Update version for v2.5.0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Update version for v2.5.0-rc4 release
2015-12-16 16:10:14 +00:00 · 2015-12-11 16:37:55 +00:00 · 2015-12-11 15:39:29 +00:00 · 2015-12-11 12:51:27 +00:00 · 2015-12-10 13:50:45 +00:00 · 2015-12-10 11:19:18 +00:00
101 changed files with 778 additions and 518 deletions
@@ -863,6 +863,7 @@ F: net/vhost-user.c

 virtio-9p
 M: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+M: Greg Kurz <gkurz@linux.vnet.ibm.com>
 S: Supported
 F: hw/9pfs/
 F: fsdev/
@@ -1 +1 @@
-2.4.92
+2.5.0
@@ -132,7 +132,7 @@ static int coroutine_fn backup_do_cow(BlockDriverState *bs,
        qemu_iovec_init_external(&bounce_qiov, &iov, 1);

        if (is_write_notifier) {
-            ret = bdrv_co_no_copy_on_readv(bs,
+            ret = bdrv_co_readv_no_serialising(bs,
                                           start * BACKUP_SECTORS_PER_CLUSTER,
                                           n, &bounce_qiov);
        } else {
@@ -30,6 +30,7 @@
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qint.h"
 #include "qapi/qmp/qstring.h"
+#include "sysemu/qtest.h"

 typedef struct BDRVBlkdebugState {
    int state;
@@ -583,9 +584,13 @@ static void suspend_request(BlockDriverState *bs, BlkdebugRule *rule)
    remove_rule(rule);
    QLIST_INSERT_HEAD(&s->suspended_reqs, &r, next);

-    printf("blkdebug: Suspended request '%s'\n", r.tag);
+    if (!qtest_enabled()) {
+        printf("blkdebug: Suspended request '%s'\n", r.tag);
+    }
    qemu_coroutine_yield();
-    printf("blkdebug: Resuming request '%s'\n", r.tag);
+    if (!qtest_enabled()) {
+        printf("blkdebug: Resuming request '%s'\n", r.tag);
+    }

    QLIST_REMOVE(&r, next);
    g_free(r.tag);
@@ -863,7 +863,9 @@ static int coroutine_fn bdrv_aligned_preadv(BlockDriverState *bs,
        mark_request_serialising(req, bdrv_get_cluster_size(bs));
    }

-    wait_serialising_requests(req);
+    if (!(flags & BDRV_REQ_NO_SERIALISING)) {
+        wait_serialising_requests(req);
+    }

    if (flags & BDRV_REQ_COPY_ON_READ) {
        int pnum;
@@ -952,7 +954,7 @@ static int coroutine_fn bdrv_co_do_preadv(BlockDriverState *bs,
    }

    /* Don't do copy-on-read if we read data before write operation */
-    if (bs->copy_on_read && !(flags & BDRV_REQ_NO_COPY_ON_READ)) {
+    if (bs->copy_on_read && !(flags & BDRV_REQ_NO_SERIALISING)) {
        flags |= BDRV_REQ_COPY_ON_READ;
    }

@@ -1021,13 +1023,13 @@ int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,
    return bdrv_co_do_readv(bs, sector_num, nb_sectors, qiov, 0);
 }

-int coroutine_fn bdrv_co_no_copy_on_readv(BlockDriverState *bs,
+int coroutine_fn bdrv_co_readv_no_serialising(BlockDriverState *bs,
    int64_t sector_num, int nb_sectors, QEMUIOVector *qiov)
 {
-    trace_bdrv_co_no_copy_on_readv(bs, sector_num, nb_sectors);
+    trace_bdrv_co_readv_no_serialising(bs, sector_num, nb_sectors);

    return bdrv_co_do_readv(bs, sector_num, nb_sectors, qiov,
-                            BDRV_REQ_NO_COPY_ON_READ);
+                            BDRV_REQ_NO_SERIALISING);
 }

 int coroutine_fn bdrv_co_copy_on_readv(BlockDriverState *bs,
@@ -388,6 +388,7 @@ static void mirror_exit(BlockJob *job, void *opaque)
    bdrv_unref(s->target);
    block_job_completed(&s->common, data->ret);
    g_free(data);
+    bdrv_drained_end(src);
    bdrv_unref(src);
 }

@@ -607,6 +608,9 @@ immediate_exit:

    data = g_malloc(sizeof(*data));
    data->ret = ret;
+    /* Before we switch to target in mirror_exit, make sure data doesn't
+     * change. */
+    bdrv_drained_begin(s->common.bs);
    block_job_defer_to_main_loop(&s->common, mirror_exit, data);
 }

@@ -1244,7 +1244,7 @@ fail:
 /* refcount checking functions */


-static size_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)
+static uint64_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)
 {
    /* This assertion holds because there is no way we can address more than
     * 2^(64 - 9) clusters at once (with cluster size 512 = 2^9, and because
@@ -2257,7 +2257,7 @@ void qmp_eject(const char *device, bool has_force, bool force, Error **errp)
        return;
    }

-    qmp_blockdev_remove_medium(device, errp);
+    qmp_x_blockdev_remove_medium(device, errp);
 }

 void qmp_block_passwd(bool has_device, const char *device,
@@ -2343,7 +2343,7 @@ void qmp_blockdev_close_tray(const char *device, Error **errp)
    blk_dev_change_media_cb(blk, true);
 }

-void qmp_blockdev_remove_medium(const char *device, Error **errp)
+void qmp_x_blockdev_remove_medium(const char *device, Error **errp)
 {
    BlockBackend *blk;
    BlockDriverState *bs;
@@ -2430,8 +2430,8 @@ static void qmp_blockdev_insert_anon_medium(const char *device,
    QTAILQ_INSERT_TAIL(&bdrv_states, bs, device_list);
 }

-void qmp_blockdev_insert_medium(const char *device, const char *node_name,
-                                Error **errp)
+void qmp_x_blockdev_insert_medium(const char *device, const char *node_name,
+                                  Error **errp)
 {
    BlockDriverState *bs;

@@ -2520,7 +2520,7 @@ void qmp_blockdev_change_medium(const char *device, const char *filename,
        goto fail;
    }

-    qmp_blockdev_remove_medium(device, &err);
+    qmp_x_blockdev_remove_medium(device, &err);
    if (err) {
        error_propagate(errp, err);
        goto fail;
@@ -740,8 +740,7 @@ static void padzero(abi_ulong elf_bss, abi_ulong last_bss)
           size must be known */
        if (qemu_real_host_page_size < qemu_host_page_size) {
            abi_ulong end_addr, end_addr1;
-            end_addr1 = (elf_bss + qemu_real_host_page_size - 1) &
-                ~(qemu_real_host_page_size - 1);
+            end_addr1 = REAL_HOST_PAGE_ALIGN(elf_bss);
            end_addr = HOST_PAGE_ALIGN(elf_bss);
            if (end_addr1 < end_addr) {
                mmap((void *)g2h(end_addr1), end_addr - end_addr1,
@@ -727,6 +727,8 @@ if test "$mingw32" = "yes" ; then
  QEMU_CFLAGS="-DWIN32_LEAN_AND_MEAN -DWINVER=0x501 $QEMU_CFLAGS"
  # enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later)
  QEMU_CFLAGS="-D__USE_MINGW_ANSI_STDIO=1 $QEMU_CFLAGS"
+  # MinGW needs -mthreads for TLS and macro _MT.
+  QEMU_CFLAGS="-mthreads $QEMU_CFLAGS"
  LIBS="-lwinmm -lws2_32 -liphlpapi $LIBS"
  write_c_skeleton;
  if compile_prog "" "-liberty" ; then
@@ -1426,6 +1428,9 @@ if compile_object ; then
 else
    error_exit "\"$cc\" either does not exist or does not work"
 fi
+if ! compile_prog ; then
+    error_exit "\"$cc\" cannot build an executable (is your linker broken?)"
+fi

 # Check that the C++ compiler exists and works with the C compiler
 if has $cxx; then
@@ -1486,6 +1491,16 @@ for flag in $gcc_flags; do
 done

 if test "$stack_protector" != "no"; then
+  cat > $TMPC << EOF
+int main(int argc, char *argv[])
+{
+    char arr[64], *p = arr, *c = argv[0];
+    while (*c) {
+        *p++ = *c++;
+    }
+    return 0;
+}
+EOF
  gcc_flags="-fstack-protector-strong -fstack-protector-all"
  sp_on=0
  for flag in $gcc_flags; do
@@ -123,10 +123,10 @@ qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
        goto cleanup;
    }

-    trace_qcrypto_tls_creds_get_path(creds, filename,
-                                     *cred ? *cred : "<none>");
    ret = 0;
 cleanup:
+    trace_qcrypto_tls_creds_get_path(creds, filename,
+                                     *cred ? *cred : "<none>");
    return ret;
 }

@@ -255,6 +255,7 @@ qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
        }

        g_free(buffer);
+        buffer = NULL;
    }

    if (isServer) {
@@ -1064,9 +1064,11 @@ static uint16_t phys_section_add(PhysPageMap *map,

 static void phys_section_destroy(MemoryRegion *mr)
 {
+    bool have_sub_page = mr->subpage;
+
    memory_region_unref(mr);

-    if (mr->subpage) {
+    if (have_sub_page) {
        subpage_t *subpage = container_of(mr, subpage_t, iomem);
        object_unref(OBJECT(&subpage->iomem));
        g_free(subpage);
@@ -1128,10 +1128,19 @@ int main(int argc, char **argv)
        }
    }

+    if (chdir("/") < 0) {
+        do_perror("chdir");
+        goto error;
+    }
+    if (chroot(rpath) < 0) {
+        do_perror("chroot");
+        goto error;
+    }
+
    get_version = false;
 #ifdef FS_IOC_GETVERSION
    /* check whether underlying FS support IOC_GETVERSION */
-    retval = statfs(rpath, &st_fs);
+    retval = statfs("/", &st_fs);
    if (!retval) {
        switch (st_fs.f_type) {
        case EXT2_SUPER_MAGIC:
@@ -1144,16 +1153,7 @@ int main(int argc, char **argv)
    }
 #endif

-    if (chdir("/") < 0) {
-        do_perror("chdir");
-        goto error;
-    }
-    if (chroot(rpath) < 0) {
-        do_perror("chroot");
-        goto error;
-    }
    umask(0);
-
    if (init_capabilities() < 0) {
        goto error;
    }
@@ -12,71 +12,30 @@
 *
 */

-#include "fsdev/qemu-fsdev.h"
-#include "qemu/thread.h"
-#include "qemu/event_notifier.h"
+#include "qemu-common.h"
+#include "block/thread-pool.h"
 #include "qemu/coroutine.h"
+#include "qemu/main-loop.h"
 #include "virtio-9p-coth.h"

-/* v9fs glib thread pool */
-static V9fsThPool v9fs_pool;
+/* Called from QEMU I/O thread.  */
+static void coroutine_enter_cb(void *opaque, int ret)
+{
+    Coroutine *co = opaque;
+    qemu_coroutine_enter(co, NULL);
+}
+
+/* Called from worker thread.  */
+static int coroutine_enter_func(void *arg)
+{
+    Coroutine *co = arg;
+    qemu_coroutine_enter(co, NULL);
+    return 0;
+}

 void co_run_in_worker_bh(void *opaque)
 {
    Coroutine *co = opaque;
-    g_thread_pool_push(v9fs_pool.pool, co, NULL);
-}
-
-static void v9fs_qemu_process_req_done(EventNotifier *e)
-{
-    Coroutine *co;
-
-    event_notifier_test_and_clear(e);
-
-    while ((co = g_async_queue_try_pop(v9fs_pool.completed)) != NULL) {
-        qemu_coroutine_enter(co, NULL);
-    }
-}
-
-static void v9fs_thread_routine(gpointer data, gpointer user_data)
-{
-    Coroutine *co = data;
-
-    qemu_coroutine_enter(co, NULL);
-
-    g_async_queue_push(v9fs_pool.completed, co);
-
-    event_notifier_set(&v9fs_pool.e);
-}
-
-int v9fs_init_worker_threads(void)
-{
-    int ret = 0;
-    V9fsThPool *p = &v9fs_pool;
-    sigset_t set, oldset;
-
-    sigfillset(&set);
-    /* Leave signal handling to the iothread.  */
-    pthread_sigmask(SIG_SETMASK, &set, &oldset);
-
-    p->pool = g_thread_pool_new(v9fs_thread_routine, p, -1, FALSE, NULL);
-    if (!p->pool) {
-        ret = -1;
-        goto err_out;
-    }
-    p->completed = g_async_queue_new();
-    if (!p->completed) {
-        /*
-         * We are going to terminate.
-         * So don't worry about cleanup
-         */
-        ret = -1;
-        goto err_out;
-    }
-    event_notifier_init(&p->e, 0);
-
-    event_notifier_set_handler(&p->e, v9fs_qemu_process_req_done);
-err_out:
-    pthread_sigmask(SIG_SETMASK, &oldset, NULL);
-    return ret;
+    thread_pool_submit_aio(qemu_get_aio_context()->thread_pool,
+                           coroutine_enter_func, co, coroutine_enter_cb, co);
 }
@@ -18,14 +18,6 @@
 #include "qemu/thread.h"
 #include "qemu/coroutine.h"
 #include "virtio-9p.h"
-#include <glib.h>
-
-typedef struct V9fsThPool {
-    EventNotifier e;
-
-    GThreadPool *pool;
-    GAsyncQueue *completed;
-} V9fsThPool;

 /*
 * we want to use bottom half because we want to make sure the below
@@ -45,7 +37,7 @@ typedef struct V9fsThPool {
        qemu_bh_schedule(co_bh);                                        \
        /*                                                              \
         * yield in qemu thread and re-enter back                       \
-         * in glib worker thread                                        \
+         * in worker thread                                             \
         */                                                             \
        qemu_coroutine_yield();                                         \
        qemu_bh_delete(co_bh);                                          \
@@ -116,10 +116,6 @@ static void virtio_9p_device_realize(DeviceState *dev, Error **errp)
                   " and export path:%s", s->fsconf.fsdev_id, s->ctx.fs_root);
        goto out;
    }
-    if (v9fs_init_worker_threads() < 0) {
-        error_setg(errp, "worker thread initialization failed");
-        goto out;
-    }

    /*
     * Check details of export path, We need to use fs driver
@@ -149,6 +145,17 @@ out:
    v9fs_path_free(&path);
 }

+static void virtio_9p_device_unrealize(DeviceState *dev, Error **errp)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
+    V9fsState *s = VIRTIO_9P(dev);
+
+    virtio_cleanup(vdev);
+    unregister_savevm(dev, "virtio-9p", s);
+    g_free(s->ctx.fs_root);
+    g_free(s->tag);
+}
+
 /* virtio-9p device */

 static Property virtio_9p_properties[] = {
@@ -165,6 +172,7 @@ static void virtio_9p_class_init(ObjectClass *klass, void *data)
    dc->props = virtio_9p_properties;
    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
    vdc->realize = virtio_9p_device_realize;
+    vdc->unrealize = virtio_9p_device_unrealize;
    vdc->get_features = virtio_9p_get_features;
    vdc->get_config = virtio_9p_get_config;
 }
@@ -45,7 +45,6 @@ struct VirtIOBlockDataPlane {
     * use it).
     */
    IOThread *iothread;
-    IOThread internal_iothread_obj;
    AioContext *ctx;
    EventNotifier host_notifier;    /* doorbell */

@@ -149,14 +148,14 @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,

    *dataplane = NULL;

-    if (!conf->data_plane && !conf->iothread) {
+    if (!conf->iothread) {
        return;
    }

