[Spice-commits] 30 commits - HACKING block.c block/nbd.c block/qcow2-cluster.c block/qcow2.c block/qcow2.h bsd-user/syscall.c configure docs/memory.txt exec.c fsdev/virtfs-proxy-helper.c hw/9pfs hw/acpi hw/arm hw/block hw/display hw/i386 hw/intc hw/usb include/hw include/qemu include/qemu-common.h include/qom include/sysemu kvm-all.c qemu-char.c qemu-doc.texi qga/channel-win32.c qom/object.c readline.c target-i386/translate.c target-s390x/kvm.c tcg/optimize.c trace-events ui/gtk.c util/oslib-posix.c util/oslib-win32.c util/uri.c vl.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Wed May 15 06:29:30 PDT 2013


 HACKING                     |    7 +--
 block.c                     |    8 ++-
 block/nbd.c                 |    2 
 block/qcow2-cluster.c       |   23 ++++++----
 block/qcow2.c               |   13 ++++-
 block/qcow2.h               |    5 +-
 bsd-user/syscall.c          |    7 +--
 configure                   |    9 +++
 docs/memory.txt             |   11 +++-
 exec.c                      |   14 ++----
 fsdev/virtfs-proxy-helper.c |    4 -
 hw/9pfs/virtio-9p-local.c   |    2 
 hw/acpi/core.c              |    7 +++
 hw/arm/spitz.c              |  100 ++++++++++++++++++++++----------------------
 hw/block/m25p80.c           |   31 +++++++++++--
 hw/block/pc_sysfw.c         |    8 +--
 hw/display/qxl.c            |    3 +
 hw/i386/pc_piix.c           |    3 -
 hw/i386/pc_q35.c            |    3 -
 hw/intc/imx_avic.c          |    2 
 hw/usb/host-linux.c         |    4 -
 include/hw/i386/pc.h        |    5 --
 include/qemu-common.h       |   12 +++++
 include/qemu/osdep.h        |    5 +-
 include/qom/object.h        |   44 ++++++++++++++++---
 include/sysemu/kvm.h        |    4 -
 kvm-all.c                   |    6 +-
 qemu-char.c                 |   10 ----
 qemu-doc.texi               |    4 -
 qga/channel-win32.c         |    2 
 qom/object.c                |   87 +++++++++++++++++++++++++++++++++-----
 readline.c                  |   15 ++++++
 target-i386/translate.c     |    1 
 target-s390x/kvm.c          |    2 
 tcg/optimize.c              |    1 
 trace-events                |    6 ++
 ui/gtk.c                    |   20 ++++++++
 util/oslib-posix.c          |   12 ++++-
 util/oslib-win32.c          |   12 ++++-
 util/uri.c                  |    2 
 vl.c                        |    2 
 41 files changed, 359 insertions(+), 159 deletions(-)

New commits:
commit 110db9b48c0a6379fca122801c3ae48e349aa6d4
Merge: e7a09b9 f3f4d2c
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue May 14 10:24:37 2013 -0500

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Kevin Wolf
    # Via Stefan Hajnoczi
    * stefanha/block:
      block: Add hint to -EFBIG error message
      qcow2: Catch some L1 table index overflows
    
    Message-id: 1368543269-29784-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit f3f4d2c09b9cf46903ba38425ec46c44185162bd
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue May 14 16:14:34 2013 +0200

    block: Add hint to -EFBIG error message
    
    The limit of qcow2 files at least depends on the cluster size. If the
    image format has a cluster_size option, suggest to increase it.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index aa9a533..3f87489 100644
--- a/block.c
+++ b/block.c
@@ -4857,8 +4857,12 @@ void bdrv_img_create(const char *filename, const char *fmt,
             error_setg(errp,"Formatting or formatting option not supported for "
                             "file format '%s'", fmt);
         } else if (ret == -EFBIG) {
-            error_setg(errp, "The image size is too large for file format '%s'",
-                       fmt);
+            const char *cluster_size_hint = "";
+            if (get_option_parameter(create_options, BLOCK_OPT_CLUSTER_SIZE)) {
+                cluster_size_hint = " (try using a larger cluster size)";
+            }
+            error_setg(errp, "The image size is too large for file format '%s'%s",
+                       fmt, cluster_size_hint);
         } else {
             error_setg(errp, "%s: error while creating %s: %s", filename, fmt,
                        strerror(-ret));
commit 2cf7cfa1cde6672b8a35bbed3fbc989f28c05dce
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue May 14 16:14:33 2013 +0200

    qcow2: Catch some L1 table index overflows
    
    This catches the situation that is described in the bug report at
    https://bugs.launchpad.net/qemu/+bug/865518 and goes like this:
    
        $ qemu-img create -f qcow2 huge.qcow2 $((1024*1024))T
        Formatting 'huge.qcow2', fmt=qcow2 size=1152921504606846976 encryption=off cluster_size=65536 lazy_refcounts=off
        $ qemu-io /tmp/huge.qcow2 -c "write $((1024*1024*1024*1024*1024*1024 - 1024)) 512"
        Segmentation fault
    
    With this patch applied the segfault will be avoided, however the case
    will still fail, though gracefully:
    
        $ qemu-img create -f qcow2 /tmp/huge.qcow2 $((1024*1024))T
        Formatting 'huge.qcow2', fmt=qcow2 size=1152921504606846976 encryption=off cluster_size=65536 lazy_refcounts=off
        qemu-img: The image size is too large for file format 'qcow2'
    
    Note that even long before these overflow checks kick in, you get
    insanely high memory usage (up to INT_MAX * sizeof(uint64_t) = 16 GB for
    the L1 table), so with somewhat smaller image sizes you'll probably see
    qemu aborting for a failed g_malloc().
    
    If you need huge image sizes, you should increase the cluster size to
    the maximum of 2 MB in order to get higher limits.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index c71470a..76f30e5 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -29,12 +29,13 @@
 #include "block/qcow2.h"
 #include "trace.h"
 
-int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size)
+int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
+                        bool exact_size)
 {
     BDRVQcowState *s = bs->opaque;
-    int new_l1_size, new_l1_size2, ret, i;
+    int new_l1_size2, ret, i;
     uint64_t *new_l1_table;
-    int64_t new_l1_table_offset;
+    int64_t new_l1_table_offset, new_l1_size;
     uint8_t data[12];
 
     if (min_size <= s->l1_size)
@@ -53,8 +54,13 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size)
         }
     }
 
+    if (new_l1_size > INT_MAX) {
+        return -EFBIG;
+    }
+
 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
+    fprintf(stderr, "grow l1_table from %d to %" PRId64 "\n",
+            s->l1_size, new_l1_size);
 #endif
 
     new_l1_size2 = sizeof(uint64_t) * new_l1_size;
@@ -391,8 +397,8 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
     int *num, uint64_t *cluster_offset)
 {
     BDRVQcowState *s = bs->opaque;
-    unsigned int l1_index, l2_index;
-    uint64_t l2_offset, *l2_table;
+    unsigned int l2_index;
+    uint64_t l1_index, l2_offset, *l2_table;
     int l1_bits, c;
     unsigned int index_in_cluster, nb_clusters;
     uint64_t nb_available, nb_needed;
@@ -507,8 +513,8 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
                              int *new_l2_index)
 {
     BDRVQcowState *s = bs->opaque;
-    unsigned int l1_index, l2_index;
-    uint64_t l2_offset;
+    unsigned int l2_index;
+    uint64_t l1_index, l2_offset;
     uint64_t *l2_table = NULL;
     int ret;
 
@@ -522,6 +528,7 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
         }
     }
 
+    assert(l1_index < s->l1_size);
     l2_offset = s->l1_table[l1_index] & L1E_OFFSET_MASK;
 
     /* seek the l2 table of the given l2 offset */
diff --git a/block/qcow2.c b/block/qcow2.c
index 2e346d8..0fa5cb2 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -307,6 +307,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
     QemuOpts *opts;
     Error *local_err = NULL;
     uint64_t ext_end;
+    uint64_t l1_vm_state_index;
 
     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
     if (ret < 0) {
@@ -424,7 +425,14 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
 
     /* read the level 1 table */
     s->l1_size = header.l1_size;
-    s->l1_vm_state_index = size_to_l1(s, header.size);
+
+    l1_vm_state_index = size_to_l1(s, header.size);
+    if (l1_vm_state_index > INT_MAX) {
+        ret = -EFBIG;
+        goto fail;
+    }
+    s->l1_vm_state_index = l1_vm_state_index;
+
     /* the L1 table must contain at least enough entries to put
        header.size bytes */
     if (s->l1_size < s->l1_vm_state_index) {
@@ -1480,7 +1488,8 @@ static coroutine_fn int qcow2_co_discard(BlockDriverState *bs,
 static int qcow2_truncate(BlockDriverState *bs, int64_t offset)
 {
     BDRVQcowState *s = bs->opaque;
-    int ret, new_l1_size;
+    int64_t new_l1_size;
+    int ret;
 
     if (offset & 511) {
         error_report("The new size must be a multiple of 512");
diff --git a/block/qcow2.h b/block/qcow2.h
index 9421843..6959c6a 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -284,7 +284,7 @@ static inline int size_to_clusters(BDRVQcowState *s, int64_t size)
     return (size + (s->cluster_size - 1)) >> s->cluster_bits;
 }
 
-static inline int size_to_l1(BDRVQcowState *s, int64_t size)
+static inline int64_t size_to_l1(BDRVQcowState *s, int64_t size)
 {
     int shift = s->cluster_bits + s->l2_bits;
     return (size + (1ULL << shift) - 1) >> shift;
@@ -360,7 +360,8 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
                           BdrvCheckMode fix);
 
 /* qcow2-cluster.c functions */
-int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size);
+int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
+                        bool exact_size);
 void qcow2_l2_cache_reset(BlockDriverState *bs);
 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
 void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
commit e7a09b92b70786f9e8c5fbf787e0248c6ebbe707
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 13 16:19:56 2013 +0200

    osdep: introduce qemu_anon_ram_free to free qemu_anon_ram_alloc-ed memory
    
    We switched from qemu_memalign to mmap() but then we don't modify
    qemu_vfree() to do a munmap() over free().  Which we cannot do
    because qemu_vfree() frees memory allocated by qemu_{mem,block}align.
    
    Introduce a new function that does the munmap(), luckily the size is
    available in the RAMBlock.
    
