ipxe: update to current git

Now that ipxe has separate settings for load / boot banner timeouts re-enable the boot banner while keeping the load banner turned off, so we don't add a delay to non-pxe boots. git shortlog: Adrian Jamróz (2): [rhine] Rewrite VIA Rhine driver [velocity] Rewrite VIA Velocity driver Alex Williamson (4): [romprefix] Allow ROM banner timeout to be configured independently [autoboot] Enable infrastructure to specify an autoboot device location [prefix] Allow prefix to specify a PCI autoboot device location [romprefix] Store boot bus:dev.fn address as autoboot device location Alexander Chernyakhovsky (1): [ocsp] Handle OCSP responses that don't provide certificates Bo Yang (1): [build] Avoid strict-aliasing warning for gcc 4.3 Brandon Penglase (1): [build] Add vmware build target Christian Hesse (2): [build] Update build system for Syslinux 6.x [build] Fix LABEL name for .liso images Daniel P. Berrange (1): [zbin] Fix size used for memset in alloc_output_file Frediano Ziglio (1): [romprefix] Fix incorrect pointer offset in undiloader.S Kevin Tran (1): [tg3] Fix various tg3 issues Marin Hannache (8): [linux] Add missing #include <stddef.h> [legal] Add FILE_LICENCE for valgrind headers [legal] Add FILE_LICENCE for core/errno.c [legal] Add FILE_LICENCE for ath9k driver headers [legal] Add missing FILE_LICENCE declarations [cmdline] Add "poweroff" command [nfs] Add support for NFS protocol [nfs] Fix an issue with the selection of a local port Michael Brown (363): [netdevice] Separate VLAN support from presence of VLAN-supporting drivers [undi] Work around specific devices with known broken interrupt behaviour [menu] Prevent character code zero from acting as a shortcut key [menu] Prevent separators with shortcut keys from being selected [tftp] Allow TFTP block size to be controlled via the PXE TFTP API [pcbios] Add extra debugging messages when unhiding iPXE from memory [nbiprefix] Set up real-mode stack before jumping to .text16 [prefix] Use %cs as implicit parameter to uninstall() [pcbios] Inhibit all calls to INT 15,e820 and INT 15,e801 during POST [romprefix] Display only one "Ctrl-B" prompt per PCI device during POST [efi] Update to latest EDK2 headers [autoboot] Split main control flow out of main() into a new function ipxe() [efi] Add last_opened_snpdev() [efi] Expose downloaded images via EFI_SIMPLE_FILE_SYSTEM_PROTOCOL [efi] Add our own EFI_LOAD_FILE_PROTOCOL implementation [efi] Fix building with newer binutils [lkrnprefix] Allow relocation when no initrd is present [efi] Fix minor typos in efi_image.c [efi] Add EFI-specific debugging macros [int13] Split out ISO9660 and El Torito definitions to separate header files [smbios] Provide SMBIOS version number via smbios_version() [smbios] Mangle UUIDs for SMBIOS version 2.6 and newer [dhcp] Use PXE byte ordering for UUID in DHCP option 97 [uuid] Abstract UUID mangling code out to a separate uuid_mangle() function [efi] Provide efi_guid_ntoa() for printing EFI GUIDs [efi] Add "reboot" command for EFI [cmdline] Add ability to perform a warm reboot [efi] Enable "cpuid" command by default for EFI [cs89x0] Remove conflicting macro definitions [igbvf] Remove conflicting macro definitions [prism2] Use standard type names [efi] Fetch device path for loaded image during initialisation [settings] Expose build architecture and platform via settings [bios] Fix screen clearing on buggy BIOSes [intel] Remove hardcoded offsets for descriptor ring registers [intel] Expose functionality to be shared with intelx driver [intel] Add intelx driver for Intel 10 Gigabit Ethernet NICs [efi] Remove obsolete EFI I/O implementation using EFI_CPU_IO_PROTOCOL [libc] Use __einfo() tuple as first argument to EUNIQ() [libc] Redefine low 8 bits of error code as "platform error code" [efi] Perform meaningful error code conversions [efi] Add sample platform-generated error disambiguations [netdevice] Use link-layer address as part of RNG seed [build] Allow sparse to find compiler.h [build] Define __WINT_TYPE__ if necessary [build] Allow sparse to be invoked via "make C=1" [build] Avoid sparse undeclared symbol warning for PROVIDE_SYMBOL() [process] Mark process descriptor as static in PERMANENT_PROCESS [realtek] Print bad MAC address in debug message when inferring no EEPROM [build] Use -Wno-decl when running sparse [build] Fix uses of literal 0 as a NULL pointer [build] Fix dubious uses of bitwise operators [build] Default to short wchar_t in stddef.h [realtek] Use ID word to detect EEPROM presence [errdb] Strip platform error code for non-platform-generated errors [pxe] Convert external PXE API errors into iPXE platform-generated errors [realtek] Allow reaction time between writing RTL_CAPR and reading RTL_CR [romprefix] Report failure cause when unable to open payload [realtek] Ensure EEPROM writes reach chip before starting udelay() [dhcp] Remove obsolete bootp.h header [netdevice] Add netdev_tx_defer() to allow drivers to defer transmissions [realtek] Defer packets when no transmit descriptors are available [settings] Eliminate settings "tag magic" [smbios] Allow access to unreferenced SMBIOS strings [smbios] Allow access to multiple instances of SMBIOS structures [crypto] Report meaningful error when certificate chain validation fails [build] Use $(eval) if available [build] Provide "allXXXs" targets for all media on all platforms [build] Add efidrv.cab target for UEFI Secure Boot signing [netdevice] Add "chip" setting [netdevice] Reset MAC address when asked to clear the "mac" setting [realtek] Fix reopening of legacy-mode 8139 NIC [crypto] Accept OCSP responses containing multiple certificates [bzimage] Align initrd images to page boundary [bzimage] Fix spurious uninitialised-variable warning on some gcc versions [build] Work around bug in gcc >= 4.8 [autoboot] Use next-server from filename's settings block [tcp] Do not send RST for unrecognised connections [tcp] Fix comment to match code behaviour [test] Add self-tests for base16 [base16] Generalise base16_decode() to hex_decode() [settings] Use hex_decode() to parse hex settings [settings] Add "hexraw" setting type [netdevice] Add "bustype" and "busloc" settings [settings] Add "busdevfn" setting type [linux] Add support for accessing PCI configuration space via /proc/bus/pci [settings] Add config/settings.h [settings] Expose PCI configuration space via settings mechanism [settings] Make "netX" settings block function as a symbolic link [cmdline] Accept "netX" in iPXE commands [lotest] Include sequence number within loopback test packets [intel] Incorporate ring producer and consumer counters in diagnostics [base16] Ensure base16_encode() always terminates its result string [realtek] Report RX error detail in debug messages [script] Allow for backslash continuation of script lines [settings] Add support for navigation keys in "config" user interface [realtek] Allow extra space in RX buffers [ifmgmt] Avoid relying on global variable within ifcommon_exec() [script] Avoid trying to read final character of a zero-length string [legal] Add missing FILE_LICENCE declarations [build] Fix %.licence build target [settings] Clarify usage of the term "named setting" [settings] Avoid potentially large stack allocations [settings] Remove temporary name buffer parameter from parse_setting_name() [settings] Remove default_type parameter from parse_setting_name() [settings] Expose parse_setting_name() [settings] Change "not-found" semantics of fetch_setting_copy() [settings] Add fetchf_setting_copy() [settings] Eliminate call to fetchf_named_setting() in expand_settings() [settings] Eliminate call to store_named_setting() in nslookup.c [settings] Remove now-unused store_named_setting() [parseopt] Allow parsed option to be modified [parseopt] Move parse_settings() to parseopt.c [parseopt] Add parse_setting() [settings] Eliminate call to storef_named_setting() in choose_exec() [settings] Eliminate calls to {fetch,store}f_named_setting() in NVO commands [settings] Remove now-unused fetchf_named_setting() and storef_named_setting() [script] Allow initial whitespace on lines containing labels [script] Allow commands following a script label [settings] Introduce the generalised concept of a numeric setting [cmdline] Add "inc" command [pci] Add pci_find_next() to iterate over existent PCI devices [cmdline] Add "pciscan" command to allow iteration over PCI devices [udp] Move high-frequency debug messages to DBGLVL_EXTRA [ipv6] Rename sin_{family,port} to sin6_{family,port} in struct sockaddr_in6 [tcpip] Allow binding to unspecified privileged ports (below 1024) [settings] Expose CPUID instruction via settings mechanism [test] Add self-tests for snprintf() [settings] Allow numeric_setting_value() to handle long setting values [settings] Expose memory map via settings mechanism [params] Add support for the general concept of a form parameter list [cmdline] Add "params" and "param" commands to manage form parameter lists [uri] Allow URIs to incorporate a parameter list [http] Add support for HTTP POST [settings] Make built-in settings a linker table [linux] Give tap devices a name and bus type [ipv4] Generalise fragment reassembly mechanism [netdevice] Increase maximum network-layer address length [netdevice] Add concept of a network device index [netdevice] Add method for generating EUI-64 address from link-layer address [ethernet] Add support for generating multicast hash for IPv6 addresses [linux] Apply MAC address prior to registering