    /* Don't try if transport does not support notifiers. */
    if (!k->set_guest_notifiers || !k->set_host_notifier) {
        error_setg(errp,
-                   "device is incompatible with x-data-plane "
+                   "device is incompatible with dataplane "
                   "(transport does not support notifiers)");
        return;
    }
@@ -179,16 +178,6 @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
    if (conf->iothread) {
        s->iothread = conf->iothread;
        object_ref(OBJECT(s->iothread));
-    } else {
-        /* Create per-device IOThread if none specified.  This is for
-         * x-data-plane option compatibility.  If x-data-plane is removed we
-         * can drop this.
-         */
-        object_initialize(&s->internal_iothread_obj,
-                          sizeof(s->internal_iothread_obj),
-                          TYPE_IOTHREAD);
-        user_creatable_complete(OBJECT(&s->internal_iothread_obj), &error_abort);
-        s->iothread = &s->internal_iothread_obj;
    }
    s->ctx = iothread_get_aio_context(s->iothread);
    s->bh = aio_bh_new(s->ctx, notify_guest_bh, s);
@@ -986,7 +986,6 @@ static Property virtio_blk_properties[] = {
 #endif
    DEFINE_PROP_BIT("request-merging", VirtIOBlock, conf.request_merging, 0,
                    true),
-    DEFINE_PROP_BIT("x-data-plane", VirtIOBlock, conf.data_plane, 0, false),
    DEFINE_PROP_END_OF_LIST(),
 };

@@ -42,7 +42,7 @@ struct bt_l2cap_sdp_state_s {

 static ssize_t sdp_datalen(const uint8_t **element, ssize_t *left)
 {
-    size_t len = *(*element) ++ & SDP_DSIZE_MASK;
+    uint32_t len = *(*element) ++ & SDP_DSIZE_MASK;

    if (!*left)
        return -1;
@@ -275,7 +275,8 @@ static void check_reserved_space (hwaddr *start,

 static void gt64120_isd_mapping(GT64120State *s)
 {
-    hwaddr start = s->regs[GT_ISD] << 21;
+    /* Bits 14:0 of ISD map to bits 35:21 of the start address.  */
+    hwaddr start = ((hwaddr)s->regs[GT_ISD] << 21) & 0xFFFE00000ull;
    hwaddr length = 0x1000;

    if (s->ISD_length) {
@@ -557,7 +557,6 @@ void DBDMA_register_channel(void *dbdma, int nchan, qemu_irq irq,
    DBDMA_DPRINTF("DBDMA_register_channel 0x%x\n", nchan);

    ch->irq = irq;
-    ch->channel = nchan;
    ch->rw = rw;
    ch->flush = flush;
    ch->io.opaque = opaque;
@@ -753,6 +752,7 @@ void* DBDMA_init (MemoryRegion **dbdma_mem)
    for (i = 0; i < DBDMA_CHANNELS; i++) {
        DBDMA_io *io = &s->channels[i].io;
        qemu_iovec_init(&io->iov, 1);
+        s->channels[i].channel = i;
    }

    memory_region_init_io(&s->mem, NULL, &dbdma_ops, s, "dbdma", 0x1000);
@@ -447,6 +447,11 @@ static void e1000_reset(void *opaque)
        e1000_link_down(d);
    }

+    /* Throttle interrupts to prevent guest (e.g Win 2012) from
+     * reinjecting interrupts endlessly. TODO: fix non ITR case.
+     */
+    d->mac_reg[ITR] = 250;
+
    /* Some guests expect pre-initialized RAH/RAL (AddrValid flag + MACaddr) */
    d->mac_reg[RA] = 0;
    d->mac_reg[RA + 1] = E1000_RAH_AV;
@@ -774,6 +774,11 @@ static void tx_command(EEPRO100State *s)
 #if 0
        uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev, tbd_address + 6);
 #endif
+        if (tx_buffer_size == 0) {
+            /* Prevent an endless loop. */
+            logout("loop in %s:%u\n", __FILE__, __LINE__);
+            break;
+        }
        tbd_address += 8;
        TRACE(RXTX, logout
            ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
@@ -855,6 +860,10 @@ static void set_multicast_list(EEPRO100State *s)

 static void action_command(EEPRO100State *s)
 {
+    /* The loop below won't stop if it gets special handcrafted data.
+       Therefore we limit the number of iterations. */
+    unsigned max_loop_count = 16;
+
    for (;;) {
        bool bit_el;
        bool bit_s;
@@ -870,6 +879,13 @@ static void action_command(EEPRO100State *s)
 #if 0
        bool bit_sf = ((s->tx.command & COMMAND_SF) != 0);
 #endif
+
+        if (max_loop_count-- == 0) {
+            /* Prevent an endless loop. */
+            logout("loop in %s:%u\n", __FILE__, __LINE__);
+            break;
+        }
+
        s->cu_offset = s->tx.link;
        TRACE(OTHER,
              logout("val=(cu start), status=0x%04x, command=0x%04x, link=0x%08x\n",
@@ -56,6 +56,8 @@ do { fprintf(stderr, "lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
 #define CSR_E2P_CMD     0xb0
 #define CSR_E2P_DATA    0xb4

+#define E2P_CMD_MAC_ADDR_LOADED 0x100
+
 /* IRQ_CFG */
 #define IRQ_INT         0x00001000
 #define IRQ_EN          0x00000100
@@ -352,14 +354,14 @@ static void lan9118_reload_eeprom(lan9118_state *s)
 {
    int i;
    if (s->eeprom[0] != 0xa5) {
-        s->e2p_cmd &= ~0x10;
+        s->e2p_cmd &= ~E2P_CMD_MAC_ADDR_LOADED;
        DPRINTF("MACADDR load failed\n");
        return;
    }
    for (i = 0; i < 6; i++) {
        s->conf.macaddr.a[i] = s->eeprom[i + 1];
    }
-    s->e2p_cmd |= 0x10;
+    s->e2p_cmd |= E2P_CMD_MAC_ADDR_LOADED;
    DPRINTF("MACADDR loaded from eeprom\n");
    lan9118_mac_changed(s);
 }
@@ -902,7 +904,8 @@ static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
         */
        break;
    default:
-        hw_error("lan9118: Unimplemented MAC register write: %d = 0x%x\n",
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "lan9118: Unimplemented MAC register write: %d = 0x%x\n",
                 s->mac_cmd & 0xf, val);
    }
 }
@@ -930,14 +933,16 @@ static uint32_t do_mac_read(lan9118_state *s, int reg)
    case MAC_FLOW:
        return s->mac_flow;
    default:
-        hw_error("lan9118: Unimplemented MAC register read: %d\n",
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "lan9118: Unimplemented MAC register read: %d\n",
                 s->mac_cmd & 0xf);
+        return 0;
    }
 }

 static void lan9118_eeprom_cmd(lan9118_state *s, int cmd, int addr)
 {
-    s->e2p_cmd = (s->e2p_cmd & 0x10) | (cmd << 28) | addr;
+    s->e2p_cmd = (s->e2p_cmd & E2P_CMD_MAC_ADDR_LOADED) | (cmd << 28) | addr;
    switch (cmd) {
    case 0:
        s->e2p_data = s->eeprom[addr];
@@ -1128,7 +1133,8 @@ static void lan9118_writel(void *opaque, hwaddr offset,
        break;

    default:
-        hw_error("lan9118_write: Bad reg 0x%x = %x\n", (int)offset, (int)val);
+        qemu_log_mask(LOG_GUEST_ERROR, "lan9118_write: Bad reg 0x%x = %x\n",
+                      (int)offset, (int)val);
        break;
    }
    lan9118_update(s);
@@ -1246,7 +1252,7 @@ static uint64_t lan9118_readl(void *opaque, hwaddr offset,
    case CSR_E2P_DATA:
        return s->e2p_data;
    }
-    hw_error("lan9118_read: Bad reg 0x%x\n", (int)offset);
+    qemu_log_mask(LOG_GUEST_ERROR, "lan9118_read: Bad reg 0x%x\n", (int)offset);
    return 0;
 }

@@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
            int pktcount = 0;

            if (!s->looptest) {
+                if (size > 4092) {
+#ifdef PCNET_DEBUG_RMD
+                    fprintf(stderr, "pcnet: truncates rx packet.\n");
+#endif
+                    size = 4092;
+                }
                memcpy(src, buf, size);
                /* no need to compute the CRC */
                src[size] = 0;
@@ -1084,7 +1090,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
                uint32_t fcs = ~0;
                uint8_t *p = src;

-                while (p != &src[size-4])
+                while (p != &src[size])
                    CRC(fcs, *p++);
                crc_err = (*(uint32_t *)p != htonl(fcs));
            }
@@ -1233,8 +1239,10 @@ static void pcnet_transmit(PCNetState *s)
        bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);

        /* if multi-tmd packet outsizes s->buffer then skip it silently.
-           Note: this is not what real hw does */
-        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
+         * Note: this is not what real hw does.
+         * Last four bytes of s->buffer are used to store CRC FCS code.
+         */
+        if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
            s->xmit_pos = -1;
            goto txdone;
        }
@@ -2015,7 +2015,6 @@ static bool vmxnet3_peer_has_vnet_hdr(VMXNET3State *s)
        return true;
    }

-    VMW_WRPRN("Peer has no virtio extension. Task offloads will be emulated.");
    return false;
 }

@@ -408,7 +408,7 @@ struct taihu_cpld_t {
    uint8_t reg1;
 };

-static uint32_t taihu_cpld_readb (void *opaque, hwaddr addr)
+static uint64_t taihu_cpld_read(void *opaque, hwaddr addr, unsigned size)
 {
    taihu_cpld_t *cpld;
    uint32_t ret;
@@ -429,8 +429,8 @@ static uint32_t taihu_cpld_readb (void *opaque, hwaddr addr)
    return ret;
 }

-static void taihu_cpld_writeb (void *opaque,
-                               hwaddr addr, uint32_t value)
+static void taihu_cpld_write(void *opaque, hwaddr addr,
+                             uint64_t value, unsigned size)
 {
    taihu_cpld_t *cpld;

@@ -447,48 +447,12 @@ static void taihu_cpld_writeb (void *opaque,
    }
 }

-static uint32_t taihu_cpld_readw (void *opaque, hwaddr addr)
-{
-    uint32_t ret;
-
-    ret = taihu_cpld_readb(opaque, addr) << 8;
-    ret |= taihu_cpld_readb(opaque, addr + 1);
-
-    return ret;
-}
-
-static void taihu_cpld_writew (void *opaque,
-                               hwaddr addr, uint32_t value)
-{
-    taihu_cpld_writeb(opaque, addr, (value >> 8) & 0xFF);
-    taihu_cpld_writeb(opaque, addr + 1, value & 0xFF);
-}
-
-static uint32_t taihu_cpld_readl (void *opaque, hwaddr addr)
-{
-    uint32_t ret;
-
-    ret = taihu_cpld_readb(opaque, addr) << 24;
-    ret |= taihu_cpld_readb(opaque, addr + 1) << 16;
-    ret |= taihu_cpld_readb(opaque, addr + 2) << 8;
-    ret |= taihu_cpld_readb(opaque, addr + 3);
-
-    return ret;
-}
-
-static void taihu_cpld_writel (void *opaque,
-                               hwaddr addr, uint32_t value)
-{
-    taihu_cpld_writel(opaque, addr, (value >> 24) & 0xFF);
-    taihu_cpld_writel(opaque, addr + 1, (value >> 16) & 0xFF);
-    taihu_cpld_writel(opaque, addr + 2, (value >> 8) & 0xFF);
-    taihu_cpld_writeb(opaque, addr + 3, value & 0xFF);
-}
-
 static const MemoryRegionOps taihu_cpld_ops = {
-    .old_mmio = {
-        .read = { taihu_cpld_readb, taihu_cpld_readw, taihu_cpld_readl, },
-        .write = { taihu_cpld_writeb, taihu_cpld_writew, taihu_cpld_writel, },
+    .read = taihu_cpld_read,
+    .write = taihu_cpld_write,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
    },
    .endianness = DEVICE_NATIVE_ENDIAN,
 };
@@ -2423,8 +2423,6 @@ static void spapr_machine_2_4_class_init(ObjectClass *oc, void *data)
    MachineClass *mc = MACHINE_CLASS(oc);

    mc->desc = "pSeries Logical Partition (PAPR compliant) v2.4";
-    mc->alias = "pseries";
-    mc->is_default = 0;
    mc->compat_props = compat_props;
 }

@@ -254,10 +254,16 @@ static void prop_get_fdt(Object *obj, Visitor *v, void *opaque,
                        const char *name, Error **errp)
 {
    sPAPRDRConnector *drc = SPAPR_DR_CONNECTOR(obj);
+    Error *err = NULL;
    int fdt_offset_next, fdt_offset, fdt_depth;
    void *fdt;

    if (!drc->fdt) {
+        visit_start_struct(v, NULL, NULL, name, 0, &err);
+        if (!err) {
+            visit_end_struct(v, &err);
+        }
+        error_propagate(errp, err);
        return;
    }

@@ -276,24 +282,43 @@ static void prop_get_fdt(Object *obj, Visitor *v, void *opaque,
        case FDT_BEGIN_NODE:
            fdt_depth++;
            name = fdt_get_name(fdt, fdt_offset, &name_len);
-            visit_start_struct(v, NULL, NULL, name, 0, NULL);
+            visit_start_struct(v, NULL, NULL, name, 0, &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
            break;
        case FDT_END_NODE:
            /* shouldn't ever see an FDT_END_NODE before FDT_BEGIN_NODE */
            g_assert(fdt_depth > 0);
-            visit_end_struct(v, NULL);
+            visit_end_struct(v, &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
            fdt_depth--;
            break;
        case FDT_PROP: {
            int i;
            prop = fdt_get_property_by_offset(fdt, fdt_offset, &prop_len);
            name = fdt_string(fdt, fdt32_to_cpu(prop->nameoff));
-            visit_start_list(v, name, NULL);
+            visit_start_list(v, name, &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
            for (i = 0; i < prop_len; i++) {
-                visit_type_uint8(v, (uint8_t *)&prop->data[i], NULL, NULL);
-
+                visit_type_uint8(v, (uint8_t *)&prop->data[i], NULL, &err);
+                if (err) {
+                    error_propagate(errp, err);
+                    return;
+                }
+            }
+            visit_end_list(v, &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
            }
-            visit_end_list(v, NULL);
            break;
        }
        default:
@@ -574,6 +599,10 @@ static void spapr_dr_connector_class_init(ObjectClass *k, void *data)
    drck->attach = attach;
    drck->detach = detach;
    drck->release_pending = release_pending;
+    /*
+     * Reason: it crashes FIXME find and document the real reason
+     */
+    dk->cannot_instantiate_with_device_add_yet = true;
 }

 static const TypeInfo spapr_dr_connector_info = {
@@ -308,7 +308,7 @@ static IOMMUTLBEntry s390_translate_iommu(MemoryRegion *iommu, hwaddr addr,
 {
    uint64_t pte;
    uint32_t flags;
-    S390PCIBusDevice *pbdev = container_of(iommu, S390PCIBusDevice, mr);
+    S390PCIBusDevice *pbdev = container_of(iommu, S390PCIBusDevice, iommu_mr);
    S390pciState *s;
    IOMMUTLBEntry ret = {
        .target_as = &address_space_memory,
@@ -454,14 +454,32 @@ static const MemoryRegionOps s390_msi_ctrl_ops = {
    .endianness = DEVICE_LITTLE_ENDIAN,
 };

