));
 
     scc->parent_realize(dev, errp);
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index a7d5213..e739156 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -234,7 +234,6 @@ static void superh_cpu_realizefn(DeviceState *dev, Error **errp)
     SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(dev);
 
     cpu_reset(CPU(cpu));
-    qemu_init_vcpu(&cpu->env);
 
     scc->parent_realize(dev, errp);
 }
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 72700cd..ff1200c 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -730,11 +730,8 @@ void sparc_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
 
 static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    SPARCCPU *cpu = SPARC_CPU(dev);
     SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(dev);
 
-    qemu_init_vcpu(&cpu->env);
-
     scc->parent_realize(dev, errp);
 }
 
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 1a97e6b..6572f01 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -83,11 +83,8 @@ static const UniCore32CPUInfo uc32_cpus[] = {
 
 static void uc32_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    UniCore32CPU *cpu = UNICORE32_CPU(dev);
     UniCore32CPUClass *ucc = UNICORE32_CPU_GET_CLASS(dev);
 
-    qemu_init_vcpu(&cpu->env);
-
     ucc->parent_realize(dev, errp);
 }
 
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index b5df321..0488984 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -59,11 +59,8 @@ static void xtensa_cpu_reset(CPUState *s)
 
 static void xtensa_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    XtensaCPU *cpu = XTENSA_CPU(dev);
     XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(dev);
 
-    qemu_init_vcpu(&cpu->env);
-
     xcc->parent_realize(dev, errp);
 }
 
commit 10a9021dfd9d8ebdaf53100a8e216054ef4fa662
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 02:24:35 2013 +0200

    cpus: Change qemu_dummy_start_vcpu() argument to CPUState
    
    Pass it to qemu_dummy_cpu_thread_fn().
    Use CPUState::env_ptr for cpu_single_env.
    
    Prepares for changing qemu_init_vcpu() argument to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 6e6a8f9..06ab567 100644
--- a/cpus.c
+++ b/cpus.c
@@ -766,8 +766,7 @@ static void *qemu_dummy_cpu_thread_fn(void *arg)
     fprintf(stderr, "qtest is not supported under Windows\n");
     exit(1);
 #else
-    CPUArchState *env = arg;
-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUState *cpu = arg;
     sigset_t waitset;
     int r;
 
@@ -782,7 +781,7 @@ static void *qemu_dummy_cpu_thread_fn(void *arg)
     cpu->created = true;
     qemu_cond_signal(&qemu_cpu_cond);
 
-    cpu_single_env = env;
+    cpu_single_env = cpu->env_ptr;
     while (1) {
         cpu_single_env = NULL;
         qemu_mutex_unlock_iothread();
@@ -795,7 +794,7 @@ static void *qemu_dummy_cpu_thread_fn(void *arg)
             exit(1);
         }
         qemu_mutex_lock_iothread();
-        cpu_single_env = env;
+        cpu_single_env = cpu->env_ptr;
         qemu_wait_io_event_common(cpu);
     }
 
@@ -1042,14 +1041,12 @@ static void qemu_kvm_start_vcpu(CPUState *cpu)
     }
 }
 
-static void qemu_dummy_start_vcpu(CPUArchState *env)
+static void qemu_dummy_start_vcpu(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     cpu->thread = g_malloc0(sizeof(QemuThread));
     cpu->halt_cond = g_malloc0(sizeof(QemuCond));
     qemu_cond_init(cpu->halt_cond);
-    qemu_thread_create(cpu->thread, qemu_dummy_cpu_thread_fn, env,
+    qemu_thread_create(cpu->thread, qemu_dummy_cpu_thread_fn, cpu,
                        QEMU_THREAD_JOINABLE);
     while (!cpu->created) {
         qemu_cond_wait(&qemu_cpu_cond, &qemu_global_mutex);
@@ -1069,7 +1066,7 @@ void qemu_init_vcpu(void *_env)
     } else if (tcg_enabled()) {
         qemu_tcg_init_vcpu(cpu);
     } else {
-        qemu_dummy_start_vcpu(env);
+        qemu_dummy_start_vcpu(cpu);
     }
 }
 
commit 48a106bd144c60862e8b6116dc226885d1937d76
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 02:20:39 2013 +0200

    cpus: Change qemu_kvm_start_vcpu() argument to CPUState
    
    Pass it on to qemu_kvm_cpu_thread_fn().
    
    Prepares for changing qemu_init_vcpu() argument to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 6016891..6e6a8f9 100644
--- a/cpus.c
+++ b/cpus.c
@@ -727,14 +727,13 @@ static void qemu_kvm_wait_io_event(CPUState *cpu)
 
 static void *qemu_kvm_cpu_thread_fn(void *arg)
 {
-    CPUArchState *env = arg;
-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUState *cpu = arg;
     int r;
 
     qemu_mutex_lock(&qemu_global_mutex);
     qemu_thread_get_self(cpu->thread);
     cpu->thread_id = qemu_get_thread_id();
-    cpu_single_env = env;
+    cpu_single_env = cpu->env_ptr;
 
     r = kvm_init_vcpu(cpu);
     if (r < 0) {
@@ -1031,14 +1030,12 @@ static void qemu_tcg_init_vcpu(CPUState *cpu)
     }
 }
 
-static void qemu_kvm_start_vcpu(CPUArchState *env)
+static void qemu_kvm_start_vcpu(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     cpu->thread = g_malloc0(sizeof(QemuThread));
     cpu->halt_cond = g_malloc0(sizeof(QemuCond));
     qemu_cond_init(cpu->halt_cond);
-    qemu_thread_create(cpu->thread, qemu_kvm_cpu_thread_fn, env,
+    qemu_thread_create(cpu->thread, qemu_kvm_cpu_thread_fn, cpu,
                        QEMU_THREAD_JOINABLE);
     while (!cpu->created) {
         qemu_cond_wait(&qemu_cpu_cond, &qemu_global_mutex);
@@ -1068,7 +1065,7 @@ void qemu_init_vcpu(void *_env)
     cpu->nr_threads = smp_threads;
     cpu->stopped = true;
     if (kvm_enabled()) {
-        qemu_kvm_start_vcpu(env);
+        qemu_kvm_start_vcpu(cpu);
     } else if (tcg_enabled()) {
         qemu_tcg_init_vcpu(cpu);
     } else {
commit 913250464f5ea5799d71ab033b51d1bf8ed84343
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 02:07:49 2013 +0200

    cpus: Change cpu_handle_guest_debug() argument to CPUState
    
    CPUArchState is no longer needed.
    
    Prepares for changing qemu_kvm_cpu_thread_fn() opaque to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 54acced..6016891 100644
--- a/cpus.c
+++ b/cpus.c
@@ -459,10 +459,8 @@ static bool cpu_can_run(CPUState *cpu)
     return true;
 }
 
-static void cpu_handle_guest_debug(CPUArchState *env)
+static void cpu_handle_guest_debug(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     gdb_set_stop_cpu(cpu);
     qemu_system_debug_request();
     cpu->stopped = true;
@@ -754,7 +752,7 @@ static void *qemu_kvm_cpu_thread_fn(void *arg)
         if (cpu_can_run(cpu)) {
             r = kvm_cpu_exec(cpu);
             if (r == EXCP_DEBUG) {
-                cpu_handle_guest_debug(env);
+                cpu_handle_guest_debug(cpu);
             }
         }
         qemu_kvm_wait_io_event(cpu);
@@ -1172,7 +1170,7 @@ static void tcg_exec_all(void)
         if (cpu_can_run(cpu)) {
             r = tcg_cpu_exec(env);
             if (r == EXCP_DEBUG) {
-                cpu_handle_guest_debug(env);
+                cpu_handle_guest_debug(cpu);
                 break;
             }
         } else if (cpu->stop || cpu->stopped) {
commit 64f6b3469d5983141707dfc5ec2e8f5f60af1ba0
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 02:06:09 2013 +0200

    gdbstub: Set gdb_set_stop_cpu() argument to CPUState
    
    Use CPUState::env_ptr for now.
    
    Prepares for changing cpu_handle_guest_debug() argument to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 12f6f32..54acced 100644
--- a/cpus.c
+++ b/cpus.c
@@ -463,7 +463,7 @@ static void cpu_handle_guest_debug(CPUArchState *env)
 {
     CPUState *cpu = ENV_GET_CPU(env);
 
-    gdb_set_stop_cpu(env);
+    gdb_set_stop_cpu(cpu);
     qemu_system_debug_request();
     cpu->stopped = true;
 }
diff --git a/gdbstub.c b/gdbstub.c
index 0f15c7c..3101a43 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2506,8 +2506,10 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
     return RS_IDLE;
 }
 
-void gdb_set_stop_cpu(CPUArchState *env)
+void gdb_set_stop_cpu(CPUState *cpu)
 {
+    CPUArchState *env = cpu->env_ptr;
+
     gdbserver_state->c_cpu = env;
     gdbserver_state->g_cpu = env;
 }
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index ba20afa..ded4160 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -16,7 +16,7 @@ typedef void (*gdb_syscall_complete_cb)(CPUArchState *env,
 
 void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...);
 int use_gdb_syscalls(void);
-void gdb_set_stop_cpu(CPUArchState *env);
+void gdb_set_stop_cpu(CPUState *cpu);
 void gdb_exit(CPUArchState *, int);
 #ifdef CONFIG_USER_ONLY
 int gdb_queuesig (void);
commit 1458c363139a54f50ea336edc612d8c5e9142220
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun May 26 23:46:55 2013 +0200

    kvm: Change kvm_cpu_exec() argument to CPUState
    
    It no longer uses CPUArchState.
    
    Prepares for changing qemu_kvm_cpu_thread_fn() opaque to CPUState.
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 4c7e329..12f6f32 100644
--- a/cpus.c
+++ b/cpus.c
@@ -752,7 +752,7 @@ static void *qemu_kvm_cpu_thread_fn(void *arg)
 
     while (1) {
         if (cpu_can_run(cpu)) {
-            r = kvm_cpu_exec(env);
+            r = kvm_cpu_exec(cpu);
             if (r == EXCP_DEBUG) {
                 cpu_handle_guest_debug(env);
             }
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 5adb044..fe8bc40 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -147,9 +147,9 @@ int kvm_has_gsi_routing(void);
 int kvm_has_intx_set_mask(void);
 
 int kvm_init_vcpu(CPUState *cpu);
+int kvm_cpu_exec(CPUState *cpu);
 
 #ifdef NEED_CPU_H
-int kvm_cpu_exec(CPUArchState *env);
 
 #if !defined(CONFIG_USER_ONLY)
 void *kvm_ram_alloc(ram_addr_t size);
diff --git a/kvm-all.c b/kvm-all.c
index d3e5e5e..7a1684e 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1607,9 +1607,8 @@ void kvm_cpu_synchronize_post_init(CPUState *cpu)
     cpu->kvm_vcpu_dirty = false;
 }
 
-int kvm_cpu_exec(CPUArchState *env)
+int kvm_cpu_exec(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_run *run = cpu->kvm_run;
     int ret, run_ret;
 
diff --git a/kvm-stub.c b/kvm-stub.c
index 50af700..5457fe8 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -54,9 +54,9 @@ void kvm_cpu_synchronize_post_init(CPUState *cpu)
 {
 }
 
-int kvm_cpu_exec(CPUArchState *env)
+int kvm_cpu_exec(CPUState *cpu)
 {
-    abort ();
+    abort();
 }
 
 int kvm_has_sync_mmu(void)
commit 5326ab5567c12bac0802b08b265f401fe84a4ad6
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 01:55:29 2013 +0200

    kvm: Change kvm_handle_internal_error() argument to CPUState
    
    It no longer uses CPUArchState.
    
    Prepares for changing kvm_cpu_exec() argument to CPUState.
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/kvm-all.c b/kvm-all.c
index bab04c9..d3e5e5e 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1525,10 +1525,8 @@ static void kvm_handle_io(uint16_t port, void *data, int direction, int size,
     }
 }
 
-static int kvm_handle_internal_error(CPUArchState *env, struct kvm_run *run)
+static int kvm_handle_internal_error(CPUState *cpu, struct kvm_run *run)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     fprintf(stderr, "KVM internal error.");
     if (kvm_check_extension(kvm_state, KVM_CAP_INTERNAL_ERROR_DATA)) {
         int i;
@@ -1690,7 +1688,7 @@ int kvm_cpu_exec(CPUArchState *env)
             ret = -1;
             break;
         case KVM_EXIT_INTERNAL_ERROR:
-            ret = kvm_handle_internal_error(env, run);
+            ret = kvm_handle_internal_error(cpu, run);
             break;
         default:
             DPRINTF("kvm_arch_handle_exit\n");
commit 878096eeb278a8ac1ccd6667af73e026f29b4cf5
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon May 27 01:33:50 2013 +0200

    cpu: Turn cpu_dump_{state,statistics}() into CPUState hooks
    
    Make cpustats monitor command available unconditionally.
    
    Prepares for changing kvm_handle_internal_error() and kvm_cpu_exec()
    arguments to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 572f13a..75dbd7f 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -511,6 +511,7 @@ static void flush_windows(CPUSPARCState *env)
 
 void cpu_loop(CPUSPARCState *env)
 {
+    CPUState *cs = CPU(sparc_env_get_cpu(env));
     int trapnr, ret, syscall_nr;
     //target_siginfo_t info;
 
@@ -659,7 +660,7 @@ void cpu_loop(CPUSPARCState *env)
         badtrap:
 #endif
             printf ("Unhandled trap: 0x%x\n", trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             exit (1);
         }
         process_pending_signals (env);
diff --git a/cpus.c b/cpus.c
index 40bf64c..4c7e329 100644
--- a/cpus.c
+++ b/cpus.c
@@ -397,7 +397,7 @@ void hw_error(const char *fmt, ...)
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
         cpu = ENV_GET_CPU(env);
         fprintf(stderr, "CPU #%d:\n", cpu->cpu_index);
-        cpu_dump_state(env, stderr, fprintf, CPU_DUMP_FPU);
+        cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_FPU);
     }
     va_end(ap);
     abort();
diff --git a/exec.c b/exec.c
index 2d02b11..c49806c 100644
--- a/exec.c
+++ b/exec.c
@@ -600,6 +600,7 @@ void cpu_single_step(CPUArchState *env, int enabled)
 
 void cpu_abort(CPUArchState *env, const char *fmt, ...)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     va_list ap;
     va_list ap2;
 
@@ -608,7 +609,7 @@ void cpu_abort(CPUArchState *env, const char *fmt, ...)
     fprintf(stderr, "qemu: fatal: ");
     vfprintf(stderr, fmt, ap);
     fprintf(stderr, "\n");
-    cpu_dump_state(env, stderr, fprintf, CPU_DUMP_FPU | CPU_DUMP_CCOP);
+    cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_FPU | CPU_DUMP_CCOP);
     if (qemu_log_enabled()) {
         qemu_log("qemu: fatal: ");
         qemu_log_vprintf(fmt, ap2);
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index e1cc62e..35bdf85 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -355,16 +355,6 @@ int page_check_range(target_ulong start, target_ulong len, int flags);
 
 CPUArchState *cpu_copy(CPUArchState *env);
 
-#define CPU_DUMP_CODE 0x00010000
-#define CPU_DUMP_FPU 0x00020000 /* dump FPU register state, not just integer */
-/* dump info about TCG QEMU's condition code optimization state */
-#define CPU_DUMP_CCOP 0x00040000
-
-void cpu_dump_state(CPUArchState *env, FILE *f, fprintf_function cpu_fprintf,
-                    int flags);
-void cpu_dump_statistics(CPUArchState *env, FILE *f, fprintf_function cpu_fprintf,
-                         int flags);
-
 void QEMU_NORETURN cpu_abort(CPUArchState *env, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
 extern CPUArchState *first_cpu;
diff --git a/include/qemu/log.h b/include/qemu/log.h
index fd76f91..a9cf214 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -75,7 +75,7 @@ void GCC_FMT_ATTR(2, 3) qemu_log_mask(int mask, const char *fmt, ...);
 static inline void log_cpu_state(CPUArchState *env1, int flags)
 {
     if (qemu_log_enabled()) {
-        cpu_dump_state(env1, qemu_logfile, fprintf, flags);
+        cpu_dump_state(ENV_GET_CPU(env1), qemu_logfile, fprintf, flags);
     }
 }
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 3494356..12b5099 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -48,6 +48,8 @@ typedef struct CPUState CPUState;
  * instantiatable CPU type.
  * @reset: Callback to reset the #CPUState to its initial state.
  * @do_interrupt: Callback for interrupt handling.
+ * @dump_state: Callback for dumping state.
+ * @dump_statistics: Callback for dumping statistics.
  * @get_arch_id: Callback for getting architecture-dependent CPU ID.
  * @get_paging_enabled: Callback for inquiring whether paging is enabled.
  * @get_memory_mapping: Callback for obtaining the memory mappings.
@@ -64,6 +66,10 @@ typedef struct CPUClass {
 
     void (*reset)(CPUState *cpu);
     void (*do_interrupt)(CPUState *cpu);
+    void (*dump_state)(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                       int flags);
+    void (*dump_statistics)(CPUState *cpu, FILE *f,
+                            fprintf_function cpu_fprintf, int flags);
     int64_t (*get_arch_id)(CPUState *cpu);
     bool (*get_paging_enabled)(const CPUState *cpu);
     void (*get_memory_mapping)(CPUState *cpu, MemoryMappingList *list,
@@ -201,6 +207,42 @@ int cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
                              void *opaque);
 
 /**
+ * CPUDumpFlags:
+ * @CPU_DUMP_CODE:
+ * @CPU_DUMP_FPU: dump FPU register state, not just integer
+ * @CPU_DUMP_CCOP: dump info about TCG QEMU's condition code optimization state
+ */
+enum CPUDumpFlags {
+    CPU_DUMP_CODE = 0x00010000,
+    CPU_DUMP_FPU  = 0x00020000,
+    CPU_DUMP_CCOP = 0x00040000,
+};
+
+/**
+ * cpu_dump_state:
+ * @cpu: The CPU whose state is to be dumped.
+ * @f: File to dump to.
+ * @cpu_fprintf: Function to dump with.
+ * @flags: Flags what to dump.
+ *
+ * Dumps CPU state.
+ */
+void cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                    int flags);
+
+/**
+ * cpu_dump_statistics:
+ * @cpu: The CPU whose state is to be dumped.
+ * @f: File to dump to.
+ * @cpu_fprintf: Function to dump with.
+ * @flags: Flags what to dump.
+ *
+ * Dumps CPU statistics.
+ */
+void cpu_dump_statistics(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                         int flags);
+
+/**
  * cpu_reset:
  * @cpu: The CPU whose state is to be reset.
  */
diff --git a/kvm-all.c b/kvm-all.c
index f1031e0..bab04c9 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1544,7 +1544,7 @@ static int kvm_handle_internal_error(CPUArchState *env, struct kvm_run *run)
     if (run->internal.suberror == KVM_INTERNAL_ERROR_EMULATION) {
         fprintf(stderr, "emulation failure\n");
         if (!kvm_arch_stop_on_emulation_error(cpu)) {
-            cpu_dump_state(env, stderr, fprintf, CPU_DUMP_CODE);
+            cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_CODE);
             return EXCP_INTERRUPT;
         }
     }
@@ -1700,7 +1700,7 @@ int kvm_cpu_exec(CPUArchState *env)
     } while (ret == 0);
 
     if (ret < 0) {
-        cpu_dump_state(env, stderr, fprintf, CPU_DUMP_CODE);
+        cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_CODE);
         vm_stop(RUN_STATE_INTERNAL_ERROR);
     }
 
diff --git a/linux-user/main.c b/linux-user/main.c
index f67a62b..af82db8 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -901,7 +901,7 @@ void cpu_loop(CPUARMState *env)
         error:
             fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n",
                     trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             abort();
         }
         process_pending_signals(env);
@@ -985,7 +985,7 @@ void cpu_loop(CPUUniCore32State *env)
 
 error:
     fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n", trapnr);
-    cpu_dump_state(env, stderr, fprintf, 0);
+    cpu_dump_state(cs, stderr, fprintf, 0);
     abort();
 }
 #endif
@@ -1115,6 +1115,7 @@ static void flush_windows(CPUSPARCState *env)
 
 void cpu_loop (CPUSPARCState *env)
 {
+    CPUState *cs = CPU(sparc_env_get_cpu(env));
     int trapnr;
     abi_long ret;
     target_siginfo_t info;
@@ -1246,7 +1247,7 @@ void cpu_loop (CPUSPARCState *env)
             break;
         default:
             printf ("Unhandled trap: 0x%x\n", trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             exit (1);
         }
         process_pending_signals (env);
@@ -1304,7 +1305,7 @@ int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
 #define EXCP_DUMP(env, fmt, ...)                                        \
 do {                                                                    \
     fprintf(stderr, fmt , ## __VA_ARGS__);                              \
-    cpu_dump_state(env, stderr, fprintf, 0);                            \
+    cpu_dump_state(ENV_GET_CPU(env), stderr, fprintf, 0);               \
     qemu_log(fmt, ## __VA_ARGS__);                                      \
     if (qemu_log_enabled()) {                                           \
         log_cpu_state(env, 0);                                          \
@@ -2391,7 +2392,7 @@ done_syscall:
 error:
             fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n",
                     trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             abort();
         }
         process_pending_signals(env);
@@ -2403,6 +2404,7 @@ error:
 
 void cpu_loop(CPUOpenRISCState *env)
 {
+    CPUState *cs = CPU(openrisc_env_get_cpu(env));
     int trapnr, gdbsig;
 
     for (;;) {
@@ -2420,7 +2422,7 @@ void cpu_loop(CPUOpenRISCState *env)
             break;
         case EXCP_DPF:
         case EXCP_IPF:
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             gdbsig = TARGET_SIGSEGV;
             break;
         case EXCP_TICK:
@@ -2469,7 +2471,7 @@ void cpu_loop(CPUOpenRISCState *env)
         default:
             qemu_log("\nqemu: unhandled CPU exception %#x - aborting\n",
                      trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             gdbsig = TARGET_SIGILL;
             break;
         }
@@ -2489,6 +2491,7 @@ void cpu_loop(CPUOpenRISCState *env)
 #ifdef TARGET_SH4
 void cpu_loop(CPUSH4State *env)
 {
+    CPUState *cs = CPU(sh_env_get_cpu(env));
     int trapnr, ret;
     target_siginfo_t info;
 
@@ -2537,7 +2540,7 @@ void cpu_loop(CPUSH4State *env)
 
         default:
             printf ("Unhandled trap: 0x%x\n", trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             exit (1);
         }
         process_pending_signals (env);
@@ -2548,6 +2551,7 @@ void cpu_loop(CPUSH4State *env)
 #ifdef TARGET_CRIS
 void cpu_loop(CPUCRISState *env)
 {
+    CPUState *cs = CPU(cris_env_get_cpu(env));
     int trapnr, ret;
     target_siginfo_t info;
     
@@ -2595,7 +2599,7 @@ void cpu_loop(CPUCRISState *env)
             break;
         default:
             printf ("Unhandled trap: 0x%x\n", trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             exit (1);
         }
         process_pending_signals (env);
@@ -2606,6 +2610,7 @@ void cpu_loop(CPUCRISState *env)
 #ifdef TARGET_MICROBLAZE
 void cpu_loop(CPUMBState *env)
 {
+    CPUState *cs = CPU(mb_env_get_cpu(env));
     int trapnr, ret;
     target_siginfo_t info;
     
@@ -2673,7 +2678,7 @@ void cpu_loop(CPUMBState *env)
                 default:
                     printf ("Unhandled hw-exception: 0x%x\n",
                             env->sregs[SR_ESR] & ESR_EC_MASK);
-                    cpu_dump_state(env, stderr, fprintf, 0);
+                    cpu_dump_state(cs, stderr, fprintf, 0);
                     exit (1);
                     break;
             }
@@ -2694,7 +2699,7 @@ void cpu_loop(CPUMBState *env)
             break;
         default:
             printf ("Unhandled trap: 0x%x\n", trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             exit (1);
         }
         process_pending_signals (env);
@@ -2706,6 +2711,7 @@ void cpu_loop(CPUMBState *env)
 
 void cpu_loop(CPUM68KState *env)
 {
+    CPUState *cs = CPU(m68k_env_get_cpu(env));
     int trapnr;
     unsigned int n;
     target_siginfo_t info;
@@ -2787,7 +2793,7 @@ void cpu_loop(CPUM68KState *env)
         default:
             fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n",
                     trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             abort();
         }
         process_pending_signals(env);
@@ -2843,6 +2849,7 @@ static void do_store_exclusive(CPUAlphaState *env, int reg, int quad)
 
 void cpu_loop(CPUAlphaState *env)
 {
+    CPUState *cs = CPU(alpha_env_get_cpu(env));
     int trapnr;
     target_siginfo_t info;
     abi_long sysret;
@@ -3017,7 +3024,7 @@ void cpu_loop(CPUAlphaState *env)
             break;
         default:
             printf ("Unhandled trap: 0x%x\n", trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             exit (1);
         }
         process_pending_signals (env);
@@ -3028,6 +3035,7 @@ void cpu_loop(CPUAlphaState *env)
 #ifdef TARGET_S390X
 void cpu_loop(CPUS390XState *env)
 {
+    CPUState *cs = CPU(s390_env_get_cpu(env));
     int trapnr, n, sig;
     target_siginfo_t info;
     target_ulong addr;
@@ -3118,7 +3126,7 @@ void cpu_loop(CPUS390XState *env)
 
             default:
                 fprintf(stderr, "Unhandled program exception: %#x\n", n);
-                cpu_dump_state(env, stderr, fprintf, 0);
+                cpu_dump_state(cs, stderr, fprintf, 0);
                 exit(1);
             }
             break;
@@ -3135,7 +3143,7 @@ void cpu_loop(CPUS390XState *env)
 
         default:
             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
-            cpu_dump_state(env, stderr, fprintf, 0);
+            cpu_dump_state(cs, stderr, fprintf, 0);
             exit(1);
         }
         process_pending_signals (env);
diff --git a/monitor.c b/monitor.c
index 19c297d..9be515c 100644
--- a/monitor.c
+++ b/monitor.c
@@ -921,9 +921,11 @@ int monitor_get_cpu_index(void)
 
 static void do_info_registers(Monitor *mon, const QDict *qdict)
 {
+    CPUState *cpu;
     CPUArchState *env;
     env = mon_get_cpu();
-    cpu_dump_state(env, (FILE *)mon, monitor_fprintf, CPU_DUMP_FPU);
+    cpu = ENV_GET_CPU(env);
+    cpu_dump_state(cpu, (FILE *)mon, monitor_fprintf, CPU_DUMP_FPU);
 }
 
 static void do_info_jit(Monitor *mon, const QDict *qdict)
@@ -948,16 +950,15 @@ static void do_info_history(Monitor *mon, const QDict *qdict)
     }
 }
 
-#if defined(TARGET_PPC)
-/* XXX: not implemented in other targets */
 static void do_info_cpu_stats(Monitor *mon, const QDict *qdict)
 {
+    CPUState *cpu;
     CPUArchState *env;
 
     env = mon_get_cpu();
-    cpu_dump_statistics(env, (FILE *)mon, &monitor_fprintf, 0);
+    cpu = ENV_GET_CPU(env);
+    cpu_dump_statistics(cpu, (FILE *)mon, &monitor_fprintf, 0);
 }
-#endif
 
 static void do_trace_print_events(Monitor *mon, const QDict *qdict)
 {
@@ -2678,7 +2679,6 @@ static mon_cmd_t info_cmds[] = {
         .help       = "show the current VM UUID",
         .mhandler.cmd = hmp_info_uuid,
     },
-#if defined(TARGET_PPC)
     {
         .name       = "cpustats",
         .args_type  = "",
@@ -2686,7 +2686,6 @@ static mon_cmd_t info_cmds[] = {
         .help       = "show CPU statistics",
         .mhandler.cmd = do_info_cpu_stats,
     },
-#endif
 #if defined(CONFIG_SLIRP)
     {
         .name       = "usernet",
diff --git a/qom/cpu.c b/qom/cpu.c
index 8a122b0..4da6332 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -18,8 +18,8 @@
  * <http://www.gnu.org/licenses/gpl-2.0.html>
  */
 
-#include "qom/cpu.h"
 #include "qemu-common.h"
+#include "qom/cpu.h"
 #include "sysemu/kvm.h"
 #include "qemu/notify.h"
 #include "sysemu/sysemu.h"
@@ -156,6 +156,26 @@ static int cpu_common_write_elf64_note(WriteCoreDumpFunction f,
 }
 
 
+void cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                    int flags)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (cc->dump_state) {
+        cc->dump_state(cpu, f, cpu_fprintf, flags);
+    }
+}
+
+void cpu_dump_statistics(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                         int flags)
+{
+    CPUClass *cc = CPU_GET_CLASS(cpu);
+
+    if (cc->dump_statistics) {
+        cc->dump_statistics(cpu, f, cpu_fprintf, flags);
+    }
+}
+
 void cpu_reset(CPUState *cpu)
 {
     CPUClass *klass = CPU_GET_CLASS(cpu);
diff --git a/stubs/cpus.c b/stubs/cpus.c
index 37000dd..f0d56c5 100644
--- a/stubs/cpus.c
+++ b/stubs/cpus.c
@@ -1,3 +1,4 @@
+#include "qemu-common.h"
 #include "qom/cpu.h"
 
 void cpu_resume(CPUState *cpu)
diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index ee10ed6..94e4a54 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -79,5 +79,7 @@ extern const struct VMStateDescription vmstate_alpha_cpu;
 #endif
 
 void alpha_cpu_do_interrupt(CPUState *cpu);
+void alpha_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                          int flags);
 
 #endif
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 8252cea..7d7fdab 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -265,6 +265,7 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->do_interrupt = alpha_cpu_do_interrupt;
+    cc->dump_state = alpha_cpu_dump_state;
     device_class_set_vmsd(dc, &vmstate_alpha_cpu);
 }
 
diff --git a/target-alpha/helper.c b/target-alpha/helper.c
index 5741ec2..ff57dd6 100644
--- a/target-alpha/helper.c
+++ b/target-alpha/helper.c
@@ -464,8 +464,8 @@ void alpha_cpu_do_interrupt(CPUState *cs)
 #endif /* !USER_ONLY */
 }
 
-void cpu_dump_state (CPUAlphaState *env, FILE *f, fprintf_function cpu_fprintf,
-                     int flags)
+void alpha_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                          int flags)
 {
     static const char *linux_reg_names[] = {
         "v0 ", "t0 ", "t1 ", "t2 ", "t3 ", "t4 ", "t5 ", "t6 ",
@@ -473,6 +473,8 @@ void cpu_dump_state (CPUAlphaState *env, FILE *f, fprintf_function cpu_fprintf,
         "a0 ", "a1 ", "a2 ", "a3 ", "a4 ", "a5 ", "t8 ", "t9 ",
         "t10", "t11", "ra ", "t12", "at ", "gp ", "sp ", "zero",
     };
+    AlphaCPU *cpu = ALPHA_CPU(cs);
+    CPUAlphaState *env = &cpu->env;
     int i;
 
     cpu_fprintf(f, "     PC  " TARGET_FMT_lx "      PS  %02x\n",
diff --git a/target-arm/arm-semi.c b/target-arm/arm-semi.c
index f0637a4..5f01bca 100644
--- a/target-arm/arm-semi.c
+++ b/target-arm/arm-semi.c
@@ -178,6 +178,7 @@ static void arm_semi_flen_cb(CPUARMState *env, target_ulong ret, target_ulong er
 #define SET_ARG(n, val) put_user_ual(val, args + (n) * 4)
 uint32_t do_arm_semihosting(CPUARMState *env)
 {
+    ARMCPU *cpu = arm_env_get_cpu(env);
     target_ulong args;
     target_ulong arg0, arg1, arg2, arg3;
     char * s;
@@ -549,7 +550,7 @@ uint32_t do_arm_semihosting(CPUARMState *env)
         exit(0);
     default:
         fprintf(stderr, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr);
-        cpu_dump_state(env, stderr, fprintf, 0);
+        cpu_dump_state(CPU(cpu), stderr, fprintf, 0);
         abort();
     }
 }
diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 25239b8..ef6261f 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -144,4 +144,7 @@ void init_cpreg_list(ARMCPU *cpu);
 void arm_cpu_do_interrupt(CPUState *cpu);
 void arm_v7m_cpu_do_interrupt(CPUState *cpu);
 
+void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                        int flags);
+
 #endif
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 2371f48..645c961 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -816,6 +816,7 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = arm_cpu_class_by_name;
     cc->do_interrupt = arm_cpu_do_interrupt;
+    cc->dump_state = arm_cpu_dump_state;
     cpu_class_set_vmsd(cc, &vmstate_arm_cpu);
 }
 
diff --git a/target-arm/translate.c b/target-arm/translate.c
index 2a18ffe..af2aef2 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -10085,9 +10085,11 @@ static const char *cpu_mode_names[16] = {
   "???", "???", "???", "und", "???", "???", "???", "sys"
 };
 
-void cpu_dump_state(CPUARMState *env, FILE *f, fprintf_function cpu_fprintf,
-                    int flags)
+void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                        int flags)
 {
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
     int i;
     uint32_t psr;
 
diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index 03829bd..e08bdb1 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -76,4 +76,7 @@ static inline CRISCPU *cris_env_get_cpu(CPUCRISState *env)
 void cris_cpu_do_interrupt(CPUState *cpu);
 void crisv10_cpu_do_interrupt(CPUState *cpu);
 
+void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                         int flags);
+
 #endif
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 67181e5..82271f7 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -252,6 +252,7 @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = cris_cpu_class_by_name;
     cc->do_interrupt = cris_cpu_do_interrupt;
+    cc->dump_state = cris_cpu_dump_state;
 }
 
 static const TypeInfo cris_cpu_type_info = {
diff --git a/target-cris/helper.c b/target-cris/helper.c
index 466cc2f..aba7537 100644
--- a/target-cris/helper.c
+++ b/target-cris/helper.c
@@ -53,9 +53,11 @@ void crisv10_cpu_do_interrupt(CPUState *cs)
 int cpu_cris_handle_mmu_fault(CPUCRISState * env, target_ulong address, int rw,
                               int mmu_idx)
 {
+    CRISCPU *cpu = cris_env_get_cpu(env);
+
     env->exception_index = 0xaa;
     env->pregs[PR_EDA] = address;
-    cpu_dump_state(env, stderr, fprintf, 0);
+    cpu_dump_state(CPU(cpu), stderr, fprintf, 0);
     return 1;
 }
 
diff --git a/target-cris/translate.c b/target-cris/translate.c
index dbcb811..09d0d2b 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3427,9 +3427,11 @@ void gen_intermediate_code_pc (CPUCRISState *env, struct TranslationBlock *tb)
     gen_intermediate_code_internal(env, tb, 1);
 }
 
-void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf,
-                     int flags)
+void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                         int flags)
 {
+    CRISCPU *cpu = CRIS_CPU(cs);
+    CPUCRISState *env = &cpu->env;
     int i;
     uint32_t srs;
 
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index e0ac072..b7c70d6 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -101,4 +101,7 @@ int x86_cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
 void x86_cpu_get_memory_mapping(CPUState *cpu, MemoryMappingList *list,
                                 Error **errp);
 
+void x86_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                        int flags);
+
 #endif
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index a7154af..48c062f 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2526,6 +2526,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->reset = x86_cpu_reset;
 
     cc->do_interrupt = x86_cpu_do_interrupt;
+    cc->dump_state = x86_cpu_dump_state;
     cc->get_arch_id = x86_cpu_get_arch_id;
     cc->get_paging_enabled = x86_cpu_get_paging_enabled;
 #ifndef CONFIG_USER_ONLY
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 803945d..5e5abe3 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -179,10 +179,11 @@ done:
 #define DUMP_CODE_BYTES_TOTAL    50
 #define DUMP_CODE_BYTES_BACKWARD 20
 
-void cpu_dump_state(CPUX86State *env, FILE *f, fprintf_function cpu_fprintf,
-                    int flags)
+void x86_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                        int flags)
 {
-    CPUState *cs = CPU(x86_env_get_cpu(env));
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
     int eflags, i, nb;
     char cc_op_name[32];
     static const char *seg_name[6] = { "ES", "CS", "SS", "DS", "FS", "GS" };
diff --git a/target-lm32/cpu-qom.h b/target-lm32/cpu-qom.h
index 9571860..5ef884b 100644
--- a/target-lm32/cpu-qom.h
+++ b/target-lm32/cpu-qom.h
@@ -76,5 +76,7 @@ extern const struct VMStateDescription vmstate_lm32_cpu;
 #endif
 
 void lm32_cpu_do_interrupt(CPUState *cpu);
+void lm32_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                         int flags);
 
 #endif
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 23c05dd..2366152 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -85,6 +85,7 @@ static void lm32_cpu_class_init(ObjectClass *oc, void *data)
     cc->reset = lm32_cpu_reset;
 
     cc->do_interrupt = lm32_cpu_do_interrupt;
+    cc->dump_state = lm32_cpu_dump_state;
     cpu_class_set_vmsd(cc, &vmstate_lm32_cpu);
 }
 
diff --git a/target-lm32/translate.c b/target-lm32/translate.c
index af9ce8c..227a801 100644
--- a/target-lm32/translate.c
+++ b/target-lm32/translate.c
@@ -1141,9 +1141,11 @@ void gen_intermediate_code_pc(CPULM32State *env, struct TranslationBlock *tb)
     gen_intermediate_code_internal(env, tb, 1);
 }
 
-void cpu_dump_state(CPULM32State *env, FILE *f, fprintf_function cpu_fprintf,
-                     int flags)
+void lm32_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                         int flags)
 {
+    LM32CPU *cpu = LM32_CPU(cs);
+    CPULM32State *env = &cpu->env;
     int i;
 
     if (!env || !f) {
diff --git a/target-m68k/cpu-qom.h b/target-m68k/cpu-qom.h
index 846aa74..2436c13 100644
--- a/target-m68k/cpu-qom.h
+++ b/target-m68k/cpu-qom.h
@@ -71,5 +71,7 @@ static inline M68kCPU *m68k_env_get_cpu(CPUM68KState *env)
 #define ENV_OFFSET offsetof(M68kCPU, env)
 
 void m68k_cpu_do_interrupt(CPUState *cpu);
+void m68k_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                         int flags);
 
 #endif
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 3c65b4e..d501027 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -187,6 +187,7 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
 
     cc->class_by_name = m68k_cpu_class_by_name;
     cc->do_interrupt = m68k_cpu_do_interrupt;
+    cc->dump_state = m68k_cpu_dump_state;
     dc->vmsd = &vmstate_m68k_cpu;
 }
 
diff --git a/target-m68k/translate.c b/target-m68k/translate.c
index 32b8132..3752094 100644
--- a/target-m68k/translate.c
+++ b/target-m68k/translate.c
@@ -3104,9 +3104,11 @@ void gen_intermediate_code_pc(CPUM68KState *env, TranslationBlock *tb)
     gen_intermediate_code_internal(env, tb, 1);
 }
 
-void cpu_dump_state(CPUM68KState *env, FILE *f, fprintf_function cpu_fprintf,
-                    int flags)
+void m68k_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                         int flags)
 {
+    M68kCPU *cpu = M68K_CPU(cs);
+    CPUM68KState *env = &cpu->env;
     int i;
     uint16_t sr;
     CPU_DoubleU u;
diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index ce92a4e..3e9c206 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -72,5 +72,7 @@ static inline MicroBlazeCPU *mb_env_get_cpu(CPUMBState *env)
 #define ENV_OFFSET offsetof(MicroBlazeCPU, env)
 
 void mb_cpu_do_interrupt(CPUState *cs);
+void mb_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                       int flags);
 
 #endif
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 404f82c..e8104d1 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -138,6 +138,7 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     cc->reset = mb_cpu_reset;
 
     cc->do_interrupt = mb_cpu_do_interrupt;
+    cc->dump_state = mb_cpu_dump_state;
     dc->vmsd = &vmstate_mb_cpu;
 
     dc->props = mb_properties;
diff --git a/target-microblaze/helper.c b/target-microblaze/helper.c
index 0dd669d..01d4bbf 100644
--- a/target-microblaze/helper.c
+++ b/target-microblaze/helper.c
@@ -39,8 +39,10 @@ void mb_cpu_do_interrupt(CPUState *cs)
 int cpu_mb_handle_mmu_fault(CPUMBState * env, target_ulong address, int rw,
                             int mmu_idx)
 {
+    MicroBlazeCPU *cpu = mb_env_get_cpu(env);
+
     env->exception_index = 0xaa;
-    cpu_dump_state(env, stderr, fprintf, 0);
+    cpu_dump_state(CPU(cpu), stderr, fprintf, 0);
     return 1;
 }
 
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index 06d2346..54f439f 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1949,9 +1949,11 @@ void gen_intermediate_code_pc (CPUMBState *env, struct TranslationBlock *tb)
     gen_intermediate_code_internal(env, tb, 1);
 }
 
-void cpu_dump_state (CPUMBState *env, FILE *f, fprintf_function cpu_fprintf,
-                     int flags)
+void mb_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                       int flags)
 {
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+    CPUMBState *env = &cpu->env;
     int i;
 
     if (!env || !f)
diff --git a/target-mips/cpu-qom.h b/target-mips/cpu-qom.h
index 32e3cad..a7ff9e6 100644
--- a/target-mips/cpu-qom.h
+++ b/target-mips/cpu-qom.h
@@ -75,5 +75,7 @@ static inline MIPSCPU *mips_env_get_cpu(CPUMIPSState *env)
 #define ENV_OFFSET offsetof(MIPSCPU, env)
 
 void mips_cpu_do_interrupt(CPUState *cpu);
+void mips_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                         int flags);
 
 #endif
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 5315f7b..b685d39 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -80,6 +80,7 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
     cc->reset = mips_cpu_reset;
 
     cc->do_interrupt = mips_cpu_do_interrupt;
+    cc->dump_state = mips_cpu_dump_state;
 }
 
 static const TypeInfo mips_cpu_type_info = {
diff --git a/target-mips/translate.c b/target-mips/translate.c
index 0a53203..160c0c0 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -15780,9 +15780,11 @@ cpu_mips_check_sign_extensions (CPUMIPSState *env, FILE *f,
 }
 #endif
 
-void cpu_dump_state (CPUMIPSState *env, FILE *f, fprintf_function cpu_fprintf,
-                     int flags)
+void mips_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                         int flags)
 {
+    MIPSCPU *cpu = MIPS_CPU(cs);
+    CPUMIPSState *env = &cpu->env;
     int i;
 
     cpu_fprintf(f, "pc=0x" TARGET_FMT_lx " HI=0x" TARGET_FMT_lx
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index f2b0791..3c3932c 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -97,8 +97,9 @@ static void moxie_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = moxie_cpu_class_by_name;
 
-    cpu_class_set_vmsd(cc, &vmstate_moxie_cpu);
     cc->do_interrupt = moxie_cpu_do_interrupt;
+    cc->dump_state = moxie_cpu_dump_state;
+    cpu_class_set_vmsd(cc, &vmstate_moxie_cpu);
 }
 
 static void moxielite_initfn(Object *obj)
diff --git a/target-moxie/cpu.h b/target-moxie/cpu.h
index a9d9ace..374b24a 100644
--- a/target-moxie/cpu.h
+++ b/target-moxie/cpu.h
@@ -116,6 +116,8 @@ static inline MoxieCPU *moxie_env_get_cpu(CPUMoxieState *env)
 MoxieCPU *cpu_moxie_init(const char *cpu_model);
 int cpu_moxie_exec(CPUMoxieState *s);
 void moxie_cpu_do_interrupt(CPUState *cs);
+void moxie_cpu_dump_state(CPUState *cpu, FILE *f,
+                          fprintf_function cpu_fprintf, int flags);
 void moxie_translate_init(void);
 int cpu_moxie_signal_handler(int host_signum, void *pinfo,
                              void *puc);
diff --git a/target-moxie/helper.c b/target-moxie/helper.c
index 5cfe889..ea0788f 100644
--- a/target-moxie/helper.c
+++ b/target-moxie/helper.c
@@ -110,9 +110,11 @@ void moxie_cpu_do_interrupt(CPUState *env)
 int cpu_moxie_handle_mmu_fault(CPUMoxieState *env, target_ulong address,
                                int rw, int mmu_idx)
 {
+    MoxieCPU *cpu = moxie_env_get_cpu(env);
+
     env->exception_index = 0xaa;
     env->debug1 = address;
-    cpu_dump_state(env, stderr, fprintf, 0);
+    cpu_dump_state(CPU(cpu), stderr, fprintf, 0);
     return 1;
 }
 
diff --git a/target-moxie/translate.c b/target-moxie/translate.c
index cc02bd3..b0ae38a 100644
--- a/target-moxie/translate.c
+++ b/target-moxie/translate.c
@@ -74,9 +74,11 @@ static int extract_branch_offset(int opcode)
   return (((signed short)((opcode & ((1 << 10) - 1)) << 6)) >> 6) << 1;
 }
 
-void cpu_dump_state(CPUArchState *env, FILE *f, fprintf_function cpu_fprintf,
-                    int flags)
+void moxie_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                          int flags)
 {
+    MoxieCPU *cpu = MOXIE_CPU(cs);
+    CPUMoxieState *env = &cpu->env;
     int i;
     cpu_fprintf(f, "pc=0x%08x\n", env->pc);
     cpu_fprintf(f, "$fp=0x%08x $sp=0x%08x $r0=0x%08x $r1=0x%08x\n",
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index f8703a0..a401706 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -149,6 +149,7 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->do_interrupt = openrisc_cpu_do_interrupt;
+    cc->dump_state = openrisc_cpu_dump_state;
     device_class_set_vmsd(dc, &vmstate_openrisc_cpu);
 }
 
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index aee7769..80a82df 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -347,6 +347,8 @@ OpenRISCCPU *cpu_openrisc_init(const char *cpu_model);
 void cpu_openrisc_list(FILE *f, fprintf_function cpu_fprintf);
 int cpu_openrisc_exec(CPUOpenRISCState *s);
 void openrisc_cpu_do_interrupt(CPUState *cpu);
+void openrisc_cpu_dump_state(CPUState *cpu, FILE *f,
+                             fprintf_function cpu_fprintf, int flags);
 void openrisc_translate_init(void);
 int cpu_openrisc_handle_mmu_fault(CPUOpenRISCState *env,
                                   target_ulong address,
diff --git a/target-openrisc/translate.c b/target-openrisc/translate.c
index 0eafd02..c59fd02 100644
--- a/target-openrisc/translate.c
+++ b/target-openrisc/translate.c
@@ -1814,15 +1814,17 @@ void gen_intermediate_code_pc(CPUOpenRISCState *env,
     gen_intermediate_code_internal(openrisc_env_get_cpu(env), tb, 1);
 }
 
-void cpu_dump_state(CPUOpenRISCState *env, FILE *f,
-                    fprintf_function cpu_fprintf,
-                    int flags)
+void openrisc_cpu_dump_state(CPUState *cs, FILE *f,
+                             fprintf_function cpu_fprintf,
+                             int flags)
 {
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+    CPUOpenRISCState *env = &cpu->env;
     int i;
-    uint32_t *regs = env->gpr;
+
     cpu_fprintf(f, "PC=%08x\n", env->pc);
     for (i = 0; i < 32; ++i) {
-        cpu_fprintf(f, "R%02d=%08x%c", i, regs[i],
+        cpu_fprintf(f, "R%02d=%08x%c", i, env->gpr[i],
                     (i % 4) == 3 ? '\n' : ' ');
     }
 }
diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index eb03a00..84ba105 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -101,5 +101,9 @@ static inline PowerPCCPU *ppc_env_get_cpu(CPUPPCState *env)
 PowerPCCPUClass *ppc_cpu_class_by_pvr(uint32_t pvr);
 
 void ppc_cpu_do_interrupt(CPUState *cpu);
+void ppc_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                        int flags);
+void ppc_cpu_dump_statistics(CPUState *cpu, FILE *f,
+                             fprintf_function cpu_fprintf, int flags);
 
 #endif
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 076cdac..3643863 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -9526,15 +9526,17 @@ GEN_SPEOP_LDST(evstwwo, 0x1E, 2),
 
 /*****************************************************************************/
 /* Misc PowerPC helpers */
-void cpu_dump_state (CPUPPCState *env, FILE *f, fprintf_function cpu_fprintf,
-                     int flags)
+void ppc_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                        int flags)
 {
 #define RGPL  4
 #define RFPL  4
 
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    CPUPPCState *env = &cpu->env;
     int i;
 
-    cpu_synchronize_state(CPU(ppc_env_get_cpu(env)));
+    cpu_synchronize_state(cs);
 
     cpu_fprintf(f, "NIP " TARGET_FMT_lx "   LR " TARGET_FMT_lx " CTR "
                 TARGET_FMT_lx " XER " TARGET_FMT_lx "\n",
@@ -9675,14 +9677,15 @@ void cpu_dump_state (CPUPPCState *env, FILE *f, fprintf_function cpu_fprintf,
 #undef RFPL
 }
 
-void cpu_dump_statistics (CPUPPCState *env, FILE*f, fprintf_function cpu_fprintf,
-                          int flags)
+void ppc_cpu_dump_statistics(CPUState *cs, FILE*f,
+                             fprintf_function cpu_fprintf, int flags)
 {
 #if defined(DO_PPC_STATISTICS)
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
     opc_handler_t **t1, **t2, **t3, *handler;
     int op1, op2, op3;
 
-    t1 = env->opcodes;
+    t1 = cpu->env.opcodes;
     for (op1 = 0; op1 < 64; op1++) {
         handler = t1[op1];
         if (is_indirect_opcode(handler)) {
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 021a31e..0edb336 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8309,6 +8309,8 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = ppc_cpu_class_by_name;
     cc->do_interrupt = ppc_cpu_do_interrupt;
+    cc->dump_state = ppc_cpu_dump_state;
+    cc->dump_statistics = ppc_cpu_dump_statistics;
 }
 
 static const TypeInfo ppc_cpu_type_info = {
diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index 34d45c2..ec32d21 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -72,5 +72,7 @@ static inline S390CPU *s390_env_get_cpu(CPUS390XState *env)
 #define ENV_OFFSET offsetof(S390CPU, env)
 
 void s390_cpu_do_interrupt(CPUState *cpu);
+void s390_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+                         int flags);
 
 #endif
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 23fe51f..8ec2f9b 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -170,6 +170,7 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     cc->reset = s390_cpu_reset;
 
     cc->do_interrupt = s390_cpu_do_interrupt;
+    cc->dump_state = s390_cpu_dump_state;
     dc->vmsd = &vmstate_s390_cpu;
 }
 
diff --git a/target-s390x/translate.c b/target-s390x/translate.c
index f97e431..cd9880e 100644
--- a/target-s390x/translate.c
+++ b/target-s390x/translate.c
@@ -86,9 +86,11 @@ static uint64_t pc_to_link_info(DisasContext *s, uint64_t pc)
     return pc;
 }
 
-void cpu_dump_state(CPUS390XState *env, FILE *f, fprintf_function cpu_fprintf,
-                    int flags)
+void s390_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                         int flags)
 {
+    S390CPU *cpu = S390_CPU(cs);
+    CPUS390XState *env = &cpu->env;
     int i;
 
     if (env->cc_op > 3) {
diff --git a/target-sh4/cpu-qom.h b/target-sh4/cpu-qom.h
index f8c80d3..01d1637 100644
--- a/target-sh4/cpu-qom.h
+++ b/target-sh4/cpu-qom.h
@@ -84,5 +84,7 @@ static inline SuperHCPU *sh_env_get_cpu(CPUSH4State *env)
 #define ENV_OFFSET offsetof(SuperHCPU, env)
 
 void superh_cpu_do_interrupt(CPUState *cpu);
+void superh_cpu_dump_state(CPUState *cpu, FILE *f,
+                           fprintf_function cpu_fprintf, int flags);
 
 #endif
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 898aecd..a7d5213 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -274,6 +274,7 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = superh_cpu_class_by_name;
     cc->do_interrupt = superh_cpu_do_interrupt;
+    cc->dump_state = superh_cpu_dump_state;
     dc->vmsd = &vmstate_sh_cpu;
 }
 
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 14fdb8f..292c9e9 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -150,10 +150,11 @@ void sh4_translate_init(void)
     done_init = 1;
 }
 
-void cpu_dump_state(CPUSH4State * env, FILE * f,
-		    int (*cpu_fprintf) (FILE * f, const char *fmt, ...),
-		    int flags)
+void superh_cpu_dump_state(CPUState *cs, FILE *f,
+                           fprintf_function cpu_fprintf, int flags)
 {
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+    CPUSH4State *env = &cpu->env;
     int i;
     cpu_fprintf(f, "pc=0x%08x sr=0x%08x pr=0x%08x fpscr=0x%08x\n",
 		env->pc, env->sr, env->pr, env->fpscr);
diff --git a/target-sparc/cpu-qom.h b/target-sparc/cpu-qom.h
index d4fe89e..97c1ec7 100644
--- a/target-sparc/cpu-qom.h
+++ b/target-sparc/cpu-qom.h
@@ -76,5 +76,7 @@ static inline SPARCCPU *sparc_env_get_cpu(CPUSPARCState *env)
 #define ENV_OFFSET offsetof(SPARCCPU, env)
 
 void sparc_cpu_do_interrupt(CPUState *cpu);
+void sparc_cpu_dump_state(CPUState *cpu, FILE *f,
+                          fprintf_function cpu_fprintf, int flags);
 
 #endif
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 13bb7bb..72700cd 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -660,9 +660,11 @@ static void cpu_print_cc(FILE *f, fprintf_function cpu_fprintf,
 #define REGS_PER_LINE 8
 #endif
 
-void cpu_dump_state(CPUSPARCState *env, FILE *f, fprintf_function cpu_fprintf,
-                    int flags)
+void sparc_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+                          int flags)
 {
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    CPUSPARCState *env = &cpu->env;
     int i, x;
 
     cpu_fprintf(f, "pc: " TARGET_FMT_lx "  npc: " TARGET_FMT_lx "\n", env->pc,
@@ -771,6 +773,7 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
     cc->reset = sparc_cpu_reset;
 
     cc->do_interrupt = sparc_cpu_do_interrupt;
+    cc->dump_state = sparc_cpu_dump_state;
 }
 
 static const TypeInfo sparc_cpu_type_info = {
diff --git a/target-unicore32/cpu-qom.h b/target-unicore32/cpu-qom.h
index ba4dee4..7eec448 100644
--- a/target-unicore32/cpu-qom.h
+++ b/target-unicore32/cpu-qom.h
@@ -61,5 +61,7 @@ static inline UniCore32CPU *uc32_env_get_cpu(CPUUniCore32State *env)
 #define ENV_OFFSET offsetof(UniCore32CPU, env)
 
 void uc32_cpu_do_interrupt(CPUState *cpu);
+void uc32_cpu_dump_state(CPUState *cpu, FILE *f,
+                         fprintf_function cpu_fprintf, int flags);
 
 #endif
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 66a1a74..1a97e6b 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -133,6 +133,7 @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = uc32_cpu_class_by_name;
     cc->do_interrupt = uc32_cpu_do_interrupt;
+    cc->dump_state = uc32_cpu_dump_state;
     dc->vmsd = &vmstate_uc32_cpu;
 }
 
diff --git a/target-unicore32/translate.c b/target-unicore32/translate.c
index 3dc7856..e1fe4e6 100644
--- a/target-unicore32/translate.c
+++ b/target-unicore32/translate.c
@@ -2113,9 +2113,11 @@ static void cpu_dump_state_ucf64(CPUUniCore32State *env, FILE *f,
 #define cpu_dump_state_ucf64(env, file, pr, flags)      do { } while (0)
 #endif
 
-void cpu_dump_state(CPUUniCore32State *env, FILE *f,
-        fprintf_function cpu_fprintf, int flags)
+void uc32_cpu_dump_state(CPUState *cs, FILE *f,
+                         fprintf_function cpu_fprintf, int flags)
 {
+    UniCore32CPU *cpu = UNICORE32_CPU(cs);
+    CPUUniCore32State *env = &cpu->env;
     int i;
     uint32_t psr;
 
diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index af0ce28..30506cf 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -81,5 +81,7 @@ static inline XtensaCPU *xtensa_env_get_cpu(const CPUXtensaState *env)
 #define ENV_OFFSET offsetof(XtensaCPU, env)
 
 void xtensa_cpu_do_interrupt(CPUState *cpu);
+void xtensa_cpu_dump_state(CPUState *cpu, FILE *f,
+                           fprintf_function cpu_fprintf, int flags);
 
 #endif
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index 6e93dd8..b5df321 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -102,6 +102,7 @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     cc->reset = xtensa_cpu_reset;
 
     cc->do_interrupt = xtensa_cpu_do_interrupt;
+    cc->dump_state = xtensa_cpu_dump_state;
     dc->vmsd = &vmstate_xtensa_cpu;
 }
 
diff --git a/target-xtensa/op_helper.c b/target-xtensa/op_helper.c
index 1037101..4c41de0 100644
--- a/target-xtensa/op_helper.c
+++ b/target-xtensa/op_helper.c
@@ -368,7 +368,9 @@ void HELPER(wsr_lend)(CPUXtensaState *env, uint32_t v)
 
 void HELPER(dump_state)(CPUXtensaState *env)
 {
-    cpu_dump_state(env, stderr, fprintf, 0);
+    XtensaCPU *cpu = xtensa_env_get_cpu(env);
+
+    cpu_dump_state(CPU(cpu), stderr, fprintf, 0);
 }
 
 void HELPER(waiti)(CPUXtensaState *env, uint32_t pc, uint32_t intlevel)
diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
index 06d68db..dcb90a5 100644
--- a/target-xtensa/translate.c
+++ b/target-xtensa/translate.c
@@ -3014,9 +3014,11 @@ void gen_intermediate_code_pc(CPUXtensaState *env, TranslationBlock *tb)
     gen_intermediate_code_internal(env, tb, 1);
 }
 
-void cpu_dump_state(CPUXtensaState *env, FILE *f, fprintf_function cpu_fprintf,
-        int flags)
+void xtensa_cpu_dump_state(CPUState *cs, FILE *f,
+                           fprintf_function cpu_fprintf, int flags)
 {
+    XtensaCPU *cpu = XTENSA_CPU(cs);
+    CPUXtensaState *env = &cpu->env;
     int i, j;
 
     cpu_fprintf(f, "PC=%08x\n\n", env->pc);
commit 13618e058cf2d76bccc41251fa0095aae88a8249
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun May 26 23:41:00 2013 +0200

    cpus: Change qemu_kvm_init_cpu_signals() argument to CPUState
    
    CPUArchState is no longer needed.
    
    Prepares for changing qemu_kvm_cpu_thread_fn() opaque to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 7d6b166..40bf64c 100644
--- a/cpus.c
+++ b/cpus.c
@@ -568,9 +568,8 @@ static void dummy_signal(int sig)
 {
 }
 
-static void qemu_kvm_init_cpu_signals(CPUArchState *env)
+static void qemu_kvm_init_cpu_signals(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     int r;
     sigset_t set;
     struct sigaction sigact;
@@ -604,7 +603,7 @@ static void qemu_tcg_init_cpu_signals(void)
 }
 
 #else /* _WIN32 */
-static void qemu_kvm_init_cpu_signals(CPUArchState *env)
+static void qemu_kvm_init_cpu_signals(CPUState *cpu)
 {
     abort();
 }
@@ -745,7 +744,7 @@ static void *qemu_kvm_cpu_thread_fn(void *arg)
         exit(1);
     }
 
-    qemu_kvm_init_cpu_signals(env);
+    qemu_kvm_init_cpu_signals(cpu);
 
     /* signal CPU creation */
     cpu->created = true;
commit 491d6e80ea5854d75ab7c19e32a0ba01d08f6df5
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun May 26 23:38:10 2013 +0200

    kvm: Change kvm_set_signal_mask() argument to CPUState
    
    CPUArchState is no longer needed.
    
    Prepares for changing qemu_kvm_init_cpu_signals() argument to CPUState.
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 37369ae..7d6b166 100644
--- a/cpus.c
+++ b/cpus.c
@@ -570,6 +570,7 @@ static void dummy_signal(int sig)
 
 static void qemu_kvm_init_cpu_signals(CPUArchState *env)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     int r;
     sigset_t set;
     struct sigaction sigact;
@@ -581,7 +582,7 @@ static void qemu_kvm_init_cpu_signals(CPUArchState *env)
     pthread_sigmask(SIG_BLOCK, NULL, &set);
     sigdelset(&set, SIG_IPI);
     sigdelset(&set, SIGBUS);
-    r = kvm_set_signal_mask(env, &set);
+    r = kvm_set_signal_mask(cpu, &set);
     if (r) {
         fprintf(stderr, "kvm_set_signal_mask: %s\n", strerror(-r));
         exit(1);
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 06da2b3..5adb044 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -166,7 +166,7 @@ int kvm_remove_breakpoint(CPUArchState *current_env, target_ulong addr,
 void kvm_remove_all_breakpoints(CPUArchState *current_env);
 int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap);
 #ifndef _WIN32
-int kvm_set_signal_mask(CPUArchState *env, const sigset_t *sigset);
+int kvm_set_signal_mask(CPUState *cpu, const sigset_t *sigset);
 #endif
 
 int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr);
diff --git a/kvm-all.c b/kvm-all.c
index eee294b..f1031e0 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -2039,9 +2039,8 @@ void kvm_remove_all_breakpoints(CPUArchState *current_env)
 }
 #endif /* !KVM_CAP_SET_GUEST_DEBUG */
 
-int kvm_set_signal_mask(CPUArchState *env, const sigset_t *sigset)
+int kvm_set_signal_mask(CPUState *cpu, const sigset_t *sigset)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_signal_mask *sigmask;
     int r;
 
diff --git a/kvm-stub.c b/kvm-stub.c
index 128faf7..50af700 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -100,7 +100,7 @@ void kvm_remove_all_breakpoints(CPUArchState *current_env)
 }
 
 #ifndef _WIN32
-int kvm_set_signal_mask(CPUArchState *env, const sigset_t *sigset)
+int kvm_set_signal_mask(CPUState *cpu, const sigset_t *sigset)
 {
     abort();
 }
commit fd529e8f465c0d6b2d5f01c58cee4746425d2734
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun May 26 23:24:55 2013 +0200

    cpus: Change qemu_kvm_wait_io_event() argument to CPUState
    
    It no longer uses CPUArchState.
    
    Prepares for changing qemu_kvm_cpu_thread_fn() opaque to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 5863b51..37369ae 100644
--- a/cpus.c
+++ b/cpus.c
@@ -717,10 +717,8 @@ static void qemu_tcg_wait_io_event(void)
     }
 }
 
-static void qemu_kvm_wait_io_event(CPUArchState *env)
+static void qemu_kvm_wait_io_event(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     while (cpu_thread_is_idle(cpu)) {
         qemu_cond_wait(cpu->halt_cond, &qemu_global_mutex);
     }
@@ -759,7 +757,7 @@ static void *qemu_kvm_cpu_thread_fn(void *arg)
                 cpu_handle_guest_debug(env);
             }
         }
-        qemu_kvm_wait_io_event(env);
+        qemu_kvm_wait_io_event(cpu);
     }
 
     return NULL;
commit a98ae1d8f5ee09694c148b1787e02205ee908b53
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun May 26 23:21:08 2013 +0200

    cpus: Change cpu_thread_is_idle() argument to CPUState
    
    It no longer needs CPUArchState.
    
    Prepares for changing all_cpu_threads_idle() CPU loop to CPUState and
    needed for changing qemu_kvm_wait_io_event() argument to CPUState.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index cce5223..5863b51 100644
--- a/cpus.c
+++ b/cpus.c
@@ -62,10 +62,8 @@
 
 static CPUArchState *next_cpu;
 
-static bool cpu_thread_is_idle(CPUArchState *env)
+static bool cpu_thread_is_idle(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     if (cpu->stop || cpu->queued_work_first) {
         return false;
     }
@@ -84,7 +82,7 @@ static bool all_cpu_threads_idle(void)
     CPUArchState *env;
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        if (!cpu_thread_is_idle(env)) {
+        if (!cpu_thread_is_idle(ENV_GET_CPU(env))) {
             return false;
         }
     }
@@ -723,7 +721,7 @@ static void qemu_kvm_wait_io_event(CPUArchState *env)
 {
     CPUState *cpu = ENV_GET_CPU(env);
 
-    while (cpu_thread_is_idle(env)) {
+    while (cpu_thread_is_idle(cpu)) {
         qemu_cond_wait(cpu->halt_cond, &qemu_global_mutex);
     }
 
commit 60a3e17a469e444a7bc4d9a14c2ecf3bdb5ec094
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri May 17 18:26:54 2013 +0200

    cpu: Change cpu_exit() argument to CPUState
    
    It no longer depends on CPUArchState, so move it to qom/cpu.c.
    
