[Spice-commits] 74 commits - CODING_STYLE block/gluster.c block/mirror.c block/qcow.c block/sheepdog.c block/vdi.c block/vhdx-log.c configure hw/arm hw/i386 hw/ide hw/intc hw/misc hw/net hw/pci hw/pci-host hw/ppc hw/scsi hw/timer hw/usb include/qemu-common.h include/qom kvm-all.c linux-user/elfload.c linux-user/signal.c migration.c net/netmap.c qapi-schema.json qemu-doc.texi qemu-file.c qemu-img.c qemu-options.hx qmp-commands.hx savevm.c scripts/make-release slirp/tftp.c target-arm/machine.c target-i386/cpu.c target-i386/cpu.h target-i386/helper.c target-i386/kvm.c target-mips/cpu.h target-mips/helper.c target-mips/op_helper.c target-mips/translate.c target-mips/translate_init.c target-ppc/translate_init.c target-s390x/arch_dump.c target-sparc/helper.c tcg/arm tests/acpi-test-data tests/libqos trace-events trace/simple.c ui/gtk.c util/cutils.c util/module.c util/osdep.c util/qemu-thread-posix.c util/qemu-thread-win32.c vl.c vmstate.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Tue Apr 1 02:09:49 PDT 2014


 CODING_STYLE                  |    7 
 block/gluster.c               |    2 
 block/mirror.c                |   37 ++--
 block/qcow.c                  |    2 
 block/sheepdog.c              |    8 -
 block/vdi.c                   |    2 
 block/vhdx-log.c              |    2 
 configure                     |  100 ++++++++++--
 hw/arm/integratorcp.c         |    1 
 hw/i386/acpi-build.c          |   22 ++
 hw/ide/pci.c                  |    2 
 hw/intc/apic.c                |    6 
 hw/intc/openpic.c             |   14 -
 hw/intc/openpic_kvm.c         |    2 
 hw/intc/slavio_intctl.c       |    2 
 hw/intc/xilinx_intc.c         |    3 
 hw/misc/vfio.c                |   33 +---
 hw/net/virtio-net.c           |   48 ++++--
 hw/pci-host/apb.c             |   10 -
 hw/pci/pci.c                  |    4 
 hw/pci/pci_host.c             |    3 
 hw/ppc/ppc.c                  |    2 
 hw/ppc/ppc440_bamboo.c        |    4 
 hw/ppc/ppc4xx_devs.c          |    2 
 hw/ppc/ppc_booke.c            |   24 +--
 hw/ppc/virtex_ml507.c         |    4 
 hw/scsi/spapr_vscsi.c         |    2 
 hw/scsi/vmw_pvscsi.c          |    3 
 hw/timer/grlib_gptimer.c      |    1 
 hw/timer/hpet.c               |    3 
 hw/usb/hcd-ohci.c             |   32 ++--
 include/qemu-common.h         |    2 
 include/qom/cpu.h             |    7 
 kvm-all.c                     |    2 
 linux-user/elfload.c          |    2 
 linux-user/signal.c           |    2 
 migration.c                   |   30 ---
 net/netmap.c                  |    4 
 qapi-schema.json              |    3 
 qemu-doc.texi                 |   11 -
 qemu-file.c                   |    2 
 qemu-img.c                    |    2 
 qemu-options.hx               |   10 +
 qmp-commands.hx               |    2 
 savevm.c                      |    8 +
 scripts/make-release          |    1 
 slirp/tftp.c                  |    2 
 target-arm/machine.c          |    2 
 target-i386/cpu.c             |    2 
 target-i386/cpu.h             |  334 +++++++++++++++++++++---------------------
 target-i386/helper.c          |   11 +
 target-i386/kvm.c             |    2 
 target-mips/cpu.h             |    2 
 target-mips/helper.c          |    8 -
 target-mips/op_helper.c       |    2 
 target-mips/translate.c       |   79 +++++----
 target-mips/translate_init.c  |   22 +-
 target-ppc/translate_init.c   |    8 -
 target-s390x/arch_dump.c      |    6 
 target-sparc/helper.c         |   17 +-
 tcg/arm/tcg-target.c          |   21 ++
 tests/acpi-test-data/pc/SSDT  |binary
 tests/acpi-test-data/q35/SSDT |binary
 tests/libqos/pci-pc.c         |   12 -
 trace-events                  |   18 ++
 trace/simple.c                |    9 -
 ui/gtk.c                      |   17 ++
 util/cutils.c                 |   14 +
 util/module.c                 |    2 
 util/osdep.c                  |   18 ++
 util/qemu-thread-posix.c      |   21 ++
 util/qemu-thread-win32.c      |    2 
 vl.c                          |   11 -
 vmstate.c                     |    2 
 74 files changed, 671 insertions(+), 448 deletions(-)

New commits:
commit 63678e17cf399ff81b93417fe7bee8d6ef6b6b1b
Author: Steven Noonan <steven at uplinklabs.net>
Date:   Fri Mar 28 17:19:02 2014 +0100

    configure: add option to disable -fstack-protector flags
    
    The -fstack-protector flag family is useful for ensuring safety and for
    debugging, but has a performance impact. Here are some boot time comparisons of
    the various versions of -fstack-protector using qemu-system-arm on an x86_64
    host:
    
        # -fstack-protector-all
        Startup finished in 1.810s (kernel) + 12.331s (initrd) + 49.016s (userspace) = 1min 3.159s
        Startup finished in 1.801s (kernel) + 12.287s (initrd) + 47.925s (userspace) = 1min 2.013s
        Startup finished in 1.812s (kernel) + 12.302s (initrd) + 47.995s (userspace) = 1min 2.111s
    
        # -fstack-protector-strong
        Startup finished in 1.744s (kernel) + 11.223s (initrd) + 44.688s (userspace) = 57.657s
        Startup finished in 1.721s (kernel) + 11.222s (initrd) + 44.194s (userspace) = 57.138s
        Startup finished in 1.693s (kernel) + 11.250s (initrd) + 44.426s (userspace) = 57.370s
    
        # -fstack-protector
        Startup finished in 1.705s (kernel) + 11.409s (initrd) + 43.563s (userspace) = 56.677s
        Startup finished in 1.877s (kernel) + 11.137s (initrd) + 43.719s (userspace) = 56.734s
        Startup finished in 1.708s (kernel) + 11.141s (initrd) + 43.628s (userspace) = 56.478s
    
        # no stack protector
        Startup finished in 1.743s (kernel) + 11.190s (initrd) + 43.709s (userspace) = 56.643s
        Startup finished in 1.763s (kernel) + 11.216s (initrd) + 43.767s (userspace) = 56.747s
        Startup finished in 1.711s (kernel) + 11.283s (initrd) + 43.878s (userspace) = 56.873s
    
    This patch introduces a configure option to disable the stack protector
    entirely, and conditional stack protector flag selection (in order,
    based on availability): -fstack-protector-strong, -fstack-protector-all,
    no stack protector.
    
    Signed-off-by: Steven Noonan <snoonan at amazon.com>
    Cc: Anthony Liguori <aliguori at amazon.com>
    Reviewed-by: Stefan Weil <sw at weilnetz.de>
    [Prefer -fstack-protector-all to -fstack-protector, suggested by
     Laurent Desnogues. - Paolo]
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/configure b/configure
index fb3bd05..eb0e7bb 100755
--- a/configure
+++ b/configure
@@ -198,6 +198,7 @@ audio_win_int=""
 cc_i386=i386-pc-linux-gnu-gcc
 libs_qga=""
 debug_info="yes"
+stack_protector=""
 
 # Don't accept a target_list environment variable.
 unset target_list
@@ -950,6 +951,10 @@ for opt do
   ;;
   --disable-werror) werror="no"
   ;;
+  --enable-stack-protector) stack_protector="yes"
+  ;;
+  --disable-stack-protector) stack_protector="no"
+  ;;
   --disable-curses) curses="no"
   ;;
   --enable-curses) curses="yes"
@@ -1219,6 +1224,7 @@ Advanced options (experts only):
   --disable-sparse         disable sparse checker (default)
   --disable-strip          disable stripping binaries
   --disable-werror         disable compilation abort on warning
+  --disable-stack-protector disable compiler-provided stack protection
   --disable-sdl            disable SDL
   --enable-sdl             enable SDL
   --with-sdlabi            select preferred SDL ABI 1.2 or 2.0
@@ -1439,9 +1445,15 @@ for flag in $gcc_flags; do
     fi
 done
 
-if compile_prog "-Werror -fstack-protector-all" "" ; then
-    QEMU_CFLAGS="$QEMU_CFLAGS -fstack-protector-all"
-    LIBTOOLFLAGS="$LIBTOOLFLAGS -Wc,-fstack-protector-all"
+if test "$stack_protector" != "no" ; then
+  gcc_flags="-fstack-protector-strong -fstack-protector-all"
+  for flag in $gcc_flags; do
+    if compile_prog "-Werror $flag" "" ; then
+      QEMU_CFLAGS="$QEMU_CFLAGS $flag"
+      LIBTOOLFLAGS="$LIBTOOLFLAGS -Wc,$flag"
+      break
+    fi
+  done
 fi
 
 # Workaround for http://gcc.gnu.org/PR55489.  Happens with -fPIE/-fPIC and
commit 58b590148ca1b19f64f533d40e32b5acce5c21e7
Author: Cole Robinson <crobinso at redhat.com>
Date:   Mon Mar 31 14:31:44 2014 -0400

    pci: Fix clearing IRQs on reset
    
    irq_state is cleared before calling pci_device_deassert_intx, but the
    latter misbehaves if the former isn't accurate. In this case, any raised
    IRQs are not cleared, which hits an assertion in pcibus_reset:
    
    qemu-system-x86_64: hw/pci/pci.c:250: pcibus_reset: Assertion
    `bus->irq_count[i] == 0' failed.
    
    pci_device_deassert_intx should clear irq_state anyways, so add
    an assert.
    
    This fixes migration with usb2 + usb-tablet.
    
    Signed-off-by: Cole Robinson <crobinso at redhat.com>
    Message-id: 7da1ad94ce027183b4049c2de370cb191b0073c1.1396290569.git.crobinso at redhat.com
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 8f722dd..2a9f08e 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -189,9 +189,9 @@ static void pci_do_device_reset(PCIDevice *dev)
 {
     int r;
 
-    dev->irq_state = 0;
-    pci_update_irq_status(dev);
     pci_device_deassert_intx(dev);
+    assert(dev->irq_state == 0);
+
     /* Clear all writable bits */
     pci_word_test_and_clear_mask(dev->config + PCI_COMMAND,
                                  pci_get_word(dev->wmask + PCI_COMMAND) |
commit 7d4d7975e58b66de6a67ecb5aa9656653653a658
Merge: 8648fcd 0d6d1ab
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 31 18:47:14 2014 +0100

    Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-2.0' into staging
    
    QOM CPUState refactorings / X86CPU
    
    * X86CPU IA32e 1GB paging support
    * Performance quickfix for CPU() cast macro
    
    # gpg: Signature made Mon 31 Mar 2014 18:33:27 BST using RSA key ID 3E7E013F
    # gpg: Good signature from "Andreas Färber <afaerber at suse.de>"
    # gpg:                 aka "Andreas Färber <afaerber at suse.com>"
    
    * remotes/afaerber/tags/qom-cpu-for-2.0:
      cpu: Avoid QOM casts for CPU()
      target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 0d6d1ab4990b6e8c6f24e9b1308801d657d411ad
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Mar 28 16:25:07 2014 +0100

    cpu: Avoid QOM casts for CPU()
    
    CPU address spaces touching load and store helpers as well as the
    movement of (almost) all fields from CPU_COMMON to CPUState have led to
    a noticeable increase of CPU() usage in "hot" paths for both TCG and KVM.
    
    While CPU()'s OBJECT_CHECK() might help detect development errors, i.e.
    in form of crashes due to QOM vs. non-QOM mismatches rather than QOM
    type mismatches, it is not really needed at runtime since mostly used in
    CPU-specific paths, coming from a target-specific CPU subtype. If that
    pointer is damaged, other errors are highly likely to occur elsewhere
    anyway.
    
    Keep the CPU() macro for a consistent developer experience and for
    flexibility to exchange its implementation, but turn it into a pure,
    unchecked C cast for now.
    
    Compare commit 6e42be7cd10260fd3a006d94f6c870692bf7a2c0.
    
    Reported-by: Laurent Desnogues <laurent.desnogues at gmail.com>
    Suggested-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index f99885a..df977c8 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -53,7 +53,12 @@ typedef uint64_t vaddr;
 
 #define TYPE_CPU "cpu"
 
-#define CPU(obj) OBJECT_CHECK(CPUState, (obj), TYPE_CPU)
+/* Since this macro is used a lot in hot code paths and in conjunction with
+ * FooCPU *foo_env_get_cpu(), we deviate from usual QOM practice by using
+ * an unchecked cast.
+ */
+#define CPU(obj) ((CPUState *)(obj))
+
 #define CPU_CLASS(class) OBJECT_CLASS_CHECK(CPUClass, (class), TYPE_CPU)
 #define CPU_GET_CLASS(obj) OBJECT_GET_CLASS(CPUClass, (obj), TYPE_CPU)
 
commit c8c14bcb72e436fb4aff99b4b2b92e44f2e715b5
Author: Luiz Capitulino <lcapitulino at redhat.com>
Date:   Wed Mar 19 17:03:53 2014 -0400

    target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation
    
    Linux guests, when using more than 4GB of RAM, may end up using 1GB pages
    to store (kernel) data. When this happens, we're unable to debug a running
    Linux kernel with GDB:
    
    (gdb) p node_data[0]->node_id
    Cannot access memory at address 0xffff88013fffd3a0
    (gdb)
    
    GDB returns this error because x86_cpu_get_phys_page_debug() doesn't support
    translating 1GB pages in IA-32e paging mode and returns an error to GDB.
    
    This commit adds support for 1GB page translation for IA32e paging.
    
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/helper.c b/target-i386/helper.c
index 4f447b8..372f0e3 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -941,6 +941,14 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
             pdpe = ldq_phys(cs->as, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK))
                 return -1;
+
+            if (pdpe & PG_PSE_MASK) {
+                page_size = 1024 * 1024 * 1024;
+                pte = pdpe & ~( (page_size - 1) & ~0xfff);
+                pte &= ~(PG_NX_MASK | PG_HI_USER_MASK);
+                goto out;
+            }
+
         } else
 #endif
         {
@@ -993,6 +1001,9 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
         pte = pte & env->a20_mask;
     }
 
+#ifdef TARGET_X86_64
+out:
+#endif
     page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1);
     paddr = (pte & TARGET_PAGE_MASK) + page_offset;
     return paddr;
commit 8648fcd52a9bcc2aa415cbe87b7c636e545acb38
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Mar 20 02:01:55 2014 +0100

    make-release: Record SeaBIOS version
    
    Before deleting .git, determine the version and save it in .version file.
    
    Cc: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1395277315-7806-1-git-send-email-afaerber at suse.de
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/scripts/make-release b/scripts/make-release
index 186358d..fa6323f 100755
--- a/scripts/make-release
+++ b/scripts/make-release
@@ -18,6 +18,7 @@ git clone "${src}" ${destination}
 pushd ${destination}
 git checkout "v${version}"
 git submodule update --init
+(cd roms/seabios && git describe --tags --long --dirty > .version)
 rm -rf .git roms/*/.git dtc/.git pixman/.git
 popd
 tar cfj ${destination}.tar.bz2 ${destination}
commit b3706faf0d8e4f9275c73895d93a16fbffb9d370
Merge: 3b6144b 1a8e80d
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Mar 28 14:52:27 2014 +0000

    Merge remote-tracking branch 'remotes/rth/tcg-arm-unaligned' into staging
    
    * remotes/rth/tcg-arm-unaligned:
      tcg-arm: Avoid ldrd/strd for user-only emulation
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 3b6144bdbb42705c95e3ed0e8c7bbe277352c0b8
Merge: 9c5793c b89834f
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Mar 28 13:46:28 2014 +0000

    Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
    
    acpi,pc,build bug fixes
    
    Here are some bugfixes for 2.0.
    
    A bugfix for acpi for pci bridges, and a build fix for
    old systems without pthread_setname_np: both fix regressions
    so we definitely want to include them.
    HPET fix is not for a regression but looks very safe,
    fixes a nasty bug and has been on list for a while.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Fri 28 Mar 2014 12:00:12 GMT using RSA key ID D28D5469
    # gpg: Good signature from "Michael S. Tsirkin <mst at kernel.org>"
    # gpg:                 aka "Michael S. Tsirkin <mst at redhat.com>"
    
    * remotes/mst/tags/for_upstream:
      acpi: fix ACPI generation for pci bridges
      Don't enable a HPET timer if HPET is disabled
      Detect pthread_setname_np at configure time
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit b89834f4d79070a26536cb73fe5216a2364551eb
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Thu Mar 27 17:35:36 2014 +0200

    acpi: fix ACPI generation for pci bridges
    
    Commit 8dcf525abc5dff785251a881f9764dd961065c0d
        acpi-build: append description for non-hotplug
    appended description for all occupied non hotpluggable PCI slots.
    However the bridge devices are already added to SSDT,
    adding them again will create an incorrect SSDT table.
    
    Fixed by skipping the pci bridge devices, marking them as 'system'.
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 7597517..90ef95c 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -841,7 +841,7 @@ static void build_pci_bus_end(PCIBus *bus, void *bus_state)
         pc = PCI_DEVICE_GET_CLASS(pdev);
         dc = DEVICE_GET_CLASS(pdev);
 
-        if (pc->class_id == PCI_CLASS_BRIDGE_ISA) {
+        if (pc->class_id == PCI_CLASS_BRIDGE_ISA || pc->is_bridge) {
             set_bit(slot, slot_device_system);
         }
 
@@ -882,7 +882,7 @@ static void build_pci_bus_end(PCIBus *bus, void *bus_state)
             memcpy(pcihp, ACPI_PCIVGA_AML, ACPI_PCIVGA_SIZEOF);
             patch_pcivga(i, pcihp);
         } else if (system) {
-            /* Nothing to do: system devices are in DSDT. */
+            /* Nothing to do: system devices are in DSDT or in SSDT above. */
         } else if (present) {
             void *pcihp = acpi_data_push(bus_table,
                                          ACPI_PCINOHP_SIZEOF);
commit 1a8e80d7e82aa385ad887dba5d039e399a18264b
Author: Richard Henderson <rth at twiddle.net>
Date:   Tue Mar 25 17:11:37 2014 -0400

    tcg-arm: Avoid ldrd/strd for user-only emulation
    
    The arm ldrd/strd insns must cause alignment traps, whereas
    at least for armv7 ldr/str must handle unaligned operations.
    