    Reported-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Amos Kong <akong at redhat.com>
    Message-id: 1368454796-14989-3-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/exec.c b/exec.c
index 4934457..aec65c5 100644
--- a/exec.c
+++ b/exec.c
@@ -1156,21 +1156,17 @@ void qemu_ram_free(ram_addr_t addr)
                     munmap(block->host, block->length);
                     close(block->fd);
                 } else {
-                    qemu_vfree(block->host);
+                    qemu_anon_ram_free(block->host, block->length);
                 }
 #else
                 abort();
 #endif
             } else {
-#if defined(TARGET_S390X) && defined(CONFIG_KVM)
-                munmap(block->host, block->length);
-#else
                 if (xen_enabled()) {
                     xen_invalidate_map_cache_entry(block->host);
                 } else {
-                    qemu_vfree(block->host);
+                    qemu_anon_ram_free(block->host, block->length);
                 }
-#endif
             }
             g_free(block);
             break;
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 06c3588..57d7b1f 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -98,6 +98,7 @@ int qemu_daemon(int nochdir, int noclose);
 void *qemu_memalign(size_t alignment, size_t size);
 void *qemu_anon_ram_alloc(size_t size);
 void qemu_vfree(void *ptr);
+void qemu_anon_ram_free(void *ptr, size_t size);
 
 #define QEMU_MADV_INVALID -1
 
diff --git a/trace-events b/trace-events
index f1a8c3a..c03b9cb 100644
--- a/trace-events
+++ b/trace-events
@@ -34,6 +34,7 @@ g_free(void *ptr) "ptr %p"
 qemu_memalign(size_t alignment, size_t size, void *ptr) "alignment %zu size %zu ptr %p"
 qemu_anon_ram_alloc(size_t size, void *ptr) "size %zu ptr %p"
 qemu_vfree(void *ptr) "ptr %p"
+qemu_anon_ram_free(void *ptr, size_t size) "size %zu ptr %p"
 
 # hw/virtio.c
 virtqueue_fill(void *vq, const void *elem, unsigned int len, unsigned int idx) "vq %p elem %p len %u idx %u"
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 6acbbef..631a1de 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -135,6 +135,14 @@ void qemu_vfree(void *ptr)
     free(ptr);
 }
 
+void qemu_anon_ram_free(void *ptr, size_t size)
+{
+    trace_qemu_anon_ram_free(ptr, size);
+    if (ptr) {
+        munmap(ptr, size);
+    }
+}
+
 void qemu_set_block(int fd)
 {
     int f;
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 5b1fc20..df2ecbd 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -76,6 +76,14 @@ void qemu_vfree(void *ptr)
     }
 }
 
+void qemu_anon_ram_free(void *ptr, size_t size)
+{
+    trace_qemu_anon_ram_free(ptr, size);
+    if (ptr) {
+        VirtualFree(ptr, 0, MEM_RELEASE);
+    }
+}
+
 /* FIXME: add proper locking */
 struct tm *gmtime_r(const time_t *timep, struct tm *result)
 {
commit 6eebf958abf3f3f701116d4524ef88bb9fd6e341
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 13 16:19:55 2013 +0200

    osdep, kvm: rename low-level RAM allocation functions
    
    This is preparatory to the introduction of a separate freeing API.
    
    Reported-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Amos Kong <akong at redhat.com>
    Message-id: 1368454796-14989-2-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/HACKING b/HACKING
index 6654d33..e73ac79 100644
--- a/HACKING
+++ b/HACKING
@@ -78,16 +78,15 @@ avoided.
 Use of the malloc/free/realloc/calloc/valloc/memalign/posix_memalign
 APIs is not allowed in the QEMU codebase. Instead of these routines,
 use the GLib memory allocation routines g_malloc/g_malloc0/g_new/
-g_new0/g_realloc/g_free or QEMU's qemu_vmalloc/qemu_memalign/qemu_vfree
+g_new0/g_realloc/g_free or QEMU's qemu_memalign/qemu_blockalign/qemu_vfree
 APIs.
 
 Please note that g_malloc will exit on allocation failure, so there
 is no need to test for failure (as you would have to with malloc).
 Calling g_malloc with a zero size is valid and will return NULL.
 
-Memory allocated by qemu_vmalloc or qemu_memalign must be freed with
-qemu_vfree, since breaking this will cause problems on Win32 and user
-emulators.
+Memory allocated by qemu_memalign or qemu_blockalign must be freed with
+qemu_vfree, since breaking this will cause problems on Win32.
 
 4. String manipulation
 
diff --git a/exec.c b/exec.c
index 19725db..4934457 100644
--- a/exec.c
+++ b/exec.c
@@ -1062,7 +1062,7 @@ ram_addr_t qemu_ram_alloc_from_ptr(ram_addr_t size, void *host,
 #if defined (__linux__) && !defined(TARGET_S390X)
             new_block->host = file_ram_alloc(new_block, size, mem_path);
             if (!new_block->host) {
-                new_block->host = qemu_vmalloc(size);
+                new_block->host = qemu_anon_ram_alloc(size);
                 memory_try_enable_merging(new_block->host, size);
             }
 #else
@@ -1074,9 +1074,9 @@ ram_addr_t qemu_ram_alloc_from_ptr(ram_addr_t size, void *host,
                 xen_ram_alloc(new_block->offset, size, mr);
             } else if (kvm_enabled()) {
                 /* some s390/kvm configurations have special constraints */
-                new_block->host = kvm_vmalloc(size);
+                new_block->host = kvm_ram_alloc(size);
             } else {
-                new_block->host = qemu_vmalloc(size);
+                new_block->host = qemu_anon_ram_alloc(size);
             }
             memory_try_enable_merging(new_block->host, size);
         }
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 3bcd4ab..06c3588 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -96,7 +96,7 @@ typedef signed int              int_fast16_t;
 
 int qemu_daemon(int nochdir, int noclose);
 void *qemu_memalign(size_t alignment, size_t size);
-void *qemu_vmalloc(size_t size);
+void *qemu_anon_ram_alloc(size_t size);
 void qemu_vfree(void *ptr);
 
 #define QEMU_MADV_INVALID -1
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 9735c1d..08284ef 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -142,8 +142,8 @@ int kvm_init_vcpu(CPUState *cpu);
 int kvm_cpu_exec(CPUArchState *env);
 
 #if !defined(CONFIG_USER_ONLY)
-void *kvm_vmalloc(ram_addr_t size);
-void *kvm_arch_vmalloc(ram_addr_t size);
+void *kvm_ram_alloc(ram_addr_t size);
+void *kvm_arch_ram_alloc(ram_addr_t size);
 #endif
 
 void kvm_setup_guest_memory(void *start, size_t size);
diff --git a/kvm-all.c b/kvm-all.c
index 3a31602..8222729 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1790,17 +1790,17 @@ int kvm_has_intx_set_mask(void)
     return kvm_state->intx_set_mask;
 }
 
-void *kvm_vmalloc(ram_addr_t size)
+void *kvm_ram_alloc(ram_addr_t size)
 {
 #ifdef TARGET_S390X
     void *mem;
 
-    mem = kvm_arch_vmalloc(size);
+    mem = kvm_arch_ram_alloc(size);
     if (mem) {
         return mem;
     }
 #endif
-    return qemu_vmalloc(size);
+    return qemu_anon_ram_alloc(size);
 }
 
 void kvm_setup_guest_memory(void *start, size_t size)
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index a585392..862fb12 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -332,7 +332,7 @@ static void *legacy_s390_alloc(ram_addr_t size)
     return mem;
 }
 
-void *kvm_arch_vmalloc(ram_addr_t size)
+void *kvm_arch_ram_alloc(ram_addr_t size)
 {
     /* Can we use the standard allocation ? */
     if (kvm_check_extension(kvm_state, KVM_CAP_S390_GMAP) &&
diff --git a/trace-events b/trace-events
index 4413beb..f1a8c3a 100644
--- a/trace-events
+++ b/trace-events
@@ -32,7 +32,7 @@ g_free(void *ptr) "ptr %p"
 
 # osdep.c
 qemu_memalign(size_t alignment, size_t size, void *ptr) "alignment %zu size %zu ptr %p"
-qemu_vmalloc(size_t size, void *ptr) "size %zu ptr %p"
+qemu_anon_ram_alloc(size_t size, void *ptr) "size %zu ptr %p"
 qemu_vfree(void *ptr) "ptr %p"
 
 # hw/virtio.c
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 3efc763..6acbbef 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -101,7 +101,7 @@ void *qemu_memalign(size_t alignment, size_t size)
 }
 
 /* alloc shared memory pages */
-void *qemu_vmalloc(size_t size)
+void *qemu_anon_ram_alloc(size_t size)
 {
     size_t align = QEMU_VMALLOC_ALIGN;
     size_t total = size + align - getpagesize();
@@ -125,7 +125,7 @@ void *qemu_vmalloc(size_t size)
         munmap(ptr + size, total - size);
     }
 
-    trace_qemu_vmalloc(size, ptr);
+    trace_qemu_anon_ram_alloc(size, ptr);
     return ptr;
 }
 
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index dcfa0c2..5b1fc20 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -53,7 +53,7 @@ void *qemu_memalign(size_t alignment, size_t size)
     return ptr;
 }
 
-void *qemu_vmalloc(size_t size)
+void *qemu_anon_ram_alloc(size_t size)
 {
     void *ptr;
 
@@ -64,7 +64,7 @@ void *qemu_vmalloc(size_t size)
         abort();
     }
     ptr = qemu_oom_check(VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE));
-    trace_qemu_vmalloc(size, ptr);
+    trace_qemu_anon_ram_alloc(size, ptr);
     return ptr;
 }
 
commit d34dc45d34618aa2495e892caba62a4aa521b386
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue May 14 12:15:54 2013 +0200

    readline: Handle xterm escape sequences for Home/End keys
    
    This fixes the Home/End keys in the monitor using the GTK frontend.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1368526554-15866-1-git-send-email-kwolf at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/readline.c b/readline.c
index d6e04d4..1c0f7ee 100644
--- a/readline.c
+++ b/readline.c
@@ -27,6 +27,7 @@
 #define IS_NORM 0
 #define IS_ESC  1
 #define IS_CSI  2
+#define IS_SS3  3
 