    Prepares for changing GDBState::c_cpu to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index 353208c..cce5223 100644
--- a/cpus.c
+++ b/cpus.c
@@ -473,7 +473,7 @@ static void cpu_handle_guest_debug(CPUArchState *env)
 static void cpu_signal(int sig)
 {
     if (cpu_single_env) {
-        cpu_exit(cpu_single_env);
+        cpu_exit(ENV_GET_CPU(cpu_single_env));
     }
     exit_request = 1;
 }
@@ -1088,7 +1088,7 @@ void cpu_stop_current(void)
         CPUState *cpu_single_cpu = ENV_GET_CPU(cpu_single_env);
         cpu_single_cpu->stop = false;
         cpu_single_cpu->stopped = true;
-        cpu_exit(cpu_single_env);
+        cpu_exit(cpu_single_cpu);
         qemu_cond_signal(&qemu_pause_cond);
     }
 }
diff --git a/exec.c b/exec.c
index 0b172b4..2d02b11 100644
--- a/exec.c
+++ b/exec.c
@@ -598,14 +598,6 @@ void cpu_single_step(CPUArchState *env, int enabled)
 #endif
 }
 
-void cpu_exit(CPUArchState *env)
-{
-    CPUState *cpu = ENV_GET_CPU(env);
-
-    cpu->exit_request = 1;
-    cpu->tcg_exit_req = 1;
-}
-
 void cpu_abort(CPUArchState *env, const char *fmt, ...)
 {
     va_list ap;
diff --git a/gdbstub.c b/gdbstub.c
index 663549c..0f15c7c 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2655,7 +2655,7 @@ void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
        is still in the running state, which can cause packets to be dropped
        and state transition 'T' packets to be sent while the syscall is still
        being processed.  */
-    cpu_exit(s->c_cpu);
+    cpu_exit(ENV_GET_CPU(s->c_cpu));
 #endif
 }
 
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 5e8f143..78f92e2 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1109,7 +1109,7 @@ static void cpu_request_exit(void *opaque, int irq, int level)
     CPUX86State *env = cpu_single_env;
 
     if (env && level) {
-        cpu_exit(env);
+        cpu_exit(CPU(x86_env_get_cpu(env)));
     }
 }
 
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index 1aac93a..00c9071 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -253,7 +253,7 @@ static void cpu_request_exit(void *opaque, int irq, int level)
     CPUMIPSState *env = cpu_single_env;
 
     if (env && level) {
-        cpu_exit(env);
+        cpu_exit(CPU(mips_env_get_cpu(env)));
     }
 }
 
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 94d9570..2ad0c0b 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -102,7 +102,7 @@ static void cpu_request_exit(void *opaque, int irq, int level)
     CPUMIPSState *env = cpu_single_env;
 
     if (env && level) {
-        cpu_exit(env);
+        cpu_exit(CPU(mips_env_get_cpu(env)));
     }
 }
 
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 5033d51..8a4459d 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -773,7 +773,7 @@ static void cpu_request_exit(void *opaque, int irq, int level)
     CPUMIPSState *env = cpu_single_env;
 
     if (env && level) {
-        cpu_exit(env);
+        cpu_exit(CPU(mips_env_get_cpu(env)));
     }
 }
 
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 4fdc164..90828f2 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -420,7 +420,7 @@ static void cpu_request_exit(void *opaque, int irq, int level)
     CPUPPCState *env = cpu_single_env;
 
     if (env && level) {
-        cpu_exit(env);
+        cpu_exit(CPU(ppc_env_get_cpu(env)));
     }
 }
 
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index e9c3717..e1cc62e 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -421,8 +421,6 @@ DECLARE_TLS(CPUArchState *,cpu_single_env);
      | CPU_INTERRUPT_TGT_EXT_3   \
      | CPU_INTERRUPT_TGT_EXT_4)
 
-void cpu_exit(CPUArchState *s);
-
 /* Breakpoint/watchpoint flags */
 #define BP_MEM_READ           0x01
 #define BP_MEM_WRITE          0x02
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 3e8cc47..3494356 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -371,6 +371,14 @@ void cpu_interrupt(CPUState *cpu, int mask);
 void cpu_reset_interrupt(CPUState *cpu, int mask);
 
 /**
+ * cpu_exit:
+ * @cpu: The CPU to exit.
+ *
+ * Requests the CPU @cpu to exit execution.
+ */
+void cpu_exit(CPUState *cpu);
+
+/**
  * cpu_resume:
  * @cpu: The CPU to resume.
  *
diff --git a/linux-user/main.c b/linux-user/main.c
index 21725a4..f67a62b 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -160,7 +160,7 @@ static inline void start_exclusive(void)
         other_cpu = ENV_GET_CPU(other);
         if (other_cpu->running) {
             pending_cpus++;
-            cpu_exit(other);
+            cpu_exit(other_cpu);
         }
     }
     if (pending_cpus > 1) {
diff --git a/linux-user/signal.c b/linux-user/signal.c
index 5da8452..c4e20dc 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -524,7 +524,7 @@ static void host_signal_handler(int host_signum, siginfo_t *info,
     host_to_target_siginfo_noswap(&tinfo, info);
     if (queue_signal(thread_env, sig, &tinfo) == 1) {
         /* interrupt the virtual CPU as soon as possible */
-        cpu_exit(thread_env);
+        cpu_exit(ENV_GET_CPU(thread_env));
     }
 }
 
diff --git a/qom/cpu.c b/qom/cpu.c
index dba4a11..8a122b0 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -91,6 +91,12 @@ void cpu_reset_interrupt(CPUState *cpu, int mask)
     cpu->interrupt_request &= ~mask;
 }
 
+void cpu_exit(CPUState *cpu)
+{
+    cpu->exit_request = 1;
+    cpu->tcg_exit_req = 1;
+}
+
 int cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
                              void *opaque)
 {
commit cb446ecab714b2444a270be209e0533bcd2ee534
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed May 1 14:24:52 2013 +0200

    kvm: Change cpu_synchronize_state() argument to CPUState
    
    Change Monitor::mon_cpu to CPUState as well.
    
    Reviewed-by: liguang <lig.fnst at cn.fujitsu.com>
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpus.c b/cpus.c
index c8bc8ad..353208c 100644
--- a/cpus.c
+++ b/cpus.c
@@ -407,10 +407,10 @@ void hw_error(const char *fmt, ...)
 
 void cpu_synchronize_all_states(void)
 {
-    CPUArchState *cpu;
+    CPUArchState *env;
 
-    for (cpu = first_cpu; cpu; cpu = cpu->next_cpu) {
-        cpu_synchronize_state(cpu);
+    for (env = first_cpu; env; env = env->next_cpu) {
+        cpu_synchronize_state(ENV_GET_CPU(env));
     }
 }
 
@@ -1219,7 +1219,7 @@ CpuInfoList *qmp_query_cpus(Error **errp)
         CPUState *cpu = ENV_GET_CPU(env);
         CpuInfoList *info;
 
-        cpu_synchronize_state(env);
+        cpu_synchronize_state(cpu);
 
         info = g_malloc0(sizeof(*info));
         info->value = g_malloc0(sizeof(*info->value));
diff --git a/gdbstub.c b/gdbstub.c
index 9ffb376..663549c 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2033,7 +2033,7 @@ static void gdb_breakpoint_remove_all(void)
 
 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 {
-    cpu_synchronize_state(s->c_cpu);
+    cpu_synchronize_state(ENV_GET_CPU(s->c_cpu));
 #if defined(TARGET_I386)
     s->c_cpu->eip = pc;
 #elif defined (TARGET_PPC)
@@ -2228,7 +2228,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         }
         break;
     case 'g':
-        cpu_synchronize_state(s->g_cpu);
+        cpu_synchronize_state(ENV_GET_CPU(s->g_cpu));
         env = s->g_cpu;
         len = 0;
         for (addr = 0; addr < num_g_regs; addr++) {
@@ -2239,7 +2239,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         put_packet(s, buf);
         break;
     case 'G':
-        cpu_synchronize_state(s->g_cpu);
+        cpu_synchronize_state(ENV_GET_CPU(s->g_cpu));
         env = s->g_cpu;
         registers = mem_buf;
         len = strlen(p) / 2;
@@ -2407,7 +2407,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             env = find_cpu(thread);
             if (env != NULL) {
                 CPUState *cpu = ENV_GET_CPU(env);
-                cpu_synchronize_state(env);
+                cpu_synchronize_state(cpu);
                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
                                "CPU#%d [%s]", cpu->cpu_index,
                                cpu->halted ? "halted " : "running");
diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index 8f80425..bd0bdd8 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -129,7 +129,7 @@ static void do_inject_external_nmi(void *data)
     uint32_t lvt;
     int ret;
 
-    cpu_synchronize_state(&s->cpu->env);
+    cpu_synchronize_state(cpu);
 
     lvt = s->lvt[APIC_LVT_LINT1];
     if (!(lvt & APIC_LVT_MASKED) && ((lvt >> 8) & 7) == APIC_DM_NMI) {
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 655483b..f93629f 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -456,7 +456,7 @@ void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cs);
 
     if (evaluate_tpr_instruction(s, env, &ip, access) < 0) {
         if (s->state == VAPIC_ACTIVE) {
@@ -627,7 +627,7 @@ static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
     hwaddr rom_paddr;
     VAPICROMState *s = opaque;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(x86_env_get_cpu(env)));
 
     /*
      * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
diff --git a/hw/misc/vmport.c b/hw/misc/vmport.c
index 57b71f5..8363dfd 100644
--- a/hw/misc/vmport.c
+++ b/hw/misc/vmport.c
@@ -66,7 +66,7 @@ static uint64_t vmport_ioport_read(void *opaque, hwaddr addr,
     unsigned char command;
     uint32_t eax;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(x86_env_get_cpu(env)));
 
     eax = env->regs[R_EAX];
     if (eax != VMPORT_MAGIC)
diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index 1290d37..ea65414 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -98,7 +98,7 @@ static void spin_kick(void *data)
     hwaddr map_size = 64 * 1024 * 1024;
     hwaddr map_start;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cpu);
     stl_p(&curspin->pir, env->spr[SPR_PIR]);
     env->nip = ldq_p(&curspin->addr) & (map_size - 1);
     env->gpr[3] = ldq_p(&curspin->r3);
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 3e1db28..06da2b3 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -263,10 +263,10 @@ void kvm_cpu_synchronize_state(CPUState *cpu);
 
 /* generic hooks - to be moved/refactored once there are more users */
 
-static inline void cpu_synchronize_state(CPUArchState *env)
+static inline void cpu_synchronize_state(CPUState *cpu)
 {
     if (kvm_enabled()) {
-        kvm_cpu_synchronize_state(ENV_GET_CPU(env));
+        kvm_cpu_synchronize_state(cpu);
     }
 }
 
diff --git a/monitor.c b/monitor.c
index 70ae8f5..19c297d 100644
--- a/monitor.c
+++ b/monitor.c
@@ -191,7 +191,7 @@ struct Monitor {
     QString *outbuf;
     ReadLineState *rs;
     MonitorControl *mc;
-    CPUArchState *mon_cpu;
+    CPUState *mon_cpu;
     BlockDriverCompletionFunc *password_completion_cb;
     void *password_opaque;
     QError *error;
@@ -900,7 +900,7 @@ int monitor_set_cpu(int cpu_index)
     if (cpu == NULL) {
         return -1;
     }
-    cur_mon->mon_cpu = cpu->env_ptr;
+    cur_mon->mon_cpu = cpu;
     return 0;
 }
 
@@ -910,7 +910,7 @@ static CPUArchState *mon_get_cpu(void)
         monitor_set_cpu(0);
     }
     cpu_synchronize_state(cur_mon->mon_cpu);
-    return cur_mon->mon_cpu;
+    return cur_mon->mon_cpu->env_ptr;
 }
 
 int monitor_get_cpu_index(void)
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 158710a..803945d 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -187,7 +187,7 @@ void cpu_dump_state(CPUX86State *env, FILE *f, fprintf_function cpu_fprintf,
     char cc_op_name[32];
     static const char *seg_name[6] = { "ES", "CS", "SS", "DS", "FS", "GS" };
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cs);
 
     eflags = cpu_compute_eflags(env);
 #ifdef TARGET_X86_64
@@ -1116,7 +1116,7 @@ static void do_inject_x86_mce(void *data)
     CPUState *cpu = CPU(params->cpu);
     uint64_t *banks = cenv->mce_banks + 4 * params->bank;
 
-    cpu_synchronize_state(cenv);
+    cpu_synchronize_state(cpu);
 
     /*
      * If there is an MCE exception being processed, ignore this SRAO MCE
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 0b0adfd..39f4fbb 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -2079,7 +2079,7 @@ static int kvm_handle_debug(X86CPU *cpu,
         ret = EXCP_DEBUG;
     }
     if (ret == 0) {
-        cpu_synchronize_state(env);
+        cpu_synchronize_state(CPU(cpu));
         assert(env->exception_injected == -1);
 
         /* pass to guest */
diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
index 43ccf45..5c67ec3 100644
--- a/target-ppc/mmu-hash64.c
+++ b/target-ppc/mmu-hash64.c
@@ -78,7 +78,7 @@ void dump_slb(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
     int i;
     uint64_t slbe, slbv;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(ppc_env_get_cpu(env)));
 
     cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
     for (i = 0; i < env->slb_nr; i++) {
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 4590c6f..076cdac 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -9534,7 +9534,7 @@ void cpu_dump_state (CPUPPCState *env, FILE *f, fprintf_function cpu_fprintf,
 
     int i;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(ppc_env_get_cpu(env)));
 
     cpu_fprintf(f, "NIP " TARGET_FMT_lx "   LR " TARGET_FMT_lx " CTR "
                 TARGET_FMT_lx " XER " TARGET_FMT_lx "\n",
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 650d3a5..b524c35 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -450,7 +450,7 @@ static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,
     uint64_t code;
     int r = 0;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(cpu));
     sccb = env->regs[ipbh0 & 0xf];
     code = env->regs[(ipbh0 & 0xf0) >> 4];
 
@@ -656,16 +656,17 @@ static int s390_store_status(CPUS390XState *env, uint32_t parameter)
 
 static int s390_cpu_initial_reset(S390CPU *cpu)
 {
+    CPUState *cs = CPU(cpu);
     CPUS390XState *env = &cpu->env;
     int i;
 
     s390_del_running_cpu(cpu);
-    if (kvm_vcpu_ioctl(CPU(cpu), KVM_S390_INITIAL_RESET, NULL) < 0) {
+    if (kvm_vcpu_ioctl(cs, KVM_S390_INITIAL_RESET, NULL) < 0) {
         perror("cannot init reset vcpu");
     }
 
     /* Manually zero out all registers */
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cs);
     for (i = 0; i < 16; i++) {
         env->regs[i] = 0;
     }
@@ -685,7 +686,7 @@ static int handle_sigp(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
     S390CPU *target_cpu;
     CPUS390XState *target_env;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(cpu));
 
     /* get order code */
     order_code = run->s390_sieic.ipb >> 28;
commit dd1750d7981cf9e38985c9dfa474dcdbbe236270
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed May 1 13:45:44 2013 +0200

    kvm: Change kvm_cpu_synchronize_state() argument to CPUState
    
    It no longer relies on CPUArchState since 20d695a.
    
    Reviewed-by: liguang <lig.fnst at cn.fujitsu.com>
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index f4bd3c9..42ed7dc 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -184,7 +184,7 @@ static void rtas_start_cpu(sPAPREnvironment *spapr,
         /* This will make sure qemu state is up to date with kvm, and
          * mark it dirty so our changes get flushed back before the
          * new cpu enters */
-        kvm_cpu_synchronize_state(env);
+        kvm_cpu_synchronize_state(cs);
 
         env->msr = (1ULL << MSR_SF) | (1ULL << MSR_ME);
         env->nip = start;
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 8b19322..3e1db28 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -259,14 +259,14 @@ int kvm_check_extension(KVMState *s, unsigned int extension);
 
 uint32_t kvm_arch_get_supported_cpuid(KVMState *env, uint32_t function,
                                       uint32_t index, int reg);
-void kvm_cpu_synchronize_state(CPUArchState *env);
+void kvm_cpu_synchronize_state(CPUState *cpu);
 
 /* generic hooks - to be moved/refactored once there are more users */
 
 static inline void cpu_synchronize_state(CPUArchState *env)
 {
     if (kvm_enabled()) {
-        kvm_cpu_synchronize_state(env);
+        kvm_cpu_synchronize_state(ENV_GET_CPU(env));
     }
 }
 
diff --git a/kvm-all.c b/kvm-all.c
index e6b262f..eee294b 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1590,10 +1590,8 @@ static void do_kvm_cpu_synchronize_state(void *arg)
     }
 }
 
-void kvm_cpu_synchronize_state(CPUArchState *env)
+void kvm_cpu_synchronize_state(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     if (!cpu->kvm_vcpu_dirty) {
         run_on_cpu(cpu, do_kvm_cpu_synchronize_state, cpu);
     }
diff --git a/kvm-stub.c b/kvm-stub.c
index 22eaff0..128faf7 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -42,7 +42,7 @@ void kvm_flush_coalesced_mmio_buffer(void)
 {
 }
 
-void kvm_cpu_synchronize_state(CPUArchState *env)
+void kvm_cpu_synchronize_state(CPUState *cpu)
 {
 }
 
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 9ffb6ca..0b0adfd 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -1857,7 +1857,7 @@ int kvm_arch_process_async_events(CPUState *cs)
 
         cs->interrupt_request &= ~CPU_INTERRUPT_MCE;
 
-        kvm_cpu_synchronize_state(env);
+        kvm_cpu_synchronize_state(cs);
 
         if (env->exception_injected == EXCP08_DBLE) {
             /* this means triple fault */
@@ -1888,16 +1888,16 @@ int kvm_arch_process_async_events(CPUState *cs)
         cs->halted = 0;
     }
     if (cs->interrupt_request & CPU_INTERRUPT_INIT) {
-        kvm_cpu_synchronize_state(env);
+        kvm_cpu_synchronize_state(cs);
         do_cpu_init(cpu);
     }
     if (cs->interrupt_request & CPU_INTERRUPT_SIPI) {
-        kvm_cpu_synchronize_state(env);
+        kvm_cpu_synchronize_state(cs);
         do_cpu_sipi(cpu);
     }
     if (cs->interrupt_request & CPU_INTERRUPT_TPR) {
         cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
-        kvm_cpu_synchronize_state(env);
+        kvm_cpu_synchronize_state(cs);
         apic_handle_tpr_access_report(env->apic_state, env->eip,
                                       env->tpr_access_type);
     }
@@ -2184,7 +2184,7 @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
-    kvm_cpu_synchronize_state(env);
+    kvm_cpu_synchronize_state(cs);
     return !(env->cr[0] & CR0_PE_MASK) ||
            ((env->segs[R_CS].selector  & 3) != 3);
 }
commit c52a6b67c1d7c6fc9fb2e3ba988d7b978e1487d3
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri May 17 17:49:10 2013 +0200

    gdbstub: Simplify find_cpu()
    
    Use qemu_get_cpu() and CPUState::env_ptr.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/gdbstub.c b/gdbstub.c
index 94c78ce..9ffb376 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2071,17 +2071,13 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 
 static CPUArchState *find_cpu(uint32_t thread_id)
 {
-    CPUArchState *env;
     CPUState *cpu;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = ENV_GET_CPU(env);
-        if (cpu_index(cpu) == thread_id) {
-            return env;
-        }
+    cpu = qemu_get_cpu(thread_id);
+    if (cpu == NULL) {
+        return NULL;
     }
-
-    return NULL;
+    return cpu->env_ptr;
 }
 
 static int gdb_handle_packet(GDBState *s, const char *line_buf)
commit 8d0f2baebe57ccdb09a21da80b2994b772854ad6
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 2 15:51:06 2013 +0100

    cpu: Guard cpu_{save,load}() definitions
    
    A few targets already managed to implement cpu_save() and cpu_load()
    without defining CPU_SAVE_VERSION that causes them to be registered.
    
    Guard the prototypes with CPU_SAVE_VERSION to avoid this happening again
    until all targets are converted to VMState (or QIDL).
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/qemu-common.h b/include/qemu-common.h
index 3c91375..6010bba 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -279,8 +279,10 @@ bool tcg_enabled(void);
 void cpu_exec_init_all(void);
 
 /* CPU save/load.  */
+#ifdef CPU_SAVE_VERSION
 void cpu_save(QEMUFile *f, void *opaque);
 int cpu_load(QEMUFile *f, void *opaque, int version_id);
+#endif
 
 /* Unblock cpu */
 void qemu_cpu_kick_self(void);
commit da69721460e652072b6a3dd52b7693da21ffe237
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 2 13:59:05 2013 +0100

    target-openrisc: Register VMStateDescription for OpenRISCCPU
    
    Since commit e67db06e9f6d7e514ee2a9b9b769ecd42977f6fb (target-or32: Add
    target stubs and QOM cpu) a VMStateDescription existed, but
    CPU_SAVE_VERSION was not set, so it was never registered.
    
    Drop cpu_{save,load}() and register VMStateDescription via DeviceState.
    Use a version_id of 1 and specify minimum versions as well.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index ffe14f3..f8703a0 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -149,6 +149,7 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = openrisc_cpu_class_by_name;
     cc->do_interrupt = openrisc_cpu_do_interrupt;
+    device_class_set_vmsd(dc, &vmstate_openrisc_cpu);
 }
 
 static void cpu_register(const OpenRISCCPUInfo *info)
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index b9c55ba..aee7769 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -360,6 +360,8 @@ int cpu_openrisc_signal_handler(int host_signum, void *pinfo, void *puc);
 #define cpu_signal_handler cpu_openrisc_signal_handler
 
 #ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_openrisc_cpu;
+
 /* hw/openrisc_pic.c */
 void cpu_openrisc_pic_init(OpenRISCCPU *cpu);
 
diff --git a/target-openrisc/machine.c b/target-openrisc/machine.c
index cba9811..6f864fe 100644
--- a/target-openrisc/machine.c
+++ b/target-openrisc/machine.c
@@ -20,8 +20,11 @@
 #include "hw/hw.h"
 #include "hw/boards.h"
 
-static const VMStateDescription vmstate_cpu = {
-    .name = "cpu",
+static const VMStateDescription vmstate_env = {
+    .name = "env",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(gpr, CPUOpenRISCState, 32),
         VMSTATE_UINT32(sr, CPUOpenRISCState),
@@ -36,12 +39,14 @@ static const VMStateDescription vmstate_cpu = {
     }
 };
 
-void cpu_save(QEMUFile *f, void *opaque)
-{
-    vmstate_save_state(f, &vmstate_cpu, opaque);
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-    return vmstate_load_state(f, &vmstate_cpu, opaque, version_id);
-}
+const VMStateDescription vmstate_openrisc_cpu = {
+    .name = "cpu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_CPU(),
+        VMSTATE_STRUCT(env, OpenRISCCPU, 1, vmstate_env, CPUOpenRISCState),
+        VMSTATE_END_OF_LIST()
+    }
+};
commit fe31e7374299c0c6172ce618b29bf2fecbd881c7
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Jan 21 00:27:16 2013 +0100

    target-alpha: Register VMStateDescription for AlphaCPU
    
    Commit b758aca1f6cdb175634812b79f5560c36c902d00 (target-alpha: Enable
    the alpha-softmmu target.) introduced cpu_{save,load}() functions but
    didn't define CPU_SAVE_VERSION, so they were never registered.
    
    Drop cpu_{save,load}() and register the VMStateDescription via DeviceClass.
    This operates on the AlphaCPU object instead of CPUAlphaState.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index 32ee286..ee10ed6 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -74,6 +74,10 @@ static inline AlphaCPU *alpha_env_get_cpu(CPUAlphaState *env)
 
 #define ENV_OFFSET offsetof(AlphaCPU, env)
 
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_alpha_cpu;
+#endif
+
 void alpha_cpu_do_interrupt(CPUState *cpu);
 
 #endif
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index cad1716..8252cea 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -21,6 +21,7 @@
 
 #include "cpu.h"
 #include "qemu-common.h"
+#include "migration/vmstate.h"
 
 
 static void alpha_cpu_realizefn(DeviceState *dev, Error **errp)
@@ -264,6 +265,7 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = alpha_cpu_class_by_name;
     cc->do_interrupt = alpha_cpu_do_interrupt;
+    device_class_set_vmsd(dc, &vmstate_alpha_cpu);
 }
 
 static const TypeInfo alpha_cpu_type_info = {
diff --git a/target-alpha/machine.c b/target-alpha/machine.c
index 1c9edd1..889f2fc 100644
--- a/target-alpha/machine.c
+++ b/target-alpha/machine.c
@@ -20,7 +20,7 @@ static const VMStateInfo vmstate_fpcr = {
     .put = put_fpcr,
 };
 
-static VMStateField vmstate_cpu_fields[] = {
+static VMStateField vmstate_env_fields[] = {
     VMSTATE_UINTTL_ARRAY(ir, CPUAlphaState, 31),
     VMSTATE_UINTTL_ARRAY(fir, CPUAlphaState, 31),
     /* Save the architecture value of the fpcr, not the internally
@@ -68,20 +68,24 @@ static VMStateField vmstate_cpu_fields[] = {
     VMSTATE_END_OF_LIST()
 };
 
-static const VMStateDescription vmstate_cpu = {
-    .name = "cpu",
+static const VMStateDescription vmstate_env = {
+    .name = "env",
     .version_id = 1,
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
-    .fields = vmstate_cpu_fields,
+    .fields = vmstate_env_fields,
 };
 
-void cpu_save(QEMUFile *f, void *opaque)
-{
-    vmstate_save_state(f, &vmstate_cpu, opaque);
-}
+static VMStateField vmstate_cpu_fields[] = {
+    VMSTATE_CPU(),
+    VMSTATE_STRUCT(env, AlphaCPU, 1, vmstate_env, CPUAlphaState),
+    VMSTATE_END_OF_LIST()
+};
 
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-    return vmstate_load_state(f, &vmstate_cpu, opaque, version_id);
-}
+const VMStateDescription vmstate_alpha_cpu = {
+    .name = "cpu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = vmstate_cpu_fields,
+};
commit 1a1562f5ea3da17d45d3829e35b5f49da9ec2db5
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Jun 17 04:09:11 2013 +0200

    cpu: Introduce VMSTATE_CPU() macro for CPUState
    
    To be used to embed common CPU state into CPU subclasses.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/exec.c b/exec.c
index f99041b..0b172b4 100644
--- a/exec.c
+++ b/exec.c
@@ -330,7 +330,7 @@ static int cpu_common_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static const VMStateDescription vmstate_cpu_common = {
+const VMStateDescription vmstate_cpu_common = {
     .name = "cpu_common",
     .version_id = 1,
     .minimum_version_id = 1,
@@ -342,8 +342,7 @@ static const VMStateDescription vmstate_cpu_common = {
         VMSTATE_END_OF_LIST()
     }
 };
-#else
-#define vmstate_cpu_common vmstate_dummy
+
 #endif
 
 CPUState *qemu_get_cpu(int index)
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 397219b..3e8cc47 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -378,4 +378,18 @@ void cpu_reset_interrupt(CPUState *cpu, int mask);
  */
 void cpu_resume(CPUState *cpu);
 
+#ifdef CONFIG_SOFTMMU
+extern const struct VMStateDescription vmstate_cpu_common;
+#else
+#define vmstate_cpu_common vmstate_dummy
+#endif
+
+#define VMSTATE_CPU() {                                                     \
+    .name = "parent_obj",                                                   \
+    .size = sizeof(CPUState),                                               \
+    .vmsd = &vmstate_cpu_common,                                            \
+    .flags = VMS_STRUCT,                                                    \
+    .offset = 0,                                                            \
+}
+
 #endif
commit 19e3835cffbcae37ade8c3abcc4525895f7b528a
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jun 18 02:23:36 2013 +0200

    cpu: Introduce device_class_set_vmsd() helper
    
    It's the equivalent to cpu_class_set_vmsd(), to assign
    DeviceClass::vmsd. It wasn't needed before since only static,
    unmigratable VMStateDescriptions were assigned so far.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 55a85c1..397219b 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -239,6 +239,27 @@ static inline void cpu_class_set_vmsd(CPUClass *cc,
 #endif
 
 /**
+ * device_class_set_vmsd:
+ * @dc: Device class
+ * @value: Value to set. Unused for %CONFIG_USER_ONLY.
+ *
+ * Sets #VMStateDescription for @dc.
+ *
+ * The @value argument is intentionally discarded for the non-softmmu targets
+ * to avoid linker errors or excessive preprocessor usage. If this behavior
+ * is undesired, you should assign #DeviceClass.vmsd directly instead.
+ */
+#ifndef CONFIG_USER_ONLY
+static inline void device_class_set_vmsd(DeviceClass *dc,
+                                         const struct VMStateDescription *value)
+{
+    dc->vmsd = value;
+}
+#else
+#define device_class_set_vmsd(dc, value) ((dc)->vmsd = NULL)
+#endif
+
+/**
  * qemu_cpu_has_work:
  * @cpu: The vCPU to check.
  *
commit 76d5f0294a744fa6786683760aa33e2b7fae6d8f
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jun 18 02:22:13 2013 +0200

    cpu: Fix cpu_class_set_vmsd() documentation
    
    It's CPUClass::vmsd, not CPUState::vmsd.
    
    Reviewed-by: liguang <lig.fnst at cn.fujitsu.com>
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index a5bb515..55a85c1 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -226,7 +226,7 @@ ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model);
  *
  * The @value argument is intentionally discarded for the non-softmmu targets
  * to avoid linker errors or excessive preprocessor usage. If this behavior
- * is undesired, you should assign #CPUState.vmsd directly instead.
+ * is undesired, you should assign #CPUClass.vmsd directly instead.
  */
 #ifndef CONFIG_USER_ONLY
 static inline void cpu_class_set_vmsd(CPUClass *cc,
commit 72c6cc94daa727f41ecfc2b2ff94aa6f0e459b7f
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Jun 28 10:21:00 2013 +0200

    vpc: Implement .bdrv_has_zero_init
    
    Depending on the subformat, has_zero_init on VHD must behave like raw
    and query the underlying storage (fixed) or like other sparse formats
    that can always return 1 (dynamic, differencing).
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/vpc.c b/block/vpc.c
index 3cad52e..fe4f311 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -786,6 +786,18 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)
     return ret;
 }
 
+static int vpc_has_zero_init(BlockDriverState *bs)
+{
+    BDRVVPCState *s = bs->opaque;
+    struct vhd_footer *footer =  (struct vhd_footer *) s->footer_buf;
+
+    if (cpu_to_be32(footer->type) == VHD_FIXED) {
+        return bdrv_has_zero_init(bs->file);
+    } else {
+        return 1;
+    }
+}
+
 static void vpc_close(BlockDriverState *bs)
 {
     BDRVVPCState *s = bs->opaque;
@@ -818,16 +830,17 @@ static BlockDriver bdrv_vpc = {
     .format_name    = "vpc",
     .instance_size  = sizeof(BDRVVPCState),
 
-    .bdrv_probe     = vpc_probe,
-    .bdrv_open      = vpc_open,
-    .bdrv_close     = vpc_close,
-    .bdrv_reopen_prepare = vpc_reopen_prepare,
-    .bdrv_create    = vpc_create,
+    .bdrv_probe             = vpc_probe,
+    .bdrv_open              = vpc_open,
+    .bdrv_close             = vpc_close,
+    .bdrv_reopen_prepare    = vpc_reopen_prepare,
+    .bdrv_create            = vpc_create,
 
     .bdrv_read              = vpc_co_read,
     .bdrv_write             = vpc_co_write,
 
-    .create_options = vpc_create_options,
+    .create_options         = vpc_create_options,
+    .bdrv_has_zero_init     = vpc_has_zero_init,
 };
 
 static void bdrv_vpc_init(void)
commit 8ed610a1c983dd2ed1eed8841036af55751d115f
Author: Fam Zheng <famz at redhat.com>
Date:   Wed Jun 26 17:24:32 2013 +0800

    vmdk: remove wrong calculation of relative path
    
    When creating image with backing file, the driver tries to calculate the
    relative path from created image file to backing file, but the path
    computation is incorrect. e.g.:
    
        $ qemu-img create -f vmdk -b vmdk-data-disk.vmdk vmdk-data-snapshot1
        Formatting 'vmdk-data-snapshot1', fmt=vmdk size=10737418240
        backing_file='vmdk-data-disk.vmdk' compat6=off zeroed_grain=off
    
        $ qemu-img info vmdk-data-snapshot1
        image: vmdk-data-snapshot1
        file format: vmdk
        virtual size: 10G (10737418240 bytes)
        disk size: 12K
    ->  backing file: disk.vmdk
    
    The common part in file names, "vmdk-data-", is incorrectly forgotten by
    relative_path(). As the VMDK specification has no restriction on
    parentNameHint to be relative path, we simply remove this by using the
    backing_file option.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/vmdk.c b/block/vmdk.c
index 975e1d4..a28fb5e 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1487,45 +1487,6 @@ static int filename_decompose(const char *filename, char *path, char *prefix,
     return VMDK_OK;
 }
 
-static int relative_path(char *dest, int dest_size,
-        const char *base, const char *target)
-{
-    int i = 0;
-    int n = 0;
-    const char *p, *q;
-#ifdef _WIN32
-    const char *sep = "\\";
-#else
-    const char *sep = "/";
-#endif
-
-    if (!(dest && base && target)) {
-        return VMDK_ERROR;
-    }
-    if (path_is_absolute(target)) {
-        pstrcpy(dest, dest_size, target);
-        return VMDK_OK;
-    }
-    while (base[i] == target[i]) {
-        i++;
-    }
-    p = &base[i];
-    q = &target[i];
-    while (*p) {
-        if (*p == *sep) {
-            n++;
-        }
-        p++;
-    }
-    dest[0] = '\0';
-    for (; n; n--) {
-        pstrcat(dest, dest_size, "..");
-        pstrcat(dest, dest_size, sep);
-    }
-    pstrcat(dest, dest_size, q);
-    return VMDK_OK;
-}
-
 static int vmdk_create(const char *filename, QEMUOptionParameter *options)
 {
     int fd, idx = 0;
@@ -1625,7 +1586,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
         return -ENOTSUP;
     }
     if (backing_file) {
-        char parent_filename[PATH_MAX];
         BlockDriverState *bs = bdrv_new("");
         ret = bdrv_open(bs, backing_file, NULL, 0, NULL);
         if (ret != 0) {
@@ -1638,10 +1598,8 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
         }
         parent_cid = vmdk_read_cid(bs, 0);
         bdrv_delete(bs);
-        relative_path(parent_filename, sizeof(parent_filename),
-                      filename, backing_file);
         snprintf(parent_desc_line, sizeof(parent_desc_line),
-                "parentFileNameHint=\"%s\"", parent_filename);
+                "parentFileNameHint=\"%s\"", backing_file);
     }
 
     /* Create extents */
commit 8ab6feec2c7500faafd9a4571fb40d03dd360a64
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jun 26 09:41:57 2013 +0200

    gluster: Return bdrv_has_zero_init = 0
    
    GlusterFS volumes can be backed by block devices, in which case
    bdrv_create() doesn't make sure that the image is zeroed out. It is
    currently not possibly to detect whether a given image is backed by a
    file or a block device, and incorrectly assuming that it is zeroed
    corrupts images during qemu-img convert, so let's err on the side of
    caution and always return 0.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/gluster.c b/block/gluster.c
index 91acde2..61424bc 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -574,6 +574,12 @@ static void qemu_gluster_close(BlockDriverState *bs)
     glfs_fini(s->glfs);
 }
 
+static int qemu_gluster_has_zero_init(BlockDriverState *bs)
+{
+    /* GlusterFS volume could be backed by a block device */
+    return 0;
+}
+
 static QEMUOptionParameter qemu_gluster_create_options[] = {
     {
         .name = BLOCK_OPT_SIZE,
@@ -595,6 +601,7 @@ static BlockDriver bdrv_gluster = {
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
+    .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
     .create_options               = qemu_gluster_create_options,
 };
 
@@ -610,6 +617,7 @@ static BlockDriver bdrv_gluster_tcp = {
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
+    .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
     .create_options               = qemu_gluster_create_options,
 };
 
@@ -625,6 +633,7 @@ static BlockDriver bdrv_gluster_unix = {
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
+    .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
     .create_options               = qemu_gluster_create_options,
 };
 
@@ -640,6 +649,7 @@ static BlockDriver bdrv_gluster_rdma = {
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
+    .bdrv_has_zero_init           = qemu_gluster_has_zero_init,
     .create_options               = qemu_gluster_create_options,
 };
 
commit 0b3f21e6a99c025c829d342ee417f317fe2e03b2
Author: Richard W.M. Jones <rjones at redhat.com>
Date:   Tue Jun 25 18:15:18 2013 +0100

    block/ssh: Set bdrv_has_zero_init according to the file type.
    
    If the remote is a regular file, set it to true (ie. reads of
    uninitialized areas in a newly created file will return zeroes).
    If we can't prove that, return false (a safe default).
    
    Tested by adding a debugging print statement [not part of this commit]
    and creating a remote file and a remote block device:
    
      $ ./qemu-img create ssh://localhost/tmp/new 100M
      Formatting 'ssh://localhost/tmp/new', fmt=raw size=104857600
      filename ssh://localhost/tmp/new: has_zero_init = 1
      $ sudo lvcreate -L 1G -n tmp /dev/fedora
        Logical volume "tmp" created
      $ ./qemu-img create ssh://localhost/dev/fedora/tmp 1G
      Formatting 'ssh://localhost/dev/fedora/tmp', fmt=raw size=1073741824
      filename ssh://localhost/dev/fedora/tmp: has_zero_init = 0
    
    Cc: Kevin Wolf <kwolf at redhat.com>
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Richard W.M. Jones <rjones at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/ssh.c b/block/ssh.c
index 246a70d..d7e7bf8 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -716,6 +716,21 @@ static void ssh_close(BlockDriverState *bs)
     ssh_state_free(s);
 }
 
+static int ssh_has_zero_init(BlockDriverState *bs)
+{
+    BDRVSSHState *s = bs->opaque;
+    /* Assume false, unless we can positively prove it's true. */
+    int has_zero_init = 0;
+
+    if (s->attrs.flags & LIBSSH2_SFTP_ATTR_PERMISSIONS) {
+        if (s->attrs.permissions & LIBSSH2_SFTP_S_IFREG) {
+            has_zero_init = 1;
+        }
+    }
+
+    return has_zero_init;
+}
+
 static void restart_coroutine(void *opaque)
 {
     Coroutine *co = opaque;
@@ -1037,6 +1052,7 @@ static BlockDriver bdrv_ssh = {
     .bdrv_file_open               = ssh_file_open,
     .bdrv_create                  = ssh_create,
     .bdrv_close                   = ssh_close,
+    .bdrv_has_zero_init           = ssh_has_zero_init,
     .bdrv_co_readv                = ssh_co_readv,
     .bdrv_co_writev               = ssh_co_writev,
     .bdrv_getlength               = ssh_getlength,
commit f59fee8d509b446df24843c1145a99b740492725
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 25 15:13:43 2013 +0200

    block: Make BlockJobTypes const
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/commit.c b/block/commit.c
index 553447e..2227fc2 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -173,7 +173,7 @@ static void commit_set_speed(BlockJob *job, int64_t speed, Error **errp)
     ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
 }
 
-static BlockJobType commit_job_type = {
+static const BlockJobType commit_job_type = {
     .instance_size = sizeof(CommitBlockJob),
     .job_type      = "commit",
     .set_speed     = commit_set_speed,
diff --git a/block/mirror.c b/block/mirror.c
index 1ae724f..bed4a7e 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -524,7 +524,7 @@ static void mirror_complete(BlockJob *job, Error **errp)
     block_job_resume(job);
 }
 
-static BlockJobType mirror_job_type = {
+static const BlockJobType mirror_job_type = {
     .instance_size = sizeof(MirrorBlockJob),
     .job_type      = "mirror",
     .set_speed     = mirror_set_speed,
diff --git a/block/stream.c b/block/stream.c
index d6df06f..7fe9e48 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -198,7 +198,7 @@ static void stream_set_speed(BlockJob *job, int64_t speed, Error **errp)
     ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
 }
 
-static BlockJobType stream_job_type = {
+static const BlockJobType stream_job_type = {
     .instance_size = sizeof(StreamBlockJob),
     .job_type      = "stream",
     .set_speed     = stream_set_speed,
commit e5ca8fdd407431e281c6f303dc9f45f63a28048f
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:20 2013 +0200

    qemu-iotests: add 055 drive-backup test case
    
    Testing drive-backup is similar to image streaming and drive mirroring.
    This test case is based on 041.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/055 b/tests/qemu-iotests/055
new file mode 100755
index 0000000..887c959
--- /dev/null
+++ b/tests/qemu-iotests/055
@@ -0,0 +1,282 @@
+#!/usr/bin/env python
+#
+# Tests for drive-backup
+#
+# Copyright (C) 2013 Red Hat, Inc.
+#
+# Based on 041.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import time
+import os
+import iotests
+from iotests import qemu_img, qemu_io
+
+test_img = os.path.join(iotests.test_dir, 'test.img')
+target_img = os.path.join(iotests.test_dir, 'target.img')
+
+class TestSingleDrive(iotests.QMPTestCase):
+    image_len = 64 * 1024 * 1024 # MB
+
+    def setUp(self):
+        # Write data to the image so we can compare later
+        qemu_img('create', '-f', iotests.imgfmt, test_img, str(TestSingleDrive.image_len))
+        qemu_io('-c', 'write -P0x5d 0 64k', test_img)
+        qemu_io('-c', 'write -P0xd5 1M 32k', test_img)
+        qemu_io('-c', 'write -P0xdc 32M 124k', test_img)
+        qemu_io('-c', 'write -P0xdc 67043328 64k', test_img)
+
+        self.vm = iotests.VM().add_drive(test_img)
+        self.vm.launch()
+
+    def tearDown(self):
+        self.vm.shutdown()
+        os.remove(test_img)
+        try:
+            os.remove(target_img)
+        except OSError:
+            pass
+
+    def test_cancel(self):
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             target=target_img)
+        self.assert_qmp(result, 'return', {})
+
+        event = self.cancel_and_wait()
+        self.assert_qmp(event, 'data/type', 'backup')
+
+    def test_pause(self):
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             target=target_img)
+        self.assert_qmp(result, 'return', {})
+
+        result = self.vm.qmp('block-job-pause', device='drive0')
+        self.assert_qmp(result, 'return', {})
+
+        time.sleep(1)
+        result = self.vm.qmp('query-block-jobs')
+        offset = self.dictpath(result, 'return[0]/offset')
+
+        time.sleep(1)
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/offset', offset)
+
+        result = self.vm.qmp('block-job-resume', device='drive0')
+        self.assert_qmp(result, 'return', {})
+
+        self.wait_until_completed()
+
+        self.vm.shutdown()
+        self.assertTrue(iotests.compare_images(test_img, target_img),
+                        'target image does not match source after backup')
+
+    def test_medium_not_found(self):
+        result = self.vm.qmp('drive-backup', device='ide1-cd0',
+                             target=target_img)
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
+    def test_image_not_found(self):
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             mode='existing', target=target_img)
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
+    def test_device_not_found(self):
+        result = self.vm.qmp('drive-backup', device='nonexistent',
+                             target=target_img)
+        self.assert_qmp(result, 'error/class', 'DeviceNotFound')
+
+class TestSetSpeed(iotests.QMPTestCase):
+    image_len = 80 * 1024 * 1024 # MB
+
+    def setUp(self):
+        qemu_img('create', '-f', iotests.imgfmt, test_img, str(TestSetSpeed.image_len))
+        self.vm = iotests.VM().add_drive(test_img)
+        self.vm.launch()
+
+    def tearDown(self):
+        self.vm.shutdown()
+        os.remove(test_img)
+        os.remove(target_img)
+
+    def test_set_speed(self):
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             target=target_img)
+        self.assert_qmp(result, 'return', {})
+
+        # Default speed is 0
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/device', 'drive0')
+        self.assert_qmp(result, 'return[0]/speed', 0)
+
+        result = self.vm.qmp('block-job-set-speed', device='drive0', speed=8 * 1024 * 1024)
+        self.assert_qmp(result, 'return', {})
+
+        # Ensure the speed we set was accepted
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/device', 'drive0')
+        self.assert_qmp(result, 'return[0]/speed', 8 * 1024 * 1024)
+
+        event = self.cancel_and_wait()
+        self.assert_qmp(event, 'data/type', 'backup')
+
+        # Check setting speed in drive-backup works
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             target=target_img, speed=4*1024*1024)
+        self.assert_qmp(result, 'return', {})
+
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/device', 'drive0')
+        self.assert_qmp(result, 'return[0]/speed', 4 * 1024 * 1024)
+
+        event = self.cancel_and_wait()
+        self.assert_qmp(event, 'data/type', 'backup')
+
+    def test_set_speed_invalid(self):
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             target=target_img, speed=-1)
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             target=target_img)
+        self.assert_qmp(result, 'return', {})
+
+        result = self.vm.qmp('block-job-set-speed', device='drive0', speed=-1)
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
+        event = self.cancel_and_wait()
+        self.assert_qmp(event, 'data/type', 'backup')
+
+class TestSingleTransaction(iotests.QMPTestCase):
+    image_len = 64 * 1024 * 1024 # MB
+
+    def setUp(self):
+        qemu_img('create', '-f', iotests.imgfmt, test_img, str(TestSingleTransaction.image_len))
+        qemu_io('-c', 'write -P0x5d 0 64k', test_img)
+        qemu_io('-c', 'write -P0xd5 1M 32k', test_img)
+        qemu_io('-c', 'write -P0xdc 32M 124k', test_img)
+        qemu_io('-c', 'write -P0xdc 67043328 64k', test_img)
+
+        self.vm = iotests.VM().add_drive(test_img)
+        self.vm.launch()
+
+    def tearDown(self):
+        self.vm.shutdown()
+        os.remove(test_img)
+        try:
+            os.remove(target_img)
+        except OSError:
+            pass
+
+    def test_cancel(self):
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('transaction', actions=[{
+                'type': 'drive-backup',
+                'data': { 'device': 'drive0',
+                          'target': target_img },
+            }
+        ])
+        self.assert_qmp(result, 'return', {})
+
+        event = self.cancel_and_wait()
+        self.assert_qmp(event, 'data/type', 'backup')
+
+    def test_pause(self):
+        self.assert_no_active_block_jobs()
+
+        result = self.vm.qmp('transaction', actions=[{
+                'type': 'drive-backup',
+                'data': { 'device': 'drive0',
+                          'target': target_img },
+            }
+        ])
+        self.assert_qmp(result, 'return', {})
+
+        result = self.vm.qmp('block-job-pause', device='drive0')
+        self.assert_qmp(result, 'return', {})
+
+        time.sleep(1)
+        result = self.vm.qmp('query-block-jobs')
+        offset = self.dictpath(result, 'return[0]/offset')
+
+        time.sleep(1)
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/offset', offset)
+
+        result = self.vm.qmp('block-job-resume', device='drive0')
+        self.assert_qmp(result, 'return', {})
+
+        self.wait_until_completed()
+
+        self.vm.shutdown()
+        self.assertTrue(iotests.compare_images(test_img, target_img),
+                        'target image does not match source after backup')
+
+    def test_medium_not_found(self):
+        result = self.vm.qmp('transaction', actions=[{
+                'type': 'drive-backup',
+                'data': { 'device': 'ide1-cd0',
+                          'target': target_img },
+            }
+        ])
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
+    def test_image_not_found(self):
+        result = self.vm.qmp('transaction', actions=[{
+                'type': 'drive-backup',
+                'data': { 'device': 'drive0',
+                          'mode': 'existing',
+                          'target': target_img },
+            }
+        ])
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
+    def test_device_not_found(self):
+        result = self.vm.qmp('transaction', actions=[{
+                'type': 'drive-backup',
+                'data': { 'device': 'nonexistent',
+                          'mode': 'existing',
+                          'target': target_img },
+            }
+        ])
+        self.assert_qmp(result, 'error/class', 'DeviceNotFound')
+
+    def test_abort(self):
+        result = self.vm.qmp('transaction', actions=[{
+                'type': 'drive-backup',
+                'data': { 'device': 'nonexistent',
+                          'mode': 'existing',
+                          'target': target_img },
+            }, {
+                'type': 'Abort',
+                'data': {},
+            }
+        ])
+        self.assert_qmp(result, 'error/class', 'GenericError')
+        self.assert_no_active_block_jobs()
+
+if __name__ == '__main__':
+    iotests.main(supported_fmts=['raw', 'qcow2'])
diff --git a/tests/qemu-iotests/055.out b/tests/qemu-iotests/055.out
new file mode 100644
index 0000000..fa16b5c
--- /dev/null
+++ b/tests/qemu-iotests/055.out
@@ -0,0 +1,5 @@
+.............
+----------------------------------------------------------------------
+Ran 13 tests
+
+OK
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index f487a8f..fdc6ed1 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -61,3 +61,4 @@
 052 rw auto backing
 053 rw auto
 054 rw auto
+055 rw auto
commit 0dbe8a1b042b5eb22c6587dcc9884ebe8cedcbb6
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:19 2013 +0200

    qemu-iotests: extract wait_until_completed() into iotests.py
    
    The 'drive-mirror' tests often issue 'block-job-complete' and wait for
    the QMP completion event.  Other types of block jobs also want to wait
    for completion but they may not need to issue 'block-job-complete'.
    
    Extract wait_until_completed() from 041 and put it into iotests.py.
    Return the QMP event object so the caller can make additional
    assertions, if necessary.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index 1e923e7..6661c03 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -57,18 +57,8 @@ class ImageMirroringTestCase(iotests.QMPTestCase):
         result = self.vm.qmp('block-job-complete', device=drive)
         self.assert_qmp(result, 'return', {})
 
-        completed = False
-        while not completed:
-            for event in self.vm.get_qmp_events(wait=True):
-                if event['event'] == 'BLOCK_JOB_COMPLETED':
-                    self.assert_qmp(event, 'data/type', 'mirror')
-                    self.assert_qmp(event, 'data/device', drive)
-                    self.assert_qmp_absent(event, 'data/error')
-                    self.assert_qmp(event, 'data/offset', self.image_len)
-                    self.assert_qmp(event, 'data/len', self.image_len)
-                    completed = True
-
-        self.assert_no_active_block_jobs()
+        event = self.wait_until_completed()
+        self.assert_qmp(event, 'data/type', 'mirror')
 
 class TestSingleDrive(ImageMirroringTestCase):
     image_len = 1 * 1024 * 1024 # MB
diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
index 8a8f181..b028a89 100644
--- a/tests/qemu-iotests/iotests.py
+++ b/tests/qemu-iotests/iotests.py
@@ -208,6 +208,21 @@ class QMPTestCase(unittest.TestCase):
         self.assert_no_active_block_jobs()
         return result
 
+    def wait_until_completed(self, drive='drive0'):
+        '''Wait for a block job to finish, returning the event'''
+        completed = False
+        while not completed:
+            for event in self.vm.get_qmp_events(wait=True):
+                if event['event'] == 'BLOCK_JOB_COMPLETED':
+                    self.assert_qmp(event, 'data/device', drive)
+                    self.assert_qmp_absent(event, 'data/error')
+                    self.assert_qmp(event, 'data/offset', self.image_len)
+                    self.assert_qmp(event, 'data/len', self.image_len)
+                    completed = True
+
+        self.assert_no_active_block_jobs()
+        return event
+
 def notrun(reason):
     '''Skip this test suite'''
     # Each test in qemu-iotests has a number ("seq")
commit 78b18b78aa89c28aecbd007ae1967c978d39bfd6
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:18 2013 +0200

    blockdev: add Abort transaction
    
    The Abort action can be used to test QMP 'transaction' failure.  Add it
    as the last action to exercise the .abort() and .cleanup() code paths
    for all previous actions.
    
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 6200c0d..b3a57e0 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -963,6 +963,16 @@ static void drive_backup_abort(BlkTransactionState *common)
     }
 }
 
+static void abort_prepare(BlkTransactionState *common, Error **errp)
+{
+    error_setg(errp, "Transaction aborted using Abort action");
+}
+
+static void abort_commit(BlkTransactionState *common)
+{
+    assert(false); /* this action never succeeds */
+}
+
 static const BdrvActionOps actions[] = {
     [TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC] = {
         .instance_size = sizeof(ExternalSnapshotState),
@@ -975,6 +985,11 @@ static const BdrvActionOps actions[] = {
         .prepare = drive_backup_prepare,
         .abort = drive_backup_abort,
     },
+    [TRANSACTION_ACTION_KIND_ABORT] = {
+        .instance_size = sizeof(BlkTransactionState),
+        .prepare = abort_prepare,
+        .commit = abort_commit,
+    },
 };
 
 /*
diff --git a/qapi-schema.json b/qapi-schema.json
index 714108d..6590307 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1660,6 +1660,16 @@
             '*on-target-error': 'BlockdevOnError' } }
 
 ##
+# @Abort
+#
+# This action can be used to test transaction failure.
+#
+# Since: 1.6
+###
+{ 'type': 'Abort',
+  'data': { } }
+
+##
 # @TransactionAction
 #
 # A discriminated record of operations that can be performed with
@@ -1668,7 +1678,8 @@
 { 'union': 'TransactionAction',
   'data': {
        'blockdev-snapshot-sync': 'BlockdevSnapshot',
-       'drive-backup': 'DriveBackup'
+       'drive-backup': 'DriveBackup',
+       'abort': 'Abort'
    } }
 
 ##
commit 3037f36446eb3556c14757ac468463c3902f331b
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:17 2013 +0200

    blockdev: add DriveBackup transaction
    
    This patch adds a transactional version of the drive-backup QMP command.
    It allows atomic snapshots of multiple drives along with automatic
    cleanup if there is a failure to start one of the backup jobs.
    
    Note that QMP events are emitted for block job completion/cancellation
    and the block job will be listed by query-block-jobs.
    
    @device: the name of the device whose writes should be mirrored.
    
    @target: the target of the new image. If the file exists, or if it
             is a device, the existing file/device will be used as the new
             destination.  If it does not exist, a new file will be created.
    
    @format: #optional the format of the new destination, default is to
             probe if @mode is 'existing', else the format of the source
    
    @mode: #optional whether and how QEMU should create a new image, default is
           'absolute-paths'.
    
    @speed: #optional the maximum speed, in bytes per second
    
    @on-source-error: #optional the action to take on an error on the source,
                      default 'report'.  'stop' and 'enospc' can only be used
                      if the block device supports io-status (see BlockInfo).
    
    @on-target-error: #optional the action to take on an error on the target,
                      default 'report' (no limitations, since this applies to
                      a different block device than @device).
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 0cf8081..6200c0d 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -919,6 +919,50 @@ static void external_snapshot_abort(BlkTransactionState *common)
     }
 }
 
+typedef struct DriveBackupState {
+    BlkTransactionState common;
+    BlockDriverState *bs;
+    BlockJob *job;
+} DriveBackupState;
+
+static void drive_backup_prepare(BlkTransactionState *common, Error **errp)
+{
+    DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
+    DriveBackup *backup;
+    Error *local_err = NULL;
+
+    assert(common->action->kind == TRANSACTION_ACTION_KIND_DRIVE_BACKUP);
+    backup = common->action->drive_backup;
+
+    qmp_drive_backup(backup->device, backup->target,
+                     backup->has_format, backup->format,
+                     backup->has_mode, backup->mode,
+                     backup->has_speed, backup->speed,
+                     backup->has_on_source_error, backup->on_source_error,
+                     backup->has_on_target_error, backup->on_target_error,
+                     &local_err);
+    if (error_is_set(&local_err)) {
+        error_propagate(errp, local_err);
+        state->bs = NULL;
+        state->job = NULL;
+        return;
+    }
+
+    state->bs = bdrv_find(backup->device);
+    state->job = state->bs->job;
+}
+
+static void drive_backup_abort(BlkTransactionState *common)
+{
+    DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
+    BlockDriverState *bs = state->bs;
+
+    /* Only cancel if it's the job we started */
+    if (bs && bs->job && bs->job == state->job) {
+        block_job_cancel_sync(bs->job);
+    }
+}
+
 static const BdrvActionOps actions[] = {
     [TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC] = {
         .instance_size = sizeof(ExternalSnapshotState),
@@ -926,6 +970,11 @@ static const BdrvActionOps actions[] = {
         .commit   = external_snapshot_commit,
         .abort = external_snapshot_abort,
     },
+    [TRANSACTION_ACTION_KIND_DRIVE_BACKUP] = {
+        .instance_size = sizeof(DriveBackupState),
+        .prepare = drive_backup_prepare,
+        .abort = drive_backup_abort,
+    },
 };
 
 /*
diff --git a/qapi-schema.json b/qapi-schema.json
index 6fe7efc..714108d 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1623,6 +1623,43 @@
             '*mode': 'NewImageMode' } }
 
 ##
+# @DriveBackup
+#
+# @device: the name of the device which should be copied.
+#
+# @target: the target of the new image. If the file exists, or if it
+#          is a device, the existing file/device will be used as the new
+#          destination.  If it does not exist, a new file will be created.
+#
+# @format: #optional the format of the new destination, default is to
+#          probe if @mode is 'existing', else the format of the source
+#
+# @mode: #optional whether and how QEMU should create a new image, default is
+#        'absolute-paths'.
+#
+# @speed: #optional the maximum speed, in bytes per second
+#
+# @on-source-error: #optional the action to take on an error on the source,
+#                   default 'report'.  'stop' and 'enospc' can only be used
+#                   if the block device supports io-status (see BlockInfo).
+#
+# @on-target-error: #optional the action to take on an error on the target,
+#                   default 'report' (no limitations, since this applies to
+#                   a different block device than @device).
+#
+# Note that @on-source-error and @on-target-error only affect background I/O.
+# If an error occurs during a guest write request, the device's rerror/werror
+# actions will be used.
+#
+# Since: 1.6
+##
+{ 'type': 'DriveBackup',
+  'data': { 'device': 'str', 'target': 'str', '*format': 'str',
+            '*mode': 'NewImageMode', '*speed': 'int',
+            '*on-source-error': 'BlockdevOnError',
+            '*on-target-error': 'BlockdevOnError' } }
+
+##
 # @TransactionAction
 #
 # A discriminated record of operations that can be performed with
@@ -1630,7 +1667,8 @@
 ##
 { 'union': 'TransactionAction',
   'data': {
-       'blockdev-snapshot-sync': 'BlockdevSnapshot'
+       'blockdev-snapshot-sync': 'BlockdevSnapshot',
+       'drive-backup': 'DriveBackup'
    } }
 
 ##
commit f9ea81e82519f44071b3dd617de98f0d6d6cca0a
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:16 2013 +0200

    blockdev: allow BdrvActionOps->commit() to be NULL
    
    Some QMP 'transaction' types don't need to do anything on .commit().
    Make .commit() optional just like .abort().
    
    The "drive-backup" action will take advantage of this, it only needs to
    cancel the block job on .abort().  Other block job actions will probably
    follow the same pattern, so allow .commit() to be NULL.
    
    Suggested-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 5312e60..0cf8081 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -789,7 +789,7 @@ typedef struct BdrvActionOps {
     size_t instance_size;
     /* Prepare the work, must NOT be NULL. */
     void (*prepare)(BlkTransactionState *common, Error **errp);
-    /* Commit the changes, must NOT be NULL. */
+    /* Commit the changes, can be NULL. */
     void (*commit)(BlkTransactionState *common);
     /* Abort the changes on fail, can be NULL. */
     void (*abort)(BlkTransactionState *common);
@@ -969,7 +969,9 @@ void qmp_transaction(TransactionActionList *dev_list, Error **errp)
     }
 
     QSIMPLEQ_FOREACH(state, &snap_bdrv_states, entry) {
-        state->ops->commit(state);
+        if (state->ops->commit) {
+            state->ops->commit(state);
+        }
     }
 
     /* success */
commit ba5d6ab68f7bc55520cddd5e00bd48b041c7aecd
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:15 2013 +0200

    blockdev: rename BlkTransactionStates to singular
    
    The QMP 'transaction' command keeps a list of in-flight transactions.
    The transaction state structure is called BlkTransactionStates even
    though it only deals with a single transaction.  The only plural thing
    is the linked list of transaction states.
    
    I find it confusing to call the single structure "States".  This patch
    renames it to "State", just like BlockDriverState is singular.
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index c77b2a8..5312e60 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -780,7 +780,7 @@ void qmp_blockdev_snapshot_sync(const char *device, const char *snapshot_file,
 
 /* New and old BlockDriverState structs for group snapshots */
 
-typedef struct BlkTransactionStates BlkTransactionStates;
+typedef struct BlkTransactionState BlkTransactionState;
 
 /* Only prepare() may fail. In a single transaction, only one of commit() or
    abort() will be called, clean() will always be called if it present. */
@@ -788,13 +788,13 @@ typedef struct BdrvActionOps {
     /* Size of state struct, in bytes. */
     size_t instance_size;
     /* Prepare the work, must NOT be NULL. */
-    void (*prepare)(BlkTransactionStates *common, Error **errp);
+    void (*prepare)(BlkTransactionState *common, Error **errp);
     /* Commit the changes, must NOT be NULL. */
-    void (*commit)(BlkTransactionStates *common);
+    void (*commit)(BlkTransactionState *common);
     /* Abort the changes on fail, can be NULL. */
-    void (*abort)(BlkTransactionStates *common);
+    void (*abort)(BlkTransactionState *common);
     /* Clean up resource in the end, can be NULL. */
-    void (*clean)(BlkTransactionStates *common);
+    void (*clean)(BlkTransactionState *common);
 } BdrvActionOps;
 
 /*
@@ -802,20 +802,20 @@ typedef struct BdrvActionOps {
  * that compiler will also arrange it to the same address with parent instance.
  * Later it will be used in free().
  */
-struct BlkTransactionStates {
+struct BlkTransactionState {
     TransactionAction *action;
     const BdrvActionOps *ops;
-    QSIMPLEQ_ENTRY(BlkTransactionStates) entry;
+    QSIMPLEQ_ENTRY(BlkTransactionState) entry;
 };
 
 /* external snapshot private data */
-typedef struct ExternalSnapshotStates {
-    BlkTransactionStates common;
+typedef struct ExternalSnapshotState {
+    BlkTransactionState common;
     BlockDriverState *old_bs;
     BlockDriverState *new_bs;
-} ExternalSnapshotStates;
+} ExternalSnapshotState;
 
-static void external_snapshot_prepare(BlkTransactionStates *common,
+static void external_snapshot_prepare(BlkTransactionState *common,
                                       Error **errp)
 {
     BlockDriver *drv;
@@ -825,8 +825,8 @@ static void external_snapshot_prepare(BlkTransactionStates *common,
     const char *new_image_file;
     const char *format = "qcow2";
     enum NewImageMode mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;
-    ExternalSnapshotStates *states =
-                             DO_UPCAST(ExternalSnapshotStates, common, common);
+    ExternalSnapshotState *state =
+                             DO_UPCAST(ExternalSnapshotState, common, common);
     TransactionAction *action = common->action;
 
     /* get parameters */
@@ -848,36 +848,36 @@ static void external_snapshot_prepare(BlkTransactionStates *common,
         return;
     }
 
-    states->old_bs = bdrv_find(device);
-    if (!states->old_bs) {
+    state->old_bs = bdrv_find(device);
+    if (!state->old_bs) {
         error_set(errp, QERR_DEVICE_NOT_FOUND, device);
         return;
     }
 
-    if (!bdrv_is_inserted(states->old_bs)) {
+    if (!bdrv_is_inserted(state->old_bs)) {
         error_set(errp, QERR_DEVICE_HAS_NO_MEDIUM, device);
         return;
     }
 
-    if (bdrv_in_use(states->old_bs)) {
+    if (bdrv_in_use(state->old_bs)) {
         error_set(errp, QERR_DEVICE_IN_USE, device);
         return;
     }
 
-    if (!bdrv_is_read_only(states->old_bs)) {
-        if (bdrv_flush(states->old_bs)) {
+    if (!bdrv_is_read_only(state->old_bs)) {
+        if (bdrv_flush(state->old_bs)) {
             error_set(errp, QERR_IO_ERROR);
             return;
         }
     }
 
-    flags = states->old_bs->open_flags;
+    flags = state->old_bs->open_flags;
 
     /* create new image w/backing file */
     if (mode != NEW_IMAGE_MODE_EXISTING) {
         bdrv_img_create(new_image_file, format,
-                        states->old_bs->filename,
-                        states->old_bs->drv->format_name,
+                        state->old_bs->filename,
+                        state->old_bs->drv->format_name,
                         NULL, -1, flags, &local_err, false);
         if (error_is_set(&local_err)) {
             error_propagate(errp, local_err);
@@ -886,42 +886,42 @@ static void external_snapshot_prepare(BlkTransactionStates *common,
     }
 
     /* We will manually add the backing_hd field to the bs later */
-    states->new_bs = bdrv_new("");
+    state->new_bs = bdrv_new("");
     /* TODO Inherit bs->options or only take explicit options with an
      * extended QMP command? */
-    ret = bdrv_open(states->new_bs, new_image_file, NULL,
+    ret = bdrv_open(state->new_bs, new_image_file, NULL,
                     flags | BDRV_O_NO_BACKING, drv);
     if (ret != 0) {
         error_setg_file_open(errp, -ret, new_image_file);
     }
 }
 
-static void external_snapshot_commit(BlkTransactionStates *common)
+static void external_snapshot_commit(BlkTransactionState *common)
 {
-    ExternalSnapshotStates *states =
-                             DO_UPCAST(ExternalSnapshotStates, common, common);
+    ExternalSnapshotState *state =
+                             DO_UPCAST(ExternalSnapshotState, common, common);
 
-    /* This removes our old bs from the bdrv_states, and adds the new bs */
-    bdrv_append(states->new_bs, states->old_bs);
+    /* This removes our old bs and adds the new bs */
+    bdrv_append(state->new_bs, state->old_bs);
     /* We don't need (or want) to use the transactional
      * bdrv_reopen_multiple() across all the entries at once, because we
      * don't want to abort all of them if one of them fails the reopen */
-    bdrv_reopen(states->new_bs, states->new_bs->open_flags & ~BDRV_O_RDWR,
+    bdrv_reopen(state->new_bs, state->new_bs->open_flags & ~BDRV_O_RDWR,
                 NULL);
 }
 
-static void external_snapshot_abort(BlkTransactionStates *common)
+static void external_snapshot_abort(BlkTransactionState *common)
 {
-    ExternalSnapshotStates *states =
-                             DO_UPCAST(ExternalSnapshotStates, common, common);
-    if (states->new_bs) {
-        bdrv_delete(states->new_bs);
+    ExternalSnapshotState *state =
+                             DO_UPCAST(ExternalSnapshotState, common, common);
+    if (state->new_bs) {
+        bdrv_delete(state->new_bs);
     }
 }
 
 static const BdrvActionOps actions[] = {
     [TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC] = {
-        .instance_size = sizeof(ExternalSnapshotStates),
+        .instance_size = sizeof(ExternalSnapshotState),
         .prepare  = external_snapshot_prepare,
         .commit   = external_snapshot_commit,
         .abort = external_snapshot_abort,
@@ -936,10 +936,10 @@ static const BdrvActionOps actions[] = {
 void qmp_transaction(TransactionActionList *dev_list, Error **errp)
 {
     TransactionActionList *dev_entry = dev_list;
-    BlkTransactionStates *states, *next;
+    BlkTransactionState *state, *next;
     Error *local_err = NULL;
 
-    QSIMPLEQ_HEAD(snap_bdrv_states, BlkTransactionStates) snap_bdrv_states;
+    QSIMPLEQ_HEAD(snap_bdrv_states, BlkTransactionState) snap_bdrv_states;
     QSIMPLEQ_INIT(&snap_bdrv_states);
 
     /* drain all i/o before any snapshots */
@@ -956,20 +956,20 @@ void qmp_transaction(TransactionActionList *dev_list, Error **errp)
         assert(dev_info->kind < ARRAY_SIZE(actions));
 
         ops = &actions[dev_info->kind];
-        states = g_malloc0(ops->instance_size);
-        states->ops = ops;
-        states->action = dev_info;
-        QSIMPLEQ_INSERT_TAIL(&snap_bdrv_states, states, entry);
+        state = g_malloc0(ops->instance_size);
+        state->ops = ops;
+        state->action = dev_info;
+        QSIMPLEQ_INSERT_TAIL(&snap_bdrv_states, state, entry);
 
-        states->ops->prepare(states, &local_err);
+        state->ops->prepare(state, &local_err);
         if (error_is_set(&local_err)) {
             error_propagate(errp, local_err);
             goto delete_and_fail;
         }
     }
 
-    QSIMPLEQ_FOREACH(states, &snap_bdrv_states, entry) {
-        states->ops->commit(states);
+    QSIMPLEQ_FOREACH(state, &snap_bdrv_states, entry) {
+        state->ops->commit(state);
     }
 
     /* success */
@@ -980,17 +980,17 @@ delete_and_fail:
     * failure, and it is all-or-none; abandon each new bs, and keep using
     * the original bs for all images
     */
-    QSIMPLEQ_FOREACH(states, &snap_bdrv_states, entry) {
-        if (states->ops->abort) {
-            states->ops->abort(states);
+    QSIMPLEQ_FOREACH(state, &snap_bdrv_states, entry) {
+        if (state->ops->abort) {
+            state->ops->abort(state);
         }
     }
 exit:
-    QSIMPLEQ_FOREACH_SAFE(states, &snap_bdrv_states, entry, next) {
-        if (states->ops->clean) {
-            states->ops->clean(states);
+    QSIMPLEQ_FOREACH_SAFE(state, &snap_bdrv_states, entry, next) {
+        if (state->ops->clean) {
+            state->ops->clean(state);
         }
-        g_free(states);
+        g_free(state);
     }
 }
 
commit 99a9addf567e31244d934376060dd1d34f0f012c
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:14 2013 +0200

    block: add drive-backup QMP command
    
    @drive-backup
    
    Start a point-in-time copy of a block device to a new destination.  The
    status of ongoing drive-backup operations can be checked with
    query-block-jobs where the BlockJobInfo.type field has the value 'backup'.
    The operation can be stopped before it has completed using the
    block-job-cancel command.
    