    While this is hardly the only problem facing user-only emu,
    this solves one problem for i386 on armv7 emulation.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Reported-by: Huw Davies <huw at codeweavers.com>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
index c8884b3..a65fc65 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.c
@@ -60,6 +60,13 @@ static int arm_arch = __ARM_ARCH;
 bool use_idiv_instructions;
 #endif
 
+/* ??? Ought to think about changing CONFIG_SOFTMMU to always defined.  */
+#ifdef CONFIG_SOFTMMU
+# define USING_SOFTMMU 1
+#else
+# define USING_SOFTMMU 0
+#endif
+
 #ifndef NDEBUG
 static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "%r0",
@@ -1404,7 +1411,9 @@ static inline void tcg_out_qemu_ld_index(TCGContext *s, TCGMemOp opc,
             TCGReg dl = (bswap ? datahi : datalo);
             TCGReg dh = (bswap ? datalo : datahi);
 
-            if (use_armv6_instructions && (dl & 1) == 0 && dh == dl + 1) {
+            /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+            if (USING_SOFTMMU && use_armv6_instructions
+                && (dl & 1) == 0 && dh == dl + 1) {
                 tcg_out_ldrd_r(s, COND_AL, dl, addrlo, addend);
             } else if (dl != addend) {
                 tcg_out_ld32_rwb(s, COND_AL, dl, addend, addrlo);
@@ -1463,7 +1472,9 @@ static inline void tcg_out_qemu_ld_direct(TCGContext *s, TCGMemOp opc,
             TCGReg dl = (bswap ? datahi : datalo);
             TCGReg dh = (bswap ? datalo : datahi);
 
-            if (use_armv6_instructions && (dl & 1) == 0 && dh == dl + 1) {
+            /* Avoid ldrd for user-only emulation, to handle unaligned.  */
+            if (USING_SOFTMMU && use_armv6_instructions
+                && (dl & 1) == 0 && dh == dl + 1) {
                 tcg_out_ldrd_8(s, COND_AL, dl, addrlo, 0);
             } else if (dl == addrlo) {
                 tcg_out_ld32_12(s, COND_AL, dh, addrlo, bswap ? 0 : 4);
@@ -1548,12 +1559,13 @@ static inline void tcg_out_qemu_st_index(TCGContext *s, int cond, TCGMemOp opc,
         }
         break;
     case MO_64:
+        /* Avoid strd for user-only emulation, to handle unaligned.  */
         if (bswap) {
             tcg_out_bswap32(s, cond, TCG_REG_R0, datahi);
             tcg_out_st32_rwb(s, cond, TCG_REG_R0, addend, addrlo);
             tcg_out_bswap32(s, cond, TCG_REG_R0, datalo);
             tcg_out_st32_12(s, cond, TCG_REG_R0, addend, 4);
-        } else if (use_armv6_instructions
+        } else if (USING_SOFTMMU && use_armv6_instructions
                    && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_r(s, cond, datalo, addrlo, addend);
         } else {
@@ -1592,12 +1604,13 @@ static inline void tcg_out_qemu_st_direct(TCGContext *s, TCGMemOp opc,
         }
         break;
     case MO_64:
+        /* Avoid strd for user-only emulation, to handle unaligned.  */
         if (bswap) {
             tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datahi);
             tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 0);
             tcg_out_bswap32(s, COND_AL, TCG_REG_R0, datalo);
             tcg_out_st32_12(s, COND_AL, TCG_REG_R0, addrlo, 4);
-        } else if (use_armv6_instructions
+        } else if (USING_SOFTMMU && use_armv6_instructions
                    && (datalo & 1) == 0 && datahi == datalo + 1) {
             tcg_out_strd_8(s, COND_AL, datalo, addrlo, 0);
         } else {
commit 9c5793c5036c7608ff2c87846c6d11f904c08b58
Merge: c6c09ba 76ac994
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Mar 27 17:08:30 2014 +0000

    Merge remote-tracking branch 'remotes/afaerber/tags/ppc-for-2.0' into staging
    
    PowerPC queue for 2.0
    
    * OpenPIC fix
    * MSR fixes for POWER7 upwards
    * TCG instruction set support fix for POWER8
    
    # gpg: Signature made Thu 27 Mar 2014 16:12:12 GMT using RSA key ID 3E7E013F
    # gpg: Good signature from "Andreas Färber <afaerber at suse.de>"
    # gpg:                 aka "Andreas Färber <afaerber at suse.com>"
    
    * remotes/afaerber/tags/ppc-for-2.0:
      target-ppc: MSR_POW not supported on POWER7/7+/8
      target-ppc: POWER7+ supports the MSR_VSX bit
      target-ppc: POWER8 supports isel
      target-ppc: POWER8 supports the MSR_LE bit
      intc/openpic_kvm: Fix MemListener delete region callback function
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit c6c09ba9950407a075bfe19c7604f09b71499a20
Merge: 6ff45f0 3768d50
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Mar 27 16:38:58 2014 +0000

    Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-03-27' into staging
    
    trivial patches for 2014-03-27
    
    # gpg: Signature made Thu 27 Mar 2014 15:23:53 GMT using RSA key ID 74F0C838
    # gpg: Good signature from "Michael Tokarev <mjt at tls.msk.ru>"
    # gpg:                 aka "Michael Tokarev <mjt at corpit.ru>"
    # gpg:                 aka "Michael Tokarev <mjt at debian.org>"
    # gpg: WARNING: This key is not certified with a trusted signature!
    # gpg:          There is no indication that the signature belongs to the owner.
    # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
    #      Subkey fingerprint: E190 8639 3B10 B51B AC2C  8B73 5253 C5AD 74F0 C838
    
    * remotes/mjt/tags/trivial-patches-2014-03-27: (23 commits)
      linux-user: remove duplicate statement
      hw/timer/grlib_gptimer: remove unnecessary assignment
      hw/pci-host/apb.c: Avoid shifting left into sign bit
      hw/intc/xilinx_intc: Avoid shifting left into sign bit
      hw/intc/slavio_intctl: Avoid shifting left into sign bit
      tests/libqos/pci-pc: Avoid shifting left into sign bit
      hw/ppc: Avoid shifting left into sign bit
      hw/intc/openpic: Avoid shifting left into sign bit
      hw/usb/hcd-ohci.c: Avoid shifting left into sign bit
      target-mips: Avoid shifting left into sign bit
      hw/i386/acpi_build.c: Avoid shifting left into sign bit
      hw/pci/pci_host.c: Avoid shifting left into sign bit
      hw/intc/apic.c: Use uint32_t for mask word in foreach_apic
      target-i386: Avoid shifting left into sign bit
      CODING_STYLE: Section about mixed declarations
      doc: update default PowerPC framebuffer settings
      doc: update sun4m documentation
      fix return check for KVM_GET_DIRTY_LOG ioctl
      target-i386: Add missing 'static' and 'const' attributes
      util: Add 'static' attribute to function implementation
      ...
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit c36ad13fe9ece9a21a8c1dd082473a2b182298ee
Author: Matt Lupfer <mlupfer at ddn.com>
Date:   Fri Feb 21 21:37:23 2014 -0700

    Don't enable a HPET timer if HPET is disabled
    
    A HPET timer can be started when HPET is not yet
    enabled. This will not generate an interrupt
    to the guest, but causes problems when HPET is later
    enabled.
    
    A timer that is created and expires at least once before
    HPET is enabled will have an initialized comparator based
    on a hpet_offset of 0 (uninitialized). When HPET is
    enabled, hpet_set_timer() is called a second time, which
    modifies the timer expiry to a time based on the
    difference between current ticks (measured with the
    newly initialized hpet_offset) and the timer's
    comparator (which was generated before hpet_offset was
    initialized). This results in a long period of no HPET
    timer ticks.
    
    When this occurs with a CentOS 5.x guest, the guest
    may not receive timer interrupts during its narrow
    timer check window and panic on boot.
    
    Signed-off-by: Matt Lupfer <mlupfer at ddn.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 1264dfd..e15d6bc 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -506,7 +506,8 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
                 timer->cmp = (uint32_t)timer->cmp;
                 timer->period = (uint32_t)timer->period;
             }
-            if (activating_bit(old_val, new_val, HPET_TN_ENABLE)) {
+            if (activating_bit(old_val, new_val, HPET_TN_ENABLE) &&
+                hpet_enabled(s)) {
                 hpet_set_timer(timer);
             } else if (deactivating_bit(old_val, new_val, HPET_TN_ENABLE)) {
                 hpet_del_timer(timer);
commit 5c312079417908381ffca44d18150b6a990c4f0b
Author: Dr. David Alan Gilbert <dgilbert at redhat.com>
Date:   Wed Mar 12 11:48:18 2014 +0000

    Detect pthread_setname_np at configure time
    
    Warn if no way of setting thread name is available.
    
    Signed-off-by: Dr. David Alan Gilbert <dgilbert at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/configure b/configure
index aae617e..01e637f 100755
--- a/configure
+++ b/configure
@@ -2696,6 +2696,24 @@ if test "$mingw32" != yes -a "$pthread" = no; then
       "Make sure to have the pthread libs and headers installed."
 fi
 
+# check for pthread_setname_np
+pthread_setname_np=no
+cat > $TMPC << EOF
+#include <pthread.h>
+
+static void *f(void *p) { return NULL; }
+int main(void)
+{
+    pthread_t thread;
+    pthread_create(&thread, 0, f, 0);
+    pthread_setname_np(thread, "QEMU");
+    return 0;
+}
+EOF
+if compile_prog "" "$pthread_lib" ; then
+  pthread_setname_np=yes
+fi
+
 ##########################################
 # rbd probe
 if test "$rbd" != "no" ; then
@@ -4628,6 +4646,16 @@ if test "$rdma" = "yes" ; then
   echo "CONFIG_RDMA=y" >> $config_host_mak
 fi
 
+# Hold two types of flag:
+#   CONFIG_THREAD_SETNAME_BYTHREAD  - we've got a way of setting the name on
+#                                     a thread we have a handle to
+#   CONFIG_PTHREAD_SETNAME_NP       - A way of doing it on a particular
+#                                     platform
+if test "$pthread_setname_np" = "yes" ; then
+  echo "CONFIG_THREAD_SETNAME_BYTHREAD=y" >> $config_host_mak
+  echo "CONFIG_PTHREAD_SETNAME_NP=y" >> $config_host_mak
+fi
+
 if test "$tcg_interpreter" = "yes"; then
   QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/tci $QEMU_INCLUDES"
 elif test "$ARCH" = "sparc64" ; then
diff --git a/util/qemu-thread-posix.c b/util/qemu-thread-posix.c
index 960d7f5..d05a649 100644
--- a/util/qemu-thread-posix.c
+++ b/util/qemu-thread-posix.c
@@ -32,6 +32,13 @@ static bool name_threads;
 void qemu_thread_naming(bool enable)
 {
     name_threads = enable;
+
+#ifndef CONFIG_THREAD_SETNAME_BYTHREAD
+    /* This is a debugging option, not fatal */
+    if (enable) {
+        fprintf(stderr, "qemu: thread naming not supported on this host\n");
+    }
+#endif
 }
 
 static void error_exit(int err, const char *msg)
@@ -394,6 +401,16 @@ void qemu_event_wait(QemuEvent *ev)
     }
 }
 
+/* Attempt to set the threads name; note that this is for debug, so
+ * we're not going to fail if we can't set it.
+ */
+static void qemu_thread_set_name(QemuThread *thread, const char *name)
+{
+#ifdef CONFIG_PTHREAD_SETNAME_NP
+    pthread_setname_np(thread->thread, name);
+#endif
+}
+
 void qemu_thread_create(QemuThread *thread, const char *name,
                        void *(*start_routine)(void*),
                        void *arg, int mode)
@@ -420,11 +437,9 @@ void qemu_thread_create(QemuThread *thread, const char *name,
     if (err)
         error_exit(err, __func__);
 
-#if defined(__GLIBC__) && (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 12))
     if (name_threads) {
-        pthread_setname_np(thread->thread, name);
+        qemu_thread_set_name(thread, name);
     }
-#endif
 
     pthread_sigmask(SIG_SETMASK, &oldset, NULL);
 
diff --git a/util/qemu-thread-win32.c b/util/qemu-thread-win32.c
index b9c957b..c405c9b 100644
--- a/util/qemu-thread-win32.c
+++ b/util/qemu-thread-win32.c
@@ -22,6 +22,8 @@ void qemu_thread_naming(bool enable)
 {
     /* But note we don't actually name them on Windows yet */
     name_threads = enable;
+
+    fprintf(stderr, "qemu: thread naming not supported on this host\n");
 }
 
 static void error_exit(int err, const char *msg)
commit 6ff45f01c734e1ad051f19913449e2577c9f4b7d
Merge: 9ad665d a7a5544
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Mar 27 15:29:33 2014 +0000

    Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140327' into staging
    
    target-arm queue:
     * Don't default to integratorcp board if no machine specified
    
    # gpg: Signature made Thu 27 Mar 2014 14:09:12 GMT using RSA key ID 14360CDE
    # gpg: Good signature from "Peter Maydell <peter.maydell at linaro.org>"
    
    * remotes/pmaydell/tags/pull-target-arm-20140327:
      vl.c: Improve message when no default machine is found
      hw/arm: Stop specifying integratorcp as the default board
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 3768d505adcd6c3fe819432d7dabd312995fa678
Author: Prasad Joshi <prasadjoshi.linux at gmail.com>
Date:   Sun Mar 23 14:58:42 2014 +0530

    linux-user: remove duplicate statement
    
    Signed-off-by: Prasad Joshi <prasadjoshi.linux at gmail.com>
    Acked-by: Riku Voipio <riku.voipio at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/linux-user/signal.c b/linux-user/signal.c
index e5fb933..7d6246f 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -4043,8 +4043,6 @@ static void setup_rt_frame(int sig, struct target_sigaction *ka,
     struct target_rt_sigframe *frame;
     abi_ulong info_addr, uc_addr;
 
-    frame_addr = get_sigframe(ka, env, sizeof *frame);
-
     frame_addr = get_sigframe(ka, env, sizeof(*frame));
     if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0)) {
         goto give_sigsegv;
commit c9f2d70cc88346d50020d01face2135481e5acde
Author: Prasad Joshi <prasadjoshi.linux at gmail.com>
Date:   Sun Mar 23 14:58:41 2014 +0530

    hw/timer/grlib_gptimer: remove unnecessary assignment
    
    Signed-off-by: Prasad Joshi <prasadjoshi.linux at gmail.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index 7672d3a..d655bb2 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -328,7 +328,6 @@ static void grlib_gptimer_reset(DeviceState *d)
 
     unit->scaler = 0;
     unit->reload = 0;
-    unit->config = 0;
 
     unit->config  = unit->nr_timers;
     unit->config |= unit->irq_line << 3;
commit af23906d50c7d7c28e7e5ff49f7cbf0fa5c6228a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:41 2014 +0000

    hw/pci-host/apb.c: Avoid shifting left into sign bit
    
    Add U suffix to avoid undefined behaviour.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index 1b399dd..252caef 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -58,11 +58,11 @@ do { printf("APB: " fmt , ## __VA_ARGS__); } while (0)
 #define PBM_PCI_IMR_MASK    0x7fffffff
 #define PBM_PCI_IMR_ENABLED 0x80000000
 
-#define POR          (1 << 31)
-#define SOFT_POR     (1 << 30)
-#define SOFT_XIR     (1 << 29)
-#define BTN_POR      (1 << 28)
-#define BTN_XIR      (1 << 27)
+#define POR          (1U << 31)
+#define SOFT_POR     (1U << 30)
+#define SOFT_XIR     (1U << 29)
+#define BTN_POR      (1U << 28)
+#define BTN_XIR      (1U << 27)
 #define RESET_MASK   0xf8000000
 #define RESET_WCMASK 0x98000000
 #define RESET_WMASK  0x60000000
commit 0bc60bd7b34ad6e59b47dbf91179ba9427a85df7
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:40 2014 +0000

    hw/intc/xilinx_intc: Avoid shifting left into sign bit
    
    Avoid undefined behaviour shifting left into the sign bit.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/intc/xilinx_intc.c b/hw/intc/xilinx_intc.c
index 4a10398..1b228ff 100644
--- a/hw/intc/xilinx_intc.c
+++ b/hw/intc/xilinx_intc.c
@@ -71,8 +71,9 @@ static void update_irq(struct xlx_pic *p)
 
     /* Update the vector register.  */
     for (i = 0; i < 32; i++) {
-        if (p->regs[R_IPR] & (1 << i))
+        if (p->regs[R_IPR] & (1U << i)) {
             break;
+        }
     }
     if (i == 32)
         i = ~0;
commit 7d45e784015971e70239e33256fd606638107a3e
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:39 2014 +0000

    hw/intc/slavio_intctl: Avoid shifting left into sign bit
    
    Add 'U' suffix to avoid undefined behaviour.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index 41a1672..b10fb66 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -272,7 +272,7 @@ static void slavio_check_interrupts(SLAVIO_INTCTLState *s, int set_irqs)
             CPU_IRQ_TIMER_IN;
         if (i == s->target_cpu) {
             for (j = 0; j < 32; j++) {
-                if ((s->intregm_pending & (1 << j)) && intbit_to_level[j]) {
+                if ((s->intregm_pending & (1U << j)) && intbit_to_level[j]) {
                     s->slaves[i].intreg_pending |= 1 << intbit_to_level[j];
                 }
             }
commit a879125b47c3ae554c01824f996a64a45a86556e
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:38 2014 +0000

    tests/libqos/pci-pc: Avoid shifting left into sign bit
    
    Add U suffix when doing "1 << 31" to avoid undefined behaviour.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/tests/libqos/pci-pc.c b/tests/libqos/pci-pc.c
index 3bde8ab..bf741a4 100644
--- a/tests/libqos/pci-pc.c
+++ b/tests/libqos/pci-pc.c
@@ -110,37 +110,37 @@ static void qpci_pc_io_writel(QPCIBus *bus, void *addr, uint32_t value)
 
 static uint8_t qpci_pc_config_readb(QPCIBus *bus, int devfn, uint8_t offset)
 {
-    outl(0xcf8, (1 << 31) | (devfn << 8) | offset);
+    outl(0xcf8, (1U << 31) | (devfn << 8) | offset);
     return inb(0xcfc);
 }
 
 static uint16_t qpci_pc_config_readw(QPCIBus *bus, int devfn, uint8_t offset)
 {
-    outl(0xcf8, (1 << 31) | (devfn << 8) | offset);
+    outl(0xcf8, (1U << 31) | (devfn << 8) | offset);
     return inw(0xcfc);
 }
 
 static uint32_t qpci_pc_config_readl(QPCIBus *bus, int devfn, uint8_t offset)
 {
-    outl(0xcf8, (1 << 31) | (devfn << 8) | offset);
+    outl(0xcf8, (1U << 31) | (devfn << 8) | offset);
     return inl(0xcfc);
 }
 
 static void qpci_pc_config_writeb(QPCIBus *bus, int devfn, uint8_t offset, uint8_t value)
 {
-    outl(0xcf8, (1 << 31) | (devfn << 8) | offset);
+    outl(0xcf8, (1U << 31) | (devfn << 8) | offset);
     outb(0xcfc, value);
 }
 
 static void qpci_pc_config_writew(QPCIBus *bus, int devfn, uint8_t offset, uint16_t value)
 {
-    outl(0xcf8, (1 << 31) | (devfn << 8) | offset);
+    outl(0xcf8, (1U << 31) | (devfn << 8) | offset);
     outw(0xcfc, value);
 }
 
 static void qpci_pc_config_writel(QPCIBus *bus, int devfn, uint8_t offset, uint32_t value)
 {
-    outl(0xcf8, (1 << 31) | (devfn << 8) | offset);
+    outl(0xcf8, (1U << 31) | (devfn << 8) | offset);
     outl(0xcfc, value);
 }
 
commit a1f7f97b950a46393b0e55a9a0082e70f540cbbd
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:37 2014 +0000

    hw/ppc: Avoid shifting left into sign bit
    
    Add U suffix to various places where we were doing "1 << 31",
    which is undefined behaviour, and also to other constant
    definitions in the same groups, for consistency.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 0e82719..9c2a132 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -1002,7 +1002,7 @@ static void cpu_4xx_wdt_cb (void *opaque)
     case 0x1:
         timer_mod(ppc40x_timer->wdt_timer, next);
         ppc40x_timer->wdt_next = next;
-        env->spr[SPR_40x_TSR] |= 1 << 31;
+        env->spr[SPR_40x_TSR] |= 1U << 31;
         break;
     case 0x2:
         timer_mod(ppc40x_timer->wdt_timer, next);
diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index ec15bab..2ddc2ed 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -128,7 +128,7 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env,
 
     tlb->attr = 0;
     tlb->prot = PAGE_VALID | ((PAGE_READ | PAGE_WRITE | PAGE_EXEC) << 4);
-    tlb->size = 1 << 31; /* up to 0x80000000  */
+    tlb->size = 1U << 31; /* up to 0x80000000  */
     tlb->EPN = va & TARGET_PAGE_MASK;
     tlb->RPN = pa & TARGET_PAGE_MASK;
     tlb->PID = 0;
@@ -136,7 +136,7 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env,
     tlb = &env->tlb.tlbe[1];
     tlb->attr = 0;
     tlb->prot = PAGE_VALID | ((PAGE_READ | PAGE_WRITE | PAGE_EXEC) << 4);
-    tlb->size = 1 << 31; /* up to 0xffffffff  */
+    tlb->size = 1U << 31; /* up to 0xffffffff  */
     tlb->EPN = 0x80000000 & TARGET_PAGE_MASK;
     tlb->RPN = 0x80000000 & TARGET_PAGE_MASK;
     tlb->PID = 0;
diff --git a/hw/ppc/ppc4xx_devs.c b/hw/ppc/ppc4xx_devs.c
index 9160ee7..8a43111 100644
--- a/hw/ppc/ppc4xx_devs.c
+++ b/hw/ppc/ppc4xx_devs.c
@@ -161,7 +161,7 @@ static void ppcuic_set_irq (void *opaque, int irq_num, int level)
     uint32_t mask, sr;
 
     uic = opaque;
-    mask = 1 << (31-irq_num);
+    mask = 1U << (31-irq_num);
     LOG_UIC("%s: irq %d level %d uicsr %08" PRIx32
                 " mask %08" PRIx32 " => %08" PRIx32 " %08" PRIx32 "\n",
                 __func__, irq_num, level,
diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c
index d839960..8b94da6 100644
--- a/hw/ppc/ppc_booke.c
+++ b/hw/ppc/ppc_booke.c
@@ -34,15 +34,15 @@
 /* Timer Control Register */
 
 #define TCR_WP_SHIFT  30        /* Watchdog Timer Period */
-#define TCR_WP_MASK   (0x3 << TCR_WP_SHIFT)
+#define TCR_WP_MASK   (0x3U << TCR_WP_SHIFT)
 #define TCR_WRC_SHIFT 28        /* Watchdog Timer Reset Control */
-#define TCR_WRC_MASK  (0x3 << TCR_WRC_SHIFT)
-#define TCR_WIE       (1 << 27) /* Watchdog Timer Interrupt Enable */
-#define TCR_DIE       (1 << 26) /* Decrementer Interrupt Enable */
+#define TCR_WRC_MASK  (0x3U << TCR_WRC_SHIFT)
+#define TCR_WIE       (1U << 27) /* Watchdog Timer Interrupt Enable */
+#define TCR_DIE       (1U << 26) /* Decrementer Interrupt Enable */
 #define TCR_FP_SHIFT  24        /* Fixed-Interval Timer Period */
-#define TCR_FP_MASK   (0x3 << TCR_FP_SHIFT)
-#define TCR_FIE       (1 << 23) /* Fixed-Interval Timer Interrupt Enable */
-#define TCR_ARE       (1 << 22) /* Auto-Reload Enable */
+#define TCR_FP_MASK   (0x3U << TCR_FP_SHIFT)
+#define TCR_FIE       (1U << 23) /* Fixed-Interval Timer Interrupt Enable */
+#define TCR_ARE       (1U << 22) /* Auto-Reload Enable */
 