 #undef printf
 #define printf do_not_use_printf
@@ -397,6 +398,9 @@ void readline_handle_byte(ReadLineState *rs, int ch)
         if (ch == '[') {
             rs->esc_state = IS_CSI;
             rs->esc_param = 0;
+        } else if (ch == 'O') {
+            rs->esc_state = IS_SS3;
+            rs->esc_param = 0;
         } else {
             rs->esc_state = IS_NORM;
         }
@@ -439,6 +443,17 @@ void readline_handle_byte(ReadLineState *rs, int ch)
         rs->esc_state = IS_NORM;
     the_end:
         break;
+    case IS_SS3:
+        switch(ch) {
+        case 'F':
+            readline_eol(rs);
+            break;
+        case 'H':
+            readline_bol(rs);
+            break;
+        }
+        rs->esc_state = IS_NORM;
+        break;
     }
     readline_update(rs);
 }
commit 7791dba3ec10ab7daa7cfecf84c617594c9776cc
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue May 14 14:05:21 2013 +0200

    portability: pty.h is glibc-specific
    
    This should fix building the GTK+ front-end on BSDs.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368533121-30796-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/qemu-common.h b/include/qemu-common.h
index b399d85..af769f5 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -42,6 +42,18 @@
 #include <signal.h>
 #include "glib-compat.h"
 
+#if defined(__GLIBC__)
+# include <pty.h>
+#elif defined CONFIG_BSD
+# if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
+#  include <libutil.h>
+# else
+#  include <util.h>
+# endif
+#elif defined CONFIG_SOLARIS
+# include <stropts.h>
+#endif
+
 #ifdef _WIN32
 #include "sysemu/os-win32.h"
 #endif
diff --git a/qemu-char.c b/qemu-char.c
index 64e824d..30a2ddf 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -53,13 +53,6 @@
 #include <sys/select.h>
 #ifdef CONFIG_BSD
 #include <sys/stat.h>
-#if defined(__GLIBC__)
-#include <pty.h>
-#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
-#include <libutil.h>
-#else
-#include <util.h>
-#endif
 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 #include <dev/ppbus/ppi.h>
 #include <dev/ppbus/ppbconf.h>
@@ -69,8 +62,6 @@
 #endif
 #else
 #ifdef __linux__
-#include <pty.h>
-
 #include <linux/ppdev.h>
 #include <linux/parport.h>
 #endif
@@ -87,7 +78,6 @@
 #include <netinet/tcp.h>
 #include <net/if.h>
 #include <syslog.h>
-#include <stropts.h>
 #endif
 #endif
 #endif
diff --git a/ui/gtk.c b/ui/gtk.c
index 841f912..52c3f95 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -55,7 +55,6 @@
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <sys/wait.h>
-#include <pty.h>
 #include <math.h>
 
 #include "ui/console.h"
commit d8e846e17cae31bfeee49d4da8a010fad3901cd9
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue May 14 14:12:25 2013 +0200

    spitz: fix compilation failure due to pty.h namespace pollution
    
    pty.h is polluting the global namespace with a CTRL macro.  spitz
    thus fails compilation with the patch at
    http://article.gmane.org/gmane.comp.emulators.qemu/211337 and
    this patch fixes it.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368533545-650-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index c42668a..b5ed109 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -277,9 +277,9 @@ static void spitz_keyboard_keydown(SpitzKeyboardState *s, int keycode)
     spitz_keyboard_sense_update(s);
 }
 
-#define SHIFT	(1 << 7)
-#define CTRL	(1 << 8)
-#define FN	(1 << 9)
+#define MOD_SHIFT   (1 << 7)
+#define MOD_CTRL    (1 << 8)
+#define MOD_FN      (1 << 9)
 
 #define QUEUE_KEY(c)	s->fifo[(s->fifopos + s->fifolen ++) & 0xf] = c
 
@@ -316,20 +316,20 @@ static void spitz_keyboard_handler(void *opaque, int keycode)
     }
 
     code = s->pre_map[mapcode = ((s->modifiers & 3) ?
-            (keycode | SHIFT) :
-            (keycode & ~SHIFT))];
+            (keycode | MOD_SHIFT) :
+            (keycode & ~MOD_SHIFT))];
 
     if (code != mapcode) {
 #if 0
-        if ((code & SHIFT) && !(s->modifiers & 1))
+        if ((code & MOD_SHIFT) && !(s->modifiers & 1))
             QUEUE_KEY(0x2a | (keycode & 0x80));
-        if ((code & CTRL ) && !(s->modifiers & 4))
+        if ((code & MOD_CTRL ) && !(s->modifiers & 4))
             QUEUE_KEY(0x1d | (keycode & 0x80));
-        if ((code & FN   ) && !(s->modifiers & 8))
+        if ((code & MOD_FN   ) && !(s->modifiers & 8))
             QUEUE_KEY(0x38 | (keycode & 0x80));
-        if ((code & FN   ) && (s->modifiers & 1))
+        if ((code & MOD_FN   ) && (s->modifiers & 1))
             QUEUE_KEY(0x2a | (~keycode & 0x80));
-        if ((code & FN   ) && (s->modifiers & 2))
+        if ((code & MOD_FN   ) && (s->modifiers & 2))
             QUEUE_KEY(0x36 | (~keycode & 0x80));
 #else
         if (keycode & 0x80) {
@@ -345,24 +345,24 @@ static void spitz_keyboard_handler(void *opaque, int keycode)
                 QUEUE_KEY(0x36);
             s->imodifiers = 0;
         } else {
-            if ((code & SHIFT) && !((s->modifiers | s->imodifiers) & 1)) {
+            if ((code & MOD_SHIFT) && !((s->modifiers | s->imodifiers) & 1)) {
                 QUEUE_KEY(0x2a);
                 s->imodifiers |= 1;
             }
-            if ((code & CTRL ) && !((s->modifiers | s->imodifiers) & 4)) {
+            if ((code & MOD_CTRL ) && !((s->modifiers | s->imodifiers) & 4)) {
                 QUEUE_KEY(0x1d);
                 s->imodifiers |= 4;
             }
-            if ((code & FN   ) && !((s->modifiers | s->imodifiers) & 8)) {
+            if ((code & MOD_FN   ) && !((s->modifiers | s->imodifiers) & 8)) {
                 QUEUE_KEY(0x38);
                 s->imodifiers |= 8;
             }
-            if ((code & FN   ) && (s->modifiers & 1) &&
+            if ((code & MOD_FN   ) && (s->modifiers & 1) &&
                             !(s->imodifiers & 0x10)) {
                 QUEUE_KEY(0x2a | 0x80);
                 s->imodifiers |= 0x10;
             }
-            if ((code & FN   ) && (s->modifiers & 2) &&
+            if ((code & MOD_FN   ) && (s->modifiers & 2) &&
                             !(s->imodifiers & 0x20)) {
                 QUEUE_KEY(0x36 | 0x80);
                 s->imodifiers |= 0x20;
@@ -394,38 +394,38 @@ static void spitz_keyboard_pre_map(SpitzKeyboardState *s)
     int i;
     for (i = 0; i < 0x100; i ++)
         s->pre_map[i] = i;
-    s->pre_map[0x02 | SHIFT	] = 0x02 | SHIFT;	/* exclam */
-    s->pre_map[0x28 | SHIFT	] = 0x03 | SHIFT;	/* quotedbl */
-    s->pre_map[0x04 | SHIFT	] = 0x04 | SHIFT;	/* numbersign */
-    s->pre_map[0x05 | SHIFT	] = 0x05 | SHIFT;	/* dollar */
-    s->pre_map[0x06 | SHIFT	] = 0x06 | SHIFT;	/* percent */
-    s->pre_map[0x08 | SHIFT	] = 0x07 | SHIFT;	/* ampersand */
-    s->pre_map[0x28		] = 0x08 | SHIFT;	/* apostrophe */
-    s->pre_map[0x0a | SHIFT	] = 0x09 | SHIFT;	/* parenleft */
-    s->pre_map[0x0b | SHIFT	] = 0x0a | SHIFT;	/* parenright */
-    s->pre_map[0x29 | SHIFT	] = 0x0b | SHIFT;	/* asciitilde */
-    s->pre_map[0x03 | SHIFT	] = 0x0c | SHIFT;	/* at */
-    s->pre_map[0xd3		] = 0x0e | FN;		/* Delete */
-    s->pre_map[0x3a		] = 0x0f | FN;		/* Caps_Lock */
-    s->pre_map[0x07 | SHIFT	] = 0x11 | FN;		/* asciicircum */
-    s->pre_map[0x0d		] = 0x12 | FN;		/* equal */
-    s->pre_map[0x0d | SHIFT	] = 0x13 | FN;		/* plus */
-    s->pre_map[0x1a		] = 0x14 | FN;		/* bracketleft */
-    s->pre_map[0x1b		] = 0x15 | FN;		/* bracketright */
-    s->pre_map[0x1a | SHIFT	] = 0x16 | FN;		/* braceleft */
-    s->pre_map[0x1b | SHIFT	] = 0x17 | FN;		/* braceright */
-    s->pre_map[0x27		] = 0x22 | FN;		/* semicolon */
-    s->pre_map[0x27 | SHIFT	] = 0x23 | FN;		/* colon */
-    s->pre_map[0x09 | SHIFT	] = 0x24 | FN;		/* asterisk */
-    s->pre_map[0x2b		] = 0x25 | FN;		/* backslash */
-    s->pre_map[0x2b | SHIFT	] = 0x26 | FN;		/* bar */
-    s->pre_map[0x0c | SHIFT	] = 0x30 | FN;		/* underscore */
-    s->pre_map[0x33 | SHIFT	] = 0x33 | FN;		/* less */
-    s->pre_map[0x35		] = 0x33 | SHIFT;	/* slash */
-    s->pre_map[0x34 | SHIFT	] = 0x34 | FN;		/* greater */
-    s->pre_map[0x35 | SHIFT	] = 0x34 | SHIFT;	/* question */
-    s->pre_map[0x49		] = 0x48 | FN;		/* Page_Up */
-    s->pre_map[0x51		] = 0x50 | FN;		/* Page_Down */
+    s->pre_map[0x02 | MOD_SHIFT	] = 0x02 | MOD_SHIFT;	/* exclam */
+    s->pre_map[0x28 | MOD_SHIFT	] = 0x03 | MOD_SHIFT;	/* quotedbl */
+    s->pre_map[0x04 | MOD_SHIFT	] = 0x04 | MOD_SHIFT;	/* numbersign */
+    s->pre_map[0x05 | MOD_SHIFT	] = 0x05 | MOD_SHIFT;	/* dollar */
+    s->pre_map[0x06 | MOD_SHIFT	] = 0x06 | MOD_SHIFT;	/* percent */
+    s->pre_map[0x08 | MOD_SHIFT	] = 0x07 | MOD_SHIFT;	/* ampersand */
+    s->pre_map[0x28		] = 0x08 | MOD_SHIFT;	/* apostrophe */
+    s->pre_map[0x0a | MOD_SHIFT	] = 0x09 | MOD_SHIFT;	/* parenleft */
+    s->pre_map[0x0b | MOD_SHIFT	] = 0x0a | MOD_SHIFT;	/* parenright */
+    s->pre_map[0x29 | MOD_SHIFT	] = 0x0b | MOD_SHIFT;	/* asciitilde */
+    s->pre_map[0x03 | MOD_SHIFT	] = 0x0c | MOD_SHIFT;	/* at */
+    s->pre_map[0xd3		] = 0x0e | MOD_FN;	/* Delete */
+    s->pre_map[0x3a		] = 0x0f | MOD_FN;	/* Caps_Lock */
+    s->pre_map[0x07 | MOD_SHIFT	] = 0x11 | MOD_FN;	/* asciicircum */
+    s->pre_map[0x0d		] = 0x12 | MOD_FN;	/* equal */
+    s->pre_map[0x0d | MOD_SHIFT	] = 0x13 | MOD_FN;	/* plus */
+    s->pre_map[0x1a		] = 0x14 | MOD_FN;	/* bracketleft */
+    s->pre_map[0x1b		] = 0x15 | MOD_FN;	/* bracketright */
+    s->pre_map[0x1a | MOD_SHIFT	] = 0x16 | MOD_FN;	/* braceleft */
+    s->pre_map[0x1b | MOD_SHIFT	] = 0x17 | MOD_FN;	/* braceright */
+    s->pre_map[0x27		] = 0x22 | MOD_FN;	/* semicolon */
+    s->pre_map[0x27 | MOD_SHIFT	] = 0x23 | MOD_FN;	/* colon */
+    s->pre_map[0x09 | MOD_SHIFT	] = 0x24 | MOD_FN;	/* asterisk */
+    s->pre_map[0x2b		] = 0x25 | MOD_FN;	/* backslash */
+    s->pre_map[0x2b | MOD_SHIFT	] = 0x26 | MOD_FN;	/* bar */
+    s->pre_map[0x0c | MOD_SHIFT	] = 0x30 | MOD_FN;	/* underscore */
+    s->pre_map[0x33 | MOD_SHIFT	] = 0x33 | MOD_FN;	/* less */
+    s->pre_map[0x35		] = 0x33 | MOD_SHIFT;	/* slash */
+    s->pre_map[0x34 | MOD_SHIFT	] = 0x34 | MOD_FN;	/* greater */
+    s->pre_map[0x35 | MOD_SHIFT	] = 0x34 | MOD_SHIFT;	/* question */
+    s->pre_map[0x49		] = 0x48 | MOD_FN;	/* Page_Up */
+    s->pre_map[0x51		] = 0x50 | MOD_FN;	/* Page_Down */
 