    @device: the name of the device which should be copied.
    
    @target: the target of the new image. If the file exists, or if it
             is a device, the existing file/device will be used as the new
             destination.  If it does not exist, a new file will be created.
    
    @format: #optional the format of the new destination, default is to
             probe if @mode is 'existing', else the format of the source
    
    @mode: #optional whether and how QEMU should create a new image, default is
           'absolute-paths'.
    
    @speed: #optional the maximum speed, in bytes per second
    
    @on-source-error: #optional the action to take on an error on the source,
                      default 'report'.  'stop' and 'enospc' can only be used
                      if the block device supports io-status (see BlockInfo).
    
    @on-target-error: #optional the action to take on an error on the target,
                      default 'report' (no limitations, since this applies to
                      a different block device than @device).
    
    Note that @on-source-error and @on-target-error only affect background I/O.
    If an error occurs during a guest write request, the device's rerror/werror
    actions will be used.
    
    Returns: nothing on success
             If @device is not a valid block device, DeviceNotFound
    
    Since 1.6
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 445f6e1..c77b2a8 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1353,6 +1353,103 @@ void qmp_block_commit(const char *device,
     drive_get_ref(drive_get_by_blockdev(bs));
 }
 
+void qmp_drive_backup(const char *device, const char *target,
+                      bool has_format, const char *format,
+                      bool has_mode, enum NewImageMode mode,
+                      bool has_speed, int64_t speed,
+                      bool has_on_source_error, BlockdevOnError on_source_error,
+                      bool has_on_target_error, BlockdevOnError on_target_error,
+                      Error **errp)
+{
+    BlockDriverState *bs;
+    BlockDriverState *target_bs;
+    BlockDriver *drv = NULL;
+    Error *local_err = NULL;
+    int flags;
+    int64_t size;
+    int ret;
+
+    if (!has_speed) {
+        speed = 0;
+    }
+    if (!has_on_source_error) {
+        on_source_error = BLOCKDEV_ON_ERROR_REPORT;
+    }
+    if (!has_on_target_error) {
+        on_target_error = BLOCKDEV_ON_ERROR_REPORT;
+    }
+    if (!has_mode) {
+        mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;
+    }
+
+    bs = bdrv_find(device);
+    if (!bs) {
+        error_set(errp, QERR_DEVICE_NOT_FOUND, device);
+        return;
+    }
+
+    if (!bdrv_is_inserted(bs)) {
+        error_set(errp, QERR_DEVICE_HAS_NO_MEDIUM, device);
+        return;
+    }
+
+    if (!has_format) {
+        format = mode == NEW_IMAGE_MODE_EXISTING ? NULL : bs->drv->format_name;
+    }
+    if (format) {
+        drv = bdrv_find_format(format);
+        if (!drv) {
+            error_set(errp, QERR_INVALID_BLOCK_FORMAT, format);
+            return;
+        }
+    }
+
+    if (bdrv_in_use(bs)) {
+        error_set(errp, QERR_DEVICE_IN_USE, device);
+        return;
+    }
+
+    flags = bs->open_flags | BDRV_O_RDWR;
+
+    size = bdrv_getlength(bs);
+    if (size < 0) {
+        error_setg_errno(errp, -size, "bdrv_getlength failed");
+        return;
+    }
+
+    if (mode != NEW_IMAGE_MODE_EXISTING) {
+        assert(format && drv);
+        bdrv_img_create(target, format,
+                        NULL, NULL, NULL, size, flags, &local_err, false);
+    }
+
+    if (error_is_set(&local_err)) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    target_bs = bdrv_new("");
+    ret = bdrv_open(target_bs, target, NULL, flags, drv);
+    if (ret < 0) {
+        bdrv_delete(target_bs);
+        error_setg_file_open(errp, -ret, target);
+        return;
+    }
+
+    backup_start(bs, target_bs, speed, on_source_error, on_target_error,
+                 block_job_cb, bs, &local_err);
+    if (local_err != NULL) {
+        bdrv_delete(target_bs);
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    /* Grab a reference so hotplug does not delete the BlockDriverState from
+     * underneath us.
+     */
+    drive_get_ref(drive_get_by_blockdev(bs));
+}
+
 #define DEFAULT_MIRROR_BUF_SIZE   (10 << 20)
 
 void qmp_drive_mirror(const char *device, const char *target,
diff --git a/qapi-schema.json b/qapi-schema.json
index a30a728..6fe7efc 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1744,6 +1744,52 @@
             '*speed': 'int' } }
 
 ##
+# @drive-backup
+#
+# Start a point-in-time copy of a block device to a new destination.  The
+# status of ongoing drive-backup operations can be checked with
+# query-block-jobs where the BlockJobInfo.type field has the value 'backup'.
+# The operation can be stopped before it has completed using the
+# block-job-cancel command.
+#
+# @device: the name of the device which should be copied.
+#
+# @target: the target of the new image. If the file exists, or if it
+#          is a device, the existing file/device will be used as the new
+#          destination.  If it does not exist, a new file will be created.
+#
+# @format: #optional the format of the new destination, default is to
+#          probe if @mode is 'existing', else the format of the source
+#
+# @mode: #optional whether and how QEMU should create a new image, default is
+#        'absolute-paths'.
+#
+# @speed: #optional the maximum speed, in bytes per second
+#
+# @on-source-error: #optional the action to take on an error on the source,
+#                   default 'report'.  'stop' and 'enospc' can only be used
+#                   if the block device supports io-status (see BlockInfo).
+#
+# @on-target-error: #optional the action to take on an error on the target,
+#                   default 'report' (no limitations, since this applies to
+#                   a different block device than @device).
+#
+# Note that @on-source-error and @on-target-error only affect background I/O.
+# If an error occurs during a guest write request, the device's rerror/werror
+# actions will be used.
+#
+# Returns: nothing on success
+#          If @device is not a valid block device, DeviceNotFound
+#
+# Since 1.6
+##
+{ 'command': 'drive-backup',
+  'data': { 'device': 'str', 'target': 'str', '*format': 'str',
+            '*mode': 'NewImageMode', '*speed': 'int',
+            '*on-source-error': 'BlockdevOnError',
+            '*on-target-error': 'BlockdevOnError' } }
+
+##
 # @drive-mirror
 #
 # Start mirroring a block device's writes to a new destination.
diff --git a/qmp-commands.hx b/qmp-commands.hx
index 8cea5e5..362f0e1 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -912,6 +912,52 @@ EQMP
     },
 
     {
+        .name       = "drive-backup",
+        .args_type  = "device:B,target:s,speed:i?,mode:s?,format:s?,"
+                      "on-source-error:s?,on-target-error:s?",
+        .mhandler.cmd_new = qmp_marshal_input_drive_backup,
+    },
+
+SQMP
+drive-backup
+------------
+
+Start a point-in-time copy of a block device to a new destination.  The
+status of ongoing drive-backup operations can be checked with
+query-block-jobs where the BlockJobInfo.type field has the value 'backup'.
+The operation can be stopped before it has completed using the
+block-job-cancel command.
+
+Arguments:
+
+- "device": the name of the device which should be copied.
+            (json-string)
+- "target": the target of the new image. If the file exists, or if it is a
+            device, the existing file/device will be used as the new
+            destination.  If it does not exist, a new file will be created.
+            (json-string)
+- "format": the format of the new destination, default is to probe if 'mode' is
+            'existing', else the format of the source
+            (json-string, optional)
+- "mode": whether and how QEMU should create a new image
+          (NewImageMode, optional, default 'absolute-paths')
+- "speed": the maximum speed, in bytes per second (json-int, optional)
+- "on-source-error": the action to take on an error on the source, default
+                     'report'.  'stop' and 'enospc' can only be used
+                     if the block device supports io-status.
+                     (BlockdevOnError, optional)
+- "on-target-error": the action to take on an error on the target, default
+                     'report' (no limitations, since this applies to
+                     a different block device than device).
+                     (BlockdevOnError, optional)
+
+Example:
+-> { "execute": "drive-backup", "arguments": { "device": "drive0",
+                                               "target": "backup.img" } }
+<- { "return": {} }
+EQMP
+
+    {
         .name       = "block-job-set-speed",
         .args_type  = "device:B,speed:o",
         .mhandler.cmd_new = qmp_marshal_input_block_job_set_speed,
commit ac3c5d831aa0ff796659300e186be1a35862dbd3
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:13 2013 +0200

    blockdev: use bdrv_getlength() in qmp_drive_mirror()
    
    Use bdrv_getlength() for its byte units and error return instead of
    bdrv_get_geometry().
    
    Reported-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index c17b525..445f6e1 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1371,7 +1371,7 @@ void qmp_drive_mirror(const char *device, const char *target,
     BlockDriver *drv = NULL;
     Error *local_err = NULL;
     int flags;
-    uint64_t size;
+    int64_t size;
     int ret;
 
     if (!has_speed) {
@@ -1435,8 +1435,12 @@ void qmp_drive_mirror(const char *device, const char *target,
         sync = MIRROR_SYNC_MODE_FULL;
     }
 
-    bdrv_get_geometry(bs, &size);
-    size *= 512;
+    size = bdrv_getlength(bs);
+    if (size < 0) {
+        error_setg_errno(errp, -size, "bdrv_getlength failed");
+        return;
+    }
+
     if (sync == MIRROR_SYNC_MODE_FULL && mode != NEW_IMAGE_MODE_EXISTING) {
         /* create new image w/o backing file */
         assert(format && drv);
commit cb78466ef60ccf707a6f38a1294c435b65a828e0
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:12 2013 +0200

    blockdev: drop redundant proto_drv check
    
    It is not necessary to check that we can find a protocol block driver
    since we create or open the image file.  This produces the error that we
    need anyway.
    
    Besides, the QERR_INVALID_BLOCK_FORMAT is inappropriate since the
    protocol is incorrect rather than the format.
    
    Also drop an empty line between bdrv_open() and checking its return
    value.  This may be due to copy-pasting from earlier code that performed
    other operations before handling errors.
    
    Reported-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Wenchao Xia <xiawenc at linux.vnet.ibm.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 459a87e..c17b525 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -818,7 +818,6 @@ typedef struct ExternalSnapshotStates {
 static void external_snapshot_prepare(BlkTransactionStates *common,
                                       Error **errp)
 {
-    BlockDriver *proto_drv;
     BlockDriver *drv;
     int flags, ret;
     Error *local_err = NULL;
@@ -874,12 +873,6 @@ static void external_snapshot_prepare(BlkTransactionStates *common,
 
     flags = states->old_bs->open_flags;
 
-    proto_drv = bdrv_find_protocol(new_image_file);
-    if (!proto_drv) {
-        error_set(errp, QERR_INVALID_BLOCK_FORMAT, format);
-        return;
-    }
-
     /* create new image w/backing file */
     if (mode != NEW_IMAGE_MODE_EXISTING) {
         bdrv_img_create(new_image_file, format,
@@ -1375,7 +1368,6 @@ void qmp_drive_mirror(const char *device, const char *target,
 {
     BlockDriverState *bs;
     BlockDriverState *source, *target_bs;
-    BlockDriver *proto_drv;
     BlockDriver *drv = NULL;
     Error *local_err = NULL;
     int flags;
@@ -1443,12 +1435,6 @@ void qmp_drive_mirror(const char *device, const char *target,
         sync = MIRROR_SYNC_MODE_FULL;
     }
 
-    proto_drv = bdrv_find_protocol(target);
-    if (!proto_drv) {
-        error_set(errp, QERR_INVALID_BLOCK_FORMAT, format);
-        return;
-    }
-
     bdrv_get_geometry(bs, &size);
     size *= 512;
     if (sync == MIRROR_SYNC_MODE_FULL && mode != NEW_IMAGE_MODE_EXISTING) {
@@ -1483,7 +1469,6 @@ void qmp_drive_mirror(const char *device, const char *target,
      */
     target_bs = bdrv_new("");
     ret = bdrv_open(target_bs, target, NULL, flags | BDRV_O_NO_BACKING, drv);
-
     if (ret < 0) {
         bdrv_delete(target_bs);
         error_setg_file_open(errp, -ret, target);
commit 98d2c6f2cd80afaa2dc10091f5e35a97c181e4f5
Author: Dietmar Maurer <dietmar at proxmox.com>
Date:   Mon Jun 24 17:13:11 2013 +0200

    block: add basic backup support to block driver
    
    backup_start() creates a block job that copies a point-in-time snapshot
    of a block device to a target block device.
    
    We call backup_do_cow() for each write during backup. That function
    reads the original data from the block device before it gets
    overwritten.  The data is then written to the target device.
    
    Currently backup cluster size is hardcoded to 65536 bytes.
    
    [I made a number of changes to Dietmar's original patch and folded them
    in to make code review easy.  Here is the full list:
    
     * Drop BackupDumpFunc interface in favor of a target block device
     * Detect zero clusters with buffer_is_zero() and use bdrv_co_write_zeroes()
     * Use 0 delay instead of 1us, like other block jobs
     * Unify creation/start functions into backup_start()
     * Simplify cleanup, free bitmap in backup_run() instead of cb
     * function
     * Use HBitmap to avoid duplicating bitmap code
     * Use bdrv_getlength() instead of accessing ->total_sectors
     * directly
     * Delete the backup.h header file, it is no longer necessary
     * Move ./backup.c to block/backup.c
     * Remove #ifdefed out code
     * Coding style and whitespace cleanups
     * Use bdrv_add_before_write_notifier() instead of blockjob-specific hooks
     * Keep our own in-flight CowRequest list instead of using block.c
       tracked requests.  This means a little code duplication but is much
       simpler than trying to share the tracked requests list and use the
       backup block size.
     * Add on_source_error and on_target_error error handling.
     * Use trace events instead of DPRINTF()
    
    -- stefanha]
    
    Signed-off-by: Dietmar Maurer <dietmar at proxmox.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/Makefile.objs b/block/Makefile.objs
index 2981654..4cf9aa4 100644
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -21,5 +21,6 @@ endif
 common-obj-y += stream.o
 common-obj-y += commit.o
 common-obj-y += mirror.o
+common-obj-y += backup.o
 
 $(obj)/curl.o: QEMU_CFLAGS+=$(CURL_CFLAGS)
diff --git a/block/backup.c b/block/backup.c
new file mode 100644
index 0000000..16105d4
--- /dev/null
+++ b/block/backup.c
@@ -0,0 +1,341 @@
+/*
+ * QEMU backup
+ *
+ * Copyright (C) 2013 Proxmox Server Solutions
+ *
+ * Authors:
+ *  Dietmar Maurer (dietmar at proxmox.com)
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+
+#include "trace.h"
+#include "block/block.h"
+#include "block/block_int.h"
+#include "block/blockjob.h"
+#include "qemu/ratelimit.h"
+
+#define BACKUP_CLUSTER_BITS 16
+#define BACKUP_CLUSTER_SIZE (1 << BACKUP_CLUSTER_BITS)
+#define BACKUP_SECTORS_PER_CLUSTER (BACKUP_CLUSTER_SIZE / BDRV_SECTOR_SIZE)
+
+#define SLICE_TIME 100000000ULL /* ns */
+
+typedef struct CowRequest {
+    int64_t start;
+    int64_t end;
+    QLIST_ENTRY(CowRequest) list;
+    CoQueue wait_queue; /* coroutines blocked on this request */
+} CowRequest;
+
+typedef struct BackupBlockJob {
+    BlockJob common;
+    BlockDriverState *target;
+    RateLimit limit;
+    BlockdevOnError on_source_error;
+    BlockdevOnError on_target_error;
+    CoRwlock flush_rwlock;
+    uint64_t sectors_read;
+    HBitmap *bitmap;
+    QLIST_HEAD(, CowRequest) inflight_reqs;
+} BackupBlockJob;
+
+/* See if in-flight requests overlap and wait for them to complete */
+static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,
+                                                       int64_t start,
+                                                       int64_t end)
+{
+    CowRequest *req;
+    bool retry;
+
+    do {
+        retry = false;
+        QLIST_FOREACH(req, &job->inflight_reqs, list) {
+            if (end > req->start && start < req->end) {
+                qemu_co_queue_wait(&req->wait_queue);
+                retry = true;
+                break;
+            }
+        }
+    } while (retry);
+}
+
+/* Keep track of an in-flight request */
+static void cow_request_begin(CowRequest *req, BackupBlockJob *job,
+                                     int64_t start, int64_t end)
+{
+    req->start = start;
+    req->end = end;
+    qemu_co_queue_init(&req->wait_queue);
+    QLIST_INSERT_HEAD(&job->inflight_reqs, req, list);
+}
+
+/* Forget about a completed request */
+static void cow_request_end(CowRequest *req)
+{
+    QLIST_REMOVE(req, list);
+    qemu_co_queue_restart_all(&req->wait_queue);
+}
+
+static int coroutine_fn backup_do_cow(BlockDriverState *bs,
+                                      int64_t sector_num, int nb_sectors,
+                                      bool *error_is_read)
+{
+    BackupBlockJob *job = (BackupBlockJob *)bs->job;
+    CowRequest cow_request;
+    struct iovec iov;
+    QEMUIOVector bounce_qiov;
+    void *bounce_buffer = NULL;
+    int ret = 0;
+    int64_t start, end;
+    int n;
+
+    qemu_co_rwlock_rdlock(&job->flush_rwlock);
+
+    start = sector_num / BACKUP_SECTORS_PER_CLUSTER;
+    end = DIV_ROUND_UP(sector_num + nb_sectors, BACKUP_SECTORS_PER_CLUSTER);
+
+    trace_backup_do_cow_enter(job, start, sector_num, nb_sectors);
+
+    wait_for_overlapping_requests(job, start, end);
+    cow_request_begin(&cow_request, job, start, end);
+
+    for (; start < end; start++) {
+        if (hbitmap_get(job->bitmap, start)) {
+            trace_backup_do_cow_skip(job, start);
+            continue; /* already copied */
+        }
+
+        trace_backup_do_cow_process(job, start);
+
+        n = MIN(BACKUP_SECTORS_PER_CLUSTER,
+                job->common.len / BDRV_SECTOR_SIZE -
+                start * BACKUP_SECTORS_PER_CLUSTER);
+
+        if (!bounce_buffer) {
+            bounce_buffer = qemu_blockalign(bs, BACKUP_CLUSTER_SIZE);
+        }
+        iov.iov_base = bounce_buffer;
+        iov.iov_len = n * BDRV_SECTOR_SIZE;
+        qemu_iovec_init_external(&bounce_qiov, &iov, 1);
+
+        ret = bdrv_co_readv(bs, start * BACKUP_SECTORS_PER_CLUSTER, n,
+                            &bounce_qiov);
+        if (ret < 0) {
+            trace_backup_do_cow_read_fail(job, start, ret);
+            if (error_is_read) {
+                *error_is_read = true;
+            }
+            goto out;
+        }
+
+        if (buffer_is_zero(iov.iov_base, iov.iov_len)) {
+            ret = bdrv_co_write_zeroes(job->target,
+                                       start * BACKUP_SECTORS_PER_CLUSTER, n);
+        } else {
+            ret = bdrv_co_writev(job->target,
+                                 start * BACKUP_SECTORS_PER_CLUSTER, n,
+                                 &bounce_qiov);
+        }
+        if (ret < 0) {
+            trace_backup_do_cow_write_fail(job, start, ret);
+            if (error_is_read) {
+                *error_is_read = false;
+            }
+            goto out;
+        }
+
+        hbitmap_set(job->bitmap, start, 1);
+
+        /* Publish progress, guest I/O counts as progress too.  Note that the
+         * offset field is an opaque progress value, it is not a disk offset.
+         */
+        job->sectors_read += n;
+        job->common.offset += n * BDRV_SECTOR_SIZE;
+    }
+
+out:
+    if (bounce_buffer) {
+        qemu_vfree(bounce_buffer);
+    }
+
+    cow_request_end(&cow_request);
+
+    trace_backup_do_cow_return(job, sector_num, nb_sectors, ret);
+
+    qemu_co_rwlock_unlock(&job->flush_rwlock);
+
+    return ret;
+}
+
+static int coroutine_fn backup_before_write_notify(
+        NotifierWithReturn *notifier,
+        void *opaque)
+{
+    BdrvTrackedRequest *req = opaque;
+
+    return backup_do_cow(req->bs, req->sector_num, req->nb_sectors, NULL);
+}
+
+static void backup_set_speed(BlockJob *job, int64_t speed, Error **errp)
+{
+    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
+
+    if (speed < 0) {
+        error_set(errp, QERR_INVALID_PARAMETER, "speed");
+        return;
+    }
+    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
+}
+
+static void backup_iostatus_reset(BlockJob *job)
+{
+    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
+
+    bdrv_iostatus_reset(s->target);
+}
+
+static const BlockJobType backup_job_type = {
+    .instance_size  = sizeof(BackupBlockJob),
+    .job_type       = "backup",
+    .set_speed      = backup_set_speed,
+    .iostatus_reset = backup_iostatus_reset,
+};
+
+static BlockErrorAction backup_error_action(BackupBlockJob *job,
+                                            bool read, int error)
+{
+    if (read) {
+        return block_job_error_action(&job->common, job->common.bs,
+                                      job->on_source_error, true, error);
+    } else {
+        return block_job_error_action(&job->common, job->target,
+                                      job->on_target_error, false, error);
+    }
+}
+
+static void coroutine_fn backup_run(void *opaque)
+{
+    BackupBlockJob *job = opaque;
+    BlockDriverState *bs = job->common.bs;
+    BlockDriverState *target = job->target;
+    BlockdevOnError on_target_error = job->on_target_error;
+    NotifierWithReturn before_write = {
+        .notify = backup_before_write_notify,
+    };
+    int64_t start, end;
+    int ret = 0;
+
+    QLIST_INIT(&job->inflight_reqs);
+    qemu_co_rwlock_init(&job->flush_rwlock);
+
+    start = 0;
+    end = DIV_ROUND_UP(job->common.len / BDRV_SECTOR_SIZE,
+                       BACKUP_SECTORS_PER_CLUSTER);
+
+    job->bitmap = hbitmap_alloc(end, 0);
+
+    bdrv_set_enable_write_cache(target, true);
+    bdrv_set_on_error(target, on_target_error, on_target_error);
+    bdrv_iostatus_enable(target);
+
+    bdrv_add_before_write_notifier(bs, &before_write);
+
+    for (; start < end; start++) {
+        bool error_is_read;
+
+        if (block_job_is_cancelled(&job->common)) {
+            break;
+        }
+
+        /* we need to yield so that qemu_aio_flush() returns.
+         * (without, VM does not reboot)
+         */
+        if (job->common.speed) {
+            uint64_t delay_ns = ratelimit_calculate_delay(
+                &job->limit, job->sectors_read);
+            job->sectors_read = 0;
+            block_job_sleep_ns(&job->common, rt_clock, delay_ns);
+        } else {
+            block_job_sleep_ns(&job->common, rt_clock, 0);
+        }
+
+        if (block_job_is_cancelled(&job->common)) {
+            break;
+        }
+
+        ret = backup_do_cow(bs, start * BACKUP_SECTORS_PER_CLUSTER,
+                            BACKUP_SECTORS_PER_CLUSTER, &error_is_read);
+        if (ret < 0) {
+            /* Depending on error action, fail now or retry cluster */
+            BlockErrorAction action =
+                backup_error_action(job, error_is_read, -ret);
+            if (action == BDRV_ACTION_REPORT) {
+                break;
+            } else {
+                start--;
+                continue;
+            }
+        }
+    }
+
+    notifier_with_return_remove(&before_write);
+
+    /* wait until pending backup_do_cow() calls have completed */
+    qemu_co_rwlock_wrlock(&job->flush_rwlock);
+    qemu_co_rwlock_unlock(&job->flush_rwlock);
+
+    hbitmap_free(job->bitmap);
+
+    bdrv_iostatus_disable(target);
+    bdrv_delete(target);
+
+    block_job_completed(&job->common, ret);
+}
+
+void backup_start(BlockDriverState *bs, BlockDriverState *target,
+                  int64_t speed,
+                  BlockdevOnError on_source_error,
+                  BlockdevOnError on_target_error,
+                  BlockDriverCompletionFunc *cb, void *opaque,
+                  Error **errp)
+{
+    int64_t len;
+
+    assert(bs);
+    assert(target);
+    assert(cb);
+
+    if ((on_source_error == BLOCKDEV_ON_ERROR_STOP ||
+         on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
+        !bdrv_iostatus_is_enabled(bs)) {
+        error_set(errp, QERR_INVALID_PARAMETER, "on-source-error");
+        return;
+    }
+
+    len = bdrv_getlength(bs);
+    if (len < 0) {
+        error_setg_errno(errp, -len, "unable to get length for '%s'",
+                         bdrv_get_device_name(bs));
+        return;
+    }
+
+    BackupBlockJob *job = block_job_create(&backup_job_type, bs, speed,
+                                           cb, opaque, errp);
+    if (!job) {
+        return;
+    }
+
+    job->on_source_error = on_source_error;
+    job->on_target_error = on_target_error;
+    job->target = target;
+    job->common.len = len;
+    job->common.co = qemu_coroutine_create(backup_run);
+    qemu_coroutine_enter(job->common.co, job);
+}
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 2d00955..c6ac871 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -399,4 +399,23 @@ void mirror_start(BlockDriverState *bs, BlockDriverState *target,
                   BlockDriverCompletionFunc *cb,
                   void *opaque, Error **errp);
 
+/*
+ * backup_start:
+ * @bs: Block device to operate on.
+ * @target: Block device to write to.
+ * @speed: The maximum speed, in bytes per second, or 0 for unlimited.
+ * @on_source_error: The action to take upon error reading from the source.
+ * @on_target_error: The action to take upon error writing to the target.
+ * @cb: Completion function for the job.
+ * @opaque: Opaque pointer value passed to @cb.
+ *
+ * Start a backup operation on @bs.  Clusters in @bs are written to @target
+ * until the job is cancelled or manually completed.
+ */
+void backup_start(BlockDriverState *bs, BlockDriverState *target,
+                  int64_t speed, BlockdevOnError on_source_error,
+                  BlockdevOnError on_target_error,
+                  BlockDriverCompletionFunc *cb, void *opaque,
+                  Error **errp);
+
 #endif /* BLOCK_INT_H */
diff --git a/trace-events b/trace-events
index c5f1ccb..0acce7b 100644
--- a/trace-events
+++ b/trace-events
@@ -92,6 +92,14 @@ mirror_yield_in_flight(void *s, int64_t sector_num, int in_flight) "s %p sector_
 mirror_yield_buf_busy(void *s, int nb_chunks, int in_flight) "s %p requested chunks %d in_flight %d"
 mirror_break_buf_busy(void *s, int nb_chunks, int in_flight) "s %p requested chunks %d in_flight %d"
 
+# block/backup.c
+backup_do_cow_enter(void *job, int64_t start, int64_t sector_num, int nb_sectors) "job %p start %"PRId64" sector_num %"PRId64" nb_sectors %d"
+backup_do_cow_return(void *job, int64_t sector_num, int nb_sectors, int ret) "job %p sector_num %"PRId64" nb_sectors %d ret %d"
+backup_do_cow_skip(void *job, int64_t start) "job %p start %"PRId64
+backup_do_cow_process(void *job, int64_t start) "job %p start %"PRId64
+backup_do_cow_read_fail(void *job, int64_t start, int ret) "job %p start %"PRId64" ret %d"
+backup_do_cow_write_fail(void *job, int64_t start, int ret) "job %p start %"PRId64" ret %d"
+
 # blockdev.c
 qmp_block_job_cancel(void *job) "job %p"
 qmp_block_job_pause(void *job) "job %p"
commit d616b224745b2c522f965cf8de7da17b553b959a
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:10 2013 +0200

    block: add bdrv_add_before_write_notifier()
    
    The bdrv_add_before_write_notifier() function installs a callback that
    is invoked before a write request is processed.  This will be used to
    implement copy-on-write point-in-time snapshots where we need to copy
    out old data before overwriting it.
    
    Note that BdrvTrackedRequest is moved to block_int.h since it is passed
    to .notify() functions.
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block.c b/block.c
index 8e77d46..0898f6b 100644
--- a/block.c
+++ b/block.c
@@ -305,6 +305,7 @@ BlockDriverState *bdrv_new(const char *device_name)
     }
     bdrv_iostatus_disable(bs);
     notifier_list_init(&bs->close_notifiers);
+    notifier_with_return_list_init(&bs->before_write_notifiers);
 
     return bs;
 }
@@ -1840,16 +1841,6 @@ int bdrv_commit_all(void)
     return 0;
 }
 
-struct BdrvTrackedRequest {
-    BlockDriverState *bs;
-    int64_t sector_num;
-    int nb_sectors;
-    bool is_write;
-    QLIST_ENTRY(BdrvTrackedRequest) list;
-    Coroutine *co; /* owner, used for deadlock detection */
-    CoQueue wait_queue; /* coroutines blocked on this request */
-};
-
 /**
  * Remove an active request from the tracked requests list
  *
@@ -2620,7 +2611,11 @@ static int coroutine_fn bdrv_co_do_writev(BlockDriverState *bs,
 
     tracked_request_begin(&req, bs, sector_num, nb_sectors, true);
 
-    if (flags & BDRV_REQ_ZERO_WRITE) {
+    ret = notifier_with_return_list_notify(&bs->before_write_notifiers, &req);
+
+    if (ret < 0) {
+        /* Do nothing, write notifier decided to fail this request */
+    } else if (flags & BDRV_REQ_ZERO_WRITE) {
         ret = bdrv_co_do_write_zeroes(bs, sector_num, nb_sectors);
     } else {
         ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov);
@@ -4581,3 +4576,9 @@ AioContext *bdrv_get_aio_context(BlockDriverState *bs)
     /* Currently BlockDriverState always uses the main loop AioContext */
     return qemu_get_aio_context();
 }
+
+void bdrv_add_before_write_notifier(BlockDriverState *bs,
+                                    NotifierWithReturn *notifier)
+{
+    notifier_with_return_list_add(&bs->before_write_notifiers, notifier);
+}
diff --git a/include/block/block_int.h b/include/block/block_int.h
index ba52247..2d00955 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -59,7 +59,16 @@
 #define BLOCK_OPT_LAZY_REFCOUNTS    "lazy_refcounts"
 #define BLOCK_OPT_ADAPTER_TYPE      "adapter_type"
 
-typedef struct BdrvTrackedRequest BdrvTrackedRequest;
+typedef struct BdrvTrackedRequest {
+    BlockDriverState *bs;
+    int64_t sector_num;
+    int nb_sectors;
+    bool is_write;
+    QLIST_ENTRY(BdrvTrackedRequest) list;
+    Coroutine *co; /* owner, used for deadlock detection */
+    CoQueue wait_queue; /* coroutines blocked on this request */
+} BdrvTrackedRequest;
+
 
 typedef struct BlockIOLimit {
     int64_t bps[3];
@@ -248,6 +257,9 @@ struct BlockDriverState {
 
     NotifierList close_notifiers;
 
+    /* Callback before write request is processed */
+    NotifierWithReturnList before_write_notifiers;
+
     /* number of in-flight copy-on-read requests */
     unsigned int copy_on_read_in_flight;
 
@@ -299,6 +311,15 @@ void bdrv_set_io_limits(BlockDriverState *bs,
                         BlockIOLimit *io_limits);
 
 /**
+ * bdrv_add_before_write_notifier:
+ *
+ * Register a callback that is invoked before write requests are processed but
+ * after any throttling or waiting for overlapping requests.
+ */
+void bdrv_add_before_write_notifier(BlockDriverState *bs,
+                                    NotifierWithReturn *notifier);
+
+/**
  * bdrv_get_aio_context:
  *
  * Returns: the currently bound #AioContext
commit 5dae8e5fb803f53fadc116cefe353953b938cbe1
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jun 24 17:13:09 2013 +0200

    notify: add NotiferWithReturn so notifier list can abort
    
    notifier_list_notify() has no return value.  This is fine when we just
    want to invoke side-effects.
    
    Sometimes it's useful for notifiers to produce a return value.  This
    allows notifiers to "veto" an operation and will be used by the block
    layer before-write notifier.
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/include/qemu/notify.h b/include/qemu/notify.h
index 4e2e7f0..a3d73e4 100644
--- a/include/qemu/notify.h
+++ b/include/qemu/notify.h
@@ -40,4 +40,33 @@ void notifier_remove(Notifier *notifier);
 
 void notifier_list_notify(NotifierList *list, void *data);
 
+/* Same as Notifier but allows .notify() to return errors */
+typedef struct NotifierWithReturn NotifierWithReturn;
+
+struct NotifierWithReturn {
+    /**
+     * Return 0 on success (next notifier will be invoked), otherwise
+     * notifier_with_return_list_notify() will stop and return the value.
+     */
+    int (*notify)(NotifierWithReturn *notifier, void *data);
+    QLIST_ENTRY(NotifierWithReturn) node;
+};
+
+typedef struct NotifierWithReturnList {
+    QLIST_HEAD(, NotifierWithReturn) notifiers;
+} NotifierWithReturnList;
+
+#define NOTIFIER_WITH_RETURN_LIST_INITIALIZER(head) \
+    { QLIST_HEAD_INITIALIZER((head).notifiers) }
+
+void notifier_with_return_list_init(NotifierWithReturnList *list);
+
+void notifier_with_return_list_add(NotifierWithReturnList *list,
+                                   NotifierWithReturn *notifier);
+
+void notifier_with_return_remove(NotifierWithReturn *notifier);
+
+int notifier_with_return_list_notify(NotifierWithReturnList *list,
+                                     void *data);
+
 #endif
diff --git a/util/notify.c b/util/notify.c
index 7b7692a..f215dfc 100644
--- a/util/notify.c
+++ b/util/notify.c
@@ -39,3 +39,33 @@ void notifier_list_notify(NotifierList *list, void *data)
         notifier->notify(notifier, data);
     }
 }
+
+void notifier_with_return_list_init(NotifierWithReturnList *list)
+{
+    QLIST_INIT(&list->notifiers);
+}
+
+void notifier_with_return_list_add(NotifierWithReturnList *list,
+                                   NotifierWithReturn *notifier)
+{
+    QLIST_INSERT_HEAD(&list->notifiers, notifier, node);
+}
+
+void notifier_with_return_remove(NotifierWithReturn *notifier)
+{
+    QLIST_REMOVE(notifier, node);
+}
+
+int notifier_with_return_list_notify(NotifierWithReturnList *list, void *data)
+{
+    NotifierWithReturn *notifier, *next;
+    int ret = 0;
+
+    QLIST_FOREACH_SAFE(notifier, &list->notifiers, node, next) {
+        ret = notifier->notify(notifier, data);
+        if (ret != 0) {
+            break;
+        }
+    }
+    return ret;
+}
commit a5c5ea3f60c000bf18c99435439533728a5f34a2
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 11 10:44:58 2013 +0200

    raw-posix: Fix /dev/cdrom magic on OS X
    
    The raw-posix driver has code to provide a /dev/cdrom on OS X even
    though it doesn't really exist. However, since commit c66a6157 the real
    filename is dismissed after finding it, so opening /dev/cdrom fails.
    Put the filename back into the options QDict to make this work again.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/raw-posix.c b/block/raw-posix.c
index c0ccf27..90ce9f8 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -1350,6 +1350,7 @@ static int hdev_open(BlockDriverState *bs, QDict *options, int flags)
                 qemu_close(fd);
             }
             filename = bsdPath;
+            qdict_put(options, "filename", qstring_from_str(filename));
         }
 
         if ( mediaIterator )
commit ec3f8c9913c1eeab78a02711be7c2a803dfb4d62
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Jun 27 20:53:38 2013 +0100

    linux-user: Fix compilation failure
    
    Fix compilation failures for linux-user targets following recent
    migration related commits bd2fa51fcd and 43487c67.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1372362818-4740-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/exec.c b/exec.c
index 2e6fc00..f99041b 100644
--- a/exec.c
+++ b/exec.c
@@ -2629,7 +2629,6 @@ bool cpu_physical_memory_is_io(hwaddr phys_addr)
     return !(memory_region_is_ram(mr) ||
              memory_region_is_romd(mr));
 }
-#endif
 
 void qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
 {
@@ -2639,3 +2638,4 @@ void qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
         func(block->host, block->offset, block->length, opaque);
     }
 }
+#endif
diff --git a/include/hw/hw.h b/include/hw/hw.h
index cc9f847..33bdb92 100644
--- a/include/hw/hw.h
+++ b/include/hw/hw.h
@@ -11,7 +11,6 @@
 #include "exec/ioport.h"
 #include "hw/irq.h"
 #include "block/aio.h"
-#include "migration/qemu-file.h"
 #include "migration/vmstate.h"
 #include "qemu/log.h"
 
diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index ebc4d09..1c31b5d 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -26,7 +26,9 @@
 #ifndef QEMU_VMSTATE_H
 #define QEMU_VMSTATE_H 1
 
+#ifndef CONFIG_USER_ONLY
 #include <migration/qemu-file.h>
+#endif
 
 typedef void SaveStateHandler(QEMUFile *f, void *opaque);
 typedef int LoadStateHandler(QEMUFile *f, void *opaque, int version_id);
commit c394ace828a559be13ec0bde15b476970f186dad
Merge: 3e50873 60d9222
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jun 27 08:48:38 2013 -0500

    Merge remote-tracking branch 'quintela/migration.next' into staging
    
    # By Michael R. Hines (9) and others
    # Via Juan Quintela
    * quintela/migration.next:
      rdma: introduce capability x-rdma-pin-all
      rdma: new QEMUFileOps hooks
      rdma: introduce qemu_ram_foreach_block()
      rdma: export qemu_fflush()
      rdma: introduce qemu_file_mode_is_not_valid()
      rdma: export throughput w/ MigrationStats QMP
      rdma: export yield_until_fd_readable()
      rdma: introduce qemu_update_position()
      rdma: add documentation
      migration: do not overwrite zero pages
      Revert "migration: do not sent zero pages in bulk stage"
      arch_init/ram_load: add error message for block length mismatch
    
    Message-id: 1372329455-5995-1-git-send-email-quintela at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 60d9222c8f50c3e5dd3df9ee84ddd1d1c4b35389
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:36 2013 -0400

    rdma: introduce capability x-rdma-pin-all
    
    This capability allows you to disable dynamic chunk registration
    for better throughput on high-performance links.
    
    For example, using an 8GB RAM virtual machine with all 8GB of memory in
    active use and the VM itself is completely idle using a 40 gbps infiniband link:
    
    1. x-rdma-pin-all disabled total time: approximately 7.5 seconds @ 9.5 Gbps
    2. x-rdma-pin-all enabled total time: approximately 4 seconds @ 26 Gbps
    
    These numbers would of course scale up to whatever size virtual machine
    you have to migrate using RDMA.
    
    Enabling this feature does *not* have any measurable affect on
    migration *downtime*. This is because, without this feature, all of the
    memory will have already been registered already in advance during
    the bulk round and does not need to be re-registered during the successive
    iteration rounds.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/include/migration/migration.h b/include/migration/migration.h
index 3ddd64f..f0640e0 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -123,6 +123,8 @@ void migrate_add_blocker(Error *reason);
  */
 void migrate_del_blocker(Error *reason);
 
+bool migrate_rdma_pin_all(void);
+
 int xbzrle_encode_buffer(uint8_t *old_buf, uint8_t *new_buf, int slen,
                          uint8_t *dst, int dlen);
 int xbzrle_decode_buffer(uint8_t *src, int slen, uint8_t *dst, int dlen);
diff --git a/migration.c b/migration.c
index 441a3b2..a704d48 100644
--- a/migration.c
+++ b/migration.c
@@ -476,6 +476,15 @@ void qmp_migrate_set_downtime(double value, Error **errp)
     max_downtime = (uint64_t)value;
 }
 
+bool migrate_rdma_pin_all(void)
+{
+    MigrationState *s;
+
+    s = migrate_get_current();
+
+    return s->enabled_capabilities[MIGRATION_CAPABILITY_X_RDMA_PIN_ALL];
+}
+
 int migrate_use_xbzrle(void)
 {
     MigrationState *s;
diff --git a/qapi-schema.json b/qapi-schema.json
index 78da557..a30a728 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -608,10 +608,15 @@
 #          This feature allows us to minimize migration traffic for certain work
 #          loads, by sending compressed difference of the pages
 #
+# @x-rdma-pin-all: Controls whether or not the entire VM memory footprint is
+#          mlock()'d on demand or all at once. Refer to docs/rdma.txt for usage.
+#          Disabled by default. Experimental: may (or may not) be renamed after
+#          further testing is complete. (since 1.6)
+#
 # Since: 1.2
 ##
 { 'enum': 'MigrationCapability',
-  'data': ['xbzrle'] }
+  'data': ['xbzrle', 'x-rdma-pin-all'] }
 
 ##
 # @MigrationCapabilityStatus
commit 43487c678d6e4e7182bfa70d2bc75422578782aa
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:35 2013 -0400

    rdma: new QEMUFileOps hooks
    
    These are the prototypes and implementation of new hooks that
    RDMA takes advantage of to perform dynamic page registration.
    
    An optional hook is also introduced for a custom function
    to be able to override the default save_page function.
    
    Also included are the prototypes and accessor methods used by
    arch_init.c which invoke funtions inside savevm.c to call out
    to the hooks that may or may not have been overridden
    inside of QEMUFileOps.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/include/migration/migration.h b/include/migration/migration.h
index 535e844..3ddd64f 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -21,6 +21,7 @@
 #include "qapi/error.h"
 #include "migration/vmstate.h"
 #include "qapi-types.h"
+#include "exec/cpu-common.h"
 
 struct MigrationParams {
     bool blk;
@@ -130,4 +131,23 @@ int migrate_use_xbzrle(void);
 int64_t migrate_xbzrle_cache_size(void);
 
 int64_t xbzrle_cache_resize(int64_t new_size);
+
+void ram_control_before_iterate(QEMUFile *f, uint64_t flags);
+void ram_control_after_iterate(QEMUFile *f, uint64_t flags);
+void ram_control_load_hook(QEMUFile *f, uint64_t flags);
+
+/* Whenever this is found in the data stream, the flags
+ * will be passed to ram_control_load_hook in the incoming-migration
+ * side. This lets before_ram_iterate/after_ram_iterate add
+ * transport-specific sections to the RAM migration data.
+ */
+#define RAM_SAVE_FLAG_HOOK     0x80
+
+#define RAM_SAVE_CONTROL_NOT_SUPP -1000
+#define RAM_SAVE_CONTROL_DELAYED  -2000
+
+size_t ram_control_save_page(QEMUFile *f, ram_addr_t block_offset,
+                             ram_addr_t offset, size_t size,
+                             int *bytes_sent);
+
 #endif
diff --git a/include/migration/qemu-file.h b/include/migration/qemu-file.h
index 37d1604..0f757fb 100644
--- a/include/migration/qemu-file.h
+++ b/include/migration/qemu-file.h
@@ -23,6 +23,7 @@
  */
 #ifndef QEMU_FILE_H
 #define QEMU_FILE_H 1
+#include "exec/cpu-common.h"
 
 /* This function writes a chunk of data to a file at the given position.
  * The pos argument can be ignored if the file is only being used for
@@ -57,12 +58,40 @@ typedef int (QEMUFileGetFD)(void *opaque);
 typedef ssize_t (QEMUFileWritevBufferFunc)(void *opaque, struct iovec *iov,
                                            int iovcnt, int64_t pos);
 
+/*
+ * This function provides hooks around different
+ * stages of RAM migration.
+ */
+typedef int (QEMURamHookFunc)(QEMUFile *f, void *opaque, uint64_t flags);
+
+/*
+ * Constants used by ram_control_* hooks
+ */
+#define RAM_CONTROL_SETUP    0
+#define RAM_CONTROL_ROUND    1
+#define RAM_CONTROL_HOOK     2
+#define RAM_CONTROL_FINISH   3
+
+/*
+ * This function allows override of where the RAM page
+ * is saved (such as RDMA, for example.)
+ */
+typedef size_t (QEMURamSaveFunc)(QEMUFile *f, void *opaque,
+                               ram_addr_t block_offset,
+                               ram_addr_t offset,
+                               size_t size,
+                               int *bytes_sent);
+
 typedef struct QEMUFileOps {
     QEMUFilePutBufferFunc *put_buffer;
     QEMUFileGetBufferFunc *get_buffer;
     QEMUFileCloseFunc *close;
     QEMUFileGetFD *get_fd;
     QEMUFileWritevBufferFunc *writev_buffer;
+    QEMURamHookFunc *before_ram_iterate;
+    QEMURamHookFunc *after_ram_iterate;
+    QEMURamHookFunc *hook_ram_load;
+    QEMURamSaveFunc *save_page;
 } QEMUFileOps;
 
 QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops);
diff --git a/savevm.c b/savevm.c
index 26d5607..e0491e7 100644
--- a/savevm.c
+++ b/savevm.c
@@ -616,6 +616,65 @@ void qemu_fflush(QEMUFile *f)
     }
 }
 
+void ram_control_before_iterate(QEMUFile *f, uint64_t flags)
+{
+    int ret = 0;
+
+    if (f->ops->before_ram_iterate) {
+        ret = f->ops->before_ram_iterate(f, f->opaque, flags);
+        if (ret < 0) {
+            qemu_file_set_error(f, ret);
+        }
+    }
+}
+
+void ram_control_after_iterate(QEMUFile *f, uint64_t flags)
+{
+    int ret = 0;
+
+    if (f->ops->after_ram_iterate) {
+        ret = f->ops->after_ram_iterate(f, f->opaque, flags);
+        if (ret < 0) {
+            qemu_file_set_error(f, ret);
+        }
+    }
+}
+
+void ram_control_load_hook(QEMUFile *f, uint64_t flags)
+{
+    int ret = 0;
+
+    if (f->ops->hook_ram_load) {
+        ret = f->ops->hook_ram_load(f, f->opaque, flags);
+        if (ret < 0) {
+            qemu_file_set_error(f, ret);
+        }
+    } else {
+        qemu_file_set_error(f, ret);
+    }
+}
+
+size_t ram_control_save_page(QEMUFile *f, ram_addr_t block_offset,
+                         ram_addr_t offset, size_t size, int *bytes_sent)
+{
+    if (f->ops->save_page) {
+        int ret = f->ops->save_page(f, f->opaque, block_offset,
+                                    offset, size, bytes_sent);
+
+        if (ret != RAM_SAVE_CONTROL_DELAYED) {
+            if (*bytes_sent > 0) {
+                qemu_update_position(f, *bytes_sent);
+            } else if (ret < 0) {
+                qemu_file_set_error(f, ret);
+            }
+        }
+
+        return ret;
+    }
+
+    return RAM_SAVE_CONTROL_NOT_SUPP;
+}
+
 static void qemu_fill_buffer(QEMUFile *f)
 {
     int len;
commit bd2fa51fcdba3408f308df1b08fae04053ecdee5
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:34 2013 -0400

    rdma: introduce qemu_ram_foreach_block()
    
    This is used during RDMA initialization in order to
    transmit a description of all the RAM blocks to the
    peer for later dynamic chunk registration purposes.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/exec.c b/exec.c
index 0b0118b..2e6fc00 100644
--- a/exec.c
+++ b/exec.c
@@ -2630,3 +2630,12 @@ bool cpu_physical_memory_is_io(hwaddr phys_addr)
              memory_region_is_romd(mr));
 }
 #endif
+
+void qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
+{
+    RAMBlock *block;
+
+    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
+        func(block->host, block->offset, block->length, opaque);
+    }
+}
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index e061e21..92a4223 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -113,6 +113,11 @@ void cpu_physical_memory_write_rom(hwaddr addr,
 extern struct MemoryRegion io_mem_rom;
 extern struct MemoryRegion io_mem_notdirty;
 
+typedef void (RAMBlockIterFunc)(void *host_addr,
+    ram_addr_t offset, ram_addr_t length, void *opaque);
+
+void qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
+
 #endif
 
 #endif /* !CPU_COMMON_H */
commit be903b2ae7ca750bde2549432c5536087436cf49
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:32 2013 -0400

    rdma: export qemu_fflush()
    
    RDMA uses this to flush the control channel before sending its
    own message to handle page registrations.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/include/migration/qemu-file.h b/include/migration/qemu-file.h
index dd3fd51..37d1604 100644
--- a/include/migration/qemu-file.h
+++ b/include/migration/qemu-file.h
@@ -112,6 +112,7 @@ void qemu_file_reset_rate_limit(QEMUFile *f);
 void qemu_file_set_rate_limit(QEMUFile *f, int64_t new_rate);
 int64_t qemu_file_get_rate_limit(QEMUFile *f);
 int qemu_file_get_error(QEMUFile *f);
+void qemu_fflush(QEMUFile *f);
 
 static inline void qemu_put_be64s(QEMUFile *f, const uint64_t *pv)
 {
diff --git a/savevm.c b/savevm.c
index 67ddf06..26d5607 100644
--- a/savevm.c
+++ b/savevm.c
@@ -589,7 +589,7 @@ static inline bool qemu_file_is_writable(QEMUFile *f)
  * If there is writev_buffer QEMUFileOps it uses it otherwise uses
  * put_buffer ops.
  */
-static void qemu_fflush(QEMUFile *f)
+void qemu_fflush(QEMUFile *f)
 {
     ssize_t ret = 0;
 
commit bc1256f7f187cc7d491bfe3861249a60873adbbc
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:31 2013 -0400

    rdma: introduce qemu_file_mode_is_not_valid()
    
    QEMUFileRDMA also has read and write modes. This function is now
    shared to reduce code duplication.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/include/migration/qemu-file.h b/include/migration/qemu-file.h
index 8fab0dd..dd3fd51 100644
--- a/include/migration/qemu-file.h
+++ b/include/migration/qemu-file.h
@@ -80,6 +80,7 @@ void qemu_put_byte(QEMUFile *f, int v);
  * The buffer should be available till it is sent asynchronously.
  */
 void qemu_put_buffer_async(QEMUFile *f, const uint8_t *buf, int size);
+bool qemu_file_mode_is_not_valid(const char *mode);
 
 static inline void qemu_put_ubyte(QEMUFile *f, unsigned int v)
 {
diff --git a/savevm.c b/savevm.c
index e35c7a4..67ddf06 100644
--- a/savevm.c
+++ b/savevm.c
@@ -449,14 +449,23 @@ static const QEMUFileOps socket_write_ops = {
     .close =      socket_close
 };
 
-QEMUFile *qemu_fopen_socket(int fd, const char *mode)
+bool qemu_file_mode_is_not_valid(const char *mode)
 {
-    QEMUFileSocket *s;
-
     if (mode == NULL ||
         (mode[0] != 'r' && mode[0] != 'w') ||
         mode[1] != 'b' || mode[2] != 0) {
         fprintf(stderr, "qemu_fopen: Argument validity check failed\n");
+        return true;
+    }
+
+    return false;
+}
+
+QEMUFile *qemu_fopen_socket(int fd, const char *mode)
+{
+    QEMUFileSocket *s;
+
+    if (qemu_file_mode_is_not_valid(mode)) {
         return NULL;
     }
 
@@ -475,10 +484,7 @@ QEMUFile *qemu_fopen(const char *filename, const char *mode)
 {
     QEMUFileStdio *s;
 
-    if (mode == NULL ||
-	(mode[0] != 'r' && mode[0] != 'w') ||
-	mode[1] != 'b' || mode[2] != 0) {
-        fprintf(stderr, "qemu_fopen: Argument validity check failed\n");
+    if (qemu_file_mode_is_not_valid(mode)) {
         return NULL;
     }
 
commit 7e114f8cf24a01893226e3a4d22a288125515cfd
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:30 2013 -0400

    rdma: export throughput w/ MigrationStats QMP
    
    This exposes throughput (in megabits/sec) through QMP.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/hmp.c b/hmp.c
index 494a9aa..148a3fb 100644
--- a/hmp.c
+++ b/hmp.c
@@ -169,6 +169,8 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
     if (info->has_ram) {
         monitor_printf(mon, "transferred ram: %" PRIu64 " kbytes\n",
                        info->ram->transferred >> 10);
+        monitor_printf(mon, "throughput: %0.2f mbps\n",
+                       info->ram->mbps);
         monitor_printf(mon, "remaining ram: %" PRIu64 " kbytes\n",
                        info->ram->remaining >> 10);
         monitor_printf(mon, "total ram: %" PRIu64 " kbytes\n",
diff --git a/include/migration/migration.h b/include/migration/migration.h
index 0be28a2..535e844 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -40,6 +40,7 @@ struct MigrationState
 
     int state;
     MigrationParams params;
+    double mbps;
     int64_t total_time;
     int64_t downtime;
     int64_t expected_downtime;
diff --git a/migration.c b/migration.c
index 058f9e6..441a3b2 100644
--- a/migration.c
+++ b/migration.c
@@ -66,6 +66,7 @@ MigrationState *migrate_get_current(void)
         .state = MIG_STATE_SETUP,
         .bandwidth_limit = MAX_THROTTLE,
         .xbzrle_cache_size = DEFAULT_MIGRATE_CACHE_SIZE,
+        .mbps = -1,
     };
 
     return &current_migration;
@@ -201,6 +202,7 @@ MigrationInfo *qmp_query_migrate(Error **errp)
         info->ram->normal = norm_mig_pages_transferred();
         info->ram->normal_bytes = norm_mig_bytes_transferred();
         info->ram->dirty_pages_rate = s->dirty_pages_rate;
+        info->ram->mbps = s->mbps;
 
         if (blk_mig_active()) {
             info->has_disk = true;
@@ -230,6 +232,7 @@ MigrationInfo *qmp_query_migrate(Error **errp)
         info->ram->skipped = skipped_mig_pages_transferred();
         info->ram->normal = norm_mig_pages_transferred();
         info->ram->normal_bytes = norm_mig_bytes_transferred();
+        info->ram->mbps = s->mbps;
         break;
     case MIG_STATE_ERROR:
         info->has_status = true;
@@ -543,6 +546,9 @@ static void *migration_thread(void *opaque)
             double bandwidth = transferred_bytes / time_spent;
             max_size = bandwidth * migrate_max_downtime() / 1000000;
 
+            s->mbps = time_spent ? (((double) transferred_bytes * 8.0) /
+                    ((double) time_spent / 1000.0)) / 1000.0 / 1000.0 : -1;
+
             DPRINTF("transferred %" PRIu64 " time_spent %" PRIu64
                     " bandwidth %g max_size %" PRId64 "\n",
                     transferred_bytes, time_spent, bandwidth, max_size);
diff --git a/qapi-schema.json b/qapi-schema.json
index 6cc07c2..78da557 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -513,12 +513,15 @@
 # @dirty-pages-rate: number of pages dirtied by second by the
 #        guest (since 1.3)
 #
+# @mbps: throughput in megabits/sec. (since 1.6)
+#
 # Since: 0.14.0
 ##
 { 'type': 'MigrationStats',
   'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' ,
            'duplicate': 'int', 'skipped': 'int', 'normal': 'int',
-           'normal-bytes': 'int', 'dirty-pages-rate' : 'int' } }
+           'normal-bytes': 'int', 'dirty-pages-rate' : 'int',
+           'mbps' : 'number' } }
 
 ##
 # @XBZRLECacheStats
commit 9f05d0c3a4f9e8fcb13ed09cc350af45a627809a
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:29 2013 -0400

    rdma: export yield_until_fd_readable()
    
    The RDMA event channel can be made non-blocking just like a TCP
    socket. Exporting this function allows us to yield so that the
    QEMU monitor remains available.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/include/block/coroutine.h b/include/block/coroutine.h
index a978162..377805a 100644
--- a/include/block/coroutine.h
+++ b/include/block/coroutine.h
@@ -209,4 +209,10 @@ void qemu_co_rwlock_unlock(CoRwlock *lock);
  */
 void coroutine_fn co_sleep_ns(QEMUClock *clock, int64_t ns);
 
+/**
+ * Yield until a file descriptor becomes readable
+ *
+ * Note that this function clobbers the handlers for the file descriptor.
+ */
+void coroutine_fn yield_until_fd_readable(int fd);
 #endif /* QEMU_COROUTINE_H */
diff --git a/qemu-coroutine-io.c b/qemu-coroutine-io.c
index e8ad1a4..c4df35a 100644
--- a/qemu-coroutine-io.c
+++ b/qemu-coroutine-io.c
@@ -63,3 +63,26 @@ qemu_co_send_recv(int sockfd, void *buf, size_t bytes, bool do_send)
     struct iovec iov = { .iov_base = buf, .iov_len = bytes };
     return qemu_co_sendv_recvv(sockfd, &iov, 1, 0, bytes, do_send);
 }
+
+typedef struct {
+    Coroutine *co;
+    int fd;
+} FDYieldUntilData;
+
+static void fd_coroutine_enter(void *opaque)
+{
+    FDYieldUntilData *data = opaque;
+    qemu_set_fd_handler(data->fd, NULL, NULL, NULL);
+    qemu_coroutine_enter(data->co, NULL);
+}
+
+void coroutine_fn yield_until_fd_readable(int fd)
+{
+    FDYieldUntilData data;
+
+    assert(qemu_in_coroutine());
+    data.co = qemu_coroutine_self();
+    data.fd = fd;
+    qemu_set_fd_handler(fd, fd_coroutine_enter, NULL, &data);
+    qemu_coroutine_yield();
+}
diff --git a/savevm.c b/savevm.c
index 9b5577e..e35c7a4 100644
--- a/savevm.c
+++ b/savevm.c
@@ -149,34 +149,6 @@ typedef struct QEMUFileSocket
     QEMUFile *file;
 } QEMUFileSocket;
 
-typedef struct {
-    Coroutine *co;
-    int fd;
-} FDYieldUntilData;
-
-static void fd_coroutine_enter(void *opaque)
-{
-    FDYieldUntilData *data = opaque;
-    qemu_set_fd_handler(data->fd, NULL, NULL, NULL);
-    qemu_coroutine_enter(data->co, NULL);
-}
-
-/**
- * Yield until a file descriptor becomes readable
- *
- * Note that this function clobbers the handlers for the file descriptor.
- */
-static void coroutine_fn yield_until_fd_readable(int fd)
-{
-    FDYieldUntilData data;
-
-    assert(qemu_in_coroutine());
-    data.co = qemu_coroutine_self();
-    data.fd = fd;
-    qemu_set_fd_handler(fd, fd_coroutine_enter, NULL, &data);
-    qemu_coroutine_yield();
-}
-
 static ssize_t socket_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,
                                     int64_t pos)
 {
commit 2b0ce0797d6bfb13ebefe010da86abced0b7a9b3
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:28 2013 -0400

    rdma: introduce qemu_update_position()
    
    RDMA writes happen asynchronously, and thus the performance accounting
    also needs to be able to occur asynchronously. This allows anybody
    to call into savevm.c to update both f->pos as well as into arch_init.c
    to update the acct_info structure with up-to-date values when
    the RDMA transfer actually completes.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index 4dd17f4..ea9ddad 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -493,6 +493,18 @@ static int ram_save_block(QEMUFile *f, bool last_stage)
 
 static uint64_t bytes_transferred;
 
+void acct_update_position(QEMUFile *f, size_t size, bool zero)
+{
+    uint64_t pages = size / TARGET_PAGE_SIZE;
+    if (zero) {
+        acct_info.dup_pages += pages;
+    } else {
+        acct_info.norm_pages += pages;
+        bytes_transferred += size;
+        qemu_update_position(f, size);
+    }
+}
+
 static ram_addr_t ram_save_remaining(void)
 {
     return migration_dirty_pages;
diff --git a/include/migration/migration.h b/include/migration/migration.h
index e2acec6..0be28a2 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -92,6 +92,8 @@ uint64_t ram_bytes_remaining(void);
 uint64_t ram_bytes_transferred(void);
 uint64_t ram_bytes_total(void);
 
+void acct_update_position(QEMUFile *f, size_t size, bool zero);
+
 extern SaveVMHandlers savevm_ram_handlers;
 
 uint64_t dup_mig_bytes_transferred(void);
diff --git a/include/migration/qemu-file.h b/include/migration/qemu-file.h
index 7519464..8fab0dd 100644
--- a/include/migration/qemu-file.h
+++ b/include/migration/qemu-file.h
@@ -93,6 +93,7 @@ void qemu_put_be32(QEMUFile *f, unsigned int v);
 void qemu_put_be64(QEMUFile *f, uint64_t v);
 int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size);
 int qemu_get_byte(QEMUFile *f);
+void qemu_update_position(QEMUFile *f, size_t size);
 
 static inline unsigned int qemu_get_ubyte(QEMUFile *f)
 {
diff --git a/savevm.c b/savevm.c
index 48cc2a9..9b5577e 100644
--- a/savevm.c
+++ b/savevm.c
@@ -671,6 +671,11 @@ int qemu_get_fd(QEMUFile *f)
     return -1;
 }
 
+void qemu_update_position(QEMUFile *f, size_t size)
+{
+    f->pos += size;
+}
+
 /** Closes the file
  *
  * Returns negative error value if any error happened on previous operations or
commit f4abc9d621823b14a6cd508c66c1ecb21f96349e
Author: Michael R. Hines <mrhines at us.ibm.com>
Date:   Tue Jun 25 21:35:27 2013 -0400

    rdma: add documentation
    
    docs/rdma.txt contains full documentation,
    wiki links, github url and contact information.
    