 /* Timer Control Register (e500 specific fields) */
 
@@ -53,12 +53,12 @@
 
 /* Timer Status Register  */
 
-#define TSR_FIS       (1 << 26) /* Fixed-Interval Timer Interrupt Status */
-#define TSR_DIS       (1 << 27) /* Decrementer Interrupt Status */
+#define TSR_FIS       (1U << 26) /* Fixed-Interval Timer Interrupt Status */
+#define TSR_DIS       (1U << 27) /* Decrementer Interrupt Status */
 #define TSR_WRS_SHIFT 28        /* Watchdog Timer Reset Status */
-#define TSR_WRS_MASK  (0x3 << TSR_WRS_SHIFT)
-#define TSR_WIS       (1 << 30) /* Watchdog Timer Interrupt Status */
-#define TSR_ENW       (1 << 31) /* Enable Next Watchdog Timer */
+#define TSR_WRS_MASK  (0x3U << TSR_WRS_SHIFT)
+#define TSR_WIS       (1U << 30) /* Watchdog Timer Interrupt Status */
+#define TSR_ENW       (1U << 31) /* Enable Next Watchdog Timer */
 
 typedef struct booke_timer_t booke_timer_t;
 struct booke_timer_t {
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index ce8ea91..3e3569d 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -71,7 +71,7 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env,
 
     tlb->attr = 0;
     tlb->prot = PAGE_VALID | ((PAGE_READ | PAGE_WRITE | PAGE_EXEC) << 4);
-    tlb->size = 1 << 31; /* up to 0x80000000  */
+    tlb->size = 1U << 31; /* up to 0x80000000  */
     tlb->EPN = va & TARGET_PAGE_MASK;
     tlb->RPN = pa & TARGET_PAGE_MASK;
     tlb->PID = 0;
@@ -79,7 +79,7 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env,
     tlb = &env->tlb.tlbe[1];
     tlb->attr = 0;
     tlb->prot = PAGE_VALID | ((PAGE_READ | PAGE_WRITE | PAGE_EXEC) << 4);
-    tlb->size = 1 << 31; /* up to 0xffffffff  */
+    tlb->size = 1U << 31; /* up to 0xffffffff  */
     tlb->EPN = 0x80000000 & TARGET_PAGE_MASK;
     tlb->RPN = 0x80000000 & TARGET_PAGE_MASK;
     tlb->PID = 0;
commit def60298825ccff006688ab9ee0ebb266c98b7e7
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:36 2014 +0000

    hw/intc/openpic: Avoid shifting left into sign bit
    
    Add U suffix to avoid undefined behaviour. This is only strictly
    necessary for the 1 << 31 cases; for consistency we extend it
    to other constants in the same group.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index 7df72f4..be76fbd 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -123,7 +123,7 @@ static FslMpicInfo fsl_mpic_42 = {
 #define TCCR_TOG          0x80000000 /* toggles when decrement to zero */
 
 #define IDR_EP_SHIFT      31
-#define IDR_EP_MASK       (1 << IDR_EP_SHIFT)
+#define IDR_EP_MASK       (1U << IDR_EP_SHIFT)
 #define IDR_CI0_SHIFT     30
 #define IDR_CI1_SHIFT     29
 #define IDR_P1_SHIFT      1
@@ -220,17 +220,17 @@ typedef struct IRQSource {
 } IRQSource;
 
 #define IVPR_MASK_SHIFT       31
-#define IVPR_MASK_MASK        (1 << IVPR_MASK_SHIFT)
+#define IVPR_MASK_MASK        (1U << IVPR_MASK_SHIFT)
 #define IVPR_ACTIVITY_SHIFT   30
-#define IVPR_ACTIVITY_MASK    (1 << IVPR_ACTIVITY_SHIFT)
+#define IVPR_ACTIVITY_MASK    (1U << IVPR_ACTIVITY_SHIFT)
 #define IVPR_MODE_SHIFT       29
-#define IVPR_MODE_MASK        (1 << IVPR_MODE_SHIFT)
+#define IVPR_MODE_MASK        (1U << IVPR_MODE_SHIFT)
 #define IVPR_POLARITY_SHIFT   23
-#define IVPR_POLARITY_MASK    (1 << IVPR_POLARITY_SHIFT)
+#define IVPR_POLARITY_MASK    (1U << IVPR_POLARITY_SHIFT)
 #define IVPR_SENSE_SHIFT      22
-#define IVPR_SENSE_MASK       (1 << IVPR_SENSE_SHIFT)
+#define IVPR_SENSE_MASK       (1U << IVPR_SENSE_SHIFT)
 
-#define IVPR_PRIORITY_MASK     (0xF << 16)
+#define IVPR_PRIORITY_MASK     (0xFU << 16)
 #define IVPR_PRIORITY(_ivprr_) ((int)(((_ivprr_) & IVPR_PRIORITY_MASK) >> 16))
 #define IVPR_VECTOR(opp, _ivprr_) ((_ivprr_) & (opp)->vector_mask)
 
commit 00b0179347bae12c5856c1195b67ef5dc7887b9b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:35 2014 +0000

    hw/usb/hcd-ohci.c: Avoid shifting left into sign bit
    
    Add U suffix to avoid undefined behaviour. This is only
    strictly necessary for the 1<<31 cases, but we add it for the
    other constants in these groups for consistency.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 3d35058..93f186f 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -234,15 +234,15 @@ struct ohci_iso_td {
 #define OHCI_STATUS_OCR       (1<<3)
 #define OHCI_STATUS_SOC       ((1<<6)|(1<<7))
 
-#define OHCI_INTR_SO          (1<<0) /* Scheduling overrun */
-#define OHCI_INTR_WD          (1<<1) /* HcDoneHead writeback */
-#define OHCI_INTR_SF          (1<<2) /* Start of frame */
-#define OHCI_INTR_RD          (1<<3) /* Resume detect */
-#define OHCI_INTR_UE          (1<<4) /* Unrecoverable error */
-#define OHCI_INTR_FNO         (1<<5) /* Frame number overflow */
-#define OHCI_INTR_RHSC        (1<<6) /* Root hub status change */
-#define OHCI_INTR_OC          (1<<30) /* Ownership change */
-#define OHCI_INTR_MIE         (1<<31) /* Master Interrupt Enable */
+#define OHCI_INTR_SO          (1U<<0) /* Scheduling overrun */
+#define OHCI_INTR_WD          (1U<<1) /* HcDoneHead writeback */
+#define OHCI_INTR_SF          (1U<<2) /* Start of frame */
+#define OHCI_INTR_RD          (1U<<3) /* Resume detect */
+#define OHCI_INTR_UE          (1U<<4) /* Unrecoverable error */
+#define OHCI_INTR_FNO         (1U<<5) /* Frame number overflow */
+#define OHCI_INTR_RHSC        (1U<<6) /* Root hub status change */
+#define OHCI_INTR_OC          (1U<<30) /* Ownership change */
+#define OHCI_INTR_MIE         (1U<<31) /* Master Interrupt Enable */
 
 #define OHCI_HCCA_SIZE        0x100
 #define OHCI_HCCA_MASK        0xffffff00
@@ -253,7 +253,7 @@ struct ohci_iso_td {
 #define OHCI_FMI_FSMPS        0xffff0000
 #define OHCI_FMI_FIT          0x80000000
 
-#define OHCI_FR_RT            (1<<31)
+#define OHCI_FR_RT            (1U<<31)
 
 #define OHCI_LS_THRESH        0x628
 
@@ -265,12 +265,12 @@ struct ohci_iso_td {
 #define OHCI_RHA_NOCP         (1<<12)
 #define OHCI_RHA_POTPGT_MASK  0xff000000
 
-#define OHCI_RHS_LPS          (1<<0)
-#define OHCI_RHS_OCI          (1<<1)
-#define OHCI_RHS_DRWE         (1<<15)
-#define OHCI_RHS_LPSC         (1<<16)
-#define OHCI_RHS_OCIC         (1<<17)
-#define OHCI_RHS_CRWE         (1<<31)
+#define OHCI_RHS_LPS          (1U<<0)
+#define OHCI_RHS_OCI          (1U<<1)
+#define OHCI_RHS_DRWE         (1U<<15)
+#define OHCI_RHS_LPSC         (1U<<16)
+#define OHCI_RHS_OCIC         (1U<<17)
+#define OHCI_RHS_CRWE         (1U<<31)
 
 #define OHCI_PORT_CCS         (1<<0)
 #define OHCI_PORT_PES         (1<<1)
commit f45cb2f43f5bb0a4122a64e61c746048b59a84ed
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:34 2014 +0000

    target-mips: Avoid shifting left into sign bit
    
    Add U suffix to various places where we shift a 1 left by 31,
    to avoid undefined behaviour.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 3ba3229..6c2014e 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -775,7 +775,7 @@ static inline void compute_hflags(CPUMIPSState *env)
            and disable the MIPS IV extensions to the MIPS III ISA.
            Some other MIPS IV CPUs ignore the bit, so the check here
            would be too restrictive for them.  */
-        if (env->CP0_Status & (1 << CP0St_CU3)) {
+        if (env->CP0_Status & (1U << CP0St_CU3)) {
             env->hflags |= MIPS_HFLAG_COP1X;
         }
     }
diff --git a/target-mips/helper.c b/target-mips/helper.c
index b28ae9b..064622c 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -458,7 +458,7 @@ void mips_cpu_do_interrupt(CPUState *cs)
         env->hflags &= ~(MIPS_HFLAG_KSU);
         /* EJTAG probe trap enable is not implemented... */
         if (!(env->CP0_Status & (1 << CP0St_EXL)))
-            env->CP0_Cause &= ~(1 << CP0Ca_BD);
+            env->CP0_Cause &= ~(1U << CP0Ca_BD);
         env->active_tc.PC = (int32_t)0xBFC00480;
         set_hflags_for_handler(env);
         break;
@@ -478,7 +478,7 @@ void mips_cpu_do_interrupt(CPUState *cs)
         env->hflags |= MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
         env->hflags &= ~(MIPS_HFLAG_KSU);
         if (!(env->CP0_Status & (1 << CP0St_EXL)))
-            env->CP0_Cause &= ~(1 << CP0Ca_BD);
+            env->CP0_Cause &= ~(1U << CP0Ca_BD);
         env->active_tc.PC = (int32_t)0xBFC00000;
         set_hflags_for_handler(env);
         break;
@@ -616,9 +616,9 @@ void mips_cpu_do_interrupt(CPUState *cs)
         if (!(env->CP0_Status & (1 << CP0St_EXL))) {
             env->CP0_EPC = exception_resume_pc(env);
             if (env->hflags & MIPS_HFLAG_BMASK) {
-                env->CP0_Cause |= (1 << CP0Ca_BD);
+                env->CP0_Cause |= (1U << CP0Ca_BD);
             } else {
-                env->CP0_Cause &= ~(1 << CP0Ca_BD);
+                env->CP0_Cause &= ~(1U << CP0Ca_BD);
             }
             env->CP0_Status |= (1 << CP0St_EXL);
             env->hflags |= MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index e56f038..4edec6c 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -648,7 +648,7 @@ static void sync_c0_tcstatus(CPUMIPSState *cpu, int tc,
 {
     uint32_t status;
     uint32_t tcu, tmx, tasid, tksu;
-    uint32_t mask = ((1 << CP0St_CU3)
+    uint32_t mask = ((1U << CP0St_CU3)
                        | (1 << CP0St_CU2)
                        | (1 << CP0St_CU1)
                        | (1 << CP0St_CU0)
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index a64fd2b..29dc2ef 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -22,20 +22,20 @@
 
 /* Have config1, uncached coherency */
 #define MIPS_CONFIG0                                              \
-  ((1 << CP0C0_M) | (0x2 << CP0C0_K0))
+  ((1U << CP0C0_M) | (0x2 << CP0C0_K0))
 
 /* Have config2, no coprocessor2 attached, no MDMX support attached,
    no performance counters, watch registers present,
    no code compression, EJTAG present, no FPU */
 #define MIPS_CONFIG1                                              \
-((1 << CP0C1_M) |                                                 \
+((1U << CP0C1_M) |                                                \
  (0 << CP0C1_C2) | (0 << CP0C1_MD) | (0 << CP0C1_PC) |            \
  (1 << CP0C1_WR) | (0 << CP0C1_CA) | (1 << CP0C1_EP) |            \
  (0 << CP0C1_FP))
 
 /* Have config3, no tertiary/secondary caches implemented */
 #define MIPS_CONFIG2                                              \
-((1 << CP0C2_M))
+((1U << CP0C2_M))
 
 /* No config4, no DSP ASE, no large physaddr (PABITS),
    no external interrupt controller, no vectored interrupts,
@@ -301,16 +301,16 @@ static const mips_def_t mips_defs[] =
                     (1 << FCR0_D) | (1 << FCR0_S) | (0x95 << FCR0_PRID),
         .CP0_SRSCtl = (0xf << CP0SRSCtl_HSS),
         .CP0_SRSConf0_rw_bitmask = 0x3fffffff,
-        .CP0_SRSConf0 = (1 << CP0SRSC0_M) | (0x3fe << CP0SRSC0_SRS3) |
+        .CP0_SRSConf0 = (1U << CP0SRSC0_M) | (0x3fe << CP0SRSC0_SRS3) |
                     (0x3fe << CP0SRSC0_SRS2) | (0x3fe << CP0SRSC0_SRS1),
         .CP0_SRSConf1_rw_bitmask = 0x3fffffff,
-        .CP0_SRSConf1 = (1 << CP0SRSC1_M) | (0x3fe << CP0SRSC1_SRS6) |
+        .CP0_SRSConf1 = (1U << CP0SRSC1_M) | (0x3fe << CP0SRSC1_SRS6) |
                     (0x3fe << CP0SRSC1_SRS5) | (0x3fe << CP0SRSC1_SRS4),
         .CP0_SRSConf2_rw_bitmask = 0x3fffffff,
-        .CP0_SRSConf2 = (1 << CP0SRSC2_M) | (0x3fe << CP0SRSC2_SRS9) |
+        .CP0_SRSConf2 = (1U << CP0SRSC2_M) | (0x3fe << CP0SRSC2_SRS9) |
                     (0x3fe << CP0SRSC2_SRS8) | (0x3fe << CP0SRSC2_SRS7),
         .CP0_SRSConf3_rw_bitmask = 0x3fffffff,
-        .CP0_SRSConf3 = (1 << CP0SRSC3_M) | (0x3fe << CP0SRSC3_SRS12) |
+        .CP0_SRSConf3 = (1U << CP0SRSC3_M) | (0x3fe << CP0SRSC3_SRS12) |
                     (0x3fe << CP0SRSC3_SRS11) | (0x3fe << CP0SRSC3_SRS10),
         .CP0_SRSConf4_rw_bitmask = 0x3fffffff,
         .CP0_SRSConf4 = (0x3fe << CP0SRSC4_SRS15) |
@@ -355,8 +355,8 @@ static const mips_def_t mips_defs[] =
                        (0 << CP0C1_DS) | (3 << CP0C1_DL) | (1 << CP0C1_DA) |
                        (1 << CP0C1_CA),
         .CP0_Config2 = MIPS_CONFIG2,
-        .CP0_Config3 = MIPS_CONFIG3 | (1 << CP0C3_M),
-        .CP0_Config4 = MIPS_CONFIG4 | (1 << CP0C4_M),
+        .CP0_Config3 = MIPS_CONFIG3 | (1U << CP0C3_M),
+        .CP0_Config4 = MIPS_CONFIG4 | (1U << CP0C4_M),
         .CP0_Config4_rw_bitmask = 0,
         .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_UFR),
         .CP0_Config5_rw_bitmask = (0 << CP0C5_M) | (1 << CP0C5_K) |
@@ -670,7 +670,7 @@ static void mvp_init (CPUMIPSState *env, const mips_def_t *def)
        programmable cache partitioning implemented, number of allocatable
        and sharable TLB entries, MVP has allocatable TCs, 2 VPEs
        implemented, 5 TCs implemented. */
-    env->mvp->CP0_MVPConf0 = (1 << CP0MVPC0_M) | (1 << CP0MVPC0_TLBS) |
+    env->mvp->CP0_MVPConf0 = (1U << CP0MVPC0_M) | (1 << CP0MVPC0_TLBS) |
                              (0 << CP0MVPC0_GS) | (1 << CP0MVPC0_PCP) |
 // TODO: actually do 2 VPEs.
 //                             (1 << CP0MVPC0_TCA) | (0x1 << CP0MVPC0_PVPE) |
@@ -684,7 +684,7 @@ static void mvp_init (CPUMIPSState *env, const mips_def_t *def)
 
     /* Allocatable CP1 have media extensions, allocatable CP1 have FP support,
        no UDI implemented, no CP2 implemented, 1 CP1 implemented. */
-    env->mvp->CP0_MVPConf1 = (1 << CP0MVPC1_CIM) | (1 << CP0MVPC1_CIF) |
+    env->mvp->CP0_MVPConf1 = (1U << CP0MVPC1_CIM) | (1 << CP0MVPC1_CIF) |
                              (0x0 << CP0MVPC1_PCX) | (0x0 << CP0MVPC1_PCP2) |
                              (0x1 << CP0MVPC1_PCP1);
 }
commit d9631b90da6ac592ea76b41a654dd5d29b2645d4
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:33 2014 +0000

    hw/i386/acpi_build.c: Avoid shifting left into sign bit
    
    Add U suffix to avoid undefined behaviour.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 7597517..b34d927 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -907,7 +907,7 @@ static void build_pci_bus_end(PCIBus *bus, void *bus_state)
 
             build_append_byte(notify, 0x7B); /* AndOp */
             build_append_byte(notify, 0x68); /* Arg0Op */
-            build_append_int(notify, 0x1 << i);
+            build_append_int(notify, 0x1U << i);
             build_append_byte(notify, 0x00); /* NullName */
             build_append_byte(notify, 0x86); /* NotifyOp */
             build_append_nameseg(notify, "S%.02X_", PCI_DEVFN(i, 0));
commit ac43fa508cc1cfe6d6f67c8eb99dc012e52c164e
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:32 2014 +0000

    hw/pci/pci_host.c: Avoid shifting left into sign bit
    
    Add U suffix to avoid undefined behaviour.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index 77c7d1f..3e26f92 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -142,8 +142,9 @@ static uint64_t pci_host_data_read(void *opaque,
 {
     PCIHostState *s = opaque;
     uint32_t val;
-    if (!(s->config_reg & (1 << 31)))
+    if (!(s->config_reg & (1U << 31))) {
         return 0xffffffff;
+    }
     val = pci_data_read(s->bus, s->config_reg | (addr & 3), len);
     PCI_DPRINTF("read addr " TARGET_FMT_plx " len %d val %x\n",
                 addr, len, val);
commit 6d55574a656f3a533a370156aaefedcf7980d4d8
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:31 2014 +0000

    hw/intc/apic.c: Use uint32_t for mask word in foreach_apic
    
    Use unsigned arithmetic for operations on the mask word
    in the foreach_apic() macro, to avoid relying on undefined
    behaviour when shifting into the sign bit.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index 361ae90..b8c061b 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -201,12 +201,12 @@ static void apic_external_nmi(APICCommonState *s)
 
 #define foreach_apic(apic, deliver_bitmask, code) \
 {\
-    int __i, __j, __mask;\
+    int __i, __j;\
     for(__i = 0; __i < MAX_APIC_WORDS; __i++) {\
-        __mask = deliver_bitmask[__i];\
+        uint32_t __mask = deliver_bitmask[__i];\
         if (__mask) {\
             for(__j = 0; __j < 32; __j++) {\
-                if (__mask & (1 << __j)) {\
+                if (__mask & (1U << __j)) {\
                     apic = local_apics[__i * 32 + __j];\
                     if (apic) {\
                         code;\
commit 2cd49cbfab0dd294de421893048ab614518fa263
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Mar 17 16:00:30 2014 +0000

    target-i386: Avoid shifting left into sign bit
    
    Add 'U' suffixes where necessary to avoid (1 << 31) which
    shifts left into the sign bit, which is undefined behaviour.
    Add the suffix also for other constants in the same groupings
    even if they don't shift into bit 31, for consistency.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 4d1374c..2a22a7d 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -194,35 +194,35 @@
 #define CR0_PE_SHIFT 0
 #define CR0_MP_SHIFT 1
 
-#define CR0_PE_MASK  (1 << 0)
-#define CR0_MP_MASK  (1 << 1)
-#define CR0_EM_MASK  (1 << 2)
-#define CR0_TS_MASK  (1 << 3)
-#define CR0_ET_MASK  (1 << 4)
-#define CR0_NE_MASK  (1 << 5)
-#define CR0_WP_MASK  (1 << 16)
-#define CR0_AM_MASK  (1 << 18)
-#define CR0_PG_MASK  (1 << 31)
-
-#define CR4_VME_MASK  (1 << 0)
-#define CR4_PVI_MASK  (1 << 1)
-#define CR4_TSD_MASK  (1 << 2)
-#define CR4_DE_MASK   (1 << 3)
-#define CR4_PSE_MASK  (1 << 4)
-#define CR4_PAE_MASK  (1 << 5)
-#define CR4_MCE_MASK  (1 << 6)
-#define CR4_PGE_MASK  (1 << 7)
-#define CR4_PCE_MASK  (1 << 8)
+#define CR0_PE_MASK  (1U << 0)
+#define CR0_MP_MASK  (1U << 1)
+#define CR0_EM_MASK  (1U << 2)
+#define CR0_TS_MASK  (1U << 3)
+#define CR0_ET_MASK  (1U << 4)
+#define CR0_NE_MASK  (1U << 5)
+#define CR0_WP_MASK  (1U << 16)
+#define CR0_AM_MASK  (1U << 18)
+#define CR0_PG_MASK  (1U << 31)
+
+#define CR4_VME_MASK  (1U << 0)
+#define CR4_PVI_MASK  (1U << 1)
+#define CR4_TSD_MASK  (1U << 2)
+#define CR4_DE_MASK   (1U << 3)
+#define CR4_PSE_MASK  (1U << 4)
+#define CR4_PAE_MASK  (1U << 5)
+#define CR4_MCE_MASK  (1U << 6)
+#define CR4_PGE_MASK  (1U << 7)
+#define CR4_PCE_MASK  (1U << 8)
 #define CR4_OSFXSR_SHIFT 9
-#define CR4_OSFXSR_MASK (1 << CR4_OSFXSR_SHIFT)
-#define CR4_OSXMMEXCPT_MASK  (1 << 10)
-#define CR4_VMXE_MASK   (1 << 13)
-#define CR4_SMXE_MASK   (1 << 14)
-#define CR4_FSGSBASE_MASK (1 << 16)
-#define CR4_PCIDE_MASK  (1 << 17)
-#define CR4_OSXSAVE_MASK (1 << 18)
-#define CR4_SMEP_MASK   (1 << 20)
-#define CR4_SMAP_MASK   (1 << 21)
+#define CR4_OSFXSR_MASK (1U << CR4_OSFXSR_SHIFT)
+#define CR4_OSXMMEXCPT_MASK  (1U << 10)
+#define CR4_VMXE_MASK   (1U << 13)
+#define CR4_SMXE_MASK   (1U << 14)
+#define CR4_FSGSBASE_MASK (1U << 16)
+#define CR4_PCIDE_MASK  (1U << 17)
+#define CR4_OSXSAVE_MASK (1U << 18)
+#define CR4_SMEP_MASK   (1U << 20)
+#define CR4_SMAP_MASK   (1U << 21)
 