     s->modifiers = 0;
     s->imodifiers = 0;
@@ -433,9 +433,9 @@ static void spitz_keyboard_pre_map(SpitzKeyboardState *s)
     s->fifolen = 0;
 }
 
-#undef SHIFT
-#undef CTRL
-#undef FN
+#undef MOD_SHIFT
+#undef MOD_CTRL
+#undef MOD_FN
 
 static int spitz_keyboard_post_load(void *opaque, int version_id)
 {
commit 2d3b989529727ccace243b953a181fbae04a30d1
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Tue May 14 14:29:04 2013 +0200

    acpi: add dummy write function for acpi timer
    
    Otherwise the guest can crash qemu (NULL pointer dereference).
    
    https://bugzilla.redhat.com/show_bug.cgi?id=947691
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Message-id: 1368534544-11826-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 64b8718..42eeace 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -462,8 +462,15 @@ static uint64_t acpi_pm_tmr_read(void *opaque, hwaddr addr, unsigned width)
     return acpi_pm_tmr_get(opaque);
 }
 
+static void acpi_pm_tmr_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned width)
+{
+    /* nothing */
+}
+
 static const MemoryRegionOps acpi_pm_tmr_ops = {
     .read = acpi_pm_tmr_read,
+    .write = acpi_pm_tmr_write,
     .valid.min_access_size = 4,
     .valid.max_access_size = 4,
     .endianness = DEVICE_LITTLE_ENDIAN,
commit 035873283b3f7514ad77d409870ccfd5f9680d9e
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon May 13 15:22:24 2013 -0500

    qom: aggressively optimize qom casting
    
    This patch adds a small typename cache to ObjectClass.  This allows
    caching positive casts within each ObjectClass.  Benchmarking a
    PPC workload provided by Aurelien, this patch eliminates every
    single g_hash_table_lookup() happening during the benchmark (which
    was about 2 million per-second).
    
    With this patch applied, I get exactly the same performance (within
    the margin of error) as with --disable-qom-cast-debug.
    
    N.B. it's safe to cache typenames only from the _assert() macros
    because they are always called with string literals.
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/qom/object.h b/include/qom/object.h
index 63e2a40..23fc048 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -344,6 +344,8 @@ typedef void (ObjectUnparent)(Object *obj);
  */
 typedef void (ObjectFree)(void *obj);
 
+#define OBJECT_CLASS_CAST_CACHE 4
+
 /**
  * ObjectClass:
  *
@@ -356,6 +358,8 @@ struct ObjectClass
     Type type;
     GSList *interfaces;
 
+    const char *cast_cache[OBJECT_CLASS_CAST_CACHE];
+
     ObjectUnparent *unparent;
 };
 
diff --git a/qom/object.c b/qom/object.c
index f5f416b..ec88231 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -439,7 +439,16 @@ Object *object_dynamic_cast_assert(Object *obj, const char *typename,
                                      typename, file, line, func);
 
 #ifdef CONFIG_QOM_CAST_DEBUG
-    Object *inst = object_dynamic_cast(obj, typename);
+    int i;
+    Object *inst;
+
+    for (i = 0; i < OBJECT_CLASS_CAST_CACHE; i++) {
+        if (obj->class->cast_cache[i] == typename) {
+            goto out;
+        }
+    }
+
+    inst = object_dynamic_cast(obj, typename);
 
     if (!inst && obj) {
         fprintf(stderr, "%s:%d:%s: Object %p is not an instance of type %s\n",
@@ -448,6 +457,15 @@ Object *object_dynamic_cast_assert(Object *obj, const char *typename,
     }
 
     assert(obj == inst);
+
+    if (obj == inst) {
+        for (i = 1; i < OBJECT_CLASS_CAST_CACHE; i++) {
+            obj->class->cast_cache[i - 1] = obj->class->cast_cache[i];
+        }
+        obj->class->cast_cache[i - 1] = typename;
+    }
+
+out:
 #endif
     return obj;
 }
@@ -510,7 +528,16 @@ ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
     trace_object_class_dynamic_cast_assert(class ? class->type->name : "(null)",
                                            typename, file, line, func);
 
-#ifndef CONFIG_QOM_CAST_DEBUG
+#ifdef CONFIG_QOM_CAST_DEBUG
+    int i;
+
+    for (i = 0; i < OBJECT_CLASS_CAST_CACHE; i++) {
+        if (class->cast_cache[i] == typename) {
+            ret = class;
+            goto out;
+        }
+    }
+#else
     if (!class->interfaces) {
         return class;
     }
@@ -523,6 +550,15 @@ ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
         abort();
     }
 
+#ifdef CONFIG_QOM_CAST_DEBUG
+    if (ret == class) {
+        for (i = 1; i < OBJECT_CLASS_CAST_CACHE; i++) {
+            class->cast_cache[i - 1] = class->cast_cache[i];
+        }
+        class->cast_cache[i - 1] = typename;
+    }
+out:
+#endif
     return ret;
 }
 
commit b087143b4d010451208264b7c841436aafe1cbb1
Author: Igor Mitsyanko <i.mitsyanko at gmail.com>
Date:   Fri May 10 18:59:45 2013 +0400

    ui/gtk.c: do not use gdk_display_warp_pointer when GTK ver >3.0
    
    Commit 9697f5d2d38e5dd1e64e8e0d64436e6d44e7b1fe "gtk: custom cursor support"
    introduced unconditional usage of gdk_display_warp_pointer(). This function
    is marked as deprecated since GTK-3.0, and triggers warning (error with -Werror)
    during compilation.
    Conditionally change gdk_display_warp_pointer() method usage to gdk_device_warp
    usage, as suggested by compiler.
    
    Signed-off-by: Igor Mitsyanko <i.mitsyanko at gmail.com>
    Message-id: 1368197985-44608-1-git-send-email-i.mitsyanko at gmail.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ui/gtk.c b/ui/gtk.c
index e12f228..841f912 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -331,6 +331,24 @@ static void gd_refresh(DisplayChangeListener *dcl)
     graphic_hw_update(dcl->con);
 }
 
+#if GTK_CHECK_VERSION(3, 0, 0)
+static void gd_mouse_set(DisplayChangeListener *dcl,
+                         int x, int y, int visible)
+{
+    GtkDisplayState *s = container_of(dcl, GtkDisplayState, dcl);
+    GdkDisplay *dpy;
+    GdkDeviceManager *mgr;
+    gint x_root, y_root;
+
+    dpy = gtk_widget_get_display(s->drawing_area);
+    mgr = gdk_display_get_device_manager(dpy);
+    gdk_window_get_root_coords(gtk_widget_get_window(s->drawing_area),
+                               x, y, &x_root, &y_root);
+    gdk_device_warp(gdk_device_manager_get_client_pointer(mgr),
+                    gtk_widget_get_screen(s->drawing_area),
+                    x, y);
+}
+#else
 static void gd_mouse_set(DisplayChangeListener *dcl,
                          int x, int y, int visible)
 {
@@ -343,6 +361,7 @@ static void gd_mouse_set(DisplayChangeListener *dcl,
                              gtk_widget_get_screen(s->drawing_area),
                              x_root, y_root);
 }
+#endif
 
 static void gd_cursor_define(DisplayChangeListener *dcl,
                              QEMUCursor *c)
commit 9e1c2ec8fd8d9a9ee299ea86c5f6c986fe25e838
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri May 10 14:38:03 2013 +0200

    Revert "pc: Kill the "use flash device for BIOS unless KVM" misfeature"
    
    This reverts commit 9953f8822cc316eec9962f0a2858c3439a80adec.
    While Markus's analysis is entirely correct, there are 1.6 patches
    that fix the bug for real and without requiring machine type hacks.
    Let's think of the children who will have to read this code, and
    avoid a complicated mess of semantics that differ between <1.5,
    1.5, and >1.5.
    