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Chegu Vinod <chegu_vinod at hp.com>
    Tested-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Michael R. Hines <mrhines at us.ibm.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/docs/rdma.txt b/docs/rdma.txt
new file mode 100644
index 0000000..45a4b1d
--- /dev/null
+++ b/docs/rdma.txt
@@ -0,0 +1,415 @@
+(RDMA: Remote Direct Memory Access)
+RDMA Live Migration Specification, Version # 1
+==============================================
+Wiki: http://wiki.qemu.org/Features/RDMALiveMigration
+Github: git at github.com:hinesmr/qemu.git, 'rdma' branch
+
+Copyright (C) 2013 Michael R. Hines <mrhines at us.ibm.com>
+
+An *exhaustive* paper (2010) shows additional performance details
+linked on the QEMU wiki above.
+
+Contents:
+=========
+* Introduction
+* Before running
+* Running
+* Performance
+* RDMA Migration Protocol Description
+* Versioning and Capabilities
+* QEMUFileRDMA Interface
+* Migration of pc.ram
+* Error handling
+* TODO
+
+Introduction:
+=============
+
+RDMA helps make your migration more deterministic under heavy load because
+of the significantly lower latency and higher throughput over TCP/IP. This is
+because the RDMA I/O architecture reduces the number of interrupts and
+data copies by bypassing the host networking stack. In particular, a TCP-based
+migration, under certain types of memory-bound workloads, may take a more
+unpredicatable amount of time to complete the migration if the amount of
+memory tracked during each live migration iteration round cannot keep pace
+with the rate of dirty memory produced by the workload.
+
+RDMA currently comes in two flavors: both Ethernet based (RoCE, or RDMA
+over Convered Ethernet) as well as Infiniband-based. This implementation of
+migration using RDMA is capable of using both technologies because of
+the use of the OpenFabrics OFED software stack that abstracts out the
+programming model irrespective of the underlying hardware.
+
+Refer to openfabrics.org or your respective RDMA hardware vendor for
+an understanding on how to verify that you have the OFED software stack
+installed in your environment. You should be able to successfully link
+against the "librdmacm" and "libibverbs" libraries and development headers
+for a working build of QEMU to run successfully using RDMA Migration.
+
+BEFORE RUNNING:
+===============
+
+Use of RDMA during migration requires pinning and registering memory
+with the hardware. This means that memory must be physically resident
+before the hardware can transmit that memory to another machine.
+If this is not acceptable for your application or product, then the use
+of RDMA migration may in fact be harmful to co-located VMs or other
+software on the machine if there is not sufficient memory available to
+relocate the entire footprint of the virtual machine. If so, then the
+use of RDMA is discouraged and it is recommended to use standard TCP migration.
+
+Experimental: Next, decide if you want dynamic page registration.
+For example, if you have an 8GB RAM virtual machine, but only 1GB
+is in active use, then enabling this feature will cause all 8GB to
+be pinned and resident in memory. This feature mostly affects the
+bulk-phase round of the migration and can be enabled for extremely
+high-performance RDMA hardware using the following command:
+
+QEMU Monitor Command:
+$ migrate_set_capability x-rdma-pin-all on # disabled by default
+
+Performing this action will cause all 8GB to be pinned, so if that's
+not what you want, then please ignore this step altogether.
+
+On the other hand, this will also significantly speed up the bulk round
+of the migration, which can greatly reduce the "total" time of your migration.
+Example performance of this using an idle VM in the previous example
+can be found in the "Performance" section.
+
+Note: for very large virtual machines (hundreds of GBs), pinning all
+*all* of the memory of your virtual machine in the kernel is very expensive
+may extend the initial bulk iteration time by many seconds,
+and thus extending the total migration time. However, this will not
+affect the determinism or predictability of your migration you will
+still gain from the benefits of advanced pinning with RDMA.
+
+RUNNING:
+========
+
+First, set the migration speed to match your hardware's capabilities:
+
+QEMU Monitor Command:
+$ migrate_set_speed 40g # or whatever is the MAX of your RDMA device
+
+Next, on the destination machine, add the following to the QEMU command line:
+
+qemu ..... -incoming x-rdma:host:port
+
+Finally, perform the actual migration on the source machine:
+
+QEMU Monitor Command:
+$ migrate -d x-rdma:host:port
+
+PERFORMANCE
+===========
+
+Here is a brief summary of total migration time and downtime using RDMA:
+Using a 40gbps infiniband link performing a worst-case stress test,
+using an 8GB RAM virtual machine:
+
+Using the following command:
+$ apt-get install stress
+$ stress --vm-bytes 7500M --vm 1 --vm-keep
+
+1. Migration throughput: 26 gigabits/second.
+2. Downtime (stop time) varies between 15 and 100 milliseconds.
+
+EFFECTS of memory registration on bulk phase round:
+
+For example, in the same 8GB RAM example with all 8GB of memory in
+active use and the VM itself is completely idle using the same 40 gbps
+infiniband link:
+
+1. x-rdma-pin-all disabled total time: approximately 7.5 seconds @ 9.5 Gbps
+2. x-rdma-pin-all enabled total time: approximately 4 seconds @ 26 Gbps
+
+These numbers would of course scale up to whatever size virtual machine
+you have to migrate using RDMA.
+
+Enabling this feature does *not* have any measurable affect on
+migration *downtime*. This is because, without this feature, all of the
+memory will have already been registered already in advance during
+the bulk round and does not need to be re-registered during the successive
+iteration rounds.
+
+RDMA Protocol Description:
+==========================
+
+Migration with RDMA is separated into two parts:
+
+1. The transmission of the pages using RDMA
+2. Everything else (a control channel is introduced)
+
+"Everything else" is transmitted using a formal
+protocol now, consisting of infiniband SEND messages.
+
+An infiniband SEND message is the standard ibverbs
+message used by applications of infiniband hardware.
+The only difference between a SEND message and an RDMA
+message is that SEND messages cause notifications
+to be posted to the completion queue (CQ) on the
+infiniband receiver side, whereas RDMA messages (used
+for pc.ram) do not (to behave like an actual DMA).
+
+Messages in infiniband require two things:
+
+1. registration of the memory that will be transmitted
+2. (SEND only) work requests to be posted on both
+   sides of the network before the actual transmission
+   can occur.
+
+RDMA messages are much easier to deal with. Once the memory
+on the receiver side is registered and pinned, we're
+basically done. All that is required is for the sender
+side to start dumping bytes onto the link.
+
+(Memory is not released from pinning until the migration
+completes, given that RDMA migrations are very fast.)
+
+SEND messages require more coordination because the
+receiver must have reserved space (using a receive
+work request) on the receive queue (RQ) before QEMUFileRDMA
+can start using them to carry all the bytes as
+a control transport for migration of device state.
+
+To begin the migration, the initial connection setup is
+as follows (migration-rdma.c):
+
+1. Receiver and Sender are started (command line or libvirt):
+2. Both sides post two RQ work requests
+3. Receiver does listen()
+4. Sender does connect()
+5. Receiver accept()
+6. Check versioning and capabilities (described later)
+
+At this point, we define a control channel on top of SEND messages
+which is described by a formal protocol. Each SEND message has a
+header portion and a data portion (but together are transmitted
+as a single SEND message).
+
+Header:
+    * Length  (of the data portion, uint32, network byte order)
+    * Type    (what command to perform, uint32, network byte order)
+    * Repeat  (Number of commands in data portion, same type only)
+
+The 'Repeat' field is here to support future multiple page registrations
+in a single message without any need to change the protocol itself
+so that the protocol is compatible against multiple versions of QEMU.
+Version #1 requires that all server implementations of the protocol must
+check this field and register all requests found in the array of commands located
+in the data portion and return an equal number of results in the response.
+The maximum number of repeats is hard-coded to 4096. This is a conservative
+limit based on the maximum size of a SEND message along with emperical
+observations on the maximum future benefit of simultaneous page registrations.
+
+The 'type' field has 10 different command values:
+    1. Unused
+    2. Error              (sent to the source during bad things)
+    3. Ready              (control-channel is available)
+    4. QEMU File          (for sending non-live device state)
+    5. RAM Blocks request (used right after connection setup)
+    6. RAM Blocks result  (used right after connection setup)
+    7. Compress page      (zap zero page and skip registration)
+    8. Register request   (dynamic chunk registration)
+    9. Register result    ('rkey' to be used by sender)
+    10. Register finished  (registration for current iteration finished)
+
+A single control message, as hinted above, can contain within the data
+portion an array of many commands of the same type. If there is more than
+one command, then the 'repeat' field will be greater than 1.
+
+After connection setup, message 5 & 6 are used to exchange ram block
+information and optionally pin all the memory if requested by the user.
+
+After ram block exchange is completed, we have two protocol-level
+functions, responsible for communicating control-channel commands
+using the above list of values:
+
+Logically:
+
+qemu_rdma_exchange_recv(header, expected command type)
+
+1. We transmit a READY command to let the sender know that
+   we are *ready* to receive some data bytes on the control channel.
+2. Before attempting to receive the expected command, we post another
+   RQ work request to replace the one we just used up.
+3. Block on a CQ event channel and wait for the SEND to arrive.
+4. When the send arrives, librdmacm will unblock us.
+5. Verify that the command-type and version received matches the one we expected.
+
+qemu_rdma_exchange_send(header, data, optional response header & data):
+
+1. Block on the CQ event channel waiting for a READY command
+   from the receiver to tell us that the receiver
+   is *ready* for us to transmit some new bytes.
+2. Optionally: if we are expecting a response from the command
+   (that we have no yet transmitted), let's post an RQ
+   work request to receive that data a few moments later.
+3. When the READY arrives, librdmacm will
+   unblock us and we immediately post a RQ work request
+   to replace the one we just used up.
+4. Now, we can actually post the work request to SEND
+   the requested command type of the header we were asked for.
+5. Optionally, if we are expecting a response (as before),
+   we block again and wait for that response using the additional
+   work request we previously posted. (This is used to carry
+   'Register result' commands #6 back to the sender which
+   hold the rkey need to perform RDMA. Note that the virtual address
+   corresponding to this rkey was already exchanged at the beginning
+   of the connection (described below).
+
+All of the remaining command types (not including 'ready')
+described above all use the aformentioned two functions to do the hard work:
+
+1. After connection setup, RAMBlock information is exchanged using
+   this protocol before the actual migration begins. This information includes
+   a description of each RAMBlock on the server side as well as the virtual addresses
+   and lengths of each RAMBlock. This is used by the client to determine the
+   start and stop locations of chunks and how to register them dynamically
+   before performing the RDMA operations.
+2. During runtime, once a 'chunk' becomes full of pages ready to
+   be sent with RDMA, the registration commands are used to ask the
+   other side to register the memory for this chunk and respond
+   with the result (rkey) of the registration.
+3. Also, the QEMUFile interfaces also call these functions (described below)
+   when transmitting non-live state, such as devices or to send
+   its own protocol information during the migration process.
+4. Finally, zero pages are only checked if a page has not yet been registered
+   using chunk registration (or not checked at all and unconditionally
+   written if chunk registration is disabled. This is accomplished using
+   the "Compress" command listed above. If the page *has* been registered
+   then we check the entire chunk for zero. Only if the entire chunk is
+   zero, then we send a compress command to zap the page on the other side.
+
+Versioning and Capabilities
+===========================
+Current version of the protocol is version #1.
+
+The same version applies to both for protocol traffic and capabilities
+negotiation. (i.e. There is only one version number that is referred to
+by all communication).
+
+librdmacm provides the user with a 'private data' area to be exchanged
+at connection-setup time before any infiniband traffic is generated.
+
+Header:
+    * Version (protocol version validated before send/recv occurs), uint32, network byte order
+    * Flags   (bitwise OR of each capability), uint32, network byte order
+
+There is no data portion of this header right now, so there is
+no length field. The maximum size of the 'private data' section
+is only 192 bytes per the Infiniband specification, so it's not
+very useful for data anyway. This structure needs to remain small.
+
+This private data area is a convenient place to check for protocol
+versioning because the user does not need to register memory to
+transmit a few bytes of version information.
+
+This is also a convenient place to negotiate capabilities
+(like dynamic page registration).
+
+If the version is invalid, we throw an error.
+
+If the version is new, we only negotiate the capabilities that the
+requested version is able to perform and ignore the rest.
+
+Currently there is only *one* capability in Version #1: dynamic page registration
+
+Finally: Negotiation happens with the Flags field: If the primary-VM
+sets a flag, but the destination does not support this capability, it
+will return a zero-bit for that flag and the primary-VM will understand
+that as not being an available capability and will thus disable that
+capability on the primary-VM side.
+
+QEMUFileRDMA Interface:
+=======================
+
+QEMUFileRDMA introduces a couple of new functions:
+
+1. qemu_rdma_get_buffer()  (QEMUFileOps rdma_read_ops)
+2. qemu_rdma_put_buffer()  (QEMUFileOps rdma_write_ops)
+
+These two functions are very short and simply use the protocol
+describe above to deliver bytes without changing the upper-level
+users of QEMUFile that depend on a bytestream abstraction.
+
+Finally, how do we handoff the actual bytes to get_buffer()?
+
+Again, because we're trying to "fake" a bytestream abstraction
+using an analogy not unlike individual UDP frames, we have
+to hold on to the bytes received from control-channel's SEND
+messages in memory.
+
+Each time we receive a complete "QEMU File" control-channel
+message, the bytes from SEND are copied into a small local holding area.
+
+Then, we return the number of bytes requested by get_buffer()
+and leave the remaining bytes in the holding area until get_buffer()
+comes around for another pass.
+
+If the buffer is empty, then we follow the same steps
+listed above and issue another "QEMU File" protocol command,
+asking for a new SEND message to re-fill the buffer.
+
+Migration of pc.ram:
+====================
+
+At the beginning of the migration, (migration-rdma.c),
+the sender and the receiver populate the list of RAMBlocks
+to be registered with each other into a structure.
+Then, using the aforementioned protocol, they exchange a
+description of these blocks with each other, to be used later
+during the iteration of main memory. This description includes
+a list of all the RAMBlocks, their offsets and lengths, virtual
+addresses and possibly includes pre-registered RDMA keys in case dynamic
+page registration was disabled on the server-side, otherwise not.
+
+Main memory is not migrated with the aforementioned protocol,
+but is instead migrated with normal RDMA Write operations.
+
+Pages are migrated in "chunks" (hard-coded to 1 Megabyte right now).
+Chunk size is not dynamic, but it could be in a future implementation.
+There's nothing to indicate that this is useful right now.
+
+When a chunk is full (or a flush() occurs), the memory backed by
+the chunk is registered with librdmacm is pinned in memory on
+both sides using the aforementioned protocol.
+After pinning, an RDMA Write is generated and transmitted
+for the entire chunk.
+
+Chunks are also transmitted in batches: This means that we
+do not request that the hardware signal the completion queue
+for the completion of *every* chunk. The current batch size
+is about 64 chunks (corresponding to 64 MB of memory).
+Only the last chunk in a batch must be signaled.
+This helps keep everything as asynchronous as possible
+and helps keep the hardware busy performing RDMA operations.
+
+Error-handling:
+===============
+
+Infiniband has what is called a "Reliable, Connected"
+link (one of 4 choices). This is the mode in which
+we use for RDMA migration.
+
+If a *single* message fails,
+the decision is to abort the migration entirely and
+cleanup all the RDMA descriptors and unregister all
+the memory.
+
+After cleanup, the Virtual Machine is returned to normal
+operation the same way that would happen if the TCP
+socket is broken during a non-RDMA based migration.
+
+TODO:
+=====
+1. 'migrate x-rdma:host:port' and '-incoming x-rdma' options will be
+   renamed to 'rdma' after the experimental phase of this work has
+   completed upstream.
+2. Currently, 'ulimit -l' mlock() limits as well as cgroups swap limits
+   are not compatible with infinband memory pinning and will result in
+   an aborted migration (but with the source VM left unaffected).
+3. Use of the recent /proc/<pid>/pagemap would likely speed up
+   the use of KSM and ballooning while using RDMA.
+4. Also, some form of balloon-device usage tracking would also
+   help alleviate some issues.
commit 211ea74022f51164a7729030b28eec90b6c99a08
Author: Peter Lieven <pl at kamp.de>
Date:   Mon Jun 10 12:14:20 2013 +0200

    migration: do not overwrite zero pages
    
    on incoming migration do not memset pages to zero if they already read as zero.
    this will allocate a new zero page and consume memory unnecessarily. even
    if we madvise a MADV_DONTNEED later this will only deallocate the memory
    asynchronously.
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index 8bb933f..4dd17f4 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -835,14 +835,16 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
             }
 
             ch = qemu_get_byte(f);
-            memset(host, ch, TARGET_PAGE_SIZE);
+            if (ch != 0 || !is_zero_page(host)) {
+                memset(host, ch, TARGET_PAGE_SIZE);
 #ifndef _WIN32
-            if (ch == 0 &&
-                (!kvm_enabled() || kvm_has_sync_mmu()) &&
-                getpagesize() <= TARGET_PAGE_SIZE) {
-                qemu_madvise(host, TARGET_PAGE_SIZE, QEMU_MADV_DONTNEED);
-            }
+                if (ch == 0 &&
+                    (!kvm_enabled() || kvm_has_sync_mmu()) &&
+                    getpagesize() <= TARGET_PAGE_SIZE) {
+                    qemu_madvise(host, TARGET_PAGE_SIZE, QEMU_MADV_DONTNEED);
+                }
 #endif
+            }
         } else if (flags & RAM_SAVE_FLAG_PAGE) {
             void *host;
 
commit 9ef051e5536b6368a1076046ec6c4ec4ac12b5c6
Author: Peter Lieven <pl at kamp.de>
Date:   Mon Jun 10 12:14:19 2013 +0200

    Revert "migration: do not sent zero pages in bulk stage"
    
    Not sending zero pages breaks migration if a page is zero
    at the source but not at the destination. This can e.g. happen
    if different BIOS versions are used at source and destination.
    It has also been reported that migration on pseries is completely
    broken with this patch.
    
    This effectively reverts commit f1c72795af573b24a7da5eb52375c9aba8a37972.
    
    Conflicts:
    
    	arch_init.c
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index 64421e1..8bb933f 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -457,15 +457,10 @@ static int ram_save_block(QEMUFile *f, bool last_stage)
             bytes_sent = -1;
             if (is_zero_page(p)) {
                 acct_info.dup_pages++;
-                if (!ram_bulk_stage) {
-                    bytes_sent = save_block_hdr(f, block, offset, cont,
-                                                RAM_SAVE_FLAG_COMPRESS);
-                    qemu_put_byte(f, 0);
-                    bytes_sent++;
-                } else {
-                    acct_info.skipped_pages++;
-                    bytes_sent = 0;
-                }
+                bytes_sent = save_block_hdr(f, block, offset, cont,
+                                            RAM_SAVE_FLAG_COMPRESS);
+                qemu_put_byte(f, 0);
+                bytes_sent++;
             } else if (!ram_bulk_stage && migrate_use_xbzrle()) {
                 current_addr = block->offset + offset;
                 bytes_sent = save_xbzrle_page(f, p, current_addr, block,
commit 87d2f8254347879f80b3a834834a6b934dea5ecc
Author: Alon Levy <alevy at redhat.com>
Date:   Sun May 12 14:16:28 2013 +0300

    arch_init/ram_load: add error message for block length mismatch
    
    Makes it easier to debug situations where the source and target have
    different ram blocks in a device and migration fails due to that, for
    instance a BAR size change on a PCI device.
    
    Signed-off-by: Alon Levy <alevy at redhat.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index a8b91ee..64421e1 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -808,6 +808,9 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
                     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
                         if (!strncmp(id, block->idstr, sizeof(id))) {
                             if (block->length != length) {
+                                fprintf(stderr, "Length mismatch: %s: %ld "
+                                        "in != " RAM_ADDR_FMT "\n", id, length,
+                                        block->length);
                                 ret =  -EINVAL;
                                 goto done;
                             }
commit 3e5087329489e0beceecf3426f1216619821937f
Merge: 8c260b1 7426aa7
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Jun 25 14:14:13 2013 -0500

    Merge remote-tracking branch 'pmaydell/arm-devs.for-upstream' into staging
    
    # By Peter Crosthwaite (3) and others
    # Via Peter Maydell
    * pmaydell/arm-devs.for-upstream:
      nand: Don't inherit from Sysbus
      block/nand: Convert Sysbus::init to Device::realize
      block/nand: QOM casting sweep
      i.MX31: Fix PRCS bit test
      arm/boot: Free dtb blob memory after use
      i.MX: Rework functions/types name and use new style initialization
      i.MX: Implement a more complete version of the GPT timer.
      ARM: Allow dumping of device tree
    
    Message-id: 1372184516-32397-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 8c260b1135b15dbfe8843de799eada596167016a
Merge: 9e49c8c bdcc150
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Jun 25 14:14:09 2013 -0500

    Merge remote-tracking branch 'pmaydell/target-arm.for-upstream' into staging
    
    # By Peter Maydell
    # Via Peter Maydell
    * pmaydell/target-arm.for-upstream:
      target-arm: Make LPAE feature imply V7MP
      target-arm: Use tuple list to sync cp regs with KVM
      target-arm: Reinitialize all KVM VCPU registers on reset
      target-arm: Initialize cpreg list from KVM when using KVM
      target-arm: Convert TCG to using (index,value) list for cp migration
      target-arm: mark up cpregs for no-migrate or raw access
      target-arm: Add raw_readfn and raw_writefn to ARMCPRegInfo
      target-arm: Allow special cpregs to have flags set
    
    Message-id: 1372181592-32170-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 9e49c8c58c7aa0eb93e4c83314a07b5c7f6339fe
Merge: 1e5b868 320ce85
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Jun 25 14:14:05 2013 -0500

    Merge remote-tracking branch 'cohuck/virtio-ccw-upstr' into staging
    
    # By Cornelia Huck (2) and Christian Borntraeger (1)
    # Via Cornelia Huck
    * cohuck/virtio-ccw-upstr:
      virtio-ccw: Wire up guest and host notifies.
      virtio-ccw: Wire up ioeventfd.
      s390/virtio-ccw: Fix virtio reset
    
    Message-id: 1372177538-9812-1-git-send-email-cornelia.huck at de.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 1e5b86804ca34913cf5bec5c1240659645774a4e
Merge: baf8673 39ae497
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Jun 25 14:14:00 2013 -0500

    Merge remote-tracking branch 'sstabellini/xen-20130625' into staging
    
    # By Paul Durrant (2) and Stefano Stabellini (1)
    # Via Stefano Stabellini
    * sstabellini/xen-20130625:
      Move hardcoded initialization of xen-platform device.
      Allow use of pc machine type (accel=xen) for Xen HVM domains.
      Revert "xen: start PCI hole at 0xe0000000 (same as pc_init1 and qemu-xen-traditional)"
    
    Message-id: alpine.DEB.2.02.1306251323220.4782 at kaball.uk.xensource.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 7426aa72c36c908a7d0eae3e38568bb0a70de479
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Jun 18 21:12:41 2013 +1000

    nand: Don't inherit from Sysbus
    
    Nand chips are not sysbus devices - they do not have any sense of MMIO,
    nor interrupts. Re-parent to TYPE_DEVICE accordingly.
    
    Cc: afaerber at suse.de
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/block/nand.c b/hw/block/nand.c
index a0232d1..a871ce0 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -21,7 +21,7 @@
 # include "hw/hw.h"
 # include "hw/block/flash.h"
 # include "sysemu/blockdev.h"
-# include "hw/sysbus.h"
+#include "hw/qdev.h"
 #include "qemu/error-report.h"
 
 # define NAND_CMD_READ0		0x00
@@ -54,7 +54,8 @@
 
 typedef struct NANDFlashState NANDFlashState;
 struct NANDFlashState {
-    SysBusDevice busdev;
+    DeviceState parent_obj;
+
     uint8_t manf_id, chip_id;
     uint8_t buswidth; /* in BYTES */
     int size, pages;
@@ -440,7 +441,7 @@ static void nand_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo nand_info = {
     .name          = TYPE_NAND,
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_DEVICE,
     .instance_size = sizeof(NANDFlashState),
     .class_init    = nand_class_init,
 };
commit d47a5d9b9dda19f975320b72c386c581dad32c7a
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Jun 18 21:11:52 2013 +1000

    block/nand: Convert Sysbus::init to Device::realize
    
    The prescribed transition from Sysbus::init function to a
    Device::realize.
    
    Cc: afaerber at suse.de
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/block/nand.c b/hw/block/nand.c
index 861e893..a0232d1 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -367,7 +367,7 @@ static const VMStateDescription vmstate_nand = {
     }
 };
 
-static int nand_device_init(SysBusDevice *dev)
+static void nand_realize(DeviceState *dev, Error **errp)
 {
     int pagesize;
     NANDFlashState *s = NAND(dev);
@@ -393,16 +393,17 @@ static int nand_device_init(SysBusDevice *dev)
         nand_init_2048(s);
         break;
     default:
-        error_report("Unsupported NAND block size");
-        return -1;
+        error_setg(errp, "Unsupported NAND block size %#x\n",
+                   1 << s->page_shift);
+        return;
     }
 
     pagesize = 1 << s->oob_shift;
     s->mem_oob = 1;
     if (s->bdrv) {
         if (bdrv_is_read_only(s->bdrv)) {
-            error_report("Can't use a read-only drive");
-            return -1;
+            error_setg(errp, "Can't use a read-only drive");
+            return;
         }
         if (bdrv_getlength(s->bdrv) >=
                 (s->pages << s->page_shift) + (s->pages << s->oob_shift)) {
@@ -418,8 +419,6 @@ static int nand_device_init(SysBusDevice *dev)
     }
     /* Give s->ioaddr a sane value in case we save state before it is used. */
     s->ioaddr = s->io;
-
-    return 0;
 }
 
 static Property nand_properties[] = {
@@ -432,9 +431,8 @@ static Property nand_properties[] = {
 static void nand_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = nand_device_init;
+    dc->realize = nand_realize;
     dc->reset = nand_reset;
     dc->vmsd = &vmstate_nand;
     dc->props = nand_properties;
commit e12078cc62f2b4a947903efef803ab1b2e13cfa1
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Jun 18 21:10:44 2013 +1000

    block/nand: QOM casting sweep
    
    Define and use standard QOM cast macro. Remove usages of DO_UPCAST and
    direct -> style casting.
    
    Cc: afaerber at suse.de
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/block/nand.c b/hw/block/nand.c
index 43401a0..861e893 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -82,6 +82,11 @@ struct NANDFlashState {
     uint32_t ioaddr_vmstate;
 };
 
+#define TYPE_NAND "nand"
+
+#define NAND(obj) \
+    OBJECT_CHECK(NANDFlashState, (obj), TYPE_NAND)
+
 static void mem_and(uint8_t *dest, const uint8_t *src, size_t n)
 {
     /* Like memcpy() but we logical-AND the data into the destination */
@@ -224,7 +229,7 @@ static const struct {
 
 static void nand_reset(DeviceState *dev)
 {
-    NANDFlashState *s = FROM_SYSBUS(NANDFlashState, SYS_BUS_DEVICE(dev));
+    NANDFlashState *s = NAND(dev);
     s->cmd = NAND_CMD_READ0;
     s->addr = 0;
     s->addrlen = 0;
@@ -279,7 +284,7 @@ static void nand_command(NANDFlashState *s)
         break;
 
     case NAND_CMD_RESET:
-        nand_reset(&s->busdev.qdev);
+        nand_reset(DEVICE(s));
         break;
 
     case NAND_CMD_PAGEPROGRAM1:
@@ -319,14 +324,14 @@ static void nand_command(NANDFlashState *s)
 
 static void nand_pre_save(void *opaque)
 {
-    NANDFlashState *s = opaque;
+    NANDFlashState *s = NAND(opaque);
 
     s->ioaddr_vmstate = s->ioaddr - s->io;
 }
 
 static int nand_post_load(void *opaque, int version_id)
 {
-    NANDFlashState *s = opaque;
+    NANDFlashState *s = NAND(opaque);
 
     if (s->ioaddr_vmstate > sizeof(s->io)) {
         return -EINVAL;
@@ -365,7 +370,7 @@ static const VMStateDescription vmstate_nand = {
 static int nand_device_init(SysBusDevice *dev)
 {
     int pagesize;
-    NANDFlashState *s = FROM_SYSBUS(NANDFlashState, dev);
+    NANDFlashState *s = NAND(dev);
 
     s->buswidth = nand_flash_ids[s->chip_id].width >> 3;
     s->size = nand_flash_ids[s->chip_id].size << 20;
@@ -436,7 +441,7 @@ static void nand_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo nand_info = {
-    .name          = "nand",
+    .name          = TYPE_NAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(NANDFlashState),
     .class_init    = nand_class_init,
@@ -456,7 +461,8 @@ static void nand_register_types(void)
 void nand_setpins(DeviceState *dev, uint8_t cle, uint8_t ale,
                   uint8_t ce, uint8_t wp, uint8_t gnd)
 {
-    NANDFlashState *s = (NANDFlashState *) dev;
+    NANDFlashState *s = NAND(dev);
+
     s->cle = cle;
     s->ale = ale;
     s->ce = ce;
@@ -477,7 +483,8 @@ void nand_getpins(DeviceState *dev, int *rb)
 void nand_setio(DeviceState *dev, uint32_t value)
 {
     int i;
-    NANDFlashState *s = (NANDFlashState *) dev;
+    NANDFlashState *s = NAND(dev);
+
     if (!s->ce && s->cle) {
         if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) {
             if (s->cmd == NAND_CMD_READ0 && value == NAND_CMD_LPREAD2)
@@ -581,7 +588,7 @@ uint32_t nand_getio(DeviceState *dev)
 {
     int offset;
     uint32_t x = 0;
-    NANDFlashState *s = (NANDFlashState *) dev;
+    NANDFlashState *s = NAND(dev);
 
     /* Allow sequential reading */
     if (!s->iolen && s->cmd == NAND_CMD_READ0) {
commit f3c8fac25f119641fd30f2014bfd368a0023769e
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 9 22:44:22 2013 +0200

    i.MX31: Fix PRCS bit test
    
    cppcheck detected a condition which was always false.
    
    According to the MCIMX31 Reference Manual, the PRCS bits have to be 01
    to select the Frequency Pre-Multiplier (FPM). PRCS uses bits 1 and 2,
    so we have to test for 2.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Peter Chubb <peter.chubb at nicta.com.au>
    Message-id: 1370810662-32320-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
index c153a24..427ce5c 100644
--- a/hw/misc/imx_ccm.c
+++ b/hw/misc/imx_ccm.c
@@ -153,7 +153,7 @@ static void update_clocks(IMXCCMState *s)
      * approach
      */
 
-    if ((s->ccmr & CCMR_PRCS) == 1) {
+    if ((s->ccmr & CCMR_PRCS) == 2) {
         s->pll_refclk_freq = CKIL_FREQ * 1024;
     } else {
         s->pll_refclk_freq = CKIH_FREQ;
commit c23045ded7571f0eaad95920ab00b6bc9c3a91e6
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:34:13 2013 +0100

    arm/boot: Free dtb blob memory after use
    
    The dtb blob returned by load_device_tree() is in memory allocated
    with g_malloc(). Free it accordingly once we have copied its
    contents into the guest memory. To make this easy, we need also to
    clean up the error handling in load_dtb() so that we consistently
    handle errors in the same way (by printing a message and then
    returning -1, rather than either plowing on or exiting immediately).
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1371209256-11408-1-git-send-email-peter.maydell at linaro.org

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 797c691..7c0090f 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -237,14 +237,14 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, binfo->dtb_filename);
     if (!filename) {
         fprintf(stderr, "Couldn't open dtb file %s\n", binfo->dtb_filename);
-        return -1;
+        goto fail;
     }
 
     fdt = load_device_tree(filename, &size);
     if (!fdt) {
         fprintf(stderr, "Couldn't open dtb file %s\n", filename);
         g_free(filename);
-        return -1;
+        goto fail;
     }
     g_free(filename);
 
@@ -252,7 +252,7 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
     scells = qemu_devtree_getprop_cell(fdt, "/", "#size-cells");
     if (acells == 0 || scells == 0) {
         fprintf(stderr, "dtb file invalid (#address-cells or #size-cells 0)\n");
-        return -1;
+        goto fail;
     }
 
     mem_reg_propsize = acells + scells;
@@ -264,7 +264,7 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
     } else if (hival != 0) {
         fprintf(stderr, "qemu: dtb file not compatible with "
                 "RAM start address > 4GB\n");
-        exit(1);
+        goto fail;
     }
     mem_reg_property[acells + scells - 1] = cpu_to_be32(binfo->ram_size);
     hival = cpu_to_be32(binfo->ram_size >> 32);
@@ -273,13 +273,14 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
     } else if (hival != 0) {
         fprintf(stderr, "qemu: dtb file not compatible with "
                 "RAM size > 4GB\n");
-        exit(1);
+        goto fail;
     }
 
     rc = qemu_devtree_setprop(fdt, "/memory", "reg", mem_reg_property,
                               mem_reg_propsize * sizeof(uint32_t));
     if (rc < 0) {
         fprintf(stderr, "couldn't set /memory/reg\n");
+        goto fail;
     }
 
     if (binfo->kernel_cmdline && *binfo->kernel_cmdline) {
@@ -287,6 +288,7 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
                                           binfo->kernel_cmdline);
         if (rc < 0) {
             fprintf(stderr, "couldn't set /chosen/bootargs\n");
+            goto fail;
         }
     }
 
@@ -295,19 +297,27 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
                 binfo->initrd_start);
         if (rc < 0) {
             fprintf(stderr, "couldn't set /chosen/linux,initrd-start\n");
+            goto fail;
         }
 
         rc = qemu_devtree_setprop_cell(fdt, "/chosen", "linux,initrd-end",
                     binfo->initrd_start + binfo->initrd_size);
         if (rc < 0) {
             fprintf(stderr, "couldn't set /chosen/linux,initrd-end\n");
+            goto fail;
         }
     }
     qemu_devtree_dumpdtb(fdt, size);
 
     cpu_physical_memory_write(addr, fdt, size);
 
+    g_free(fdt);
+
     return 0;
+
+fail:
+    g_free(fdt);
+    return -1;
 }
 
 static void do_cpu_reset(void *opaque)
commit 67110c3e010088d45bf0b396fca2aa8cd48ff9d0
Author: Jean-Christophe DUBOIS <jcd at tribudubois.net>
Date:   Tue Jun 25 18:34:13 2013 +0100

    i.MX: Rework functions/types name and use new style initialization
    
    * use dynamic cast whenever possible
    * Change function names to some more meaningful prefix
    * Change type names to a more meaningful one
    * use new style device initialization
    
    Signed-off-by: Jean-Christophe DUBOIS <jcd at tribudubois.net>
    Message-id: 1369898943-1993-3-git-send-email-jcd at tribudubois.net
    Reviewed-by: Peter Chubb <peter.chubb at nicta.com.au>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index ecf6e53..de53b13 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -27,7 +27,7 @@
 #define DEBUG_TIMER 0
 #if DEBUG_TIMER
 
-static char const *imx_timerg_reg_name(uint32_t reg)
+static char const *imx_gpt_reg_name(uint32_t reg)
 {
     switch (reg) {
     case 0:
@@ -67,12 +67,14 @@ static char const *imx_timerg_reg_name(uint32_t reg)
  */
 #define DEBUG_IMPLEMENTATION 1
 #if DEBUG_IMPLEMENTATION
-#  define IPRINTF(fmt, args...)                                         \
+#  define IPRINTF(fmt, args...) \
           do { fprintf(stderr, "%s: " fmt, __func__, ##args); } while (0)
 #else
 #  define IPRINTF(fmt, args...) do {} while (0)
 #endif
 
+#define IMX_GPT(obj) \
+        OBJECT_CHECK(IMXGPTState, (obj), TYPE_IMX_GPT)
 /*
  * GPT : General purpose timer
  *
@@ -137,33 +139,33 @@ typedef struct {
     uint32_t freq;
 
     qemu_irq irq;
-} IMXTimerGState;
+} IMXGPTState;
 
-static const VMStateDescription vmstate_imx_timerg = {
+static const VMStateDescription vmstate_imx_timer_gpt = {
     .name = TYPE_IMX_GPT,
     .version_id = 3,
     .minimum_version_id = 3,
     .minimum_version_id_old = 3,
     .fields      = (VMStateField[]) {
-        VMSTATE_UINT32(cr, IMXTimerGState),
-        VMSTATE_UINT32(pr, IMXTimerGState),
-        VMSTATE_UINT32(sr, IMXTimerGState),
-        VMSTATE_UINT32(ir, IMXTimerGState),
-        VMSTATE_UINT32(ocr1, IMXTimerGState),
-        VMSTATE_UINT32(ocr2, IMXTimerGState),
-        VMSTATE_UINT32(ocr3, IMXTimerGState),
-        VMSTATE_UINT32(icr1, IMXTimerGState),
-        VMSTATE_UINT32(icr2, IMXTimerGState),
-        VMSTATE_UINT32(cnt, IMXTimerGState),
-        VMSTATE_UINT32(next_timeout, IMXTimerGState),
-        VMSTATE_UINT32(next_int, IMXTimerGState),
-        VMSTATE_UINT32(freq, IMXTimerGState),
-        VMSTATE_PTIMER(timer, IMXTimerGState),
+        VMSTATE_UINT32(cr, IMXGPTState),
+        VMSTATE_UINT32(pr, IMXGPTState),
+        VMSTATE_UINT32(sr, IMXGPTState),
+        VMSTATE_UINT32(ir, IMXGPTState),
+        VMSTATE_UINT32(ocr1, IMXGPTState),
+        VMSTATE_UINT32(ocr2, IMXGPTState),
+        VMSTATE_UINT32(ocr3, IMXGPTState),
+        VMSTATE_UINT32(icr1, IMXGPTState),
+        VMSTATE_UINT32(icr2, IMXGPTState),
+        VMSTATE_UINT32(cnt, IMXGPTState),
+        VMSTATE_UINT32(next_timeout, IMXGPTState),
+        VMSTATE_UINT32(next_int, IMXGPTState),
+        VMSTATE_UINT32(freq, IMXGPTState),
+        VMSTATE_PTIMER(timer, IMXGPTState),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static const IMXClk imx_timerg_clocks[] = {
+static const IMXClk imx_gpt_clocks[] = {
     NOCLK,    /* 000 No clock source */
     IPG,      /* 001 ipg_clk, 532MHz*/
     IPG,      /* 010 ipg_clk_highfreq */
@@ -174,10 +176,10 @@ static const IMXClk imx_timerg_clocks[] = {
     NOCLK,    /* 111 not defined */
 };
 
-static void imx_timerg_set_freq(IMXTimerGState *s)
+static void imx_gpt_set_freq(IMXGPTState *s)
 {
     uint32_t clksrc = extract32(s->cr, GPT_CR_CLKSRC_SHIFT, 3);
-    uint32_t freq = imx_clock_frequency(s->ccm, imx_timerg_clocks[clksrc])
+    uint32_t freq = imx_clock_frequency(s->ccm, imx_gpt_clocks[clksrc])
                                                 / (1 + s->pr);
     s->freq = freq;
 
@@ -188,7 +190,7 @@ static void imx_timerg_set_freq(IMXTimerGState *s)
     }
 }
 
-static void imx_timerg_update(IMXTimerGState *s)
+static void imx_gpt_update_int(IMXGPTState *s)
 {
     if ((s->sr & s->ir) && (s->cr & GPT_CR_EN)) {
         qemu_irq_raise(s->irq);
@@ -197,14 +199,14 @@ static void imx_timerg_update(IMXTimerGState *s)
     }
 }
 
-static uint32_t imx_timerg_update_counts(IMXTimerGState *s)
+static uint32_t imx_gpt_update_count(IMXGPTState *s)
 {
     s->cnt = s->next_timeout - (uint32_t)ptimer_get_count(s->timer);
 
     return s->cnt;
 }
 
-static inline uint32_t imx_timerg_find_limit(uint32_t count, uint32_t reg,
+static inline uint32_t imx_gpt_find_limit(uint32_t count, uint32_t reg,
                                              uint32_t timeout)
 {
     if ((count < reg) && (timeout > reg)) {
@@ -214,7 +216,7 @@ static inline uint32_t imx_timerg_find_limit(uint32_t count, uint32_t reg,
     return timeout;
 }
 
-static void imx_timerg_compute_next_timeout(IMXTimerGState *s, bool event)
+static void imx_gpt_compute_next_timeout(IMXGPTState *s, bool event)
 {
     uint32_t timeout = TIMER_MAX;
     uint32_t count = 0;
@@ -233,24 +235,24 @@ static void imx_timerg_compute_next_timeout(IMXTimerGState *s, bool event)
              * if we are in free running mode and we have not reached
              * the TIMER_MAX limit, then update the count
              */
-            count = imx_timerg_update_counts(s);
+            count = imx_gpt_update_count(s);
         }
     } else {
         /* not a timer event, then just update the count */
 
-        count = imx_timerg_update_counts(s);
+        count = imx_gpt_update_count(s);
     }
 
     /* now, find the next timeout related to count */
 
     if (s->ir & GPT_IR_OF1IE) {
-        timeout = imx_timerg_find_limit(count, s->ocr1, timeout);
+        timeout = imx_gpt_find_limit(count, s->ocr1, timeout);
     }
     if (s->ir & GPT_IR_OF2IE) {
-        timeout = imx_timerg_find_limit(count, s->ocr2, timeout);
+        timeout = imx_gpt_find_limit(count, s->ocr2, timeout);
     }
     if (s->ir & GPT_IR_OF3IE) {
-        timeout = imx_timerg_find_limit(count, s->ocr3, timeout);
+        timeout = imx_gpt_find_limit(count, s->ocr3, timeout);
     }
 
     /* find the next set of interrupts to raise for next timer event */
@@ -270,7 +272,7 @@ static void imx_timerg_compute_next_timeout(IMXTimerGState *s, bool event)
     }
 
     /* the new range to count down from */
-    limit = timeout - imx_timerg_update_counts(s);
+    limit = timeout - imx_gpt_update_count(s);
 
     if (limit < 0) {
         /*
@@ -280,9 +282,9 @@ static void imx_timerg_compute_next_timeout(IMXTimerGState *s, bool event)
          */
         s->sr |= s->next_int;
 
-        imx_timerg_compute_next_timeout(s, event);
+        imx_gpt_compute_next_timeout(s, event);
 
-        imx_timerg_update(s);
+        imx_gpt_update_int(s);
     } else {
         /* New timeout value */
         s->next_timeout = timeout;
@@ -292,10 +294,9 @@ static void imx_timerg_compute_next_timeout(IMXTimerGState *s, bool event)
     }
 }
 
-static uint64_t imx_timerg_read(void *opaque, hwaddr offset,
-                                unsigned size)
+static uint64_t imx_gpt_read(void *opaque, hwaddr offset, unsigned size)
 {
-    IMXTimerGState *s = (IMXTimerGState *)opaque;
+    IMXGPTState *s = IMX_GPT(opaque);
     uint32_t reg_value = 0;
     uint32_t reg = offset >> 2;
 
@@ -339,7 +340,7 @@ static uint64_t imx_timerg_read(void *opaque, hwaddr offset,
         break;
 
     case 9: /* cnt */
-        imx_timerg_update_counts(s);
+        imx_gpt_update_count(s);
         reg_value = s->cnt;
         break;
 
@@ -348,14 +349,14 @@ static uint64_t imx_timerg_read(void *opaque, hwaddr offset,
         break;
     }
 
-    DPRINTF("(%s) = 0x%08x\n", imx_timerg_reg_name(reg), reg_value);
+    DPRINTF("(%s) = 0x%08x\n", imx_gpt_reg_name(reg), reg_value);
 
     return reg_value;
 }
 
-static void imx_timerg_reset(DeviceState *dev)
+static void imx_gpt_reset(DeviceState *dev)
 {
-    IMXTimerGState *s = container_of(dev, IMXTimerGState, busdev.qdev);
+    IMXGPTState *s = IMX_GPT(dev);
 
     /* stop timer */
     ptimer_stop(s->timer);
@@ -379,7 +380,7 @@ static void imx_timerg_reset(DeviceState *dev)
     s->next_int = 0;
 
     /* compute new freq */
-    imx_timerg_set_freq(s);
+    imx_gpt_set_freq(s);
 
     /* reset the limit to TIMER_MAX */
     ptimer_set_limit(s->timer, TIMER_MAX, 1);
@@ -390,14 +391,14 @@ static void imx_timerg_reset(DeviceState *dev)
     }
 }
 
-static void imx_timerg_write(void *opaque, hwaddr offset,
-                             uint64_t value, unsigned size)
+static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
+                          unsigned size)
 {
-    IMXTimerGState *s = (IMXTimerGState *)opaque;
+    IMXGPTState *s = IMX_GPT(opaque);
     uint32_t oldreg;
     uint32_t reg = offset >> 2;
 
-    DPRINTF("(%s, value = 0x%08x)\n", imx_timerg_reg_name(reg),
+    DPRINTF("(%s, value = 0x%08x)\n", imx_gpt_reg_name(reg),
             (uint32_t)value);
 
     switch (reg) {
@@ -406,17 +407,17 @@ static void imx_timerg_write(void *opaque, hwaddr offset,
         s->cr = value & ~0x7c14;
         if (s->cr & GPT_CR_SWR) { /* force reset */
             /* handle the reset */
-            imx_timerg_reset(DEVICE(s));
+            imx_gpt_reset(DEVICE(s));
         } else {
             /* set our freq, as the source might have changed */
-            imx_timerg_set_freq(s);
+            imx_gpt_set_freq(s);
 
             if ((oldreg ^ s->cr) & GPT_CR_EN) {
                 if (s->cr & GPT_CR_EN) {
                     if (s->cr & GPT_CR_ENMOD) {
                         s->next_timeout = TIMER_MAX;
                         ptimer_set_count(s->timer, TIMER_MAX);
-                        imx_timerg_compute_next_timeout(s, false);
+                        imx_gpt_compute_next_timeout(s, false);
                     }
                     ptimer_run(s->timer, 1);
                 } else {
@@ -429,19 +430,19 @@ static void imx_timerg_write(void *opaque, hwaddr offset,
 
     case 1: /* Prescaler */
         s->pr = value & 0xfff;
-        imx_timerg_set_freq(s);
+        imx_gpt_set_freq(s);
         break;
 
     case 2: /* SR */
         s->sr &= ~(value & 0x3f);
-        imx_timerg_update(s);
+        imx_gpt_update_int(s);
         break;
 
     case 3: /* IR -- interrupt register */
         s->ir = value & 0x3f;
-        imx_timerg_update(s);
+        imx_gpt_update_int(s);
 
-        imx_timerg_compute_next_timeout(s, false);
+        imx_gpt_compute_next_timeout(s, false);
 
         break;
 
@@ -455,7 +456,7 @@ static void imx_timerg_write(void *opaque, hwaddr offset,
         }
 
         /* compute the new timeout */
-        imx_timerg_compute_next_timeout(s, false);
+        imx_gpt_compute_next_timeout(s, false);
 
         break;
 
@@ -463,7 +464,7 @@ static void imx_timerg_write(void *opaque, hwaddr offset,
         s->ocr2 = value;
 
         /* compute the new timeout */
-        imx_timerg_compute_next_timeout(s, false);
+        imx_gpt_compute_next_timeout(s, false);
 
         break;
 
@@ -471,7 +472,7 @@ static void imx_timerg_write(void *opaque, hwaddr offset,
         s->ocr3 = value;
 
         /* compute the new timeout */
-        imx_timerg_compute_next_timeout(s, false);
+        imx_gpt_compute_next_timeout(s, false);
 
         break;
 
@@ -481,80 +482,76 @@ static void imx_timerg_write(void *opaque, hwaddr offset,
     }
 }
 
-static void imx_timerg_timeout(void *opaque)
+static void imx_gpt_timeout(void *opaque)
 {
-    IMXTimerGState *s = (IMXTimerGState *)opaque;
+    IMXGPTState *s = IMX_GPT(opaque);
 
     DPRINTF("\n");
 
     s->sr |= s->next_int;
     s->next_int = 0;
 
-    imx_timerg_compute_next_timeout(s, true);
+    imx_gpt_compute_next_timeout(s, true);
 
-    imx_timerg_update(s);
+    imx_gpt_update_int(s);
 
     if (s->freq && (s->cr & GPT_CR_EN)) {
         ptimer_run(s->timer, 1);
     }
 }
 
-static const MemoryRegionOps imx_timerg_ops = {
-    .read = imx_timerg_read,
-    .write = imx_timerg_write,
+static const MemoryRegionOps imx_gpt_ops = {
+    .read = imx_gpt_read,
+    .write = imx_gpt_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
 
-static int imx_timerg_init(SysBusDevice *dev)
+static void imx_gpt_realize(DeviceState *dev, Error **errp)
 {
-    IMXTimerGState *s = FROM_SYSBUS(IMXTimerGState, dev);
+    IMXGPTState *s = IMX_GPT(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     QEMUBH *bh;
 
-    sysbus_init_irq(dev, &s->irq);
-    memory_region_init_io(&s->iomem, &imx_timerg_ops,
-                          s, TYPE_IMX_GPT,
+    sysbus_init_irq(sbd, &s->irq);
+    memory_region_init_io(&s->iomem, &imx_gpt_ops, s, TYPE_IMX_GPT,
                           0x00001000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    bh = qemu_bh_new(imx_timerg_timeout, s);
+    bh = qemu_bh_new(imx_gpt_timeout, s);
     s->timer = ptimer_init(bh);
-
-    /* Hard reset resets extra bits in CR */
-    s->cr = 0;
-    return 0;
 }
 
 void imx_timerg_create(const hwaddr addr, qemu_irq irq, DeviceState *ccm)
 {
-    IMXTimerGState *pp;
+    IMXGPTState *pp;
     DeviceState *dev;
 
     dev = sysbus_create_simple(TYPE_IMX_GPT, addr, irq);
-    pp = container_of(dev, IMXTimerGState, busdev.qdev);
+    pp = IMX_GPT(dev);
     pp->ccm = ccm;
 }
 
-static void imx_timerg_class_init(ObjectClass *klass, void *data)
+static void imx_gpt_class_init(ObjectClass *klass, void *data)
 {
-    DeviceClass *dc  = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-    k->init = imx_timerg_init;
-    dc->vmsd = &vmstate_imx_timerg;
-    dc->reset = imx_timerg_reset;
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = imx_gpt_realize;
+    dc->reset = imx_gpt_reset;
+    dc->vmsd = &vmstate_imx_timer_gpt;
     dc->desc = "i.MX general timer";
 }
 
-static const TypeInfo imx_timerg_info = {
+static const TypeInfo imx_gpt_info = {
     .name = TYPE_IMX_GPT,
     .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(IMXTimerGState),
-    .class_init = imx_timerg_class_init,
+    .instance_size = sizeof(IMXGPTState),
+    .class_init = imx_gpt_class_init,
 };
 
-static void imx_timer_register_types(void)
+static void imx_gpt_register_types(void)
 {
-    type_register_static(&imx_timerg_info);
+    type_register_static(&imx_gpt_info);
 }
 
-type_init(imx_timer_register_types)
+type_init(imx_gpt_register_types)
commit 5ec694b52a3a486fbc5a6eb6d6da4692c27d6575
Author: Jean-Christophe DUBOIS <jcd at tribudubois.net>
Date:   Tue Jun 25 18:34:13 2013 +0100

    i.MX: Implement a more complete version of the GPT timer.
    
    * implement compare 1 2 and 3 registers
    * simplify Debug printf
    
    Signed-off-by: Jean-Christophe DUBOIS <jcd at tribudubois.net>
    Message-id: 1369898943-1993-2-git-send-email-jcd at tribudubois.net
    Reviewed-by: Peter Chubb <peter.chubb at nicta.com.au>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index d8c4f0b..ecf6e53 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -5,6 +5,7 @@
  * Copyright (c) 2011 NICTA Pty Ltd
  * Originally written by Hans Jiang
  * Updated by Peter Chubb
+ * Updated by Jean-Christophe Dubois
  *
  * This code is licensed under GPL version 2 or later.  See
  * the COPYING file in the top-level directory.
@@ -18,10 +19,44 @@
 #include "hw/sysbus.h"
 #include "hw/arm/imx.h"
 
-//#define DEBUG_TIMER 1
-#ifdef DEBUG_TIMER
+#define TYPE_IMX_GPT "imx.gpt"
+
+/*
+ * Define to 1 for debug messages
+ */
+#define DEBUG_TIMER 0
+#if DEBUG_TIMER
+
+static char const *imx_timerg_reg_name(uint32_t reg)
+{
+    switch (reg) {
+    case 0:
+        return "CR";
+    case 1:
+        return "PR";
+    case 2:
+        return "SR";
+    case 3:
+        return "IR";
+    case 4:
+        return "OCR1";
+    case 5:
+        return "OCR2";
+    case 6:
+        return "OCR3";
+    case 7:
+        return "ICR1";
+    case 8:
+        return "ICR2";
+    case 9:
+        return "CNT";
+    default:
+        return "[?]";
+    }
+}
+
 #  define DPRINTF(fmt, args...) \
-      do { printf("imx_timer: " fmt , ##args); } while (0)
+          do { printf("%s: " fmt , __func__, ##args); } while (0)
 #else
 #  define DPRINTF(fmt, args...) do {} while (0)
 #endif
@@ -33,7 +68,7 @@
 #define DEBUG_IMPLEMENTATION 1
 #if DEBUG_IMPLEMENTATION
 #  define IPRINTF(fmt, args...)                                         \
-    do  { fprintf(stderr, "imx_timer: " fmt, ##args); } while (0)
+          do { fprintf(stderr, "%s: " fmt, __func__, ##args); } while (0)
 #else
 #  define IPRINTF(fmt, args...) do {} while (0)
 #endif
@@ -43,16 +78,7 @@
  *
  * This timer counts up continuously while it is enabled, resetting itself
  * to 0 when it reaches TIMER_MAX (in freerun mode) or when it
- * reaches the value of ocr1 (in periodic mode).  WE simulate this using a
- * QEMU ptimer counting down from ocr1 and reloading from ocr1 in
- * periodic mode, or counting from ocr1 to zero, then TIMER_MAX - ocr1.
- * waiting_rov is set when counting from TIMER_MAX.
- *
- * In the real hardware, there are three comparison registers that can
- * trigger interrupts, and compare channel 1 can be used to
- * force-reset the timer. However, this is a `bare-bones'
- * implementation: only what Linux 3.x uses has been implemented
- * (free-running timer from 0 to OCR1 or TIMER_MAX) .
+ * reaches the value of one of the ocrX (in periodic mode).
  */
 
 #define TIMER_MAX  0XFFFFFFFFUL
@@ -79,9 +105,13 @@
 #define GPT_CR_FO3    (1 << 31) /* Force Output Compare Channel 3 */
 
 #define GPT_SR_OF1  (1 << 0)
+#define GPT_SR_OF2  (1 << 1)
+#define GPT_SR_OF3  (1 << 2)
 #define GPT_SR_ROV  (1 << 5)
 
 #define GPT_IR_OF1IE  (1 << 0)
+#define GPT_IR_OF2IE  (1 << 1)
+#define GPT_IR_OF3IE  (1 << 2)
 #define GPT_IR_ROVIE  (1 << 5)
 
 typedef struct {
@@ -101,15 +131,19 @@ typedef struct {
     uint32_t icr2;
     uint32_t cnt;
 
-    uint32_t waiting_rov;
+    uint32_t next_timeout;
+    uint32_t next_int;
+
+    uint32_t freq;
+
     qemu_irq irq;
 } IMXTimerGState;
 
 static const VMStateDescription vmstate_imx_timerg = {
-    .name = "imx-timerg",
-    .version_id = 2,
-    .minimum_version_id = 2,
-    .minimum_version_id_old = 2,
+    .name = TYPE_IMX_GPT,
+    .version_id = 3,
+    .minimum_version_id = 3,
+    .minimum_version_id_old = 3,
     .fields      = (VMStateField[]) {
         VMSTATE_UINT32(cr, IMXTimerGState),
         VMSTATE_UINT32(pr, IMXTimerGState),
@@ -121,7 +155,9 @@ static const VMStateDescription vmstate_imx_timerg = {
         VMSTATE_UINT32(icr1, IMXTimerGState),
         VMSTATE_UINT32(icr2, IMXTimerGState),
         VMSTATE_UINT32(cnt, IMXTimerGState),
-        VMSTATE_UINT32(waiting_rov, IMXTimerGState),
+        VMSTATE_UINT32(next_timeout, IMXTimerGState),
+        VMSTATE_UINT32(next_int, IMXTimerGState),
+        VMSTATE_UINT32(freq, IMXTimerGState),
         VMSTATE_PTIMER(timer, IMXTimerGState),
         VMSTATE_END_OF_LIST()
     }
@@ -138,16 +174,14 @@ static const IMXClk imx_timerg_clocks[] = {
     NOCLK,    /* 111 not defined */
 };
 
-
 static void imx_timerg_set_freq(IMXTimerGState *s)
 {
-    int clksrc;
-    uint32_t freq;
-
-    clksrc = (s->cr >> GPT_CR_CLKSRC_SHIFT) & GPT_CR_CLKSRC_MASK;
-    freq = imx_clock_frequency(s->ccm, imx_timerg_clocks[clksrc]) / (1 + s->pr);
+    uint32_t clksrc = extract32(s->cr, GPT_CR_CLKSRC_SHIFT, 3);
+    uint32_t freq = imx_clock_frequency(s->ccm, imx_timerg_clocks[clksrc])
+                                                / (1 + s->pr);
+    s->freq = freq;
 
-    DPRINTF("Setting gtimer clksrc %d to frequency %d\n", clksrc, freq);
+    DPRINTF("Setting clksrc %d to frequency %d\n", clksrc, freq);
 
     if (freq) {
         ptimer_set_freq(s->timer, freq);
@@ -156,111 +190,176 @@ static void imx_timerg_set_freq(IMXTimerGState *s)
 
 static void imx_timerg_update(IMXTimerGState *s)
 {
-    uint32_t flags = s->sr & s->ir & (GPT_SR_OF1 | GPT_SR_ROV);
-
-    DPRINTF("g-timer SR: %s %s IR=%s %s, %s\n",
-            s->sr & GPT_SR_OF1 ? "OF1" : "",
-            s->sr & GPT_SR_ROV ? "ROV" : "",
-            s->ir & GPT_SR_OF1 ? "OF1" : "",
-            s->ir & GPT_SR_ROV ? "ROV" : "",
-            s->cr & GPT_CR_EN ? "CR_EN" : "Not Enabled");
-
-    qemu_set_irq(s->irq, (s->cr & GPT_CR_EN) && flags);
+    if ((s->sr & s->ir) && (s->cr & GPT_CR_EN)) {
+        qemu_irq_raise(s->irq);
+    } else {
+        qemu_irq_lower(s->irq);
+    }
 }
 
 static uint32_t imx_timerg_update_counts(IMXTimerGState *s)
 {
-    uint64_t target = s->waiting_rov ? TIMER_MAX : s->ocr1;
-    uint64_t cnt = ptimer_get_count(s->timer);
-    s->cnt = target - cnt;
+    s->cnt = s->next_timeout - (uint32_t)ptimer_get_count(s->timer);
+
     return s->cnt;
 }
 
-static void imx_timerg_reload(IMXTimerGState *s, uint32_t timeout)
+static inline uint32_t imx_timerg_find_limit(uint32_t count, uint32_t reg,
+                                             uint32_t timeout)
 {
-    uint64_t diff_cnt;
+    if ((count < reg) && (timeout > reg)) {
+        timeout = reg;
+    }
+
+    return timeout;
+}
 
-    if (!(s->cr & GPT_CR_FRR)) {
-        IPRINTF("IMX_timerg_reload --- called in reset-mode\n");
+static void imx_timerg_compute_next_timeout(IMXTimerGState *s, bool event)
+{
+    uint32_t timeout = TIMER_MAX;
+    uint32_t count = 0;
+    long long limit;
+
+    if (!(s->cr & GPT_CR_EN)) {
+        /* if not enabled just return */
         return;
     }
 
-    /*
-     * For small timeouts, qemu sometimes runs too slow.
-     * Better deliver a late interrupt than none.
-     *
-     * In Reset mode (FRR bit clear)
-     * the ptimer reloads itself from OCR1;
-     * in free-running mode we need to fake
-     * running from 0 to ocr1 to TIMER_MAX
-     */
-    if (timeout > s->cnt) {
-        diff_cnt = timeout - s->cnt;
+    if (event) {
+        /* This is a timer event  */
+
+        if ((s->cr & GPT_CR_FRR)  && (s->next_timeout != TIMER_MAX)) {
+            /*
+             * if we are in free running mode and we have not reached
+             * the TIMER_MAX limit, then update the count
+             */
+            count = imx_timerg_update_counts(s);
+        }
     } else {
-        diff_cnt = 0;
+        /* not a timer event, then just update the count */
+
+        count = imx_timerg_update_counts(s);
+    }
+
+    /* now, find the next timeout related to count */
+
+    if (s->ir & GPT_IR_OF1IE) {
+        timeout = imx_timerg_find_limit(count, s->ocr1, timeout);
+    }
+    if (s->ir & GPT_IR_OF2IE) {
+        timeout = imx_timerg_find_limit(count, s->ocr2, timeout);
+    }
+    if (s->ir & GPT_IR_OF3IE) {
+        timeout = imx_timerg_find_limit(count, s->ocr3, timeout);
+    }
+
+    /* find the next set of interrupts to raise for next timer event */
+
+    s->next_int = 0;
+    if ((s->ir & GPT_IR_OF1IE) && (timeout == s->ocr1)) {
+        s->next_int |= GPT_SR_OF1;
+    }
+    if ((s->ir & GPT_IR_OF2IE) && (timeout == s->ocr2)) {
+        s->next_int |= GPT_SR_OF2;
+    }
+    if ((s->ir & GPT_IR_OF3IE) && (timeout == s->ocr3)) {
+        s->next_int |= GPT_SR_OF3;
+    }
+    if ((s->ir & GPT_IR_ROVIE) && (timeout == TIMER_MAX)) {
+        s->next_int |= GPT_SR_ROV;
+    }
+
+    /* the new range to count down from */
+    limit = timeout - imx_timerg_update_counts(s);
+
+    if (limit < 0) {
+        /*
+         * if we reach here, then QEMU is running too slow and we pass the
+         * timeout limit while computing it. Let's deliver the interrupt
+         * and compute a new limit.
+         */
+        s->sr |= s->next_int;
+
+        imx_timerg_compute_next_timeout(s, event);
+
+        imx_timerg_update(s);
+    } else {
+        /* New timeout value */
+        s->next_timeout = timeout;
+
+        /* reset the limit to the computed range */
+        ptimer_set_limit(s->timer, limit, 1);
     }
-    ptimer_set_count(s->timer, diff_cnt);
 }
 
 static uint64_t imx_timerg_read(void *opaque, hwaddr offset,
                                 unsigned size)
 {
     IMXTimerGState *s = (IMXTimerGState *)opaque;
+    uint32_t reg_value = 0;
+    uint32_t reg = offset >> 2;
 
-    DPRINTF("g-read(offset=%x)", (unsigned int)(offset >> 2));
-    switch (offset >> 2) {
+    switch (reg) {
     case 0: /* Control Register */
-        DPRINTF(" cr = %x\n", s->cr);
-        return s->cr;
+        reg_value = s->cr;
+        break;
 
     case 1: /* prescaler */
-        DPRINTF(" pr = %x\n", s->pr);
-        return s->pr;
+        reg_value = s->pr;
+        break;
 
     case 2: /* Status Register */
-        DPRINTF(" sr = %x\n", s->sr);
-        return s->sr;
+        reg_value = s->sr;
+        break;
 
     case 3: /* Interrupt Register */
-        DPRINTF(" ir = %x\n", s->ir);
-        return s->ir;
+        reg_value = s->ir;
+        break;
 
     case 4: /* Output Compare Register 1 */
-        DPRINTF(" ocr1 = %x\n", s->ocr1);
-        return s->ocr1;
+        reg_value = s->ocr1;
+        break;
 
     case 5: /* Output Compare Register 2 */
-        DPRINTF(" ocr2 = %x\n", s->ocr2);
-        return s->ocr2;
+        reg_value = s->ocr2;
+        break;
 
     case 6: /* Output Compare Register 3 */
-        DPRINTF(" ocr3 = %x\n", s->ocr3);
-        return s->ocr3;
+        reg_value = s->ocr3;
+        break;
 
     case 7: /* input Capture Register 1 */
-        DPRINTF(" icr1 = %x\n", s->icr1);
-        return s->icr1;
+        qemu_log_mask(LOG_UNIMP, "icr1 feature is not implemented\n");
+        reg_value = s->icr1;
+        break;
 
     case 8: /* input Capture Register 2 */
-        DPRINTF(" icr2 = %x\n", s->icr2);
-        return s->icr2;
+        qemu_log_mask(LOG_UNIMP, "icr2 feature is not implemented\n");
+        reg_value = s->icr2;
+        break;
 
     case 9: /* cnt */
         imx_timerg_update_counts(s);
-        DPRINTF(" cnt = %x\n", s->cnt);
-        return s->cnt;
+        reg_value = s->cnt;
+        break;
+
+    default:
+        IPRINTF("Bad offset %x\n", reg);
+        break;
     }
 
-    IPRINTF("imx_timerg_read: Bad offset %x\n",
-            (int)offset >> 2);
+    DPRINTF("(%s) = 0x%08x\n", imx_timerg_reg_name(reg), reg_value);
 
-    return 0;
+    return reg_value;
 }
 
 static void imx_timerg_reset(DeviceState *dev)
 {
     IMXTimerGState *s = container_of(dev, IMXTimerGState, busdev.qdev);
 
+    /* stop timer */
+    ptimer_stop(s->timer);
+
     /*
      * Soft reset doesn't touch some bits; hard reset clears them
      */
@@ -275,89 +374,110 @@ static void imx_timerg_reset(DeviceState *dev)
     s->ocr3 = TIMER_MAX;
     s->icr1 = 0;
     s->icr2 = 0;
-    ptimer_stop(s->timer);
-    ptimer_set_limit(s->timer, TIMER_MAX, 1);
-    ptimer_set_count(s->timer, TIMER_MAX);
+
+    s->next_timeout = TIMER_MAX;
+    s->next_int = 0;
+
+    /* compute new freq */
     imx_timerg_set_freq(s);
+
+    /* reset the limit to TIMER_MAX */
+    ptimer_set_limit(s->timer, TIMER_MAX, 1);
+
+    /* if the timer is still enabled, restart it */
+    if (s->freq && (s->cr & GPT_CR_EN)) {
+        ptimer_run(s->timer, 1);
+    }
 }
 
 static void imx_timerg_write(void *opaque, hwaddr offset,
                              uint64_t value, unsigned size)
 {
     IMXTimerGState *s = (IMXTimerGState *)opaque;
-    DPRINTF("g-write(offset=%x, value = 0x%x)\n", (unsigned int)offset >> 2,
-            (unsigned int)value);
-
-    switch (offset >> 2) {
-    case 0: {
-        uint32_t oldcr = s->cr;
-        /* CR */
-        if (value & GPT_CR_SWR) { /* force reset */
-            value &= ~GPT_CR_SWR;
-            imx_timerg_reset(&s->busdev.qdev);
-            imx_timerg_update(s);
-        }
-
-        s->cr = value & ~0x7c00;
-        imx_timerg_set_freq(s);
-        if ((oldcr ^ value) & GPT_CR_EN) {
-            if (value & GPT_CR_EN) {
-                if (value & GPT_CR_ENMOD) {
-                    ptimer_set_count(s->timer, s->ocr1);
-                    s->cnt = 0;
+    uint32_t oldreg;
+    uint32_t reg = offset >> 2;
+
+    DPRINTF("(%s, value = 0x%08x)\n", imx_timerg_reg_name(reg),
+            (uint32_t)value);
+
+    switch (reg) {
+    case 0:
+        oldreg = s->cr;
+        s->cr = value & ~0x7c14;
+        if (s->cr & GPT_CR_SWR) { /* force reset */
+            /* handle the reset */
+            imx_timerg_reset(DEVICE(s));
+        } else {
+            /* set our freq, as the source might have changed */
+            imx_timerg_set_freq(s);
+
+            if ((oldreg ^ s->cr) & GPT_CR_EN) {
+                if (s->cr & GPT_CR_EN) {
+                    if (s->cr & GPT_CR_ENMOD) {
+                        s->next_timeout = TIMER_MAX;
+                        ptimer_set_count(s->timer, TIMER_MAX);
+                        imx_timerg_compute_next_timeout(s, false);
+                    }
+                    ptimer_run(s->timer, 1);
+                } else {
+                    /* stop timer */
+                    ptimer_stop(s->timer);
                 }
-                ptimer_run(s->timer,
-                           (value & GPT_CR_FRR) && (s->ocr1 != TIMER_MAX));
-            } else {
-                ptimer_stop(s->timer);
-            };
+            }
         }
-        return;
-    }
+        break;
 
     case 1: /* Prescaler */
         s->pr = value & 0xfff;
         imx_timerg_set_freq(s);
-        return;
+        break;
 
     case 2: /* SR */
-        /*
-         * No point in implementing the status register bits to do with
-         * external interrupt sources.
-         */
-        value &= GPT_SR_OF1 | GPT_SR_ROV;
-        s->sr &= ~value;
+        s->sr &= ~(value & 0x3f);
         imx_timerg_update(s);
-        return;
+        break;
 
     case 3: /* IR -- interrupt register */
         s->ir = value & 0x3f;
         imx_timerg_update(s);
-        return;
+
+        imx_timerg_compute_next_timeout(s, false);
+
+        break;
 
     case 4: /* OCR1 -- output compare register */
+        s->ocr1 = value;
+
         /* In non-freerun mode, reset count when this register is written */
         if (!(s->cr & GPT_CR_FRR)) {
-            s->waiting_rov = 0;
-            ptimer_set_limit(s->timer, value, 1);
-        } else {
-            imx_timerg_update_counts(s);
-            if (value > s->cnt) {
-                s->waiting_rov = 0;
-                imx_timerg_reload(s, value);
-            } else {
-                s->waiting_rov = 1;
-                imx_timerg_reload(s, TIMER_MAX - s->cnt);
-            }
+            s->next_timeout = TIMER_MAX;
+            ptimer_set_limit(s->timer, TIMER_MAX, 1);
         }
-        s->ocr1 = value;
-        return;
+
+        /* compute the new timeout */
+        imx_timerg_compute_next_timeout(s, false);
+
+        break;
 
     case 5: /* OCR2 -- output compare register */
+        s->ocr2 = value;
+
+        /* compute the new timeout */
+        imx_timerg_compute_next_timeout(s, false);
+
+        break;
+
     case 6: /* OCR3 -- output compare register */
+        s->ocr3 = value;
+
+        /* compute the new timeout */
+        imx_timerg_compute_next_timeout(s, false);
+
+        break;
+
     default:
-        IPRINTF("imx_timerg_write: Bad offset %x\n",
-                (int)offset >> 2);
+        IPRINTF("Bad offset %x\n", reg);
+        break;
     }
 }
 
@@ -365,41 +485,18 @@ static void imx_timerg_timeout(void *opaque)
 {
     IMXTimerGState *s = (IMXTimerGState *)opaque;
 
-    DPRINTF("imx_timerg_timeout, waiting rov=%d\n", s->waiting_rov);
-    if (s->cr & GPT_CR_FRR) {
-        /*
-         * Free running timer from 0 -> TIMERMAX
-         * Generates interrupt at TIMER_MAX and at cnt==ocr1
-         * If ocr1 == TIMER_MAX, then no need to reload timer.
-         */
-        if (s->ocr1 == TIMER_MAX) {
-            DPRINTF("s->ocr1 == TIMER_MAX, FRR\n");
-            s->sr |= GPT_SR_OF1 | GPT_SR_ROV;
-            imx_timerg_update(s);
-            return;
-        }
+    DPRINTF("\n");
 
-        if (s->waiting_rov) {
-            /*
-             * We were waiting for cnt==TIMER_MAX
-             */
-            s->sr |= GPT_SR_ROV;
-            s->waiting_rov = 0;
-            s->cnt = 0;
-            imx_timerg_reload(s, s->ocr1);
-        } else {
-            /* Must have got a cnt==ocr1 timeout. */
-            s->sr |= GPT_SR_OF1;
-            s->cnt = s->ocr1;
-            s->waiting_rov = 1;
-            imx_timerg_reload(s, TIMER_MAX);
-        }
-        imx_timerg_update(s);
-        return;
-    }
+    s->sr |= s->next_int;
+    s->next_int = 0;
+
+    imx_timerg_compute_next_timeout(s, true);
 
-    s->sr |= GPT_SR_OF1;
     imx_timerg_update(s);
+
+    if (s->freq && (s->cr & GPT_CR_EN)) {
+        ptimer_run(s->timer, 1);
+    }
 }
 
 static const MemoryRegionOps imx_timerg_ops = {
@@ -416,7 +513,7 @@ static int imx_timerg_init(SysBusDevice *dev)
 
     sysbus_init_irq(dev, &s->irq);
     memory_region_init_io(&s->iomem, &imx_timerg_ops,
-                          s, "imxg-timer",
+                          s, TYPE_IMX_GPT,
                           0x00001000);
     sysbus_init_mmio(dev, &s->iomem);
 
@@ -428,14 +525,12 @@ static int imx_timerg_init(SysBusDevice *dev)
     return 0;
 }
 
-void imx_timerg_create(const hwaddr addr,
-                              qemu_irq irq,
-                              DeviceState *ccm)
+void imx_timerg_create(const hwaddr addr, qemu_irq irq, DeviceState *ccm)
 {
     IMXTimerGState *pp;
     DeviceState *dev;
 
-    dev = sysbus_create_simple("imx_timerg", addr, irq);
+    dev = sysbus_create_simple(TYPE_IMX_GPT, addr, irq);
     pp = container_of(dev, IMXTimerGState, busdev.qdev);
     pp->ccm = ccm;
 }
@@ -451,7 +546,7 @@ static void imx_timerg_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo imx_timerg_info = {
-    .name = "imx_timerg",
+    .name = TYPE_IMX_GPT,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXTimerGState),
     .class_init = imx_timerg_class_init,
commit 2acafb1a7b8b5ff4da48fccd7ce217cb07f36ffa
Author: John Rigby <john.rigby at linaro.org>
Date:   Tue Jun 25 18:34:13 2013 +0100

    ARM: Allow dumping of device tree
    
    By calling qemu_devtree_dumpdtb near the end of load_dtb.
    