 #define DR6_BD          (1 << 13)
 #define DR6_BS          (1 << 14)
@@ -407,96 +407,96 @@ typedef enum FeatureWord {
 typedef uint32_t FeatureWordArray[FEATURE_WORDS];
 
 /* cpuid_features bits */
-#define CPUID_FP87 (1 << 0)
-#define CPUID_VME  (1 << 1)
-#define CPUID_DE   (1 << 2)
-#define CPUID_PSE  (1 << 3)
-#define CPUID_TSC  (1 << 4)
-#define CPUID_MSR  (1 << 5)
-#define CPUID_PAE  (1 << 6)
-#define CPUID_MCE  (1 << 7)
-#define CPUID_CX8  (1 << 8)
-#define CPUID_APIC (1 << 9)
-#define CPUID_SEP  (1 << 11) /* sysenter/sysexit */
-#define CPUID_MTRR (1 << 12)
-#define CPUID_PGE  (1 << 13)
-#define CPUID_MCA  (1 << 14)
-#define CPUID_CMOV (1 << 15)
-#define CPUID_PAT  (1 << 16)
-#define CPUID_PSE36   (1 << 17)
-#define CPUID_PN   (1 << 18)
-#define CPUID_CLFLUSH (1 << 19)
-#define CPUID_DTS (1 << 21)
-#define CPUID_ACPI (1 << 22)
-#define CPUID_MMX  (1 << 23)
-#define CPUID_FXSR (1 << 24)
-#define CPUID_SSE  (1 << 25)
-#define CPUID_SSE2 (1 << 26)
-#define CPUID_SS (1 << 27)
-#define CPUID_HT (1 << 28)
-#define CPUID_TM (1 << 29)
-#define CPUID_IA64 (1 << 30)
-#define CPUID_PBE (1 << 31)
-
-#define CPUID_EXT_SSE3     (1 << 0)
-#define CPUID_EXT_PCLMULQDQ (1 << 1)
-#define CPUID_EXT_DTES64   (1 << 2)
-#define CPUID_EXT_MONITOR  (1 << 3)
-#define CPUID_EXT_DSCPL    (1 << 4)
-#define CPUID_EXT_VMX      (1 << 5)
-#define CPUID_EXT_SMX      (1 << 6)
-#define CPUID_EXT_EST      (1 << 7)
-#define CPUID_EXT_TM2      (1 << 8)
-#define CPUID_EXT_SSSE3    (1 << 9)
-#define CPUID_EXT_CID      (1 << 10)
-#define CPUID_EXT_FMA      (1 << 12)
-#define CPUID_EXT_CX16     (1 << 13)
-#define CPUID_EXT_XTPR     (1 << 14)
-#define CPUID_EXT_PDCM     (1 << 15)
-#define CPUID_EXT_PCID     (1 << 17)
-#define CPUID_EXT_DCA      (1 << 18)
-#define CPUID_EXT_SSE41    (1 << 19)
-#define CPUID_EXT_SSE42    (1 << 20)
-#define CPUID_EXT_X2APIC   (1 << 21)
-#define CPUID_EXT_MOVBE    (1 << 22)
-#define CPUID_EXT_POPCNT   (1 << 23)
-#define CPUID_EXT_TSC_DEADLINE_TIMER (1 << 24)
-#define CPUID_EXT_AES      (1 << 25)
-#define CPUID_EXT_XSAVE    (1 << 26)
-#define CPUID_EXT_OSXSAVE  (1 << 27)
-#define CPUID_EXT_AVX      (1 << 28)
-#define CPUID_EXT_F16C     (1 << 29)
-#define CPUID_EXT_RDRAND   (1 << 30)
-#define CPUID_EXT_HYPERVISOR  (1 << 31)
-
-#define CPUID_EXT2_FPU     (1 << 0)
-#define CPUID_EXT2_VME     (1 << 1)
-#define CPUID_EXT2_DE      (1 << 2)
-#define CPUID_EXT2_PSE     (1 << 3)
-#define CPUID_EXT2_TSC     (1 << 4)
-#define CPUID_EXT2_MSR     (1 << 5)
-#define CPUID_EXT2_PAE     (1 << 6)
-#define CPUID_EXT2_MCE     (1 << 7)
-#define CPUID_EXT2_CX8     (1 << 8)
-#define CPUID_EXT2_APIC    (1 << 9)
-#define CPUID_EXT2_SYSCALL (1 << 11)
-#define CPUID_EXT2_MTRR    (1 << 12)
-#define CPUID_EXT2_PGE     (1 << 13)
-#define CPUID_EXT2_MCA     (1 << 14)
-#define CPUID_EXT2_CMOV    (1 << 15)
-#define CPUID_EXT2_PAT     (1 << 16)
-#define CPUID_EXT2_PSE36   (1 << 17)
-#define CPUID_EXT2_MP      (1 << 19)
-#define CPUID_EXT2_NX      (1 << 20)
-#define CPUID_EXT2_MMXEXT  (1 << 22)
-#define CPUID_EXT2_MMX     (1 << 23)
-#define CPUID_EXT2_FXSR    (1 << 24)
-#define CPUID_EXT2_FFXSR   (1 << 25)
-#define CPUID_EXT2_PDPE1GB (1 << 26)
-#define CPUID_EXT2_RDTSCP  (1 << 27)
-#define CPUID_EXT2_LM      (1 << 29)
-#define CPUID_EXT2_3DNOWEXT (1 << 30)
-#define CPUID_EXT2_3DNOW   (1 << 31)
+#define CPUID_FP87 (1U << 0)
+#define CPUID_VME  (1U << 1)
+#define CPUID_DE   (1U << 2)
+#define CPUID_PSE  (1U << 3)
+#define CPUID_TSC  (1U << 4)
+#define CPUID_MSR  (1U << 5)
+#define CPUID_PAE  (1U << 6)
+#define CPUID_MCE  (1U << 7)
+#define CPUID_CX8  (1U << 8)
+#define CPUID_APIC (1U << 9)
+#define CPUID_SEP  (1U << 11) /* sysenter/sysexit */
+#define CPUID_MTRR (1U << 12)
+#define CPUID_PGE  (1U << 13)
+#define CPUID_MCA  (1U << 14)
+#define CPUID_CMOV (1U << 15)
+#define CPUID_PAT  (1U << 16)
+#define CPUID_PSE36   (1U << 17)
+#define CPUID_PN   (1U << 18)
+#define CPUID_CLFLUSH (1U << 19)
+#define CPUID_DTS (1U << 21)
+#define CPUID_ACPI (1U << 22)
+#define CPUID_MMX  (1U << 23)
+#define CPUID_FXSR (1U << 24)
+#define CPUID_SSE  (1U << 25)
+#define CPUID_SSE2 (1U << 26)
+#define CPUID_SS (1U << 27)
+#define CPUID_HT (1U << 28)
+#define CPUID_TM (1U << 29)
+#define CPUID_IA64 (1U << 30)
+#define CPUID_PBE (1U << 31)
+
+#define CPUID_EXT_SSE3     (1U << 0)
+#define CPUID_EXT_PCLMULQDQ (1U << 1)
+#define CPUID_EXT_DTES64   (1U << 2)
+#define CPUID_EXT_MONITOR  (1U << 3)
+#define CPUID_EXT_DSCPL    (1U << 4)
+#define CPUID_EXT_VMX      (1U << 5)
+#define CPUID_EXT_SMX      (1U << 6)
+#define CPUID_EXT_EST      (1U << 7)
+#define CPUID_EXT_TM2      (1U << 8)
+#define CPUID_EXT_SSSE3    (1U << 9)
+#define CPUID_EXT_CID      (1U << 10)
+#define CPUID_EXT_FMA      (1U << 12)
+#define CPUID_EXT_CX16     (1U << 13)
+#define CPUID_EXT_XTPR     (1U << 14)
+#define CPUID_EXT_PDCM     (1U << 15)
+#define CPUID_EXT_PCID     (1U << 17)
+#define CPUID_EXT_DCA      (1U << 18)
+#define CPUID_EXT_SSE41    (1U << 19)
+#define CPUID_EXT_SSE42    (1U << 20)
+#define CPUID_EXT_X2APIC   (1U << 21)
+#define CPUID_EXT_MOVBE    (1U << 22)
+#define CPUID_EXT_POPCNT   (1U << 23)
+#define CPUID_EXT_TSC_DEADLINE_TIMER (1U << 24)
+#define CPUID_EXT_AES      (1U << 25)
+#define CPUID_EXT_XSAVE    (1U << 26)
+#define CPUID_EXT_OSXSAVE  (1U << 27)
+#define CPUID_EXT_AVX      (1U << 28)
+#define CPUID_EXT_F16C     (1U << 29)
+#define CPUID_EXT_RDRAND   (1U << 30)
+#define CPUID_EXT_HYPERVISOR  (1U << 31)
+
+#define CPUID_EXT2_FPU     (1U << 0)
+#define CPUID_EXT2_VME     (1U << 1)
+#define CPUID_EXT2_DE      (1U << 2)
+#define CPUID_EXT2_PSE     (1U << 3)
+#define CPUID_EXT2_TSC     (1U << 4)
+#define CPUID_EXT2_MSR     (1U << 5)
+#define CPUID_EXT2_PAE     (1U << 6)
+#define CPUID_EXT2_MCE     (1U << 7)
+#define CPUID_EXT2_CX8     (1U << 8)
+#define CPUID_EXT2_APIC    (1U << 9)
+#define CPUID_EXT2_SYSCALL (1U << 11)
+#define CPUID_EXT2_MTRR    (1U << 12)
+#define CPUID_EXT2_PGE     (1U << 13)
+#define CPUID_EXT2_MCA     (1U << 14)
+#define CPUID_EXT2_CMOV    (1U << 15)
+#define CPUID_EXT2_PAT     (1U << 16)
+#define CPUID_EXT2_PSE36   (1U << 17)
+#define CPUID_EXT2_MP      (1U << 19)
+#define CPUID_EXT2_NX      (1U << 20)
+#define CPUID_EXT2_MMXEXT  (1U << 22)
+#define CPUID_EXT2_MMX     (1U << 23)
+#define CPUID_EXT2_FXSR    (1U << 24)
+#define CPUID_EXT2_FFXSR   (1U << 25)
+#define CPUID_EXT2_PDPE1GB (1U << 26)
+#define CPUID_EXT2_RDTSCP  (1U << 27)
+#define CPUID_EXT2_LM      (1U << 29)
+#define CPUID_EXT2_3DNOWEXT (1U << 30)
+#define CPUID_EXT2_3DNOW   (1U << 31)
 
 /* CPUID[8000_0001].EDX bits that are aliase of CPUID[1].EDX bits on AMD CPUs */
 #define CPUID_EXT2_AMD_ALIASES (CPUID_EXT2_FPU | CPUID_EXT2_VME | \
@@ -509,53 +509,53 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
                                 CPUID_EXT2_PAT | CPUID_EXT2_PSE36 | \
                                 CPUID_EXT2_MMX | CPUID_EXT2_FXSR)
 
-#define CPUID_EXT3_LAHF_LM (1 << 0)
-#define CPUID_EXT3_CMP_LEG (1 << 1)
-#define CPUID_EXT3_SVM     (1 << 2)
-#define CPUID_EXT3_EXTAPIC (1 << 3)
-#define CPUID_EXT3_CR8LEG  (1 << 4)
-#define CPUID_EXT3_ABM     (1 << 5)
-#define CPUID_EXT3_SSE4A   (1 << 6)
-#define CPUID_EXT3_MISALIGNSSE (1 << 7)
-#define CPUID_EXT3_3DNOWPREFETCH (1 << 8)
-#define CPUID_EXT3_OSVW    (1 << 9)
-#define CPUID_EXT3_IBS     (1 << 10)
-#define CPUID_EXT3_XOP     (1 << 11)
-#define CPUID_EXT3_SKINIT  (1 << 12)
-#define CPUID_EXT3_WDT     (1 << 13)
-#define CPUID_EXT3_LWP     (1 << 15)
-#define CPUID_EXT3_FMA4    (1 << 16)
-#define CPUID_EXT3_TCE     (1 << 17)
-#define CPUID_EXT3_NODEID  (1 << 19)
-#define CPUID_EXT3_TBM     (1 << 21)
-#define CPUID_EXT3_TOPOEXT (1 << 22)
-#define CPUID_EXT3_PERFCORE (1 << 23)
-#define CPUID_EXT3_PERFNB  (1 << 24)
-
-#define CPUID_SVM_NPT          (1 << 0)
-#define CPUID_SVM_LBRV         (1 << 1)
-#define CPUID_SVM_SVMLOCK      (1 << 2)
-#define CPUID_SVM_NRIPSAVE     (1 << 3)
-#define CPUID_SVM_TSCSCALE     (1 << 4)
-#define CPUID_SVM_VMCBCLEAN    (1 << 5)
-#define CPUID_SVM_FLUSHASID    (1 << 6)
-#define CPUID_SVM_DECODEASSIST (1 << 7)
-#define CPUID_SVM_PAUSEFILTER  (1 << 10)
-#define CPUID_SVM_PFTHRESHOLD  (1 << 12)
-
-#define CPUID_7_0_EBX_FSGSBASE (1 << 0)
-#define CPUID_7_0_EBX_BMI1     (1 << 3)
-#define CPUID_7_0_EBX_HLE      (1 << 4)
-#define CPUID_7_0_EBX_AVX2     (1 << 5)
-#define CPUID_7_0_EBX_SMEP     (1 << 7)
-#define CPUID_7_0_EBX_BMI2     (1 << 8)
-#define CPUID_7_0_EBX_ERMS     (1 << 9)
-#define CPUID_7_0_EBX_INVPCID  (1 << 10)
-#define CPUID_7_0_EBX_RTM      (1 << 11)
-#define CPUID_7_0_EBX_MPX      (1 << 14)
-#define CPUID_7_0_EBX_RDSEED   (1 << 18)
-#define CPUID_7_0_EBX_ADX      (1 << 19)
-#define CPUID_7_0_EBX_SMAP     (1 << 20)
+#define CPUID_EXT3_LAHF_LM (1U << 0)
+#define CPUID_EXT3_CMP_LEG (1U << 1)
+#define CPUID_EXT3_SVM     (1U << 2)
+#define CPUID_EXT3_EXTAPIC (1U << 3)
+#define CPUID_EXT3_CR8LEG  (1U << 4)
+#define CPUID_EXT3_ABM     (1U << 5)
+#define CPUID_EXT3_SSE4A   (1U << 6)
+#define CPUID_EXT3_MISALIGNSSE (1U << 7)
+#define CPUID_EXT3_3DNOWPREFETCH (1U << 8)
+#define CPUID_EXT3_OSVW    (1U << 9)
+#define CPUID_EXT3_IBS     (1U << 10)
+#define CPUID_EXT3_XOP     (1U << 11)
+#define CPUID_EXT3_SKINIT  (1U << 12)
+#define CPUID_EXT3_WDT     (1U << 13)
+#define CPUID_EXT3_LWP     (1U << 15)
+#define CPUID_EXT3_FMA4    (1U << 16)
+#define CPUID_EXT3_TCE     (1U << 17)
+#define CPUID_EXT3_NODEID  (1U << 19)
+#define CPUID_EXT3_TBM     (1U << 21)
+#define CPUID_EXT3_TOPOEXT (1U << 22)
+#define CPUID_EXT3_PERFCORE (1U << 23)
+#define CPUID_EXT3_PERFNB  (1U << 24)
+
+#define CPUID_SVM_NPT          (1U << 0)
+#define CPUID_SVM_LBRV         (1U << 1)
+#define CPUID_SVM_SVMLOCK      (1U << 2)
+#define CPUID_SVM_NRIPSAVE     (1U << 3)
+#define CPUID_SVM_TSCSCALE     (1U << 4)
+#define CPUID_SVM_VMCBCLEAN    (1U << 5)
+#define CPUID_SVM_FLUSHASID    (1U << 6)
+#define CPUID_SVM_DECODEASSIST (1U << 7)
+#define CPUID_SVM_PAUSEFILTER  (1U << 10)
+#define CPUID_SVM_PFTHRESHOLD  (1U << 12)
+
+#define CPUID_7_0_EBX_FSGSBASE (1U << 0)
+#define CPUID_7_0_EBX_BMI1     (1U << 3)
+#define CPUID_7_0_EBX_HLE      (1U << 4)
+#define CPUID_7_0_EBX_AVX2     (1U << 5)
+#define CPUID_7_0_EBX_SMEP     (1U << 7)
+#define CPUID_7_0_EBX_BMI2     (1U << 8)
+#define CPUID_7_0_EBX_ERMS     (1U << 9)
+#define CPUID_7_0_EBX_INVPCID  (1U << 10)
+#define CPUID_7_0_EBX_RTM      (1U << 11)
+#define CPUID_7_0_EBX_MPX      (1U << 14)
+#define CPUID_7_0_EBX_RDSEED   (1U << 18)
+#define CPUID_7_0_EBX_ADX      (1U << 19)
+#define CPUID_7_0_EBX_SMAP     (1U << 20)
 
 #define CPUID_VENDOR_SZ      12
 
@@ -571,8 +571,8 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
 
 #define CPUID_VENDOR_VIA   "CentaurHauls"
 
-#define CPUID_MWAIT_IBE     (1 << 1) /* Interrupts can exit capability */
-#define CPUID_MWAIT_EMX     (1 << 0) /* enumeration supported */
+#define CPUID_MWAIT_IBE     (1U << 1) /* Interrupts can exit capability */
+#define CPUID_MWAIT_EMX     (1U << 0) /* enumeration supported */
 
 #ifndef HYPERV_SPINLOCK_NEVER_RETRY
 #define HYPERV_SPINLOCK_NEVER_RETRY             0xFFFFFFFF
commit e939c6ed619e2cf98c379318f6ee389c97163f18
Author: Eduardo Habkost <ehabkost at redhat.com>
Date:   Mon Mar 17 15:26:31 2014 -0300

    CODING_STYLE: Section about mixed declarations
    
    We had an unwritten rule about declarations having to be at beginning of
    blocks. Make it a written rule.
    
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/CODING_STYLE b/CODING_STYLE
index dcbce28..4280945 100644
--- a/CODING_STYLE
+++ b/CODING_STYLE
@@ -84,3 +84,10 @@ and clarity it comes on a line by itself:
 Rationale: a consistent (except for functions...) bracing style reduces
 ambiguity and avoids needless churn when lines are added or removed.
 Furthermore, it is the QEMU coding style.
+
+5. Declarations
+
+Mixed declarations (interleaving statements and declarations within blocks)
+are not allowed; declarations should be at the beginning of blocks.  In other
+words, the code should not generate warnings if using GCC's
+-Wdeclaration-after-statement option.
commit 340fb41b311356d66b280468698b1f2d7b0c1a56
Author: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
Date:   Mon Mar 17 21:46:26 2014 +0000

    doc: update default PowerPC framebuffer settings
    
    Since 1.7, the default framebuffer settings for PowerPC are 800x600x32.
    
    Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    CC: qemu-ppc at nongnu.org
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-doc.texi b/qemu-doc.texi
index 6d684e2..e6e20eb 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -1938,7 +1938,7 @@ The following options are specific to the PowerPC emulation:
 
 @item -g @var{W}x at var{H}[x at var{DEPTH}]
 
-Set the initial VGA graphic mode. The default is 800x600x15.
+Set the initial VGA graphic mode. The default is 800x600x32.
 
 @item -prom-env @var{string}
 
commit 33632788089531a4452976ff40bbb15551d37fea
Author: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
Date:   Mon Mar 17 21:46:25 2014 +0000

    doc: update sun4m documentation
    
    A few minor tidy-ups, plus add reference to the new -vga tcx and cg3 options.
    
    Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qemu-doc.texi b/qemu-doc.texi
index ad31f2d..6d684e2 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -1996,7 +1996,7 @@ QEMU emulates the following sun4m peripherals:
 @item
 IOMMU
 @item
-TCX Frame buffer
+TCX or cgthree Frame buffer
 @item
 Lance (Am7990) Ethernet
 @item
@@ -2023,7 +2023,7 @@ firmware implementation. The goal is to implement a 100% IEEE
 
 A sample Linux 2.6 series kernel and ram disk image are available on
 the QEMU web site. There are still issues with NetBSD and OpenBSD, but
-some kernel versions work. Please note that currently Solaris kernels
+some kernel versions work. Please note that currently older Solaris kernels
 don't work probably due to interface issues between OpenBIOS and
 Solaris.
 
@@ -2035,8 +2035,9 @@ The following options are specific to the Sparc32 emulation:
 
 @item -g @var{W}x at var{H}x[x at var{DEPTH}]
 
-Set the initial TCX graphic mode. The default is 1024x768x8, currently
-the only other possible mode is 1024x768x24.
+Set the initial graphics mode. For TCX, the default is 1024x768x8 with the
+option of 1024x768x24. For cgthree, the default is 1024x768x8 with the option
+of 1152x900x8 for people who wish to use OBP.
 