    Conflicts:
    	hw/i386/pc_piix.c
    	hw/i386/pc_q35.c
    	include/hw/i386/pc.h
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Acked-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1368189483-7915-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/block/pc_sysfw.c b/hw/block/pc_sysfw.c
index aad8614..4f17668 100644
--- a/hw/block/pc_sysfw.c
+++ b/hw/block/pc_sysfw.c
@@ -209,7 +209,7 @@ void pc_system_firmware_init(MemoryRegion *rom_memory)
      * TODO This device exists only so that users can switch between
      * use of flash and ROM for the BIOS.  The ability to switch was
      * created because flash doesn't work with KVM.  Once it does, we
-     * should drop this device for new machine types.
+     * should drop this device.
      */
     sysfw_dev = (PcSysFwDevice*) qdev_create(NULL, "pc-sysfw");
 
@@ -226,9 +226,9 @@ void pc_system_firmware_init(MemoryRegion *rom_memory)
        Use old rom based firmware initialization for KVM. */
     /*
      * This is a Bad Idea, because it makes enabling/disabling KVM
-     * guest-visible.  Do it only in bug-compatibility mode.
+     * guest-visible.  Let's fix it for real in QEMU 1.6.
      */
-    if (pc_sysfw_flash_vs_rom_bug_compatible && kvm_enabled()) {
+    if (kvm_enabled()) {
         if (pflash_drv != NULL) {
             fprintf(stderr, "qemu: pflash cannot be used with kvm enabled\n");
             exit(1);
@@ -255,7 +255,7 @@ void pc_system_firmware_init(MemoryRegion *rom_memory)
 }
 
 static Property pcsysfw_properties[] = {
-    DEFINE_PROP_UINT8("rom_only", PcSysFwDevice, rom_only, 1),
+    DEFINE_PROP_UINT8("rom_only", PcSysFwDevice, rom_only, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index f7c80ad..43ab480 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -248,7 +248,6 @@ static void pc_init_pci(QEMUMachineInitArgs *args)
 
 static void pc_init_pci_1_4(QEMUMachineInitArgs *args)
 {
-    pc_sysfw_flash_vs_rom_bug_compatible = true;
     has_pvpanic = false;
     x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE);
     pc_init_pci(args);
@@ -257,7 +256,6 @@ static void pc_init_pci_1_4(QEMUMachineInitArgs *args)
 static void pc_init_pci_1_3(QEMUMachineInitArgs *args)
 {
     enable_compat_apic_id_mode();
-    pc_sysfw_flash_vs_rom_bug_compatible = true;
     has_pvpanic = false;
     pc_init_pci(args);
 }
@@ -267,7 +265,6 @@ static void pc_init_pci_1_2(QEMUMachineInitArgs *args)
 {
     disable_kvm_pv_eoi();
     enable_compat_apic_id_mode();
-    pc_sysfw_flash_vs_rom_bug_compatible = true;
     has_pvpanic = false;
     pc_init_pci(args);
 }
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 6825380..7888dfe 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -210,7 +210,6 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
 
 static void pc_q35_init_1_4(QEMUMachineInitArgs *args)
 {
-    pc_sysfw_flash_vs_rom_bug_compatible = true;
     has_pvpanic = false;
     x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE);
     pc_q35_init(args);
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 417afe4..2bd7090 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -169,7 +169,6 @@ static inline bool isa_ne2000_init(ISABus *bus, int base, int irq, NICInfo *nd)
 }
 
 /* pc_sysfw.c */
-extern bool pc_sysfw_flash_vs_rom_bug_compatible;
 void pc_system_firmware_init(MemoryRegion *rom_memory);
 
 /* pvpanic.c */
@@ -239,10 +238,6 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
             .property = "romfile",\
             .value    = "pxe-virtio.rom",\
         },{\
-            .driver   = "pc-sysfw",\
-            .property = "rom_only",\
-            .value    = stringify(0),\
-        },{\
             .driver   = "486-" TYPE_X86_CPU,\
             .property = "model",\
             .value    = stringify(0),\
commit 3556c233d931ad5ffa46a35cb25cfc057732ebb8
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri May 10 14:16:40 2013 +0200

    qom: allow turning cast debugging off
    
    Cast debugging can have a substantial cost (20% or more).  Instead of adding
    special-cased "fast casts" in the hot paths, we can just disable it in
    releases.  The tracing facilities we just added make it easier to analyze
    those problems that cast debugging would reveal.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368188203-3407-7-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/configure b/configure
index 9439f1c..cab6332 100755
--- a/configure
+++ b/configure
@@ -220,6 +220,7 @@ blobs="yes"
 pkgversion=""
 pie=""
 zero_malloc=""
+qom_cast_debug="yes"
 trace_backend="nop"
 trace_file="trace"
 spice=""
@@ -688,6 +689,10 @@ for opt do
   ;;
   --enable-sdl) sdl="yes"
   ;;
+  --disable-qom-cast-debug) qom_cast_debug="no"
+  ;;
+  --enable-qom-cast-debug) qom_cast_debug="yes"
+  ;;
   --disable-virtfs) virtfs="no"
   ;;
   --enable-virtfs) virtfs="yes"
@@ -3575,6 +3580,7 @@ echo "gcov enabled      $gcov"
 echo "TPM support       $tpm"
 echo "libssh2 support   $libssh2"
 echo "TPM passthrough   $tpm_passthrough"
+echo "QOM debugging     $qom_cast_debug"
 
 if test "$sdl_too_old" = "yes"; then
 echo "-> Your SDL version is too old - please upgrade to have SDL support"
@@ -3909,6 +3915,9 @@ echo "CONFIG_UNAME_RELEASE=\"$uname_release\"" >> $config_host_mak
 if test "$zero_malloc" = "yes" ; then
   echo "CONFIG_ZERO_MALLOC=y" >> $config_host_mak
 fi
+if test "$qom_cast_debug" = "yes" ; then
+  echo "CONFIG_QOM_CAST_DEBUG=y" >> $config_host_mak
+fi
 if test "$rbd" = "yes" ; then
   echo "CONFIG_RBD=y" >> $config_host_mak
 fi
diff --git a/include/qom/object.h b/include/qom/object.h
index 38f674f..63e2a40 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -615,8 +615,9 @@ Object *object_dynamic_cast(Object *obj, const char *typename);
  *
  * See object_dynamic_cast() for a description of the parameters of this
  * function.  The only difference in behavior is that this function asserts
- * instead of returning #NULL on failure.  This function is not meant to be
- * called directly, but only through the wrapper macro OBJECT_CHECK.
+ * instead of returning #NULL on failure if QOM cast debugging is enabled.
+ * This function is not meant to be called directly, but only through
+ * the wrapper macro OBJECT_CHECK.
  */
 Object *object_dynamic_cast_assert(Object *obj, const char *typename,
                                    const char *file, int line, const char *func);
@@ -666,9 +667,9 @@ Type type_register(const TypeInfo *info);
  *
  * See object_class_dynamic_cast() for a description of the parameters
  * of this function.  The only difference in behavior is that this function
- * asserts instead of returning #NULL on failure.  This function is not
- * meant to be called directly, but only through the wrapper macros
- * OBJECT_CLASS_CHECK and INTERFACE_CHECK.
+ * asserts instead of returning #NULL on failure if QOM cast debugging is
+ * enabled.  This function is not meant to be called directly, but only through
+ * the wrapper macros OBJECT_CLASS_CHECK and INTERFACE_CHECK.
  */
 ObjectClass *object_class_dynamic_cast_assert(ObjectClass *klass,
                                               const char *typename,
diff --git a/qom/object.c b/qom/object.c
index 1b9c5ce..f5f416b 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -435,12 +435,11 @@ Object *object_dynamic_cast(Object *obj, const char *typename)
 Object *object_dynamic_cast_assert(Object *obj, const char *typename,
                                    const char *file, int line, const char *func)
 {
-    Object *inst;
-
     trace_object_dynamic_cast_assert(obj ? obj->class->type->name : "(null)",
                                      typename, file, line, func);
 
-    inst = object_dynamic_cast(obj, typename);
+#ifdef CONFIG_QOM_CAST_DEBUG
+    Object *inst = object_dynamic_cast(obj, typename);
 
     if (!inst && obj) {
         fprintf(stderr, "%s:%d:%s: Object %p is not an instance of type %s\n",
@@ -448,7 +447,9 @@ Object *object_dynamic_cast_assert(Object *obj, const char *typename,
         abort();
     }
 
-    return inst;
+    assert(obj == inst);
+#endif
+    return obj;
 }
 
 ObjectClass *object_class_dynamic_cast(ObjectClass *class,
@@ -509,6 +510,12 @@ ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
     trace_object_class_dynamic_cast_assert(class ? class->type->name : "(null)",
                                            typename, file, line, func);
 
+#ifndef CONFIG_QOM_CAST_DEBUG
+    if (!class->interfaces) {
+        return class;
+    }
+#endif
+
     ret = object_class_dynamic_cast(class, typename);
     if (!ret && class) {
         fprintf(stderr, "%s:%d:%s: Object %p is not an instance of type %s\n",
commit fa131d94a5c00c6bbea39358d4bca7bf98f6c1f5
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri May 10 14:16:39 2013 +0200

    qom: trace asserting casts
    
    This provides a way to detect the cast that leads to a (reproducible)
    crash even when QOM cast debugging is disabled.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368188203-3407-6-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qom/object.c b/qom/object.c
index bca6219..1b9c5ce 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -16,6 +16,7 @@
 #include "qapi/string-input-visitor.h"
 #include "qapi/string-output-visitor.h"
 #include "qapi/qmp/qerror.h"
+#include "trace.h"
 
 /* TODO: replace QObject with a simpler visitor to avoid a dependency
  * of the QOM core on QObject?  */
@@ -436,6 +437,9 @@ Object *object_dynamic_cast_assert(Object *obj, const char *typename,
 {
     Object *inst;
 
+    trace_object_dynamic_cast_assert(obj ? obj->class->type->name : "(null)",
+                                     typename, file, line, func);
+
     inst = object_dynamic_cast(obj, typename);
 
     if (!inst && obj) {
@@ -500,8 +504,12 @@ ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
                                               const char *file, int line,
                                               const char *func)
 {
-    ObjectClass *ret = object_class_dynamic_cast(class, typename);
+    ObjectClass *ret;
+
+    trace_object_class_dynamic_cast_assert(class ? class->type->name : "(null)",
+                                           typename, file, line, func);
 