    Signed-off-by: John Rigby <john.rigby at linaro.org>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index defcf15..797c691 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -303,6 +303,7 @@ static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo)
             fprintf(stderr, "couldn't set /chosen/linux,initrd-end\n");
         }
     }
+    qemu_devtree_dumpdtb(fdt, size);
 
     cpu_physical_memory_write(addr, fdt, size);
 
commit bdcc150dc44ea96152f05f9e68970b63508d5ae7
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:08 2013 +0100

    target-arm: Make LPAE feature imply V7MP
    
    The v7 ARM ARM specifies that the Large Physical Address
    Extension requires implementation of the Multiprocessing
    Extensions, so make our LPAE feature imply V7MP rather
    than specifying both in the A15 CPU initfn.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1371127899-10364-1-git-send-email-peter.maydell at linaro.org

diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 241f032..2371f48 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -198,6 +198,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         set_feature(env, ARM_FEATURE_VFP);
     }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
+        set_feature(env, ARM_FEATURE_V7MP);
         set_feature(env, ARM_FEATURE_PXN);
     }
 
@@ -573,7 +574,6 @@ static void cortex_a15_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_ARM_DIV);
-    set_feature(&cpu->env, ARM_FEATURE_V7MP);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_LPAE);
commit f7134d963d94d1fa64a482855585d21dbb58b6bd
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:07 2013 +0100

    target-arm: Use tuple list to sync cp regs with KVM
    
    Use the tuple list of cp registers for syncing KVM state to QEMU,
    rather than only syncing a very minimal set by hand.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/kvm.c b/target-arm/kvm.c
index 49108cf..d3937a2 100644
--- a/target-arm/kvm.c
+++ b/target-arm/kvm.c
@@ -344,17 +344,6 @@ typedef struct Reg {
         offsetof(CPUARMState, QEMUFIELD)                     \
     }
 
-#define CP15REG(CRN, CRM, OPC1, OPC2, QEMUFIELD) \
-    {                                            \
-        KVM_REG_ARM | KVM_REG_SIZE_U32 |         \
-        (15 << KVM_REG_ARM_COPROC_SHIFT) |       \
-        ((CRN) << KVM_REG_ARM_32_CRN_SHIFT) |    \
-        ((CRM) << KVM_REG_ARM_CRM_SHIFT) |       \
-        ((OPC1) << KVM_REG_ARM_OPC1_SHIFT) |     \
-        ((OPC2) << KVM_REG_ARM_32_OPC2_SHIFT),   \
-        offsetof(CPUARMState, QEMUFIELD)         \
-    }
-
 #define VFPSYSREG(R)                                       \
     {                                                      \
         KVM_REG_ARM | KVM_REG_SIZE_U32 | KVM_REG_ARM_VFP | \
@@ -403,12 +392,6 @@ static const Reg regs[] = {
     COREREG(fiq_regs[7], banked_spsr[5]),
     /* R15 */
     COREREG(usr_regs.uregs[15], regs[15]),
-    /* A non-comprehensive set of cp15 registers.
-     * TODO: drive this from the cp_regs hashtable instead.
-     */
-    CP15REG(1, 0, 0, 0, cp15.c1_sys), /* SCTLR */
-    CP15REG(2, 0, 0, 2, cp15.c2_control), /* TTBCR */
-    CP15REG(3, 0, 0, 0, cp15.c3), /* DACR */
     /* VFP system registers */
     VFPSYSREG(FPSID),
     VFPSYSREG(MVFR1),
@@ -426,7 +409,6 @@ int kvm_arch_put_registers(CPUState *cs, int level)
     int mode, bn;
     int ret, i;
     uint32_t cpsr, fpscr;
-    uint64_t ttbr;
 
     /* Make sure the banked regs are properly set */
     mode = env->uncached_cpsr & CPSR_M;
@@ -460,26 +442,6 @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    /* TTBR0: cp15 crm=2 opc1=0 */
-    ttbr = ((uint64_t)env->cp15.c2_base0_hi << 32) | env->cp15.c2_base0;
-    r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | (15 << KVM_REG_ARM_COPROC_SHIFT) |
-        (2 << KVM_REG_ARM_CRM_SHIFT) | (0 << KVM_REG_ARM_OPC1_SHIFT);
-    r.addr = (uintptr_t)(&ttbr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
-    if (ret) {
-        return ret;
-    }
-
-    /* TTBR1: cp15 crm=2 opc1=1 */
-    ttbr = ((uint64_t)env->cp15.c2_base1_hi << 32) | env->cp15.c2_base1;
-    r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | (15 << KVM_REG_ARM_COPROC_SHIFT) |
-        (2 << KVM_REG_ARM_CRM_SHIFT) | (1 << KVM_REG_ARM_OPC1_SHIFT);
-    r.addr = (uintptr_t)(&ttbr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
-    if (ret) {
-        return ret;
-    }
-
     /* VFP registers */
     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
     for (i = 0; i < 32; i++) {
@@ -496,6 +458,31 @@ int kvm_arch_put_registers(CPUState *cs, int level)
     fpscr = vfp_get_fpscr(env);
     r.addr = (uintptr_t)&fpscr;
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
+    if (ret) {
+        return ret;
+    }
+
+    /* Note that we do not call write_cpustate_to_list()
+     * here, so we are only writing the tuple list back to
+     * KVM. This is safe because nothing can change the
+     * CPUARMState cp15 fields (in particular gdb accesses cannot)
+     * and so there are no changes to sync. In fact syncing would
+     * be wrong at this point: for a constant register where TCG and
+     * KVM disagree about its value, the preceding write_list_to_cpustate()
+     * would not have had any effect on the CPUARMState value (since the
+     * register is read-only), and a write_cpustate_to_list() here would
+     * then try to write the TCG value back into KVM -- this would either
+     * fail or incorrectly change the value the guest sees.
+     *
+     * If we ever want to allow the user to modify cp15 registers via
+     * the gdb stub, we would need to be more clever here (for instance
+     * tracking the set of registers kvm_arch_get_registers() successfully
+     * managed to update the CPUARMState with, and only allowing those
+     * to be written back up into the kernel).
+     */
+    if (!write_list_to_kvmstate(cpu)) {
+        return EINVAL;
+    }
 
     return ret;
 }
@@ -508,7 +495,6 @@ int kvm_arch_get_registers(CPUState *cs)
     int mode, bn;
     int ret, i;
     uint32_t cpsr, fpscr;
-    uint64_t ttbr;
 
     for (i = 0; i < ARRAY_SIZE(regs); i++) {
         r.id = regs[i].id;
@@ -529,28 +515,6 @@ int kvm_arch_get_registers(CPUState *cs)
     }
     cpsr_write(env, cpsr, 0xffffffff);
 
-    /* TTBR0: cp15 crm=2 opc1=0 */
-    r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | (15 << KVM_REG_ARM_COPROC_SHIFT) |
-        (2 << KVM_REG_ARM_CRM_SHIFT) | (0 << KVM_REG_ARM_OPC1_SHIFT);
-    r.addr = (uintptr_t)(&ttbr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
-    if (ret) {
-        return ret;
-    }
-    env->cp15.c2_base0_hi = ttbr >> 32;
-    env->cp15.c2_base0 = ttbr;
-
-    /* TTBR1: cp15 crm=2 opc1=1 */
-    r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | (15 << KVM_REG_ARM_COPROC_SHIFT) |
-        (2 << KVM_REG_ARM_CRM_SHIFT) | (1 << KVM_REG_ARM_OPC1_SHIFT);
-    r.addr = (uintptr_t)(&ttbr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
-    if (ret) {
-        return ret;
-    }
-    env->cp15.c2_base1_hi = ttbr >> 32;
-    env->cp15.c2_base1 = ttbr;
-
     /* Make sure the current mode regs are properly set */
     mode = env->uncached_cpsr & CPSR_M;
     bn = bank_number(mode);
@@ -563,15 +527,6 @@ int kvm_arch_get_registers(CPUState *cs)
     env->regs[14] = env->banked_r14[bn];
     env->spsr = env->banked_spsr[bn];
 
-    /* The main GET_ONE_REG loop above set c2_control, but we need to
-     * update some extra cached precomputed values too.
-     * When this is driven from the cp_regs hashtable then this ugliness
-     * can disappear because we'll use the access function which sets
-     * these values automatically.
-     */
-    env->cp15.c2_mask = ~(0xffffffffu >> env->cp15.c2_control);
-    env->cp15.c2_base_mask = ~(0x3fffu >> env->cp15.c2_control);
-
     /* VFP registers */
     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
     for (i = 0; i < 32; i++) {
@@ -592,6 +547,14 @@ int kvm_arch_get_registers(CPUState *cs)
     }
     vfp_set_fpscr(env, fpscr);
 
+    if (!write_kvmstate_to_list(cpu)) {
+        return EINVAL;
+    }
+    /* Note that it's OK to have registers which aren't in CPUState,
+     * so we can ignore a failure return here.
+     */
+    write_list_to_cpustate(cpu);
+
     return 0;
 }
 
commit 2d8e5a0e25171eca30a72a450826f539f05951d0
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:07 2013 +0100

    target-arm: Reinitialize all KVM VCPU registers on reset
    
    Since the ARM KVM API doesn't include a "reset this VCPU"
    ioctl, we have to capture the initial values of every
    register it knows about so that we can reset the VCPU
    by feeding those values back again.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 2242eee..25239b8 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -72,7 +72,11 @@ typedef struct ARMCPU {
     uint64_t *cpreg_indexes;
     /* Values of the registers (cpreg_indexes[i]'s value is cpreg_values[i]) */
     uint64_t *cpreg_values;
-    /* Length of the indexes, values arrays */
+    /* When using KVM, keeps a copy of the initial state of the VCPU,
+     * so that on reset we can feed the reset values back into the kernel.
+     */
+    uint64_t *cpreg_reset_values;
+    /* Length of the indexes, values, reset_values arrays */
     int32_t cpreg_array_len;
     /* These are used only for migration: incoming data arrives in
      * these fields and is sanity checked in post_load before copying
diff --git a/target-arm/kvm.c b/target-arm/kvm.c
index 66ce67a..49108cf 100644
--- a/target-arm/kvm.c
+++ b/target-arm/kvm.c
@@ -162,6 +162,13 @@ int kvm_arch_init_vcpu(CPUState *cs)
         goto out;
     }
 
+    /* Save a copy of the initial register values so that we can
+     * feed it back to the kernel on VCPU reset.
+     */
+    cpu->cpreg_reset_values = g_memdup(cpu->cpreg_values,
+                                       cpu->cpreg_array_len *
+                                       sizeof(cpu->cpreg_values[0]));
+
 out:
     g_free(rlp);
     return ret;
@@ -603,6 +610,15 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
 
 void kvm_arch_reset_vcpu(CPUState *cs)
 {
+    /* Feed the kernel back its initial register state */
+    ARMCPU *cpu = ARM_CPU(cs);
+
+    memmove(cpu->cpreg_values, cpu->cpreg_reset_values,
+            cpu->cpreg_array_len * sizeof(cpu->cpreg_values[0]));
+
+    if (!write_list_to_kvmstate(cpu)) {
+        abort();
+    }
 }
 
 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
commit ff047453f56713aa627e63aade1a9046ccd3bdfd
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:07 2013 +0100

    target-arm: Initialize cpreg list from KVM when using KVM
    
    When using KVM, use the kernel's initial state to set up the
    cpreg list, and sync to and from the kernel when doing
    migration.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/Makefile.objs b/target-arm/Makefile.objs
index d89b57c..4a6e52e 100644
--- a/target-arm/Makefile.objs
+++ b/target-arm/Makefile.objs
@@ -1,5 +1,6 @@
 obj-y += arm-semi.o
 obj-$(CONFIG_SOFTMMU) += machine.o
 obj-$(CONFIG_KVM) += kvm.o
+obj-$(CONFIG_NO_KVM) += kvm-stub.o
 obj-y += translate.o op_helper.o helper.o cpu.o
 obj-y += neon_helper.o iwmmxt_helper.o
diff --git a/target-arm/kvm-stub.c b/target-arm/kvm-stub.c
new file mode 100644
index 0000000..cd1849f
--- /dev/null
+++ b/target-arm/kvm-stub.c
@@ -0,0 +1,23 @@
+/*
+ * QEMU KVM ARM specific function stubs
+ *
+ * Copyright Linaro Limited 2013
+ *
+ * Author: Peter Maydell <peter.maydell at linaro.org>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+#include "qemu-common.h"
+#include "kvm_arm.h"
+
+bool write_kvmstate_to_list(ARMCPU *cpu)
+{
+    abort();
+}
+
+bool write_list_to_kvmstate(ARMCPU *cpu)
+{
+    abort();
+}
diff --git a/target-arm/kvm.c b/target-arm/kvm.c
index f427537..66ce67a 100644
--- a/target-arm/kvm.c
+++ b/target-arm/kvm.c
@@ -50,12 +50,35 @@ unsigned long kvm_arch_vcpu_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
+static bool reg_syncs_via_tuple_list(uint64_t regidx)
+{
+    /* Return true if the regidx is a register we should synchronize
+     * via the cpreg_tuples array (ie is not a core reg we sync by
+     * hand in kvm_arch_get/put_registers())
+     */
+    switch (regidx & KVM_REG_ARM_COPROC_MASK) {
+    case KVM_REG_ARM_CORE:
+    case KVM_REG_ARM_VFP:
+        return false;
+    default:
+        return true;
+    }
+}
+
+static int compare_u64(const void *a, const void *b)
+{
+    return *(uint64_t *)a - *(uint64_t *)b;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     struct kvm_vcpu_init init;
-    int ret;
+    int i, ret, arraylen;
     uint64_t v;
     struct kvm_one_reg r;
+    struct kvm_reg_list rl;
+    struct kvm_reg_list *rlp;
+    ARMCPU *cpu = ARM_CPU(cs);
 
     init.target = KVM_ARM_TARGET_CORTEX_A15;
     memset(init.features, 0, sizeof(init.features));
@@ -74,6 +97,73 @@ int kvm_arch_init_vcpu(CPUState *cs)
     if (ret == -ENOENT) {
         return -EINVAL;
     }
+
+    /* Populate the cpreg list based on the kernel's idea
+     * of what registers exist (and throw away the TCG-created list).
+     */
+    rl.n = 0;
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, &rl);
+    if (ret != -E2BIG) {
+        return ret;
+    }
+    rlp = g_malloc(sizeof(struct kvm_reg_list) + rl.n * sizeof(uint64_t));
+    rlp->n = rl.n;
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, rlp);
+    if (ret) {
+        goto out;
+    }
+    /* Sort the list we get back from the kernel, since cpreg_tuples
+     * must be in strictly ascending order.
+     */
+    qsort(&rlp->reg, rlp->n, sizeof(rlp->reg[0]), compare_u64);
+
+    for (i = 0, arraylen = 0; i < rlp->n; i++) {
+        if (!reg_syncs_via_tuple_list(rlp->reg[i])) {
+            continue;
+        }
+        switch (rlp->reg[i] & KVM_REG_SIZE_MASK) {
+        case KVM_REG_SIZE_U32:
+        case KVM_REG_SIZE_U64:
+            break;
+        default:
+            fprintf(stderr, "Can't handle size of register in kernel list\n");
+            ret = -EINVAL;
+            goto out;
+        }
+
+        arraylen++;
+    }
+
+    cpu->cpreg_indexes = g_renew(uint64_t, cpu->cpreg_indexes, arraylen);
+    cpu->cpreg_values = g_renew(uint64_t, cpu->cpreg_values, arraylen);
+    cpu->cpreg_vmstate_indexes = g_renew(uint64_t, cpu->cpreg_vmstate_indexes,
+                                         arraylen);
+    cpu->cpreg_vmstate_values = g_renew(uint64_t, cpu->cpreg_vmstate_values,
+                                        arraylen);
+    cpu->cpreg_array_len = arraylen;
+    cpu->cpreg_vmstate_array_len = arraylen;
+
+    for (i = 0, arraylen = 0; i < rlp->n; i++) {
+        uint64_t regidx = rlp->reg[i];
+        if (!reg_syncs_via_tuple_list(regidx)) {
+            continue;
+        }
+        cpu->cpreg_indexes[arraylen] = regidx;
+        arraylen++;
+    }
+    assert(cpu->cpreg_array_len == arraylen);
+
+    if (!write_kvmstate_to_list(cpu)) {
+        /* Shouldn't happen unless kernel is inconsistent about
+         * what registers exist.
+         */
+        fprintf(stderr, "Initial read of kernel register state failed\n");
+        ret = -EINVAL;
+        goto out;
+    }
+
+out:
+    g_free(rlp);
     return ret;
 }
 
@@ -163,6 +253,78 @@ void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid)
     QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);
 }
 
+bool write_kvmstate_to_list(ARMCPU *cpu)
+{
+    CPUState *cs = CPU(cpu);
+    int i;
+    bool ok = true;
+
+    for (i = 0; i < cpu->cpreg_array_len; i++) {
+        struct kvm_one_reg r;
+        uint64_t regidx = cpu->cpreg_indexes[i];
+        uint32_t v32;
+        int ret;
+
+        r.id = regidx;
+
+        switch (regidx & KVM_REG_SIZE_MASK) {
+        case KVM_REG_SIZE_U32:
+            r.addr = (uintptr_t)&v32;
+            ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
+            if (!ret) {
+                cpu->cpreg_values[i] = v32;
+            }
+            break;
+        case KVM_REG_SIZE_U64:
+            r.addr = (uintptr_t)(cpu->cpreg_values + i);
+            ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
+            break;
+        default:
+            abort();
+        }
+        if (ret) {
+            ok = false;
+        }
+    }
+    return ok;
+}
+
+bool write_list_to_kvmstate(ARMCPU *cpu)
+{
+    CPUState *cs = CPU(cpu);
+    int i;
+    bool ok = true;
+
+    for (i = 0; i < cpu->cpreg_array_len; i++) {
+        struct kvm_one_reg r;
+        uint64_t regidx = cpu->cpreg_indexes[i];
+        uint32_t v32;
+        int ret;
+
+        r.id = regidx;
+        switch (regidx & KVM_REG_SIZE_MASK) {
+        case KVM_REG_SIZE_U32:
+            v32 = cpu->cpreg_values[i];
+            r.addr = (uintptr_t)&v32;
+            break;
+        case KVM_REG_SIZE_U64:
+            r.addr = (uintptr_t)(cpu->cpreg_values + i);
+            break;
+        default:
+            abort();
+        }
+        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
+        if (ret) {
+            /* We might fail for "unknown register" and also for
+             * "you tried to set a register which is constant with
+             * a different value from what it actually contains".
+             */
+            ok = false;
+        }
+    }
+    return ok;
+}
+
 typedef struct Reg {
     uint64_t id;
     int offset;
diff --git a/target-arm/kvm_arm.h b/target-arm/kvm_arm.h
index b1c54ff..5d14887 100644
--- a/target-arm/kvm_arm.h
+++ b/target-arm/kvm_arm.h
@@ -29,4 +29,37 @@
  */
 void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid);
 
+/**
+ * write_list_to_kvmstate:
+ * @cpu: ARMCPU
+ *
+ * For each register listed in the ARMCPU cpreg_indexes list, write
+ * its value from the cpreg_values list into the kernel (via ioctl).
+ * This updates KVM's working data structures from TCG data or
+ * from incoming migration state.
+ *
+ * Returns: true if all register values were updated correctly,
+ * false if some register was unknown to the kernel or could not
+ * be written (eg constant register with the wrong value).
+ * Note that we do not stop early on failure -- we will attempt
+ * writing all registers in the list.
+ */
+bool write_list_to_kvmstate(ARMCPU *cpu);
+
+/**
+ * write_kvmstate_to_list:
+ * @cpu: ARMCPU
+ *
+ * For each register listed in the ARMCPU cpreg_indexes list, write
+ * its value from the kernel into the cpreg_values list. This is used to
+ * copy info from KVM's working data structures into TCG or
+ * for outbound migration.
+ *
+ * Returns: true if all register values were read correctly,
+ * false if some register was unknown or could not be read.
+ * Note that we do not stop early on failure -- we will attempt
+ * reading all registers in the list.
+ */
+bool write_kvmstate_to_list(ARMCPU *cpu);
+
 #endif
diff --git a/target-arm/machine.c b/target-arm/machine.c
index 076dc16..6d4c2d4 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -1,5 +1,7 @@
 #include "hw/hw.h"
 #include "hw/boards.h"
+#include "sysemu/kvm.h"
+#include "kvm_arm.h"
 
 static bool vfp_needed(void *opaque)
 {
@@ -152,9 +154,16 @@ static void cpu_pre_save(void *opaque)
 {
     ARMCPU *cpu = opaque;
 
-    if (!write_cpustate_to_list(cpu)) {
-        /* This should never fail. */
-        abort();
+    if (kvm_enabled()) {
+        if (!write_kvmstate_to_list(cpu)) {
+            /* This should never fail */
+            abort();
+        }
+    } else {
+        if (!write_cpustate_to_list(cpu)) {
+            /* This should never fail. */
+            abort();
+        }
     }
 
     cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
@@ -193,8 +202,19 @@ static int cpu_post_load(void *opaque, int version_id)
         v++;
     }
 
-    if (!write_list_to_cpustate(cpu)) {
-        return -1;
+    if (kvm_enabled()) {
+        if (!write_list_to_kvmstate(cpu)) {
+            return -1;
+        }
+        /* Note that it's OK for the TCG side not to know about
+         * every register in the list; KVM is authoritative if
+         * we're using it.
+         */
+        write_list_to_cpustate(cpu);
+    } else {
+        if (!write_list_to_cpustate(cpu)) {
+            return -1;
+        }
     }
 
     return 0;
commit 721fae125369deba8c12a37f5824138686fb6e4e
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:07 2013 +0100

    target-arm: Convert TCG to using (index,value) list for cp migration
    
    Convert the TCG ARM target to using an (index,value) list for migrating
    coprocessors. The primary benefit of the (index,value) list is for
    passing state between KVM and QEMU, but it works for TCG-to-TCG
    migration as well and is a useful self-contained first step.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 12fcefe..2242eee 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -62,6 +62,25 @@ typedef struct ARMCPU {
 
     /* Coprocessor information */
     GHashTable *cp_regs;
+    /* For marshalling (mostly coprocessor) register state between the
+     * kernel and QEMU (for KVM) and between two QEMUs (for migration),
+     * we use these arrays.
+     */
+    /* List of register indexes managed via these arrays; (full KVM style
+     * 64 bit indexes, not CPRegInfo 32 bit indexes)
+     */
+    uint64_t *cpreg_indexes;
+    /* Values of the registers (cpreg_indexes[i]'s value is cpreg_values[i]) */
+    uint64_t *cpreg_values;
+    /* Length of the indexes, values arrays */
+    int32_t cpreg_array_len;
+    /* These are used only for migration: incoming data arrives in
+     * these fields and is sanity checked in post_load before copying
+     * to the working data structures above.
+     */
+    uint64_t *cpreg_vmstate_indexes;
+    uint64_t *cpreg_vmstate_values;
+    int32_t cpreg_vmstate_array_len;
 
     /* The instance init functions for implementation-specific subclasses
      * set these fields to specify the implementation-dependent values of
@@ -116,6 +135,7 @@ extern const struct VMStateDescription vmstate_arm_cpu;
 #endif
 
 void register_cp_regs_for_features(ARMCPU *cpu);
+void init_cpreg_list(ARMCPU *cpu);
 
 void arm_cpu_do_interrupt(CPUState *cpu);
 void arm_v7m_cpu_do_interrupt(CPUState *cpu);
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 496a59f..241f032 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -204,6 +204,8 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     register_cp_regs_for_features(cpu);
     arm_cpu_register_gdb_regs_for_features(cpu);
 
+    init_cpreg_list(cpu);
+
     cpu_reset(CPU(cpu));
     qemu_init_vcpu(env);
 
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 1d8eba5..abcc0b4 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -424,6 +424,43 @@ void armv7m_nvic_complete_irq(void *opaque, int irq);
     (((cp) << 16) | ((is64) << 15) | ((crn) << 11) |    \
      ((crm) << 7) | ((opc1) << 3) | (opc2))
 
+/* Note that these must line up with the KVM/ARM register
+ * ID field definitions (kvm.c will check this, but we
+ * can't just use the KVM defines here as the kvm headers
+ * are unavailable to non-KVM-specific files)
+ */
+#define CP_REG_SIZE_SHIFT 52
+#define CP_REG_SIZE_MASK       0x00f0000000000000ULL
+#define CP_REG_SIZE_U32        0x0020000000000000ULL
+#define CP_REG_SIZE_U64        0x0030000000000000ULL
+#define CP_REG_ARM             0x4000000000000000ULL
+
+/* Convert a full 64 bit KVM register ID to the truncated 32 bit
+ * version used as a key for the coprocessor register hashtable
+ */
+static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
+{
+    uint32_t cpregid = kvmid;
+    if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) {
+        cpregid |= (1 << 15);
+    }
+    return cpregid;
+}
+
+/* Convert a truncated 32 bit hashtable key into the full
+ * 64 bit KVM register ID.
+ */
+static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+{
+    uint64_t kvmid = cpregid & ~(1 << 15);
+    if (cpregid & (1 << 15)) {
+        kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM;
+    } else {
+        kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM;
+    }
+    return kvmid;
+}
+
 /* ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
  * special-behaviour cp reg and bits [15..8] indicate what behaviour
  * it has. Otherwise it is a simple cp reg, where CONST indicates that
@@ -621,6 +658,38 @@ static inline bool cp_access_ok(CPUARMState *env,
     return (ri->access >> ((arm_current_pl(env) * 2) + isread)) & 1;
 }
 
+/**
+ * write_list_to_cpustate
+ * @cpu: ARMCPU
+ *
+ * For each register listed in the ARMCPU cpreg_indexes list, write
+ * its value from the cpreg_values list into the ARMCPUState structure.
+ * This updates TCG's working data structures from KVM data or
+ * from incoming migration state.
+ *
+ * Returns: true if all register values were updated correctly,
+ * false if some register was unknown or could not be written.
+ * Note that we do not stop early on failure -- we will attempt
+ * writing all registers in the list.
+ */
+bool write_list_to_cpustate(ARMCPU *cpu);
+
+/**
+ * write_cpustate_to_list:
+ * @cpu: ARMCPU
+ *
+ * For each register listed in the ARMCPU cpreg_indexes list, write
+ * its value from the ARMCPUState structure into the cpreg_values list.
+ * This is used to copy info from TCG's working data structures into
+ * KVM or for outbound migration.
+ *
+ * Returns: true if all register values were read correctly,
+ * false if some register was unknown or could not be read.
+ * Note that we do not stop early on failure -- we will attempt
+ * reading all registers in the list.
+ */
+bool write_cpustate_to_list(ARMCPU *cpu);
+
 /* Does the core conform to the the "MicroController" profile. e.g. Cortex-M3.
    Note the M in older cores (eg. ARM7TDMI) stands for Multiply. These are
    conventional cores (ie. Application or Realtime profile).  */
diff --git a/target-arm/helper.c b/target-arm/helper.c
index baf7576..5f639fd 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -78,6 +78,180 @@ static int raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
     return 0;
 }
 
+static bool read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
+                            uint64_t *v)
+{
+    /* Raw read of a coprocessor register (as needed for migration, etc)
+     * return true on success, false if the read is impossible for some reason.
+     */
+    if (ri->type & ARM_CP_CONST) {
+        *v = ri->resetvalue;
+    } else if (ri->raw_readfn) {
+        return (ri->raw_readfn(env, ri, v) == 0);
+    } else if (ri->readfn) {
+        return (ri->readfn(env, ri, v) == 0);
+    } else {
+        if (ri->type & ARM_CP_64BIT) {
+            *v = CPREG_FIELD64(env, ri);
+        } else {
+            *v = CPREG_FIELD32(env, ri);
+        }
+    }
+    return true;
+}
+
+static bool write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
+                             int64_t v)
+{
+    /* Raw write of a coprocessor register (as needed for migration, etc).
+     * Return true on success, false if the write is impossible for some reason.
+     * Note that constant registers are treated as write-ignored; the
+     * caller should check for success by whether a readback gives the
+     * value written.
+     */
+    if (ri->type & ARM_CP_CONST) {
+        return true;
+    } else if (ri->raw_writefn) {
+        return (ri->raw_writefn(env, ri, v) == 0);
+    } else if (ri->writefn) {
+        return (ri->writefn(env, ri, v) == 0);
+    } else {
+        if (ri->type & ARM_CP_64BIT) {
+            CPREG_FIELD64(env, ri) = v;
+        } else {
+            CPREG_FIELD32(env, ri) = v;
+        }
+    }
+    return true;
+}
+
+bool write_cpustate_to_list(ARMCPU *cpu)
+{
+    /* Write the coprocessor state from cpu->env to the (index,value) list. */
+    int i;
+    bool ok = true;
+
+    for (i = 0; i < cpu->cpreg_array_len; i++) {
+        uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
+        const ARMCPRegInfo *ri;
+        uint64_t v;
+        ri = get_arm_cp_reginfo(cpu, regidx);
+        if (!ri) {
+            ok = false;
+            continue;
+        }
+        if (ri->type & ARM_CP_NO_MIGRATE) {
+            continue;
+        }
+        if (!read_raw_cp_reg(&cpu->env, ri, &v)) {
+            ok = false;
+            continue;
+        }
+        cpu->cpreg_values[i] = v;
+    }
+    return ok;
+}
+
+bool write_list_to_cpustate(ARMCPU *cpu)
+{
+    int i;
+    bool ok = true;
+
+    for (i = 0; i < cpu->cpreg_array_len; i++) {
+        uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
+        uint64_t v = cpu->cpreg_values[i];
+        uint64_t readback;
+        const ARMCPRegInfo *ri;
+
+        ri = get_arm_cp_reginfo(cpu, regidx);
+        if (!ri) {
+            ok = false;
+            continue;
+        }
+        if (ri->type & ARM_CP_NO_MIGRATE) {
+            continue;
+        }
+        /* Write value and confirm it reads back as written
+         * (to catch read-only registers and partially read-only
+         * registers where the incoming migration value doesn't match)
+         */
+        if (!write_raw_cp_reg(&cpu->env, ri, v) ||
+            !read_raw_cp_reg(&cpu->env, ri, &readback) ||
+            readback != v) {
+            ok = false;
+        }
+    }
+    return ok;
+}
+
+static void add_cpreg_to_list(gpointer key, gpointer opaque)
+{
+    ARMCPU *cpu = opaque;
+    uint64_t regidx;
+    const ARMCPRegInfo *ri;
+
+    regidx = *(uint32_t *)key;
+    ri = get_arm_cp_reginfo(cpu, regidx);
+
+    if (!(ri->type & ARM_CP_NO_MIGRATE)) {
+        cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
+        /* The value array need not be initialized at this point */
+        cpu->cpreg_array_len++;
+    }
+}
+
+static void count_cpreg(gpointer key, gpointer opaque)
+{
+    ARMCPU *cpu = opaque;
+    uint64_t regidx;
+    const ARMCPRegInfo *ri;
+
+    regidx = *(uint32_t *)key;
+    ri = get_arm_cp_reginfo(cpu, regidx);
+
+    if (!(ri->type & ARM_CP_NO_MIGRATE)) {
+        cpu->cpreg_array_len++;
+    }
+}
+
+static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
+{
+    uint32_t aidx = *(uint32_t *)a;
+    uint32_t bidx = *(uint32_t *)b;
+
+    return aidx - bidx;
+}
+
+void init_cpreg_list(ARMCPU *cpu)
+{
+    /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
+     * Note that we require cpreg_tuples[] to be sorted by key ID.
+     */
+    GList *keys;
+    int arraylen;
+
+    keys = g_hash_table_get_keys(cpu->cp_regs);
+    keys = g_list_sort(keys, cpreg_key_compare);
+
+    cpu->cpreg_array_len = 0;
+
+    g_list_foreach(keys, count_cpreg, cpu);
+
+    arraylen = cpu->cpreg_array_len;
+    cpu->cpreg_indexes = g_new(uint64_t, arraylen);
+    cpu->cpreg_values = g_new(uint64_t, arraylen);
+    cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
+    cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
+    cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
+    cpu->cpreg_array_len = 0;
+
+    g_list_foreach(keys, add_cpreg_to_list, cpu);
+
+    assert(cpu->cpreg_array_len == arraylen);
+
+    g_list_free(keys);
+}
+
 static int dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 {
     env->cp15.c3 = value;
diff --git a/target-arm/kvm.c b/target-arm/kvm.c
index 27dcab9..f427537 100644
--- a/target-arm/kvm.c
+++ b/target-arm/kvm.c
@@ -23,6 +23,15 @@
 #include "cpu.h"
 #include "hw/arm/arm.h"
 
+/* Check that cpu.h's idea of coprocessor fields matches KVM's */
+#if (CP_REG_SIZE_SHIFT != KVM_REG_SIZE_SHIFT) || \
+    (CP_REG_SIZE_MASK != KVM_REG_SIZE_MASK) ||   \
+    (CP_REG_SIZE_U32 != KVM_REG_SIZE_U32) || \
+    (CP_REG_SIZE_U64 != KVM_REG_SIZE_U64) || \
+    (CP_REG_ARM != KVM_REG_ARM)
+#error mismatch between cpu.h and KVM header definitions
+#endif
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
diff --git a/target-arm/machine.c b/target-arm/machine.c
index 4dd057c..076dc16 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -148,11 +148,65 @@ static const VMStateInfo vmstate_cpsr = {
     .put = put_cpsr,
 };
 
+static void cpu_pre_save(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+
+    if (!write_cpustate_to_list(cpu)) {
+        /* This should never fail. */
+        abort();
+    }
+
+    cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
+    memcpy(cpu->cpreg_vmstate_indexes, cpu->cpreg_indexes,
+           cpu->cpreg_array_len * sizeof(uint64_t));
+    memcpy(cpu->cpreg_vmstate_values, cpu->cpreg_values,
+           cpu->cpreg_array_len * sizeof(uint64_t));
+}
+
+static int cpu_post_load(void *opaque, int version_id)
+{
+    ARMCPU *cpu = opaque;
+    int i, v;
+
+    /* Update the values list from the incoming migration data.
+     * Anything in the incoming data which we don't know about is
+     * a migration failure; anything we know about but the incoming
+     * data doesn't specify retains its current (reset) value.
+     * The indexes list remains untouched -- we only inspect the
+     * incoming migration index list so we can match the values array
+     * entries with the right slots in our own values array.
+     */
+
+    for (i = 0, v = 0; i < cpu->cpreg_array_len
+             && v < cpu->cpreg_vmstate_array_len; i++) {
+        if (cpu->cpreg_vmstate_indexes[v] > cpu->cpreg_indexes[i]) {
+            /* register in our list but not incoming : skip it */
+            continue;
+        }
+        if (cpu->cpreg_vmstate_indexes[v] < cpu->cpreg_indexes[i]) {
+            /* register in their list but not ours: fail migration */
+            return -1;
+        }
+        /* matching register, copy the value over */
+        cpu->cpreg_values[i] = cpu->cpreg_vmstate_values[v];
+        v++;
+    }
+
+    if (!write_list_to_cpustate(cpu)) {
+        return -1;
+    }
+
+    return 0;
+}
+
 const VMStateDescription vmstate_arm_cpu = {
     .name = "cpu",
-    .version_id = 11,
-    .minimum_version_id = 11,
-    .minimum_version_id_old = 11,
+    .version_id = 12,
+    .minimum_version_id = 12,
+    .minimum_version_id_old = 12,
+    .pre_save = cpu_pre_save,
+    .post_load = cpu_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(env.regs, ARMCPU, 16),
         {
@@ -169,50 +223,16 @@ const VMStateDescription vmstate_arm_cpu = {
         VMSTATE_UINT32_ARRAY(env.banked_r14, ARMCPU, 6),
         VMSTATE_UINT32_ARRAY(env.usr_regs, ARMCPU, 5),
         VMSTATE_UINT32_ARRAY(env.fiq_regs, ARMCPU, 5),
-        VMSTATE_UINT32(env.cp15.c0_cpuid, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c0_cssel, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c1_sys, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c1_coproc, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c1_xscaleauxcr, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c1_scr, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_base0, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_base0_hi, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_base1, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_base1_hi, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_control, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_mask, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_base_mask, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_data, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c2_insn, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c3, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c5_insn, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c5_data, ARMCPU),
-        VMSTATE_UINT32_ARRAY(env.cp15.c6_region, ARMCPU, 8),
-        VMSTATE_UINT32(env.cp15.c6_insn, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c6_data, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c7_par, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c7_par_hi, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_insn, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_data, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_pmcr, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_pmcnten, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_pmovsr, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_pmxevtyper, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_pmuserenr, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c9_pminten, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c13_fcse, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c13_context, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c13_tls1, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c13_tls2, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c13_tls3, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_cpar, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_ticonfig, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_i_max, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_i_min, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_threadid, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_power_control, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_diagnostic, ARMCPU),
-        VMSTATE_UINT32(env.cp15.c15_power_diagnostic, ARMCPU),
+        /* The length-check must come before the arrays to avoid
+         * incoming data possibly overflowing the array.
+         */
+        VMSTATE_INT32_LE(cpreg_vmstate_array_len, ARMCPU),
+        VMSTATE_VARRAY_INT32(cpreg_vmstate_indexes, ARMCPU,
+                             cpreg_vmstate_array_len,
+                             0, vmstate_info_uint64, uint64_t),
+        VMSTATE_VARRAY_INT32(cpreg_vmstate_values, ARMCPU,
+                             cpreg_vmstate_array_len,
+                             0, vmstate_info_uint64, uint64_t),
         VMSTATE_UINT32(env.exclusive_addr, ARMCPU),
         VMSTATE_UINT32(env.exclusive_val, ARMCPU),
         VMSTATE_UINT32(env.exclusive_high, ARMCPU),
commit d4e6df6379a31efb2cf6cab3dea3f26fb489fabe
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:07 2013 +0100

    target-arm: mark up cpregs for no-migrate or raw access
    
    Mark up coprocessor register definitions to add raw access
    functions or mark the register as non-migratable where necessary.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 2585d59..baf7576 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -64,6 +64,20 @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
+static int raw_read(CPUARMState *env, const ARMCPRegInfo *ri,
+                    uint64_t *value)
+{
+    *value = CPREG_FIELD32(env, ri);
+    return 0;
+}
+
+static int raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                     uint64_t value)
+{
+    CPREG_FIELD32(env, ri) = value;
+    return 0;
+}
+
 static int dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 {
     env->cp15.c3 = value;
@@ -139,13 +153,13 @@ static const ARMCPRegInfo cp_reginfo[] = {
     { .name = "DACR", .cp = 15,
       .crn = 3, .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),
-      .resetvalue = 0, .writefn = dacr_write },
+      .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },
     { .name = "FCSEIDR", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 0,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c13_fcse),
-      .resetvalue = 0, .writefn = fcse_write },
+      .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
     { .name = "CONTEXTIDR", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 1,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c13_fcse),
-      .resetvalue = 0, .writefn = contextidr_write },
+      .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
     /* ??? This covers not just the impdef TLB lockdown registers but also
      * some v7VMSA registers relating to TEX remap, so it is overly broad.
      */
@@ -155,13 +169,17 @@ static const ARMCPRegInfo cp_reginfo[] = {
      * the unified TLB ops but also the dside/iside/inner-shareable variants.
      */
     { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
-      .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, },
+      .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
+      .type = ARM_CP_NO_MIGRATE },
     { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
-      .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, },
+      .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
+      .type = ARM_CP_NO_MIGRATE },
     { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
-      .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, },
+      .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
+      .type = ARM_CP_NO_MIGRATE },
     { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
-      .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, },
+      .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
+      .type = ARM_CP_NO_MIGRATE },
     /* Cache maintenance ops; some of this space may be overridden later. */
     { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
@@ -196,7 +214,8 @@ static const ARMCPRegInfo not_v7_cp_reginfo[] = {
       .resetvalue = 0 },
     /* v6 doesn't have the cache ID registers but Linux reads them anyway */
     { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
-      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
+      .resetvalue = 0 },
     REGINFO_SENTINEL
 };
 
@@ -235,6 +254,7 @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+
 static int pmreg_read(CPUARMState *env, const ARMCPRegInfo *ri,
                       uint64_t *value)
 {
@@ -366,13 +386,16 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
       .access = PL0_RW, .resetvalue = 0,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
-      .readfn = pmreg_read, .writefn = pmcntenset_write },
+      .readfn = pmreg_read, .writefn = pmcntenset_write,
+      .raw_readfn = raw_read, .raw_writefn = raw_write },
     { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
-      .readfn = pmreg_read, .writefn = pmcntenclr_write },
+      .readfn = pmreg_read, .writefn = pmcntenclr_write,
+      .type = ARM_CP_NO_MIGRATE },
     { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
-      .readfn = pmreg_read, .writefn = pmovsr_write },
+      .readfn = pmreg_read, .writefn = pmovsr_write,
+      .raw_readfn = raw_read, .raw_writefn = raw_write },
     /* Unimplemented so WI. Strictly speaking write accesses in PL0 should
      * respect PMUSERENR.
      */
@@ -389,7 +412,8 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
       .access = PL0_RW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
-      .readfn = pmreg_read, .writefn = pmxevtyper_write },
+      .readfn = pmreg_read, .writefn = pmxevtyper_write,
+      .raw_readfn = raw_read, .raw_writefn = raw_write },
     /* Unimplemented, RAZ/WI. XXX PMUSERENR */
     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
@@ -397,22 +421,21 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .access = PL0_R | PL1_RW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
       .resetvalue = 0,
-      .writefn = pmuserenr_write },
+      .writefn = pmuserenr_write, .raw_writefn = raw_write },
     { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
       .access = PL1_RW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .resetvalue = 0,
-      .writefn = pmintenset_write },
+      .writefn = pmintenset_write, .raw_writefn = raw_write },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
-      .access = PL1_RW,
+      .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-      .resetvalue = 0,
-      .writefn = pmintenclr_write },
+      .resetvalue = 0, .writefn = pmintenclr_write, },
     { .name = "SCR", .cp = 15, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_scr),
       .resetvalue = 0, },
     { .name = "CCSIDR", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
-      .access = PL1_R, .readfn = ccsidr_read },
+      .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_MIGRATE },
     { .name = "CSSELR", .cp = 15, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c0_cssel),
       .writefn = csselr_write, .resetvalue = 0 },
@@ -461,7 +484,7 @@ static const ARMCPRegInfo t2ee_cp_reginfo[] = {
       .writefn = teecr_write },
     { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
-      .resetvalue = 0,
+      .resetvalue = 0, .raw_readfn = raw_read, .raw_writefn = raw_write,
       .readfn = teehbr_read, .writefn = teehbr_write },
     REGINFO_SENTINEL
 };
@@ -486,7 +509,8 @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* Dummy implementation: RAZ/WI the whole crn=14 space */
     { .name = "GENERIC_TIMER", .cp = 15, .crn = 14,
       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
+      .resetvalue = 0 },
     REGINFO_SENTINEL
 };
 
@@ -579,7 +603,7 @@ static const ARMCPRegInfo vapa_cp_reginfo[] = {
       .writefn = par_write },
 #ifndef CONFIG_USER_ONLY
     { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
-      .access = PL1_W, .writefn = ats_write },
+      .access = PL1_W, .writefn = ats_write, .type = ARM_CP_NO_MIGRATE },
 #endif
     REGINFO_SENTINEL
 };
@@ -664,11 +688,11 @@ static int arm946_prbs_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
     { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
-      .access = PL1_RW,
+      .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
       .fieldoffset = offsetof(CPUARMState, cp15.c5_data), .resetvalue = 0,
       .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
     { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
-      .access = PL1_RW,
+      .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
       .fieldoffset = offsetof(CPUARMState, cp15.c5_insn), .resetvalue = 0,
       .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
     { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
@@ -690,15 +714,11 @@ static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 
-static int vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                            uint64_t value)
+static int vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                                uint64_t value)
 {
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
-        /* With LPAE the TTBCR could result in a change of ASID
-         * via the TTBCR.A1 bit, so do a TLB flush.
-         */
-        tlb_flush(env, 1);
     } else {
         value &= 7;
     }
@@ -713,6 +733,18 @@ static int vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     return 0;
 }
 
+static int vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                            uint64_t value)
+{
+    if (arm_feature(env, ARM_FEATURE_LPAE)) {
+        /* With LPAE the TTBCR could result in a change of ASID
+         * via the TTBCR.A1 bit, so do a TLB flush.
+         */
+        tlb_flush(env, 1);
+    }
+    return vmsa_ttbcr_raw_write(env, ri, value);
+}
+
 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     env->cp15.c2_base_mask = 0xffffc000u;
@@ -735,7 +767,7 @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.c2_base1), .resetvalue = 0, },
     { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .writefn = vmsa_ttbcr_write,
-      .resetfn = vmsa_ttbcr_reset,
+      .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write,
       .fieldoffset = offsetof(CPUARMState, cp15.c2_control) },
     { .name = "DFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c6_data),
@@ -801,6 +833,7 @@ static const ARMCPRegInfo omap_cp_reginfo[] = {
       .writefn = omap_threadid_write },
     { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
       .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
+      .type = ARM_CP_NO_MIGRATE,
       .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
     /* TODO: Peripheral port remap register:
      * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
@@ -808,7 +841,8 @@ static const ARMCPRegInfo omap_cp_reginfo[] = {
      * when MMU is off.
      */
     { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
-      .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, .type = ARM_CP_OVERRIDE,
+      .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
+      .type = ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE,
       .writefn = omap_cachemaint_write },
     { .name = "C9", .cp = 15, .crn = 9,
       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
@@ -848,21 +882,24 @@ static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
      */
     { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
+      .resetvalue = 0 },
     REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
     /* Cache status: RAZ because we have no cache so it's always clean */
     { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
-      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
+      .resetvalue = 0 },
     REGINFO_SENTINEL
 };
 
 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
     /* We never have a a block transfer operation in progress */
     { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
-      .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
+      .resetvalue = 0 },
     /* The cache ops themselves: these all NOP for QEMU */
     { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
@@ -884,9 +921,11 @@ static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
      * to indicate that there are no dirty cache lines.
      */
     { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
-      .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = (1 << 30) },
+      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
+      .resetvalue = (1 << 30) },
     { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
-      .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = (1 << 30) },
+      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
+      .resetvalue = (1 << 30) },
     REGINFO_SENTINEL
 };
 
@@ -894,8 +933,8 @@ static const ARMCPRegInfo strongarm_cp_reginfo[] = {
     /* Ignore ReadBuffer accesses */
     { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
-      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_OVERRIDE,
-      .resetvalue = 0 },
+      .access = PL1_RW, .resetvalue = 0,
+      .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE },
     REGINFO_SENTINEL
 };
 
@@ -921,7 +960,7 @@ static int mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
     { .name = "MPIDR", .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
-      .access = PL1_R, .readfn = mpidr_read },
+      .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_MIGRATE },
     REGINFO_SENTINEL
 };
 
@@ -951,14 +990,20 @@ static int ttbr064_read(CPUARMState *env, const ARMCPRegInfo *ri,
     return 0;
 }
 
-static int ttbr064_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
+static int ttbr064_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
 {
     env->cp15.c2_base0_hi = value >> 32;
     env->cp15.c2_base0 = value;
+    return 0;
+}
+
+static int ttbr064_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
     /* Writes to the 64 bit format TTBRs may change the ASID */
     tlb_flush(env, 1);
-    return 0;
+    return ttbr064_raw_write(env, ri, value);
 }
 
 static void ttbr064_reset(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -1008,7 +1053,8 @@ static const ARMCPRegInfo lpae_cp_reginfo[] = {
       .readfn = par64_read, .writefn = par64_write, .resetfn = par64_reset },
     { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
       .access = PL1_RW, .type = ARM_CP_64BIT, .readfn = ttbr064_read,
-      .writefn = ttbr064_write, .resetfn = ttbr064_reset },
+      .writefn = ttbr064_write, .raw_writefn = ttbr064_raw_write,
+      .resetfn = ttbr064_reset },
     { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
       .access = PL1_RW, .type = ARM_CP_64BIT, .readfn = ttbr164_read,
       .writefn = ttbr164_write, .resetfn = ttbr164_reset },
@@ -1104,7 +1150,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
             .access = PL0_RW, .resetvalue = cpu->midr & 0xff000000,
             .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
-            .readfn = pmreg_read, .writefn = pmcr_write
+            .readfn = pmreg_read, .writefn = pmcr_write,
+            .raw_readfn = raw_read, .raw_writefn = raw_write,
         };
         ARMCPRegInfo clidr = {
             .name = "CLIDR", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
@@ -1176,7 +1223,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "MIDR",
               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
               .access = PL1_R, .resetvalue = cpu->midr,
-              .writefn = arm_cp_write_ignore,
+              .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
               .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid) },
             { .name = "CTR",
               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
@@ -1245,7 +1292,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         ARMCPRegInfo sctlr = {
             .name = "SCTLR", .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
             .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_sys),
-            .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr
+            .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
+            .raw_writefn = raw_write,
         };
         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
             /* Normally we would always end the TB on an SCTLR write, but Linux
commit 7023ec7e2b4ee14f60c530ff9ce6e04127cf1802
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:06 2013 +0100

    target-arm: Add raw_readfn and raw_writefn to ARMCPRegInfo
    
    For reading and writing register values from the kernel for KVM,
    we need to provide accessor functions which are guaranteed to succeed
    and don't impose access checks, mask out unwritable bits, etc.
    Define new fields raw_readfn and raw_writefn for this purpose;
    these only need to be provided if there is a readfn or writefn
    already and it is not suitable.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 737c00c..1d8eba5 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -434,19 +434,22 @@ void armv7m_nvic_complete_irq(void *opaque, int irq);
  * a register definition to override a previous definition for the
  * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the
  * old must have the OVERRIDE bit set.
+ * NO_MIGRATE indicates that this register should be ignored for migration;
+ * (eg because any state is accessed via some other coprocessor register).
  */
 #define ARM_CP_SPECIAL 1
 #define ARM_CP_CONST 2
 #define ARM_CP_64BIT 4
 #define ARM_CP_SUPPRESS_TB_END 8
 #define ARM_CP_OVERRIDE 16
+#define ARM_CP_NO_MIGRATE 32
 #define ARM_CP_NOP (ARM_CP_SPECIAL | (1 << 8))
 #define ARM_CP_WFI (ARM_CP_SPECIAL | (2 << 8))
 #define ARM_LAST_SPECIAL ARM_CP_WFI
 /* Used only as a terminator for ARMCPRegInfo lists */
 #define ARM_CP_SENTINEL 0xffff
 /* Mask of only the flag bits in a type field */
-#define ARM_CP_FLAG_MASK 0x1f
+#define ARM_CP_FLAG_MASK 0x3f
 
 /* Return true if cptype is a valid type field. This is used to try to
  * catch errors where the sentinel has been accidentally left off the end
@@ -562,6 +565,19 @@ struct ARMCPRegInfo {
      * by fieldoffset.
      */
     CPWriteFn *writefn;
+    /* Function for doing a "raw" read; used when we need to copy
+     * coprocessor state to the kernel for KVM or out for
+     * migration. This only needs to be provided if there is also a
+     * readfn and it makes an access permission check.
+     */
+    CPReadFn *raw_readfn;
+    /* Function for doing a "raw" write; used when we need to copy KVM
+     * kernel coprocessor state into userspace, or for inbound
+     * migration. This only needs to be provided if there is also a
+     * writefn and it makes an access permission check or masks out
+     * "unwritable" bits or has write-one-to-clear or similar behaviour.
+     */
+    CPWriteFn *raw_writefn;
     /* Function for resetting the register. If NULL, then reset will be done
      * by writing resetvalue to the field specified in fieldoffset. If
      * fieldoffset is 0 then no reset will be done.
diff --git a/target-arm/helper.c b/target-arm/helper.c
index fd055e8..2585d59 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1392,6 +1392,19 @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                 r2->crm = crm;
                 r2->opc1 = opc1;
                 r2->opc2 = opc2;
+                /* By convention, for wildcarded registers only the first
+                 * entry is used for migration; the others are marked as
+                 * NO_MIGRATE so we don't try to transfer the register
+                 * multiple times. Special registers (ie NOP/WFI) are
+                 * never migratable.
+                 */
+                if ((r->type & ARM_CP_SPECIAL) ||
+                    ((r->crm == CP_ANY) && crm != 0) ||
+                    ((r->opc1 == CP_ANY) && opc1 != 0) ||
+                    ((r->opc2 == CP_ANY) && opc2 != 0)) {
+                    r2->type |= ARM_CP_NO_MIGRATE;
+                }
+
                 /* Overriding of an existing definition must be explicitly
                  * requested.
                  */
commit 34affeefbbdbd97471c283677179254a2e006994
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jun 25 18:16:06 2013 +0100

    target-arm: Allow special cpregs to have flags set
    
    Relax the "is this a valid ARMCPRegInfo type value?" check to permit
    "special" cpregs to have flags other than ARM_CP_SPECIAL set. At
    the moment none of the other flags are relevant for special regs,
    but the migration related flag we're about to introduce can apply
    here too.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 5438444..737c00c 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -456,7 +456,7 @@ static inline bool cptype_valid(int cptype)
 {
     return ((cptype & ~ARM_CP_FLAG_MASK) == 0)
         || ((cptype & ARM_CP_SPECIAL) &&
-            (cptype <= ARM_LAST_SPECIAL));
+            ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL));
 }
 
 /* Access rights:
commit 320ce8503baf081725f74514d73d7bd65071a45e
Author: Cornelia Huck <cornelia.huck at de.ibm.com>
Date:   Tue Feb 19 13:48:17 2013 +0100

    virtio-ccw: Wire up guest and host notifies.
    
    Guest and host notifiers are needed by vhost. We use ioeventfds for
    the guest notifiers, but need to fall back on qemu injecting interrupts
    for the host notifiers.
    