 @item -prom-env @var{string}
 
diff --git a/qemu-options.hx b/qemu-options.hx
index ee5437b..2d33815 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1043,7 +1043,7 @@ Rotate graphical output some deg left (only PXA LCD).
 ETEXI
 
 DEF("vga", HAS_ARG, QEMU_OPTION_vga,
-    "-vga [std|cirrus|vmware|qxl|xenfb|none]\n"
+    "-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|none]\n"
     "                select video card type\n", QEMU_ARCH_ALL)
 STEXI
 @item -vga @var{type}
@@ -1068,6 +1068,14 @@ card.
 QXL paravirtual graphic card.  It is VGA compatible (including VESA
 2.0 VBE support).  Works best with qxl guest drivers installed though.
 Recommended choice when using the spice protocol.
+ at item tcx
+(sun4m only) Sun TCX framebuffer. This is the default framebuffer for
+sun4m machines and offers both 8-bit and 24-bit colour depths at a
+fixed resolution of 1024x768.
+ at item cg3
+(sun4m only) Sun cgthree framebuffer. This is a simple 8-bit framebuffer
+for sun4m machines available in both 1024x768 (OpenBIOS) and 1152x900 (OBP)
+resolutions aimed at people wishing to run older Solaris versions.
 @item none
 Disable VGA card.
 @end table
commit b533f658a98325d0e47b36113bd9f5bcc046fdae
Author: Mario Smarduch <m.smarduch at samsung.com>
Date:   Wed Mar 19 10:24:26 2014 -0700

    fix return check for KVM_GET_DIRTY_LOG ioctl
    
    Fix return condition check from kvm_vm_ioctl(s, KVM_GET_DIRTY_LOG, &d) to
    handle internal failures or no support for memory slot dirty bitmap.
    Otherwise the ioctl succeeds and continues with migration.
    Addresses BUG# 1294227
    
    Signed-off-by: Mario Smarduch <m.smarduch at samsung.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/kvm-all.c b/kvm-all.c
index 82a9119..cd4111d 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -441,7 +441,7 @@ static int kvm_physical_sync_dirty_bitmap(MemoryRegionSection *section)
 
         d.slot = mem->slot;
 
-        if (kvm_vm_ioctl(s, KVM_GET_DIRTY_LOG, &d) == -1) {
+        if (kvm_vm_ioctl(s, KVM_GET_DIRTY_LOG, &d) < 0) {
             DPRINTF("ioctl failed %d\n", errno);
             ret = -1;
             break;
commit a443bc3496658c9e144ad914933607ebc8418979
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Mar 16 15:03:41 2014 +0100

    target-i386: Add missing 'static' and 'const' attributes
    
    This fixes warnings from the static code analysis (smatch).
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index e7e62c5..8fd1497 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -316,7 +316,7 @@ typedef struct X86RegisterInfo32 {
 
 #define REGISTER(reg) \
     [R_##reg] = { .name = #reg, .qapi_enum = X86_CPU_REGISTER32_##reg }
-X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
+static const X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
     REGISTER(EAX),
     REGISTER(ECX),
     REGISTER(EDX),
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 7a295f6..4389959 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -122,7 +122,7 @@ static struct kvm_cpuid2 *get_supported_cpuid(KVMState *s)
     return cpuid;
 }
 
-struct kvm_para_features {
+static const struct kvm_para_features {
     int cap;
     int feature;
 } para_features[] = {
commit 08cf99629d5de859aad0d54bafb2f18803a86dfe
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Mar 16 19:02:52 2014 +0100

    util: Add 'static' attribute to function implementation
    
    The static code analyzer smatch complains because of a missing 'static'
    attribute:
    
    util/module.c:166:6: warning:
     symbol 'module_load' was not declared. Should it be static?
    
    'static' is used in the forward declaration, but not in the implementation.
    Add it there, too.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/util/module.c b/util/module.c
index 863a8a3..214effb 100644
--- a/util/module.c
+++ b/util/module.c
@@ -163,7 +163,7 @@ out:
 }
 #endif
 
-void module_load(module_init_type type)
+static void module_load(module_init_type type)
 {
 #ifdef CONFIG_MODULES
     char *fname = NULL;
commit 06ab66cfab317741ab55d164ec3530c08ce1a547
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Mar 16 19:13:18 2014 +0100

    hw/ide: Add missing 'static' attributes
    
    This fixes a warning from the static code analysis (smatch).
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 91151fc..d8b1157 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -421,7 +421,7 @@ static const VMStateDescription vmstate_bmdma_current = {
     }
 };
 
-const VMStateDescription vmstate_bmdma_status = {
+static const VMStateDescription vmstate_bmdma_status = {
     .name ="ide bmdma/status",
     .version_id = 1,
     .minimum_version_id = 1,
commit 6df05bdd172d26b699fecf162c277286579f2c16
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Mar 16 19:07:55 2014 +0100

    target-arm: Add missing 'static' attribute
    
    This fixes a warning from the static code analysis (smatch).
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/target-arm/machine.c b/target-arm/machine.c
index 8f9e7d4..7ced87a 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -88,7 +88,7 @@ static bool m_needed(void *opaque)
     return arm_feature(env, ARM_FEATURE_M);
 }
 
-const VMStateDescription vmstate_m = {
+static const VMStateDescription vmstate_m = {
     .name = "cpu/m",
     .version_id = 1,
     .minimum_version_id = 1,
commit ecb4e01e3449074576ae866c4547b5ff3849ddd7
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Mar 16 14:49:11 2014 +0100

    target-s390x: Add missing 'static' and 'const' attributes
    
    This fixes warnings from the static code analysis (smatch).
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/target-s390x/arch_dump.c b/target-s390x/arch_dump.c
index 5cbb53c..a1554f5 100644
--- a/target-s390x/arch_dump.c
+++ b/target-s390x/arch_dump.c
@@ -123,7 +123,7 @@ static void s390x_write_elf64_prefix(Note *note, S390CPU *cpu)
 }
 
 
-struct NoteFuncDescStruct {
+static const struct NoteFuncDescStruct {
     int contents_size;
     void (*note_contents_func)(Note *note, S390CPU *cpu);
 } note_func[] = {
@@ -146,7 +146,7 @@ static int s390x_write_all_elf64_notes(const char *note_name,
                                        void *opaque)
 {
     Note note;
-    NoteFuncDesc *nf;
+    const NoteFuncDesc *nf;
     int note_size;
     int ret = -1;
 
@@ -192,7 +192,7 @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
     int name_size = 8; /* "CORE" or "QEMU" rounded */
     size_t elf_note_size = 0;
     int note_head_size;
-    NoteFuncDesc *nf;
+    const NoteFuncDesc *nf;
 
     assert(class == ELFCLASS64);
     assert(machine == EM_S390);
commit 76ac9940c3114db35df92582f3549d9a64a369c4
Author: Anton Blanchard <anton at samba.org>
Date:   Tue Mar 25 13:40:29 2014 +1100

    target-ppc: MSR_POW not supported on POWER7/7+/8
    
    Remove MSR_POW from the msr_mask for POWER7/7P/8.
    
    Signed-off-by: Anton Blanchard <anton at samba.org>
    Reviewed-by: Cédric Le Goater <clg at fr.ibm.com>
    Tested-by: Cédric Le Goater <clg at fr.ibm.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 87c00a1..d07e186 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7075,7 +7075,7 @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
                         PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 |
                         PPC2_ATOMIC_ISA206 | PPC2_FP_CVT_ISA206 |
                         PPC2_FP_TST_ISA206;
-    pcc->msr_mask = 0x800000000284FF37ULL;
+    pcc->msr_mask = 0x800000000280FF37ULL;
     pcc->mmu_model = POWERPC_MMU_2_06;
 #if defined(CONFIG_SOFTMMU)
     pcc->handle_mmu_fault = ppc_hash64_handle_mmu_fault;
@@ -7118,7 +7118,7 @@ POWERPC_FAMILY(POWER7P)(ObjectClass *oc, void *data)
                         PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 |
                         PPC2_ATOMIC_ISA206 | PPC2_FP_CVT_ISA206 |
                         PPC2_FP_TST_ISA206;
-    pcc->msr_mask = 0x800000000284FF37ULL;
+    pcc->msr_mask = 0x800000000280FF37ULL;
     pcc->mmu_model = POWERPC_MMU_2_06;
 #if defined(CONFIG_SOFTMMU)
     pcc->handle_mmu_fault = ppc_hash64_handle_mmu_fault;
@@ -7175,7 +7175,7 @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
                         PPC2_FP_TST_ISA206 | PPC2_BCTAR_ISA207 |
                         PPC2_LSQ_ISA207 | PPC2_ALTIVEC_207 |
                         PPC2_ISA205 | PPC2_ISA207S;
-    pcc->msr_mask = 0x800000000284FF37ULL;
+    pcc->msr_mask = 0x800000000280FF37ULL;
     pcc->mmu_model = POWERPC_MMU_2_06;
 #if defined(CONFIG_SOFTMMU)
     pcc->handle_mmu_fault = ppc_hash64_handle_mmu_fault;
commit 5b2b7dc4e5ed10d439d1aac86879299d9f620f5b
Author: Anton Blanchard <anton at samba.org>
Date:   Tue Mar 25 13:40:28 2014 +1100

    target-ppc: POWER7+ supports the MSR_VSX bit
    
    Without MSR_VSX we die early during a Linux boot.
    
    Signed-off-by: Anton Blanchard <anton at samba.org>
    Reviewed-by: Cédric Le Goater <clg at fr.ibm.com>
    Tested-by: Cédric Le Goater <clg at fr.ibm.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 4fda0fd..87c00a1 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7118,7 +7118,7 @@ POWERPC_FAMILY(POWER7P)(ObjectClass *oc, void *data)
                         PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 |
                         PPC2_ATOMIC_ISA206 | PPC2_FP_CVT_ISA206 |
                         PPC2_FP_TST_ISA206;
-    pcc->msr_mask = 0x800000000204FF37ULL;
+    pcc->msr_mask = 0x800000000284FF37ULL;
     pcc->mmu_model = POWERPC_MMU_2_06;
 #if defined(CONFIG_SOFTMMU)
     pcc->handle_mmu_fault = ppc_hash64_handle_mmu_fault;
commit 536492ebb3934a827a981be1f207cf7835a53c30
Author: Anton Blanchard <anton at samba.org>
Date:   Tue Mar 25 13:40:27 2014 +1100

    target-ppc: POWER8 supports isel
    
    Add PPC_ISEL to insns_flags.
    
    Signed-off-by: Anton Blanchard <anton at samba.org>
    Reviewed-by: Cédric Le Goater <clg at fr.ibm.com>
    Tested-by: Cédric Le Goater <clg at fr.ibm.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index a82c8f9..4fda0fd 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7157,7 +7157,7 @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
     pcc->pvr_mask = CPU_POWERPC_POWER8_MASK;
     pcc->init_proc = init_proc_POWER8;
     pcc->check_pow = check_pow_nocheck;
-    pcc->insns_flags = PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |
+    pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
                        PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
                        PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
                        PPC_FLOAT_FRSQRTES |
commit d6fb330f70831180c69899a4f8ba1a7a5fdce45c
Author: Anton Blanchard <anton at samba.org>
Date:   Tue Mar 25 13:40:26 2014 +1100

    target-ppc: POWER8 supports the MSR_LE bit
    
    Add MSR_LE to the msr_mask for POWER8.
    
    Signed-off-by: Anton Blanchard <anton at samba.org>
    Reviewed-by: Cédric Le Goater <clg at fr.ibm.com>
    Tested-by: Cédric Le Goater <clg at fr.ibm.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 7f53c33..a82c8f9 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7175,7 +7175,7 @@ POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
                         PPC2_FP_TST_ISA206 | PPC2_BCTAR_ISA207 |
                         PPC2_LSQ_ISA207 | PPC2_ALTIVEC_207 |
                         PPC2_ISA205 | PPC2_ISA207S;
-    pcc->msr_mask = 0x800000000284FF36ULL;
+    pcc->msr_mask = 0x800000000284FF37ULL;
     pcc->mmu_model = POWERPC_MMU_2_06;
 #if defined(CONFIG_SOFTMMU)
     pcc->handle_mmu_fault = ppc_hash64_handle_mmu_fault;
commit 6f1834a2baa2f2688efaa7756d000876c7898d13
Author: Prasad Joshi <prasadjoshi.linux at gmail.com>
Date:   Sun Mar 23 14:58:39 2014 +0530

    intc/openpic_kvm: Fix MemListener delete region callback function
    
    Fixes d85937e683f6ff4d68293cb24c780fb1f6820d2c.
    
    Signed-off-by: Prasad Joshi <prasadjoshi.linux at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/openpic_kvm.c b/hw/intc/openpic_kvm.c
index 87fdb12..afa604d 100644
--- a/hw/intc/openpic_kvm.c
+++ b/hw/intc/openpic_kvm.c
@@ -200,7 +200,7 @@ static void kvm_openpic_realize(DeviceState *dev, Error **errp)
     qdev_init_gpio_in(dev, kvm_openpic_set_irq, OPENPIC_MAX_IRQ);
 
     opp->mem_listener.region_add = kvm_openpic_region_add;
-    opp->mem_listener.region_add = kvm_openpic_region_del;
+    opp->mem_listener.region_del = kvm_openpic_region_del;
     memory_listener_register(&opp->mem_listener, &address_space_memory);
 
     /* indicate pic capabilities */
commit 9ad665df2a9eeb8ed6f3501896e45c1a3cd9dd5f
Merge: bea4acd 9013dca
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Mar 27 14:32:17 2014 +0000

    Merge remote-tracking branch 'remotes/amit-migration/tags/for_upstream' into staging
    
    migration: traces
    
    Adds trace messages to migration path.  Patches have been on list for a
    while, and have been reviewed by Juan.
    
    # gpg: Signature made Thu 27 Mar 2014 10:44:21 GMT using RSA key ID 854083B6
    # gpg: Can't check signature: public key not found
    
    * remotes/amit-migration/tags/for_upstream:
      migration: add more traces
      util: add qemu_ether_ntoa
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit a7a5544a3a59600f30f29985397f56ee40929850
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Mar 27 14:00:52 2014 +0000

    vl.c: Improve message when no default machine is found
    
    Improve the clarity of the message QEMU prints when the user
    doesn't specify a machine model to use and there is no default.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Marcel Apfelbaum <marcel.a at redhat.com>

diff --git a/vl.c b/vl.c
index 2355227..9975e5a 100644
--- a/vl.c
+++ b/vl.c
@@ -3929,7 +3929,8 @@ int main(int argc, char **argv, char **envp)
 #endif
 
     if (machine_class == NULL) {
-        fprintf(stderr, "No machine found.\n");
+        fprintf(stderr, "No machine specified, and there is no default.\n"
+                "Use -machine help to list supported machines!\n");
         exit(1);
     }
 
commit d4715c4183043c5e977f821b6f9ca88b17d90bbb
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Mar 27 14:00:52 2014 +0000

    hw/arm: Stop specifying integratorcp as the default board
    
    Currently for both qemu-system-arm and qemu-system-aarch64
    the default board model if the user doesn't specify one
    is the 'integratorcp'. This is a totally arbitrary historical
    accident since it was the first board to be modelled.
    That board is now just one target among many for us, and
    is a very poor choice of default:
     * it's an ancient board that is now only found in the
       junkpiles of longtime ARM/Linux hackers, if at all
     * it's an ARMv5 CPU, when most distros are now assuming
       ARMv7
     * it's pretty much unmaintained in QEMU
     * it doesn't even have versatilepb's advantage of
       supporting PCI
    
    Making it or any other board the default serves only
    to confuse people new to ARM who expect something more
    like the x86 monoculture. Remove the is_default marker
    from integratorcp, and don't set it for any other board,
    to give users a nudge that they need to think about
    which board they want a QEMU model of. (QEMU will produce
    the admittedly slightly cryptic error "No machine found.")
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index a759689..912af96 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -534,7 +534,6 @@ static QEMUMachine integratorcp_machine = {
     .name = "integratorcp",
     .desc = "ARM Integrator/CP (ARM926EJ-S)",
     .init = integratorcp_init,
-    .is_default = 1,
 };
 
 static void integratorcp_machine_init(void)
commit bea4acda3bff00e98cb00d5354f23de9e74a928f
Merge: db237e3 6a5b69a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Mar 27 10:54:17 2014 +0000

    Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into staging
    
    * remotes/mcayland/qemu-sparc:
      target-sparc: fix 32bit integer division overflow
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 9013dca5539186ddca018bebcf2d5da63d061365
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Tue Mar 11 10:42:29 2014 +1100

    migration: add more traces
    
    This replaces DPRINTF macro with tracepoints.
    
    This moves some messages from migration.c to savevm.c.
    
    This adds tracepoint to signal about fileds failed to migrate.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/migration.c b/migration.c
index e0e24d4..bd1fb91 100644
--- a/migration.c
+++ b/migration.c
@@ -26,16 +26,6 @@
 #include "qmp-commands.h"
 #include "trace.h"
 
-//#define DEBUG_MIGRATION
-
-#ifdef DEBUG_MIGRATION
-#define DPRINTF(fmt, ...) \
-    do { printf("migration: " fmt, ## __VA_ARGS__); } while (0)
-#else
-#define DPRINTF(fmt, ...) \
-    do { } while (0)
-#endif
-
 enum {
     MIG_STATE_ERROR = -1,
     MIG_STATE_NONE,
@@ -112,7 +102,6 @@ static void process_incoming_migration_co(void *opaque)
         exit(EXIT_FAILURE);
     }
     qemu_announce_self();
-    DPRINTF("successfully loaded vm state\n");
 
     bdrv_clear_incoming_migration_all();
     /* Make sure all file formats flush their mutable metadata */
@@ -306,7 +295,7 @@ static void migrate_fd_cleanup(void *opaque)
     s->cleanup_bh = NULL;
 
     if (s->file) {
-        DPRINTF("closing file\n");
+        trace_migrate_fd_cleanup();
         qemu_mutex_unlock_iothread();
         qemu_thread_join(&s->thread);
         qemu_mutex_lock_iothread();
@@ -329,7 +318,7 @@ static void migrate_fd_cleanup(void *opaque)
 
 void migrate_fd_error(MigrationState *s)
 {
-    DPRINTF("setting error state\n");
+    trace_migrate_fd_error();
     assert(s->file == NULL);
     s->state = MIG_STATE_ERROR;
     trace_migrate_set_state(MIG_STATE_ERROR);
@@ -339,7 +328,7 @@ void migrate_fd_error(MigrationState *s)
 static void migrate_fd_cancel(MigrationState *s)
 {
     int old_state ;
-    DPRINTF("cancelling migration\n");
+    trace_migrate_fd_cancel();
 
     do {
         old_state = s->state;
@@ -589,29 +578,23 @@ static void *migration_thread(void *opaque)
     int64_t start_time = initial_time;
     bool old_vm_running = false;
 
-    DPRINTF("beginning savevm\n");
     qemu_savevm_state_begin(s->file, &s->params);
 
     s->setup_time = qemu_clock_get_ms(QEMU_CLOCK_HOST) - setup_start;
     migrate_set_state(s, MIG_STATE_SETUP, MIG_STATE_ACTIVE);
 
-    DPRINTF("setup complete\n");
-
     while (s->state == MIG_STATE_ACTIVE) {
         int64_t current_time;
         uint64_t pending_size;
 
         if (!qemu_file_rate_limit(s->file)) {
-            DPRINTF("iterate\n");
             pending_size = qemu_savevm_state_pending(s->file, max_size);
-            DPRINTF("pending size %" PRIu64 " max %" PRIu64 "\n",
-                    pending_size, max_size);
+            trace_migrate_pending(pending_size, max_size);
             if (pending_size && pending_size >= max_size) {
                 qemu_savevm_state_iterate(s->file);
             } else {
                 int ret;
 
-                DPRINTF("done iterating\n");
                 qemu_mutex_lock_iothread();
                 start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
                 qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER);
@@ -650,9 +633,8 @@ static void *migration_thread(void *opaque)
             s->mbps = time_spent ? (((double) transferred_bytes * 8.0) /
                     ((double) time_spent / 1000.0)) / 1000.0 / 1000.0 : -1;
 
-            DPRINTF("transferred %" PRIu64 " time_spent %" PRIu64
-                    " bandwidth %g max_size %" PRId64 "\n",
-                    transferred_bytes, time_spent, bandwidth, max_size);
+            trace_migrate_transferred(transferred_bytes, time_spent,
+                                      bandwidth, max_size);
             /* if we haven't sent anything, we don't want to recalculate
                10000 is a small enough number for our purposes */
             if (s->dirty_bytes_rate && transferred_bytes > 10000) {
diff --git a/qemu-file.c b/qemu-file.c
index e5ec798..8d5f45d 100644
--- a/qemu-file.c
+++ b/qemu-file.c
@@ -4,6 +4,7 @@
 #include "block/coroutine.h"
 #include "migration/migration.h"
 #include "migration/qemu-file.h"
+#include "trace.h"
 
 #define IO_BUF_SIZE 32768
 #define MAX_IOV_SIZE MIN(IOV_MAX, 64)
@@ -595,6 +596,7 @@ int qemu_fclose(QEMUFile *f)
         ret = f->last_error;
     }
     g_free(f);
+    trace_qemu_file_fclose();
     return ret;
 }
 
diff --git a/savevm.c b/savevm.c
index d094fbb..22123be 100644
--- a/savevm.c
+++ b/savevm.c
@@ -81,6 +81,7 @@ static void qemu_announce_self_iter(NICState *nic, void *opaque)
     uint8_t buf[60];
     int len;
 