+    ret = object_class_dynamic_cast(class, typename);
     if (!ret && class) {
         fprintf(stderr, "%s:%d:%s: Object %p is not an instance of type %s\n",
                 file, line, func, class, typename);
diff --git a/trace-events b/trace-events
index 17d75ab..4413beb 100644
--- a/trace-events
+++ b/trace-events
@@ -1160,3 +1160,6 @@ kvm_vm_ioctl(int type, void *arg) "type %d, arg %p"
 kvm_vcpu_ioctl(int cpu_index, int type, void *arg) "cpu_index %d, type %d, arg %p"
 kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
 
+# qom/object.c
+object_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
+object_class_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
commit be17f18b8cd438be7f8f65000c0baecdd5b34634
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri May 10 14:16:38 2013 +0200

    qom: pass file/line/function to asserting casts
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368188203-3407-5-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/qom/object.h b/include/qom/object.h
index 41b7068..38f674f 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -476,7 +476,8 @@ struct TypeInfo
  * generated.
  */
 #define OBJECT_CHECK(type, obj, name) \
-    ((type *)object_dynamic_cast_assert(OBJECT(obj), (name)))
+    ((type *)object_dynamic_cast_assert(OBJECT(obj), (name), \
+                                        __FILE__, __LINE__, __func__))
 
 /**
  * OBJECT_CLASS_CHECK:
@@ -489,7 +490,8 @@ struct TypeInfo
  * specific class type.
  */
 #define OBJECT_CLASS_CHECK(class, obj, name) \
-    ((class *)object_class_dynamic_cast_assert(OBJECT_CLASS(obj), (name)))
+    ((class *)object_class_dynamic_cast_assert(OBJECT_CLASS(obj), (name), \
+                                               __FILE__, __LINE__, __func__))
 
 /**
  * OBJECT_GET_CLASS:
@@ -547,7 +549,8 @@ struct InterfaceClass
  * Returns: @obj casted to @interface if cast is valid, otherwise raise error.
  */
 #define INTERFACE_CHECK(interface, obj, name) \
-    ((interface *)object_dynamic_cast_assert(OBJECT((obj)), (name)))
+    ((interface *)object_dynamic_cast_assert(OBJECT((obj)), (name), \
+                                             __FILE__, __LINE__, __func__))
 
 /**
  * object_new:
@@ -615,7 +618,8 @@ Object *object_dynamic_cast(Object *obj, const char *typename);
  * instead of returning #NULL on failure.  This function is not meant to be
  * called directly, but only through the wrapper macro OBJECT_CHECK.
  */
-Object *object_dynamic_cast_assert(Object *obj, const char *typename);
+Object *object_dynamic_cast_assert(Object *obj, const char *typename,
+                                   const char *file, int line, const char *func);
 
 /**
  * object_get_class:
@@ -667,7 +671,9 @@ Type type_register(const TypeInfo *info);
  * OBJECT_CLASS_CHECK and INTERFACE_CHECK.
  */
 ObjectClass *object_class_dynamic_cast_assert(ObjectClass *klass,
-                                              const char *typename);
+                                              const char *typename,
+                                              const char *file, int line,
+                                              const char *func);
 
 /**
  * object_class_dynamic_cast:
diff --git a/qom/object.c b/qom/object.c
index 0aa0c07..bca6219 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -431,15 +431,16 @@ Object *object_dynamic_cast(Object *obj, const char *typename)
     return NULL;
 }
 
-Object *object_dynamic_cast_assert(Object *obj, const char *typename)
+Object *object_dynamic_cast_assert(Object *obj, const char *typename,
+                                   const char *file, int line, const char *func)
 {
     Object *inst;
 
     inst = object_dynamic_cast(obj, typename);
 
     if (!inst && obj) {
-        fprintf(stderr, "Object %p is not an instance of type %s\n",
-                obj, typename);
+        fprintf(stderr, "%s:%d:%s: Object %p is not an instance of type %s\n",
+                file, line, func, obj, typename);
         abort();
     }
 
@@ -495,13 +496,15 @@ ObjectClass *object_class_dynamic_cast(ObjectClass *class,
 }
 
 ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
-                                              const char *typename)
+                                              const char *typename,
+                                              const char *file, int line,
+                                              const char *func)
 {
     ObjectClass *ret = object_class_dynamic_cast(class, typename);
 
     if (!ret && class) {
-        fprintf(stderr, "Object %p is not an instance of type %s\n",
-                class, typename);
+        fprintf(stderr, "%s:%d:%s: Object %p is not an instance of type %s\n",
+                file, line, func, class, typename);
         abort();
     }
 
commit 793c96b5403233fd9935c94b2af6d557c297a088
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri May 10 14:16:37 2013 +0200

    qom: add a fast path to object_class_dynamic_cast
    
    For leaf classes, in many cases the callbacks will simply downcast
    the object back to the original class.  Add this fast path to
    object_class_dynamic_cast, object_dynamic_cast will inherit it.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368188203-3407-4-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qom/object.c b/qom/object.c
index 35f4694..0aa0c07 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -457,7 +457,12 @@ ObjectClass *object_class_dynamic_cast(ObjectClass *class,
         return NULL;
     }
 
+    /* A simple fast path that can trigger a lot for leaf classes.  */
     type = class->type;
+    if (type->name == typename) {
+        return class;
+    }
+
     target_type = type_get_by_name(typename);
     if (!target_type) {
         /* target class type unknown, so fail the cast */
commit bf0fda346694db1eddecff1d74ff9f4d5eba3461
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri May 10 14:16:36 2013 +0200

    qom: allow casting of a NULL class
    
    This mimics what we do in object_dynamic_cast_assert.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368188203-3407-3-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qom/object.c b/qom/object.c
index 75e6aac..35f4694 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -449,10 +449,16 @@ Object *object_dynamic_cast_assert(Object *obj, const char *typename)
 ObjectClass *object_class_dynamic_cast(ObjectClass *class,
                                        const char *typename)
 {
-    TypeImpl *target_type = type_get_by_name(typename);
-    TypeImpl *type = class->type;
     ObjectClass *ret = NULL;
+    TypeImpl *target_type;
+    TypeImpl *type;
 
+    if (!class) {
+        return NULL;
+    }
+
+    type = class->type;
+    target_type = type_get_by_name(typename);
     if (!target_type) {
         /* target class type unknown, so fail the cast */
         return NULL;
@@ -488,7 +494,7 @@ ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class,
 {
     ObjectClass *ret = object_class_dynamic_cast(class, typename);
 
-    if (!ret) {
+    if (!ret && class) {
         fprintf(stderr, "Object %p is not an instance of type %s\n",
                 class, typename);
         abort();
commit 33bc94eb209864b4aef7f341f0c2b7cd8740396f
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri May 10 14:16:35 2013 +0200

    qom: improve documentation of cast functions
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1368188203-3407-2-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/qom/object.h b/include/qom/object.h
index d0f99c5..41b7068 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -612,7 +612,8 @@ Object *object_dynamic_cast(Object *obj, const char *typename);
  *
  * See object_dynamic_cast() for a description of the parameters of this
  * function.  The only difference in behavior is that this function asserts
- * instead of returning #NULL on failure.
+ * instead of returning #NULL on failure.  This function is not meant to be
+ * called directly, but only through the wrapper macro OBJECT_CHECK.
  */
 Object *object_dynamic_cast_assert(Object *obj, const char *typename);
 
@@ -659,11 +660,29 @@ Type type_register(const TypeInfo *info);
  * @klass: The #ObjectClass to attempt to cast.
  * @typename: The QOM typename of the class to cast to.
  *
- * Returns: This function always returns @klass and asserts on failure.
+ * See object_class_dynamic_cast() for a description of the parameters
+ * of this function.  The only difference in behavior is that this function
+ * asserts instead of returning #NULL on failure.  This function is not
+ * meant to be called directly, but only through the wrapper macros
+ * OBJECT_CLASS_CHECK and INTERFACE_CHECK.
  */
 ObjectClass *object_class_dynamic_cast_assert(ObjectClass *klass,
                                               const char *typename);
 
+/**
+ * object_class_dynamic_cast:
+ * @klass: The #ObjectClass to attempt to cast.
+ * @typename: The QOM typename of the class to cast to.
+ *
+ * Returns: If @typename is a class, this function returns @klass if
+ * @typename is a subtype of @klass, else returns #NULL.
+ *
+ * If @typename is an interface, this function returns the interface
+ * definition for @klass if @klass implements it unambiguously; #NULL
+ * is returned if @klass does not implement the interface or if multiple
+ * classes or interfaces on the hierarchy leading to @klass implement
+ * it.  (FIXME: perhaps this can be detected at type definition time?)
+ */
 ObjectClass *object_class_dynamic_cast(ObjectClass *klass,
                                        const char *typename);
 
commit f6e136e47a6adc176cb53a24cf5a515ca09f977f
Merge: 879367e 98b2d19
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon May 13 09:44:25 2013 -0500

    Merge remote-tracking branch 'mjt/trivial-patches-next' into staging
    
    # By Dong Xu Wang (2) and others
    # Via Michael Tokarev
    * mjt/trivial-patches-next:
      osdep.h: include sys/types.h for ssize_t definition
      remove double semicolons
      clean unnecessary code: don't check g_strdup arg for NULL
      docs: mention AddressSpaces in docs/memory.txt
      audio: update documentation after removing --audio-card-list option
      m25p80.c: Sync Flash chip list with Linux
      bsd-user: OS-agnostic 64-bit SYSCTL types
    
    Message-id: 518F61B9.9050803 at msgid.tls.msk.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 879367efba1f2e9733ff76d03041324b5b76f645
Merge: 38ebb39 0a2b5e3
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon May 13 09:44:04 2013 -0500

    Merge remote-tracking branch 'spice/spice.v70' into staging
    
    # By Hans de Goede
    # Via Gerd Hoffmann
    * spice/spice.v70:
      qxl: Call spice_qxl_driver_unload from qxl_enter_vga_mode
    
    Message-id: 1368093776-8949-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 98b2d199c109c9eabebb70965db0ae24f3f75a79
Author: Igor Mitsyanko <i.mitsyanko at gmail.com>
Date:   Fri May 10 23:58:21 2013 +0400

    osdep.h: include sys/types.h for ssize_t definition
    
    sys/types.h is taken out from "ifdef __OpenBSD__" guard. It should be
    safe for other systems, according to following survey:
    http://hacks.owlfolio.org/header-survey/
    
    This fixes build for CONFIG_IOVEC-less systems (mingw).
    