+void s390_pcihost_iommu_configure(S390PCIBusDevice *pbdev, bool enable)
+{
+    pbdev->configured = false;
+
+    if (enable) {
+        uint64_t size = pbdev->pal - pbdev->pba + 1;
+        memory_region_init_iommu(&pbdev->iommu_mr, OBJECT(&pbdev->mr),
+                                 &s390_iommu_ops, "iommu-s390", size);
+        memory_region_add_subregion(&pbdev->mr, pbdev->pba, &pbdev->iommu_mr);
+    } else {
+        memory_region_del_subregion(&pbdev->mr, &pbdev->iommu_mr);
+    }
+
+    pbdev->configured = true;
+}
+
 static void s390_pcihost_init_as(S390pciState *s)
 {
    int i;
+    S390PCIBusDevice *pbdev;

    for (i = 0; i < PCI_SLOT_MAX; i++) {
-        memory_region_init_iommu(&s->pbdev[i].mr, OBJECT(s),
-                                 &s390_iommu_ops, "iommu-s390", UINT64_MAX);
-        address_space_init(&s->pbdev[i].as, &s->pbdev[i].mr, "iommu-pci");
+        pbdev = &s->pbdev[i];
+        memory_region_init(&pbdev->mr, OBJECT(s),
+                           "iommu-root-s390", UINT64_MAX);
+        address_space_init(&pbdev->as, &pbdev->mr, "iommu-pci");
    }

    memory_region_init_io(&s->msix_notify_mr, OBJECT(s),
@@ -231,6 +231,7 @@ typedef struct S390PCIBusDevice {
    AdapterRoutes routes;
    AddressSpace as;
    MemoryRegion mr;
+    MemoryRegion iommu_mr;
 } S390PCIBusDevice;

 typedef struct S390pciState {
@@ -244,6 +245,7 @@ typedef struct S390pciState {
 int chsc_sei_nt2_get_event(void *res);
 int chsc_sei_nt2_have_event(void);
 void s390_pci_sclp_configure(int configure, SCCB *sccb);
+void s390_pcihost_iommu_configure(S390PCIBusDevice *pbdev, bool enable);
 S390PCIBusDevice *s390_pci_find_dev_by_idx(uint32_t idx);
 S390PCIBusDevice *s390_pci_find_dev_by_fh(uint32_t fh);
 S390PCIBusDevice *s390_pci_find_dev_by_fid(uint32_t fid);
@@ -528,7 +528,7 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2)
        goto out;
    }

-    mr = pci_device_iommu_address_space(pbdev->pdev)->root;
+    mr = &pbdev->iommu_mr;
    while (start < end) {
        entry = mr->iommu_ops->translate(mr, start, 0);

@@ -689,6 +689,9 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib)
    pbdev->pba = pba;
    pbdev->pal = pal;
    pbdev->g_iota = g_iota;
+
+    s390_pcihost_iommu_configure(pbdev, true);
+
    return 0;
 }

@@ -697,6 +700,8 @@ static void dereg_ioat(S390PCIBusDevice *pbdev)
    pbdev->pba = 0;
    pbdev->pal = 0;
    pbdev->g_iota = 0;
+
+    s390_pcihost_iommu_configure(pbdev, false);
 }

 int mpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar)
@@ -33,6 +33,7 @@
 #include "hw/virtio/virtio.h"
 #include "sysemu/kvm.h"
 #include "exec/address-spaces.h"
+#include "sysemu/qtest.h"

 #include "hw/s390x/s390-virtio-bus.h"
 #include "hw/s390x/sclp.h"
@@ -268,9 +269,11 @@ static void s390_init(MachineState *machine)
    hwaddr virtio_region_len;
    hwaddr virtio_region_start;

-    error_printf("WARNING\n"
-                 "The s390-virtio machine (non-ccw) is deprecated.\n"
-                 "It will be removed in 2.6. Please use s390-ccw-virtio\n");
+    if (!qtest_enabled()) {
+        error_printf("WARNING\n"
+                     "The s390-virtio machine (non-ccw) is deprecated.\n"
+                     "It will be removed in 2.6. Please use s390-ccw-virtio\n");
+    }

    if (machine->ram_slots) {
        error_report("Memory hotplug not supported by the selected machine.");
@@ -1555,6 +1555,17 @@ static void virtio_ccw_device_plugged(DeviceState *d, Error **errp)
                          d->hotplugged, 1);
 }

+static void virtio_ccw_post_plugged(DeviceState *d, Error **errp)
+{
+   VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
+   VirtIODevice *vdev = virtio_bus_get_device(&dev->bus);
+
+   if (!virtio_host_has_feature(vdev, VIRTIO_F_VERSION_1)) {
+        /* A backend didn't support modern virtio. */
+       dev->max_rev = 0;
+   }
+}
+
 static void virtio_ccw_device_unplugged(DeviceState *d)
 {
    VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
@@ -1891,6 +1902,7 @@ static void virtio_ccw_bus_class_init(ObjectClass *klass, void *data)
    k->save_config = virtio_ccw_save_config;
    k->load_config = virtio_ccw_load_config;
    k->device_plugged = virtio_ccw_device_plugged;
+    k->post_plugged = virtio_ccw_post_plugged;
    k->device_unplugged = virtio_ccw_device_unplugged;
 }

@@ -494,6 +494,7 @@ SDState *sd_init(BlockBackend *blk, bool is_spi)
    if (sd->blk) {
        /* Attach dev if not already attached.  (This call ignores an
         * error return code if sd->blk is already attached.) */
+        /* FIXME ignoring blk_attach_dev() failure is dangerously brittle */
        blk_attach_dev(sd->blk, sd);
        blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
    }
@@ -1221,7 +1221,12 @@ const VMStateDescription sdhci_vmstate = {
 /* Capabilities registers provide information on supported features of this
 * specific host controller implementation */
 static Property sdhci_pci_properties[] = {
-    DEFINE_BLOCK_PROPERTIES(SDHCIState, conf),
+    /*
+     * We currently fuse controller and card into a single device
+     * model, but we intend to separate them.  For that purpose, the
+     * properties that belong to the card are marked as experimental.
+     */
+    DEFINE_PROP_DRIVE("x-drive", SDHCIState, blk),
    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
            SDHC_CAPAB_REG_DEFAULT),
    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
@@ -1233,7 +1238,7 @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
    SDHCIState *s = PCI_SDHCI(dev);
    dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
    dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
-    sdhci_initfn(s, s->conf.blk);
+    sdhci_initfn(s, s->blk);
    s->buf_maxsz = sdhci_get_fifolen(s);
    s->fifo_buffer = g_malloc0(s->buf_maxsz);
    s->irq = pci_allocate_irq(dev);
@@ -56,6 +56,9 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
    assert(vdc->get_features != NULL);
    vdev->host_features = vdc->get_features(vdev, vdev->host_features,
                                            errp);
+    if (klass->post_plugged != NULL) {
+        klass->post_plugged(qbus->parent, errp);
+    }
 }

 /* Reset the virtio_bus */
@@ -1814,13 +1814,10 @@ static void virtio_pci_realize(PCIDevice *pci_dev, Error **errp)

    address_space_init(&proxy->modern_as, &proxy->modern_cfg, "virtio-pci-cfg-as");

-    if (!(proxy->flags & VIRTIO_PCI_FLAG_DISABLE_PCIE)
-        && !(proxy->flags & VIRTIO_PCI_FLAG_DISABLE_MODERN)
-        && pci_bus_is_express(pci_dev->bus)
-        && !pci_bus_is_root(pci_dev->bus)) {
+    if (pci_is_express(pci_dev) && pci_bus_is_express(pci_dev->bus) &&
+        !pci_bus_is_root(pci_dev->bus)) {
        int pos;

-        pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
        pos = pcie_endpoint_cap_init(pci_dev, 0);
        assert(pos > 0);

@@ -1832,6 +1829,12 @@ static void virtio_pci_realize(PCIDevice *pci_dev, Error **errp)
         * PCI Power Management Interface Specification.
         */
        pci_set_word(pci_dev->config + pos + PCI_PM_PMC, 0x3);
+    } else {
+        /*
+         * make future invocations of pci_is_express() return false
+         * and pci_config_size() return PCI_CONFIG_SPACE_SIZE.
+         */
+        pci_dev->cap_present &= ~QEMU_PCI_CAP_EXPRESS;
    }

    virtio_pci_bus_new(&proxy->bus, sizeof(proxy->bus), proxy);
@@ -1879,10 +1882,25 @@ static Property virtio_pci_properties[] = {
    DEFINE_PROP_END_OF_LIST(),
 };

+static void virtio_pci_dc_realize(DeviceState *qdev, Error **errp)
+{
+    VirtioPCIClass *vpciklass = VIRTIO_PCI_GET_CLASS(qdev);
+    VirtIOPCIProxy *proxy = VIRTIO_PCI(qdev);
+    PCIDevice *pci_dev = &proxy->pci_dev;
+
+    if (!(proxy->flags & VIRTIO_PCI_FLAG_DISABLE_PCIE) &&
+        !(proxy->flags & VIRTIO_PCI_FLAG_DISABLE_MODERN)) {
+        pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
+    }
+
+    vpciklass->parent_dc_realize(qdev, errp);
+}
+
 static void virtio_pci_class_init(ObjectClass *klass, void *data)
 {
    DeviceClass *dc = DEVICE_CLASS(klass);
    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    VirtioPCIClass *vpciklass = VIRTIO_PCI_CLASS(klass);

    dc->props = virtio_pci_properties;
    k->realize = virtio_pci_realize;
@@ -1890,6 +1908,8 @@ static void virtio_pci_class_init(ObjectClass *klass, void *data)
    k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
    k->revision = VIRTIO_PCI_ABI_VERSION;
    k->class_id = PCI_CLASS_OTHERS;
+    vpciklass->parent_dc_realize = dc->realize;
+    dc->realize = virtio_pci_dc_realize;
    dc->reset = virtio_pci_reset;
 }

@@ -105,6 +105,7 @@ typedef struct {

 typedef struct VirtioPCIClass {
    PCIDeviceClass parent_class;
+    DeviceRealize parent_dc_realize;
    void (*realize)(VirtIOPCIProxy *vpci_dev, Error **errp);
 } VirtioPCIClass;

@@ -61,7 +61,7 @@ typedef enum {
     * opened with BDRV_O_UNMAP.
     */
    BDRV_REQ_MAY_UNMAP          = 0x4,
-    BDRV_REQ_NO_COPY_ON_READ    = 0x8,
+    BDRV_REQ_NO_SERIALISING     = 0x8,
 } BdrvRequestFlags;

 typedef struct BlockSizes {
@@ -248,7 +248,7 @@ int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,
    int nb_sectors, QEMUIOVector *qiov);
 int coroutine_fn bdrv_co_copy_on_readv(BlockDriverState *bs,
    int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
-int coroutine_fn bdrv_co_no_copy_on_readv(BlockDriverState *bs,
+int coroutine_fn bdrv_co_readv_no_serialising(BlockDriverState *bs,
    int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
 int coroutine_fn bdrv_co_writev(BlockDriverState *bs, int64_t sector_num,
    int nb_sectors, QEMUIOVector *qiov);
@@ -174,11 +174,13 @@ extern unsigned long reserved_va;
 #define TARGET_PAGE_MASK ~(TARGET_PAGE_SIZE - 1)
 #define TARGET_PAGE_ALIGN(addr) (((addr) + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK)

-/* ??? These should be the larger of uintptr_t and target_ulong.  */
+/* Using intptr_t ensures that qemu_*_page_mask is sign-extended even
+ * when intptr_t is 32-bit and we are aligning a long long.
+ */
 extern uintptr_t qemu_real_host_page_size;
-extern uintptr_t qemu_real_host_page_mask;
+extern intptr_t qemu_real_host_page_mask;
 extern uintptr_t qemu_host_page_size;
-extern uintptr_t qemu_host_page_mask;
+extern intptr_t qemu_host_page_mask;

 #define HOST_PAGE_ALIGN(addr) (((addr) + qemu_host_page_size - 1) & qemu_host_page_mask)
 #define REAL_HOST_PAGE_ALIGN(addr) (((addr) + qemu_real_host_page_size - 1) & \
@@ -504,7 +504,6 @@ typedef struct {

 #define OCF_CREATE_CONN_CANCEL		0x0008
 typedef struct {
-    uint8_t	status;
    bdaddr_t	bdaddr;
 } QEMU_PACKED create_conn_cancel_cp;
 #define CREATE_CONN_CANCEL_CP_SIZE 6
@@ -1266,13 +1265,13 @@ typedef struct {
    uint8_t	status;
    uint16_t	handle;
 } QEMU_PACKED reset_failed_contact_counter_rp;
-#define RESET_FAILED_CONTACT_COUNTER_RP_SIZE 4
+#define RESET_FAILED_CONTACT_COUNTER_RP_SIZE 3

 #define OCF_READ_LINK_QUALITY		0x0003
 typedef struct {
    uint16_t	handle;
 } QEMU_PACKED read_link_quality_cp;
-#define READ_LINK_QUALITY_CP_SIZE 4
+#define READ_LINK_QUALITY_CP_SIZE 2

 typedef struct {
    uint8_t	status;
@@ -1332,7 +1331,7 @@ typedef struct {
    uint8_t	dev_class[3];
    uint16_t	clock_offset;
 } QEMU_PACKED inquiry_info;
-#define INQUIRY_INFO_SIZE 14
+#define INQUIRY_INFO_SIZE 15

 #define EVT_CONN_COMPLETE		0x03
 typedef struct {
@@ -1381,7 +1380,7 @@ typedef struct {
    uint16_t	handle;
    uint8_t	encrypt;
 } QEMU_PACKED evt_encrypt_change;
-#define EVT_ENCRYPT_CHANGE_SIZE 5
+#define EVT_ENCRYPT_CHANGE_SIZE 4

 #define EVT_CHANGE_CONN_LINK_KEY_COMPLETE	0x09
 typedef struct {
@@ -1629,18 +1628,6 @@ typedef struct {
 } QEMU_PACKED evt_sniff_subrate;
 #define EVT_SNIFF_SUBRATE_SIZE 11

-#define EVT_EXTENDED_INQUIRY_RESULT	0x2F
-typedef struct {
-    bdaddr_t	bdaddr;
-    uint8_t	pscan_rep_mode;
-    uint8_t	pscan_period_mode;
-    uint8_t	dev_class[3];
-    uint16_t	clock_offset;
-    int8_t	rssi;
-    uint8_t	data[240];
-} QEMU_PACKED extended_inquiry_info;
-#define EXTENDED_INQUIRY_INFO_SIZE 254
-
 #define EVT_TESTING			0xFE

 #define EVT_VENDOR			0xFF
@@ -250,7 +250,6 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
                          uint8_t *buf, void *hba_private);
 int32_t scsi_req_enqueue(SCSIRequest *req);
-void scsi_req_free(SCSIRequest *req);
 SCSIRequest *scsi_req_ref(SCSIRequest *req);
 void scsi_req_unref(SCSIRequest *req);

@@ -39,7 +39,7 @@ typedef struct SDHCIState {
    };
    SDState *card;
    MemoryRegion iomem;
-    BlockConf conf;
+    BlockBackend *blk;

    QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
    QEMUTimer *transfer_timer;
@@ -66,7 +66,6 @@ struct vhost_dev {
 int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
                   VhostBackendType backend_type);
 void vhost_dev_cleanup(struct vhost_dev *hdev);
-bool vhost_dev_query(struct vhost_dev *hdev, VirtIODevice *vdev);
 int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev);
 void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev);
 int vhost_dev_enable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev);
@@ -37,7 +37,6 @@ struct VirtIOBlkConf
    char *serial;
    uint32_t scsi;
    uint32_t config_wce;
-    uint32_t data_plane;
    uint32_t request_merging;
 };