+    trace_qemu_announce_self_iter(qemu_ether_ntoa(&nic->conf->macaddr));
     len = announce_self_create(buf, nic->conf->macaddr.a);
 
     qemu_send_packet_raw(qemu_get_queue(nic), buf, len);
@@ -429,6 +430,7 @@ void vmstate_unregister(DeviceState *dev, const VMStateDescription *vmsd,
 
 static int vmstate_load(QEMUFile *f, SaveStateEntry *se, int version_id)
 {
+    trace_vmstate_load(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
     if (!se->vmsd) {         /* Old style */
         return se->ops->load_state(f, se->opaque, version_id);
     }
@@ -437,6 +439,7 @@ static int vmstate_load(QEMUFile *f, SaveStateEntry *se, int version_id)
 
 static void vmstate_save(QEMUFile *f, SaveStateEntry *se)
 {
+    trace_vmstate_save(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
     if (!se->vmsd) {         /* Old style */
         se->ops->save_state(f, se->opaque);
         return;
@@ -463,6 +466,7 @@ void qemu_savevm_state_begin(QEMUFile *f,
     SaveStateEntry *se;
     int ret;
 
+    trace_savevm_state_begin();
     QTAILQ_FOREACH(se, &savevm_handlers, entry) {
         if (!se->ops || !se->ops->set_params) {
             continue;
@@ -515,6 +519,7 @@ int qemu_savevm_state_iterate(QEMUFile *f)
     SaveStateEntry *se;
     int ret = 1;
 
+    trace_savevm_state_iterate();
     QTAILQ_FOREACH(se, &savevm_handlers, entry) {
         if (!se->ops || !se->ops->save_live_iterate) {
             continue;
@@ -554,6 +559,8 @@ void qemu_savevm_state_complete(QEMUFile *f)
     SaveStateEntry *se;
     int ret;
 
+    trace_savevm_state_complete();
+
     cpu_synchronize_all_states();
 
     QTAILQ_FOREACH(se, &savevm_handlers, entry) {
@@ -628,6 +635,7 @@ void qemu_savevm_state_cancel(void)
 {
     SaveStateEntry *se;
 
+    trace_savevm_state_cancel();
     QTAILQ_FOREACH(se, &savevm_handlers, entry) {
         if (se->ops && se->ops->cancel) {
             se->ops->cancel(se->opaque);
diff --git a/trace-events b/trace-events
index 3b7ff4d..3df3f32 100644
--- a/trace-events
+++ b/trace-events
@@ -1042,6 +1042,17 @@ vmware_setmode(uint32_t w, uint32_t h, uint32_t bpp) "%dx%d @ %d bpp"
 # savevm.c
 savevm_section_start(const char *id, unsigned int section_id) "%s, section_id %u"
 savevm_section_end(const char *id, unsigned int section_id) "%s, section_id %u"
+savevm_state_begin(void) ""
+savevm_state_iterate(void) ""
+savevm_state_complete(void) ""
+savevm_state_cancel(void) ""
+vmstate_save(const char *idstr, const char *vmsd_name) "%s, %s"
+vmstate_load(const char *idstr, const char *vmsd_name) "%s, %s"
+vmstate_load_field_error(const char *field, int ret) "field \"%s\" load failed, ret = %d"
+qemu_announce_self_iter(const char *mac) "%s"
+
+# qemu-file.c
+qemu_file_fclose(void) ""
 
 # arch_init.c
 migration_bitmap_sync_start(void) ""
@@ -1181,6 +1192,11 @@ flic_reset_failed(int err) "flic: reset failed %d"
 
 # migration.c
 migrate_set_state(int new_state) "new state %d"
+migrate_fd_cleanup(void) ""
+migrate_fd_error(void) ""
+migrate_fd_cancel(void) ""
+migrate_pending(uint64_t size, uint64_t max) "pending size %" PRIu64 " max %" PRIu64
+migrate_transferred(uint64_t tranferred, uint64_t time_spent, double bandwidth, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %g max_size %" PRId64
 
 # kvm-all.c
 kvm_ioctl(int type, void *arg) "type 0x%x, arg %p"
diff --git a/vmstate.c b/vmstate.c
index d1f5eb0..b689f2f 100644
--- a/vmstate.c
+++ b/vmstate.c
@@ -3,6 +3,7 @@
 #include "migration/qemu-file.h"
 #include "migration/vmstate.h"
 #include "qemu/bitops.h"
+#include "trace.h"
 
 static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
                                     void *opaque);
@@ -73,6 +74,7 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
 
                 }
                 if (ret < 0) {
+                    trace_vmstate_load_field_error(field->name, ret);
                     return ret;
                 }
             }
commit 4297c8ee6f0ef70e5a71e3387a0fccaa20b04f94
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Tue Mar 11 10:42:26 2014 +1100

    util: add qemu_ether_ntoa
    
    This adds a helper to format ethernet MAC address.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/include/qemu-common.h b/include/qemu-common.h
index c8a58a8..a998e8d 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -472,4 +472,6 @@ size_t buffer_find_nonzero_offset(const void *buf, size_t len);
  */
 int parse_debug_env(const char *name, int max, int initial);
 
+const char *qemu_ether_ntoa(const MACAddr *mac);
+
 #endif
diff --git a/util/cutils.c b/util/cutils.c
index 0116fcd..b337293 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -27,6 +27,7 @@
 
 #include "qemu/sockets.h"
 #include "qemu/iov.h"
+#include "net/net.h"
 
 void strpadcpy(char *buf, int buf_size, const char *str, char pad)
 {
@@ -530,3 +531,16 @@ int parse_debug_env(const char *name, int max, int initial)
     }
     return debug;
 }
+
+/*
+ * Helper to print ethernet mac address
+ */
+const char *qemu_ether_ntoa(const MACAddr *mac)
+{
+    static char ret[18];
+
+    snprintf(ret, sizeof(ret), "%02x:%02x:%02x:%02x:%02x:%02x",
+             mac->a[0], mac->a[1], mac->a[2], mac->a[3], mac->a[4], mac->a[5]);
+
+    return ret;
+}
commit 6a5b69a959483c7404576a7dc54221ced41e6515
Author: Olivier Danet <odanet at caramail.com>
Date:   Fri Mar 21 02:25:19 2014 +0100

    target-sparc: fix 32bit integer division overflow
    
    The signed integer division -0x8000_0000_0000_0000 / -1 must be handled
    separately to avoid an overflow on the QEMU host.
    
    Negative overflow must be a negative number for correct sign
    extension in Sparc64 mode. Use <stdint.h> constants.
    
    Signed-off-by: Olivier Danet <odanet at caramail.com>
    Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>

diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index f3c7fbf..ae7740b 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -85,8 +85,8 @@ static target_ulong helper_udiv_common(CPUSPARCState *env, target_ulong a,
     }
 
     x0 = x0 / x1;
-    if (x0 > 0xffffffff) {
-        x0 = 0xffffffff;
+    if (x0 > UINT32_MAX) {
+        x0 = UINT32_MAX;
         overflow = 1;
     }
 
@@ -122,12 +122,15 @@ static target_ulong helper_sdiv_common(CPUSPARCState *env, target_ulong a,
     if (x1 == 0) {
         cpu_restore_state(CPU(cpu), GETPC());
         helper_raise_exception(env, TT_DIV_ZERO);
-    }
-
-    x0 = x0 / x1;
-    if ((int32_t) x0 != x0) {
-        x0 = x0 < 0 ? 0x80000000 : 0x7fffffff;
+    } else if (x1 == -1 && x0 == INT64_MIN) {
+        x0 = INT32_MAX;
         overflow = 1;
+    } else {
+        x0 = x0 / x1;
+        if ((int32_t) x0 != x0) {
+            x0 = x0 < 0 ? INT32_MIN : INT32_MAX;
+            overflow = 1;
+        }
     }
 
     if (cc) {
commit db237e33c08a279f0179f8f5128a6d10d9adc38a
Merge: 61898bc ad1c7e0
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Wed Mar 26 17:10:15 2014 +0000

    Merge remote-tracking branch 'remotes/riku/for-2.0' into staging
    
    * remotes/riku/for-2.0:
      linux-user: Correct DLINFO_ITEMS
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 61898bc020c3367c629a99a2abdaa1c60fce76cd
Merge: 0a87466 ec8929a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Wed Mar 26 16:17:36 2014 +0000

    Merge remote-tracking branch 'remotes/bonzini/scsi-next' into staging
    
    * remotes/bonzini/scsi-next:
      spapr_vscsi: remove duplicate condition check
      scsi: check req pointer before dereferencing it
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 0a87466ef3fe3d9a062195f801727569ab886bde
Merge: 0acf0a5 f7bc8ef
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Wed Mar 26 15:15:19 2014 +0000

    Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
    
    acpi,virtio bug fixes
    
    Two bugfixes for virtio-net, and one for a recent
    regression in acpi.
    Both issues have been reported in the wild, so
    I think it's preferable to merge these ASAP so
    that reporters can make sure RC fixes their issue.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Wed 26 Mar 2014 10:52:16 GMT using RSA key ID D28D5469
    # gpg: Good signature from "Michael S. Tsirkin <mst at kernel.org>"
    # gpg:                 aka "Michael S. Tsirkin <mst at redhat.com>"
    
    * remotes/mst/tags/for_upstream:
      virtio-net: add vlan receive state to RxFilterInfo
      virtio-net: Do not filter VLANs without F_CTRL_VLAN
      Revert "acpi-test: rebuild SSDT"
      acpi: make SSDT 1.0 spec compliant when possible
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 0acf0a50c8ae6a4e146e00df5dba9f763d7b75a6
Merge: 7f6613c bbbf9bf
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Wed Mar 26 14:07:25 2014 +0000

    Merge remote-tracking branch 'remotes/weil/qemu-2.0' into staging
    
    * remotes/weil/qemu-2.0:
      gtk: Support GTK without VTE
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit ec8929a55512606456e364ffa80586219f67c904
Author: Prasad Joshi <prasadjoshi.linux at gmail.com>
Date:   Mon Mar 24 21:14:46 2014 +0530

    spapr_vscsi: remove duplicate condition check
    
    Signed-off-by: Prasad Joshi <prasadjoshi.linux at gmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 34478f0..d4ada4f 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -690,7 +690,7 @@ static void vscsi_inquiry_no_target(VSCSIState *s, vscsi_req *req)
     int rc, len, alen;
 
     /* We dont do EVPD. Also check that page_code is 0 */
-    if ((cdb[1] & 0x01) || (cdb[1] & 0x01) || cdb[2] != 0) {
+    if ((cdb[1] & 0x01) || cdb[2] != 0) {
         /* Send INVALID FIELD IN CDB */
         vscsi_makeup_sense(s, req, ILLEGAL_REQUEST, 0x24, 0);
         vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);
commit b0f49d138777fb6609aa2ea96d2c59fb872d2c2d
Author: Prasad Joshi <prasadjoshi.linux at gmail.com>
Date:   Wed Mar 19 07:10:32 2014 +0530

    scsi: check req pointer before dereferencing it
    
    Signed-off-by: Prasad Joshi <prasadjoshi.linux at gmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 7d344b9..e35bff7 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -479,12 +479,13 @@ static void
 pvscsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 {
     PVSCSIRequest *pvscsi_req = req->hba_private;
-    PVSCSIState *s = pvscsi_req->dev;
+    PVSCSIState *s;
 
     if (!pvscsi_req) {
         trace_pvscsi_command_complete_not_found(req->tag);
         return;
     }
+    s = pvscsi_req->dev;
 
     if (resid) {
         /* Short transfer.  */
commit ad1c7e0faac82eeb654cba7f99d4e6d88273e0f9
Author: James Hogan <james.hogan at imgtec.com>
Date:   Tue Mar 25 21:47:28 2014 +0000

    linux-user: Correct DLINFO_ITEMS
    
    Commit a07c67dfccb1 (Implement AT_CLKTCK.) back in March 2008 added a
    new auxvec entry but didn't increment DLINFO_ITEMS, so it's been out of
    sync ever since.
    
    Bump it up to 14 so that it matches the number of NEW_AUX_ENT's that
    need to be counted in create_elf_tables().
    
    Signed-off-by: James Hogan <james.hogan at imgtec.com>
    Cc: Riku Voipio <riku.voipio at iki.fi>
    Cc: Paul Brook <paul at codesourcery.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 99a2c58..d2380b6 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1076,7 +1076,7 @@ struct exec
 #define TARGET_ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(TARGET_ELF_EXEC_PAGESIZE-1))
 #define TARGET_ELF_PAGEOFFSET(_v) ((_v) & (TARGET_ELF_EXEC_PAGESIZE-1))
 
-#define DLINFO_ITEMS 13
+#define DLINFO_ITEMS 14
 
 static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)
 {
commit f7bc8ef8091229a4bec0e2a40af90abb8dcb3834
Author: Amos Kong <akong at redhat.com>
Date:   Wed Mar 26 08:19:43 2014 +0800

    virtio-net: add vlan receive state to RxFilterInfo
    
    Stefan Fritsch just fixed a virtio-net driver bug [1], virtio-net won't
    filter out VLAN-tagged packets if VIRTIO_NET_F_CTRL_VLAN isn't negotiated.
    
    This patch added a new field to @RxFilterInfo to indicate vlan receive
    state ('normal', 'none', 'all'). If VIRTIO_NET_F_CTRL_VLAN isn't
    negotiated, vlan receive state will be 'all', then all VLAN-tagged packets
    will be received by guest.
    
    This patch also fixed a boundary issue in visiting vlan table.
    
    [1] http://lists.nongnu.org/archive/html/qemu-devel/2014-02/msg02604.html
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 33fb799..439477b 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -222,13 +222,33 @@ static char *mac_strdup_printf(const uint8_t *mac)
                             mac[1], mac[2], mac[3], mac[4], mac[5]);
 }
 
+static intList *get_vlan_table(VirtIONet *n)
+{
+    intList *list, *entry;
+    int i, j;
+
+    list = NULL;
+    for (i = 0; i < MAX_VLAN >> 5; i++) {
+        for (j = 0; n->vlans[i] && j <= 0x1f; j++) {
+            if (n->vlans[i] & (1U << j)) {
+                entry = g_malloc0(sizeof(*entry));
+                entry->value = (i << 5) + j;
+                entry->next = list;
+                list = entry;
+            }
+        }
+    }
+
+    return list;
+}
+
 static RxFilterInfo *virtio_net_query_rxfilter(NetClientState *nc)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
+    VirtIODevice *vdev = VIRTIO_DEVICE(n);
     RxFilterInfo *info;
     strList *str_list, *entry;
-    intList *int_list, *int_entry;
-    int i, j;
+    int i;
 
     info = g_malloc0(sizeof(*info));
     info->name = g_strdup(nc->name);
@@ -273,19 +293,15 @@ static RxFilterInfo *virtio_net_query_rxfilter(NetClientState *nc)
         str_list = entry;
     }
     info->multicast_table = str_list;
+    info->vlan_table = get_vlan_table(n);
 
-    int_list = NULL;
-    for (i = 0; i < MAX_VLAN >> 5; i++) {
-        for (j = 0; n->vlans[i] && j < 0x1f; j++) {
-            if (n->vlans[i] & (1U << j)) {
-                int_entry = g_malloc0(sizeof(*int_entry));
-                int_entry->value = (i << 5) + j;
-                int_entry->next = int_list;
-                int_list = int_entry;
-            }
-        }
+    if (!((1 << VIRTIO_NET_F_CTRL_VLAN) & vdev->guest_features)) {
+        info->vlan = RX_STATE_ALL;
+    } else if (!info->vlan_table) {
+        info->vlan = RX_STATE_NONE;
+    } else {
+        info->vlan = RX_STATE_NORMAL;
     }
-    info->vlan_table = int_list;
 
     /* enable event notification after query */
     nc->rxfilter_notify_enabled = 1;
diff --git a/qapi-schema.json b/qapi-schema.json
index b68cd44..391356f 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -4184,6 +4184,8 @@
 #
 # @unicast: unicast receive state
 #
+# @vlan: vlan receive state (Since 2.0)
+#
 # @broadcast-allowed: whether to receive broadcast
 #
 # @multicast-overflow: multicast table is overflowed or not
@@ -4207,6 +4209,7 @@
     'promiscuous':        'bool',
     'multicast':          'RxState',
     'unicast':            'RxState',
+    'vlan':               'RxState',
     'broadcast-allowed':  'bool',
     'multicast-overflow': 'bool',
     'unicast-overflow':   'bool',
diff --git a/qmp-commands.hx b/qmp-commands.hx
index a22621f..ed3ab92 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -3407,6 +3407,7 @@ Each array entry contains the following:
 - "promiscuous": promiscuous mode is enabled (json-bool)
 - "multicast": multicast receive state (one of 'normal', 'none', 'all')
 - "unicast": unicast receive state  (one of 'normal', 'none', 'all')
+- "vlan": vlan receive state (one of 'normal', 'none', 'all') (Since 2.0)
 - "broadcast-allowed": allow to receive broadcast (json-bool)
 - "multicast-overflow": multicast table is overflowed (json-bool)
 - "unicast-overflow": unicast table is overflowed (json-bool)
@@ -3424,6 +3425,7 @@ Example:
             "name": "vnet0",
             "main-mac": "52:54:00:12:34:56",
             "unicast": "normal",
+            "vlan": "normal",
             "vlan-table": [
                 4,
                 0
commit 0b1eaa8803e680de9a05727355dfe3d306b81e17
Author: Stefan Fritsch <sf at sfritsch.de>
Date:   Wed Mar 26 18:29:52 2014 +0800

    virtio-net: Do not filter VLANs without F_CTRL_VLAN
    
    If VIRTIO_NET_F_CTRL_VLAN is not negotiated, do not filter out all
    VLAN-tagged packets but send them to the guest.
    
    This fixes VLANs with OpenBSD guests (and probably NetBSD, too, because
    the OpenBSD driver started as a port from NetBSD).
    
    Signed-off-by: Stefan Fritsch <sf at sfritsch.de>
    Signed-off-by: Amos Kong <akong at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index fd23c46..33fb799 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -514,6 +514,12 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint32_t features)
         }
         vhost_net_ack_features(tap_get_vhost_net(nc->peer), features);
     }
+
+    if ((1 << VIRTIO_NET_F_CTRL_VLAN) & features) {
+        memset(n->vlans, 0, MAX_VLAN >> 3);
+    } else {
+        memset(n->vlans, 0xff, MAX_VLAN >> 3);
+    }
 }
 
 static int virtio_net_handle_rx_mode(VirtIONet *n, uint8_t cmd,
commit 53a786acac7b4d53288d603504021d928f734513
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Wed Mar 26 12:42:31 2014 +0200

    Revert "acpi-test: rebuild SSDT"
    
    This reverts commit d07e0e9cddf02dd2abedbbf7ab0e069c8f5dabfd.
    
    Since
    commit b4f4d54812624581ce429c805e5179c78222c707
        acpi: make SSDT 1.0 spec compliant when possible
    We are back to old encoding.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/tests/acpi-test-data/pc/SSDT b/tests/acpi-test-data/pc/SSDT
index 727853e..6444f60 100644
Binary files a/tests/acpi-test-data/pc/SSDT and b/tests/acpi-test-data/pc/SSDT differ
diff --git a/tests/acpi-test-data/q35/SSDT b/tests/acpi-test-data/q35/SSDT
index c7e20ff..9199638 100644
Binary files a/tests/acpi-test-data/q35/SSDT and b/tests/acpi-test-data/q35/SSDT differ
commit b4f4d54812624581ce429c805e5179c78222c707
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Wed Mar 26 12:31:31 2014 +0200

    acpi: make SSDT 1.0 spec compliant when possible
    
    The ACPI specification says:
    
    The ASL compiler can emit two different AML opcodes for a Package
    declaration, either PackageOp or VarPackageOp. For small, fixed-length
    packages, the PackageOp is used and this opcode is compatible with ACPI
    1.0. A VarPackageOp will be emitted if any of the following conditions
    are true:
    . The NumElements argument is a TermArg that can only be resolved at
    runtime.
    . At compile time, NumElements resolves to a constant that is larger than
    255.
    . The PackageList contains more than 255 initializer elements.
    Note: The ability to create variable-sized packages was first introduced
    in ACPI 2.0. ACPI 1.0 only allowed fixed-size packages with up to 255 elements.
    
    So the spec seems to say a fixed value up to 255 must always
    be used with PackageOp and not VarPackageOp, and some guests
    (windows up to win2k8) seem to interpret it like this.
    
    Let's do just this, choosing the encoding depending on
    the number of elements.
    