    Signed-off-by: Igor Mitsyanko <i.mitsyanko at gmail.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 42545bc..3bcd4ab 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -5,8 +5,8 @@
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdbool.h>
-#ifdef __OpenBSD__
 #include <sys/types.h>
+#ifdef __OpenBSD__
 #include <sys/signal.h>
 #endif
 
commit c7e775e4dda91472ec538101c536ea8950fe1515
Author: Dong Xu Wang <wdongxu at linux.vnet.ibm.com>
Date:   Thu May 9 15:53:50 2013 +0800

    remove double semicolons
    
    Signed-off-by: Dong Xu Wang <wdongxu at linux.vnet.ibm.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/block/nbd.c b/block/nbd.c
index fab114b..30e3b78 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -609,7 +609,7 @@ static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,
         return 0;
     }
     request.type = NBD_CMD_TRIM;
-    request.from = sector_num * 512;;
+    request.from = sector_num * 512;
     request.len = nb_sectors * 512;
 
     nbd_coroutine_start(s, &request);
diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
index 36f6616..713a7b2 100644
--- a/fsdev/virtfs-proxy-helper.c
+++ b/fsdev/virtfs-proxy-helper.c
@@ -248,7 +248,7 @@ static int send_fd(int sockfd, int fd)
 static int send_status(int sockfd, struct iovec *iovec, int status)
 {
     ProxyHeader header;
-    int retval, msg_size;;
+    int retval, msg_size;
 
     if (status < 0) {
         header.type = T_ERROR;
@@ -381,7 +381,7 @@ static int send_response(int sock, struct iovec *iovec, int size)
     proxy_marshal(iovec, 0, "dd", header.type, header.size);
     retval = socket_write(sock, iovec->iov_base, header.size + PROXY_HDR_SZ);
     if (retval < 0) {
-        return retval;;
+        return retval;
     }
     return 0;
 }
diff --git a/hw/9pfs/virtio-9p-local.c b/hw/9pfs/virtio-9p-local.c
index be898ec..6ece6f7 100644
--- a/hw/9pfs/virtio-9p-local.c
+++ b/hw/9pfs/virtio-9p-local.c
@@ -878,7 +878,7 @@ static int local_remove(FsContext *ctx, const char *path)
          * Now remove the name from parent directory
          * .virtfs_metadata directory
          */
-        err = remove(local_mapped_attr_path(ctx, path, buffer));;
+        err = remove(local_mapped_attr_path(ctx, path, buffer));
         if (err < 0 && errno != ENOENT) {
             /*
              * We didn't had the .virtfs_metadata file. May be file created
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 4160e2b..6825380 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -128,7 +128,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     q35_host->mch.ram_memory = ram_memory;
     q35_host->mch.pci_address_space = pci_memory;
     q35_host->mch.system_memory = get_system_memory();
-    q35_host->mch.address_space_io = get_system_io();;
+    q35_host->mch.address_space_io = get_system_io();
     q35_host->mch.below_4g_mem_size = below_4g_mem_size;
     q35_host->mch.above_4g_mem_size = above_4g_mem_size;
     /* pci */
diff --git a/hw/intc/imx_avic.c b/hw/intc/imx_avic.c
index 4e280b6..ff45dcd 100644
--- a/hw/intc/imx_avic.c
+++ b/hw/intc/imx_avic.c
@@ -370,7 +370,7 @@ static void imx_avic_reset(DeviceState *dev)
 
 static int imx_avic_init(SysBusDevice *dev)
 {
-    IMXAVICState *s = FROM_SYSBUS(IMXAVICState, dev);;
+    IMXAVICState *s = FROM_SYSBUS(IMXAVICState, dev);
 
     memory_region_init_io(&s->iomem, &imx_avic_ops, s, "imx_avic", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index 8994668..ca09a89 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -651,7 +651,7 @@ static void usb_host_handle_reset(USBDevice *dev)
 
     trace_usb_host_reset(s->bus_num, s->addr);
 
-    usb_host_do_reset(s);;
+    usb_host_do_reset(s);
 
     usb_host_claim_interfaces(s, 0);
     usb_linux_update_endp_table(s);
@@ -1429,7 +1429,7 @@ static void usb_host_exit_notifier(struct Notifier *n, void *data)
 
     usb_host_release_port(s);
     if (s->fd != -1) {
-        usb_host_do_reset(s);;
+        usb_host_do_reset(s);
     }
 }
 
diff --git a/qga/channel-win32.c b/qga/channel-win32.c
index 7ed98d7..8a303f3 100644
--- a/qga/channel-win32.c
+++ b/qga/channel-win32.c
@@ -268,7 +268,7 @@ static GIOStatus ga_channel_write(GAChannel *c, const char *buf, size_t size,
 
 GIOStatus ga_channel_write_all(GAChannel *c, const char *buf, size_t size)
 {
-    GIOStatus status = G_IO_STATUS_NORMAL;;
+    GIOStatus status = G_IO_STATUS_NORMAL;
     size_t count;
 
     while (size) {
commit 7f303adc4f0aaa71b196d9f983150f3ec3367b46
Author: Dong Xu Wang <wdongxu at linux.vnet.ibm.com>
Date:   Thu May 9 15:53:49 2013 +0800

    clean unnecessary code: don't check g_strdup arg for NULL
    
    Signed-off-by: Dong Xu Wang <wdongxu at linux.vnet.ibm.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/uri.c b/util/uri.c
index 4238729..e348c17 100644
--- a/util/uri.c
+++ b/util/uri.c
@@ -2162,7 +2162,7 @@ query_params_append (struct QueryParams *ps,
     }
 
     ps->p[ps->n].name = g_strdup(name);
-    ps->p[ps->n].value = value ? g_strdup(value) : NULL;
+    ps->p[ps->n].value = g_strdup(value);
     ps->p[ps->n].ignore = 0;
     ps->n++;
 
diff --git a/vl.c b/vl.c
index 6e6225f..be0a93c 100644
--- a/vl.c
+++ b/vl.c
@@ -1215,7 +1215,7 @@ void add_boot_device_path(int32_t bootindex, DeviceState *dev,
 
     node = g_malloc0(sizeof(FWBootEntry));
     node->bootindex = bootindex;
-    node->suffix = suffix ? g_strdup(suffix) : NULL;
+    node->suffix = g_strdup(suffix);
     node->dev = dev;
 
     QTAILQ_FOREACH(i, &fw_boot_order, link) {
commit 2d40178a33293603a06fdf3c0fd9988322bc5fda
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon May 6 18:23:38 2013 +0200

    docs: mention AddressSpaces in docs/memory.txt
    
    Reported-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/docs/memory.txt b/docs/memory.txt
index 5bbee8e..feb9fe9 100644
--- a/docs/memory.txt
+++ b/docs/memory.txt
@@ -15,10 +15,13 @@ The memory model provides support for
  - setting up coalesced memory for kvm
  - setting up ioeventfd regions for kvm
 
-Memory is modelled as a tree (really acyclic graph) of MemoryRegion objects.
-The root of the tree is memory as seen from the CPU's viewpoint (the system
-bus).  Nodes in the tree represent other buses, memory controllers, and
-memory regions that have been rerouted.  Leaves are RAM and MMIO regions.
+Memory is modelled as an acyclic graph of MemoryRegion objects.  Sinks
+(leaves) are RAM and MMIO regions, while other nodes represent
+buses, memory controllers, and memory regions that have been rerouted.
+
+In addition to MemoryRegion objects, the memory API provides AddressSpace
+objects for every root and possibly for intermediate MemoryRegions too.
+These represent memory as seen from the CPU or a device's viewpoint.
 
 Types of regions
 ----------------
commit 59d827629360097caa9a4f160680affde84cb4c8
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Sat May 4 16:17:37 2013 +0200

    audio: update documentation after removing --audio-card-list option
    
    Commit 98af93fde2e37b5b0c8cee9036e028fe6df6446c removed the
    --audio-card-list option in configure, and commit
    8f3b664f6cc4153cc73941c941d54c4e499b7537 always compiled in
    the adlib, gus and cs4231a audio cards.
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-doc.texi b/qemu-doc.texi
index 64493eb..5fc0eae 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -214,10 +214,6 @@ PCI UHCI USB controller and a virtual USB hub.
 
 SMP is supported with up to 255 CPUs.
 
-Note that adlib, gus and cs4231a are only available when QEMU was
-configured with --audio-card-list option containing the name(s) of
-required card(s).
-
 QEMU uses the PC BIOS from the Bochs project and the Plex86/Bochs LGPL
 VGA BIOS.
 
commit 3e758c1df05bcd305cb761beddeb078b67c3ab88
Author: Ed Maste <emaste at freebsd.org>
Date:   Wed May 1 10:40:53 2013 -0400

    m25p80.c: Sync Flash chip list with Linux
    
    Add new devices for various manufacturers, and re-sort Spansion list to
    match the order in Linux, which requires chips with a non-zero extended ID
    to come first.
    
    With this commit the outstanding differences to Linux rev 55bf75b are:
    
    - Erase size flag differences in s25sl032p, s25sl064p, s25fl016k, s25fl064k
      (These devices have only some blocks that support small erase sizes.)
    - Linux lacks n25q128
    - Devices without a Jedec ID have been excluded
    
    Signed-off-by: Ed Maste <emaste at freebsd.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index b3ca19a..759c84d 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -91,18 +91,27 @@ static const FlashPartInfo known_devices[] = {
     { INFO("at26df161a",  0x1f4601,      0,  64 << 10,  32, ER_4K) },
     { INFO("at26df321",   0x1f4700,      0,  64 << 10,  64, ER_4K) },
 
+    { INFO("at45db081d",  0x1f2500,      0,  64 << 10,  16, ER_4K) },
+
     /* EON -- en25xxx */
     { INFO("en25f32",     0x1c3116,      0,  64 << 10,  64, ER_4K) },
     { INFO("en25p32",     0x1c2016,      0,  64 << 10,  64, 0) },
     { INFO("en25q32b",    0x1c3016,      0,  64 << 10,  64, 0) },
     { INFO("en25p64",     0x1c2017,      0,  64 << 10, 128, 0) },
+    { INFO("en25q64",     0x1c3017,      0,  64 << 10, 128, ER_4K) },
+
+    /* GigaDevice */
+    { INFO("gd25q32",     0xc84016,      0,  64 << 10,  64, ER_4K) },
+    { INFO("gd25q64",     0xc84017,      0,  64 << 10, 128, ER_4K) },
 
     /* Intel/Numonyx -- xxxs33b */
     { INFO("160s33b",     0x898911,      0,  64 << 10,  32, 0) },
     { INFO("320s33b",     0x898912,      0,  64 << 10,  64, 0) },
     { INFO("640s33b",     0x898913,      0,  64 << 10, 128, 0) },
+    { INFO("n25q064",     0x20ba17,      0,  64 << 10, 128, 0) },
 