@@ -59,6 +59,11 @@ typedef struct VirtioBusClass {
     * This is called by virtio-bus just after the device is plugged.
     */
    void (*device_plugged)(DeviceState *d, Error **errp);
+    /*
+     * Re-evaluate setup after feature bits have been validated
+     * by the device backend.
+     */
+    void (*post_plugged)(DeviceState *d, Error **errp);
    /*
     * transport independent exit function.
     * This is called by virtio-bus just before the device is unplugged.
@@ -3,6 +3,8 @@

 #include "qemu-common.h"

+size_t qemu_fd_getpagesize(int fd);
+
 void *qemu_ram_mmap(int fd, size_t size, size_t align, bool shared);

 void qemu_ram_munmap(void *ptr, size_t size);
@@ -3,7 +3,6 @@

 /* A load of opaque types so that device init declarations don't have to
   pull in all the real definitions.  */
-struct Monitor;

 /* Please keep this list in alphabetical order */
 typedef struct AdapterInfo AdapterInfo;
@@ -19,8 +18,8 @@ typedef struct BusState BusState;
 typedef struct CharDriverState CharDriverState;
 typedef struct CompatProperty CompatProperty;
 typedef struct CPUAddressSpace CPUAddressSpace;
-typedef struct DeviceState DeviceState;
 typedef struct DeviceListener DeviceListener;
+typedef struct DeviceState DeviceState;
 typedef struct DisplayChangeListener DisplayChangeListener;
 typedef struct DisplayState DisplayState;
 typedef struct DisplaySurface DisplaySurface;
@@ -46,6 +45,7 @@ typedef struct MigrationIncomingState MigrationIncomingState;
 typedef struct MigrationParams MigrationParams;
 typedef struct MigrationState MigrationState;
 typedef struct Monitor Monitor;
+typedef struct MonitorDef MonitorDef;
 typedef struct MouseTransformInfo MouseTransformInfo;
 typedef struct MSIMessage MSIMessage;
 typedef struct NetClientState NetClientState;
@@ -63,13 +63,13 @@ typedef struct PCIESlot PCIESlot;
 typedef struct PCIExpressDevice PCIExpressDevice;
 typedef struct PCIExpressHost PCIExpressHost;
 typedef struct PCIHostState PCIHostState;
-typedef struct PCMachineState PCMachineState;
 typedef struct PCMachineClass PCMachineClass;
+typedef struct PCMachineState PCMachineState;
 typedef struct PCMCIACardState PCMCIACardState;
 typedef struct PixelFormat PixelFormat;
 typedef struct PostcopyDiscardState PostcopyDiscardState;
-typedef struct PropertyInfo PropertyInfo;
 typedef struct Property Property;
+typedef struct PropertyInfo PropertyInfo;
 typedef struct QEMUBH QEMUBH;
 typedef struct QemuConsole QemuConsole;
 typedef struct QEMUFile QEMUFile;
@@ -78,10 +78,10 @@ typedef struct QemuOpts QemuOpts;
 typedef struct QemuOptsList QemuOptsList;
 typedef struct QEMUSGList QEMUSGList;
 typedef struct QEMUSizedBuffer QEMUSizedBuffer;
-typedef struct QEMUTimerListGroup QEMUTimerListGroup;
 typedef struct QEMUTimer QEMUTimer;
-typedef struct Range Range;
+typedef struct QEMUTimerListGroup QEMUTimerListGroup;
 typedef struct RAMBlock RAMBlock;
+typedef struct Range Range;
 typedef struct SerialState SerialState;
 typedef struct SHPCDevice SHPCDevice;
 typedef struct SMBusDevice SMBusDevice;
@@ -89,6 +89,5 @@ typedef struct SSIBus SSIBus;
 typedef struct uWireSlave uWireSlave;
 typedef struct VirtIODevice VirtIODevice;
 typedef struct Visitor Visitor;
-typedef struct MonitorDef MonitorDef;

 #endif /* QEMU_TYPEDEFS_H */
@@ -394,9 +394,6 @@ struct ObjectClass
 * As a result, #Object contains a reference to the objects type as its
 * first member.  This allows identification of the real type of the object at
 * run time.
- *
- * #Object also contains a list of #Interfaces that this object
- * implements.
 */
 struct Object
 {
@@ -87,7 +87,7 @@ static inline void os_setup_post(void) {}
 void os_set_line_buffering(void);
 static inline void os_set_proc_name(const char *dummy) {}

-size_t getpagesize(void);
+int getpagesize(void);

 #if !defined(EPROTONOSUPPORT)
 # define EPROTONOSUPPORT EINVAL
@@ -72,6 +72,7 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
 {
    Error *local_error = NULL;
    IOThread *iothread = IOTHREAD(obj);
+    char *name, *thread_name;

    iothread->stopping = false;
    iothread->thread_id = -1;
@@ -87,8 +88,12 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
    /* This assumes we are called from a thread with useful CPU affinity for us
     * to inherit.
     */
-    qemu_thread_create(&iothread->thread, "iothread", iothread_run,
+    name = object_get_canonical_path_component(OBJECT(obj));
+    thread_name = g_strdup_printf("IO %s", name);
+    qemu_thread_create(&iothread->thread, thread_name, iothread_run,
                       iothread, QEMU_THREAD_JOINABLE);
+    g_free(thread_name);
+    g_free(name);

    /* Wait for initialization to complete */
    qemu_mutex_lock(&iothread->init_done_lock);
@@ -1478,8 +1478,7 @@ static void zero_bss(abi_ulong elf_bss, abi_ulong last_bss, int prot)

    host_start = (uintptr_t) g2h(elf_bss);
    host_end = (uintptr_t) g2h(last_bss);
-    host_map_start = (host_start + qemu_real_host_page_size - 1);
-    host_map_start &= -qemu_real_host_page_size;
+    host_map_start = REAL_HOST_PAGE_ALIGN(host_start);

    if (host_map_start < host_end) {
        void *p = mmap((void *)host_map_start, host_end - host_map_start,
@@ -444,9 +444,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
           /* If so, truncate the file map at eof aligned with 
              the hosts real pagesize. Additional anonymous maps
              will be created beyond EOF.  */
-           len = (sb.st_size - offset);
-           len += qemu_real_host_page_size - 1;
-           len &= ~(qemu_real_host_page_size - 1);
+           len = REAL_HOST_PAGE_ALIGN(sb.st_size - offset);
       }
    }

@@ -230,7 +230,7 @@ static int os_host_main_loop_wait(int64_t timeout)
    if (!timeout && (spin_counter > MAX_MAIN_LOOP_SPIN)) {
        static bool notified;

-        if (!notified && !qtest_enabled()) {
+        if (!notified && !qtest_driver()) {
            fprintf(stderr,
                    "main-loop: WARNING: I/O thread spun for %d iterations\n",
                    MAX_MAIN_LOOP_SPIN);
@@ -1674,7 +1674,7 @@ static void *migration_thread(void *opaque)
        if (current_time >= initial_time + BUFFER_DELAY) {
            uint64_t transferred_bytes = qemu_ftell(s->file) - initial_bytes;
            uint64_t time_spent = current_time - initial_time;
-            double bandwidth = transferred_bytes / time_spent;
+            double bandwidth = (double)transferred_bytes / time_spent;
            max_size = bandwidth * migrate_max_downtime() / 1000000;

            s->mbps = time_spent ? (((double) transferred_bytes * 8.0) /
@@ -72,7 +72,8 @@ static ssize_t socket_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,
            pfd.fd = s->fd;
            pfd.events = G_IO_OUT | G_IO_ERR;
            pfd.revents = 0;
-            g_poll(&pfd, 1 /* 1 fd */, -1 /* no timeout */);
+            TFR(err = g_poll(&pfd, 1, -1 /* no timeout */));
+            /* Errors other than EINTR intentionally ignored */
        }
     }

@@ -716,6 +716,9 @@ static int save_zero_page(QEMUFile *f, RAMBlock *block, ram_addr_t offset,
 * ram_save_page: Send the given page to the stream
 *
 * Returns: Number of pages written.
+ *          < 0 - error
+ *          >=0 - Number of pages written - this might legally be 0
+ *                if xbzrle noticed the page was the same.
 *
 * @f: QEMUFile where to send the data
 * @block: block that contains the page we want to send
@@ -1249,7 +1252,13 @@ static int ram_save_target_page(MigrationState *ms, QEMUFile *f,
        if (unsentmap) {
            clear_bit(dirty_ram_abs >> TARGET_PAGE_BITS, unsentmap);
        }
-        last_sent_block = block;
+        /* Only update last_sent_block if a block was actually sent; xbzrle
+         * might have decided the page was identical so didn't bother writing
+         * to the stream.
+         */
+        if (res > 0) {
+            last_sent_block = block;
+        }
    }

    return res;
@@ -77,7 +77,12 @@

 //#define DEBUG_TAP_WIN32

-#define TUN_ASYNCHRONOUS_WRITES 1
+/* FIXME: The asynch write path appears to be broken at
+ * present. WriteFile() ignores the lpNumberOfBytesWritten parameter
+ * for overlapped writes, with the result we return zero bytes sent,
+ * and after handling a single packet, receive is disabled for this
+ * interface. */
+/* #define TUN_ASYNCHRONOUS_WRITES 1 */

 #define TUN_BUFFER_SIZE 1560
 #define TUN_MAX_BUFFER_COUNT 32
@@ -356,7 +361,8 @@ static int get_device_guid(
                &len);

            if (status != ERROR_SUCCESS || name_type != REG_SZ) {
-                    return -1;
+                ++i;
+                continue;
            }
            else {
                if (is_tap_win32_dev(enum_name)) {
@@ -460,27 +466,48 @@ static int tap_win32_write(tap_win32_overlapped_t *overlapped,
    BOOL result;
    DWORD error;

+#ifdef TUN_ASYNCHRONOUS_WRITES
    result = GetOverlappedResult( overlapped->handle, &overlapped->write_overlapped,
                                  &write_size, FALSE);

    if (!result && GetLastError() == ERROR_IO_INCOMPLETE)
        WaitForSingleObject(overlapped->write_event, INFINITE);
+#endif

    result = WriteFile(overlapped->handle, buffer, size,
                       &write_size, &overlapped->write_overlapped);

+#ifdef TUN_ASYNCHRONOUS_WRITES
+    /* FIXME: we can't sensibly set write_size here, without waiting
+     * for the IO to complete! Moreover, we can't return zero,
+     * because that will disable receive on this interface, and we
+     * also can't assume it will succeed and return the full size,
+     * because that will result in the buffer being reclaimed while
+     * the IO is in progress. */
+#error Async writes are broken. Please disable TUN_ASYNCHRONOUS_WRITES.
+#else /* !TUN_ASYNCHRONOUS_WRITES */
    if (!result) {
-        switch (error = GetLastError())
-        {
-        case ERROR_IO_PENDING:
-#ifndef TUN_ASYNCHRONOUS_WRITES
-            WaitForSingleObject(overlapped->write_event, INFINITE);
-#endif
-            break;
-        default:
-            return -1;
+        error = GetLastError();
+        if (error == ERROR_IO_PENDING) {
+            result = GetOverlappedResult(overlapped->handle,
+                                         &overlapped->write_overlapped,
+                                         &write_size, TRUE);
        }
    }
+#endif
+
+    if (!result) {
+#ifdef DEBUG_TAP_WIN32
+        LPTSTR msgbuf;
+        error = GetLastError();
+        FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
+                      NULL, error, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                      &msgbuf, 0, NULL);
+        fprintf(stderr, "Tap-Win32: Error WriteFile %d - %s\n", error, msgbuf);
+        LocalFree(msgbuf);
+#endif
+        return 0;
+    }

    return write_size;
 }
@@ -316,6 +316,11 @@ int net_init_vhost_user(const NetClientOptions *opts, const char *name,
    }

    queues = vhost_user_opts->has_queues ? vhost_user_opts->queues : 1;
+    if (queues < 1) {
+        error_setg(errp,
+                   "vhost-user number of queues must be bigger than zero");
+        return -1;
+    }

    return net_vhost_user_init(peer, "vhost_user", name, chr, queues);
 }
@@ -10,7 +10,7 @@ $(call set-vpath, $(SRC_PATH)/pc-bios/s390-ccw)
 .PHONY : all clean build-all

 OBJECTS = start.o main.o bootmap.o sclp-ascii.o virtio.o
-CFLAGS += -fPIE -fno-stack-protector -ffreestanding
+CFLAGS += -fPIE -fno-stack-protector -ffreestanding -march=z900
 CFLAGS += -fno-delete-null-pointer-checks -msoft-float
 LDFLAGS += -Wl,-pie -nostdlib

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: QEMU 1.4.50\n"
 "Report-Msgid-Bugs-To: qemu-devel@nongnu.org\n"
-"POT-Creation-Date: 2015-07-30 07:34+0200\n"
+"POT-Creation-Date: 2015-12-10 13:29+0000\n"
 "PO-Revision-Date: 2012-02-28 16:00+0100\n"
 "Last-Translator: Kevin Wolf <kwolf@redhat.com>\n"
 "Language-Team: Deutsch <de@li.org>\n"
@@ -16,70 +16,70 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n!=1);\n"

-#: ui/gtk.c:260
+#: ui/gtk.c:271
 msgid " - Press Ctrl+Alt+G to release grab"
 msgstr " - Strg+Alt+G drücken, um Eingabegeräte freizugeben"

-#: ui/gtk.c:264
+#: ui/gtk.c:275
 msgid " [Paused]"
 msgstr " [Angehalten]"

-#: ui/gtk.c:1688
+#: ui/gtk.c:1783
 msgid "_Pause"
 msgstr "_Angehalten"

-#: ui/gtk.c:1694
+#: ui/gtk.c:1789
 msgid "_Reset"
 msgstr "_Reset"

-#: ui/gtk.c:1697
+#: ui/gtk.c:1792
 msgid "Power _Down"
 msgstr "_Herunterfahren"

-#: ui/gtk.c:1703
+#: ui/gtk.c:1798
 msgid "_Quit"
 msgstr "_Beenden"

-#: ui/gtk.c:1787
+#: ui/gtk.c:1890
 msgid "_Fullscreen"
 msgstr "_Vollbild"

-#: ui/gtk.c:1801
+#: ui/gtk.c:1904
 msgid "Zoom _In"
 msgstr "_Heranzoomen"

-#: ui/gtk.c:1808
+#: ui/gtk.c:1911
 msgid "Zoom _Out"
 msgstr "_Wegzoomen"

-#: ui/gtk.c:1815
+#: ui/gtk.c:1918
 msgid "Best _Fit"
 msgstr "_Einpassen"

-#: ui/gtk.c:1822
+#: ui/gtk.c:1925
 msgid "Zoom To _Fit"
 msgstr "Auf _Fenstergröße skalieren"

-#: ui/gtk.c:1828
+#: ui/gtk.c:1931
 msgid "Grab On _Hover"
 msgstr "Tastatur _automatisch einfangen"

-#: ui/gtk.c:1831
+#: ui/gtk.c:1934
 msgid "_Grab Input"
 msgstr "_Eingabegeräte einfangen"

-#: ui/gtk.c:1860
+#: ui/gtk.c:1963
 msgid "Show _Tabs"
 msgstr "Reiter anzeigen"

-#: ui/gtk.c:1863
+#: ui/gtk.c:1966
 msgid "Detach Tab"
 msgstr "Reiter abtrennen"

-#: ui/gtk.c:1875
+#: ui/gtk.c:1978
 msgid "_Machine"
 msgstr "_Maschine"