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 4ad9d9a..faef5dd 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -101,6 +101,7 @@ static void virtio_ccw_start_ioeventfd(VirtioCcwDevice *dev)
     int n, r;
 
     if (!(dev->flags & VIRTIO_CCW_FLAG_USE_IOEVENTFD) ||
+        dev->ioeventfd_disabled ||
         dev->ioeventfd_started) {
         return;
     }
@@ -911,6 +912,90 @@ static void virtio_ccw_vmstate_change(DeviceState *d, bool running)
     }
 }
 
+static bool virtio_ccw_query_guest_notifiers(DeviceState *d)
+{
+    VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
+
+    return !!(dev->sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ENA);
+}
+
+static int virtio_ccw_set_host_notifier(DeviceState *d, int n, bool assign)
+{
+    VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
+
+    /* Stop using the generic ioeventfd, we are doing eventfd handling
+     * ourselves below */
+    dev->ioeventfd_disabled = assign;
+    if (assign) {
+        virtio_ccw_stop_ioeventfd(dev);
+    }
+    return virtio_ccw_set_guest2host_notifier(dev, n, assign, false);
+}
+
+static int virtio_ccw_set_guest_notifier(VirtioCcwDevice *dev, int n,
+                                         bool assign, bool with_irqfd)
+{
+    VirtQueue *vq = virtio_get_queue(dev->vdev, n);
+    EventNotifier *notifier = virtio_queue_get_guest_notifier(vq);
+    VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(dev->vdev);
+
+    if (assign) {
+        int r = event_notifier_init(notifier, 0);
+
+        if (r < 0) {
+            return r;
+        }
+        virtio_queue_set_guest_notifier_fd_handler(vq, true, with_irqfd);
+        /* We do not support irqfd for classic I/O interrupts, because the
+         * classic interrupts are intermixed with the subchannel status, that
+         * is queried with test subchannel. We want to use vhost, though.
+         * Lets make sure to have vhost running and wire up the irq fd to
+         * land in qemu (and only the irq fd) in this code.
+         */
+        if (k->guest_notifier_mask) {
+            k->guest_notifier_mask(dev->vdev, n, false);
+        }
+        /* get lost events and re-inject */
+        if (k->guest_notifier_pending &&
+            k->guest_notifier_pending(dev->vdev, n)) {
+            event_notifier_set(notifier);
+        }
+    } else {
+        if (k->guest_notifier_mask) {
+            k->guest_notifier_mask(dev->vdev, n, true);
+        }
+        virtio_queue_set_guest_notifier_fd_handler(vq, false, with_irqfd);
+        event_notifier_cleanup(notifier);
+    }
+    return 0;
+}
+
+static int virtio_ccw_set_guest_notifiers(DeviceState *d, int nvqs,
+                                          bool assigned)
+{
+    VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
+    VirtIODevice *vdev = dev->vdev;
+    int r, n;
+
+    for (n = 0; n < nvqs; n++) {
+        if (!virtio_queue_get_num(vdev, n)) {
+            break;
+        }
+        /* false -> true, as soon as irqfd works */
+        r = virtio_ccw_set_guest_notifier(dev, n, assigned, false);
+        if (r < 0) {
+            goto assign_error;
+        }
+    }
+    return 0;
+
+assign_error:
+    while (--n >= 0) {
+        virtio_ccw_set_guest_notifier(dev, n, !assigned, false);
+    }
+    return r;
+}
+
 /**************** Virtio-ccw Bus Device Descriptions *******************/
 
 static Property virtio_ccw_net_properties[] = {
@@ -1224,6 +1309,9 @@ static void virtio_ccw_bus_class_init(ObjectClass *klass, void *data)
     k->notify = virtio_ccw_notify;
     k->get_features = virtio_ccw_get_features;
     k->vmstate_change = virtio_ccw_vmstate_change;
+    k->query_guest_notifiers = virtio_ccw_query_guest_notifiers;
+    k->set_host_notifier = virtio_ccw_set_host_notifier;
+    k->set_guest_notifiers = virtio_ccw_set_guest_notifiers;
 }
 
 static const TypeInfo virtio_ccw_bus_info = {
diff --git a/hw/s390x/virtio-ccw.h b/hw/s390x/virtio-ccw.h
index 433f27a..96d6f5d 100644
--- a/hw/s390x/virtio-ccw.h
+++ b/hw/s390x/virtio-ccw.h
@@ -82,6 +82,7 @@ struct VirtioCcwDevice {
     uint32_t host_features[VIRTIO_CCW_FEATURE_SIZE];
     VirtioBusState bus;
     bool ioeventfd_started;
+    bool ioeventfd_disabled;
     uint32_t flags;
     /* Guest provided values: */
     hwaddr indicators;
commit b4436a0b4db0334c3157f71e9baa2944a133c4d4
Author: Cornelia Huck <cornelia.huck at de.ibm.com>
Date:   Fri Feb 15 10:18:43 2013 +0100

    virtio-ccw: Wire up ioeventfd.
    
    On hosts that support ioeventfd, make use of it for host-to-guest
    notifications via diagnose 500.
    
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index f82abfe..93b0b97 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -68,7 +68,7 @@ int css_create_css_image(uint8_t cssid, bool default_image)
     return 0;
 }
 
-static uint16_t css_build_subchannel_id(SubchDev *sch)
+uint16_t css_build_subchannel_id(SubchDev *sch)
 {
     if (channel_subsys->max_cssid > 0) {
         return (sch->cssid << 8) | (1 << 3) | (sch->ssid << 1) | 1;
diff --git a/hw/s390x/css.h b/hw/s390x/css.h
index 85ed05d..b536ab5 100644
--- a/hw/s390x/css.h
+++ b/hw/s390x/css.h
@@ -90,6 +90,7 @@ bool css_devno_used(uint8_t cssid, uint8_t ssid, uint16_t devno);
 void css_subch_assign(uint8_t cssid, uint8_t ssid, uint16_t schid,
                       uint16_t devno, SubchDev *sch);
 void css_sch_build_virtual_schib(SubchDev *sch, uint8_t chpid, uint8_t type);
+uint16_t css_build_subchannel_id(SubchDev *sch);
 void css_reset(void);
 void css_reset_sch(SubchDev *sch);
 void css_queue_crw(uint8_t rsc, uint8_t erc, int chain, uint16_t rsid);
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index de51589..4ad9d9a 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -63,6 +63,90 @@ VirtIODevice *virtio_ccw_get_vdev(SubchDev *sch)
     return vdev;
 }
 
+static int virtio_ccw_set_guest2host_notifier(VirtioCcwDevice *dev, int n,
+                                              bool assign, bool set_handler)
+{
+    VirtQueue *vq = virtio_get_queue(dev->vdev, n);
+    EventNotifier *notifier = virtio_queue_get_host_notifier(vq);
+    int r = 0;
+    SubchDev *sch = dev->sch;
+    uint32_t sch_id = (css_build_subchannel_id(sch) << 16) | sch->schid;
+
+    if (assign) {
+        r = event_notifier_init(notifier, 1);
+        if (r < 0) {
+            error_report("%s: unable to init event notifier: %d", __func__, r);
+            return r;
+        }
+        virtio_queue_set_host_notifier_fd_handler(vq, true, set_handler);
+        r = s390_assign_subch_ioeventfd(event_notifier_get_fd(notifier), sch_id,
+                                        n, assign);
+        if (r < 0) {
+            error_report("%s: unable to assign ioeventfd: %d", __func__, r);
+            virtio_queue_set_host_notifier_fd_handler(vq, false, false);
+            event_notifier_cleanup(notifier);
+            return r;
+        }
+    } else {
+        virtio_queue_set_host_notifier_fd_handler(vq, false, false);
+        s390_assign_subch_ioeventfd(event_notifier_get_fd(notifier), sch_id,
+                                    n, assign);
+        event_notifier_cleanup(notifier);
+    }
+    return r;
+}
+
+static void virtio_ccw_start_ioeventfd(VirtioCcwDevice *dev)
+{
+    int n, r;
+
+    if (!(dev->flags & VIRTIO_CCW_FLAG_USE_IOEVENTFD) ||
+        dev->ioeventfd_started) {
+        return;
+    }
+    for (n = 0; n < VIRTIO_PCI_QUEUE_MAX; n++) {
+        if (!virtio_queue_get_num(dev->vdev, n)) {
+            continue;
+        }
+        r = virtio_ccw_set_guest2host_notifier(dev, n, true, true);
+        if (r < 0) {
+            goto assign_error;
+        }
+    }
+    dev->ioeventfd_started = true;
+    return;
+
+  assign_error:
+    while (--n >= 0) {
+        if (!virtio_queue_get_num(dev->vdev, n)) {
+            continue;
+        }
+        r = virtio_ccw_set_guest2host_notifier(dev, n, false, false);
+        assert(r >= 0);
+    }
+    dev->ioeventfd_started = false;
+    /* Disable ioeventfd for this device. */
+    dev->flags &= ~VIRTIO_CCW_FLAG_USE_IOEVENTFD;
+    error_report("%s: failed. Fallback to userspace (slower).", __func__);
+}
+
+static void virtio_ccw_stop_ioeventfd(VirtioCcwDevice *dev)
+{
+    int n, r;
+
+    if (!dev->ioeventfd_started) {
+        return;
+    }
+    for (n = 0; n < VIRTIO_PCI_QUEUE_MAX; n++) {
+        if (!virtio_queue_get_num(dev->vdev, n)) {
+            continue;
+        }
+        r = virtio_ccw_set_guest2host_notifier(dev, n, false, false);
+        assert(r >= 0);
+    }
+    dev->ioeventfd_started = false;
+}
+
 VirtualCssBus *virtual_css_bus_init(void)
 {
     VirtualCssBus *cbus;
@@ -187,6 +271,7 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
         }
         break;
     case CCW_CMD_VDEV_RESET:
+        virtio_ccw_stop_ioeventfd(dev);
         virtio_reset(dev->vdev);
         ret = 0;
         break;
@@ -309,10 +394,16 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
             ret = -EFAULT;
         } else {
             status = ldub_phys(ccw.cda);
+            if (!(status & VIRTIO_CONFIG_S_DRIVER_OK)) {
+                virtio_ccw_stop_ioeventfd(dev);
+            }
             virtio_set_status(dev->vdev, status);
             if (dev->vdev->status == 0) {
                 virtio_reset(dev->vdev);
             }
+            if (status & VIRTIO_CONFIG_S_DRIVER_OK) {
+                virtio_ccw_start_ioeventfd(dev);
+            }
             sch->curr_status.scsw.count = ccw.count - sizeof(status);
             ret = 0;
         }
@@ -540,6 +631,7 @@ static int virtio_ccw_exit(VirtioCcwDevice *dev)
 {
     SubchDev *sch = dev->sch;
 
+    virtio_ccw_stop_ioeventfd(dev);
     if (sch) {
         css_subch_assign(sch->cssid, sch->ssid, sch->schid, sch->devno, NULL);
         g_free(sch);
@@ -801,12 +893,24 @@ static void virtio_ccw_reset(DeviceState *d)
 {
     VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
 
+    virtio_ccw_stop_ioeventfd(dev);
     virtio_reset(dev->vdev);
     css_reset_sch(dev->sch);
     dev->indicators = 0;
     dev->indicators2 = 0;
 }
 
+static void virtio_ccw_vmstate_change(DeviceState *d, bool running)
+{
+    VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
+
+    if (running) {
+        virtio_ccw_start_ioeventfd(dev);
+    } else {
+        virtio_ccw_stop_ioeventfd(dev);
+    }
+}
+
 /**************** Virtio-ccw Bus Device Descriptions *******************/
 
 static Property virtio_ccw_net_properties[] = {
@@ -814,6 +918,8 @@ static Property virtio_ccw_net_properties[] = {
     DEFINE_VIRTIO_NET_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_VIRTIO_NET_PROPERTIES(VirtIONetCcw, vdev.net_conf),
     DEFINE_NIC_PROPERTIES(VirtIONetCcw, vdev.nic_conf),
+    DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
+                    VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -840,6 +946,8 @@ static Property virtio_ccw_blk_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
     DEFINE_VIRTIO_BLK_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_VIRTIO_BLK_PROPERTIES(VirtIOBlkCcw, blk),
+    DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
+                    VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -866,6 +974,8 @@ static Property virtio_ccw_serial_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
     DEFINE_VIRTIO_SERIAL_PROPERTIES(VirtioSerialCcw, vdev.serial),
     DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
+    DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
+                    VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -891,6 +1001,8 @@ static const TypeInfo virtio_ccw_serial = {
 static Property virtio_ccw_balloon_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
     DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
+    DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
+                    VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -917,6 +1029,8 @@ static Property virtio_ccw_scsi_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
     DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSICcw, vdev.parent_obj.conf),
     DEFINE_VIRTIO_SCSI_FEATURES(VirtioCcwDevice, host_features[0]),
+    DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
+                    VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -980,6 +1094,8 @@ static Property virtio_ccw_rng_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
     DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_VIRTIO_RNG_PROPERTIES(VirtIORNGCcw, vdev.conf),
+    DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
+                    VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -1107,6 +1223,7 @@ static void virtio_ccw_bus_class_init(ObjectClass *klass, void *data)
     bus_class->max_dev = 1;
     k->notify = virtio_ccw_notify;
     k->get_features = virtio_ccw_get_features;
+    k->vmstate_change = virtio_ccw_vmstate_change;
 }
 
 static const TypeInfo virtio_ccw_bus_info = {
diff --git a/hw/s390x/virtio-ccw.h b/hw/s390x/virtio-ccw.h
index 121a5f8..433f27a 100644
--- a/hw/s390x/virtio-ccw.h
+++ b/hw/s390x/virtio-ccw.h
@@ -69,6 +69,11 @@ typedef struct VirtIOCCWDeviceClass {
 /* Change here if we want to support more feature bits. */
 #define VIRTIO_CCW_FEATURE_SIZE 1
 
+/* Performance improves when virtqueue kick processing is decoupled from the
+ * vcpu thread using ioeventfd for some devices. */
+#define VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT 1
+#define VIRTIO_CCW_FLAG_USE_IOEVENTFD   (1 << VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT)
+
 struct VirtioCcwDevice {
     DeviceState parent_obj;
     SubchDev *sch;
@@ -76,6 +81,8 @@ struct VirtioCcwDevice {
     char *bus_id;
     uint32_t host_features[VIRTIO_CCW_FEATURE_SIZE];
     VirtioBusState bus;
+    bool ioeventfd_started;
+    uint32_t flags;
     /* Guest provided values: */
     hwaddr indicators;
     hwaddr indicators2;
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 0ce82cf..918c819 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -1081,6 +1081,7 @@ void kvm_s390_io_interrupt(S390CPU *cpu, uint16_t subchannel_id,
 void kvm_s390_crw_mchk(S390CPU *cpu);
 void kvm_s390_enable_css_support(S390CPU *cpu);
 int kvm_s390_get_registers_partial(CPUState *cpu);
+int kvm_s390_assign_subch_ioeventfd(int fd, uint32_t sch, int vq, bool assign);
 #else
 static inline void kvm_s390_io_interrupt(S390CPU *cpu,
                                         uint16_t subchannel_id,
@@ -1099,6 +1100,11 @@ static inline int kvm_s390_get_registers_partial(CPUState *cpu)
 {
     return -ENOSYS;
 }
+static inline int kvm_s390_assign_subch_ioeventfd(int fd, uint32_t sch, int vq,
+                                                  bool assign)
+{
+    return -ENOSYS;
+}
 #endif
 
 static inline void s390_io_interrupt(S390CPU *cpu,
@@ -1125,4 +1131,14 @@ static inline void s390_crw_mchk(S390CPU *cpu)
     }
 }
 
+static inline int s390_assign_subch_ioeventfd(int fd, uint32_t sch_id, int vq,
+                                              bool assign)
+{
+    if (kvm_enabled()) {
+        return kvm_s390_assign_subch_ioeventfd(fd, sch_id, vq, assign);
+    } else {
+        return -ENOSYS;
+    }
+}
+
 #endif
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 4d9ac4a..650d3a5 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -932,3 +932,22 @@ void kvm_s390_enable_css_support(S390CPU *cpu)
 void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
+
+int kvm_s390_assign_subch_ioeventfd(int fd, uint32_t sch, int vq, bool assign)
+{
+    struct kvm_ioeventfd kick = {
+        .flags = KVM_IOEVENTFD_FLAG_VIRTIO_CCW_NOTIFY |
+        KVM_IOEVENTFD_FLAG_DATAMATCH,
+        .fd = fd,
+        .datamatch = vq,
+        .addr = sch,
+        .len = 8,
+    };
+    if (!kvm_check_extension(kvm_state, KVM_CAP_IOEVENTFD)) {
+        return -ENOSYS;
+    }
+    if (!assign) {
+        kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
+    }
+    return kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &kick);
+}
commit 6504a93011138458a2e4f67b513c5a77bdb3cae1
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Fri Jun 7 12:18:46 2013 +0200

    s390/virtio-ccw: Fix virtio reset
    
    On virtio reset we must reset the indicator to avoid stale interrupts,
    e.g. after a reset.
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 201a635..de51589 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -803,6 +803,8 @@ static void virtio_ccw_reset(DeviceState *d)
 
     virtio_reset(dev->vdev);
     css_reset_sch(dev->sch);
+    dev->indicators = 0;
+    dev->indicators2 = 0;
 }
 
 /**************** Virtio-ccw Bus Device Descriptions *******************/
commit 39ae4972390f78f8891a355545c56d20a9fb7770
Author: Paul Durrant <paul.durrant at citrix.com>
Date:   Tue Jun 25 11:46:44 2013 +0000

    Move hardcoded initialization of xen-platform device.
    
    Creation of the xen-platform device is currently hardcoded into machine
    type pc's initialization code, guarded by a test for the whether the xen
    accelerator is enabled. This patch moves the creation of xen-platform into
    the initialization code of the xenfv machine type. This maintains backwards
    compatibility for that machine type but allows more flexibility if another
    machine type is used with Xen HVM domains.
    
    Signed-off-by: Paul Durrant <paul.durrant at citrix.com>
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 2782e1d..fa59a0c 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -179,9 +179,6 @@ static void pc_init1(MemoryRegion *system_memory,
     pc_register_ferr_irq(gsi[13]);
 
     pc_vga_init(isa_bus, pci_enabled ? pci_bus : NULL);
-    if (xen_enabled()) {
-        pci_create_simple(pci_bus, -1, "xen-platform");
-    }
 
     /* init basic PC hardware */
     pc_basic_device_init(isa_bus, gsi, &rtc_state, &floppy, xen_enabled());
@@ -325,7 +322,14 @@ static void pc_init_isa(QEMUMachineInitArgs *args)
 #ifdef CONFIG_XEN
 static void pc_xen_hvm_init(QEMUMachineInitArgs *args)
 {
+    PCIBus *bus;
+
     pc_init_pci(args);
+
+    bus = pci_find_root_bus(0);
+    if (bus != NULL) {
+        pci_create_simple(bus, -1, "xen-platform");
+    }
 }
 #endif
 
commit a97d6fe6fbb97630d77253d20bdce78f76d01850
Author: Paul Durrant <paul.durrant at citrix.com>
Date:   Tue Jun 25 11:46:37 2013 +0000

    Allow use of pc machine type (accel=xen) for Xen HVM domains.
    
    Xen HVM domains normally spawn QEMU with a dedicated xenfv machine type. The
    initialization code for this machine type can easily be pulled into the
    generic pc initialization code and guarded with a test for whether the xen
    accelerator options is specified, which is more consistent with the way
    other accelerators are used.
    
    Signed-off-by: Paul Durrant <paul.durrant at citrix.com>
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 523baac..2782e1d 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -91,6 +91,11 @@ static void pc_init1(MemoryRegion *system_memory,
     DeviceState *icc_bridge;
     FWCfgState *fw_cfg = NULL;
 
+    if (xen_enabled() && xen_hvm_init() != 0) {
+        fprintf(stderr, "xen hardware virtual machine initialisation failed\n");
+        exit(1);
+    }
+
     icc_bridge = qdev_create(NULL, TYPE_ICC_BRIDGE);
     object_property_add_child(qdev_get_machine(), "icc-bridge",
                               OBJECT(icc_bridge), NULL);
@@ -320,9 +325,6 @@ static void pc_init_isa(QEMUMachineInitArgs *args)
 #ifdef CONFIG_XEN
 static void pc_xen_hvm_init(QEMUMachineInitArgs *args)
 {
-    if (xen_hvm_init() != 0) {
-        hw_error("xen hardware virtual machine initialisation failed");
-    }
     pc_init_pci(args);
 }
 #endif
diff --git a/xen-stub.c b/xen-stub.c
index 6f0516a..47c8e73 100644
--- a/xen-stub.c
+++ b/xen-stub.c
@@ -63,3 +63,8 @@ void qmp_xen_set_global_dirty_log(bool enable, Error **errp)
 void xen_modified_memory(ram_addr_t start, ram_addr_t length)
 {
 }
+
+int xen_hvm_init(void)
+{
+    return 0;
+}
commit fc744bb10cde3ba7b9ecbaf9e723e99d3b7fa25c
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Tue Jun 25 11:43:04 2013 +0000

    Revert "xen: start PCI hole at 0xe0000000 (same as pc_init1 and qemu-xen-traditional)"
    
    This reverts commit 9f24a8030a70ea4954b5b8c48f606012f086f65f.
    
    The start of the PCI hole is actually set to 0xf0000000 by hvmloader.
    In order to retain ABI compatibility with Xen we leave the start of the
    PCI hole at 0xf0000000 in QEMU (for Xen) too.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 7972443..523baac 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -102,9 +102,9 @@ static void pc_init1(MemoryRegion *system_memory,
         kvmclock_create();
     }
 
-    if (ram_size >= QEMU_BELOW_4G_RAM_END ) {
-        above_4g_mem_size = ram_size - QEMU_BELOW_4G_RAM_END;
-        below_4g_mem_size = QEMU_BELOW_4G_RAM_END;
+    if (ram_size >= 0xe0000000 ) {
+        above_4g_mem_size = ram_size - 0xe0000000;
+        below_4g_mem_size = 0xe0000000;
     } else {
         above_4g_mem_size = 0;
         below_4g_mem_size = ram_size;
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 7f04967..a417402 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -79,9 +79,6 @@ extern int fd_bootchk;
 void pc_register_ferr_irq(qemu_irq irq);
 void pc_acpi_smi_interrupt(void *opaque, int irq, int level);
 
-#define QEMU_BELOW_4G_RAM_END       0xe0000000
-#define QEMU_BELOW_4G_MMIO_LENGTH   ((1ULL << 32) - QEMU_BELOW_4G_RAM_END)
-
 void pc_cpus_init(const char *cpu_model, DeviceState *icc_bridge);
 void pc_hot_add_cpu(const int64_t id, Error **errp);
 void pc_acpi_init(const char *default_dsdt);
diff --git a/xen-all.c b/xen-all.c
index 9b57350..dcb57a0 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -161,18 +161,18 @@ static void xen_ram_init(ram_addr_t ram_size)
     ram_addr_t block_len;
 
     block_len = ram_size;
-    if (ram_size >= QEMU_BELOW_4G_RAM_END) {
+    if (ram_size >= HVM_BELOW_4G_RAM_END) {
         /* Xen does not allocate the memory continuously, and keep a hole at
-         * QEMU_BELOW_4G_RAM_END of QEMU_BELOW_4G_MMIO_LENGTH
+         * HVM_BELOW_4G_MMIO_START of HVM_BELOW_4G_MMIO_LENGTH
          */
-        block_len += QEMU_BELOW_4G_MMIO_LENGTH;
+        block_len += HVM_BELOW_4G_MMIO_LENGTH;
     }
     memory_region_init_ram(&ram_memory, "xen.ram", block_len);
     vmstate_register_ram_global(&ram_memory);
 
-    if (ram_size >= QEMU_BELOW_4G_RAM_END) {
-        above_4g_mem_size = ram_size - QEMU_BELOW_4G_RAM_END;
-        below_4g_mem_size = QEMU_BELOW_4G_RAM_END;
+    if (ram_size >= HVM_BELOW_4G_RAM_END) {
+        above_4g_mem_size = ram_size - HVM_BELOW_4G_RAM_END;
+        below_4g_mem_size = HVM_BELOW_4G_RAM_END;
     } else {
         below_4g_mem_size = ram_size;
     }
commit baf8673ca802cb3ea2cdbe94813441d23bde223b
Merge: 9fbbf0d 96c51eb
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jun 24 14:33:17 2013 -0500

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Kevin Wolf (22) and Fam Zheng (1)
    # Via Stefan Hajnoczi
    * stefanha/block: (23 commits)
      vmdk: refuse to open higher version than supported
      block: Always enable discard on the protocol level
      qcow2: Batch discards
      qcow2: Options to enable discard for freed clusters
      qcow2: Add refcount update reason to all callers
      Revert "block: Disable driver-specific options for 1.5"
      ide: Clean up ide_exec_cmd()
      ide: Convert SMART commands to ide_cmd_table handler
      ide: Convert CF-ATA commands to ide_cmd_table handler
      ide: Convert ATAPI commands to ide_cmd_table handler
      ide: Convert SEEK to ide_cmd_table handler
      ide: Convert FLUSH CACHE to ide_cmd_table handler
      ide: Convert SET FEATURES to ide_cmd_table handler
      ide: Convert CHECK POWER MDOE to ide_cmd_table handler
      ide: Convert READ NATIVE MAX ADDRESS to ide_cmd_table handler
      ide: Convert DMA read/write commands to ide_cmd_table handler
      ide: Convert PIO read/write commands to ide_cmd_table handler
      ide: Convert read/write multiple commands to ide_cmd_table handler
      ide: Convert verify commands to ide_cmd_table handler
      ide: Convert cmd_nop commands to ide_cmd_table handler
      ...
    
    Message-id: 1372065035-19601-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 9fbbf0d1b16a0e3e4132b187c2beba458964ea98
Merge: 89f204d 5ad24e5
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jun 24 14:33:09 2013 -0500

    Merge remote-tracking branch 'spice/spice.v71' into staging
    
    # By Gerd Hoffmann (1) and Hans de Goede (1)
    # Via Gerd Hoffmann
    * spice/spice.v71:
      spice: Add -spice disable-agent-file-transfer cmdline option (rhbz#961850)
      qxl: fix Coverity scan SIGN_EXTENSION error
    
    Message-id: 1372060666-18182-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 89f204d2c60fbf3e0c5af1ff1681e57c9f057178
Merge: 21ca4a5 93c8e4d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jun 24 14:33:00 2013 -0500

    Merge remote-tracking branch 'kraxel/usb.84' into staging
    
    # By Andreas Färber (3) and others
    # Via Gerd Hoffmann
    * kraxel/usb.84:
      usb: fix serial number for hid devices
      usb: add serial bus property
      usb-host-libusb: set USB_DEV_FLAG_IS_HOST
      usb/host-libusb: Fix building with libusb git master code
      usb/hcd-ehci: Add Faraday FUSBH200 support
      usb/hcd-ehci: Replace PORTSC macros with variables
      usb/hcd-ehci: Add Tegra2 SysBus EHCI device
      usb/hcd-ehci: Split off instance_init from realize
      usb/hcd-ehci-sysbus: Convert to QOM realize

commit 21ca4a5bb3cde109e68059ee357b3114afbc51e4
Merge: b52df46 464e367
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jun 24 14:32:33 2013 -0500

    Merge remote-tracking branch 'mjt/trivial-patches' into staging
    
    # By Stefan Weil (5) and others
    # Via Michael Tokarev
    * mjt/trivial-patches:
      configure: Add signed*signed check to [u]int128_t test
      Makefile: pass include directives to dtc via CPPFLAGS, not CFLAGS
      qapi: lack of two commas in dict
      sd: pass bool parameter for sd_init
      qemu-char: use bool in qemu_chr_open_socket and simplify code a bit
      vnc: use booleans for vnc_connect, vnc_listen_read and vnc_display_add_client
      block/nand: Formatting sweep
      qxl: Fix QXLRam initialisation.
      acl: acl_add can't insert before last list element, fix
      configure: Fix "ERROR: ERROR: " for missing/incompatible DTC
      audio: Replace static functions in header file by macros, remove GCC_ATTR
      libcacard: Fix cppcheck warning and remove unneeded code
      savevm: Fix potential memory leak
      kvm: Fix potential resource leak (missing fclose)
      qemu-img: Add missing GCC_FMT_ATTR
      qemu-options: trivial fix for -mon args help
      vl: reformat SDL ifdeffery a bit
    
    Message-id: 1371893076-9643-1-git-send-email-mjt at msgid.tls.msk.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit b52df46551d303ffc79ec39c38440bd8a62ee210
Author: Edgar E. Iglesias <edgar.iglesias at gmail.com>
Date:   Tue Jun 18 09:22:55 2013 +0200

    cadence_uart: Handle backend tx errors
    
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index c2a7834..205e125 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -297,9 +297,7 @@ static void uart_write_tx_fifo(UartState *s, const uint8_t *buf, int size)
         return;
     }
 
-    while (size) {
-        size -= qemu_chr_fe_write(s->chr, buf, size);
-    }
+    qemu_chr_fe_write_all(s->chr, buf, size);
 }
 
 static void uart_receive(void *opaque, const uint8_t *buf, int size)
commit 96c51eb5e46af2312b33f745ad72acb20e799aea
Author: Fam Zheng <famz at redhat.com>
Date:   Thu Jun 13 11:21:29 2013 +0800

    vmdk: refuse to open higher version than supported
    
    Refuse to open higher version for safety.
    
    Although we try to be compatible with published VMDK spec, VMware has
    newer version from ESXi 5.1 exported OVF/OVA, which we have no knowledge
    what's changed in it. And it is very likely to have more new versions in
    the future, so it's not safe to open them blindly.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vmdk.c b/block/vmdk.c
index 65ae011..975e1d4 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -561,6 +561,15 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
         header = footer.header;
     }
 
+    if (le32_to_cpu(header.version) >= 3) {
+        char buf[64];
+        snprintf(buf, sizeof(buf), "VMDK version %d",
+                 le32_to_cpu(header.version));
+        qerror_report(QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
+                bs->device_name, "vmdk", buf);
+        return -ENOTSUP;
+    }
+
     l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte)
                         * le64_to_cpu(header.granularity);
     if (l1_entry_sectors == 0) {
commit 50b05b6f2e24296b4d739a638e1e7427767ed7cd
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jun 19 13:44:21 2013 +0200

    block: Always enable discard on the protocol level
    
    Turning on discard options in qcow2 doesn't help a lot when the discard
    requests that it issues are thrown away by the raw-posix layer. This
    patch always enables discard functionality on the protocol level so that
    it's the image format's responsibility to send (or not) discard
    requests. Requests sent by the guest will be allowed or ignored by the
    top level BlockDriverState, which depends on the discard=... option like
    before.
    
    In particular, this means that even without specifying options, the
    qcow2 default of discarding deleted snapshots actually takes effect now,
    both for qemu and qemu-img.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index b88ad2f..8e77d46 100644
--- a/block.c
+++ b/block.c
@@ -1045,7 +1045,7 @@ int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
     extract_subqdict(options, &file_options, "file.");
 
     ret = bdrv_file_open(&file, filename, file_options,
-                         bdrv_open_flags(bs, flags));
+                         bdrv_open_flags(bs, flags | BDRV_O_UNMAP));
     if (ret < 0) {
         goto fail;
     }
commit 0b919fae31f4f80f78ebeab8388dc3a03cc5e4ed
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jun 19 13:44:20 2013 +0200

    qcow2: Batch discards
    
    This optimises the discard operation for freed clusters by batching
    discard requests (both snapshot deletion and bdrv_discard end up
    updating the refcounts cluster by cluster).
    
    Note that we don't discard asynchronously, but keep s->lock held. This
    is to avoid that a freed cluster is reallocated and written to while the
    discard is still in flight.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 3191d6b..cca76d4 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -1377,18 +1377,25 @@ int qcow2_discard_clusters(BlockDriverState *bs, uint64_t offset,
 
     nb_clusters = size_to_clusters(s, end_offset - offset);
 
+    s->cache_discards = true;
+
     /* Each L2 table is handled by its own loop iteration */
     while (nb_clusters > 0) {
         ret = discard_single_l2(bs, offset, nb_clusters);
         if (ret < 0) {
-            return ret;
+            goto fail;
         }
 
         nb_clusters -= ret;
         offset += (ret * s->cluster_size);
     }
 
-    return 0;
+    ret = 0;
+fail:
+    s->cache_discards = false;
+    qcow2_process_discards(bs, ret);
+
+    return ret;
 }
 
 /*
@@ -1450,15 +1457,22 @@ int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors)
     /* Each L2 table is handled by its own loop iteration */
     nb_clusters = size_to_clusters(s, nb_sectors << BDRV_SECTOR_BITS);
 
+    s->cache_discards = true;
+
     while (nb_clusters > 0) {
         ret = zero_single_l2(bs, offset, nb_clusters);
         if (ret < 0) {
-            return ret;
+            goto fail;
         }
 
         nb_clusters -= ret;
         offset += (ret * s->cluster_size);
     }
 
-    return 0;
+    ret = 0;
+fail:
+    s->cache_discards = false;
+    qcow2_process_discards(bs, ret);
+
+    return ret;
 }
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 7488988..1244693 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -420,6 +420,74 @@ fail_block:
     return ret;
 }
 
+void qcow2_process_discards(BlockDriverState *bs, int ret)
+{
+    BDRVQcowState *s = bs->opaque;
+    Qcow2DiscardRegion *d, *next;
+
+    QTAILQ_FOREACH_SAFE(d, &s->discards, next, next) {
+        QTAILQ_REMOVE(&s->discards, d, next);
+
+        /* Discard is optional, ignore the return value */
+        if (ret >= 0) {
+            bdrv_discard(bs->file,
+                         d->offset >> BDRV_SECTOR_BITS,
+                         d->bytes >> BDRV_SECTOR_BITS);
+        }
+
+        g_free(d);
+    }
+}
+
+static void update_refcount_discard(BlockDriverState *bs,
+                                    uint64_t offset, uint64_t length)
+{
+    BDRVQcowState *s = bs->opaque;
+    Qcow2DiscardRegion *d, *p, *next;
+
+    QTAILQ_FOREACH(d, &s->discards, next) {
+        uint64_t new_start = MIN(offset, d->offset);
+        uint64_t new_end = MAX(offset + length, d->offset + d->bytes);
+
+        if (new_end - new_start <= length + d->bytes) {
+            /* There can't be any overlap, areas ending up here have no
+             * references any more and therefore shouldn't get freed another
+             * time. */
+            assert(d->bytes + length == new_end - new_start);
+            d->offset = new_start;
+            d->bytes = new_end - new_start;
+            goto found;
+        }
+    }
+
+    d = g_malloc(sizeof(*d));
+    *d = (Qcow2DiscardRegion) {
+        .bs     = bs,
+        .offset = offset,
+        .bytes  = length,
+    };
+    QTAILQ_INSERT_TAIL(&s->discards, d, next);
+
+found:
+    /* Merge discard requests if they are adjacent now */
+    QTAILQ_FOREACH_SAFE(p, &s->discards, next, next) {
+        if (p == d
+            || p->offset > d->offset + d->bytes
+            || d->offset > p->offset + p->bytes)
+        {
+            continue;
+        }
+
+        /* Still no overlap possible */
+        assert(p->offset == d->offset + d->bytes
+            || d->offset == p->offset + p->bytes);
+
+        QTAILQ_REMOVE(&s->discards, p, next);
+        d->offset = MIN(d->offset, p->offset);
+        d->bytes += p->bytes;
+    }
+}
+
 /* XXX: cache several refcount block clusters ? */
 static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
     int64_t offset, int64_t length, int addend, enum qcow2_discard_type type)
@@ -488,15 +556,18 @@ static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
             s->free_cluster_index = cluster_index;
         }
         refcount_block[block_index] = cpu_to_be16(refcount);
+
         if (refcount == 0 && s->discard_passthrough[type]) {
-            /* Try discarding, ignore errors */
-            /* FIXME Doing this cluster by cluster will be painfully slow */
-            bdrv_discard(bs->file, cluster_offset, 1);
+            update_refcount_discard(bs, cluster_offset, s->cluster_size);
         }
     }
 
     ret = 0;
 fail:
+    if (!s->cache_discards) {
+        qcow2_process_discards(bs, ret);
+    }
+
     /* Write last changed block to disk */
     if (refcount_block) {
         int wret;
@@ -755,6 +826,8 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
     l1_table = NULL;
     l1_size2 = l1_size * sizeof(uint64_t);
 
+    s->cache_discards = true;
+
     /* WARNING: qcow2_snapshot_goto relies on this function not using the
      * l1_table_offset when it is the current s->l1_table_offset! Be careful
      * when changing this! */
@@ -867,6 +940,9 @@ fail:
         qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
     }
 
+    s->cache_discards = false;
+    qcow2_process_discards(bs, ret);
+
     /* Update L1 only if it isn't deleted anyway (addend = -1) */
     if (ret == 0 && addend >= 0 && l1_modified) {
         for (i = 0; i < l1_size; i++) {
diff --git a/block/qcow2.c b/block/qcow2.c
index ef8a2ca..9383990 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -486,6 +486,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
     }
 
     QLIST_INIT(&s->cluster_allocs);
+    QTAILQ_INIT(&s->discards);
 
     /* read qcow2 extensions */
     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL)) {
diff --git a/block/qcow2.h b/block/qcow2.h
index 6f91b9a..3b2d5cd 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -147,6 +147,13 @@ typedef struct Qcow2Feature {
     char    name[46];
 } QEMU_PACKED Qcow2Feature;
 
+typedef struct Qcow2DiscardRegion {
+    BlockDriverState *bs;
+    uint64_t offset;
+    uint64_t bytes;
+    QTAILQ_ENTRY(Qcow2DiscardRegion) next;
+} Qcow2DiscardRegion;
+
 typedef struct BDRVQcowState {
     int cluster_bits;
     int cluster_size;
@@ -199,6 +206,8 @@ typedef struct BDRVQcowState {
     size_t unknown_header_fields_size;
     void* unknown_header_fields;
     QLIST_HEAD(, Qcow2UnknownHeaderExtension) unknown_header_ext;
+    QTAILQ_HEAD (, Qcow2DiscardRegion) discards;
+    bool cache_discards;
 } BDRVQcowState;
 
 /* XXX: use std qcow open function ? */
@@ -374,6 +383,8 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
 int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
                           BdrvCheckMode fix);
 
+void qcow2_process_discards(BlockDriverState *bs, int ret);
+
 /* qcow2-cluster.c functions */
 int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
                         bool exact_size);
commit 67af674e478054086f972811dd0a11289afa39a9
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jun 19 13:44:19 2013 +0200

    qcow2: Options to enable discard for freed clusters
    
    Deleted snapshots are discarded in the image file by default, discard
    requests take their default from the -drive discard=... option and other
    places that free clusters must always be enabled explicitly.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 6d35e49..7488988 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -488,6 +488,11 @@ static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
             s->free_cluster_index = cluster_index;
         }
         refcount_block[block_index] = cpu_to_be16(refcount);
+        if (refcount == 0 && s->discard_passthrough[type]) {
+            /* Try discarding, ignore errors */
+            /* FIXME Doing this cluster by cluster will be painfully slow */
+            bdrv_discard(bs->file, cluster_offset, 1);
+        }
     }
 
     ret = 0;
diff --git a/block/qcow2.c b/block/qcow2.c
index e28ea47..ef8a2ca 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -295,6 +295,22 @@ static QemuOptsList qcow2_runtime_opts = {
             .type = QEMU_OPT_BOOL,
             .help = "Postpone refcount updates",
         },
+        {
+            .name = QCOW2_OPT_DISCARD_REQUEST,
+            .type = QEMU_OPT_BOOL,
+            .help = "Pass guest discard requests to the layer below",
+        },
+        {
+            .name = QCOW2_OPT_DISCARD_SNAPSHOT,
+            .type = QEMU_OPT_BOOL,
+            .help = "Generate discard requests when snapshot related space "
+                    "is freed",
+        },
+        {
+            .name = QCOW2_OPT_DISCARD_OTHER,
+            .type = QEMU_OPT_BOOL,
+            .help = "Generate discard requests when other clusters are freed",
+        },
         { /* end of list */ }
     },
 };
@@ -532,6 +548,16 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
     s->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
 
+    s->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
+    s->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
+    s->discard_passthrough[QCOW2_DISCARD_REQUEST] =
+        qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
+                          flags & BDRV_O_UNMAP);
+    s->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
+        qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
+    s->discard_passthrough[QCOW2_DISCARD_OTHER] =
+        qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
+
     qemu_opts_del(opts);
 
     if (s->use_lazy_refcounts && s->qcow_version < 3) {
diff --git a/block/qcow2.h b/block/qcow2.h
index 64a6479..6f91b9a 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -60,6 +60,9 @@
 
 
 #define QCOW2_OPT_LAZY_REFCOUNTS "lazy_refcounts"
+#define QCOW2_OPT_DISCARD_REQUEST "pass_discard_request"
+#define QCOW2_OPT_DISCARD_SNAPSHOT "pass_discard_snapshot"
+#define QCOW2_OPT_DISCARD_OTHER "pass_discard_other"
 
 typedef struct QCowHeader {
     uint32_t magic;
@@ -187,6 +190,8 @@ typedef struct BDRVQcowState {
     int qcow_version;
     bool use_lazy_refcounts;
 
+    bool discard_passthrough[QCOW2_DISCARD_MAX];
+
     uint64_t incompatible_features;
     uint64_t compatible_features;
     uint64_t autoclear_features;
commit 6cfcb9b8b91d303ab51b78623f2299b5288d2d51
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jun 19 13:44:18 2013 +0200

    qcow2: Add refcount update reason to all callers
    
    This adds a refcount update reason to all callers of update_refcounts(),
    so that a follow-up patch can use this information to decide whether
    clusters that reach a refcount of 0 should be discarded in the image
    file.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 76f30e5..3191d6b 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -98,14 +98,16 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
         goto fail;
     }
     g_free(s->l1_table);
-    qcow2_free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
+    qcow2_free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t),
+                        QCOW2_DISCARD_OTHER);
     s->l1_table_offset = new_l1_table_offset;
     s->l1_table = new_l1_table;
     s->l1_size = new_l1_size;
     return 0;
  fail:
     g_free(new_l1_table);
-    qcow2_free_clusters(bs, new_l1_table_offset, new_l1_size2);
+    qcow2_free_clusters(bs, new_l1_table_offset, new_l1_size2,
+                        QCOW2_DISCARD_OTHER);
     return ret;
 }
 
@@ -548,7 +550,8 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
 
         /* Then decrease the refcount of the old table */
         if (l2_offset) {
-            qcow2_free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
+            qcow2_free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t),
+                                QCOW2_DISCARD_OTHER);
         }
     }
 
@@ -715,10 +718,14 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
     /*
      * If this was a COW, we need to decrease the refcount of the old cluster.
      * Also flush bs->file to get the right order for L2 and refcount update.
+     *
+     * Don't discard clusters that reach a refcount of 0 (e.g. compressed
+     * clusters), the next write will reuse them anyway.
      */
     if (j != 0) {
         for (i = 0; i < j; i++) {
-            qcow2_free_any_clusters(bs, be64_to_cpu(old_cluster[i]), 1);
+            qcow2_free_any_clusters(bs, be64_to_cpu(old_cluster[i]), 1,
+                                    QCOW2_DISCARD_NEVER);
         }
     }
 
@@ -1339,7 +1346,7 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
         l2_table[l2_index + i] = cpu_to_be64(0);
 
         /* Then decrease the refcount */
-        qcow2_free_any_clusters(bs, old_offset, 1);
+        qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);
     }
 
     ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
@@ -1415,7 +1422,7 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,
         qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_table);
         if (old_offset & QCOW_OFLAG_COMPRESSED) {
             l2_table[l2_index + i] = cpu_to_be64(QCOW_OFLAG_ZERO);
-            qcow2_free_any_clusters(bs, old_offset, 1);
+            qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);
         } else {
             l2_table[l2_index + i] |= cpu_to_be64(QCOW_OFLAG_ZERO);
         }
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index b32738f..6d35e49 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -29,7 +29,7 @@
 static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size);
 static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
                             int64_t offset, int64_t length,
-                            int addend);
+                            int addend, enum qcow2_discard_type type);
 
 
 /*********************************************************/
@@ -235,7 +235,8 @@ static int alloc_refcount_block(BlockDriverState *bs,
     } else {
         /* Described somewhere else. This can recurse at most twice before we
          * arrive at a block that describes itself. */
-        ret = update_refcount(bs, new_block, s->cluster_size, 1);
+        ret = update_refcount(bs, new_block, s->cluster_size, 1,
+                              QCOW2_DISCARD_NEVER);
         if (ret < 0) {
             goto fail_block;
         }
@@ -399,7 +400,8 @@ static int alloc_refcount_block(BlockDriverState *bs,
 
     /* Free old table. Remember, we must not change free_cluster_index */
     uint64_t old_free_cluster_index = s->free_cluster_index;
-    qcow2_free_clusters(bs, old_table_offset, old_table_size * sizeof(uint64_t));
+    qcow2_free_clusters(bs, old_table_offset, old_table_size * sizeof(uint64_t),
+                        QCOW2_DISCARD_OTHER);
     s->free_cluster_index = old_free_cluster_index;
 
     ret = load_refcount_block(bs, new_block, (void**) refcount_block);
@@ -420,7 +422,7 @@ fail_block:
 
 /* XXX: cache several refcount block clusters ? */
 static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
-    int64_t offset, int64_t length, int addend)
+    int64_t offset, int64_t length, int addend, enum qcow2_discard_type type)
 {
     BDRVQcowState *s = bs->opaque;
     int64_t start, last, cluster_offset;
@@ -506,7 +508,8 @@ fail:
      */
     if (ret < 0) {
         int dummy;
-        dummy = update_refcount(bs, offset, cluster_offset - offset, -addend);
+        dummy = update_refcount(bs, offset, cluster_offset - offset, -addend,
+                                QCOW2_DISCARD_NEVER);
         (void)dummy;
     }
 
@@ -522,12 +525,14 @@ fail:
  */
 static int update_cluster_refcount(BlockDriverState *bs,
                                    int64_t cluster_index,
-                                   int addend)
+                                   int addend,
+                                   enum qcow2_discard_type type)
 {
     BDRVQcowState *s = bs->opaque;
     int ret;
 
-    ret = update_refcount(bs, cluster_index << s->cluster_bits, 1, addend);
+    ret = update_refcount(bs, cluster_index << s->cluster_bits, 1, addend,
+                          type);
     if (ret < 0) {
         return ret;
     }
@@ -579,7 +584,7 @@ int64_t qcow2_alloc_clusters(BlockDriverState *bs, int64_t size)
         return offset;
     }
 
-    ret = update_refcount(bs, offset, size, 1);
+    ret = update_refcount(bs, offset, size, 1, QCOW2_DISCARD_NEVER);
     if (ret < 0) {
         return ret;
     }
@@ -611,7 +616,8 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
     old_free_cluster_index = s->free_cluster_index;
     s->free_cluster_index = cluster_index + i;
 
-    ret = update_refcount(bs, offset, i << s->cluster_bits, 1);
+    ret = update_refcount(bs, offset, i << s->cluster_bits, 1,
+                          QCOW2_DISCARD_NEVER);
     if (ret < 0) {
         return ret;
     }
@@ -649,7 +655,8 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
         if (free_in_cluster == 0)
             s->free_byte_offset = 0;
         if ((offset & (s->cluster_size - 1)) != 0)
-            update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
+            update_cluster_refcount(bs, offset >> s->cluster_bits, 1,
+                                    QCOW2_DISCARD_NEVER);
     } else {
         offset = qcow2_alloc_clusters(bs, s->cluster_size);
         if (offset < 0) {
@@ -659,7 +666,8 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
         if ((cluster_offset + s->cluster_size) == offset) {
             /* we are lucky: contiguous data */
             offset = s->free_byte_offset;
-            update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
+            update_cluster_refcount(bs, offset >> s->cluster_bits, 1,
+                                    QCOW2_DISCARD_NEVER);
             s->free_byte_offset += size;
         } else {
             s->free_byte_offset = offset;
@@ -676,12 +684,13 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
 }
 
 void qcow2_free_clusters(BlockDriverState *bs,
-                          int64_t offset, int64_t size)
+                          int64_t offset, int64_t size,
+                          enum qcow2_discard_type type)
 {
     int ret;
 
     BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_FREE);
-    ret = update_refcount(bs, offset, size, -1);
+    ret = update_refcount(bs, offset, size, -1, type);
     if (ret < 0) {
         fprintf(stderr, "qcow2_free_clusters failed: %s\n", strerror(-ret));
         /* TODO Remember the clusters to free them later and avoid leaking */
@@ -692,8 +701,8 @@ void qcow2_free_clusters(BlockDriverState *bs,
  * Free a cluster using its L2 entry (handles clusters of all types, e.g.
  * normal cluster, compressed cluster, etc.)
  */
-void qcow2_free_any_clusters(BlockDriverState *bs,
-    uint64_t l2_entry, int nb_clusters)
+void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
+                             int nb_clusters, enum qcow2_discard_type type)
 {
     BDRVQcowState *s = bs->opaque;
 
@@ -705,12 +714,12 @@ void qcow2_free_any_clusters(BlockDriverState *bs,
                            s->csize_mask) + 1;
             qcow2_free_clusters(bs,
                 (l2_entry & s->cluster_offset_mask) & ~511,
-                nb_csectors * 512);
+                nb_csectors * 512, type);
         }
         break;
     case QCOW2_CLUSTER_NORMAL:
         qcow2_free_clusters(bs, l2_entry & L2E_OFFSET_MASK,
-                            nb_clusters << s->cluster_bits);
+                            nb_clusters << s->cluster_bits, type);
         break;
     case QCOW2_CLUSTER_UNALLOCATED:
     case QCOW2_CLUSTER_ZERO:
@@ -785,7 +794,8 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                             int ret;
                             ret = update_refcount(bs,
                                 (offset & s->cluster_offset_mask) & ~511,
-                                nb_csectors * 512, addend);
+                                nb_csectors * 512, addend,
+                                QCOW2_DISCARD_SNAPSHOT);
                             if (ret < 0) {
                                 goto fail;
                             }
@@ -795,7 +805,8 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                     } else {
                         uint64_t cluster_index = (offset & L2E_OFFSET_MASK) >> s->cluster_bits;
                         if (addend != 0) {
-                            refcount = update_cluster_refcount(bs, cluster_index, addend);
+                            refcount = update_cluster_refcount(bs, cluster_index, addend,
+                                                               QCOW2_DISCARD_SNAPSHOT);
                         } else {
                             refcount = get_refcount(bs, cluster_index);
                         }
@@ -827,7 +838,8 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
 
 
             if (addend != 0) {
-                refcount = update_cluster_refcount(bs, l2_offset >> s->cluster_bits, addend);
+                refcount = update_cluster_refcount(bs, l2_offset >> s->cluster_bits, addend,
+                                                   QCOW2_DISCARD_SNAPSHOT);
             } else {
                 refcount = get_refcount(bs, l2_offset >> s->cluster_bits);
             }
@@ -1253,7 +1265,8 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
 
             if (num_fixed) {
                 ret = update_refcount(bs, i << s->cluster_bits, 1,
-                                      refcount2 - refcount1);
+                                      refcount2 - refcount1,
+                                      QCOW2_DISCARD_ALWAYS);
                 if (ret >= 0) {
                     (*num_fixed)++;
                     continue;
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 992a5c8..0caac90 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -262,7 +262,8 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
     }
 
     /* free the old snapshot table */
-    qcow2_free_clusters(bs, s->snapshots_offset, s->snapshots_size);
+    qcow2_free_clusters(bs, s->snapshots_offset, s->snapshots_size,
+                        QCOW2_DISCARD_SNAPSHOT);
     s->snapshots_offset = snapshots_offset;
     s->snapshots_size = snapshots_size;
     return 0;
@@ -569,7 +570,8 @@ int qcow2_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
     if (ret < 0) {
         return ret;
     }
-    qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t));
+    qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t),
+                        QCOW2_DISCARD_SNAPSHOT);
 
     /* must update the copied flag on the current cluster offsets */
     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
diff --git a/block/qcow2.c b/block/qcow2.c
index 0fa5cb2..e28ea47 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1196,7 +1196,8 @@ static int preallocate(BlockDriverState *bs)
 
         ret = qcow2_alloc_cluster_link_l2(bs, meta);
         if (ret < 0) {
-            qcow2_free_any_clusters(bs, meta->alloc_offset, meta->nb_clusters);
+            qcow2_free_any_clusters(bs, meta->alloc_offset, meta->nb_clusters,
+                                    QCOW2_DISCARD_NEVER);
             return ret;
         }
 
diff --git a/block/qcow2.h b/block/qcow2.h
index 6959c6a..64a6479 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -129,6 +129,15 @@ enum {
     QCOW2_COMPAT_FEAT_MASK            = QCOW2_COMPAT_LAZY_REFCOUNTS,
 };
 
+enum qcow2_discard_type {
+    QCOW2_DISCARD_NEVER = 0,
+    QCOW2_DISCARD_ALWAYS,
+    QCOW2_DISCARD_REQUEST,
+    QCOW2_DISCARD_SNAPSHOT,
+    QCOW2_DISCARD_OTHER,
+    QCOW2_DISCARD_MAX
+};
+
 typedef struct Qcow2Feature {
     uint8_t type;
     uint8_t bit;
@@ -349,9 +358,10 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
     int nb_clusters);
 int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size);
 void qcow2_free_clusters(BlockDriverState *bs,
-    int64_t offset, int64_t size);
-void qcow2_free_any_clusters(BlockDriverState *bs,
-    uint64_t cluster_offset, int nb_clusters);
+                          int64_t offset, int64_t size,
+                          enum qcow2_discard_type type);
+void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
+                             int nb_clusters, enum qcow2_discard_type type);
 
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
     int64_t l1_table_offset, int l1_size, int addend);
commit 492fdc6fbe17b2d45878e813e980f782ac260c30
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Jun 19 13:44:17 2013 +0200

    Revert "block: Disable driver-specific options for 1.5"
    
    This reverts commit 8ec7d390b0d50b5e5b4b1d8dba7ba40d64a70875.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 5975dde..459a87e 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1737,120 +1737,10 @@ QemuOptsList qemu_drive_opts = {
     .name = "drive",
     .head = QTAILQ_HEAD_INITIALIZER(qemu_drive_opts.head),
     .desc = {
-        {
-            .name = "bus",
-            .type = QEMU_OPT_NUMBER,
-            .help = "bus number",
-        },{
-            .name = "unit",
-            .type = QEMU_OPT_NUMBER,
-            .help = "unit number (i.e. lun for scsi)",
-        },{
-            .name = "if",
-            .type = QEMU_OPT_STRING,
-            .help = "interface (ide, scsi, sd, mtd, floppy, pflash, virtio)",
-        },{
-            .name = "index",
-            .type = QEMU_OPT_NUMBER,
-            .help = "index number",
-        },{
-            .name = "cyls",
-            .type = QEMU_OPT_NUMBER,
-            .help = "number of cylinders (ide disk geometry)",
-        },{
-            .name = "heads",
-            .type = QEMU_OPT_NUMBER,
-            .help = "number of heads (ide disk geometry)",
-        },{
-            .name = "secs",
-            .type = QEMU_OPT_NUMBER,
-            .help = "number of sectors (ide disk geometry)",
-        },{
-            .name = "trans",
-            .type = QEMU_OPT_STRING,
-            .help = "chs translation (auto, lba. none)",
-        },{
-            .name = "media",
-            .type = QEMU_OPT_STRING,
-            .help = "media type (disk, cdrom)",
-        },{
-            .name = "snapshot",
-            .type = QEMU_OPT_BOOL,
-            .help = "enable/disable snapshot mode",
-        },{
-            .name = "file",
-            .type = QEMU_OPT_STRING,
-            .help = "disk image",
-        },{
-            .name = "discard",
-            .type = QEMU_OPT_STRING,
-            .help = "discard operation (ignore/off, unmap/on)",
-        },{
-            .name = "cache",
-            .type = QEMU_OPT_STRING,
-            .help = "host cache usage (none, writeback, writethrough, "
-                    "directsync, unsafe)",
-        },{
-            .name = "aio",
-            .type = QEMU_OPT_STRING,
-            .help = "host AIO implementation (threads, native)",
-        },{
-            .name = "format",
-            .type = QEMU_OPT_STRING,
-            .help = "disk format (raw, qcow2, ...)",
-        },{
-            .name = "serial",
-            .type = QEMU_OPT_STRING,
-            .help = "disk serial number",
-        },{
-            .name = "rerror",
-            .type = QEMU_OPT_STRING,
-            .help = "read error action",
-        },{
-            .name = "werror",
-            .type = QEMU_OPT_STRING,
-            .help = "write error action",
-        },{
-            .name = "addr",
-            .type = QEMU_OPT_STRING,
-            .help = "pci address (virtio only)",
-        },{
-            .name = "readonly",
-            .type = QEMU_OPT_BOOL,
-            .help = "open drive file as read-only",
-        },{
-            .name = "iops",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit total I/O operations per second",
-        },{
-            .name = "iops_rd",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit read operations per second",
-        },{
-            .name = "iops_wr",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit write operations per second",
-        },{
-            .name = "bps",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit total bytes per second",
-        },{
-            .name = "bps_rd",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit read bytes per second",
-        },{
-            .name = "bps_wr",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit write bytes per second",
-        },{
-            .name = "copy-on-read",
-            .type = QEMU_OPT_BOOL,
-            .help = "copy read data from backing file into image file",
-        },{
-            .name = "boot",
-            .type = QEMU_OPT_BOOL,
-            .help = "(deprecated, ignored)",
-        },
+        /*
+         * no elements => accept any params
+         * validation will happen later
+         */
         { /* end of list */ }
     },
 };
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index 387b050..f487a8f 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -57,7 +57,7 @@
 048 img auto quick
 049 rw auto
 050 rw auto backing quick
-#051 rw auto
+051 rw auto
 052 rw auto backing
 053 rw auto
 054 rw auto
commit dfe1ea8fc49b93ab2bfaad67046c659a0dae708f
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:11 2013 +0200

    ide: Clean up ide_exec_cmd()
    
    All commands are now converted to ide_cmd_table handlers, so it can be
    unconditional now and the old switch block can go.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 1c8f414..03d1cfa 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1694,6 +1694,7 @@ static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
 void ide_exec_cmd(IDEBus *bus, uint32_t val)
 {
     IDEState *s;
+    bool complete;
 
 #if defined(DEBUG_IDE)
     printf("ide: CMD=%02x\n", val);
@@ -1708,37 +1709,24 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
         return;
 
     if (!ide_cmd_permitted(s, val)) {
-        goto abort_cmd;
+        ide_abort_command(s);
+        ide_set_irq(s->bus);
+        return;
     }
 
-    if (ide_cmd_table[val].handler != NULL) {
-        bool complete;
-
-        s->status = READY_STAT | BUSY_STAT;
-        s->error = 0;
-
-        complete = ide_cmd_table[val].handler(s, val);
-        if (complete) {
-            s->status &= ~BUSY_STAT;
-            assert(!!s->error == !!(s->status & ERR_STAT));
+    s->status = READY_STAT | BUSY_STAT;
+    s->error = 0;
 
-            if ((ide_cmd_table[val].flags & SET_DSC) && !s->error) {
-                s->status |= SEEK_STAT;
-            }
+    complete = ide_cmd_table[val].handler(s, val);
+    if (complete) {
+        s->status &= ~BUSY_STAT;
+        assert(!!s->error == !!(s->status & ERR_STAT));
 
-            ide_set_irq(s->bus);
+        if ((ide_cmd_table[val].flags & SET_DSC) && !s->error) {
+            s->status |= SEEK_STAT;
         }
 
-        return;
-    }
-
-    switch(val) {
-    default:
-        /* should not be reachable */
-    abort_cmd:
-        ide_abort_command(s);
         ide_set_irq(s->bus);
-        break;
     }
 }
 
commit ff3526773080de2840481ec237db13ae3cbc7166
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:10 2013 +0200

    ide: Convert SMART commands to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index a563f6e..1c8f414 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1438,6 +1438,179 @@ static bool cmd_ibm_sense_condition(IDEState *s, uint8_t cmd)
     return true;
 }
 
+
+/*** SMART commands ***/
+
+static bool cmd_smart(IDEState *s, uint8_t cmd)
+{
+    int n;
+
+    if (s->hcyl != 0xc2 || s->lcyl != 0x4f) {
+        goto abort_cmd;
+    }
+
+    if (!s->smart_enabled && s->feature != SMART_ENABLE) {
+        goto abort_cmd;
+    }
+
+    switch (s->feature) {
+    case SMART_DISABLE:
+        s->smart_enabled = 0;
+        return true;
+
+    case SMART_ENABLE:
+        s->smart_enabled = 1;
+        return true;
+
+    case SMART_ATTR_AUTOSAVE:
+        switch (s->sector) {
+        case 0x00:
+            s->smart_autosave = 0;
+            break;
+        case 0xf1:
+            s->smart_autosave = 1;
+            break;
+        default:
+            goto abort_cmd;
+        }
+        return true;
+
+    case SMART_STATUS:
+        if (!s->smart_errors) {
+            s->hcyl = 0xc2;
+            s->lcyl = 0x4f;
+        } else {
+            s->hcyl = 0x2c;
+            s->lcyl = 0xf4;
+        }
+        return true;
+
+    case SMART_READ_THRESH:
+        memset(s->io_buffer, 0, 0x200);
+        s->io_buffer[0] = 0x01; /* smart struct version */
+
+        for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
+            s->io_buffer[2 + 0 + (n * 12)] = smart_attributes[n][0];
+            s->io_buffer[2 + 1 + (n * 12)] = smart_attributes[n][11];
+        }
+
+        /* checksum */
+        for (n = 0; n < 511; n++) {
+            s->io_buffer[511] += s->io_buffer[n];
+        }
+        s->io_buffer[511] = 0x100 - s->io_buffer[511];
+
+        s->status = READY_STAT | SEEK_STAT;
+        ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
+        ide_set_irq(s->bus);
+        return false;
+
+    case SMART_READ_DATA:
+        memset(s->io_buffer, 0, 0x200);
+        s->io_buffer[0] = 0x01; /* smart struct version */
+
+        for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
+            int i;
+            for (i = 0; i < 11; i++) {
+                s->io_buffer[2 + i + (n * 12)] = smart_attributes[n][i];
+            }
+        }
+
+        s->io_buffer[362] = 0x02 | (s->smart_autosave ? 0x80 : 0x00);
+        if (s->smart_selftest_count == 0) {
+            s->io_buffer[363] = 0;
+        } else {
+            s->io_buffer[363] =
+                s->smart_selftest_data[3 +
+                           (s->smart_selftest_count - 1) *
+                           24];
+        }
+        s->io_buffer[364] = 0x20;
+        s->io_buffer[365] = 0x01;
+        /* offline data collection capacity: execute + self-test*/
+        s->io_buffer[367] = (1 << 4 | 1 << 3 | 1);
+        s->io_buffer[368] = 0x03; /* smart capability (1) */
+        s->io_buffer[369] = 0x00; /* smart capability (2) */
+        s->io_buffer[370] = 0x01; /* error logging supported */
+        s->io_buffer[372] = 0x02; /* minutes for poll short test */
+        s->io_buffer[373] = 0x36; /* minutes for poll ext test */
+        s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
+
+        for (n = 0; n < 511; n++) {
+            s->io_buffer[511] += s->io_buffer[n];
+        }
+        s->io_buffer[511] = 0x100 - s->io_buffer[511];
+
+        s->status = READY_STAT | SEEK_STAT;
+        ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
+        ide_set_irq(s->bus);
+        return false;
+
+    case SMART_READ_LOG:
+        switch (s->sector) {
+        case 0x01: /* summary smart error log */
+            memset(s->io_buffer, 0, 0x200);
+            s->io_buffer[0] = 0x01;
+            s->io_buffer[1] = 0x00; /* no error entries */
+            s->io_buffer[452] = s->smart_errors & 0xff;
+            s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
+
+            for (n = 0; n < 511; n++) {
+                s->io_buffer[511] += s->io_buffer[n];
+            }
+            s->io_buffer[511] = 0x100 - s->io_buffer[511];
+            break;
+        case 0x06: /* smart self test log */
+            memset(s->io_buffer, 0, 0x200);
+            s->io_buffer[0] = 0x01;
+            if (s->smart_selftest_count == 0) {
+                s->io_buffer[508] = 0;
+            } else {
+                s->io_buffer[508] = s->smart_selftest_count;
+                for (n = 2; n < 506; n++)  {
+                    s->io_buffer[n] = s->smart_selftest_data[n];
+                }
+            }
+
+            for (n = 0; n < 511; n++) {
+                s->io_buffer[511] += s->io_buffer[n];
+            }
+            s->io_buffer[511] = 0x100 - s->io_buffer[511];
+            break;
+        default:
+            goto abort_cmd;
+        }
+        s->status = READY_STAT | SEEK_STAT;
+        ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
+        ide_set_irq(s->bus);
+        return false;
+
+    case SMART_EXECUTE_OFFLINE:
+        switch (s->sector) {
+        case 0: /* off-line routine */
+        case 1: /* short self test */
+        case 2: /* extended self test */
+            s->smart_selftest_count++;
+            if (s->smart_selftest_count > 21) {
+                s->smart_selftest_count = 0;
+            }
+            n = 2 + (s->smart_selftest_count - 1) * 24;
+            s->smart_selftest_data[n] = s->sector;
+            s->smart_selftest_data[n + 1] = 0x00; /* OK and finished */
+            s->smart_selftest_data[n + 2] = 0x34; /* hour count lsb */
+            s->smart_selftest_data[n + 3] = 0x12; /* hour count msb */
+            break;
+        default:
+            goto abort_cmd;
+        }
+        return true;
+    }
+
+abort_cmd:
+    ide_abort_command(s);
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1486,7 +1659,7 @@ static const struct {
     [WIN_SLEEPNOW2]               = { cmd_nop, ALL_OK },
     [WIN_PACKETCMD]               = { cmd_packet, CD_OK },
     [WIN_PIDENTIFY]               = { cmd_identify_packet, CD_OK },
-    [WIN_SMART]                   = { NULL, HD_CFA_OK },
+    [WIN_SMART]                   = { cmd_smart, HD_CFA_OK | SET_DSC },
     [CFA_ACCESS_METADATA_STORAGE] = { cmd_cfa_access_metadata_storage, CFA_OK },
     [CFA_ERASE_SECTORS]           = { cmd_cfa_erase_sectors, CFA_OK | SET_DSC },
     [WIN_MULTREAD]                = { cmd_read_multiple, HD_CFA_OK },
@@ -1521,7 +1694,6 @@ static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
 void ide_exec_cmd(IDEBus *bus, uint32_t val)
 {
     IDEState *s;
-    int n;
 