     /* Macronix */
+    { INFO("mx25l2005a",  0xc22012,      0,  64 << 10,   4, ER_4K) },
     { INFO("mx25l4005a",  0xc22013,      0,  64 << 10,   8, ER_4K) },
     { INFO("mx25l8005",   0xc22014,      0,  64 << 10,  16, 0) },
     { INFO("mx25l1606e",  0xc22015,      0,  64 << 10,  32, ER_4K) },
@@ -113,15 +122,16 @@ static const FlashPartInfo known_devices[] = {
     { INFO("mx25l25635e", 0xc22019,      0,  64 << 10, 512, 0) },
     { INFO("mx25l25655e", 0xc22619,      0,  64 << 10, 512, 0) },
 
+    /* Micron */
+    { INFO("n25q128a11",  0x20bb18,      0,  64 << 10, 256, 0) },
+    { INFO("n25q128a13",  0x20ba18,      0,  64 << 10, 256, 0) },
+    { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512, ER_4K) },
+
     /* Spansion -- single (large) sector size only, at least
      * for the chips listed here (without boot sectors).
      */
-    { INFO("s25sl004a",   0x010212,      0,  64 << 10,   8, 0) },
-    { INFO("s25sl008a",   0x010213,      0,  64 << 10,  16, 0) },
-    { INFO("s25sl016a",   0x010214,      0,  64 << 10,  32, 0) },
-    { INFO("s25sl032a",   0x010215,      0,  64 << 10,  64, 0) },
     { INFO("s25sl032p",   0x010215, 0x4d00,  64 << 10,  64, ER_4K) },
-    { INFO("s25sl064a",   0x010216,      0,  64 << 10, 128, 0) },
+    { INFO("s25sl064p",   0x010216, 0x4d00,  64 << 10, 128, ER_4K) },
     { INFO("s25fl256s0",  0x010219, 0x4d00, 256 << 10, 128, 0) },
     { INFO("s25fl256s1",  0x010219, 0x4d01,  64 << 10, 512, 0) },
     { INFO("s25fl512s",   0x010220, 0x4d00, 256 << 10, 256, 0) },
@@ -130,6 +140,11 @@ static const FlashPartInfo known_devices[] = {
     { INFO("s25sl12801",  0x012018, 0x0301,  64 << 10, 256, 0) },
     { INFO("s25fl129p0",  0x012018, 0x4d00, 256 << 10,  64, 0) },
     { INFO("s25fl129p1",  0x012018, 0x4d01,  64 << 10, 256, 0) },
+    { INFO("s25sl004a",   0x010212,      0,  64 << 10,   8, 0) },
+    { INFO("s25sl008a",   0x010213,      0,  64 << 10,  16, 0) },
+    { INFO("s25sl016a",   0x010214,      0,  64 << 10,  32, 0) },
+    { INFO("s25sl032a",   0x010215,      0,  64 << 10,  64, 0) },
+    { INFO("s25sl064a",   0x010216,      0,  64 << 10, 128, 0) },
     { INFO("s25fl016k",   0xef4015,      0,  64 << 10,  32, ER_4K | ER_32K) },
     { INFO("s25fl064k",   0xef4017,      0,  64 << 10, 128, ER_4K | ER_32K) },
 
@@ -153,11 +168,13 @@ static const FlashPartInfo known_devices[] = {
     { INFO("m25p32",      0x202016,      0,  64 << 10,  64, 0) },
     { INFO("m25p64",      0x202017,      0,  64 << 10, 128, 0) },
     { INFO("m25p128",     0x202018,      0, 256 << 10,  64, 0) },
+    { INFO("n25q032",     0x20ba16,      0,  64 << 10,  64, 0) },
 
     { INFO("m45pe10",     0x204011,      0,  64 << 10,   2, 0) },
     { INFO("m45pe80",     0x204014,      0,  64 << 10,  16, 0) },
     { INFO("m45pe16",     0x204015,      0,  64 << 10,  32, 0) },
 
+    { INFO("m25pe20",     0x208012,      0,  64 << 10,   4, 0) },
     { INFO("m25pe80",     0x208014,      0,  64 << 10,  16, 0) },
     { INFO("m25pe16",     0x208015,      0,  64 << 10,  32, ER_4K) },
 
@@ -174,8 +191,12 @@ static const FlashPartInfo known_devices[] = {
     { INFO("w25x16",      0xef3015,      0,  64 << 10,  32, ER_4K) },
     { INFO("w25x32",      0xef3016,      0,  64 << 10,  64, ER_4K) },
     { INFO("w25q32",      0xef4016,      0,  64 << 10,  64, ER_4K) },
+    { INFO("w25q32dw",    0xef6016,      0,  64 << 10,  64, ER_4K) },
     { INFO("w25x64",      0xef3017,      0,  64 << 10, 128, ER_4K) },
     { INFO("w25q64",      0xef4017,      0,  64 << 10, 128, ER_4K) },
+    { INFO("w25q80",      0xef5014,      0,  64 << 10,  16, ER_4K) },
+    { INFO("w25q80bl",    0xef4014,      0,  64 << 10,  16, ER_4K) },
+    { INFO("w25q256",     0xef4019,      0,  64 << 10, 512, ER_4K) },
 
     /* Numonyx -- n25q128 */
     { INFO("n25q128",      0x20ba18,      0,  64 << 10, 256, 0) },
commit e6a3ee5f7981e7df40aa581ebc245fd0a7d3bed0
Author: Ed Maste <emaste at freebsd.org>
Date:   Tue Apr 30 09:29:32 2013 -0400

    bsd-user: OS-agnostic 64-bit SYSCTL types
    
    Use existence of type as #ifdef condition rather than FreeBSD-specific
    version check, as suggested by Patrick Welche.
    
    Also handle the signed (CTLTYPE_S64) case identically to the unsigned
    (CTLTYPE_U64) case, per later patches in the FreeBSD ports tree
    (emulators/qemu-devel/files/patch-z-arm-bsd-user-001).
    
    Signed-off-by: Ed Maste <emaste at freebsd.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/bsd-user/syscall.c b/bsd-user/syscall.c
index 69e3466..a4d1583 100644
--- a/bsd-user/syscall.c
+++ b/bsd-user/syscall.c
@@ -211,10 +211,11 @@ static int sysctl_oldcvt(void *holdp, size_t holdlen, uint32_t kind)
         *(uint64_t *)holdp = tswap64(*(unsigned long *)holdp);
         break;
 #endif
-#if !defined(__FreeBSD_version) || __FreeBSD_version < 900031
-    case CTLTYPE_QUAD:
-#else
+#ifdef CTLTYPE_U64
+    case CTLTYPE_S64:
     case CTLTYPE_U64:
+#else
+    case CTLTYPE_QUAD:
 #endif
         *(uint64_t *)holdp = tswap64(*(uint64_t *)holdp);
         break;
commit 38ebb396c955ceb2ef7e246248ceb7f8bfe1b774
Author: Aurelien Jarno <aurelien at aurel32.net>
Date:   Thu May 9 19:36:41 2013 +0200

    target-i386: ROR r8/r16 imm instruction fix
    
    Fix EFLAGS corruption by ROR r8/r16 imm instruction located at the end
    of the TB, similarly to commit 089305ac for the non-immediate case.
    
    Reported-by: Hervé Poussineau <hpoussin at reactos.org>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-i386/translate.c b/target-i386/translate.c
index 524a0b4..0aeccdb 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -1871,6 +1871,7 @@ static void gen_rot_rm_im(DisasContext *s, int ot, int op1, int op2,
         if (is_right) {
             tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask - 1);
             tcg_gen_shri_tl(cpu_cc_dst, cpu_T[0], mask);
+            tcg_gen_andi_tl(cpu_cc_dst, cpu_cc_dst, 1);
         } else {
             tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask);
             tcg_gen_andi_tl(cpu_cc_dst, cpu_T[0], 1);
commit 66e61b55f158ef5628e4c056dd2f233c9351a3f5
Author: Aurelien Jarno <aurelien at aurel32.net>
Date:   Wed May 8 22:36:39 2013 +0200

    tcg/optimize: fix setcond2 optimization
    
    When setcond2 is rewritten into setcond, the state of the destination
    temp should be reset, so that a copy of the previous value is not
    used instead of the result.
    
    Reported-by: Michael Tokarev <mjt at tls.msk.ru>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 1b6644c..b35868a 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1057,6 +1057,7 @@ static TCGArg *tcg_constant_folding(TCGContext *s, uint16_t *tcg_opc_ptr,
                 /* Simplify LT/GE comparisons vs zero to a single compare
                    vs the high word of the input.  */
                 s->gen_opc_buf[op_index] = INDEX_op_setcond_i32;
+                reset_temp(args[0]);
                 gen_args[0] = args[0];
                 gen_args[1] = args[2];
                 gen_args[2] = args[4];
commit 0a2b5e3a7899b40d05d7c6c1c41eb4e64dd2ed4b
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Tue Apr 23 10:18:16 2013 +0200

    qxl: Call spice_qxl_driver_unload from qxl_enter_vga_mode
    
    With a SPICE_DISPLAY_CAP_MONITORS_CONFIG capable client, the client needs to
    know what part of the primary to use for each monitor. If the guest driver
    does not support this, the server sends messages to the client for a
    single monitor spanning the entire primary.
    
    As soon as the guest calls spice_qxl_monitors_config_async once, the server
    sets the red_worker driver_has_monitors_config flag and stops doing this.
    
    This is a problem when the driver gets unloaded, for example after a reboot
    or when switching to a text vc with usermode mode-setting under Linux.
    
    To reproduce this start a multi-mon capable Linux guest which uses
    usermode mode-setting and then once X has started switch to a text vc. Note
    how the client window does not only not resize, if you try to resize it
    manually you always keep blackborders since the aspect is wrong.
    
    This patch calls a new spice-server method called spice_qxl_driver_unload
    which clears the driver_has_monitors_config flag inside the server, thereby
    fixing this.
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 2d49e9a..c475cb1 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1077,6 +1077,9 @@ static void qxl_enter_vga_mode(PCIQXLDevice *d)
         return;
     }
     trace_qxl_enter_vga_mode(d->id);
+#if SPICE_SERVER_VERSION >= 0x000c03 /* release 0.12.3 */
+    spice_qxl_driver_unload(&d->ssd.qxl);
+#endif
     qemu_spice_create_host_primary(&d->ssd);
     d->mode = QXL_MODE_VGA;
     vga_dirty_log_start(&d->vga);


More information about the Spice-commits mailing list