-#: ui/gtk.c:1880
+#: ui/gtk.c:1983
 msgid "_View"
 msgstr "_Ansicht"
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: QEMU 1.4.50\n"
 "Report-Msgid-Bugs-To: qemu-devel@nongnu.org\n"
-"POT-Creation-Date: 2015-07-30 07:34+0200\n"
+"POT-Creation-Date: 2015-12-10 13:29+0000\n"
 "PO-Revision-Date: 2014-07-28 23:25+0200\n"
 "Last-Translator: Aurelien Jarno <aurelien@aurel32.net>\n"
 "Language-Team: French <FR@li.org>\n"
@@ -17,70 +17,70 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
 "X-Generator: Lokalize 1.4\n"

-#: ui/gtk.c:260
+#: ui/gtk.c:271
 msgid " - Press Ctrl+Alt+G to release grab"
 msgstr "- Appuyer sur Ctrl+Alt+G pour arrêter la capture"

-#: ui/gtk.c:264
+#: ui/gtk.c:275
 msgid " [Paused]"
 msgstr " [En pause]"

-#: ui/gtk.c:1688
+#: ui/gtk.c:1783
 msgid "_Pause"
 msgstr "_Pause"

-#: ui/gtk.c:1694
+#: ui/gtk.c:1789
 msgid "_Reset"
 msgstr "_Réinitialiser"

-#: ui/gtk.c:1697
+#: ui/gtk.c:1792
 msgid "Power _Down"
 msgstr "_Éteindre"

-#: ui/gtk.c:1703
+#: ui/gtk.c:1798
 msgid "_Quit"
 msgstr "_Quitter"

-#: ui/gtk.c:1787
+#: ui/gtk.c:1890
 msgid "_Fullscreen"
 msgstr "Mode _plein écran"

-#: ui/gtk.c:1801
+#: ui/gtk.c:1904
 msgid "Zoom _In"
 msgstr "Zoom _avant"

-#: ui/gtk.c:1808
+#: ui/gtk.c:1911
 msgid "Zoom _Out"
 msgstr "_Zoom arrière"

-#: ui/gtk.c:1815
+#: ui/gtk.c:1918
 msgid "Best _Fit"
 msgstr "Zoom _idéal"

-#: ui/gtk.c:1822
+#: ui/gtk.c:1925
 msgid "Zoom To _Fit"
 msgstr "Zoomer pour a_juster"

-#: ui/gtk.c:1828
+#: ui/gtk.c:1931
 msgid "Grab On _Hover"
 msgstr "Capturer en _survolant"

-#: ui/gtk.c:1831
+#: ui/gtk.c:1934
 msgid "_Grab Input"
 msgstr "_Capturer les entrées"

-#: ui/gtk.c:1860
+#: ui/gtk.c:1963
 msgid "Show _Tabs"
 msgstr "Montrer les _onglets"

-#: ui/gtk.c:1863
+#: ui/gtk.c:1966
 msgid "Detach Tab"
 msgstr "_Détacher l'onglet"

-#: ui/gtk.c:1875
+#: ui/gtk.c:1978
 msgid "_Machine"
 msgstr "_Machine"

-#: ui/gtk.c:1880
+#: ui/gtk.c:1983
 msgid "_View"
 msgstr "_Vue"
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: QEMU 1.4.50\n"
 "Report-Msgid-Bugs-To: qemu-devel@nongnu.org\n"
-"POT-Creation-Date: 2015-07-30 07:34+0200\n"
+"POT-Creation-Date: 2015-12-10 13:29+0000\n"
 "PO-Revision-Date: 2013-05-06 20:42+0200\n"
 "Last-Translator: Ákos Kovács <akoskovacs@gmx.com>\n"
 "Language-Team: Hungarian <hu@li.org>\n"
@@ -15,73 +15,73 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"

-#: ui/gtk.c:260
+#: ui/gtk.c:271
 msgid " - Press Ctrl+Alt+G to release grab"
 msgstr " - Nyomj Ctrl+Alt+G-t a bemeneti eszközök elengedéséhez"

-#: ui/gtk.c:264
+#: ui/gtk.c:275
 msgid " [Paused]"
 msgstr " [Megállítva]"

-#: ui/gtk.c:1688
+#: ui/gtk.c:1783
 msgid "_Pause"
 msgstr "_Megállítás"

-#: ui/gtk.c:1694
+#: ui/gtk.c:1789
 msgid "_Reset"
 msgstr "Új_raindítás"

-#: ui/gtk.c:1697
+#: ui/gtk.c:1792
 msgid "Power _Down"
 msgstr "_Leállítás"

-#: ui/gtk.c:1703
+#: ui/gtk.c:1798
 msgid "_Quit"
 msgstr ""

-#: ui/gtk.c:1787
+#: ui/gtk.c:1890
 msgid "_Fullscreen"
 msgstr ""

-#: ui/gtk.c:1801
+#: ui/gtk.c:1904
 #, fuzzy
 msgid "Zoom _In"
 msgstr "Ablakmérethez _igazítás"

-#: ui/gtk.c:1808
+#: ui/gtk.c:1911
 #, fuzzy
 msgid "Zoom _Out"
 msgstr "Ablakmérethez _igazítás"

-#: ui/gtk.c:1815
+#: ui/gtk.c:1918
 msgid "Best _Fit"
 msgstr ""

-#: ui/gtk.c:1822
+#: ui/gtk.c:1925
 msgid "Zoom To _Fit"
 msgstr "Ablakmérethez _igazítás"

-#: ui/gtk.c:1828
+#: ui/gtk.c:1931
 msgid "Grab On _Hover"
 msgstr "Automatikus _elfogás"

-#: ui/gtk.c:1831
+#: ui/gtk.c:1934
 msgid "_Grab Input"
 msgstr "_Bemeneti eszközök megragadása"

-#: ui/gtk.c:1860
+#: ui/gtk.c:1963
 msgid "Show _Tabs"
 msgstr "_Fülek megjelenítése"

-#: ui/gtk.c:1863
+#: ui/gtk.c:1966
 msgid "Detach Tab"
 msgstr ""

-#: ui/gtk.c:1875
+#: ui/gtk.c:1978
 msgid "_Machine"
 msgstr "_Gép"

-#: ui/gtk.c:1880
+#: ui/gtk.c:1983
 msgid "_View"
 msgstr "_Nézet"

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: QEMU 1.4.50\n"
 "Report-Msgid-Bugs-To: qemu-devel@nongnu.org\n"
-"POT-Creation-Date: 2015-07-30 07:34+0200\n"
+"POT-Creation-Date: 2015-12-10 13:29+0000\n"
 "PO-Revision-Date: 2014-07-29 08:25+0200\n"
 "Last-Translator: Paolo Bonzini <pbonzini@redhat.com>\n"
 "Language-Team: Italian <it@li.org>\n"
@@ -16,70 +16,70 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"

-#: ui/gtk.c:260
+#: ui/gtk.c:271
 msgid " - Press Ctrl+Alt+G to release grab"
 msgstr " - Premere Ctrl+Alt+G per rilasciare l'input"

-#: ui/gtk.c:264
+#: ui/gtk.c:275
 msgid " [Paused]"
 msgstr " [Pausa]"

-#: ui/gtk.c:1688
+#: ui/gtk.c:1783
 msgid "_Pause"
 msgstr "_Pausa"

-#: ui/gtk.c:1694
+#: ui/gtk.c:1789
 msgid "_Reset"
 msgstr "_Reset"

-#: ui/gtk.c:1697
+#: ui/gtk.c:1792
 msgid "Power _Down"
 msgstr "_Spegni"

-#: ui/gtk.c:1703
+#: ui/gtk.c:1798
 msgid "_Quit"
 msgstr "_Esci"

-#: ui/gtk.c:1787
+#: ui/gtk.c:1890
 msgid "_Fullscreen"
 msgstr ""

-#: ui/gtk.c:1801
+#: ui/gtk.c:1904
 msgid "Zoom _In"
 msgstr "_Aumenta zoom"

-#: ui/gtk.c:1808
+#: ui/gtk.c:1911
 msgid "Zoom _Out"
 msgstr "_Riduci zoom"

-#: ui/gtk.c:1815
+#: ui/gtk.c:1918
 msgid "Best _Fit"
 msgstr "A_nnulla zoom"

-#: ui/gtk.c:1822
+#: ui/gtk.c:1925
 msgid "Zoom To _Fit"
 msgstr "Adatta alla _finestra"

-#: ui/gtk.c:1828
+#: ui/gtk.c:1931
 msgid "Grab On _Hover"
 msgstr "Cattura _automatica input"

-#: ui/gtk.c:1831
+#: ui/gtk.c:1934
 msgid "_Grab Input"
 msgstr "_Cattura input"

-#: ui/gtk.c:1860
+#: ui/gtk.c:1963
 msgid "Show _Tabs"
 msgstr "Mostra _tab"

-#: ui/gtk.c:1863
+#: ui/gtk.c:1966
 msgid "Detach Tab"
 msgstr "_Sposta in una nuova finestra"

-#: ui/gtk.c:1875
+#: ui/gtk.c:1978
 msgid "_Machine"
 msgstr "_Macchina virtuale"

-#: ui/gtk.c:1880
+#: ui/gtk.c:1983
 msgid "_View"
 msgstr "_Visualizza"
@@ -5,9 +5,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: QEMU 2.3.93\n"
+"Project-Id-Version: QEMU 2.4.93\n"
 "Report-Msgid-Bugs-To: qemu-devel@nongnu.org\n"
-"POT-Creation-Date: 2015-07-30 07:34+0200\n"
+"POT-Creation-Date: 2015-12-10 13:29+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -16,70 +16,70 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"

-#: ui/gtk.c:260
+#: ui/gtk.c:271
 msgid " - Press Ctrl+Alt+G to release grab"
 msgstr ""

-#: ui/gtk.c:264
+#: ui/gtk.c:275
 msgid " [Paused]"
 msgstr ""

-#: ui/gtk.c:1688
+#: ui/gtk.c:1783
 msgid "_Pause"
 msgstr ""

-#: ui/gtk.c:1694
+#: ui/gtk.c:1789
 msgid "_Reset"
 msgstr ""

-#: ui/gtk.c:1697
+#: ui/gtk.c:1792
 msgid "Power _Down"
 msgstr ""

-#: ui/gtk.c:1703
+#: ui/gtk.c:1798
 msgid "_Quit"
 msgstr ""

-#: ui/gtk.c:1787
+#: ui/gtk.c:1890
 msgid "_Fullscreen"
 msgstr ""

-#: ui/gtk.c:1801
+#: ui/gtk.c:1904
 msgid "Zoom _In"
 msgstr ""

-#: ui/gtk.c:1808
+#: ui/gtk.c:1911
 msgid "Zoom _Out"
 msgstr ""

-#: ui/gtk.c:1815
+#: ui/gtk.c:1918
 msgid "Best _Fit"
 msgstr ""

-#: ui/gtk.c:1822
+#: ui/gtk.c:1925
 msgid "Zoom To _Fit"
 msgstr ""

-#: ui/gtk.c:1828
+#: ui/gtk.c:1931
 msgid "Grab On _Hover"
 msgstr ""

-#: ui/gtk.c:1831
+#: ui/gtk.c:1934
 msgid "_Grab Input"
 msgstr ""

-#: ui/gtk.c:1860
+#: ui/gtk.c:1963
 msgid "Show _Tabs"
 msgstr ""

-#: ui/gtk.c:1863
+#: ui/gtk.c:1966
 msgid "Detach Tab"
 msgstr ""

-#: ui/gtk.c:1875
+#: ui/gtk.c:1978
 msgid "_Machine"
 msgstr ""

-#: ui/gtk.c:1880
+#: ui/gtk.c:1983
 msgid "_View"
 msgstr ""
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: QEMU 1.4.50\n"
 "Report-Msgid-Bugs-To: qemu-devel@nongnu.org\n"
-"POT-Creation-Date: 2015-07-30 07:34+0200\n"
+"POT-Creation-Date: 2015-12-10 13:29+0000\n"
 "PO-Revision-Date: 2013-04-22 18:35+0300\n"
 "Last-Translator: Ozan Çağlayan <ozancag@gmail.com>\n"
 "Language-Team: Türkçe <>\n"
@@ -17,72 +17,72 @@ msgstr ""
 "Plural-Forms: nplurals=1; plural=0;\n"
 "X-Generator: Gtranslator 2.91.6\n"

-#: ui/gtk.c:260
+#: ui/gtk.c:271
 msgid " - Press Ctrl+Alt+G to release grab"
 msgstr " - Yakalamayı durdurmak için Ctrl+Alt+G tuşlarına basın"

-#: ui/gtk.c:264
+#: ui/gtk.c:275
 msgid " [Paused]"
 msgstr " [Duraklatıldı]"

-#: ui/gtk.c:1688
+#: ui/gtk.c:1783
 msgid "_Pause"
 msgstr "_Duraklat"

-#: ui/gtk.c:1694
+#: ui/gtk.c:1789
 msgid "_Reset"
 msgstr "_Sıfırla"

-#: ui/gtk.c:1697
+#: ui/gtk.c:1792
 msgid "Power _Down"
 msgstr "_Kapat"

-#: ui/gtk.c:1703
+#: ui/gtk.c:1798
 msgid "_Quit"
 msgstr ""

-#: ui/gtk.c:1787
+#: ui/gtk.c:1890
 msgid "_Fullscreen"
 msgstr ""

-#: ui/gtk.c:1801
+#: ui/gtk.c:1904
 #, fuzzy
 msgid "Zoom _In"
 msgstr "Yakınlaş ve Sığ_dır"

-#: ui/gtk.c:1808
+#: ui/gtk.c:1911
 #, fuzzy
 msgid "Zoom _Out"
 msgstr "Yakınlaş ve Sığ_dır"

-#: ui/gtk.c:1815
+#: ui/gtk.c:1918
 msgid "Best _Fit"
 msgstr ""

-#: ui/gtk.c:1822
+#: ui/gtk.c:1925
 msgid "Zoom To _Fit"
 msgstr "Yakınlaş ve Sığ_dır"

-#: ui/gtk.c:1828
+#: ui/gtk.c:1931
 msgid "Grab On _Hover"
 msgstr "Ü_zerindeyken Yakala"

-#: ui/gtk.c:1831
+#: ui/gtk.c:1934
 msgid "_Grab Input"
 msgstr "Girdiyi _Yakala"

-#: ui/gtk.c:1860
+#: ui/gtk.c:1963
 msgid "Show _Tabs"
 msgstr "Se_kmeleri Göster"

-#: ui/gtk.c:1863
+#: ui/gtk.c:1966
 msgid "Detach Tab"
 msgstr ""

-#: ui/gtk.c:1875
+#: ui/gtk.c:1978
 msgid "_Machine"
 msgstr "_Makine"

-#: ui/gtk.c:1880
+#: ui/gtk.c:1983
 msgid "_View"
 msgstr "_Görüntüle"
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: QEMU 2.2\n"
 "Report-Msgid-Bugs-To: qemu-devel@nongnu.org\n"
-"POT-Creation-Date: 2015-07-30 07:34+0200\n"
+"POT-Creation-Date: 2015-12-10 13:29+0000\n"
 "PO-Revision-Date: 2014-07-31 10:00+0800\n"
 "Last-Translator: Fam Zheng <famz@redhat.com>\n"
 "Language-Team: Chinese <zh@li.org>\n"
@@ -17,70 +17,70 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
 "X-Generator: Lokalize 1.4\n"

-#: ui/gtk.c:260
+#: ui/gtk.c:271
 msgid " - Press Ctrl+Alt+G to release grab"
 msgstr " - 按下 Ctrl+Alt+G 取消捕获"