 #if defined(DEBUG_IDE)
     printf("ide: CMD=%02x\n", val);
@@ -1561,155 +1733,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_SMART:
-	if (s->hcyl != 0xc2 || s->lcyl != 0x4f)
-		goto abort_cmd;
-	if (!s->smart_enabled && s->feature != SMART_ENABLE)
-		goto abort_cmd;
-	switch (s->feature) {
-	case SMART_DISABLE:
-		s->smart_enabled = 0;
-		s->status = READY_STAT | SEEK_STAT;
-		ide_set_irq(s->bus);
-		break;
-	case SMART_ENABLE:
-		s->smart_enabled = 1;
-		s->status = READY_STAT | SEEK_STAT;
-		ide_set_irq(s->bus);
-		break;
-	case SMART_ATTR_AUTOSAVE:
-		switch (s->sector) {
-		case 0x00:
-		s->smart_autosave = 0;
-		break;
-		case 0xf1:
-		s->smart_autosave = 1;
-		break;
-		default:
-		goto abort_cmd;
-		}
-		s->status = READY_STAT | SEEK_STAT;
-		ide_set_irq(s->bus);
-		break;
-	case SMART_STATUS:
-		if (!s->smart_errors) {
-		s->hcyl = 0xc2;
-		s->lcyl = 0x4f;
-		} else {
-		s->hcyl = 0x2c;
-		s->lcyl = 0xf4;
-		}
-		s->status = READY_STAT | SEEK_STAT;
-		ide_set_irq(s->bus);
-		break;
-	case SMART_READ_THRESH:
-		memset(s->io_buffer, 0, 0x200);
-		s->io_buffer[0] = 0x01; /* smart struct version */
-		for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
-		s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
-		s->io_buffer[2+1+(n*12)] = smart_attributes[n][11];
-		}
-		for (n=0; n<511; n++) /* checksum */
-		s->io_buffer[511] += s->io_buffer[n];
-		s->io_buffer[511] = 0x100 - s->io_buffer[511];
-		s->status = READY_STAT | SEEK_STAT;
-		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
-		ide_set_irq(s->bus);
-		break;
-	case SMART_READ_DATA:
-		memset(s->io_buffer, 0, 0x200);
-		s->io_buffer[0] = 0x01; /* smart struct version */
-		for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
-		    int i;
-		    for(i = 0; i < 11; i++) {
-			s->io_buffer[2+i+(n*12)] = smart_attributes[n][i];
-		    }
-		}
-		s->io_buffer[362] = 0x02 | (s->smart_autosave?0x80:0x00);
-		if (s->smart_selftest_count == 0) {
-		s->io_buffer[363] = 0;
-		} else {
-		s->io_buffer[363] =
-			s->smart_selftest_data[3 + 
-					   (s->smart_selftest_count - 1) *
-					   24];
-		}
-		s->io_buffer[364] = 0x20; 
-		s->io_buffer[365] = 0x01; 
-		/* offline data collection capacity: execute + self-test*/
-		s->io_buffer[367] = (1<<4 | 1<<3 | 1); 
-		s->io_buffer[368] = 0x03; /* smart capability (1) */
-		s->io_buffer[369] = 0x00; /* smart capability (2) */
-		s->io_buffer[370] = 0x01; /* error logging supported */
-		s->io_buffer[372] = 0x02; /* minutes for poll short test */
-		s->io_buffer[373] = 0x36; /* minutes for poll ext test */
-		s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
-
-		for (n=0; n<511; n++) 
-		s->io_buffer[511] += s->io_buffer[n];
-		s->io_buffer[511] = 0x100 - s->io_buffer[511];
-		s->status = READY_STAT | SEEK_STAT;
-		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
-		ide_set_irq(s->bus);
-		break;
-	case SMART_READ_LOG:
-		switch (s->sector) {
-		case 0x01: /* summary smart error log */
-		memset(s->io_buffer, 0, 0x200);
-		s->io_buffer[0] = 0x01;
-		s->io_buffer[1] = 0x00; /* no error entries */
-		s->io_buffer[452] = s->smart_errors & 0xff;
-		s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
-
-		for (n=0; n<511; n++)
-			s->io_buffer[511] += s->io_buffer[n];
-		s->io_buffer[511] = 0x100 - s->io_buffer[511];
-		break;
-		case 0x06: /* smart self test log */
-		memset(s->io_buffer, 0, 0x200);
-		s->io_buffer[0] = 0x01;
-		if (s->smart_selftest_count == 0) {
-			s->io_buffer[508] = 0;
-		} else {
-			s->io_buffer[508] = s->smart_selftest_count;
-			for (n=2; n<506; n++) 
-			s->io_buffer[n] = s->smart_selftest_data[n];
-		}
-		for (n=0; n<511; n++)
-			s->io_buffer[511] += s->io_buffer[n];
-		s->io_buffer[511] = 0x100 - s->io_buffer[511];
-		break;
-		default:
-		goto abort_cmd;
-		}
-		s->status = READY_STAT | SEEK_STAT;
-		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
-		ide_set_irq(s->bus);
-		break;
-	case SMART_EXECUTE_OFFLINE:
-		switch (s->sector) {
-		case 0: /* off-line routine */
-		case 1: /* short self test */
-		case 2: /* extended self test */
-		s->smart_selftest_count++;
-		if(s->smart_selftest_count > 21)
-			s->smart_selftest_count = 0;
-		n = 2 + (s->smart_selftest_count - 1) * 24;
-		s->smart_selftest_data[n] = s->sector;
-		s->smart_selftest_data[n+1] = 0x00; /* OK and finished */
-		s->smart_selftest_data[n+2] = 0x34; /* hour count lsb */
-		s->smart_selftest_data[n+3] = 0x12; /* hour count msb */
-		s->status = READY_STAT | SEEK_STAT;
-		ide_set_irq(s->bus);
-		break;
-		default:
-		goto abort_cmd;
-		}
-		break;
-	default:
-		goto abort_cmd;
-	}
-	break;
     default:
         /* should not be reachable */
     abort_cmd:
commit 6b1dd744240896b67ab3d8fbf3a6292521aaed58
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:09 2013 +0200

    ide: Convert CF-ATA commands to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index eebd5d9..a563f6e 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1349,6 +1349,95 @@ static bool cmd_packet(IDEState *s, uint8_t cmd)
     return false;
 }
 
+
+/*** CF-ATA commands ***/
+
+static bool cmd_cfa_req_ext_error_code(IDEState *s, uint8_t cmd)
+{
+    s->error = 0x09;    /* miscellaneous error */
+    s->status = READY_STAT | SEEK_STAT;
+    ide_set_irq(s->bus);
+
+    return false;
+}
+
+static bool cmd_cfa_erase_sectors(IDEState *s, uint8_t cmd)
+{
+    /* WIN_SECURITY_FREEZE_LOCK has the same ID as CFA_WEAR_LEVEL and is
+     * required for Windows 8 to work with AHCI */
+
+    if (cmd == CFA_WEAR_LEVEL) {
+        s->nsector = 0;
+    }
+
+    if (cmd == CFA_ERASE_SECTORS) {
+        s->media_changed = 1;
+    }
+
+    return true;
+}
+
+static bool cmd_cfa_translate_sector(IDEState *s, uint8_t cmd)
+{
+    s->status = READY_STAT | SEEK_STAT;
+
+    memset(s->io_buffer, 0, 0x200);
+    s->io_buffer[0x00] = s->hcyl;                   /* Cyl MSB */
+    s->io_buffer[0x01] = s->lcyl;                   /* Cyl LSB */
+    s->io_buffer[0x02] = s->select;                 /* Head */
+    s->io_buffer[0x03] = s->sector;                 /* Sector */
+    s->io_buffer[0x04] = ide_get_sector(s) >> 16;   /* LBA MSB */
+    s->io_buffer[0x05] = ide_get_sector(s) >> 8;    /* LBA */
+    s->io_buffer[0x06] = ide_get_sector(s) >> 0;    /* LBA LSB */
+    s->io_buffer[0x13] = 0x00;                      /* Erase flag */
+    s->io_buffer[0x18] = 0x00;                      /* Hot count */
+    s->io_buffer[0x19] = 0x00;                      /* Hot count */
+    s->io_buffer[0x1a] = 0x01;                      /* Hot count */
+
+    ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
+    ide_set_irq(s->bus);
+
+    return false;
+}
+
+static bool cmd_cfa_access_metadata_storage(IDEState *s, uint8_t cmd)
+{
+    switch (s->feature) {
+    case 0x02:  /* Inquiry Metadata Storage */
+        ide_cfata_metadata_inquiry(s);
+        break;
+    case 0x03:  /* Read Metadata Storage */
+        ide_cfata_metadata_read(s);
+        break;
+    case 0x04:  /* Write Metadata Storage */
+        ide_cfata_metadata_write(s);
+        break;
+    default:
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
+    s->status = 0x00; /* NOTE: READY is _not_ set */
+    ide_set_irq(s->bus);
+
+    return false;
+}
+
+static bool cmd_ibm_sense_condition(IDEState *s, uint8_t cmd)
+{
+    switch (s->feature) {
+    case 0x01:  /* sense temperature in device */
+        s->nsector = 0x50;      /* +20 C */
+        break;
+    default:
+        ide_abort_command(s);
+        return true;
+    }
+
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1365,7 +1454,7 @@ static const struct {
     int flags;
 } ide_cmd_table[0x100] = {
     /* NOP not implemented, mandatory for CD */
-    [CFA_REQ_EXT_ERROR_CODE]      = { NULL, CFA_OK },
+    [CFA_REQ_EXT_ERROR_CODE]      = { cmd_cfa_req_ext_error_code, CFA_OK },
     [WIN_DSM]                     = { cmd_data_set_management, ALL_OK },
     [WIN_DEVICE_RESET]            = { cmd_device_reset, CD_OK },
     [WIN_RECAL]                   = { cmd_nop, HD_CFA_OK | SET_DSC},
@@ -1386,7 +1475,7 @@ static const struct {
     [WIN_VERIFY_ONCE]             = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_VERIFY_EXT]              = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_SEEK]                    = { cmd_seek, HD_CFA_OK | SET_DSC },
-    [CFA_TRANSLATE_SECTOR]        = { NULL, CFA_OK },
+    [CFA_TRANSLATE_SECTOR]        = { cmd_cfa_translate_sector, CFA_OK },
     [WIN_DIAGNOSE]                = { cmd_exec_dev_diagnostic, ALL_OK },
     [WIN_SPECIFY]                 = { cmd_nop, HD_CFA_OK | SET_DSC },
     [WIN_STANDBYNOW2]             = { cmd_nop, ALL_OK },
@@ -1398,8 +1487,8 @@ static const struct {
     [WIN_PACKETCMD]               = { cmd_packet, CD_OK },
     [WIN_PIDENTIFY]               = { cmd_identify_packet, CD_OK },
     [WIN_SMART]                   = { NULL, HD_CFA_OK },
-    [CFA_ACCESS_METADATA_STORAGE] = { NULL, CFA_OK },
-    [CFA_ERASE_SECTORS]           = { NULL, CFA_OK },
+    [CFA_ACCESS_METADATA_STORAGE] = { cmd_cfa_access_metadata_storage, CFA_OK },
+    [CFA_ERASE_SECTORS]           = { cmd_cfa_erase_sectors, CFA_OK | SET_DSC },
     [WIN_MULTREAD]                = { cmd_read_multiple, HD_CFA_OK },
     [WIN_MULTWRITE]               = { cmd_write_multiple, HD_CFA_OK },
     [WIN_SETMULT]                 = { cmd_set_multiple_mode, HD_CFA_OK | SET_DSC },
@@ -1418,8 +1507,8 @@ static const struct {
     [WIN_FLUSH_CACHE_EXT]         = { cmd_flush_cache, HD_CFA_OK },
     [WIN_IDENTIFY]                = { cmd_identify, ALL_OK },
     [WIN_SETFEATURES]             = { cmd_set_features, ALL_OK | SET_DSC },
-    [IBM_SENSE_CONDITION]         = { NULL, CFA_OK },
-    [CFA_WEAR_LEVEL]              = { NULL, HD_CFA_OK },
+    [IBM_SENSE_CONDITION]         = { cmd_ibm_sense_condition, CFA_OK | SET_DSC },
+    [CFA_WEAR_LEVEL]              = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC },
     [WIN_READ_NATIVE_MAX]         = { cmd_read_native_max, ALL_OK | SET_DSC },
 };
 
@@ -1472,75 +1561,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    /* CF-ATA commands */
-    case CFA_REQ_EXT_ERROR_CODE:
-        s->error = 0x09;    /* miscellaneous error */
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
-    case CFA_ERASE_SECTORS:
-    case CFA_WEAR_LEVEL:
-#if 0
-    /* This one has the same ID as CFA_WEAR_LEVEL and is required for
-       Windows 8 to work with AHCI */
-    case WIN_SECURITY_FREEZE_LOCK:
-#endif
-        if (val == CFA_WEAR_LEVEL)
-            s->nsector = 0;
-        if (val == CFA_ERASE_SECTORS)
-            s->media_changed = 1;
-        s->error = 0x00;
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
-    case CFA_TRANSLATE_SECTOR:
-        s->error = 0x00;
-        s->status = READY_STAT | SEEK_STAT;
-        memset(s->io_buffer, 0, 0x200);
-        s->io_buffer[0x00] = s->hcyl;			/* Cyl MSB */
-        s->io_buffer[0x01] = s->lcyl;			/* Cyl LSB */
-        s->io_buffer[0x02] = s->select;			/* Head */
-        s->io_buffer[0x03] = s->sector;			/* Sector */
-        s->io_buffer[0x04] = ide_get_sector(s) >> 16;	/* LBA MSB */
-        s->io_buffer[0x05] = ide_get_sector(s) >> 8;	/* LBA */
-        s->io_buffer[0x06] = ide_get_sector(s) >> 0;	/* LBA LSB */
-        s->io_buffer[0x13] = 0x00;				/* Erase flag */
-        s->io_buffer[0x18] = 0x00;				/* Hot count */
-        s->io_buffer[0x19] = 0x00;				/* Hot count */
-        s->io_buffer[0x1a] = 0x01;				/* Hot count */
-        ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
-        ide_set_irq(s->bus);
-        break;
-    case CFA_ACCESS_METADATA_STORAGE:
-        switch (s->feature) {
-        case 0x02:	/* Inquiry Metadata Storage */
-            ide_cfata_metadata_inquiry(s);
-            break;
-        case 0x03:	/* Read Metadata Storage */
-            ide_cfata_metadata_read(s);
-            break;
-        case 0x04:	/* Write Metadata Storage */
-            ide_cfata_metadata_write(s);
-            break;
-        default:
-            goto abort_cmd;
-        }
-        ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
-        s->status = 0x00; /* NOTE: READY is _not_ set */
-        ide_set_irq(s->bus);
-        break;
-    case IBM_SENSE_CONDITION:
-        switch (s->feature) {
-        case 0x01:  /* sense temperature in device */
-            s->nsector = 0x50;      /* +20 C */
-            break;
-        default:
-            goto abort_cmd;
-        }
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
-
     case WIN_SMART:
 	if (s->hcyl != 0xc2 || s->lcyl != 0x4f)
 		goto abort_cmd;
commit ee425c78cad08778361bde3133162d520aa32e23
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:08 2013 +0200

    ide: Convert ATAPI commands to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 76a3fdf..eebd5d9 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1292,6 +1292,63 @@ abort_cmd:
     return true;
 }
 
+
+/*** ATAPI commands ***/
+
+static bool cmd_identify_packet(IDEState *s, uint8_t cmd)
+{
+    ide_atapi_identify(s);
+    s->status = READY_STAT | SEEK_STAT;
+    ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
+    ide_set_irq(s->bus);
+    return false;
+}
+
+static bool cmd_exec_dev_diagnostic(IDEState *s, uint8_t cmd)
+{
+    ide_set_signature(s);
+
+    if (s->drive_kind == IDE_CD) {
+        s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
+                        * devices to return a clear status register
+                        * with READY_STAT *not* set. */
+    } else {
+        s->status = READY_STAT | SEEK_STAT;
+        /* The bits of the error register are not as usual for this command!
+         * They are part of the regular output (this is why ERR_STAT isn't set)
+         * Device 0 passed, Device 1 passed or not present. */
+        s->error = 0x01;
+        ide_set_irq(s->bus);
+    }
+
+    return false;
+}
+
+static bool cmd_device_reset(IDEState *s, uint8_t cmd)
+{
+    ide_set_signature(s);
+    s->status = 0x00; /* NOTE: READY is _not_ set */
+    s->error = 0x01;
+
+    return false;
+}
+
+static bool cmd_packet(IDEState *s, uint8_t cmd)
+{
+    /* overlapping commands not supported */
+    if (s->feature & 0x02) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    s->status = READY_STAT | SEEK_STAT;
+    s->atapi_dma = s->feature & 1;
+    s->nsector = 1;
+    ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
+                       ide_atapi_cmd);
+    return false;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1310,7 +1367,7 @@ static const struct {
     /* NOP not implemented, mandatory for CD */
     [CFA_REQ_EXT_ERROR_CODE]      = { NULL, CFA_OK },
     [WIN_DSM]                     = { cmd_data_set_management, ALL_OK },
-    [WIN_DEVICE_RESET]            = { NULL, CD_OK },
+    [WIN_DEVICE_RESET]            = { cmd_device_reset, CD_OK },
     [WIN_RECAL]                   = { cmd_nop, HD_CFA_OK | SET_DSC},
     [WIN_READ]                    = { cmd_read_pio, ALL_OK },
     [WIN_READ_ONCE]               = { cmd_read_pio, ALL_OK },
@@ -1330,7 +1387,7 @@ static const struct {
     [WIN_VERIFY_EXT]              = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_SEEK]                    = { cmd_seek, HD_CFA_OK | SET_DSC },
     [CFA_TRANSLATE_SECTOR]        = { NULL, CFA_OK },
-    [WIN_DIAGNOSE]                = { NULL, ALL_OK },
+    [WIN_DIAGNOSE]                = { cmd_exec_dev_diagnostic, ALL_OK },
     [WIN_SPECIFY]                 = { cmd_nop, HD_CFA_OK | SET_DSC },
     [WIN_STANDBYNOW2]             = { cmd_nop, ALL_OK },
     [WIN_IDLEIMMEDIATE2]          = { cmd_nop, ALL_OK },
@@ -1338,8 +1395,8 @@ static const struct {
     [WIN_SETIDLE2]                = { cmd_nop, ALL_OK },
     [WIN_CHECKPOWERMODE2]         = { cmd_check_power_mode, ALL_OK | SET_DSC },
     [WIN_SLEEPNOW2]               = { cmd_nop, ALL_OK },
-    [WIN_PACKETCMD]               = { NULL, CD_OK },
-    [WIN_PIDENTIFY]               = { NULL, CD_OK },
+    [WIN_PACKETCMD]               = { cmd_packet, CD_OK },
+    [WIN_PIDENTIFY]               = { cmd_identify_packet, CD_OK },
     [WIN_SMART]                   = { NULL, HD_CFA_OK },
     [CFA_ACCESS_METADATA_STORAGE] = { NULL, CFA_OK },
     [CFA_ERASE_SECTORS]           = { NULL, CFA_OK },
@@ -1415,41 +1472,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-        /* ATAPI commands */
-    case WIN_PIDENTIFY:
-        ide_atapi_identify(s);
-        s->status = READY_STAT | SEEK_STAT;
-        ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
-        ide_set_irq(s->bus);
-        break;
-    case WIN_DIAGNOSE:
-        ide_set_signature(s);
-        if (s->drive_kind == IDE_CD)
-            s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
-                            * devices to return a clear status register
-                            * with READY_STAT *not* set. */
-        else
-            s->status = READY_STAT | SEEK_STAT;
-        s->error = 0x01; /* Device 0 passed, Device 1 passed or not
-                          * present.
-                          */
-        ide_set_irq(s->bus);
-        break;
-    case WIN_DEVICE_RESET:
-        ide_set_signature(s);
-        s->status = 0x00; /* NOTE: READY is _not_ set */
-        s->error = 0x01;
-        break;
-    case WIN_PACKETCMD:
-        /* overlapping commands not supported */
-        if (s->feature & 0x02)
-            goto abort_cmd;
-        s->status = READY_STAT | SEEK_STAT;
-        s->atapi_dma = s->feature & 1;
-        s->nsector = 1;
-        ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
-                           ide_atapi_cmd);
-        break;
     /* CF-ATA commands */
     case CFA_REQ_EXT_ERROR_CODE:
         s->error = 0x09;    /* miscellaneous error */
commit 61fdda377a7e8f05dc1171504405647131148d80
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:07 2013 +0200

    ide: Convert SEEK to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 83e86aa..76a3fdf 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1190,6 +1190,12 @@ static bool cmd_flush_cache(IDEState *s, uint8_t cmd)
     return false;
 }
 
+static bool cmd_seek(IDEState *s, uint8_t cmd)
+{
+    /* XXX: Check that seek is within bounds */
+    return true;
+}
+
 static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
 {
     bool lba48 = (cmd == WIN_READ_NATIVE_MAX_EXT);
@@ -1322,7 +1328,7 @@ static const struct {
     [WIN_VERIFY]                  = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_VERIFY_ONCE]             = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_VERIFY_EXT]              = { cmd_verify, HD_CFA_OK | SET_DSC },
-    [WIN_SEEK]                    = { NULL, HD_CFA_OK },
+    [WIN_SEEK]                    = { cmd_seek, HD_CFA_OK | SET_DSC },
     [CFA_TRANSLATE_SECTOR]        = { NULL, CFA_OK },
     [WIN_DIAGNOSE]                = { NULL, ALL_OK },
     [WIN_SPECIFY]                 = { cmd_nop, HD_CFA_OK | SET_DSC },
@@ -1409,11 +1415,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_SEEK:
-        /* XXX: Check that seek is within bounds */
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
         /* ATAPI commands */
     case WIN_PIDENTIFY:
         ide_atapi_identify(s);
commit 9afce42903b3f8af1f9c158b411c73e41cf95df7
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:06 2013 +0200

    ide: Convert FLUSH CACHE to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 8789758..83e86aa 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1184,6 +1184,12 @@ static bool cmd_write_dma(IDEState *s, uint8_t cmd)
     return false;
 }
 
+static bool cmd_flush_cache(IDEState *s, uint8_t cmd)
+{
+    ide_flush_cache(s);
+    return false;
+}
+
 static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
 {
     bool lba48 = (cmd == WIN_READ_NATIVE_MAX_EXT);
@@ -1345,8 +1351,8 @@ static const struct {
     [WIN_SETIDLE1]                = { cmd_nop, ALL_OK },
     [WIN_CHECKPOWERMODE1]         = { cmd_check_power_mode, ALL_OK | SET_DSC },
     [WIN_SLEEPNOW1]               = { cmd_nop, ALL_OK },
-    [WIN_FLUSH_CACHE]             = { NULL, ALL_OK },
-    [WIN_FLUSH_CACHE_EXT]         = { NULL, HD_CFA_OK },
+    [WIN_FLUSH_CACHE]             = { cmd_flush_cache, ALL_OK },
+    [WIN_FLUSH_CACHE_EXT]         = { cmd_flush_cache, HD_CFA_OK },
     [WIN_IDENTIFY]                = { cmd_identify, ALL_OK },
     [WIN_SETFEATURES]             = { cmd_set_features, ALL_OK | SET_DSC },
     [IBM_SENSE_CONDITION]         = { NULL, CFA_OK },
@@ -1403,10 +1409,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_FLUSH_CACHE:
-    case WIN_FLUSH_CACHE_EXT:
-        ide_flush_cache(s);
-        break;
     case WIN_SEEK:
         /* XXX: Check that seek is within bounds */
         s->status = READY_STAT | SEEK_STAT;
commit ee03398c510ea18d44f45fc7f1ec8b21db2eee2c
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:05 2013 +0200

    ide: Convert SET FEATURES to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index a7f8445..8789758 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1206,6 +1206,80 @@ static bool cmd_check_power_mode(IDEState *s, uint8_t cmd)
     return true;
 }
 
+static bool cmd_set_features(IDEState *s, uint8_t cmd)
+{
+    uint16_t *identify_data;
+
+    if (!s->bs) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    /* XXX: valid for CDROM ? */
+    switch (s->feature) {
+    case 0x02: /* write cache enable */
+        bdrv_set_enable_write_cache(s->bs, true);
+        identify_data = (uint16_t *)s->identify_data;
+        put_le16(identify_data + 85, (1 << 14) | (1 << 5) | 1);
+        return true;
+    case 0x82: /* write cache disable */
+        bdrv_set_enable_write_cache(s->bs, false);
+        identify_data = (uint16_t *)s->identify_data;
+        put_le16(identify_data + 85, (1 << 14) | 1);
+        ide_flush_cache(s);
+        return false;
+    case 0xcc: /* reverting to power-on defaults enable */
+    case 0x66: /* reverting to power-on defaults disable */
+    case 0xaa: /* read look-ahead enable */
+    case 0x55: /* read look-ahead disable */
+    case 0x05: /* set advanced power management mode */
+    case 0x85: /* disable advanced power management mode */
+    case 0x69: /* NOP */
+    case 0x67: /* NOP */
+    case 0x96: /* NOP */
+    case 0x9a: /* NOP */
+    case 0x42: /* enable Automatic Acoustic Mode */
+    case 0xc2: /* disable Automatic Acoustic Mode */
+        return true;
+    case 0x03: /* set transfer mode */
+        {
+            uint8_t val = s->nsector & 0x07;
+            identify_data = (uint16_t *)s->identify_data;
+
+            switch (s->nsector >> 3) {
+            case 0x00: /* pio default */
+            case 0x01: /* pio mode */
+                put_le16(identify_data + 62, 0x07);
+                put_le16(identify_data + 63, 0x07);
+                put_le16(identify_data + 88, 0x3f);
+                break;
+            case 0x02: /* sigle word dma mode*/
+                put_le16(identify_data + 62, 0x07 | (1 << (val + 8)));
+                put_le16(identify_data + 63, 0x07);
+                put_le16(identify_data + 88, 0x3f);
+                break;
+            case 0x04: /* mdma mode */
+                put_le16(identify_data + 62, 0x07);
+                put_le16(identify_data + 63, 0x07 | (1 << (val + 8)));
+                put_le16(identify_data + 88, 0x3f);
+                break;
+            case 0x08: /* udma mode */
+                put_le16(identify_data + 62, 0x07);
+                put_le16(identify_data + 63, 0x07);
+                put_le16(identify_data + 88, 0x3f | (1 << (val + 8)));
+                break;
+            default:
+                goto abort_cmd;
+            }
+            return true;
+        }
+    }
+
+abort_cmd:
+    ide_abort_command(s);
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1274,7 +1348,7 @@ static const struct {
     [WIN_FLUSH_CACHE]             = { NULL, ALL_OK },
     [WIN_FLUSH_CACHE_EXT]         = { NULL, HD_CFA_OK },
     [WIN_IDENTIFY]                = { cmd_identify, ALL_OK },
-    [WIN_SETFEATURES]             = { NULL, ALL_OK },
+    [WIN_SETFEATURES]             = { cmd_set_features, ALL_OK | SET_DSC },
     [IBM_SENSE_CONDITION]         = { NULL, CFA_OK },
     [CFA_WEAR_LEVEL]              = { NULL, HD_CFA_OK },
     [WIN_READ_NATIVE_MAX]         = { cmd_read_native_max, ALL_OK | SET_DSC },
@@ -1288,7 +1362,6 @@ static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
 
 void ide_exec_cmd(IDEBus *bus, uint32_t val)
 {
-    uint16_t *identify_data;
     IDEState *s;
     int n;
 
@@ -1330,76 +1403,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_SETFEATURES:
-        if (!s->bs)
-            goto abort_cmd;
-        /* XXX: valid for CDROM ? */
-        switch(s->feature) {
-        case 0x02: /* write cache enable */
-            bdrv_set_enable_write_cache(s->bs, true);
-            identify_data = (uint16_t *)s->identify_data;
-            put_le16(identify_data + 85, (1 << 14) | (1 << 5) | 1);
-            s->status = READY_STAT | SEEK_STAT;
-            ide_set_irq(s->bus);
-            break;
-        case 0x82: /* write cache disable */
-            bdrv_set_enable_write_cache(s->bs, false);
-            identify_data = (uint16_t *)s->identify_data;
-            put_le16(identify_data + 85, (1 << 14) | 1);
-            ide_flush_cache(s);
-            break;
-        case 0xcc: /* reverting to power-on defaults enable */
-        case 0x66: /* reverting to power-on defaults disable */
-        case 0xaa: /* read look-ahead enable */
-        case 0x55: /* read look-ahead disable */
-        case 0x05: /* set advanced power management mode */
-        case 0x85: /* disable advanced power management mode */
-        case 0x69: /* NOP */
-        case 0x67: /* NOP */
-        case 0x96: /* NOP */
-        case 0x9a: /* NOP */
-        case 0x42: /* enable Automatic Acoustic Mode */
-        case 0xc2: /* disable Automatic Acoustic Mode */
-            s->status = READY_STAT | SEEK_STAT;
-            ide_set_irq(s->bus);
-            break;
-        case 0x03: { /* set transfer mode */
-		uint8_t val = s->nsector & 0x07;
-		identify_data = (uint16_t *)s->identify_data;
-
-		switch (s->nsector >> 3) {
-		case 0x00: /* pio default */
-		case 0x01: /* pio mode */
-			put_le16(identify_data + 62,0x07);
-			put_le16(identify_data + 63,0x07);
-			put_le16(identify_data + 88,0x3f);
-			break;
-                case 0x02: /* sigle word dma mode*/
-			put_le16(identify_data + 62,0x07 | (1 << (val + 8)));
-			put_le16(identify_data + 63,0x07);
-			put_le16(identify_data + 88,0x3f);
-			break;
-		case 0x04: /* mdma mode */
-			put_le16(identify_data + 62,0x07);
-			put_le16(identify_data + 63,0x07 | (1 << (val + 8)));
-			put_le16(identify_data + 88,0x3f);
-			break;
-		case 0x08: /* udma mode */
-			put_le16(identify_data + 62,0x07);
-			put_le16(identify_data + 63,0x07);
-			put_le16(identify_data + 88,0x3f | (1 << (val + 8)));
-			break;
-		default:
-			goto abort_cmd;
-		}
-            s->status = READY_STAT | SEEK_STAT;
-            ide_set_irq(s->bus);
-            break;
-	}
-        default:
-            goto abort_cmd;
-        }
-        break;
     case WIN_FLUSH_CACHE:
     case WIN_FLUSH_CACHE_EXT:
         ide_flush_cache(s);
commit 785f63208569a38a4bed5c12bfe2211f3b14d524
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:04 2013 +0200

    ide: Convert CHECK POWER MDOE to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 3064e2e..a7f8445 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1200,6 +1200,12 @@ static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
     return true;
 }
 
+static bool cmd_check_power_mode(IDEState *s, uint8_t cmd)
+{
+    s->nsector = 0xff; /* device active or idle */
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1244,7 +1250,7 @@ static const struct {
     [WIN_IDLEIMMEDIATE2]          = { cmd_nop, ALL_OK },
     [WIN_STANDBY2]                = { cmd_nop, ALL_OK },
     [WIN_SETIDLE2]                = { cmd_nop, ALL_OK },
-    [WIN_CHECKPOWERMODE2]         = { NULL, ALL_OK },
+    [WIN_CHECKPOWERMODE2]         = { cmd_check_power_mode, ALL_OK | SET_DSC },
     [WIN_SLEEPNOW2]               = { cmd_nop, ALL_OK },
     [WIN_PACKETCMD]               = { NULL, CD_OK },
     [WIN_PIDENTIFY]               = { NULL, CD_OK },
@@ -1263,7 +1269,7 @@ static const struct {
     [WIN_IDLEIMMEDIATE]           = { cmd_nop, ALL_OK },
     [WIN_STANDBY]                 = { cmd_nop, ALL_OK },
     [WIN_SETIDLE1]                = { cmd_nop, ALL_OK },
-    [WIN_CHECKPOWERMODE1]         = { NULL, ALL_OK },
+    [WIN_CHECKPOWERMODE1]         = { cmd_check_power_mode, ALL_OK | SET_DSC },
     [WIN_SLEEPNOW1]               = { cmd_nop, ALL_OK },
     [WIN_FLUSH_CACHE]             = { NULL, ALL_OK },
     [WIN_FLUSH_CACHE_EXT]         = { NULL, HD_CFA_OK },
@@ -1324,13 +1330,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_CHECKPOWERMODE1:
-    case WIN_CHECKPOWERMODE2:
-        s->error = 0;
-        s->nsector = 0xff; /* device active or idle */
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
     case WIN_SETFEATURES:
         if (!s->bs)
             goto abort_cmd;
commit 63a82e6a7b412f61a09d4a593685d8ca2856b093
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:03 2013 +0200

    ide: Convert READ NATIVE MAX ADDRESS to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 2c8a0ff..3064e2e 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1184,6 +1184,22 @@ static bool cmd_write_dma(IDEState *s, uint8_t cmd)
     return false;
 }
 
+static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_READ_NATIVE_MAX_EXT);
+
+    /* Refuse if no sectors are addressable (e.g. medium not inserted) */
+    if (s->nb_sectors == 0) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_cmd_lba48_transform(s, lba48);
+    ide_set_sector(s, s->nb_sectors - 1);
+
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1208,7 +1224,7 @@ static const struct {
     [WIN_READ_ONCE]               = { cmd_read_pio, ALL_OK },
     [WIN_READ_EXT]                = { cmd_read_pio, HD_CFA_OK },
     [WIN_READDMA_EXT]             = { cmd_read_dma, HD_CFA_OK },
-    [WIN_READ_NATIVE_MAX_EXT]     = { NULL, HD_CFA_OK },
+    [WIN_READ_NATIVE_MAX_EXT]     = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
     [WIN_MULTREAD_EXT]            = { cmd_read_multiple, HD_CFA_OK },
     [WIN_WRITE]                   = { cmd_write_pio, HD_CFA_OK },
     [WIN_WRITE_ONCE]              = { cmd_write_pio, HD_CFA_OK },
@@ -1255,7 +1271,7 @@ static const struct {
     [WIN_SETFEATURES]             = { NULL, ALL_OK },
     [IBM_SENSE_CONDITION]         = { NULL, CFA_OK },
     [CFA_WEAR_LEVEL]              = { NULL, HD_CFA_OK },
-    [WIN_READ_NATIVE_MAX]         = { NULL, ALL_OK },
+    [WIN_READ_NATIVE_MAX]         = { cmd_read_native_max, ALL_OK | SET_DSC },
 };
 
 static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
@@ -1269,7 +1285,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     uint16_t *identify_data;
     IDEState *s;
     int n;
-    int lba48 = 0;
 
 #if defined(DEBUG_IDE)
     printf("ide: CMD=%02x\n", val);
@@ -1309,20 +1324,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_READ_NATIVE_MAX_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_READ_NATIVE_MAX:
-        /* Refuse if no sectors are addressable (e.g. medium not inserted) */
-        if (s->nb_sectors == 0) {
-            goto abort_cmd;
-        }
-	ide_cmd_lba48_transform(s, lba48);
-        ide_set_sector(s, s->nb_sectors - 1);
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
-
     case WIN_CHECKPOWERMODE1:
     case WIN_CHECKPOWERMODE2:
         s->error = 0;
commit 92a6a6f64fbb7b7d3d8cb899a9cb52bd873d33fd
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:02 2013 +0200

    ide: Convert DMA read/write commands to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 86af4b0..2c8a0ff 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1152,6 +1152,38 @@ static bool cmd_write_pio(IDEState *s, uint8_t cmd)
     return false;
 }
 
+static bool cmd_read_dma(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_READDMA_EXT);
+
+    if (!s->bs) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_cmd_lba48_transform(s, lba48);
+    ide_sector_start_dma(s, IDE_DMA_READ);
+
+    return false;
+}
+
+static bool cmd_write_dma(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_WRITEDMA_EXT);
+
+    if (!s->bs) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_cmd_lba48_transform(s, lba48);
+    ide_sector_start_dma(s, IDE_DMA_WRITE);
+
+    s->media_changed = 1;
+
+    return false;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1175,13 +1207,13 @@ static const struct {
     [WIN_READ]                    = { cmd_read_pio, ALL_OK },
     [WIN_READ_ONCE]               = { cmd_read_pio, ALL_OK },
     [WIN_READ_EXT]                = { cmd_read_pio, HD_CFA_OK },
-    [WIN_READDMA_EXT]             = { NULL, HD_CFA_OK },
+    [WIN_READDMA_EXT]             = { cmd_read_dma, HD_CFA_OK },
     [WIN_READ_NATIVE_MAX_EXT]     = { NULL, HD_CFA_OK },
     [WIN_MULTREAD_EXT]            = { cmd_read_multiple, HD_CFA_OK },
     [WIN_WRITE]                   = { cmd_write_pio, HD_CFA_OK },
     [WIN_WRITE_ONCE]              = { cmd_write_pio, HD_CFA_OK },
     [WIN_WRITE_EXT]               = { cmd_write_pio, HD_CFA_OK },
-    [WIN_WRITEDMA_EXT]            = { NULL, HD_CFA_OK },
+    [WIN_WRITEDMA_EXT]            = { cmd_write_dma, HD_CFA_OK },
     [CFA_WRITE_SECT_WO_ERASE]     = { cmd_write_pio, CFA_OK },
     [WIN_MULTWRITE_EXT]           = { cmd_write_multiple, HD_CFA_OK },
     [WIN_WRITE_VERIFY]            = { cmd_write_pio, HD_CFA_OK },
@@ -1206,10 +1238,10 @@ static const struct {
     [WIN_MULTREAD]                = { cmd_read_multiple, HD_CFA_OK },
     [WIN_MULTWRITE]               = { cmd_write_multiple, HD_CFA_OK },
     [WIN_SETMULT]                 = { cmd_set_multiple_mode, HD_CFA_OK | SET_DSC },
-    [WIN_READDMA]                 = { NULL, HD_CFA_OK },
-    [WIN_READDMA_ONCE]            = { NULL, HD_CFA_OK },
-    [WIN_WRITEDMA]                = { NULL, HD_CFA_OK },
-    [WIN_WRITEDMA_ONCE]           = { NULL, HD_CFA_OK },
+    [WIN_READDMA]                 = { cmd_read_dma, HD_CFA_OK },
+    [WIN_READDMA_ONCE]            = { cmd_read_dma, HD_CFA_OK },
+    [WIN_WRITEDMA]                = { cmd_write_dma, HD_CFA_OK },
+    [WIN_WRITEDMA_ONCE]           = { cmd_write_dma, HD_CFA_OK },
     [CFA_WRITE_MULTI_WO_ERASE]    = { cmd_write_multiple, CFA_OK },
     [WIN_STANDBYNOW1]             = { cmd_nop, ALL_OK },
     [WIN_IDLEIMMEDIATE]           = { cmd_nop, ALL_OK },
@@ -1277,31 +1309,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_READDMA_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_READDMA:
-    case WIN_READDMA_ONCE:
-        if (!s->bs) {
-            goto abort_cmd;
-        }
-	ide_cmd_lba48_transform(s, lba48);
-        ide_sector_start_dma(s, IDE_DMA_READ);
-        break;
-
-    case WIN_WRITEDMA_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_WRITEDMA:
-    case WIN_WRITEDMA_ONCE:
-        if (!s->bs) {
-            goto abort_cmd;
-        }
-	ide_cmd_lba48_transform(s, lba48);
-        ide_sector_start_dma(s, IDE_DMA_WRITE);
-        s->media_changed = 1;
-        break;
-
     case WIN_READ_NATIVE_MAX_EXT:
         lba48 = 1;
         /* fall through */
commit 0e6498ed65e5f237b163f0bda9f689426dbf6ff0
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:01 2013 +0200

    ide: Convert PIO read/write commands to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index e6cd7b8..86af4b0 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1110,6 +1110,48 @@ static bool cmd_write_multiple(IDEState *s, uint8_t cmd)
     return false;
 }
 
+static bool cmd_read_pio(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_READ_EXT);
+
+    if (s->drive_kind == IDE_CD) {
+        ide_set_signature(s); /* odd, but ATA4 8.27.5.2 requires it */
+        ide_abort_command(s);
+        return true;
+    }
+
+    if (!s->bs) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_cmd_lba48_transform(s, lba48);
+    s->req_nb_sectors = 1;
+    ide_sector_read(s);
+
+    return false;
+}
+
+static bool cmd_write_pio(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_WRITE_EXT);
+
+    if (!s->bs) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_cmd_lba48_transform(s, lba48);
+
+    s->req_nb_sectors = 1;
+    s->status = SEEK_STAT | READY_STAT;
+    ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
+
+    s->media_changed = 1;
+
+    return false;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1130,19 +1172,19 @@ static const struct {
     [WIN_DSM]                     = { cmd_data_set_management, ALL_OK },
     [WIN_DEVICE_RESET]            = { NULL, CD_OK },
     [WIN_RECAL]                   = { cmd_nop, HD_CFA_OK | SET_DSC},
-    [WIN_READ]                    = { NULL, ALL_OK },
-    [WIN_READ_ONCE]               = { NULL, ALL_OK },
-    [WIN_READ_EXT]                = { NULL, HD_CFA_OK },
+    [WIN_READ]                    = { cmd_read_pio, ALL_OK },
+    [WIN_READ_ONCE]               = { cmd_read_pio, ALL_OK },
+    [WIN_READ_EXT]                = { cmd_read_pio, HD_CFA_OK },
     [WIN_READDMA_EXT]             = { NULL, HD_CFA_OK },
     [WIN_READ_NATIVE_MAX_EXT]     = { NULL, HD_CFA_OK },
     [WIN_MULTREAD_EXT]            = { cmd_read_multiple, HD_CFA_OK },
-    [WIN_WRITE]                   = { NULL, HD_CFA_OK },
-    [WIN_WRITE_ONCE]              = { NULL, HD_CFA_OK },
-    [WIN_WRITE_EXT]               = { NULL, HD_CFA_OK },
+    [WIN_WRITE]                   = { cmd_write_pio, HD_CFA_OK },
+    [WIN_WRITE_ONCE]              = { cmd_write_pio, HD_CFA_OK },
+    [WIN_WRITE_EXT]               = { cmd_write_pio, HD_CFA_OK },
     [WIN_WRITEDMA_EXT]            = { NULL, HD_CFA_OK },
-    [CFA_WRITE_SECT_WO_ERASE]     = { NULL, CFA_OK },
+    [CFA_WRITE_SECT_WO_ERASE]     = { cmd_write_pio, CFA_OK },
     [WIN_MULTWRITE_EXT]           = { cmd_write_multiple, HD_CFA_OK },
-    [WIN_WRITE_VERIFY]            = { NULL, HD_CFA_OK },
+    [WIN_WRITE_VERIFY]            = { cmd_write_pio, HD_CFA_OK },
     [WIN_VERIFY]                  = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_VERIFY_ONCE]             = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_VERIFY_EXT]              = { cmd_verify, HD_CFA_OK | SET_DSC },
@@ -1235,41 +1277,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_READ_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_READ:
-    case WIN_READ_ONCE:
-        if (s->drive_kind == IDE_CD) {
-            ide_set_signature(s); /* odd, but ATA4 8.27.5.2 requires it */
-            goto abort_cmd;
-        }
-        if (!s->bs) {
-            goto abort_cmd;
-        }
-	ide_cmd_lba48_transform(s, lba48);
-        s->req_nb_sectors = 1;
-        ide_sector_read(s);
-        break;
-
-    case WIN_WRITE_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_WRITE:
-    case WIN_WRITE_ONCE:
-    case CFA_WRITE_SECT_WO_ERASE:
-    case WIN_WRITE_VERIFY:
-        if (!s->bs) {
-            goto abort_cmd;
-        }
-	ide_cmd_lba48_transform(s, lba48);
-        s->error = 0;
-        s->status = SEEK_STAT | READY_STAT;
-        s->req_nb_sectors = 1;
-        ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
-        s->media_changed = 1;
-        break;
-
     case WIN_READDMA_EXT:
         lba48 = 1;
         /* fall through */
commit adf3a2c46e0b2ed9085df9aca3af76ff83731e98
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:26:00 2013 +0200

    ide: Convert read/write multiple commands to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index bf2007a..e6cd7b8 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1056,6 +1056,60 @@ static bool cmd_verify(IDEState *s, uint8_t cmd)
     return true;
 }
 
+static bool cmd_set_multiple_mode(IDEState *s, uint8_t cmd)
+{
+    if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
+        /* Disable Read and Write Multiple */
+        s->mult_sectors = 0;
+    } else if ((s->nsector & 0xff) != 0 &&
+        ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
+         (s->nsector & (s->nsector - 1)) != 0)) {
+        ide_abort_command(s);
+    } else {
+        s->mult_sectors = s->nsector & 0xff;
+    }
+
+    return true;
+}
+
+static bool cmd_read_multiple(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_MULTREAD_EXT);
+
+    if (!s->bs || !s->mult_sectors) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_cmd_lba48_transform(s, lba48);
+    s->req_nb_sectors = s->mult_sectors;
+    ide_sector_read(s);
+    return false;
+}
+
+static bool cmd_write_multiple(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_MULTWRITE_EXT);
+    int n;
+
+    if (!s->bs || !s->mult_sectors) {
+        ide_abort_command(s);
+        return true;
+    }
+
+    ide_cmd_lba48_transform(s, lba48);
+
+    s->req_nb_sectors = s->mult_sectors;
+    n = MIN(s->nsector, s->req_nb_sectors);
+
+    s->status = SEEK_STAT | READY_STAT;
+    ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
+
+    s->media_changed = 1;
+
+    return false;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1081,13 +1135,13 @@ static const struct {
     [WIN_READ_EXT]                = { NULL, HD_CFA_OK },
     [WIN_READDMA_EXT]             = { NULL, HD_CFA_OK },
     [WIN_READ_NATIVE_MAX_EXT]     = { NULL, HD_CFA_OK },
-    [WIN_MULTREAD_EXT]            = { NULL, HD_CFA_OK },
+    [WIN_MULTREAD_EXT]            = { cmd_read_multiple, HD_CFA_OK },
     [WIN_WRITE]                   = { NULL, HD_CFA_OK },
     [WIN_WRITE_ONCE]              = { NULL, HD_CFA_OK },
     [WIN_WRITE_EXT]               = { NULL, HD_CFA_OK },
     [WIN_WRITEDMA_EXT]            = { NULL, HD_CFA_OK },
     [CFA_WRITE_SECT_WO_ERASE]     = { NULL, CFA_OK },
-    [WIN_MULTWRITE_EXT]           = { NULL, HD_CFA_OK },
+    [WIN_MULTWRITE_EXT]           = { cmd_write_multiple, HD_CFA_OK },
     [WIN_WRITE_VERIFY]            = { NULL, HD_CFA_OK },
     [WIN_VERIFY]                  = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_VERIFY_ONCE]             = { cmd_verify, HD_CFA_OK | SET_DSC },
@@ -1107,14 +1161,14 @@ static const struct {
     [WIN_SMART]                   = { NULL, HD_CFA_OK },
     [CFA_ACCESS_METADATA_STORAGE] = { NULL, CFA_OK },
     [CFA_ERASE_SECTORS]           = { NULL, CFA_OK },
-    [WIN_MULTREAD]                = { NULL, HD_CFA_OK },
-    [WIN_MULTWRITE]               = { NULL, HD_CFA_OK },
-    [WIN_SETMULT]                 = { NULL, HD_CFA_OK },
+    [WIN_MULTREAD]                = { cmd_read_multiple, HD_CFA_OK },
+    [WIN_MULTWRITE]               = { cmd_write_multiple, HD_CFA_OK },
+    [WIN_SETMULT]                 = { cmd_set_multiple_mode, HD_CFA_OK | SET_DSC },
     [WIN_READDMA]                 = { NULL, HD_CFA_OK },
     [WIN_READDMA_ONCE]            = { NULL, HD_CFA_OK },
     [WIN_WRITEDMA]                = { NULL, HD_CFA_OK },
     [WIN_WRITEDMA_ONCE]           = { NULL, HD_CFA_OK },
-    [CFA_WRITE_MULTI_WO_ERASE]    = { NULL, CFA_OK },
+    [CFA_WRITE_MULTI_WO_ERASE]    = { cmd_write_multiple, CFA_OK },
     [WIN_STANDBYNOW1]             = { cmd_nop, ALL_OK },
     [WIN_IDLEIMMEDIATE]           = { cmd_nop, ALL_OK },
     [WIN_STANDBY]                 = { cmd_nop, ALL_OK },
@@ -1181,22 +1235,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_SETMULT:
-        if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
-            /* Disable Read and Write Multiple */
-            s->mult_sectors = 0;
-            s->status = READY_STAT | SEEK_STAT;
-        } else if ((s->nsector & 0xff) != 0 &&
-            ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
-             (s->nsector & (s->nsector - 1)) != 0)) {
-            ide_abort_command(s);
-        } else {
-            s->mult_sectors = s->nsector & 0xff;
-            s->status = READY_STAT | SEEK_STAT;
-        }
-        ide_set_irq(s->bus);
-        break;
-
     case WIN_READ_EXT:
         lba48 = 1;
         /* fall through */
@@ -1232,43 +1270,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
         s->media_changed = 1;
         break;
 
-    case WIN_MULTREAD_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_MULTREAD:
-        if (!s->bs) {
-            goto abort_cmd;
-        }
-        if (!s->mult_sectors) {
-            goto abort_cmd;
-        }
-	ide_cmd_lba48_transform(s, lba48);
-        s->req_nb_sectors = s->mult_sectors;
-        ide_sector_read(s);
-        break;
-
-    case WIN_MULTWRITE_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_MULTWRITE:
-    case CFA_WRITE_MULTI_WO_ERASE:
-        if (!s->bs) {
-            goto abort_cmd;
-        }
-        if (!s->mult_sectors) {
-            goto abort_cmd;
-        }
-	ide_cmd_lba48_transform(s, lba48);
-        s->error = 0;
-        s->status = SEEK_STAT | READY_STAT;
-        s->req_nb_sectors = s->mult_sectors;
-        n = s->nsector;
-        if (n > s->req_nb_sectors)
-            n = s->req_nb_sectors;
-        ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
-        s->media_changed = 1;
-        break;
-
     case WIN_READDMA_EXT:
         lba48 = 1;
         /* fall through */
commit 413860cfb57d44baf971ae8d4f1cdf45340b3a4d
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:25:59 2013 +0200

    ide: Convert verify commands to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 057662d..bf2007a 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1046,6 +1046,16 @@ static bool cmd_identify(IDEState *s, uint8_t cmd)
     return true;
 }
 
+static bool cmd_verify(IDEState *s, uint8_t cmd)
+{
+    bool lba48 = (cmd == WIN_VERIFY_EXT);
+
+    /* do sector number check ? */
+    ide_cmd_lba48_transform(s, lba48);
+
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1079,9 +1089,9 @@ static const struct {
     [CFA_WRITE_SECT_WO_ERASE]     = { NULL, CFA_OK },
     [WIN_MULTWRITE_EXT]           = { NULL, HD_CFA_OK },
     [WIN_WRITE_VERIFY]            = { NULL, HD_CFA_OK },
-    [WIN_VERIFY]                  = { NULL, HD_CFA_OK },
-    [WIN_VERIFY_ONCE]             = { NULL, HD_CFA_OK },
-    [WIN_VERIFY_EXT]              = { NULL, HD_CFA_OK },
+    [WIN_VERIFY]                  = { cmd_verify, HD_CFA_OK | SET_DSC },
+    [WIN_VERIFY_ONCE]             = { cmd_verify, HD_CFA_OK | SET_DSC },
+    [WIN_VERIFY_EXT]              = { cmd_verify, HD_CFA_OK | SET_DSC },
     [WIN_SEEK]                    = { NULL, HD_CFA_OK },
     [CFA_TRANSLATE_SECTOR]        = { NULL, CFA_OK },
     [WIN_DIAGNOSE]                = { NULL, ALL_OK },
@@ -1187,17 +1197,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
         ide_set_irq(s->bus);
         break;
 
-    case WIN_VERIFY_EXT:
-        lba48 = 1;
-        /* fall through */
-    case WIN_VERIFY:
-    case WIN_VERIFY_ONCE:
-        /* do sector number check ? */
-	ide_cmd_lba48_transform(s, lba48);
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
-
     case WIN_READ_EXT:
         lba48 = 1;
         /* fall through */
commit b300337e4e939d58ba39843b5e5fef53eb82acec
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:25:58 2013 +0200

    ide: Convert cmd_nop commands to ide_cmd_table handler
    
    cmd_nop handles all commands that don't really do anything in our
    implementation except setting status register flags.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 2df078b..057662d 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1004,6 +1004,11 @@ void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
     }
 }
 
+static bool cmd_nop(IDEState *s, uint8_t cmd)
+{
+    return true;
+}
+
 static bool cmd_data_set_management(IDEState *s, uint8_t cmd)
 {
     switch (s->feature) {
@@ -1060,7 +1065,7 @@ static const struct {
     [CFA_REQ_EXT_ERROR_CODE]      = { NULL, CFA_OK },
     [WIN_DSM]                     = { cmd_data_set_management, ALL_OK },
     [WIN_DEVICE_RESET]            = { NULL, CD_OK },
-    [WIN_RECAL]                   = { NULL, HD_CFA_OK },
+    [WIN_RECAL]                   = { cmd_nop, HD_CFA_OK | SET_DSC},
     [WIN_READ]                    = { NULL, ALL_OK },
     [WIN_READ_ONCE]               = { NULL, ALL_OK },
     [WIN_READ_EXT]                = { NULL, HD_CFA_OK },
@@ -1080,13 +1085,13 @@ static const struct {
     [WIN_SEEK]                    = { NULL, HD_CFA_OK },
     [CFA_TRANSLATE_SECTOR]        = { NULL, CFA_OK },
     [WIN_DIAGNOSE]                = { NULL, ALL_OK },
-    [WIN_SPECIFY]                 = { NULL, HD_CFA_OK },
-    [WIN_STANDBYNOW2]             = { NULL, ALL_OK },
-    [WIN_IDLEIMMEDIATE2]          = { NULL, ALL_OK },
-    [WIN_STANDBY2]                = { NULL, ALL_OK },
-    [WIN_SETIDLE2]                = { NULL, ALL_OK },
+    [WIN_SPECIFY]                 = { cmd_nop, HD_CFA_OK | SET_DSC },
+    [WIN_STANDBYNOW2]             = { cmd_nop, ALL_OK },
+    [WIN_IDLEIMMEDIATE2]          = { cmd_nop, ALL_OK },
+    [WIN_STANDBY2]                = { cmd_nop, ALL_OK },
+    [WIN_SETIDLE2]                = { cmd_nop, ALL_OK },
     [WIN_CHECKPOWERMODE2]         = { NULL, ALL_OK },
-    [WIN_SLEEPNOW2]               = { NULL, ALL_OK },
+    [WIN_SLEEPNOW2]               = { cmd_nop, ALL_OK },
     [WIN_PACKETCMD]               = { NULL, CD_OK },
     [WIN_PIDENTIFY]               = { NULL, CD_OK },
     [WIN_SMART]                   = { NULL, HD_CFA_OK },
@@ -1100,12 +1105,12 @@ static const struct {
     [WIN_WRITEDMA]                = { NULL, HD_CFA_OK },
     [WIN_WRITEDMA_ONCE]           = { NULL, HD_CFA_OK },
     [CFA_WRITE_MULTI_WO_ERASE]    = { NULL, CFA_OK },
-    [WIN_STANDBYNOW1]             = { NULL, ALL_OK },
-    [WIN_IDLEIMMEDIATE]           = { NULL, ALL_OK },
-    [WIN_STANDBY]                 = { NULL, ALL_OK },
-    [WIN_SETIDLE1]                = { NULL, ALL_OK },
+    [WIN_STANDBYNOW1]             = { cmd_nop, ALL_OK },
+    [WIN_IDLEIMMEDIATE]           = { cmd_nop, ALL_OK },
+    [WIN_STANDBY]                 = { cmd_nop, ALL_OK },
+    [WIN_SETIDLE1]                = { cmd_nop, ALL_OK },
     [WIN_CHECKPOWERMODE1]         = { NULL, ALL_OK },
-    [WIN_SLEEPNOW1]               = { NULL, ALL_OK },
+    [WIN_SLEEPNOW1]               = { cmd_nop, ALL_OK },
     [WIN_FLUSH_CACHE]             = { NULL, ALL_OK },
     [WIN_FLUSH_CACHE_EXT]         = { NULL, HD_CFA_OK },
     [WIN_IDENTIFY]                = { cmd_identify, ALL_OK },
@@ -1166,12 +1171,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_SPECIFY:
-    case WIN_RECAL:
-        s->error = 0;
-        s->status = READY_STAT | SEEK_STAT;
-        ide_set_irq(s->bus);
-        break;
     case WIN_SETMULT:
         if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
             /* Disable Read and Write Multiple */
@@ -1391,19 +1390,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     case WIN_FLUSH_CACHE_EXT:
         ide_flush_cache(s);
         break;
-    case WIN_STANDBY:
-    case WIN_STANDBY2:
-    case WIN_STANDBYNOW1:
-    case WIN_STANDBYNOW2:
-    case WIN_IDLEIMMEDIATE:
-    case WIN_IDLEIMMEDIATE2:
-    case WIN_SETIDLE1:
-    case WIN_SETIDLE2:
-    case WIN_SLEEPNOW1:
-    case WIN_SLEEPNOW2:
-        s->status = READY_STAT;
-        ide_set_irq(s->bus);
-        break;
     case WIN_SEEK:
         /* XXX: Check that seek is within bounds */
         s->status = READY_STAT | SEEK_STAT;
commit 1c66869a02b81ad6b687a08d99d32f5f2b01232e
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:25:57 2013 +0200

    ide: Convert WIN_IDENTIFY to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 567515e..2df078b 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1019,6 +1019,28 @@ static bool cmd_data_set_management(IDEState *s, uint8_t cmd)
     return true;
 }
 
+static bool cmd_identify(IDEState *s, uint8_t cmd)
+{
+    if (s->bs && s->drive_kind != IDE_CD) {
+        if (s->drive_kind != IDE_CFATA) {
+            ide_identify(s);
+        } else {
+            ide_cfata_identify(s);
+        }
+        s->status = READY_STAT | SEEK_STAT;
+        ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
+        ide_set_irq(s->bus);
+        return false;
+    } else {
+        if (s->drive_kind == IDE_CD) {
+            ide_set_signature(s);
+        }
+        ide_abort_command(s);
+    }
+
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1086,7 +1108,7 @@ static const struct {
     [WIN_SLEEPNOW1]               = { NULL, ALL_OK },
     [WIN_FLUSH_CACHE]             = { NULL, ALL_OK },
     [WIN_FLUSH_CACHE_EXT]         = { NULL, HD_CFA_OK },
-    [WIN_IDENTIFY]                = { NULL, ALL_OK },
+    [WIN_IDENTIFY]                = { cmd_identify, ALL_OK },
     [WIN_SETFEATURES]             = { NULL, ALL_OK },
     [IBM_SENSE_CONDITION]         = { NULL, CFA_OK },
     [CFA_WEAR_LEVEL]              = { NULL, HD_CFA_OK },
@@ -1144,22 +1166,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_IDENTIFY:
-        if (s->bs && s->drive_kind != IDE_CD) {
-            if (s->drive_kind != IDE_CFATA)
-                ide_identify(s);
-            else
-                ide_cfata_identify(s);
-            s->status = READY_STAT | SEEK_STAT;
-            ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
-        } else {
-            if (s->drive_kind == IDE_CD) {
-                ide_set_signature(s);
-            }
-            ide_abort_command(s);
-        }
-        ide_set_irq(s->bus);
-        break;
     case WIN_SPECIFY:
     case WIN_RECAL:
         s->error = 0;
commit 4286434cd607b7dea8fb3366f1529abf0ae39fa9
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:25:56 2013 +0200

    ide: Convert WIN_DSM to ide_cmd_table handler
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index cd9de14..567515e 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1004,6 +1004,21 @@ void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
     }
 }
 
+static bool cmd_data_set_management(IDEState *s, uint8_t cmd)
+{
+    switch (s->feature) {
+    case DSM_TRIM:
+        if (s->bs) {
+            ide_sector_start_dma(s, IDE_DMA_TRIM);
+            return false;
+        }
+        break;
+    }
+
+    ide_abort_command(s);
+    return true;
+}
+
 #define HD_OK (1u << IDE_HD)
 #define CD_OK (1u << IDE_CD)
 #define CFA_OK (1u << IDE_CFATA)
@@ -1021,7 +1036,7 @@ static const struct {
 } ide_cmd_table[0x100] = {
     /* NOP not implemented, mandatory for CD */
     [CFA_REQ_EXT_ERROR_CODE]      = { NULL, CFA_OK },
-    [WIN_DSM]                     = { NULL, ALL_OK },
+    [WIN_DSM]                     = { cmd_data_set_management, ALL_OK },
     [WIN_DEVICE_RESET]            = { NULL, CD_OK },
     [WIN_RECAL]                   = { NULL, HD_CFA_OK },
     [WIN_READ]                    = { NULL, ALL_OK },
@@ -1129,18 +1144,6 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     }
 
     switch(val) {
-    case WIN_DSM:
-        switch (s->feature) {
-        case DSM_TRIM:
-            if (!s->bs) {
-                goto abort_cmd;
-            }
-            ide_sector_start_dma(s, IDE_DMA_TRIM);
-            break;
-        default:
-            goto abort_cmd;
-        }
-        break;
     case WIN_IDENTIFY:
         if (s->bs && s->drive_kind != IDE_CD) {
             if (s->drive_kind != IDE_CFATA)
commit a0436e9239d29837955a60e916f876f857d46452
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jun 18 10:25:55 2013 +0200

    ide: Add handler to ide_cmd_table
    
    As a preparation for moving all IDE commands into their own function
    like in the ATAPI code, introduce a 'handler' callback to ide_cmd_table.
    
    Commands using this new infrastructure get some things handled
    automatically:
    
    * The BSY flag is set before calling the handler (in order to avoid bugs
      like the one fixed in f68ec837) and reset on completion.
    
    * The (obsolete) DSC flag in the status register is set on completion if
      the command is flagged with SET_DSC in the command table
    
    * An IRQ is triggered on completion.
    
    * The error register and the ERR flag in the status register are cleared
      before calling the handler and on completion it is asserted that
      either none or both of them are set.
    