    Fixes 9bcc80cd71892df42605e0c097d85c0237ff45d1
    (i386/acpi-build: allow more than 255 elements in CPON).
    
    https://bugs.launchpad.net/bugs/1297651
    
    Reported-by: Robert Hu <robert.hu at intel.com>
    Cc: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index f1054dd..7597517 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1055,9 +1055,21 @@ build_ssdt(GArray *table_data, GArray *linker,
 
         {
             GArray *package = build_alloc_array();
-            uint8_t op = 0x13; /* VarPackageOp */
+            uint8_t op;
+
+            /*
+             * Note: The ability to create variable-sized packages was first introduced in ACPI 2.0. ACPI 1.0 only
+             * allowed fixed-size packages with up to 255 elements.
+             * Windows guests up to win2k8 fail when VarPackageOp is used.
+             */
+            if (acpi_cpus <= 255) {
+                op = 0x12; /* PackageOp */
+                build_append_byte(package, acpi_cpus); /* NumElements */
+            } else {
+                op = 0x13; /* VarPackageOp */
+                build_append_int(package, acpi_cpus); /* VarNumElements */
+            }
 
-            build_append_int(package, acpi_cpus); /* VarNumElements */
             for (i = 0; i < acpi_cpus; i++) {
                 uint8_t b = test_bit(i, cpu->found_cpus) ? 0x01 : 0x00;
                 build_append_byte(package, b);
commit bbbf9bfb9c27e389340cf50a11c22fa46c572150
Author: Stefan Weil <sw at weilnetz.de>
Date:   Wed Feb 19 07:04:34 2014 +0100

    gtk: Support GTK without VTE
    
    GTK without VTE is needed for hosts which don't support VTE (for example
    all variants of MinGW), but it can also be reasonable for other hosts.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/configure b/configure
index aae617e..5eaa802 100755
--- a/configure
+++ b/configure
@@ -318,6 +318,7 @@ glusterfs_zerofill="no"
 virtio_blk_data_plane=""
 gtk=""
 gtkabi="2.0"
+vte=""
 tpm="no"
 libssh2=""
 vhdx=""
@@ -1063,6 +1064,10 @@ for opt do
   ;;
   --with-gtkabi=*) gtkabi="$optarg"
   ;;
+  --disable-vte) vte="no"
+  ;;
+  --enable-vte) vte="yes"
+  ;;
   --enable-tpm) tpm="yes"
   ;;
   --disable-libssh2) libssh2="no"
@@ -1946,30 +1951,41 @@ if test "$gtk" != "no"; then
     gtkpackage="gtk+-$gtkabi"
     if test "$gtkabi" = "3.0" ; then
       gtkversion="3.0.0"
+    else
+      gtkversion="2.18.0"
+    fi
+    if $pkg_config --exists "$gtkpackage >= $gtkversion"; then
+        gtk_cflags=`$pkg_config --cflags $gtkpackage`
+        gtk_libs=`$pkg_config --libs $gtkpackage`
+        libs_softmmu="$gtk_libs $libs_softmmu"
+        gtk="yes"
+    elif test "$gtk" = "yes"; then
+        feature_not_found "gtk" "Install gtk2 or gtk3 (requires --with-gtkabi=3.0 option to configure) devel"
+    else
+        gtk="no"
+    fi
+fi
+
+##########################################
+# VTE probe
+
+if test "$vte" != "no"; then
+    if test "$gtkabi" = "3.0"; then
       vtepackage="vte-2.90"
       vteversion="0.32.0"
     else
-      gtkversion="2.18.0"
       vtepackage="vte"
       vteversion="0.24.0"
     fi
-    if ! $pkg_config --exists "$gtkpackage >= $gtkversion"; then
-        if test "$gtk" = "yes" ; then
-            feature_not_found "gtk" "Install gtk2 or gtk3 (requires --with-gtkabi=3.0 option to configure) devel"
-        fi
-        gtk="no"
-    elif ! $pkg_config --exists "$vtepackage >= $vteversion"; then
-        if test "$gtk" = "yes" ; then
-            error_exit "libvte not found (required for gtk support)"
-        fi
-        gtk="no"
+    if $pkg_config --exists "$vtepackage >= $vteversion"; then
+        vte_cflags=`$pkg_config --cflags $vtepackage`
+        vte_libs=`$pkg_config --libs $vtepackage`
+        libs_softmmu="$vte_libs $libs_softmmu"
+        vte="yes"
+    elif test "$vte" = "yes"; then
+        feature_not_found "vte" "Install libvte or libvte-2.90 (requires --with-gtkabi=3.0 option to configure) devel"
     else
-	gtk_cflags=`$pkg_config --cflags $gtkpackage`
-	gtk_libs=`$pkg_config --libs $gtkpackage`
-	vte_cflags=`$pkg_config --cflags $vtepackage`
-	vte_libs=`$pkg_config --libs $vtepackage`
-	libs_softmmu="$gtk_libs $vte_libs $libs_softmmu"
-	gtk="yes"
+        vte="no"
     fi
 fi
 
@@ -4053,6 +4069,7 @@ fi
 echo "pixman            $pixman"
 echo "SDL support       $sdl"
 echo "GTK support       $gtk"
+echo "VTE support       $vte"
 echo "curses support    $curses"
 echo "curl support      $curl"
 echo "mingw32 support   $mingw32"
@@ -4381,6 +4398,9 @@ echo "GLIB_CFLAGS=$glib_cflags" >> $config_host_mak
 if test "$gtk" = "yes" ; then
   echo "CONFIG_GTK=y" >> $config_host_mak
   echo "GTK_CFLAGS=$gtk_cflags" >> $config_host_mak
+fi
+if test "$vte" = "yes" ; then
+  echo "CONFIG_VTE=y" >> $config_host_mak
   echo "VTE_CFLAGS=$vte_cflags" >> $config_host_mak
 fi
 if test "$xen" = "yes" ; then
diff --git a/ui/gtk.c b/ui/gtk.c
index baabf86..f056e40 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -54,7 +54,9 @@
 #include <gdk/gdkkeysyms.h>
 #include <glib/gi18n.h>
 #include <locale.h>
+#if defined(CONFIG_VTE)
 #include <vte/vte.h>
+#endif
 #include <math.h>
 
 #include "trace.h"
@@ -68,6 +70,9 @@
 
 #define MAX_VCS 10
 
+#if !defined(CONFIG_VTE)
+# define VTE_CHECK_VERSION(a, b, c) 0
+#endif
 
 /* Compatibility define to let us build on both Gtk2 and Gtk3 */
 #if GTK_CHECK_VERSION(3, 0, 0)
@@ -105,8 +110,10 @@ typedef struct VirtualConsole
 {
     GtkWidget *menu_item;
     GtkWidget *terminal;
+#if defined(CONFIG_VTE)
     GtkWidget *scrolled_window;
     CharDriverState *chr;
+#endif
     int fd;
 } VirtualConsole;
 
@@ -1063,6 +1070,7 @@ static void gd_change_page(GtkNotebook *nb, gpointer arg1, guint arg2,
     if (arg2 == 0) {
         gtk_check_menu_item_set_active(GTK_CHECK_MENU_ITEM(s->vga_item), TRUE);
     } else {
+#if defined(CONFIG_VTE)
         VirtualConsole *vc = &s->vc[arg2 - 1];
         VteTerminal *term = VTE_TERMINAL(vc->terminal);
         int width, height;
@@ -1072,6 +1080,9 @@ static void gd_change_page(GtkNotebook *nb, gpointer arg1, guint arg2,
 
         gtk_check_menu_item_set_active(GTK_CHECK_MENU_ITEM(vc->menu_item), TRUE);
         gtk_widget_set_size_request(vc->terminal, width, height);
+#else
+        g_assert_not_reached();
+#endif
     }
 
     gtk_widget_set_sensitive(s->grab_item, on_vga);
@@ -1117,7 +1128,7 @@ static int gd_vc_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
 {
     VirtualConsole *vc = chr->opaque;
 
-    return write(vc->fd, buf, len);
+    return vc ? write(vc->fd, buf, len) : len;
 }
 
 static int nb_vcs;
@@ -1142,6 +1153,7 @@ void early_gtk_display_init(void)
     register_vc_handler(gd_vc_handler);
 }
 
+#if defined(CONFIG_VTE)
 static gboolean gd_vc_in(GIOChannel *chan, GIOCondition cond, void *opaque)
 {
     VirtualConsole *vc = opaque;
@@ -1157,10 +1169,12 @@ static gboolean gd_vc_in(GIOChannel *chan, GIOCondition cond, void *opaque)
 
     return TRUE;
 }
+#endif
 
 static GSList *gd_vc_init(GtkDisplayState *s, VirtualConsole *vc, int index, GSList *group,
                           GtkWidget *view_menu)
 {
+#if defined(CONFIG_VTE)
     const char *label;
     char buffer[32];
     char path[32];
@@ -1230,6 +1244,7 @@ static GSList *gd_vc_init(GtkDisplayState *s, VirtualConsole *vc, int index, GSL
     chan = g_io_channel_unix_new(vc->fd);
     g_io_add_watch(chan, G_IO_IN, gd_vc_in, vc);
 
+#endif /* CONFIG_VTE */
     return group;
 }
 
commit 7f6613cedc59fa849105668ae971dc31004bca1c
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Tue Mar 25 14:35:18 2014 +0100

    target-mips: fix MTHC1 and MFHC1 when FPU in FR=0 mode
    
    Previous implementation presumed that FPU registers are 64-bit and are
    working in 64-bit mode. This change first checks MIPS_HFLAG_F64 and if not
    set, it does load/store from the odd numbered register pair.
    Patch by Matthew Fortune.
    
    Signed-off-by: Matthew Fortune <matthew.fortune at imgtec.com>
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-mips/translate.c b/target-mips/translate.c
index 71dccae..05f82d2 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -1216,20 +1216,28 @@ static void gen_store_fpr32(TCGv_i32 t, int reg)
     tcg_temp_free_i64(t64);
 }
 
-static void gen_load_fpr32h(TCGv_i32 t, int reg)
+static void gen_load_fpr32h(DisasContext *ctx, TCGv_i32 t, int reg)
 {
-    TCGv_i64 t64 = tcg_temp_new_i64();
-    tcg_gen_shri_i64(t64, fpu_f64[reg], 32);
-    tcg_gen_trunc_i64_i32(t, t64);
-    tcg_temp_free_i64(t64);
+    if (ctx->hflags & MIPS_HFLAG_F64) {
+        TCGv_i64 t64 = tcg_temp_new_i64();
+        tcg_gen_shri_i64(t64, fpu_f64[reg], 32);
+        tcg_gen_trunc_i64_i32(t, t64);
+        tcg_temp_free_i64(t64);
+    } else {
+        gen_load_fpr32(t, reg | 1);
+    }
 }
 
-static void gen_store_fpr32h(TCGv_i32 t, int reg)
+static void gen_store_fpr32h(DisasContext *ctx, TCGv_i32 t, int reg)
 {
-    TCGv_i64 t64 = tcg_temp_new_i64();
-    tcg_gen_extu_i32_i64(t64, t);
-    tcg_gen_deposit_i64(fpu_f64[reg], fpu_f64[reg], t64, 32, 32);
-    tcg_temp_free_i64(t64);
+    if (ctx->hflags & MIPS_HFLAG_F64) {
+        TCGv_i64 t64 = tcg_temp_new_i64();
+        tcg_gen_extu_i32_i64(t64, t);
+        tcg_gen_deposit_i64(fpu_f64[reg], fpu_f64[reg], t64, 32, 32);
+        tcg_temp_free_i64(t64);
+    } else {
+        gen_store_fpr32(t, reg | 1);
+    }
 }
 
 static void gen_load_fpr64(DisasContext *ctx, TCGv_i64 t, int reg)
@@ -6613,7 +6621,7 @@ static void gen_mftr(CPUMIPSState *env, DisasContext *ctx, int rt, int rd,
         } else {
             TCGv_i32 fp0 = tcg_temp_new_i32();
 
-            gen_load_fpr32h(fp0, rt);
+            gen_load_fpr32h(ctx, fp0, rt);
             tcg_gen_ext_i32_tl(t0, fp0);
             tcg_temp_free_i32(fp0);
         }
@@ -6812,7 +6820,7 @@ static void gen_mttr(CPUMIPSState *env, DisasContext *ctx, int rd, int rt,
             TCGv_i32 fp0 = tcg_temp_new_i32();
 
             tcg_gen_trunc_tl_i32(fp0, t0);
-            gen_store_fpr32h(fp0, rd);
+            gen_store_fpr32h(ctx, fp0, rd);
             tcg_temp_free_i32(fp0);
         }
         break;
@@ -7283,7 +7291,7 @@ static void gen_cp1 (DisasContext *ctx, uint32_t opc, int rt, int fs)
         {
             TCGv_i32 fp0 = tcg_temp_new_i32();
 
-            gen_load_fpr32h(fp0, fs);
+            gen_load_fpr32h(ctx, fp0, fs);
             tcg_gen_ext_i32_tl(t0, fp0);
             tcg_temp_free_i32(fp0);
         }
@@ -7296,7 +7304,7 @@ static void gen_cp1 (DisasContext *ctx, uint32_t opc, int rt, int fs)
             TCGv_i32 fp0 = tcg_temp_new_i32();
 
             tcg_gen_trunc_tl_i32(fp0, t0);
-            gen_store_fpr32h(fp0, fs);
+            gen_store_fpr32h(ctx, fp0, fs);
             tcg_temp_free_i32(fp0);
         }
         opn = "mthc1";
@@ -7383,7 +7391,8 @@ static inline void gen_movcf_d (DisasContext *ctx, int fs, int fd, int cc, int t
     gen_set_label(l1);
 }
 
-static inline void gen_movcf_ps (int fs, int fd, int cc, int tf)
+static inline void gen_movcf_ps(DisasContext *ctx, int fs, int fd,
+                                int cc, int tf)
 {
     int cond;
     TCGv_i32 t0 = tcg_temp_new_i32();
@@ -7403,8 +7412,8 @@ static inline void gen_movcf_ps (int fs, int fd, int cc, int tf)
 
     tcg_gen_andi_i32(t0, fpu_fcr31, 1 << get_fp_bit(cc+1));
     tcg_gen_brcondi_i32(cond, t0, 0, l2);
-    gen_load_fpr32h(t0, fs);
-    gen_store_fpr32h(t0, fd);
+    gen_load_fpr32h(ctx, t0, fs);
+    gen_store_fpr32h(ctx, t0, fd);
     tcg_temp_free_i32(t0);
     gen_set_label(l2);
 }
@@ -8389,7 +8398,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
         break;
     case OPC_MOVCF_PS:
         check_cp1_64bitmode(ctx);
-        gen_movcf_ps(fs, fd, (ft >> 2) & 0x7, ft & 0x1);
+        gen_movcf_ps(ctx, fs, fd, (ft >> 2) & 0x7, ft & 0x1);
         opn = "movcf.ps";
         break;
     case OPC_MOVZ_PS:
@@ -8514,7 +8523,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
         {
             TCGv_i32 fp0 = tcg_temp_new_i32();
 
-            gen_load_fpr32h(fp0, fs);
+            gen_load_fpr32h(ctx, fp0, fs);
             gen_helper_float_cvts_pu(fp0, cpu_env, fp0);
             gen_store_fpr32(fp0, fd);
             tcg_temp_free_i32(fp0);
@@ -8553,7 +8562,7 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
 
             gen_load_fpr32(fp0, fs);
             gen_load_fpr32(fp1, ft);
-            gen_store_fpr32h(fp0, fd);
+            gen_store_fpr32h(ctx, fp0, fd);
             gen_store_fpr32(fp1, fd);
             tcg_temp_free_i32(fp0);
             tcg_temp_free_i32(fp1);
@@ -8567,9 +8576,9 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
             TCGv_i32 fp1 = tcg_temp_new_i32();
 
             gen_load_fpr32(fp0, fs);
-            gen_load_fpr32h(fp1, ft);
+            gen_load_fpr32h(ctx, fp1, ft);
             gen_store_fpr32(fp1, fd);
-            gen_store_fpr32h(fp0, fd);
+            gen_store_fpr32h(ctx, fp0, fd);
             tcg_temp_free_i32(fp0);
             tcg_temp_free_i32(fp1);
         }
@@ -8581,10 +8590,10 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
             TCGv_i32 fp0 = tcg_temp_new_i32();
             TCGv_i32 fp1 = tcg_temp_new_i32();
 
-            gen_load_fpr32h(fp0, fs);
+            gen_load_fpr32h(ctx, fp0, fs);
             gen_load_fpr32(fp1, ft);
             gen_store_fpr32(fp1, fd);
-            gen_store_fpr32h(fp0, fd);
+            gen_store_fpr32h(ctx, fp0, fd);
             tcg_temp_free_i32(fp0);
             tcg_temp_free_i32(fp1);
         }
@@ -8596,10 +8605,10 @@ static void gen_farith (DisasContext *ctx, enum fopcode op1,
             TCGv_i32 fp0 = tcg_temp_new_i32();
             TCGv_i32 fp1 = tcg_temp_new_i32();
 
-            gen_load_fpr32h(fp0, fs);
-            gen_load_fpr32h(fp1, ft);
+            gen_load_fpr32h(ctx, fp0, fs);
+            gen_load_fpr32h(ctx, fp1, ft);
             gen_store_fpr32(fp1, fd);
-            gen_store_fpr32h(fp0, fd);
+            gen_store_fpr32h(ctx, fp0, fd);
             tcg_temp_free_i32(fp0);
             tcg_temp_free_i32(fp1);
         }
@@ -8763,23 +8772,23 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
 
             tcg_gen_brcondi_tl(TCG_COND_NE, t0, 0, l1);
             gen_load_fpr32(fp, fs);
-            gen_load_fpr32h(fph, fs);
+            gen_load_fpr32h(ctx, fph, fs);
             gen_store_fpr32(fp, fd);
-            gen_store_fpr32h(fph, fd);
+            gen_store_fpr32h(ctx, fph, fd);
             tcg_gen_br(l2);
             gen_set_label(l1);
             tcg_gen_brcondi_tl(TCG_COND_NE, t0, 4, l2);
             tcg_temp_free(t0);
 #ifdef TARGET_WORDS_BIGENDIAN
             gen_load_fpr32(fp, fs);
-            gen_load_fpr32h(fph, ft);
-            gen_store_fpr32h(fp, fd);
+            gen_load_fpr32h(ctx, fph, ft);
+            gen_store_fpr32h(ctx, fp, fd);
             gen_store_fpr32(fph, fd);
 #else
-            gen_load_fpr32h(fph, fs);
+            gen_load_fpr32h(ctx, fph, fs);
             gen_load_fpr32(fp, ft);
             gen_store_fpr32(fph, fd);
-            gen_store_fpr32h(fp, fd);
+            gen_store_fpr32h(ctx, fp, fd);
 #endif
             gen_set_label(l2);
             tcg_temp_free_i32(fp);
@@ -11976,7 +11985,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
                         gen_movcf_d(ctx, rs, rt, cc, 0);
                         break;
                     case FMT_SDPS_PS:
-                        gen_movcf_ps(rs, rt, cc, 0);
+                        gen_movcf_ps(ctx, rs, rt, cc, 0);
                         break;
                     default:
                         goto pool32f_invalid;
@@ -11991,7 +12000,7 @@ static void decode_micromips32_opc (CPUMIPSState *env, DisasContext *ctx,
                         gen_movcf_d(ctx, rs, rt, cc, 1);
                         break;
                     case FMT_SDPS_PS:
-                        gen_movcf_ps(rs, rt, cc, 1);
+                        gen_movcf_ps(ctx, rs, rt, cc, 1);
                         break;
                     default:
                         goto pool32f_invalid;
commit b9bf8a1abb1cafe7184e3dbad9bf8819b3cb620a
Merge: 169e487 4e505dd
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Mar 25 18:30:52 2014 +0000

    Merge remote-tracking branch 'remotes/awilliam/tags/vfio-pci-for-qemu-20140325.0' into staging
    
    A couple trivial fixes for QEMU 2.0:
     - Coding correction that allowed attempts to read the device
       ROM after we'd already marked it failed (Bandan)
     - Cosmetic error reporting fixes to remove unnecessary new lines
       and fix a cut-n-paste wording error (Alex)
    
    # gpg: Signature made Tue 25 Mar 2014 18:18:57 GMT using RSA key ID 3BB08B22
    # gpg: Can't check signature: public key not found
    
    * remotes/awilliam/tags/vfio-pci-for-qemu-20140325.0:
      vfio: Cosmetic error reporting fixes
      vfio: Correction in vfio_rom_read when attempting rom loading
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 4e505ddd9af1d5810378a4e7b851f788b1c075ba
Author: Alex Williamson <alex.williamson at redhat.com>
Date:   Tue Mar 25 12:08:52 2014 -0600

    vfio: Cosmetic error reporting fixes
    
    * Remove terminating newlines from hw_error() and error_report() calls
    * Fix cut-n-paste error in text (s/to/from/)
    
    Signed-off-by: Alex Williamson <alex.williamson at redhat.com>

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index 7147430..9cf5b84 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -1043,7 +1043,7 @@ static void vfio_bar_write(void *opaque, hwaddr addr,
         buf.dword = cpu_to_le32(data);
         break;
     default:
-        hw_error("vfio: unsupported write size, %d bytes\n", size);
+        hw_error("vfio: unsupported write size, %d bytes", size);
         break;
     }
 
@@ -1103,7 +1103,7 @@ static uint64_t vfio_bar_read(void *opaque,
         data = le32_to_cpu(buf.dword);
         break;
     default:
-        hw_error("vfio: unsupported read size, %d bytes\n", size);
+        hw_error("vfio: unsupported read size, %d bytes", size);
         break;
     }
 
@@ -1157,7 +1157,7 @@ static void vfio_pci_load_rom(VFIODevice *vdev)
     if (!vdev->rom_size) {
         vdev->rom_read_failed = true;
         error_report("vfio-pci: Cannot read device rom at "
-                    "%04x:%02x:%02x.%x\n",
+                    "%04x:%02x:%02x.%x",
                     vdev->host.domain, vdev->host.bus, vdev->host.slot,
                     vdev->host.function);
         error_printf("Device option ROM contents are probably invalid "
@@ -1338,7 +1338,7 @@ static void vfio_vga_write(void *opaque, hwaddr addr,
         buf.dword = cpu_to_le32(data);
         break;
     default:
-        hw_error("vfio: unsupported write size, %d bytes\n", size);
+        hw_error("vfio: unsupported write size, %d bytes", size);
         break;
     }
 
@@ -1381,7 +1381,7 @@ static uint64_t vfio_vga_read(void *opaque, hwaddr addr, unsigned size)
         data = le32_to_cpu(buf.dword);
         break;
     default:
-        hw_error("vfio: unsupported read size, %d bytes\n", size);
+        hw_error("vfio: unsupported read size, %d bytes", size);
         break;
     }
 
@@ -1426,7 +1426,7 @@ static uint64_t vfio_generic_window_quirk_read(void *opaque,
 
         if (!vfio_range_contained(addr, size, quirk->data.data_offset,
                                   quirk->data.data_size)) {
-            hw_error("%s: window data read not fully contained: %s\n",
+            hw_error("%s: window data read not fully contained: %s",
                      __func__, memory_region_name(&quirk->mem));
         }
 