-#: ui/gtk.c:264
+#: ui/gtk.c:275
 msgid " [Paused]"
 msgstr " [已暂停]"

-#: ui/gtk.c:1688
+#: ui/gtk.c:1783
 msgid "_Pause"
 msgstr "暂停(_P)"

-#: ui/gtk.c:1694
+#: ui/gtk.c:1789
 msgid "_Reset"
 msgstr "重置(_R)"

-#: ui/gtk.c:1697
+#: ui/gtk.c:1792
 msgid "Power _Down"
 msgstr "关闭电源(_D)"

-#: ui/gtk.c:1703
+#: ui/gtk.c:1798
 msgid "_Quit"
 msgstr "退出(_Q)"

-#: ui/gtk.c:1787
+#: ui/gtk.c:1890
 msgid "_Fullscreen"
 msgstr "全屏(_F)"

-#: ui/gtk.c:1801
+#: ui/gtk.c:1904
 msgid "Zoom _In"
 msgstr "放大(_I)"

-#: ui/gtk.c:1808
+#: ui/gtk.c:1911
 msgid "Zoom _Out"
 msgstr "缩小(_O)"

-#: ui/gtk.c:1815
+#: ui/gtk.c:1918
 msgid "Best _Fit"
 msgstr "最合适大小(_F)"

-#: ui/gtk.c:1822
+#: ui/gtk.c:1925
 msgid "Zoom To _Fit"
 msgstr "缩放以适应大小(_F)"

-#: ui/gtk.c:1828
+#: ui/gtk.c:1931
 msgid "Grab On _Hover"
 msgstr "鼠标经过时捕获(_H)"

-#: ui/gtk.c:1831
+#: ui/gtk.c:1934
 msgid "_Grab Input"
 msgstr "捕获输入(_G)"

-#: ui/gtk.c:1860
+#: ui/gtk.c:1963
 msgid "Show _Tabs"
 msgstr "显示标签页(_T)"

-#: ui/gtk.c:1863
+#: ui/gtk.c:1966
 msgid "Detach Tab"
 msgstr "分离标签页"

-#: ui/gtk.c:1875
+#: ui/gtk.c:1978
 msgid "_Machine"
 msgstr "虚拟机(_M)"

-#: ui/gtk.c:1880
+#: ui/gtk.c:1983
 msgid "_View"
 msgstr "视图(_V)"
@@ -2081,7 +2081,7 @@
  'data': { 'device': 'str' } }

 ##
-# @blockdev-remove-medium:
+# @x-blockdev-remove-medium:
 #
 # Removes a medium (a block driver state tree) from a block device. That block
 # device's tray must currently be open (unless there is no attached guest
@@ -2089,27 +2089,33 @@
 #
 # If the tray is open and there is no medium inserted, this will be a no-op.
 #
+# This command is still a work in progress and is considered experimental.
+# Stay away from it unless you want to help with its development.
+#
 # @device: block device name
 #
 # Since: 2.5
 ##
-{ 'command': 'blockdev-remove-medium',
+{ 'command': 'x-blockdev-remove-medium',
  'data': { 'device': 'str' } }

 ##
-# @blockdev-insert-medium:
+# @x-blockdev-insert-medium:
 #
 # Inserts a medium (a block driver state tree) into a block device. That block
 # device's tray must currently be open (unless there is no attached guest
 # device) and there must be no medium inserted already.
 #
+# This command is still a work in progress and is considered experimental.
+# Stay away from it unless you want to help with its development.
+#
 # @device:    block device name
 #
 # @node-name: name of a node in the block driver state graph
 #
 # Since: 2.5
 ##
-{ 'command': 'blockdev-insert-medium',
+{ 'command': 'x-blockdev-insert-medium',
  'data': { 'device': 'str',
            'node-name': 'str'} }

@@ -2137,8 +2143,8 @@
 #
 # Changes the medium inserted into a block device by ejecting the current medium
 # and loading a new image file which is inserted as the new medium (this command
-# combines blockdev-open-tray, blockdev-remove-medium, blockdev-insert-medium
-# and blockdev-close-tray).
+# combines blockdev-open-tray, x-blockdev-remove-medium,
+# x-blockdev-insert-medium and blockdev-close-tray).
 #
 # @device:          block device name
 #
@@ -1241,11 +1241,16 @@ static void pty_chr_update_read_handler_locked(CharDriverState *chr)
 {
    PtyCharDriver *s = chr->opaque;
    GPollFD pfd;
+    int rc;

    pfd.fd = g_io_channel_unix_get_fd(s->fd);
    pfd.events = G_IO_OUT;
    pfd.revents = 0;
-    g_poll(&pfd, 1, 0);
+    do {
+        rc = g_poll(&pfd, 1, 0);
+    } while (rc == -1 && errno == EINTR);
+    assert(rc >= 0);
+
    if (pfd.revents & G_IO_HUP) {
        pty_chr_state(chr, 0);
    } else {
@@ -4203,27 +4203,30 @@ Example:
 EQMP

    {
-        .name       = "blockdev-remove-medium",
+        .name       = "x-blockdev-remove-medium",
        .args_type  = "device:s",
-        .mhandler.cmd_new = qmp_marshal_blockdev_remove_medium,
+        .mhandler.cmd_new = qmp_marshal_x_blockdev_remove_medium,
    },

 SQMP
-blockdev-remove-medium
----------------------
+x-blockdev-remove-medium
+------------------------

 Removes a medium (a block driver state tree) from a block device. That block
 device's tray must currently be open (unless there is no attached guest device).

 If the tray is open and there is no medium inserted, this will be a no-op.

+This command is still a work in progress and is considered experimental.
+Stay away from it unless you want to help with its development.
+
 Arguments:

 - "device": block device name (json-string)

 Example:

-> { "execute": "blockdev-remove-medium",
+-> { "execute": "x-blockdev-remove-medium",
     "arguments": { "device": "ide1-cd0" } }

 <- { "error": { "class": "GenericError",
@@ -4240,7 +4243,7 @@ Example:

 <- { "return": {} }

-> { "execute": "blockdev-remove-medium",
+-> { "execute": "x-blockdev-remove-medium",
     "arguments": { "device": "ide1-cd0" } }

 <- { "return": {} }
@@ -4248,19 +4251,22 @@ Example:
 EQMP

    {
-        .name       = "blockdev-insert-medium",
+        .name       = "x-blockdev-insert-medium",
        .args_type  = "device:s,node-name:s",
-        .mhandler.cmd_new = qmp_marshal_blockdev_insert_medium,
+        .mhandler.cmd_new = qmp_marshal_x_blockdev_insert_medium,
    },

 SQMP
-blockdev-insert-medium
----------------------
+x-blockdev-insert-medium
+------------------------

 Inserts a medium (a block driver state tree) into a block device. That block
 device's tray must currently be open (unless there is no attached guest device)
 and there must be no medium inserted already.

+This command is still a work in progress and is considered experimental.
+Stay away from it unless you want to help with its development.
+
 Arguments:

 - "device": block device name (json-string)
@@ -4276,7 +4282,7 @@ Example:

 <- { "return": {} }

-> { "execute": "blockdev-insert-medium",
+-> { "execute": "x-blockdev-insert-medium",
     "arguments": { "device": "ide1-cd0",
                    "node-name": "node0" } }

@@ -12,3 +12,8 @@

 /* Needed for qtest_allowed() */
 bool qtest_allowed;
+
+bool qtest_driver(void)
+{
+    return false;
+}
@@ -684,6 +684,27 @@ enum {
 #define fpscr_eex (((env->fpscr) >> FPSCR_XX) & ((env->fpscr) >> FPSCR_XE) &  \
                   0x1F)

+#define FP_FX		(1ull << FPSCR_FX)
+#define FP_FEX		(1ull << FPSCR_FEX)
+#define FP_OX		(1ull << FPSCR_OX)
+#define FP_OE		(1ull << FPSCR_OE)
+#define FP_UX		(1ull << FPSCR_UX)
+#define FP_UE		(1ull << FPSCR_UE)
+#define FP_XX		(1ull << FPSCR_XX)
+#define FP_XE		(1ull << FPSCR_XE)
+#define FP_ZX		(1ull << FPSCR_ZX)
+#define FP_ZE		(1ull << FPSCR_ZE)
+#define FP_VX		(1ull << FPSCR_VX)
+#define FP_VXSNAN	(1ull << FPSCR_VXSNAN)
+#define FP_VXISI	(1ull << FPSCR_VXISI)
+#define FP_VXIMZ	(1ull << FPSCR_VXIMZ)
+#define FP_VXZDZ	(1ull << FPSCR_VXZDZ)
+#define FP_VXIDI	(1ull << FPSCR_VXIDI)
+#define FP_VXVC		(1ull << FPSCR_VXVC)
+#define FP_VXCVI	(1ull << FPSCR_VXCVI)
+#define FP_VE		(1ull << FPSCR_VE)
+#define FP_FI		(1ull << FPSCR_FI)
+
 /*****************************************************************************/
 /* Vector status and control register */
 #define VSCR_NJ		16 /* Vector non-java */
@@ -170,27 +170,6 @@ static void dfp_prepare_decimal128(struct PPC_DFP *dfp, uint64_t *a,
    }
 }

-#define FP_FX       (1ull << FPSCR_FX)
-#define FP_FEX      (1ull << FPSCR_FEX)
-#define FP_OX       (1ull << FPSCR_OX)
-#define FP_OE       (1ull << FPSCR_OE)
-#define FP_UX       (1ull << FPSCR_UX)
-#define FP_UE       (1ull << FPSCR_UE)
-#define FP_XX       (1ull << FPSCR_XX)
-#define FP_XE       (1ull << FPSCR_XE)
-#define FP_ZX       (1ull << FPSCR_ZX)
-#define FP_ZE       (1ull << FPSCR_ZE)
-#define FP_VX       (1ull << FPSCR_VX)
-#define FP_VXSNAN   (1ull << FPSCR_VXSNAN)
-#define FP_VXISI    (1ull << FPSCR_VXISI)
-#define FP_VXIMZ    (1ull << FPSCR_VXIMZ)
-#define FP_VXZDZ    (1ull << FPSCR_VXZDZ)
-#define FP_VXIDI    (1ull << FPSCR_VXIDI)
-#define FP_VXVC     (1ull << FPSCR_VXVC)
-#define FP_VXCVI    (1ull << FPSCR_VXCVI)
-#define FP_VE       (1ull << FPSCR_VE)
-#define FP_FI       (1ull << FPSCR_FI)
-
 static void dfp_set_FPSCR_flag(struct PPC_DFP *dfp, uint64_t flag,
                uint64_t enabled)
 {
@@ -194,7 +194,7 @@ static inline uint64_t fload_invalid_op_excp(CPUPPCState *env, int op,
    /* Update the floating-point invalid operation summary */
    env->fpscr |= 1 << FPSCR_VX;
    /* Update the floating-point exception summary */
-    env->fpscr |= 1 << FPSCR_FX;
+    env->fpscr |= FP_FX;
    if (ve != 0) {
        /* Update the floating-point enabled exception summary */
        env->fpscr |= 1 << FPSCR_FEX;
@@ -211,7 +211,7 @@ static inline void float_zero_divide_excp(CPUPPCState *env)
    env->fpscr |= 1 << FPSCR_ZX;
    env->fpscr &= ~((1 << FPSCR_FR) | (1 << FPSCR_FI));
    /* Update the floating-point exception summary */
-    env->fpscr |= 1 << FPSCR_FX;
+    env->fpscr |= FP_FX;
    if (fpscr_ze != 0) {
        /* Update the floating-point enabled exception summary */
        env->fpscr |= 1 << FPSCR_FEX;
@@ -228,7 +228,7 @@ static inline void float_overflow_excp(CPUPPCState *env)

    env->fpscr |= 1 << FPSCR_OX;
    /* Update the floating-point exception summary */
-    env->fpscr |= 1 << FPSCR_FX;
+    env->fpscr |= FP_FX;
    if (fpscr_oe != 0) {
        /* XXX: should adjust the result */
        /* Update the floating-point enabled exception summary */
@@ -248,7 +248,7 @@ static inline void float_underflow_excp(CPUPPCState *env)

    env->fpscr |= 1 << FPSCR_UX;
    /* Update the floating-point exception summary */
-    env->fpscr |= 1 << FPSCR_FX;
+    env->fpscr |= FP_FX;
    if (fpscr_ue != 0) {
        /* XXX: should adjust the result */
        /* Update the floating-point enabled exception summary */
@@ -265,7 +265,7 @@ static inline void float_inexact_excp(CPUPPCState *env)

    env->fpscr |= 1 << FPSCR_XX;
    /* Update the floating-point exception summary */
-    env->fpscr |= 1 << FPSCR_FX;
+    env->fpscr |= FP_FX;
    if (fpscr_xe != 0) {
        /* Update the floating-point enabled exception summary */
        env->fpscr |= 1 << FPSCR_FEX;
@@ -330,31 +330,31 @@ void helper_fpscr_setbit(CPUPPCState *env, uint32_t bit)
    if (prev == 0) {
        switch (bit) {
        case FPSCR_VX:
-            env->fpscr |= 1 << FPSCR_FX;
+            env->fpscr |= FP_FX;
            if (fpscr_ve) {
                goto raise_ve;
            }
            break;
        case FPSCR_OX:
-            env->fpscr |= 1 << FPSCR_FX;
+            env->fpscr |= FP_FX;
            if (fpscr_oe) {
                goto raise_oe;
            }
            break;
        case FPSCR_UX:
-            env->fpscr |= 1 << FPSCR_FX;
+            env->fpscr |= FP_FX;
            if (fpscr_ue) {
                goto raise_ue;
            }
            break;
        case FPSCR_ZX:
-            env->fpscr |= 1 << FPSCR_FX;
+            env->fpscr |= FP_FX;
            if (fpscr_ze) {
                goto raise_ze;
            }
            break;
        case FPSCR_XX:
-            env->fpscr |= 1 << FPSCR_FX;
+            env->fpscr |= FP_FX;
            if (fpscr_xe) {
                goto raise_xe;
            }
@@ -369,7 +369,7 @@ void helper_fpscr_setbit(CPUPPCState *env, uint32_t bit)
        case FPSCR_VXSQRT:
        case FPSCR_VXCVI:
            env->fpscr |= 1 << FPSCR_VX;
-            env->fpscr |= 1 << FPSCR_FX;
+            env->fpscr |= FP_FX;
            if (fpscr_ve != 0) {
                goto raise_ve;
            }
@@ -5097,7 +5097,8 @@ static void disas_sparc_insn(DisasContext * dc, unsigned int insn)
                    if (IS_IMM) {
                        goto illegal_insn;
                    }
-                    if (!supervisor(dc)) {
+                    /* LEON3 allows CASA from user space with ASI 0xa */
+                    if ((GET_FIELD(insn, 19, 26) != 0xa) && !supervisor(dc)) {
                        goto priv_insn;
                    }
 #endif
@@ -388,7 +388,11 @@ void tcg_prologue_init(TCGContext *s)
    /* Compute a high-water mark, at which we voluntarily flush the buffer
       and start over.  The size here is arbitrary, significantly larger
       than we expect the code generation for any one opcode to require.  */
-    s->code_gen_highwater = s->code_gen_buffer + (total_size - 1024);
+    /* ??? We currently have no good estimate for, or checks in,
+       tcg_out_tb_finalize.  If there are quite a lot of guest memory ops,
+       the number of out-of-line fragments could be quite high.  In the
+       short-term, increase the highwater buffer.  */
+    s->code_gen_highwater = s->code_gen_buffer + (total_size - 64*1024);

    tcg_register_jit(s->code_gen_buffer, total_size);