    No commands are converted at this point.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 9926d92..cd9de14 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1010,71 +1010,78 @@ void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 #define HD_CFA_OK (HD_OK | CFA_OK)
 #define ALL_OK (HD_OK | CD_OK | CFA_OK)
 
+/* Set the Disk Seek Completed status bit during completion */
+#define SET_DSC (1u << 8)
+
 /* See ACS-2 T13/2015-D Table B.2 Command codes */
-static const uint8_t ide_cmd_table[0x100] = {
+static const struct {
+    /* Returns true if the completion code should be run */
+    bool (*handler)(IDEState *s, uint8_t cmd);
+    int flags;
+} ide_cmd_table[0x100] = {
     /* NOP not implemented, mandatory for CD */
-    [CFA_REQ_EXT_ERROR_CODE]            = CFA_OK,
-    [WIN_DSM]                           = ALL_OK,
-    [WIN_DEVICE_RESET]                  = CD_OK,
-    [WIN_RECAL]                         = HD_CFA_OK,
-    [WIN_READ]                          = ALL_OK,
-    [WIN_READ_ONCE]                     = ALL_OK,
-    [WIN_READ_EXT]                      = HD_CFA_OK,
-    [WIN_READDMA_EXT]                   = HD_CFA_OK,
-    [WIN_READ_NATIVE_MAX_EXT]           = HD_CFA_OK,
-    [WIN_MULTREAD_EXT]                  = HD_CFA_OK,
-    [WIN_WRITE]                         = HD_CFA_OK,
-    [WIN_WRITE_ONCE]                    = HD_CFA_OK,
-    [WIN_WRITE_EXT]                     = HD_CFA_OK,
-    [WIN_WRITEDMA_EXT]                  = HD_CFA_OK,
-    [CFA_WRITE_SECT_WO_ERASE]           = CFA_OK,
-    [WIN_MULTWRITE_EXT]                 = HD_CFA_OK,
-    [WIN_WRITE_VERIFY]                  = HD_CFA_OK,
-    [WIN_VERIFY]                        = HD_CFA_OK,
-    [WIN_VERIFY_ONCE]                   = HD_CFA_OK,
-    [WIN_VERIFY_EXT]                    = HD_CFA_OK,
-    [WIN_SEEK]                          = HD_CFA_OK,
-    [CFA_TRANSLATE_SECTOR]              = CFA_OK,
-    [WIN_DIAGNOSE]                      = ALL_OK,
-    [WIN_SPECIFY]                       = HD_CFA_OK,
-    [WIN_STANDBYNOW2]                   = ALL_OK,
-    [WIN_IDLEIMMEDIATE2]                = ALL_OK,
-    [WIN_STANDBY2]                      = ALL_OK,
-    [WIN_SETIDLE2]                      = ALL_OK,
-    [WIN_CHECKPOWERMODE2]               = ALL_OK,
-    [WIN_SLEEPNOW2]                     = ALL_OK,
-    [WIN_PACKETCMD]                     = CD_OK,
-    [WIN_PIDENTIFY]                     = CD_OK,
-    [WIN_SMART]                         = HD_CFA_OK,
-    [CFA_ACCESS_METADATA_STORAGE]       = CFA_OK,
-    [CFA_ERASE_SECTORS]                 = CFA_OK,
-    [WIN_MULTREAD]                      = HD_CFA_OK,
-    [WIN_MULTWRITE]                     = HD_CFA_OK,
-    [WIN_SETMULT]                       = HD_CFA_OK,
-    [WIN_READDMA]                       = HD_CFA_OK,
-    [WIN_READDMA_ONCE]                  = HD_CFA_OK,
-    [WIN_WRITEDMA]                      = HD_CFA_OK,
-    [WIN_WRITEDMA_ONCE]                 = HD_CFA_OK,
-    [CFA_WRITE_MULTI_WO_ERASE]          = CFA_OK,
-    [WIN_STANDBYNOW1]                   = ALL_OK,
-    [WIN_IDLEIMMEDIATE]                 = ALL_OK,
-    [WIN_STANDBY]                       = ALL_OK,
-    [WIN_SETIDLE1]                      = ALL_OK,
-    [WIN_CHECKPOWERMODE1]               = ALL_OK,
-    [WIN_SLEEPNOW1]                     = ALL_OK,
-    [WIN_FLUSH_CACHE]                   = ALL_OK,
-    [WIN_FLUSH_CACHE_EXT]               = HD_CFA_OK,
-    [WIN_IDENTIFY]                      = ALL_OK,
-    [WIN_SETFEATURES]                   = ALL_OK,
-    [IBM_SENSE_CONDITION]               = CFA_OK,
-    [CFA_WEAR_LEVEL]                    = HD_CFA_OK,
-    [WIN_READ_NATIVE_MAX]               = ALL_OK,
+    [CFA_REQ_EXT_ERROR_CODE]      = { NULL, CFA_OK },
+    [WIN_DSM]                     = { NULL, ALL_OK },
+    [WIN_DEVICE_RESET]            = { NULL, CD_OK },
+    [WIN_RECAL]                   = { NULL, HD_CFA_OK },
+    [WIN_READ]                    = { NULL, ALL_OK },
+    [WIN_READ_ONCE]               = { NULL, ALL_OK },
+    [WIN_READ_EXT]                = { NULL, HD_CFA_OK },
+    [WIN_READDMA_EXT]             = { NULL, HD_CFA_OK },
+    [WIN_READ_NATIVE_MAX_EXT]     = { NULL, HD_CFA_OK },
+    [WIN_MULTREAD_EXT]            = { NULL, HD_CFA_OK },
+    [WIN_WRITE]                   = { NULL, HD_CFA_OK },
+    [WIN_WRITE_ONCE]              = { NULL, HD_CFA_OK },
+    [WIN_WRITE_EXT]               = { NULL, HD_CFA_OK },
+    [WIN_WRITEDMA_EXT]            = { NULL, HD_CFA_OK },
+    [CFA_WRITE_SECT_WO_ERASE]     = { NULL, CFA_OK },
+    [WIN_MULTWRITE_EXT]           = { NULL, HD_CFA_OK },
+    [WIN_WRITE_VERIFY]            = { NULL, HD_CFA_OK },
+    [WIN_VERIFY]                  = { NULL, HD_CFA_OK },
+    [WIN_VERIFY_ONCE]             = { NULL, HD_CFA_OK },
+    [WIN_VERIFY_EXT]              = { NULL, HD_CFA_OK },
+    [WIN_SEEK]                    = { NULL, HD_CFA_OK },
+    [CFA_TRANSLATE_SECTOR]        = { NULL, CFA_OK },
+    [WIN_DIAGNOSE]                = { NULL, ALL_OK },
+    [WIN_SPECIFY]                 = { NULL, HD_CFA_OK },
+    [WIN_STANDBYNOW2]             = { NULL, ALL_OK },
+    [WIN_IDLEIMMEDIATE2]          = { NULL, ALL_OK },
+    [WIN_STANDBY2]                = { NULL, ALL_OK },
+    [WIN_SETIDLE2]                = { NULL, ALL_OK },
+    [WIN_CHECKPOWERMODE2]         = { NULL, ALL_OK },
+    [WIN_SLEEPNOW2]               = { NULL, ALL_OK },
+    [WIN_PACKETCMD]               = { NULL, CD_OK },
+    [WIN_PIDENTIFY]               = { NULL, CD_OK },
+    [WIN_SMART]                   = { NULL, HD_CFA_OK },
+    [CFA_ACCESS_METADATA_STORAGE] = { NULL, CFA_OK },
+    [CFA_ERASE_SECTORS]           = { NULL, CFA_OK },
+    [WIN_MULTREAD]                = { NULL, HD_CFA_OK },
+    [WIN_MULTWRITE]               = { NULL, HD_CFA_OK },
+    [WIN_SETMULT]                 = { NULL, HD_CFA_OK },
+    [WIN_READDMA]                 = { NULL, HD_CFA_OK },
+    [WIN_READDMA_ONCE]            = { NULL, HD_CFA_OK },
+    [WIN_WRITEDMA]                = { NULL, HD_CFA_OK },
+    [WIN_WRITEDMA_ONCE]           = { NULL, HD_CFA_OK },
+    [CFA_WRITE_MULTI_WO_ERASE]    = { NULL, CFA_OK },
+    [WIN_STANDBYNOW1]             = { NULL, ALL_OK },
+    [WIN_IDLEIMMEDIATE]           = { NULL, ALL_OK },
+    [WIN_STANDBY]                 = { NULL, ALL_OK },
+    [WIN_SETIDLE1]                = { NULL, ALL_OK },
+    [WIN_CHECKPOWERMODE1]         = { NULL, ALL_OK },
+    [WIN_SLEEPNOW1]               = { NULL, ALL_OK },
+    [WIN_FLUSH_CACHE]             = { NULL, ALL_OK },
+    [WIN_FLUSH_CACHE_EXT]         = { NULL, HD_CFA_OK },
+    [WIN_IDENTIFY]                = { NULL, ALL_OK },
+    [WIN_SETFEATURES]             = { NULL, ALL_OK },
+    [IBM_SENSE_CONDITION]         = { NULL, CFA_OK },
+    [CFA_WEAR_LEVEL]              = { NULL, HD_CFA_OK },
+    [WIN_READ_NATIVE_MAX]         = { NULL, ALL_OK },
 };
 
 static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
 {
     return cmd < ARRAY_SIZE(ide_cmd_table)
-        && (ide_cmd_table[cmd] & (1u << s->drive_kind));
+        && (ide_cmd_table[cmd].flags & (1u << s->drive_kind));
 }
 
 void ide_exec_cmd(IDEBus *bus, uint32_t val)
@@ -1100,6 +1107,27 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
         goto abort_cmd;
     }
 
+    if (ide_cmd_table[val].handler != NULL) {
+        bool complete;
+
+        s->status = READY_STAT | BUSY_STAT;
+        s->error = 0;
+
+        complete = ide_cmd_table[val].handler(s, val);
+        if (complete) {
+            s->status &= ~BUSY_STAT;
+            assert(!!s->error == !!(s->status & ERR_STAT));
+
+            if ((ide_cmd_table[val].flags & SET_DSC) && !s->error) {
+                s->status |= SEEK_STAT;
+            }
+
+            ide_set_irq(s->bus);
+        }
+
+        return;
+    }
+
     switch(val) {
     case WIN_DSM:
         switch (s->feature) {
commit 93c8e4dc386a243d7d417567d81dc1f1698478a4
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Wed Jun 12 13:08:45 2013 +0200

    usb: fix serial number for hid devices
    
    commit 7b074a22dab4bdda9864b933f1bc811a3db42845 changed the serial
    number of hid devices.  Add compat properties to keep the old serial
    number for qemu 0.12 and older.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 97362f2..7972443 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -622,6 +622,18 @@ static QEMUMachine pc_machine_v0_13 = {
             .driver   = "virtio-serial-pci",\
             .property = "vectors",\
             .value    = stringify(0),\
+        },{\
+            .driver   = "usb-mouse",\
+            .property = "serial",\
+            .value    = "1",\
+        },{\
+            .driver   = "usb-tablet",\
+            .property = "serial",\
+            .value    = "1",\
+        },{\
+            .driver   = "usb-kbd",\
+            .property = "serial",\
+            .value    = "1",\
         }
 
 static QEMUMachine pc_machine_v0_12 = {
commit 71938a09d2b9fd4007515fec6c395916cb08f868
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Wed Jun 12 13:01:49 2013 +0200

    usb: add serial bus property
    
    This patch adds a serial property for all usb devices, which can be
    used to set the serial number of a usb device (as listed by lsusb -v)
    to a specific value.  Applies to emulated devices only.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index d1827be..f83d1de 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -13,6 +13,7 @@ static int usb_qdev_exit(DeviceState *qdev);
 
 static Property usb_props[] = {
     DEFINE_PROP_STRING("port", USBDevice, port_path),
+    DEFINE_PROP_STRING("serial", USBDevice, serial),
     DEFINE_PROP_BIT("full-path", USBDevice, flags,
                     USB_DEV_FLAG_FULL_PATH, true),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/usb/desc.c b/hw/usb/desc.c
index fce303e..bf6c522 100644
--- a/hw/usb/desc.c
+++ b/hw/usb/desc.c
@@ -566,6 +566,12 @@ void usb_desc_create_serial(USBDevice *dev)
     char *path;
     int dst;
 
+    if (dev->serial) {
+        /* 'serial' usb bus property has priority if present */
+        usb_desc_set_string(dev, index, dev->serial);
+        return;
+    }
+
     assert(index != 0 && desc->str[index] != NULL);
     dst = snprintf(serial, sizeof(serial), "%s", desc->str[index]);
     path = qdev_get_dev_path(hcd);
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index b48899d..31f3cde 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -560,6 +560,9 @@ static int usb_hid_initfn(USBDevice *dev, int kind)
 {
     USBHIDState *us = DO_UPCAST(USBHIDState, dev, dev);
 
+    if (dev->serial) {
+        usb_desc_set_string(dev, STR_SERIALNUMBER, dev->serial);
+    }
     usb_desc_init(dev);
     us->intr = usb_ep_get(dev, USB_TOKEN_IN, 1);
     hid_init(&us->hid, kind, usb_hid_changed);
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 1073901..fe914ab 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -58,7 +58,6 @@ typedef struct {
     USBPacket *packet;
     /* usb-storage only */
     BlockConf conf;
-    char *serial;
     uint32_t removable;
 } MSDState;
 
@@ -602,7 +601,7 @@ static int usb_msd_initfn_storage(USBDevice *dev)
         return -1;
     }
 
-    blkconf_serial(&s->conf, &s->serial);
+    blkconf_serial(&s->conf, &dev->serial);
 
     /*
      * Hack alert: this pretends to be a block device, but it's really
@@ -616,16 +615,11 @@ static int usb_msd_initfn_storage(USBDevice *dev)
     bdrv_detach_dev(bs, &s->dev.qdev);
     s->conf.bs = NULL;
 
-    if (s->serial) {
-        usb_desc_set_string(dev, STR_SERIALNUMBER, s->serial);
-    } else {
-        usb_desc_create_serial(dev);
-    }
-
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
     scsi_bus_new(&s->bus, &s->dev.qdev, &usb_msd_scsi_info_storage, NULL);
     scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0, !!s->removable,
-                                            s->conf.bootindex, s->serial);
+                                            s->conf.bootindex, dev->serial);
     if (!scsi_dev) {
         return -1;
     }
@@ -734,7 +728,6 @@ static const VMStateDescription vmstate_usb_msd = {
 
 static Property msd_properties[] = {
     DEFINE_BLOCK_PROPERTIES(MSDState, conf),
-    DEFINE_PROP_STRING("serial", MSDState, serial),
     DEFINE_PROP_BIT("removable", MSDState, removable, 0, false),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/include/hw/usb.h b/include/hw/usb.h
index 4d9d05e..901b0da 100644
--- a/include/hw/usb.h
+++ b/include/hw/usb.h
@@ -205,6 +205,7 @@ struct USBDevice {
     DeviceState qdev;
     USBPort *port;
     char *port_path;
+    char *serial;
     void *opaque;
     uint32_t flags;
 
commit 628e54857a82a3cb65ef96c12640c30d6307a064
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Wed Jun 12 13:17:02 2013 +0200

    usb-host-libusb: set USB_DEV_FLAG_IS_HOST
    
    ... like host-{linux,bsd}.c do.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index 0c12b0f..e2f3cc8 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -895,6 +895,7 @@ static int usb_host_initfn(USBDevice *udev)
     USBHostDevice *s = USB_HOST_DEVICE(udev);
 
     loglevel = s->loglevel;
+    udev->flags |= (1 << USB_DEV_FLAG_IS_HOST);
     udev->auto_attach = 0;
     QTAILQ_INIT(&s->requests);
     QTAILQ_INIT(&s->isorings);
commit bc45de8c21dfc3bc3896a78b33d5a6d9e710dfff
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Thu Jun 6 16:39:34 2013 +0200

    usb/host-libusb: Fix building with libusb git master code
    
    The next libusb release will deprecate libusb_get_port_path, and since
    we compile with -Werror, this breaks the build.
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index 3a582c5..0c12b0f 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -241,7 +241,11 @@ static int usb_host_get_port(libusb_device *dev, char *port, size_t len)
     size_t off;
     int rc, i;
 
+#if LIBUSBX_API_VERSION >= 0x01000102
+    rc = libusb_get_port_numbers(dev, path, 7);
+#else
     rc = libusb_get_port_path(ctx, dev, path, 7);
+#endif
     if (rc < 0) {
         return 0;
     }
commit 4e3d8b4b37b67ff6896ec77975eecbaabf7968a4
Author: Kuo-Jung Su <dantesu at faraday-tech.com>
Date:   Thu Jun 6 15:41:13 2013 +0200

    usb/hcd-ehci: Add Faraday FUSBH200 support
    
    Add Faraday FUSBH200 support, which is slightly different from EHCI spec.
    (Or maybe simply a bad/wrong implementation...)
    
    Signed-off-by: Kuo-Jung Su <dantesu at faraday-tech.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index bad9ca6..e7d4f74 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -124,12 +124,87 @@ static const TypeInfo ehci_tegra2_type_info = {
     .class_init    = ehci_tegra2_class_init,
 };
 
+/*
+ * Faraday FUSBH200 USB 2.0 EHCI
+ */
+
+/**
+ * FUSBH200EHCIRegs:
+ * @FUSBH200_REG_EOF_ASTR: EOF/Async. Sleep Timer Register
+ * @FUSBH200_REG_BMCSR: Bus Monitor Control/Status Register
+ */
+enum FUSBH200EHCIRegs {
+    FUSBH200_REG_EOF_ASTR = 0x34,
+    FUSBH200_REG_BMCSR    = 0x40,
+};
+
+static uint64_t fusbh200_ehci_read(void *opaque, hwaddr addr, unsigned size)
+{
+    EHCIState *s = opaque;
+    hwaddr off = s->opregbase + s->portscbase + 4 * s->portnr + addr;
+
+    switch (off) {
+    case FUSBH200_REG_EOF_ASTR:
+        return 0x00000041;
+    case FUSBH200_REG_BMCSR:
+        /* High-Speed, VBUS valid, interrupt level-high active */
+        return (2 << 9) | (1 << 8) | (1 << 3);
+    }
+
+    return 0;
+}
+
+static void fusbh200_ehci_write(void *opaque, hwaddr addr, uint64_t val,
+                                unsigned size)
+{
+}
+
+static const MemoryRegionOps fusbh200_ehci_mmio_ops = {
+    .read = fusbh200_ehci_read,
+    .write = fusbh200_ehci_write,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void fusbh200_ehci_init(Object *obj)
+{
+    EHCISysBusState *i = SYS_BUS_EHCI(obj);
+    FUSBH200EHCIState *f = FUSBH200_EHCI(obj);
+    EHCIState *s = &i->ehci;
+
+    memory_region_init_io(&f->mem_vendor, &fusbh200_ehci_mmio_ops, s,
+                          "fusbh200", 0x4c);
+    memory_region_add_subregion(&s->mem,
+                                s->opregbase + s->portscbase + 4 * s->portnr,
+                                &f->mem_vendor);
+}
+
+static void fusbh200_ehci_class_init(ObjectClass *oc, void *data)
+{
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+
+    sec->capsbase = 0x0;
+    sec->opregbase = 0x10;
+    sec->portscbase = 0x20;
+    sec->portnr = 1;
+}
+
+static const TypeInfo ehci_fusbh200_type_info = {
+    .name          = TYPE_FUSBH200_EHCI,
+    .parent        = TYPE_SYS_BUS_EHCI,
+    .instance_size = sizeof(FUSBH200EHCIState),
+    .instance_init = fusbh200_ehci_init,
+    .class_init    = fusbh200_ehci_class_init,
+};
+
 static void ehci_sysbus_register_types(void)
 {
     type_register_static(&ehci_type_info);
     type_register_static(&ehci_xlnx_type_info);
     type_register_static(&ehci_exynos4210_type_info);
     type_register_static(&ehci_tegra2_type_info);
+    type_register_static(&ehci_fusbh200_type_info);
 }
 
 type_init(ehci_sysbus_register_types)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 1fb9483..15a28e8 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -338,6 +338,7 @@ typedef struct EHCIPCIState {
 #define TYPE_SYS_BUS_EHCI "sysbus-ehci-usb"
 #define TYPE_EXYNOS4210_EHCI "exynos4210-ehci-usb"
 #define TYPE_TEGRA2_EHCI "tegra2-ehci-usb"
+#define TYPE_FUSBH200_EHCI "fusbh200-ehci-usb"
 
 #define SYS_BUS_EHCI(obj) \
     OBJECT_CHECK(EHCISysBusState, (obj), TYPE_SYS_BUS_EHCI)
@@ -365,4 +366,15 @@ typedef struct SysBusEHCIClass {
     uint16_t portnr;
 } SysBusEHCIClass;
 
+#define FUSBH200_EHCI(obj) \
+    OBJECT_CHECK(FUSBH200EHCIState, (obj), TYPE_FUSBH200_EHCI)
+
+typedef struct FUSBH200EHCIState {
+    /*< private >*/
+    EHCISysBusState parent_obj;
+    /*< public >*/
+
+    MemoryRegion mem_vendor;
+} FUSBH200EHCIState;
+
 #endif
commit cc8d6a8481e64ec53d06245f249235bcaaa73b27
Author: Kuo-Jung Su <dantesu at faraday-tech.com>
Date:   Thu Jun 6 15:41:12 2013 +0200

    usb/hcd-ehci: Replace PORTSC macros with variables
    
    Replace PORTSC macros with variables which could then be
    configured in ehci_xxxx_class_init(...)
    
    Signed-off-by: Kuo-Jung Su <dantesu at faraday-tech.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 509867d..5d229bc 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -78,6 +78,8 @@ static void usb_ehci_pci_init(Object *obj)
 
     s->capsbase = 0x00;
     s->opregbase = 0x20;
+    s->portscbase = 0x44;
+    s->portnr = NB_PORTS;
 
     usb_ehci_init(s, DEVICE(obj));
 }
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 68667b5..bad9ca6 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -51,6 +51,8 @@ static void ehci_sysbus_init(Object *obj)
 
     s->capsbase = sec->capsbase;
     s->opregbase = sec->opregbase;
+    s->portscbase = sec->portscbase;
+    s->portnr = sec->portnr;
     s->as = &address_space_memory;
 
     usb_ehci_init(s, DEVICE(obj));
@@ -60,6 +62,10 @@ static void ehci_sysbus_init(Object *obj)
 static void ehci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(klass);
+
+    sec->portscbase = 0x44;
+    sec->portnr = NB_PORTS;
 
     dc->realize = usb_ehci_sysbus_realize;
     dc->vmsd = &vmstate_ehci_sysbus;
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 546032a..16d6356 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -995,7 +995,7 @@ static uint64_t ehci_port_read(void *ptr, hwaddr addr,
     uint32_t val;
 
     val = s->portsc[addr >> 2];
-    trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val);
+    trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val);
     return val;
 }
 
@@ -1036,7 +1036,7 @@ static void ehci_port_write(void *ptr, hwaddr addr,
     uint32_t old = *portsc;
     USBDevice *dev = s->ports[port].dev;
 
-    trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val);
+    trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val);
 
     /* Clear rwc bits */
     *portsc &= ~(val & PORTSC_RWC_MASK);
@@ -1069,7 +1069,7 @@ static void ehci_port_write(void *ptr, hwaddr addr,
 
     *portsc &= ~PORTSC_RO_MASK;
     *portsc |= val;
-    trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old);
+    trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old);
 }
 
 static void ehci_opreg_write(void *ptr, hwaddr addr,
@@ -2512,8 +2512,14 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
 {
     int i;
 
+    if (s->portnr > NB_PORTS) {
+        error_setg(errp, "Too many ports! Max. port number is %d.",
+                   NB_PORTS);
+        return;
+    }
+
     usb_bus_new(&s->bus, &ehci_bus_ops, dev);
-    for (i = 0; i < NB_PORTS; i++) {
+    for (i = 0; i < s->portnr; i++) {
         usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
                           USB_SPEED_MASK_HIGH);
         s->ports[i].dev = 0;
@@ -2533,7 +2539,7 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
     s->caps[0x01] = 0x00;
     s->caps[0x02] = 0x00;
     s->caps[0x03] = 0x01;        /* HC version */
-    s->caps[0x04] = NB_PORTS;    /* Number of downstream ports */
+    s->caps[0x04] = s->portnr;   /* Number of downstream ports */
     s->caps[0x05] = 0x00;        /* No companion ports at present */
     s->caps[0x06] = 0x00;
     s->caps[0x07] = 0x00;
@@ -2549,13 +2555,13 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
     memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
                           "capabilities", CAPA_SIZE);
     memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
-                          "operational", PORTSC_BEGIN);
+                          "operational", s->portscbase);
     memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
-                          "ports", PORTSC_END - PORTSC_BEGIN);
+                          "ports", 4 * s->portnr);
 
     memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
     memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
-    memory_region_add_subregion(&s->mem, s->opregbase + PORTSC_BEGIN,
+    memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase,
                                 &s->mem_ports);
 }
 
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 2c03e8f..1fb9483 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -40,11 +40,7 @@
 #define MMIO_SIZE        0x1000
 #define CAPA_SIZE        0x10
 
-#define PORTSC               0x0044
-#define PORTSC_BEGIN         PORTSC
-#define PORTSC_END           (PORTSC + 4 * NB_PORTS)
-
-#define NB_PORTS         6        /* Number of downstream ports */
+#define NB_PORTS         6        /* Max. Number of downstream ports */
 
 typedef struct EHCIPacket EHCIPacket;
 typedef struct EHCIQueue EHCIQueue;
@@ -268,6 +264,8 @@ struct EHCIState {
     int companion_count;
     uint16_t capsbase;
     uint16_t opregbase;
+    uint16_t portscbase;
+    uint16_t portnr;
 
     /* properties */
     uint32_t maxframes;
@@ -278,7 +276,7 @@ struct EHCIState {
      */
     uint8_t caps[CAPA_SIZE];
     union {
-        uint32_t opreg[PORTSC_BEGIN/sizeof(uint32_t)];
+        uint32_t opreg[0x44/sizeof(uint32_t)];
         struct {
             uint32_t usbcmd;
             uint32_t usbsts;
@@ -363,6 +361,8 @@ typedef struct SysBusEHCIClass {
 
     uint16_t capsbase;
     uint16_t opregbase;
+    uint16_t portscbase;
+    uint16_t portnr;
 } SysBusEHCIClass;
 
 #endif
commit 20c570432e995313874eaeabc3d0251dab40e16f
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Thu Jun 6 15:41:11 2013 +0200

    usb/hcd-ehci: Add Tegra2 SysBus EHCI device
    
    This prepares an EHCI device for the Nvidia Tegra2 SoC family.
    Values based on patch by Vincent Palatin and verified against TRM v01p.
    
    Cc: Vincent Palatin <vpalatin at chromium.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index e450137..68667b5 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -104,11 +104,26 @@ static const TypeInfo ehci_exynos4210_type_info = {
     .class_init    = ehci_exynos4210_class_init,
 };
 
+static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
+{
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+
+    sec->capsbase = 0x100;
+    sec->opregbase = 0x140;
+}
+
+static const TypeInfo ehci_tegra2_type_info = {
+    .name          = TYPE_TEGRA2_EHCI,
+    .parent        = TYPE_SYS_BUS_EHCI,
+    .class_init    = ehci_tegra2_class_init,
+};
+
 static void ehci_sysbus_register_types(void)
 {
     type_register_static(&ehci_type_info);
     type_register_static(&ehci_xlnx_type_info);
     type_register_static(&ehci_exynos4210_type_info);
+    type_register_static(&ehci_tegra2_type_info);
 }
 
 type_init(ehci_sysbus_register_types)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 7a93957..2c03e8f 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -339,6 +339,7 @@ typedef struct EHCIPCIState {
 
 #define TYPE_SYS_BUS_EHCI "sysbus-ehci-usb"
 #define TYPE_EXYNOS4210_EHCI "exynos4210-ehci-usb"
+#define TYPE_TEGRA2_EHCI "tegra2-ehci-usb"
 
 #define SYS_BUS_EHCI(obj) \
     OBJECT_CHECK(EHCISysBusState, (obj), TYPE_SYS_BUS_EHCI)
commit d4614cc3121b3c6375a63d01947779e36149c68c
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 6 15:41:10 2013 +0200

    usb/hcd-ehci: Split off instance_init from realize
    
    This makes the mem MemoryRegion available to derived instance_inits.
    
    Keep the bus in realize for now since naming breaks in instance_init.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index b352f73..509867d 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -60,20 +60,28 @@ static int usb_ehci_pci_initfn(PCIDevice *dev)
     pci_conf[0x6e] = 0x00;
     pci_conf[0x6f] = 0xc0;  /* USBLEFCTLSTS */
 
-    s->caps[0x09] = 0x68;        /* EECP */
-
     s->irq = dev->irq[3];
     s->as = pci_get_address_space(dev);
 
-    s->capsbase = 0x00;
-    s->opregbase = 0x20;
-
     usb_ehci_realize(s, DEVICE(dev), NULL);
     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
 
     return 0;
 }
 
+static void usb_ehci_pci_init(Object *obj)
+{
+    EHCIPCIState *i = PCI_EHCI(obj);
+    EHCIState *s = &i->ehci;
+
+    s->caps[0x09] = 0x68;        /* EECP */
+
+    s->capsbase = 0x00;
+    s->opregbase = 0x20;
+
+    usb_ehci_init(s, DEVICE(obj));
+}
+
 static void usb_ehci_pci_write_config(PCIDevice *dev, uint32_t addr,
                                       uint32_t val, int l)
 {
@@ -122,6 +130,7 @@ static const TypeInfo ehci_pci_type_info = {
     .name = TYPE_PCI_EHCI,
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(EHCIPCIState),
+    .instance_init = usb_ehci_pci_init,
     .abstract = true,
     .class_init = ehci_class_init,
 };
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 3179e6f..e450137 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -36,15 +36,24 @@ static void usb_ehci_sysbus_realize(DeviceState *dev, Error **errp)
 {
     SysBusDevice *d = SYS_BUS_DEVICE(dev);
     EHCISysBusState *i = SYS_BUS_EHCI(dev);
-    SysBusEHCIClass *sec = SYS_BUS_EHCI_GET_CLASS(dev);
+    EHCIState *s = &i->ehci;
+
+    usb_ehci_realize(s, dev, errp);
+    sysbus_init_irq(d, &s->irq);
+}
+
+static void ehci_sysbus_init(Object *obj)
+{
+    SysBusDevice *d = SYS_BUS_DEVICE(obj);
+    EHCISysBusState *i = SYS_BUS_EHCI(obj);
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_GET_CLASS(obj);
     EHCIState *s = &i->ehci;
 
     s->capsbase = sec->capsbase;
     s->opregbase = sec->opregbase;
     s->as = &address_space_memory;
 
-    usb_ehci_realize(s, dev, errp);
-    sysbus_init_irq(d, &s->irq);
+    usb_ehci_init(s, DEVICE(obj));
     sysbus_init_mmio(d, &s->mem);
 }
 
@@ -61,6 +70,7 @@ static const TypeInfo ehci_type_info = {
     .name          = TYPE_SYS_BUS_EHCI,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(EHCISysBusState),
+    .instance_init = ehci_sysbus_init,
     .abstract      = true,
     .class_init    = ehci_sysbus_class_init,
     .class_size    = sizeof(SysBusEHCIClass),
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index ea0379b..546032a 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2512,6 +2512,22 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
 {
     int i;
 
+    usb_bus_new(&s->bus, &ehci_bus_ops, dev);
+    for (i = 0; i < NB_PORTS; i++) {
+        usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
+                          USB_SPEED_MASK_HIGH);
+        s->ports[i].dev = 0;
+    }
+
+    s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
+    s->async_bh = qemu_bh_new(ehci_frame_timer, s);
+
+    qemu_register_reset(ehci_reset, s);
+    qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
+}
+
+void usb_ehci_init(EHCIState *s, DeviceState *dev)
+{
     /* 2.2 host controller interface version */
     s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
     s->caps[0x01] = 0x00;
@@ -2525,22 +2541,10 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
     s->caps[0x0a] = 0x00;
     s->caps[0x0b] = 0x00;
 
-    usb_bus_new(&s->bus, &ehci_bus_ops, dev);
-    for(i = 0; i < NB_PORTS; i++) {
-        usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
-                          USB_SPEED_MASK_HIGH);
-        s->ports[i].dev = 0;
-    }
-
-    s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
-    s->async_bh = qemu_bh_new(ehci_frame_timer, s);
     QTAILQ_INIT(&s->aqueues);
     QTAILQ_INIT(&s->pqueues);
     usb_packet_init(&s->ipacket);
 
-    qemu_register_reset(ehci_reset, s);
-    qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
-
     memory_region_init(&s->mem, "ehci", MMIO_SIZE);
     memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
                           "capabilities", CAPA_SIZE);
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 15c7630..7a93957 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -322,6 +322,7 @@ struct EHCIState {
 
 extern const VMStateDescription vmstate_ehci;
 
+void usb_ehci_init(EHCIState *s, DeviceState *dev);
 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp);
 
 #define TYPE_PCI_EHCI "pci-ehci-usb"
commit 08f4c90b2887a4499a2f199cf9410308f8ed298c
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jun 6 15:41:09 2013 +0200

    usb/hcd-ehci-sysbus: Convert to QOM realize
    
    The SysBus qdev initfn merely calls SysBusDeviceClass::init, so we can
    replace it with a realizefn already. This avoids getting into any initfn
    ambiguity with the upcoming Faraday EHCI implementation.
    
    Rename internal usb_ehci_initfn() to usb_ehci_realize() to allow to
    return Errors from common initialization code as well.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index f1b5f5d..b352f73 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -68,7 +68,7 @@ static int usb_ehci_pci_initfn(PCIDevice *dev)
     s->capsbase = 0x00;
     s->opregbase = 0x20;
 
-    usb_ehci_initfn(s, DEVICE(dev));
+    usb_ehci_realize(s, DEVICE(dev), NULL);
     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
 
     return 0;
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index f9e4fd3..3179e6f 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -32,8 +32,9 @@ static Property ehci_sysbus_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static int usb_ehci_sysbus_initfn(SysBusDevice *dev)
+static void usb_ehci_sysbus_realize(DeviceState *dev, Error **errp)
 {
+    SysBusDevice *d = SYS_BUS_DEVICE(dev);
     EHCISysBusState *i = SYS_BUS_EHCI(dev);
     SysBusEHCIClass *sec = SYS_BUS_EHCI_GET_CLASS(dev);
     EHCIState *s = &i->ehci;
@@ -42,18 +43,16 @@ static int usb_ehci_sysbus_initfn(SysBusDevice *dev)
     s->opregbase = sec->opregbase;
     s->as = &address_space_memory;
 
-    usb_ehci_initfn(s, DEVICE(dev));
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_mmio(dev, &s->mem);
-    return 0;
+    usb_ehci_realize(s, dev, errp);
+    sysbus_init_irq(d, &s->irq);
+    sysbus_init_mmio(d, &s->mem);
 }
 
 static void ehci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = usb_ehci_sysbus_initfn;
+    dc->realize = usb_ehci_sysbus_realize;
     dc->vmsd = &vmstate_ehci_sysbus;
     dc->props = ehci_sysbus_properties;
 }
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 1ad2159..ea0379b 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2508,7 +2508,7 @@ const VMStateDescription vmstate_ehci = {
     }
 };
 
-void usb_ehci_initfn(EHCIState *s, DeviceState *dev)
+void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
 {
     int i;
 
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 2fcb92f..15c7630 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -322,7 +322,7 @@ struct EHCIState {
 
 extern const VMStateDescription vmstate_ehci;
 
-void usb_ehci_initfn(EHCIState *s, DeviceState *dev);
+void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp);
 
 #define TYPE_PCI_EHCI "pci-ehci-usb"
 #define PCI_EHCI(obj) OBJECT_CHECK(EHCIPCIState, (obj), TYPE_PCI_EHCI)
commit 5ad24e5f3b5968240d50fb2e5b6e19517b041052
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Sat Jun 8 15:37:27 2013 +0200

    spice: Add -spice disable-agent-file-transfer cmdline option (rhbz#961850)
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index 8355f9b..c1533a3 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -917,8 +917,8 @@ DEF("spice", HAS_ARG, QEMU_OPTION_spice,
     "       [,jpeg-wan-compression=[auto|never|always]]\n"
     "       [,zlib-glz-wan-compression=[auto|never|always]]\n"
     "       [,streaming-video=[off|all|filter]][,disable-copy-paste]\n"
-    "       [,agent-mouse=[on|off]][,playback-compression=[on|off]]\n"
-    "       [,seamless-migration=[on|off]]\n"
+    "       [,disable-agent-file-xfer][,agent-mouse=[on|off]]\n"
+    "       [,playback-compression=[on|off]][,seamless-migration=[on|off]]\n"
     "   enable spice\n"
     "   at least one of {port, tls-port} is mandatory\n",
     QEMU_ARCH_ALL)
@@ -961,6 +961,9 @@ Allow client connects without authentication.
 @item disable-copy-paste
 Disable copy paste between the client and the guest.
 
+ at item disable-agent-file-xfer
+Disable spice-vdagent based file-xfer between the client and the guest.
+
 @item tls-port=<nr>
 Set the TCP port spice is listening on for encrypted channels.
 
diff --git a/ui/spice-core.c b/ui/spice-core.c
index bcc4199..f308fd9 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -446,6 +446,9 @@ static QemuOptsList qemu_spice_opts = {
             .name = "disable-copy-paste",
             .type = QEMU_OPT_BOOL,
         },{
+            .name = "disable-agent-file-xfer",
+            .type = QEMU_OPT_BOOL,
+        },{
             .name = "sasl",
             .type = QEMU_OPT_BOOL,
         },{
@@ -739,6 +742,16 @@ void qemu_spice_init(void)
         spice_server_set_agent_copypaste(spice_server, false);
     }
 
+    if (qemu_opt_get_bool(opts, "disable-agent-file-xfer", 0)) {
+#if SPICE_SERVER_VERSION >= 0x000c04
+        spice_server_set_agent_file_xfer(spice_server, false);
+#else
+        error_report("this qemu build does not support the "
+                     "\"disable-agent-file-xfer\" option");
+        exit(1);
+#endif
+    }
+
     compression = SPICE_IMAGE_COMPRESS_AUTO_GLZ;
     str = qemu_opt_get(opts, "image-compression");
     if (str) {
commit bfc10122fafc399654f11eed8dd3ceea7b569105
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Jun 3 10:36:54 2013 +0200

    qxl: fix Coverity scan SIGN_EXTENSION error
    
    Cc: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index f511a62..269b1a7 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -199,7 +199,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor)
     c->hot_y = cursor->header.hot_spot_y;
     switch (cursor->header.type) {
     case SPICE_CURSOR_TYPE_ALPHA:
-        size = cursor->header.width * cursor->header.height * sizeof(uint32_t);
+        size = sizeof(uint32_t) * cursor->header.width * cursor->header.height;
         memcpy(c->data, cursor->chunk.data, size);
         if (qxl->debug > 2) {
             cursor_print_ascii_art(c, "qxl/alpha");
commit 464e3671f9d5c206fa9e2646c81f21ceef7cfb7d
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Jun 21 14:01:31 2013 +0100

    configure: Add signed*signed check to [u]int128_t test
    
    clang 3.3 with -fsanitize=undefined will fail to link code containing an
    int128_t * int128_t multiply (http://llvm.org/bugs/show_bug.cgi?id=16404)
    so add this to our configure test for whether [u]int128_t are usable.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/configure b/configure
index bb126e8..0e0adde 100755
--- a/configure
+++ b/configure
@@ -3329,6 +3329,7 @@ __uint128_t b;
 int main (void) {
   a = a + b;
   b = a * b;
+  a = a * a;
   return 0;
 }
 EOF
commit 965f486c21a0a8fed33e65278516edfc01d1e2fd
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Jun 21 14:00:17 2013 +0100

    Makefile: pass include directives to dtc via CPPFLAGS, not CFLAGS
    
    The dtc submodule's makefile expects -I include directives to be
    in CPPFLAGS, not CFLAGS. Getting this wrong meant that the include
    directive would not be applied when generating the dependency .d
    files. This in turn meant that we couldn't build libfdt when
    doing an out of tree build with clang. (gcc's dependency output
    is slightly different from clang in this situation so it happened
    to work.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/Makefile b/Makefile
index 3cfa7d0..c06bfab 100644
--- a/Makefile
+++ b/Makefile
@@ -146,10 +146,11 @@ $(SRC_PATH)/pixman/configure:
 	(cd $(SRC_PATH)/pixman; autoreconf -v --install)
 
 DTC_MAKE_ARGS=-I$(SRC_PATH)/dtc VPATH=$(SRC_PATH)/dtc -C dtc V="$(V)" LIBFDT_srcdir=$(SRC_PATH)/dtc/libfdt
-DTC_CFLAGS=$(CFLAGS) $(QEMU_CFLAGS) -I$(BUILD_DIR)/dtc -I$(SRC_PATH)/dtc -I$(SRC_PATH)/dtc/libfdt
+DTC_CFLAGS=$(CFLAGS) $(QEMU_CFLAGS)
+DTC_CPPFLAGS=-I$(BUILD_DIR)/dtc -I$(SRC_PATH)/dtc -I$(SRC_PATH)/dtc/libfdt
 
 subdir-dtc:dtc/libfdt dtc/tests
-	$(call quiet-command,$(MAKE) $(DTC_MAKE_ARGS) CFLAGS="$(DTC_CFLAGS)" LDFLAGS="$(LDFLAGS)" ARFLAGS="$(ARFLAGS)" CC="$(CC)" AR="$(AR)" LD="$(LD)" $(SUBDIR_MAKEFLAGS) libfdt/libfdt.a,)
+	$(call quiet-command,$(MAKE) $(DTC_MAKE_ARGS) CPPFLAGS="$(DTC_CPPFLAGS)" CFLAGS="$(DTC_CFLAGS)" LDFLAGS="$(LDFLAGS)" ARFLAGS="$(ARFLAGS)" CC="$(CC)" AR="$(AR)" LD="$(LD)" $(SUBDIR_MAKEFLAGS) libfdt/libfdt.a,)
 
 dtc/%:
 	mkdir -p $@
commit ad0f171e25fb60b385dc7d07632916d3b1043d81
Author: Amos Kong <akong at redhat.com>
Date:   Wed Jun 19 17:23:27 2013 +0800

    qapi: lack of two commas in dict
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qapi-schema.json b/qapi-schema.json
index a80ee40..6cc07c2 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -391,7 +391,7 @@
 #
 # Since: 1.4
 ##
-{ 'enum': 'DataFormat'
+{ 'enum': 'DataFormat',
   'data': [ 'utf8', 'base64' ] }
 
 ##
@@ -1595,7 +1595,7 @@
 #
 # Since: 1.1
 ##
-{ 'enum': 'NewImageMode'
+{ 'enum': 'NewImageMode',
   'data': [ 'existing', 'absolute-paths' ] }
 
 ##
commit 6790f59da37f6b8d4f0fe3a6b17febf512511307
Author: liguang <lig.fnst at cn.fujitsu.com>
Date:   Tue Jun 18 11:45:36 2013 +0800

    sd: pass bool parameter for sd_init
    
    Signed-off-by: liguang <lig.fnst at cn.fujitsu.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index d5944bc..61a8aad 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -250,7 +250,7 @@ static int milkymist_memcard_init(SysBusDevice *dev)
     DriveInfo *dinfo;
 
     dinfo = drive_get_next(IF_SD);
-    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, 0);
+    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     s->enabled = dinfo ? bdrv_is_inserted(dinfo->bdrv) : 0;
 
     memory_region_init_io(&s->regs_region, &memcard_mmio_ops, s,
diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index d4079cd..ba9f4b3 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -592,7 +592,7 @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     /* Instantiate the storage */
-    s->card = sd_init(bd, 0);
+    s->card = sd_init(bd, false);
 
     return s;
 }
@@ -617,7 +617,7 @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
     omap_l4_attach(ta, 0, &s->iomem);
 
     /* Instantiate the storage */
-    s->card = sd_init(bd, 0);
+    s->card = sd_init(bd, false);
 
     s->cdet = qemu_allocate_irqs(omap_mmc_cover_cb, s, 1)[0];
     sd_set_cb(s->card, NULL, s->cdet);
diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index 2527296..e08fd04 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -485,7 +485,7 @@ static int pl181_init(SysBusDevice *dev)
     sysbus_init_irq(dev, &s->irq[1]);
     qdev_init_gpio_out(&s->busdev.qdev, s->cardstatus, 2);
     dinfo = drive_get_next(IF_SD);
-    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, 0);
+    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     return 0;
 }
 
diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c
index 2db1cab..0574d6b 100644
--- a/hw/sd/pxa2xx_mmci.c
+++ b/hw/sd/pxa2xx_mmci.c
@@ -538,7 +538,7 @@ PXA2xxMMCIState *pxa2xx_mmci_init(MemoryRegion *sysmem,
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     /* Instantiate the actual storage */
-    s->card = sd_init(bd, 0);
+    s->card = sd_init(bd, false);
 
     register_savevm(NULL, "pxa2xx_mmci", 0, 0,
                     pxa2xx_mmci_save, pxa2xx_mmci_load, s);
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 0065067..b9dd4be 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1165,7 +1165,7 @@ static void sdhci_initfn(Object *obj)
     DriveInfo *di;
 
     di = drive_get_next(IF_SD);
-    s->card = sd_init(di ? di->bdrv : NULL, 0);
+    s->card = sd_init(di ? di->bdrv : NULL, false);
     s->eject_cb = qemu_allocate_irqs(sdhci_insert_eject_cb, s, 1)[0];
     s->ro_cb = qemu_allocate_irqs(sdhci_card_readonly_cb, s, 1)[0];
     sd_set_cb(s->card, s->ro_cb, s->eject_cb);
diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index 4d3c4f6..d47e237 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -245,7 +245,7 @@ static int ssi_sd_init(SSISlave *dev)
 
     s->mode = SSI_SD_CMD;
     dinfo = drive_get_next(IF_SD);
-    s->sd = sd_init(dinfo ? dinfo->bdrv : NULL, 1);
+    s->sd = sd_init(dinfo ? dinfo->bdrv : NULL, true);
     register_savevm(&dev->qdev, "ssi_sd", -1, 1, ssi_sd_save, ssi_sd_load, s);
     return 0;
 }
commit e990a3932847c45839355de72e73182a53fc75ac
Author: liguang <lig.fnst at cn.fujitsu.com>
Date:   Tue Jun 18 11:45:35 2013 +0800

    qemu-char: use bool in qemu_chr_open_socket and simplify code a bit
    
    Local variables is_* should be bool by usage.
    While at it, simplify the logic/code a bit.
    
    Signed-off-by: liguang <lig.fnst at cn.fujitsu.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-char.c b/qemu-char.c
index 2c3cfe6..a030e6b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2679,19 +2679,12 @@ static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
     CharDriverState *chr = NULL;
     Error *local_err = NULL;
     int fd = -1;
-    int is_listen;
-    int is_waitconnect;
-    int do_nodelay;
-    int is_unix;
-    int is_telnet;
-
-    is_listen      = qemu_opt_get_bool(opts, "server", 0);
-    is_waitconnect = qemu_opt_get_bool(opts, "wait", 1);
-    is_telnet      = qemu_opt_get_bool(opts, "telnet", 0);
-    do_nodelay     = !qemu_opt_get_bool(opts, "delay", 1);
-    is_unix        = qemu_opt_get(opts, "path") != NULL;
-    if (!is_listen)
-        is_waitconnect = 0;
+
+    bool is_listen      = qemu_opt_get_bool(opts, "server", false);
+    bool is_waitconnect = is_listen && qemu_opt_get_bool(opts, "wait", true);
+    bool is_telnet      = qemu_opt_get_bool(opts, "telnet", false);
+    bool do_nodelay     = !qemu_opt_get_bool(opts, "delay", true);
+    bool is_unix        = qemu_opt_get(opts, "path") != NULL;
 
     if (is_unix) {
         if (is_listen) {
commit 2c8cf549571bbe0b245fc4f9680e1dbde39a015c
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Tue Jun 11 15:42:44 2013 +0400

    vnc: use booleans for vnc_connect, vnc_listen_read and vnc_display_add_client
    
    Some arguments to these functions are booleans - either by declaration,
    or by actual usage, but sometimes value of 0 or 1 is passed for a bool,
    and sometimes it is declared as int but a bool value, or true/false,
    is passed to it instead.  Clean it up a bit.
    
    Cc: liguang <lig.fnst at cn.fujitsu.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/include/ui/console.h b/include/ui/console.h
index f1d79f9..98edf41 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -314,7 +314,7 @@ void cocoa_display_init(DisplayState *ds, int full_screen);
 /* vnc.c */
 void vnc_display_init(DisplayState *ds);
 void vnc_display_open(DisplayState *ds, const char *display, Error **errp);
-void vnc_display_add_client(DisplayState *ds, int csock, int skipauth);
+void vnc_display_add_client(DisplayState *ds, int csock, bool skipauth);
 char *vnc_display_local_addr(DisplayState *ds);
 #ifdef CONFIG_VNC
 int vnc_display_password(DisplayState *ds, const char *password);
diff --git a/ui/vnc.c b/ui/vnc.c
index dfc7459..5601cc3 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2771,7 +2771,8 @@ static void vnc_refresh(DisplayChangeListener *dcl)
     }
 }
 
-static void vnc_connect(VncDisplay *vd, int csock, int skipauth, bool websocket)
+static void vnc_connect(VncDisplay *vd, int csock,
+                        bool skipauth, bool websocket)
 {
     VncState *vs = g_malloc0(sizeof(VncState));
     int i;
@@ -2883,19 +2884,19 @@ static void vnc_listen_read(void *opaque, bool websocket)
     }
 
     if (csock != -1) {
-        vnc_connect(vs, csock, 0, websocket);
+        vnc_connect(vs, csock, false, websocket);
     }
 }
 
 static void vnc_listen_regular_read(void *opaque)
 {
-    vnc_listen_read(opaque, 0);
+    vnc_listen_read(opaque, false);
 }
 
 #ifdef CONFIG_VNC_WS
 static void vnc_listen_websocket_read(void *opaque)
 {
-    vnc_listen_read(opaque, 1);
+    vnc_listen_read(opaque, true);
 }
 #endif /* CONFIG_VNC_WS */
 
@@ -3283,7 +3284,7 @@ void vnc_display_open(DisplayState *ds, const char *display, Error **errp)
         if (csock < 0) {
             goto fail;
         }
-        vnc_connect(vs, csock, 0, 0);
+        vnc_connect(vs, csock, false, false);
     } else {
         /* listen for connects */
         char *dpy;
@@ -3341,9 +3342,9 @@ fail:
 #endif /* CONFIG_VNC_WS */
 }
 
-void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
+void vnc_display_add_client(DisplayState *ds, int csock, bool skipauth)
 {
     VncDisplay *vs = vnc_display;
 
-    vnc_connect(vs, csock, skipauth, 0);
+    vnc_connect(vs, csock, skipauth, false);
 }
commit 1984745ea8ad309a06690a83e91d031d21d709ff
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Jun 18 21:08:57 2013 +1000

    block/nand: Formatting sweep
    
    Make this code closer to passing checkpatch. Mostly missing braces, but
    a few rogue tabs in there as well.
    
    Cc: qemu-trivial at nongnu.org
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/block/nand.c b/hw/block/nand.c
index 087ca14..43401a0 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -298,10 +298,8 @@ static void nand_command(NANDFlashState *s)
 
     case NAND_CMD_BLOCKERASE2:
         s->addr &= (1ull << s->addrlen * 8) - 1;
-        if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP)
-            s->addr <<= 16;
-        else
-            s->addr <<= 8;
+        s->addr <<= nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP ?
+                                                                    16 : 8;
 
         if (s->wp) {
             s->blk_erase(s);
@@ -464,10 +462,11 @@ void nand_setpins(DeviceState *dev, uint8_t cle, uint8_t ale,
     s->ce = ce;
     s->wp = wp;
     s->gnd = gnd;
-    if (wp)
+    if (wp) {
         s->status |= NAND_IOSTATUS_UNPROTCT;
-    else
+    } else {
         s->status &= ~NAND_IOSTATUS_UNPROTCT;
+    }
 }
 
 void nand_getpins(DeviceState *dev, int *rb)
@@ -489,13 +488,12 @@ void nand_setio(DeviceState *dev, uint32_t value)
                 return;
             }
         }
-        if (value == NAND_CMD_READ0)
+        if (value == NAND_CMD_READ0) {
             s->offset = 0;
-	else if (value == NAND_CMD_READ1) {
+        } else if (value == NAND_CMD_READ1) {
             s->offset = 0x100;
             value = NAND_CMD_READ0;
-        }
-	else if (value == NAND_CMD_READ2) {
+        } else if (value == NAND_CMD_READ2) {
             s->offset = 1 << s->page_shift;
             value = NAND_CMD_READ0;
         }
@@ -508,8 +506,9 @@ void nand_setio(DeviceState *dev, uint32_t value)
                 s->cmd == NAND_CMD_BLOCKERASE2 ||
                 s->cmd == NAND_CMD_NOSERIALREAD2 ||
                 s->cmd == NAND_CMD_RANDOMREAD2 ||
-                s->cmd == NAND_CMD_RESET)
+                s->cmd == NAND_CMD_RESET) {
             nand_command(s);
+        }
 
         if (s->cmd != NAND_CMD_RANDOMREAD2) {
             s->addrlen = 0;
@@ -596,8 +595,9 @@ uint32_t nand_getio(DeviceState *dev)
             s->iolen = (1 << s->page_shift) + (1 << s->oob_shift) - offset;
     }
 
-    if (s->ce || s->iolen <= 0)
+    if (s->ce || s->iolen <= 0) {
         return 0;
+    }
 
     for (offset = s->buswidth; offset--;) {
         x |= s->ioaddr[offset] << (offset << 3);
@@ -696,8 +696,9 @@ static void glue(nand_blk_erase_, PAGE_SIZE)(NANDFlashState *s)
     uint8_t iobuf[0x200] = { [0 ... 0x1ff] = 0xff, };
     addr = s->addr & ~((1 << (ADDR_SHIFT + s->erase_shift)) - 1);
 
-    if (PAGE(addr) >= s->pages)
+    if (PAGE(addr) >= s->pages) {
         return;
+    }
 
     if (!s->bdrv) {
         memset(s->storage + PAGE_START(addr),
@@ -725,11 +726,12 @@ static void glue(nand_blk_erase_, PAGE_SIZE)(NANDFlashState *s)
         memset(iobuf, 0xff, 0x200);
         i = (addr & ~0x1ff) + 0x200;
         for (addr += ((PAGE_SIZE + OOB_SIZE) << s->erase_shift) - 0x200;
-                        i < addr; i += 0x200)
+                        i < addr; i += 0x200) {
             if (bdrv_write(s->bdrv, i >> 9, iobuf, 1) < 0) {
                 printf("%s: write error in sector %" PRIu64 "\n",
                        __func__, i >> 9);
             }
+        }
 
         page = i >> 9;
         if (bdrv_read(s->bdrv, page, iobuf, 1) < 0) {
@@ -745,8 +747,9 @@ static void glue(nand_blk_erase_, PAGE_SIZE)(NANDFlashState *s)
 static void glue(nand_blk_load_, PAGE_SIZE)(NANDFlashState *s,
                 uint64_t addr, int offset)
 {
-    if (PAGE(addr) >= s->pages)
+    if (PAGE(addr) >= s->pages) {
         return;
+    }
 
     if (s->bdrv) {
         if (s->mem_oob) {
commit 329f97fc4ff4b533fcd2d8f4eab6c9c2568aed27
Author: Anthony PERARD <anthony.perard at citrix.com>
Date:   Mon Jun 17 17:38:26 2013 +0100

    qxl: Fix QXLRam initialisation.
    
    The qxl driver expect NULL for QXLRam.memory_configs, but this is never
    initialized.
    
    If memory is set to 0xc2c2.., it leads to a spice-critical error when
    trying to start qxl.
    
    Signed-off-by: Anthony PERARD <anthony.perard at citrix.com>
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index c475cb1..937a402 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -387,6 +387,7 @@ static void init_qxl_ram(PCIQXLDevice *d)
     d->ram->int_pending = cpu_to_le32(0);
     d->ram->int_mask    = cpu_to_le32(0);
     d->ram->update_surface = 0;
+    d->ram->monitors_config = 0;
     SPICE_RING_INIT(&d->ram->cmd_ring);
     SPICE_RING_INIT(&d->ram->cursor_ring);
     SPICE_RING_INIT(&d->ram->release_ring);
commit 4999f3a8a6009de05ba82e58e723277917f16254
Author: Markus Armbruster <armbru at redhat.com>
Date:   Tue Jun 18 10:05:23 2013 +0200

    acl: acl_add can't insert before last list element, fix
    
    Watch this:
    
        $ upstream-qemu -nodefaults -S -vnc :0,acl,sasl -monitor stdio
        QEMU 1.5.50 monitor - type 'help' for more information
        (qemu) acl_add vnc.username drei allow
        acl: added rule at position 1
        (qemu) acl_show vnc.username
        policy: deny
        1: allow drei
        (qemu) acl_add vnc.username zwei allow 1
        acl: added rule at position 2
        (qemu) acl_show vnc.username
        policy: deny
        1: allow drei
        2: allow zwei
        (qemu) acl_add vnc.username eins allow 1
        acl: added rule at position 1
        (qemu) acl_show vnc.username
        policy: deny
        1: allow eins
        2: allow drei
        3: allow zwei
    
    The second acl_add inserts at position 2 instead of 1.
    
    Root cause is an off-by-one in qemu_acl_insert(): when index ==
    acl->nentries, it appends instead of inserting before the last list
    element.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/acl.c b/util/acl.c
index a7f33ff..938b7ae 100644
--- a/util/acl.c
+++ b/util/acl.c
@@ -138,9 +138,9 @@ int qemu_acl_insert(qemu_acl *acl,
 
     if (index <= 0)
         return -1;
-    if (index >= acl->nentries)
+    if (index > acl->nentries) {
         return qemu_acl_append(acl, deny, match);
-
+    }
 
     entry = g_malloc(sizeof(*entry));
     entry->match = g_strdup(match);
commit f2c4ddd9c32f7f389e83a0d866fb600e37985d03
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Jun 18 01:09:06 2013 +0200

    configure: Fix "ERROR: ERROR: " for missing/incompatible DTC
    
    error_exit already prepends "ERROR: ", so no need to print it manually.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/configure b/configure
index ad32f87..bb126e8 100755
--- a/configure
+++ b/configure
@@ -2529,7 +2529,7 @@ EOF
     fdt_libs="-L\$(BUILD_DIR)/dtc/libfdt $fdt_libs"
   elif test "$fdt" = "yes" ; then
     # have neither and want - prompt for system/submodule install
-    error_exit "ERROR: DTC not present. Your options:" \
+    error_exit "DTC not present. Your options:" \
         "  (1) Preferred: Install the DTC devel package" \
         "  (2) Fetch the DTC submodule, using:" \
         "      git submodule update --init dtc"
commit 87e613ea9ed30f4217fd11aa2ad28a9fb4f1c54a
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 16 11:19:31 2013 +0200

    audio: Replace static functions in header file by macros, remove GCC_ATTR
    
    Using macros instead of static functions for dolog and for ldebug
    simplifies the code and can also reduce the total code size.
    
    GCC_ATTR was only used in audio_int.h, so it is now unused and
    the definition can be removed from compiler.h.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/audio/audio_int.h b/audio/audio_int.h
index b9b0676..fd019a0 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -243,38 +243,13 @@ static inline int audio_ring_dist (int dst, int src, int len)
     return (dst >= src) ? (dst - src) : (len - src + dst);
 }
 
-static void GCC_ATTR dolog (const char *fmt, ...)
-{
-    va_list ap;
-
-    va_start (ap, fmt);
-    AUD_vlog (AUDIO_CAP, fmt, ap);
-    va_end (ap);
-}
+#define dolog(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
 
 #ifdef DEBUG
-static void GCC_ATTR ldebug (const char *fmt, ...)
-{
-    va_list ap;
-
-    va_start (ap, fmt);
-    AUD_vlog (AUDIO_CAP, fmt, ap);
-    va_end (ap);
-}
+#define ldebug(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
 #else
-#if defined NDEBUG && defined __GNUC__
-#define ldebug(...)
-#elif defined NDEBUG && defined _MSC_VER
-#define ldebug __noop
-#else
-static void GCC_ATTR ldebug (const char *fmt, ...)
-{
-    (void) fmt;
-}
+#define ldebug(fmt, ...) (void)0
 #endif
-#endif
-
-#undef GCC_ATTR
 
 #define AUDIO_STRINGIFY_(n) #n
 #define AUDIO_STRINGIFY(n) AUDIO_STRINGIFY_(n)
diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index 6175c24..155b358 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -38,11 +38,9 @@
 #if defined __GNUC__
 # if !QEMU_GNUC_PREREQ(4, 4)
    /* gcc versions before 4.4.x don't support gnu_printf, so use printf. */
-#  define GCC_ATTR __attribute__((__unused__, format(printf, 1, 2)))
 #  define GCC_FMT_ATTR(n, m) __attribute__((format(printf, n, m)))
 # else
    /* Use gnu_printf when supported (qemu uses standard format strings). */
-#  define GCC_ATTR __attribute__((__unused__, format(gnu_printf, 1, 2)))
 #  define GCC_FMT_ATTR(n, m) __attribute__((format(gnu_printf, n, m)))
 #  if defined(_WIN32)
     /* Map __printf__ to __gnu_printf__ because we want standard format strings
@@ -51,7 +49,6 @@
 #  endif
 # endif
 #else
-#define GCC_ATTR /**/
 #define GCC_FMT_ATTR(n, m)
 #endif
 
commit 48f0475f813dfa5ceb0e1f10c2ac3f28a8af583b
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 16 11:08:52 2013 +0200

    libcacard: Fix cppcheck warning and remove unneeded code
    
    The local function vcard_emul_alloc_arrays always returned PR_TRUE.
    Therefore cppcheck complained about code which handled the
    non-existent PR_FALSE case.
    
    Remove the function's return value and the dead code.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/libcacard/vcard_emul_nss.c b/libcacard/vcard_emul_nss.c
index 1a3e568..fb429b1 100644
--- a/libcacard/vcard_emul_nss.c
+++ b/libcacard/vcard_emul_nss.c
@@ -90,17 +90,13 @@ static int nss_emul_init;
 /*
  * allocate the set of arrays for certs, cert_len, key
  */
-static PRBool
+static void
 vcard_emul_alloc_arrays(unsigned char ***certsp, int **cert_lenp,
                         VCardKey ***keysp, int cert_count)
 {
-    *certsp = NULL;
-    *cert_lenp = NULL;
-    *keysp = NULL;
     *certsp = (unsigned char **)g_malloc(sizeof(unsigned char *)*cert_count);
     *cert_lenp = (int *)g_malloc(sizeof(int)*cert_count);
     *keysp = (VCardKey **)g_malloc(sizeof(VCardKey *)*cert_count);
-    return PR_TRUE;
 }
 
 /*
@@ -601,7 +597,6 @@ vcard_emul_mirror_card(VReader *vreader)
     int *cert_len;
     VCardKey **keys;
     PK11SlotInfo *slot;
-    PRBool ret;
     VCard *card;
 
     slot = vcard_emul_reader_get_slot(vreader);
@@ -627,10 +622,7 @@ vcard_emul_mirror_card(VReader *vreader)
     }
 
     /* allocate the arrays */
-    ret = vcard_emul_alloc_arrays(&certs, &cert_len, &keys, cert_count);
-    if (ret == PR_FALSE) {
-        return NULL;
-    }
+    vcard_emul_alloc_arrays(&certs, &cert_len, &keys, cert_count);
 
     /* fill in the arrays */
     cert_count = 0;
@@ -878,7 +870,7 @@ VCardEmulError
 vcard_emul_init(const VCardEmulOptions *options)
 {
     SECStatus rv;
-    PRBool ret, has_readers = PR_FALSE;
+    PRBool has_readers = PR_FALSE;
     VReader *vreader;
     VReaderEmul *vreader_emul;
     SECMODListLock *module_lock;
@@ -944,11 +936,9 @@ vcard_emul_init(const VCardEmulOptions *options)
         vreader_add_reader(vreader);
         cert_count = options->vreader[i].cert_count;
 
-        ret = vcard_emul_alloc_arrays(&certs, &cert_len, &keys,
-                                      options->vreader[i].cert_count);
-        if (ret == PR_FALSE) {
-            continue;
-        }
+        vcard_emul_alloc_arrays(&certs, &cert_len, &keys,
+                                options->vreader[i].cert_count);
+
         cert_count = 0;
         for (j = 0; j < options->vreader[i].cert_count; j++) {
             /* we should have a better way of identifying certs than by
commit 4f080057767a684aab60998659e18f98c5fbefc7
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 16 13:33:05 2013 +0200

    savevm: Fix potential memory leak
    
    The leak was reported by cppcheck. Fix it by moving the g_malloc0 after
    the argument validity check.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/savevm.c b/savevm.c
index ff5ece6..48cc2a9 100644
--- a/savevm.c
+++ b/savevm.c
@@ -479,7 +479,7 @@ static const QEMUFileOps socket_write_ops = {
 
 QEMUFile *qemu_fopen_socket(int fd, const char *mode)
 {
-    QEMUFileSocket *s = g_malloc0(sizeof(QEMUFileSocket));
+    QEMUFileSocket *s;
 
     if (mode == NULL ||
         (mode[0] != 'r' && mode[0] != 'w') ||
@@ -488,6 +488,7 @@ QEMUFile *qemu_fopen_socket(int fd, const char *mode)
         return NULL;
     }
 
+    s = g_malloc0(sizeof(QEMUFileSocket));
     s->fd = fd;
     if (mode[0] == 'w') {
         qemu_set_block(s->fd);
commit 90527d2a8bb08ca5b4774eacfdd6b8fe9671c077
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 16 13:37:25 2013 +0200

    kvm: Fix potential resource leak (missing fclose)
    
    This leak was detected by cppcheck.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index ff85590..1fb7ad4 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -548,6 +548,7 @@ static int get_real_id(const char *devpath, const char *idname, uint16_t *val)
     if (fscanf(f, "%li\n", &id) == 1) {
         *val = id;
     } else {
+        fclose(f);
         return -1;
     }
     fclose(f);
commit 7c30f65703fc4698ea9794126f1b978f34ac93b9
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jun 16 17:01:05 2013 +0200

    qemu-img: Add missing GCC_FMT_ATTR
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-img.c b/qemu-img.c
index 809b4f1..f8c97d3 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -128,7 +128,7 @@ static void help(void)
     exit(1);
 }
 
-static int qprintf(bool quiet, const char *fmt, ...)
+static int GCC_FMT_ATTR(2, 3) qprintf(bool quiet, const char *fmt, ...)
 {
     int ret = 0;
     if (!quiet) {
commit f17e4eaafc9d89a841fd30be93512b4973e53e31
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Sat Jun 15 13:47:32 2013 +0400

    qemu-options: trivial fix for -mon args help
    
    It is the (implied sub)option name which is optional, not
    the value of that (sub)option, make it so in the help output.
    (Introduced by commit 22a0e04b9bb)
    
    Cc: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-options.hx b/qemu-options.hx
index 8355f9b..688040e 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2539,9 +2539,9 @@ Like -monitor but opens in 'control' mode.
 ETEXI
 
 DEF("mon", HAS_ARG, QEMU_OPTION_mon, \
-    "-mon chardev=[name][,mode=readline|control][,default]\n", QEMU_ARCH_ALL)
+    "-mon [chardev=]name[,mode=readline|control][,default]\n", QEMU_ARCH_ALL)
 STEXI
- at item -mon chardev=[name][,mode=readline|control][,default]
+ at item -mon [chardev=]name[,mode=readline|control][,default]
 @findex -mon
 Setup monitor on chardev @var{name}.
 ETEXI
commit 24f6ff863bce236f39ea597206e0a8df2e9537e6
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Sat Jun 15 14:44:20 2013 +0400

    vl: reformat SDL ifdeffery a bit
    
    This reformats #ifdef..#endif and case statement a bit,
    to make it a bit shorter and matching other cases like that
    (no code changes).
    
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/vl.c b/vl.c
index 767e020..0a8f056 100644
--- a/vl.c
+++ b/vl.c
@@ -3472,12 +3472,11 @@ int main(int argc, char **argv, char **envp)
             case QEMU_OPTION_no_quit:
                 no_quit = 1;
                 break;
-#ifdef CONFIG_SDL
             case QEMU_OPTION_sdl:
+#ifdef CONFIG_SDL
                 display_type = DT_SDL;
                 break;
 #else
-            case QEMU_OPTION_sdl:
                 fprintf(stderr, "SDL support is disabled\n");
                 exit(1);
 #endif


More information about the Spice-commits mailing list