@@ -1455,7 +1455,7 @@ static void vfio_generic_window_quirk_write(void *opaque, hwaddr addr,
                        quirk->data.address_offset, quirk->data.address_size)) {
 
         if (addr != quirk->data.address_offset) {
-            hw_error("%s: offset write into address window: %s\n",
+            hw_error("%s: offset write into address window: %s",
                      __func__, memory_region_name(&quirk->mem));
         }
 
@@ -1476,7 +1476,7 @@ static void vfio_generic_window_quirk_write(void *opaque, hwaddr addr,
 
         if (!vfio_range_contained(addr, size, quirk->data.data_offset,
                                   quirk->data.data_size)) {
-            hw_error("%s: window data write not fully contained: %s\n",
+            hw_error("%s: window data write not fully contained: %s",
                      __func__, memory_region_name(&quirk->mem));
         }
 
@@ -1512,7 +1512,7 @@ static uint64_t vfio_generic_quirk_read(void *opaque,
         ranges_overlap(addr, size, offset, quirk->data.address_mask + 1)) {
         if (!vfio_range_contained(addr, size, offset,
                                   quirk->data.address_mask + 1)) {
-            hw_error("%s: read not fully contained: %s\n",
+            hw_error("%s: read not fully contained: %s",
                      __func__, memory_region_name(&quirk->mem));
         }
 
@@ -1541,7 +1541,7 @@ static void vfio_generic_quirk_write(void *opaque, hwaddr addr,
         ranges_overlap(addr, size, offset, quirk->data.address_mask + 1)) {
         if (!vfio_range_contained(addr, size, offset,
                                   quirk->data.address_mask + 1)) {
-            hw_error("%s: write not fully contained: %s\n",
+            hw_error("%s: write not fully contained: %s",
                      __func__, memory_region_name(&quirk->mem));
         }
 
@@ -2299,7 +2299,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
                 container->iommu_data.type1.error = ret;
             }
         } else {
-            hw_error("vfio: DMA mapping failed, unable to continue\n");
+            hw_error("vfio: DMA mapping failed, unable to continue");
         }
     }
 }
@@ -2969,7 +2969,7 @@ static void vfio_pci_pre_reset(VFIODevice *vdev)
             pmcsr = vfio_pci_read_config(pdev, vdev->pm_cap + PCI_PM_CTRL, 2);
             state = pmcsr & PCI_PM_CTRL_STATE_MASK;
             if (state) {
-                error_report("vfio: Unable to power on device, stuck in D%d\n",
+                error_report("vfio: Unable to power on device, stuck in D%d",
                              state);
             }
         }
@@ -3268,7 +3268,7 @@ static void vfio_kvm_device_del_group(VFIOGroup *group)
     }
 
     if (ioctl(vfio_kvm_device_fd, KVM_SET_DEVICE_ATTR, &attr)) {
-        error_report("Failed to remove group %d to KVM VFIO device: %m",
+        error_report("Failed to remove group %d from KVM VFIO device: %m",
                      group->groupid);
     }
 #endif
@@ -3336,7 +3336,7 @@ static int vfio_connect_container(VFIOGroup *group)
             vfio_listener_release(container);
             g_free(container);
             close(fd);
-            error_report("vfio: memory listener initialization failed for container\n");
+            error_report("vfio: memory listener initialization failed for container");
             return ret;
         }
 
commit 169e4878ee96b7d6dec929e0cd400a0395865a85
Merge: d4cc1a2 131e744
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Mar 25 17:49:45 2014 +0000

    Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging
    
    Net patches
    
    # gpg: Signature made Tue 25 Mar 2014 15:02:48 GMT using RSA key ID 81AB73C8
    # gpg: Good signature from "Stefan Hajnoczi <stefanha at redhat.com>"
    # gpg:                 aka "Stefan Hajnoczi <stefanha at gmail.com>"
    # gpg: WARNING: This key is not certified with a trusted signature!
    # gpg:          There is no indication that the signature belongs to the owner.
    # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8
    
    * remotes/stefanha/tags/net-pull-request:
      net: netmap_poll must update both read/write poll state
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit d4cc1a213f8cb22fa0861ae2a907c60cf00796ff
Merge: 839a554 7b770c7
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Mar 25 15:23:08 2014 +0000

    Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
    
    Block pull request
    
    # gpg: Signature made Tue 25 Mar 2014 14:34:45 GMT using RSA key ID 81AB73C8
    # gpg: Good signature from "Stefan Hajnoczi <stefanha at redhat.com>"
    # gpg:                 aka "Stefan Hajnoczi <stefanha at gmail.com>"
    # gpg: WARNING: This key is not certified with a trusted signature!
    # gpg:          There is no indication that the signature belongs to the owner.
    # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8
    
    * remotes/stefanha/tags/block-pull-request:
      mirror: fix early wake from sleep due to aio
      mirror: fix throttling delay calculation
      Fixed various typos
      qemu-img: mandate argument to 'qemu-img check --repair'
      osdep: initialize glib threads in all QEMU tools
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit db01eedb6d883a1fed5b4079f8a6ff048b9c1217
Author: Bandan Das <bsd at redhat.com>
Date:   Tue Mar 25 08:24:20 2014 -0600

    vfio: Correction in vfio_rom_read when attempting rom loading
    
    commit e638073c569e801ce9de added a flag to track whether
    a previous rom read had failed. Accidentally, the code
    ended up adding vfio_load_option_rom twice. (Thanks to Alex
    for spotting it)
    
    Signed-off-by: Bandan Das <bsd at redhat.com>
    Signed-off-by: Alex Williamson <alex.williamson at redhat.com>

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index c2c688c..7147430 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -1192,11 +1192,8 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
     uint64_t val = ((uint64_t)1 << (size * 8)) - 1;
 
     /* Load the ROM lazily when the guest tries to read it */
-    if (unlikely(!vdev->rom)) {
+    if (unlikely(!vdev->rom && !vdev->rom_read_failed)) {
         vfio_pci_load_rom(vdev);
-        if (unlikely(!vdev->rom && !vdev->rom_read_failed)) {
-            vfio_pci_load_rom(vdev);
-        }
     }
 
     memcpy(&val, vdev->rom + addr,
commit 7b770c720b28b8ac5b82ae431f2f354b7f8add91
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Fri Mar 21 13:55:19 2014 +0100

    mirror: fix early wake from sleep due to aio
    
    The mirror blockjob coroutine rate-limits itself by sleeping.  The
    coroutine also performs I/O asynchronously so it's important that the
    aio callback doesn't wake the coroutine early as that breaks
    rate-limiting.
    
    Reported-by: Joaquim Barrera <jbarrera at ac.upc.edu>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/mirror.c b/block/mirror.c
index adb09cf..0ef41f9 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -98,7 +98,14 @@ static void mirror_iteration_done(MirrorOp *op, int ret)
 
     qemu_iovec_destroy(&op->qiov);
     g_slice_free(MirrorOp, op);
-    qemu_coroutine_enter(s->common.co, NULL);
+
+    /* Enter coroutine when it is not sleeping.  The coroutine sleeps to
+     * rate-limit itself.  The coroutine will eventually resume since there is
+     * a sleep timeout so don't wake it early.
+     */
+    if (s->common.busy) {
+        qemu_coroutine_enter(s->common.co, NULL);
+    }
 }
 
 static void mirror_write_complete(void *opaque, int ret)
commit cc8c9d6c6f28e4e376a6561a2a31524fd069bc2d
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Mar 21 13:55:18 2014 +0100

    mirror: fix throttling delay calculation
    
    The throttling delay calculation was using an inaccurate sector count to
    calculate the time to sleep.  This broke rate-limiting for the block
    mirror job.
    
    Move the delay calculation into mirror_iteration() where we know how
    many sectors were transferred.  This lets us calculate an accurate delay
    time.
    
    Reported-by: Joaquim Barrera <jbarrera at ac.upc.edu>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/mirror.c b/block/mirror.c
index dd5ee05..adb09cf 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -139,11 +139,12 @@ static void mirror_read_complete(void *opaque, int ret)
                     mirror_write_complete, op);
 }
 
-static void coroutine_fn mirror_iteration(MirrorBlockJob *s)
+static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
 {
     BlockDriverState *source = s->common.bs;
     int nb_sectors, sectors_per_chunk, nb_chunks;
     int64_t end, sector_num, next_chunk, next_sector, hbitmap_next_sector;
+    uint64_t delay_ns;
     MirrorOp *op;
 
     s->sector_num = hbitmap_iter_next(&s->hbi);
@@ -231,7 +232,12 @@ static void coroutine_fn mirror_iteration(MirrorBlockJob *s)
         nb_chunks += added_chunks;
         next_sector += added_sectors;
         next_chunk += added_chunks;
-    } while (next_sector < end);
+        if (!s->synced && s->common.speed) {
+            delay_ns = ratelimit_calculate_delay(&s->limit, added_sectors);
+        } else {
+            delay_ns = 0;
+        }
+    } while (delay_ns == 0 && next_sector < end);
 
     /* Allocate a MirrorOp that is used as an AIO callback.  */
     op = g_slice_new(MirrorOp);
@@ -268,6 +274,7 @@ static void coroutine_fn mirror_iteration(MirrorBlockJob *s)
     trace_mirror_one_iteration(s, sector_num, nb_sectors);
     bdrv_aio_readv(source, sector_num, &op->qiov, nb_sectors,
                    mirror_read_complete, op);
+    return delay_ns;
 }
 
 static void mirror_free_init(MirrorBlockJob *s)
@@ -362,7 +369,7 @@ static void coroutine_fn mirror_run(void *opaque)
     bdrv_dirty_iter_init(bs, s->dirty_bitmap, &s->hbi);
     last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
     for (;;) {
-        uint64_t delay_ns;
+        uint64_t delay_ns = 0;
         int64_t cnt;
         bool should_complete;
 
@@ -386,8 +393,10 @@ static void coroutine_fn mirror_run(void *opaque)
                 qemu_coroutine_yield();
                 continue;
             } else if (cnt != 0) {
-                mirror_iteration(s);
-                continue;
+                delay_ns = mirror_iteration(s);
+                if (delay_ns == 0) {
+                    continue;
+                }
             }
         }
 
@@ -432,17 +441,10 @@ static void coroutine_fn mirror_run(void *opaque)
         }
 
         ret = 0;
-        trace_mirror_before_sleep(s, cnt, s->synced);
+        trace_mirror_before_sleep(s, cnt, s->synced, delay_ns);
         if (!s->synced) {
             /* Publish progress */
             s->common.offset = (end - cnt) * BDRV_SECTOR_SIZE;
-
-            if (s->common.speed) {
-                delay_ns = ratelimit_calculate_delay(&s->limit, sectors_per_chunk);
-            } else {
-                delay_ns = 0;
-            }
-
             block_job_sleep_ns(&s->common, QEMU_CLOCK_REALTIME, delay_ns);
             if (block_job_is_cancelled(&s->common)) {
                 break;
diff --git a/trace-events b/trace-events
index 002c260..3b7ff4d 100644
--- a/trace-events
+++ b/trace-events
@@ -82,7 +82,7 @@ mirror_start(void *bs, void *s, void *co, void *opaque) "bs %p s %p co %p opaque
 mirror_restart_iter(void *s, int64_t cnt) "s %p dirty count %"PRId64
 mirror_before_flush(void *s) "s %p"
 mirror_before_drain(void *s, int64_t cnt) "s %p dirty count %"PRId64
-mirror_before_sleep(void *s, int64_t cnt, int synced) "s %p dirty count %"PRId64" synced %d"
+mirror_before_sleep(void *s, int64_t cnt, int synced, uint64_t delay_ns) "s %p dirty count %"PRId64" synced %d delay %"PRIu64"ns"
 mirror_one_iteration(void *s, int64_t sector_num, int nb_sectors) "s %p sector_num %"PRId64" nb_sectors %d"
 mirror_iteration_done(void *s, int64_t sector_num, int nb_sectors, int ret) "s %p sector_num %"PRId64" nb_sectors %d ret %d"
 mirror_yield(void *s, int64_t cnt, int buf_free_count, int in_flight) "s %p dirty count %"PRId64" free buffers %d in_flight %d"
commit dc6fb73d219472e011d93867f5e7eebfffde0319
Author: Deepak Kathayat <deepak.mk17 at gmail.com>
Date:   Mon Mar 24 16:30:17 2014 +0800

    Fixed various typos
    
    Signed-off-by: Deepak Kathayat <deepak.mk17 at gmail.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/gluster.c b/block/gluster.c
index a44d612..8836085 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -80,7 +80,7 @@ static int parse_volume_options(GlusterConf *gconf, char *path)
  * 'server' specifies the server where the volume file specification for
  * the given volume resides. This can be either hostname, ipv4 address
  * or ipv6 address. ipv6 address needs to be within square brackets [ ].
- * If transport type is 'unix', then 'server' field should not be specifed.
+ * If transport type is 'unix', then 'server' field should not be specified.
  * The 'socket' field needs to be populated with the path to unix domain
  * socket.
  *
diff --git a/block/qcow.c b/block/qcow.c
index 1e128be..d5a7d5f 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -723,7 +723,7 @@ static int qcow_create(const char *filename, QEMUOptionParameter *options,
             backing_file = NULL;
         }
         header.cluster_bits = 9; /* 512 byte cluster to avoid copying
-                                    unmodifyed sectors */
+                                    unmodified sectors */
         header.l2_bits = 12; /* 32 KB L2 tables */
     } else {
         header.cluster_bits = 12; /* 4 KB clusters */
diff --git a/block/sheepdog.c b/block/sheepdog.c
index f7bd024..0eb33ee 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -909,9 +909,9 @@ static void co_write_request(void *opaque)
 }
 
 /*
- * Return a socket discriptor to read/write objects.
+ * Return a socket descriptor to read/write objects.
  *
- * We cannot use this discriptor for other operations because
+ * We cannot use this descriptor for other operations because
  * the block driver may be on waiting response from the server.
  */
 static int get_sheep_fd(BDRVSheepdogState *s)
@@ -1896,7 +1896,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
 
     /*
      * Even If deletion fails, we will just create extra snapshot based on
-     * the workding VDI which was supposed to be deleted. So no need to
+     * the working VDI which was supposed to be deleted. So no need to
      * false bail out.
      */
     deleted = sd_delete(s);
@@ -2194,7 +2194,7 @@ cleanup:
  * We implement rollback(loadvm) operation to the specified snapshot by
  * 1) switch to the snapshot
  * 2) rely on sd_create_branch to delete working VDI and
- * 3) create a new working VDI based on the speicified snapshot
+ * 3) create a new working VDI based on the specified snapshot
  */
 static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
 {
diff --git a/block/vdi.c b/block/vdi.c
index ae49cd8..ac9a025 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -31,7 +31,7 @@
  * Allocation of blocks could be optimized (less writes to block map and
  * header).
  *
- * Read and write of adjacents blocks could be done in one operation
+ * Read and write of adjacent blocks could be done in one operation
  * (current code uses one operation per block (1 MiB).
  *
  * The code is not thread safe (missing locks for changes in header and
diff --git a/block/vhdx-log.c b/block/vhdx-log.c
index 02755b8..a77c040 100644
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -578,7 +578,7 @@ static int vhdx_validate_log_entry(BlockDriverState *bs, BDRVVHDXState *s,
     total_sectors = hdr.entry_length / VHDX_LOG_SECTOR_SIZE;
 
 
-    /* read_desc() will incrememnt the read idx */
+    /* read_desc() will increment the read idx */
     ret = vhdx_log_read_desc(bs, s, log, &desc_buffer);
     if (ret < 0) {
         goto free_and_exit;
diff --git a/slirp/tftp.c b/slirp/tftp.c
index 1a79c45..a329fb2 100644
--- a/slirp/tftp.c
+++ b/slirp/tftp.c
@@ -279,7 +279,7 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
 
   spt = &slirp->tftp_sessions[s];
 
-  /* unspecifed prefix means service disabled */
+  /* unspecified prefix means service disabled */
   if (!slirp->tftp_prefix) {
       tftp_send_error(spt, 2, "Access violation", tp);
       return;
commit 4fd6a984b93701fcb40a0053098ae5c2c4ee27f4
Author: Prasad Joshi <prasadjoshi.linux at gmail.com>
Date:   Tue Mar 25 00:08:54 2014 +0530

    qemu-img: mandate argument to 'qemu-img check --repair'
    
    qemu-img check --repair option accepts an argument. The argument to
    --repair switch can either be 'all' or 'leak'. Fix the long option to
    mandate argument with --repair switch.
    
    The patch fixes following segmentation fault
    
    Core was generated by `qemu-img check -f qcow2 --repair all t.qcow2'.
    Program terminated with signal 11, Segmentation fault.
    0  in img_check (argc=6, argv=0x7fffab9b8a10) at qemu-img.c:588
    588	            if (!strcmp(optarg, "leaks")) {
    (gdb) bt
      0  img_check (argc=6, argv=0x7fffab9b8a10) at qemu-img.c:588
      1  __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
      2  _start ()
    (gdb)
    
    Signed-off-by: Prasad Joshi <prasadjoshi.linux at gmail.com>
    Reviewed-by: Leandro Dorileo <l at dorileo.org>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/qemu-img.c b/qemu-img.c
index 2e40cc1..77d946b 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -565,7 +565,7 @@ static int img_check(int argc, char **argv)
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
             {"format", required_argument, 0, 'f'},
-            {"repair", no_argument, 0, 'r'},
+            {"repair", required_argument, 0, 'r'},
             {"output", required_argument, 0, OPTION_OUTPUT},
             {0, 0, 0, 0}
         };
commit ae2990c259abec198879c362dc13f7047f26c2cf
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Oct 8 11:58:31 2013 +0200

    osdep: initialize glib threads in all QEMU tools
    
    glib versions prior to 2.31.0 require an explicit g_thread_init() call
    to enable multi-threading.
    
    Failure to initialize threading causes glib to take single-threaded code
    paths without synchronization.  For example, the g_slice allocator will
    crash due to race conditions.
    
    Fix this for all QEMU tool programs (qemu-nbd, qemu-io, qemu-img) by
    moving the g_thread_init() call from vl.c:main() into a new
    osdep.c:thread_init() constructor function.
    
    thread_init() has __attribute__((constructor)) and is automatically
    invoked by the runtime during startup.
    
    We can now drop the "simple" trace backend's g_thread_init() call since
    thread_init() already called it.
    
    Note that we must keep coroutine-gthread.c's g_thread_init() call which
    is located in a constructor function.  There is no guarantee for
    constructor function ordering so thread_init() may only be called later.
    
    Reported-by: Mario de Chenno <mario.dechenno at unina2.it>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/trace/simple.c b/trace/simple.c
index 57572c4..aaa010e 100644
--- a/trace/simple.c
+++ b/trace/simple.c
@@ -414,15 +414,6 @@ bool trace_backend_init(const char *events, const char *file)
 {
     GThread *thread;
 
-    if (!g_thread_supported()) {
-#if !GLIB_CHECK_VERSION(2, 31, 0)
-        g_thread_init(NULL);
-#else
-        fprintf(stderr, "glib threading failed to initialize.\n");
-        exit(1);
-#endif
-    }
-
 #if !GLIB_CHECK_VERSION(2, 31, 0)
     trace_available_cond = g_cond_new();
     trace_empty_cond = g_cond_new();
diff --git a/util/osdep.c b/util/osdep.c
index bd4f530..a9029f8 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -436,6 +436,24 @@ int socket_init(void)
     return 0;
 }
 
+/* Ensure that glib is running in multi-threaded mode */
+static void __attribute__((constructor)) thread_init(void)
+{
+    if (!g_thread_supported()) {
+#if !GLIB_CHECK_VERSION(2, 31, 0)
+        /* Old versions of glib require explicit initialization.  Failure to do
+         * this results in the single-threaded code paths being taken inside
+         * glib.  For example, the g_slice allocator will not be thread-safe
+         * and cause crashes.
+         */
+        g_thread_init(NULL);
+#else
+        fprintf(stderr, "glib threading failed to initialize.\n");
+        exit(1);
+#endif
+    }
+}
+
 #ifndef CONFIG_IOVEC
 /* helper function for iov_send_recv() */
 static ssize_t
diff --git a/vl.c b/vl.c
index acd97a8..2355227 100644
--- a/vl.c
+++ b/vl.c
@@ -2970,14 +2970,6 @@ int main(int argc, char **argv, char **envp)
     qemu_init_exec_dir(argv[0]);
 
     g_mem_set_vtable(&mem_trace);
-    if (!g_thread_supported()) {
-#if !GLIB_CHECK_VERSION(2, 31, 0)
-        g_thread_init(NULL);
-#else
-        fprintf(stderr, "glib threading failed to initialize.\n");
-        exit(1);
-#endif
-    }
 
     module_call_init(MODULE_INIT_QOM);
 
commit 131e744a15c54f0bad3d3925eeca1acf47996e06
Author: Prasad Joshi <prasadjoshi.linux at gmail.com>
Date:   Sun Mar 23 14:58:43 2014 +0530

    net: netmap_poll must update both read/write poll state
    
    Signed-off-by: Prasad Joshi <prasadjoshi.linux at gmail.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/net/netmap.c b/net/netmap.c
index 8213304..0c1772b 100644
--- a/net/netmap.c
+++ b/net/netmap.c
@@ -177,8 +177,8 @@ static void netmap_poll(NetClientState *nc, bool enable)
     NetmapState *s = DO_UPCAST(NetmapState, nc, nc);
 
     if (s->read_poll != enable || s->write_poll != enable) {
-        s->read_poll = enable;
-        s->read_poll = enable;
+        s->write_poll = enable;
+        s->read_poll  = enable;
         netmap_update_fd_handler(s);
     }
 }


More information about the Spice-commits mailing list