@@ -612,7 +612,7 @@ $(patsubst %, check-%, $(check-unit-y)): check-%: %
 $(patsubst %, check-report-qtest-%.xml, $(QTEST_TARGETS)): check-report-qtest-%.xml: $(check-qtest-y)
 	$(call quiet-command,QTEST_QEMU_BINARY=$*-softmmu/qemu-system-$* \
 		QTEST_QEMU_IMG=qemu-img$(EXESUF) \
-	  gtester -q $(GTESTER_OPTIONS) -o $@ -m=$(SPEED) $(check-qtest-$*-y),"GTESTER $@")
+	  gtester -q $(GTESTER_OPTIONS) -o $@ -m=$(SPEED) $(check-qtest-$*-y) $(check-qtest-generic-y),"GTESTER $@")

 check-report-unit.xml: $(check-unit-y)
 	$(call quiet-command,gtester -q $(GTESTER_OPTIONS) -o $@ -m=$(SPEED) $^, "GTESTER $@")
@@ -660,7 +660,7 @@ check: check-qapi-schema check-unit check-qtest
 check-clean:
 	$(MAKE) -C tests/tcg clean
 	rm -rf $(check-unit-y) tests/*.o $(QEMU_IOTESTS_HELPERS-y)
-	rm -rf $(sort $(foreach target,$(SYSEMU_TARGET_LIST), $(check-qtest-$(target)-y)))
+	rm -rf $(sort $(foreach target,$(SYSEMU_TARGET_LIST), $(check-qtest-$(target)-y)) $(check-qtest-generic-y))

 clean: check-clean

@@ -593,12 +593,12 @@ static void test_flush_nodev(void)
    ide_test_quit();
 }

-static void test_pci_retry_flush(const char *machine)
+static void test_pci_retry_flush(void)
 {
    test_retry_flush("pc");
 }

-static void test_isa_retry_flush(const char *machine)
+static void test_isa_retry_flush(void)
 {
    test_retry_flush("isapc");
 }
@@ -110,6 +110,11 @@ static void kill_qemu(QTestState *s)
    }
 }

+static void kill_qemu_hook_func(void *s)
+{
+    kill_qemu(s);
+}
+
 static void sigabrt_handler(int signo)
 {
    g_hook_list_invoke(&abrt_hooks, FALSE);
@@ -133,7 +138,7 @@ static void cleanup_sigabrt_handler(void)
    sigaction(SIGABRT, &sigact_old, NULL);
 }

-void qtest_add_abrt_handler(void (*fn), const void *data)
+void qtest_add_abrt_handler(GHookFunc fn, const void *data)
 {
    GHook *hook;

@@ -170,7 +175,7 @@ QTestState *qtest_init(const char *extra_args)
    sock = init_socket(socket_path);
    qmpsock = init_socket(qmp_socket_path);

-    qtest_add_abrt_handler(kill_qemu, s);
+    qtest_add_abrt_handler(kill_qemu_hook_func, s);

    s->qemu_pid = fork();
    if (s->qemu_pid == 0) {
@@ -755,14 +760,15 @@ void qtest_memread(QTestState *s, uint64_t addr, void *data, size_t size)
    g_strfreev(args);
 }

-void qtest_add_func(const char *str, void (*fn))
+void qtest_add_func(const char *str, void (*fn)(void))
 {
    gchar *path = g_strdup_printf("/%s/%s", qtest_get_arch(), str);
    g_test_add_func(path, fn);
    g_free(path);
 }

-void qtest_add_data_func(const char *str, const void *data, void (*fn))
+void qtest_add_data_func(const char *str, const void *data,
+                         void (*fn)(const void *))
 {
    gchar *path = g_strdup_printf("/%s/%s", qtest_get_arch(), str);
    g_test_add_data_func(path, data, fn);
@@ -416,7 +416,7 @@ const char *qtest_get_arch(void);
 * The path is prefixed with the architecture under test, as
 * returned by qtest_get_arch().
 */
-void qtest_add_func(const char *str, void (*fn));
+void qtest_add_func(const char *str, void (*fn)(void));

 /**
 * qtest_add_data_func:
@@ -428,7 +428,8 @@ void qtest_add_func(const char *str, void (*fn));
 * The path is prefixed with the architecture under test, as
 * returned by qtest_get_arch().
 */
-void qtest_add_data_func(const char *str, const void *data, void (*fn));
+void qtest_add_data_func(const char *str, const void *data,
+                         void (*fn)(const void *));

 /**
 * qtest_add:
@@ -450,7 +451,7 @@ void qtest_add_data_func(const char *str, const void *data, void (*fn));
        g_free(path); \
    } while (0)

-void qtest_add_abrt_handler(void (*fn), const void *data);
+void qtest_add_abrt_handler(GHookFunc fn, const void *data);

 /**
 * qtest_start:
@@ -82,6 +82,31 @@ class TestSyncModesNoneAndTop(iotests.QMPTestCase):
        time.sleep(1)
        self.assertEqual(-1, qemu_io('-c', 'read -P0x41 0 512', target_img).find("verification failed"))

+class TestBeforeWriteNotifier(iotests.QMPTestCase):
+    def setUp(self):
+        self.vm = iotests.VM().add_drive_raw("file=blkdebug::null-co://,id=drive0,align=65536,driver=blkdebug")
+        self.vm.launch()
+
+    def tearDown(self):
+        self.vm.shutdown()
+        os.remove(target_img)
+
+    def test_before_write_notifier(self):
+        self.vm.pause_drive("drive0")
+        result = self.vm.qmp('drive-backup', device='drive0',
+                             sync='full', target=target_img,
+                             format="file", speed=1)
+        self.assert_qmp(result, 'return', {})
+        result = self.vm.qmp('block-job-pause', device="drive0")
+        self.assert_qmp(result, 'return', {})
+        # Speed is low enough that this must be an uncopied range, which will
+        # trigger the before write notifier
+        self.vm.hmp_qemu_io('drive0', 'aio_write -P 1 512512 512')
+        self.vm.resume_drive("drive0")
+        result = self.vm.qmp('block-job-resume', device="drive0")
+        self.assert_qmp(result, 'return', {})
+        event = self.cancel_and_wait()
+        self.assert_qmp(event, 'data/type', 'backup')

 if __name__ == '__main__':
    iotests.main(supported_fmts=['qcow2', 'qed'])
@@ -1,5 +1,5 @@
-..
+...
 ----------------------------------------------------------------------
-Ran 2 tests
+Ran 3 tests

 OK
@@ -208,14 +208,14 @@ class GeneralChangeTestsBaseClass(ChangeBaseClass):
        else:
            self.assert_qmp(result, 'return[0]/inserted/image/filename', old_img)

-        result = self.vm.qmp('blockdev-remove-medium', device='drive0')
+        result = self.vm.qmp('x-blockdev-remove-medium', device='drive0')
        self.assert_qmp(result, 'return', {})

        result = self.vm.qmp('query-block')
        self.assert_qmp(result, 'return[0]/tray_open', True)
        self.assert_qmp_absent(result, 'return[0]/inserted')

-        result = self.vm.qmp('blockdev-insert-medium', device='drive0',
+        result = self.vm.qmp('x-blockdev-insert-medium', device='drive0',
                                                       node_name='new')
        self.assert_qmp(result, 'return', {})

@@ -243,7 +243,7 @@ class GeneralChangeTestsBaseClass(ChangeBaseClass):
            # Empty floppy drive
            return

-        result = self.vm.qmp('blockdev-remove-medium', device='drive0')
+        result = self.vm.qmp('x-blockdev-remove-medium', device='drive0')
        self.assert_qmp(result, 'error/class', 'GenericError')

    def test_insert_on_closed(self):
@@ -258,7 +258,7 @@ class GeneralChangeTestsBaseClass(ChangeBaseClass):
                                               'driver': 'file'}})
        self.assert_qmp(result, 'return', {})

-        result = self.vm.qmp('blockdev-insert-medium', device='drive0',
+        result = self.vm.qmp('x-blockdev-insert-medium', device='drive0',
                                                       node_name='new')
        self.assert_qmp(result, 'error/class', 'GenericError')

@@ -289,7 +289,7 @@ class TestInitiallyFilled(GeneralChangeTestsBaseClass):

        self.wait_for_open()

-        result = self.vm.qmp('blockdev-insert-medium', device='drive0',
+        result = self.vm.qmp('x-blockdev-insert-medium', device='drive0',
                                                       node_name='new')
        self.assert_qmp(result, 'error/class', 'GenericError')

@@ -311,7 +311,7 @@ class TestInitiallyEmpty(GeneralChangeTestsBaseClass):

        self.wait_for_open()

-        result = self.vm.qmp('blockdev-remove-medium', device='drive0')
+        result = self.vm.qmp('x-blockdev-remove-medium', device='drive0')
        # Should be a no-op
        self.assert_qmp(result, 'return', {})

@@ -604,14 +604,14 @@ class TestChangeReadOnly(ChangeBaseClass):
        self.assert_qmp(result, 'return[0]/inserted/ro', False)
        self.assert_qmp(result, 'return[0]/inserted/image/filename', old_img)

-        result = self.vm.qmp('blockdev-remove-medium', device='drive0')
+        result = self.vm.qmp('x-blockdev-remove-medium', device='drive0')
        self.assert_qmp(result, 'return', {})

        result = self.vm.qmp('query-block')
        self.assert_qmp(result, 'return[0]/tray_open', True)
        self.assert_qmp_absent(result, 'return[0]/inserted')

-        result = self.vm.qmp('blockdev-insert-medium', device='drive0',
+        result = self.vm.qmp('x-blockdev-insert-medium', device='drive0',
                                                       node_name='new')
        self.assert_qmp(result, 'return', {})

@@ -653,7 +653,7 @@ class TestBlockJobsAfterCycle(ChangeBaseClass):

        # For device-less BBs, calling blockdev-open-tray or blockdev-close-tray
        # is not necessary
-        result = self.vm.qmp('blockdev-remove-medium', device='drive0')
+        result = self.vm.qmp('x-blockdev-remove-medium', device='drive0')
        self.assert_qmp(result, 'return', {})

        result = self.vm.qmp('query-block')
@@ -666,7 +666,7 @@ class TestBlockJobsAfterCycle(ChangeBaseClass):
                                               'driver': 'file'}})
        self.assert_qmp(result, 'return', {})

-        result = self.vm.qmp('blockdev-insert-medium', device='drive0',
+        result = self.vm.qmp('x-blockdev-insert-medium', device='drive0',
                                                       node_name='node0')
        self.assert_qmp(result, 'return', {})

@@ -174,7 +174,7 @@ class TestBlockdevDel(iotests.QMPTestCase):
    def insertDrive(self, backend, node):
        self.checkBlockBackend(backend, None)
        self.checkBlockDriverState(node)
-        result = self.vm.qmp('blockdev-insert-medium',
+        result = self.vm.qmp('x-blockdev-insert-medium',
                             device = backend, node_name = node)
        self.assert_qmp(result, 'return', {})
        self.checkBlockBackend(backend, node)
@@ -140,6 +140,11 @@ class VM(object):
        self._args.append('-monitor')
        self._args.append(args)

+    def add_drive_raw(self, opts):
+        self._args.append('-drive')
+        self._args.append(opts)
+        return self
+
    def add_drive(self, path, opts='', interface='virtio'):
        '''Add a virtio-blk drive to the VM'''
        options = ['if=%s' % interface,
@@ -47,7 +47,7 @@ static bool is_blacklisted(const char *arch, const char *mach)
 static void test_properties(const char *path, bool recurse)
 {
    char *child_path;
-    QDict *response, *tuple;
+    QDict *response, *tuple, *tmp;
    QList *list;
    QListEntry *entry;

@@ -57,6 +57,7 @@ static void test_properties(const char *path, bool recurse)
    g_assert(response);

    if (!recurse) {
+        QDECREF(response);
        return;
    }

@@ -75,14 +76,16 @@ static void test_properties(const char *path, bool recurse)
        } else {
            const char *prop = qdict_get_str(tuple, "name");
            g_test_message("Testing property %s.%s", path, prop);
-            response = qmp("{ 'execute': 'qom-get',"
-                           "  'arguments': { 'path': %s,"
-                           "                 'property': %s } }",
-                           path, prop);
+            tmp = qmp("{ 'execute': 'qom-get',"
+                      "  'arguments': { 'path': %s,"
+                      "                 'property': %s } }",
+                      path, prop);
            /* qom-get may fail but should not, e.g., segfault. */
-            g_assert(response);
+            g_assert(tmp);
+            QDECREF(tmp);
        }
    }
+    QDECREF(response);
 }

 static void test_machine(gconstpointer data)
@@ -98,9 +101,11 @@ static void test_machine(gconstpointer data)

    response = qmp("{ 'execute': 'quit' }");
    g_assert(qdict_haskey(response, "return"));
+    QDECREF(response);

    qtest_end();
    g_free(args);
+    g_free((void *)machine);
 }

 static void add_machine_test_cases(void)
@@ -129,10 +134,12 @@ static void add_machine_test_cases(void)
        mname = qstring_get_str(qstr);
        if (!is_blacklisted(arch, mname)) {
            path = g_strdup_printf("qom/%s", mname);
-            qtest_add_data_func(path, mname, test_machine);
+            qtest_add_data_func(path, g_strdup(mname), test_machine);
        }
    }
+
    qtest_end();
+    QDECREF(response);
 }

 int main(int argc, char **argv)
@@ -113,7 +113,6 @@ dispatcher_add(Dispatcher *dispr, int sock, void *ctx, CallbackFunc cb)
    return 0;
 }

-#if 0
 /* dispatcher_remove() is not currently in use but may be useful
 * in the future. */
 static int
@@ -127,9 +126,9 @@ dispatcher_remove(Dispatcher *dispr, int sock)
    }

    FD_CLR(sock, &dispr->fdset);
+    DPRINT("Sock %d removed from dispatcher watch.\n", sock);
    return 0;
 }
-#endif

 /* timeout in us */
 static int
@@ -156,11 +155,16 @@ dispatcher_wait(Dispatcher *dispr, uint32_t timeout)
    /* Now call callback for every ready socket. */

    int sock;
-    for (sock = 0; sock < dispr->max_sock + 1; sock++)
-        if (FD_ISSET(sock, &fdset)) {
+    for (sock = 0; sock < dispr->max_sock + 1; sock++) {
+        /* The callback on a socket can remove other sockets from the
+         * dispatcher, thus we have to check that the socket is
+         * still not removed from dispatcher's list
+         */
+        if (FD_ISSET(sock, &fdset) && FD_ISSET(sock, &dispr->fdset)) {
            Event *e = &dispr->events[sock];
            e->callback(sock, e->ctx);
        }
+    }

    return 0;
 }
@@ -837,9 +841,10 @@ vubr_set_mem_table_exec(VubrDev *dev, VhostUserMsg *vmsg)
        if (mmap_addr == MAP_FAILED) {
            vubr_die("mmap");
        }
-
        dev_region->mmap_addr = (uint64_t) mmap_addr;
        DPRINT("    mmap_addr:       0x%016"PRIx64"\n", dev_region->mmap_addr);
+
+        close(vmsg->fds[i]);
    }

    return 0;
@@ -950,6 +955,17 @@ vubr_get_vring_base_exec(VubrDev *dev, VhostUserMsg *vmsg)
     * we have to respect * VHOST_USER_SET_VRING_ENABLE request. */
    dev->ready = 0;

+    if (dev->vq[index].call_fd != -1) {
+        close(dev->vq[index].call_fd);
+        dispatcher_remove(&dev->dispatcher, dev->vq[index].call_fd);
+        dev->vq[index].call_fd = -1;
+    }
+    if (dev->vq[index].kick_fd != -1) {
+        close(dev->vq[index].kick_fd);
+        dispatcher_remove(&dev->dispatcher, dev->vq[index].kick_fd);
+        dev->vq[index].kick_fd = -1;
+    }
+
    /* Reply */
    return 1;
 }
@@ -965,6 +981,10 @@ vubr_set_vring_kick_exec(VubrDev *dev, VhostUserMsg *vmsg)
    assert((u64_arg & VHOST_USER_VRING_NOFD_MASK) == 0);
    assert(vmsg->fd_num == 1);

+    if (dev->vq[index].kick_fd != -1) {
+        close(dev->vq[index].kick_fd);
+        dispatcher_remove(&dev->dispatcher, dev->vq[index].kick_fd);
+    }
    dev->vq[index].kick_fd = vmsg->fds[0];
    DPRINT("Got kick_fd: %d for vq: %d\n", vmsg->fds[0], index);

@@ -999,6 +1019,10 @@ vubr_set_vring_call_exec(VubrDev *dev, VhostUserMsg *vmsg)
    assert((u64_arg & VHOST_USER_VRING_NOFD_MASK) == 0);
    assert(vmsg->fd_num == 1);

+    if (dev->vq[index].call_fd != -1) {
+        close(dev->vq[index].call_fd);
+        dispatcher_remove(&dev->dispatcher, dev->vq[index].call_fd);
+    }
    dev->vq[index].call_fd = vmsg->fds[0];
    DPRINT("Got call_fd: %d for vq: %d\n", vmsg->fds[0], index);

@@ -123,6 +123,7 @@ static VhostUserMsg m __attribute__ ((unused));

 typedef struct TestServer {
    gchar *socket_path;
+    gchar *mig_path;
    gchar *chr_name;
    CharDriverState *chr;
    int fds_num;
@@ -172,8 +173,9 @@ static void wait_for_fds(TestServer *s)
    g_mutex_unlock(&s->data_mutex);
 }

-static void read_guest_mem(TestServer *s)
+static void read_guest_mem(const void *data)
 {
+    TestServer *s = (void *)data;
    uint32_t *guest_mem;
    int i, j;
    size_t size;
@@ -216,8 +218,7 @@ static void read_guest_mem(TestServer *s)

 static void *thread_function(void *data)
 {
-    GMainLoop *loop;
-    loop = g_main_loop_new(NULL, FALSE);
+    GMainLoop *loop = data;
    g_main_loop_run(loop);
    return NULL;
 }
@@ -365,6 +366,7 @@ static TestServer *test_server_new(const gchar *name)
    gchar *chr_path;

    server->socket_path = g_strdup_printf("%s/%s.sock", tmpfs, name);
+    server->mig_path = g_strdup_printf("%s/%s.mig", tmpfs, name);

    chr_path = g_strdup_printf("unix:%s,server,nowait", server->socket_path);
    server->chr_name = g_strdup_printf("chr-%s", name);
@@ -389,7 +391,7 @@ static TestServer *test_server_new(const gchar *name)
    g_strdup_printf(QEMU_CMD extra, (mem), (mem), (root), (s)->chr_name,       \
                    (s)->socket_path, (s)->chr_name, ##__VA_ARGS__)

-static void test_server_free(TestServer *server)
+static gboolean _test_server_free(TestServer *server)
 {
    int i;

@@ -406,9 +408,18 @@ static void test_server_free(TestServer *server)
    unlink(server->socket_path);
    g_free(server->socket_path);

+    unlink(server->mig_path);
+    g_free(server->mig_path);

    g_free(server->chr_name);
    g_free(server);
+
+    return FALSE;
+}
+
+static void test_server_free(TestServer *server)
+{
+    g_idle_add((GSourceFunc)_test_server_free, server);
 }

 static void wait_for_log_fd(TestServer *s)
@@ -496,18 +507,29 @@ test_migrate_source_check(GSource *source)
    return FALSE;
 }

+#if !GLIB_CHECK_VERSION(2,36,0)
+/* this callback is unnecessary with glib >2.36, the default
+ * prepare for the source does the same */
+static gboolean
+test_migrate_source_prepare(GSource *source, gint *timeout)
+{
+    *timeout = -1;
+    return FALSE;
+}
+#endif
+
 GSourceFuncs test_migrate_source_funcs = {
-    NULL,
-    test_migrate_source_check,
-    NULL,
-    NULL
+#if !GLIB_CHECK_VERSION(2,36,0)
+    .prepare = test_migrate_source_prepare,
+#endif
+    .check = test_migrate_source_check,
 };

 static void test_migrate(void)
 {
    TestServer *s = test_server_new("src");
    TestServer *dest = test_server_new("dest");
-    const char *uri = "tcp:127.0.0.1:1234";
+    char *uri = g_strdup_printf("%s%s", "unix:", dest->mig_path);
    QTestState *global = global_qtest, *from, *to;
    GSource *source;
    gchar *cmd;
@@ -578,6 +600,7 @@ static void test_migrate(void)
    test_server_free(dest);
    qtest_quit(from);
    test_server_free(s);
+    g_free(uri);

    global_qtest = global;
 }
@@ -590,6 +613,8 @@ int main(int argc, char **argv)
    char *qemu_cmd = NULL;
    int ret;
    char template[] = "/tmp/vhost-test-XXXXXX";
+    GMainLoop *loop;
+    GThread *thread;

    g_test_init(&argc, &argv, NULL);

@@ -612,8 +637,9 @@ int main(int argc, char **argv)

    server = test_server_new("test");

+    loop = g_main_loop_new(NULL, FALSE);
    /* run the main loop thread so the chardev may operate */
-    g_thread_new(NULL, thread_function, NULL);
+    thread = g_thread_new(NULL, thread_function, loop);

    qemu_cmd = GET_QEMU_CMD(server);

@@ -632,6 +658,14 @@ int main(int argc, char **argv)
    /* cleanup */
    test_server_free(server);

+    /* finish the helper thread and dispatch pending sources */
+    g_main_loop_quit(loop);
+    g_thread_join(thread);
+    while (g_main_context_pending(NULL)) {
+        g_main_context_iteration (NULL, TRUE);
+    }
+    g_main_loop_unref(loop);
+
    ret = rmdir(tmpfs);
    if (ret != 0) {
        g_test_message("unable to rmdir: path (%s): %s\n",
@@ -69,7 +69,7 @@ bdrv_aio_write_zeroes(void *bs, int64_t sector_num, int nb_sectors, int flags, v
 bdrv_lock_medium(void *bs, bool locked) "bs %p locked %d"
 bdrv_co_readv(void *bs, int64_t sector_num, int nb_sector) "bs %p sector_num %"PRId64" nb_sectors %d"
 bdrv_co_copy_on_readv(void *bs, int64_t sector_num, int nb_sector) "bs %p sector_num %"PRId64" nb_sectors %d"
-bdrv_co_no_copy_on_readv(void *bs, int64_t sector_num, int nb_sector) "bs %p sector_num %"PRId64" nb_sectors %d"
+bdrv_co_readv_no_serialising(void *bs, int64_t sector_num, int nb_sector) "bs %p sector_num %"PRId64" nb_sectors %d"
 bdrv_co_writev(void *bs, int64_t sector_num, int nb_sector) "bs %p sector_num %"PRId64" nb_sectors %d"
 bdrv_co_write_zeroes(void *bs, int64_t sector_num, int nb_sector, int flags) "bs %p sector_num %"PRId64" nb_sectors %d flags %#x"
 bdrv_co_io_em(void *bs, int64_t sector_num, int nb_sectors, int is_write, void *acb) "bs %p sector_num %"PRId64" nb_sectors %d is_write %d acb %p"
@@ -329,7 +329,8 @@ bool st_set_trace_file(const char *file)
    g_free(trace_file_name);

    if (!file) {
-        trace_file_name = g_strdup_printf(CONFIG_TRACE_FILE, getpid());
+        /* Type cast needed for Windows where getpid() returns an int. */
+        trace_file_name = g_strdup_printf(CONFIG_TRACE_FILE, (pid_t)getpid());
    } else {
        trace_file_name = g_strdup_printf("%s", file);
    }
@@ -118,7 +118,7 @@ typedef struct PageDesc {
 #define V_L1_SHIFT (L1_MAP_ADDR_SPACE_BITS - TARGET_PAGE_BITS - V_L1_BITS)

 uintptr_t qemu_host_page_size;
-uintptr_t qemu_host_page_mask;
+intptr_t qemu_host_page_mask;

 /* The bottom level has pointers to PageDesc */
 static void *l1_map[V_L1_SIZE];
@@ -326,14 +326,14 @@ void page_size_init(void)
    /* NOTE: we can always suppose that qemu_host_page_size >=
       TARGET_PAGE_SIZE */
    qemu_real_host_page_size = getpagesize();
-    qemu_real_host_page_mask = ~(qemu_real_host_page_size - 1);
+    qemu_real_host_page_mask = -(intptr_t)qemu_real_host_page_size;
    if (qemu_host_page_size == 0) {
        qemu_host_page_size = qemu_real_host_page_size;
    }
    if (qemu_host_page_size < TARGET_PAGE_SIZE) {
        qemu_host_page_size = TARGET_PAGE_SIZE;
    }
-    qemu_host_page_mask = ~(qemu_host_page_size - 1);
+    qemu_host_page_mask = -(intptr_t)qemu_host_page_size;
 }

 static void page_init(void)
@@ -21,7 +21,7 @@
 #include "qom/cpu.h"

 uintptr_t qemu_real_host_page_size;
-uintptr_t qemu_real_host_page_mask;
+intptr_t qemu_real_host_page_mask;

 #ifndef CONFIG_USER_ONLY
 /* mask must never be zero, except for A20 change call */
@@ -724,7 +724,15 @@ QemuCocoaView *cocoaView;
    }

    if (mouse_event) {
-        if (last_buttons != buttons) {
+        /* Don't send button events to the guest unless we've got a
+         * mouse grab or window focus. If we have neither then this event
+         * is the user clicking on the background window to activate and
+         * bring us to the front, which will be done by the sendEvent
+         * call below. We definitely don't want to pass that click through
+         * to the guest.
+         */
+        if ((isMouseGrabbed || [[self window] isKeyWindow]) &&
+            (last_buttons != buttons)) {
            static uint32_t bmap[INPUT_BUTTON_MAX] = {
                [INPUT_BUTTON_LEFT]       = MOUSE_EVENT_LBUTTON,
                [INPUT_BUTTON_MIDDLE]     = MOUSE_EVENT_MBUTTON,
@@ -2198,15 +2198,15 @@ static void set_pixel_format(VncState *vs,
        return;
    }

-    vs->client_pf.rmax = red_max;
+    vs->client_pf.rmax = red_max ? red_max : 0xFF;
    vs->client_pf.rbits = hweight_long(red_max);
    vs->client_pf.rshift = red_shift;
    vs->client_pf.rmask = red_max << red_shift;
-    vs->client_pf.gmax = green_max;
+    vs->client_pf.gmax = green_max ? green_max : 0xFF;
    vs->client_pf.gbits = hweight_long(green_max);
    vs->client_pf.gshift = green_shift;
    vs->client_pf.gmask = green_max << green_shift;
-    vs->client_pf.bmax = blue_max;
+    vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
    vs->client_pf.bbits = hweight_long(blue_max);
    vs->client_pf.bshift = blue_shift;
    vs->client_pf.bmask = blue_max << blue_shift;
@@ -29,7 +29,7 @@ bool id_wellformed(const char *id)

 #define ID_SPECIAL_CHAR '#'

-static const char *const id_subsys_str[] = {
+static const char *const id_subsys_str[ID_MAX] = {
    [ID_QDEV]  = "qdev",
    [ID_BLOCK] = "block",
 };
@@ -53,7 +53,7 @@ char *id_generate(IdSubSystems id)
    static uint64_t id_counters[ID_MAX];
    uint32_t rnd;

-    assert(id < ID_MAX);
+    assert(id < ARRAY_SIZE(id_subsys_str));
    assert(id_subsys_str[id]);

    rnd = g_random_int_range(0, 100);
@@ -14,6 +14,32 @@
 #include <sys/mman.h>
 #include <assert.h>

+#define HUGETLBFS_MAGIC       0x958458f6
+
+#ifdef CONFIG_LINUX
+#include <sys/vfs.h>
+#endif
+
+size_t qemu_fd_getpagesize(int fd)
+{
+#ifdef CONFIG_LINUX
+    struct statfs fs;
+    int ret;
+
+    if (fd != -1) {
+        do {
+            ret = fstatfs(fd, &fs);
+        } while (ret != 0 && errno == EINTR);
+
+        if (ret == 0 && fs.f_type == HUGETLBFS_MAGIC) {
+            return fs.f_bsize;
+        }
+    }
+#endif
+
+    return getpagesize();
+}
+
 void *qemu_ram_mmap(int fd, size_t size, size_t align, bool shared)
 {
    /*
@@ -21,7 +47,20 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align, bool shared)
     * space, even if size is already aligned.
     */
    size_t total = size + align;
+#if defined(__powerpc64__) && defined(__linux__)
+    /* On ppc64 mappings in the same segment (aka slice) must share the same
+     * page size. Since we will be re-allocating part of this segment
+     * from the supplied fd, we should make sure to use the same page size,
+     * unless we are using the system page size, in which case anonymous memory
+     * is OK. Use align as a hint for the page size.
+     * In this case, set MAP_NORESERVE to avoid allocating backing store memory.
+     */
+    int anonfd = fd == -1 || qemu_fd_getpagesize(fd) == getpagesize() ? -1 : fd;
+    int flags = anonfd == -1 ? MAP_ANONYMOUS : MAP_NORESERVE;
+    void *ptr = mmap(0, total, PROT_NONE, flags | MAP_PRIVATE, anonfd, 0);
+#else
    void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+#endif
    size_t offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
    void *ptr1;

@@ -46,7 +46,6 @@ extern int daemon(int, int);
 #else
 #  define QEMU_VMALLOC_ALIGN getpagesize()
 #endif
-#define HUGETLBFS_MAGIC       0x958458f6

 #include <termios.h>
 #include <unistd.h>
@@ -65,7 +64,6 @@ extern int daemon(int, int);

 #ifdef CONFIG_LINUX
 #include <sys/syscall.h>
-#include <sys/vfs.h>
 #endif

 #ifdef __FreeBSD__
@@ -340,26 +338,6 @@ static void sigbus_handler(int signal)
    siglongjmp(sigjump, 1);
 }

-static size_t fd_getpagesize(int fd)
-{
-#ifdef CONFIG_LINUX
-    struct statfs fs;
-    int ret;
-
-    if (fd != -1) {
-        do {
-            ret = fstatfs(fd, &fs);
-        } while (ret != 0 && errno == EINTR);
-
-        if (ret == 0 && fs.f_type == HUGETLBFS_MAGIC) {
-            return fs.f_bsize;
-        }
-    }
-#endif
-
-    return getpagesize();
-}
-
 void os_mem_prealloc(int fd, char *area, size_t memory)
 {
    int ret;
@@ -387,7 +365,7 @@ void os_mem_prealloc(int fd, char *area, size_t memory)
        exit(1);
    } else {
        int i;
-        size_t hpagesize = fd_getpagesize(fd);
+        size_t hpagesize = qemu_fd_getpagesize(fd);
        size_t numpages = DIV_ROUND_UP(memory, hpagesize);

        /* MAP_POPULATE silently ignores failures */
@@ -1 +1 @@
 .4.92
 .5.0