network device [tcpip] Pass through network device to transport layer protocols [neighbour] Generalise concept of neighbour discovery [ipv4] Abstract out protocol-specific portions of "route" command [ipv6] Replace IPv6 stack [ipv6] Fix uninitialised-variable warning [tcp] Reduce path MTU to 1280 bytes [ipv6] Add inet6_aton() [build] Work around bug in gcc >= 4.8 [neighbour] Add nstat() function to print out neighbour table [cmdline] Add "nstat" command [tcp] Add AF_INET6 socket opener [udp] Add AF_INET6 socket opener [netdevice] Add find_netdev_by_index() [socket] Add concept of a generalised socket address converter [ipv4] Add IPv4 socket address converter [ipv6] Add IPv6 socket address converter [resolv] Use sock_aton() to allow parsing of arbitrary numeric addresses [icmp] Add support for sending ICMP echo requests [ping] Add concept of a ping socket [ping] Add generic ping mechanism [ping] Add top-level ping() function to ping a host [cmdline] Add "ping" command [ipv6] Handle IPv6 option length correctly [ipv6] Extract link layer addresses from router advertisements [ipv6] Support stateless address autoconfiguration (SLAAC) [ipv6] Treat sin6_scope_id consistently [ipv6] Automatically choose source for link-local and multicast destinations [pxe] Always retrieve cached DHCPACK and apply to relevant network device [ipv6] Add ndp_tx_router_solicitation() to send router solicitations [parseopt] Add parse_timeout() [netdevice] Make all net_driver methods optional [interface] Default to calling intf_restart() in response to intf_close() [job] Allow job_progress() to return an ongoing job status code, if known [monojob] Add timeout parameter to monojob_wait() [monojob] Report ongoing job status as overall return status on timeout [cmdline] Rewrite "sync" command to use monojob_wait() [autoboot] Fix shell banner timeout [ifmgmt] Rewrite iflinkwait() to use monojob_wait() [cmdline] Allow "if<xxx>" commands to take options [netdevice] Add generic concept of a network device configurator [dhcp] Add DHCP network device configurator [parseopt] Add parse_netdev_configurator() [ifmgmt] Add ifconf() to carry out network device configuration [autoboot] Use ifconf() to configure network device [cmdline] Add "ifconf" command [cmdline] Make "dhcp" command a synonym for "ifconf" [dhcp] Remove obsolete dhcp() function [ipv6] Add IPv6 network device configurator [cmdline] Generate command option help text automatically [pxe] Ensure cached DHCPACK is retrieved prior to network device creation [base16] Fix comparison of signed and unsigned integers [settings] Move user-class setting from dhcp.c to settings.c [ipv6] Use given source address only if it is not the unspecified address [ipv6] Add "ipv6" setting type [dhcpv6] Add basic support for stateful and stateless DHCPv6 [ipv6] Separate the concepts of prefix and address creation [dhcpv6] Allow stateful DHCPv6 to apply obtained IPv6 addresses [test] Include failing code within failed test result output [main] Defer "initialising devices" message until initialising devices [console] Pass escape sequence context to ANSI escape sequence handlers [pixbuf] Add generic concept of a pixel buffer [image] Allow for non-executable image formats [image] Add image_pixbuf() to create pixel buffer from image [pnm] Add support for PNM images [mucurses] Use "<ESC>[2J" ANSI escape sequence to clear screen [console] Allow console input and output to be disabled independently [console] Add concept of generic console configuration [cmdline] Add "console" command to configure console [fbcon] Add generic concept of a frame buffer console [vesafb] Add VESA frame buffer console [vesafb] Include raw status value within VBE error messages [vesafb] Skip modes for which we cannot get mode information [vesafb] Return meaningful error when no suitable mode is found [vesafb] Select an optimal mode, rather than the first acceptable mode [build] Fix building on OpenBSD 5.4 [console] Allow '?' as an intermediate byte in ANSI escape sequences [mucurses] Implement curs_set() to control cursor visibility [settings] Hide cursor when not actively editing a setting [menu] Hide cursor when displaying menu [fbcon] Add support for displaying a cursor [settings] Explicitly separate the concept of a completed fetched setting [settings] Allow for IPv6 setting types in non-IPv6 builds [settings] Add fetch_ipv6_setting() [dns] Add support for resolving IPv6 addresses via AAAA records [socket] Ensure socket address structure sizes are fixed [syslog] Add support for IPv6 syslog server [ipv6] Add support for resolving IPv6 addresses via the "nslookup" command [linux] Provide access to SMBIOS via /dev/mem [dhcpv6] Use DUID-UUID form of client DUID [settings] Force settings into alphabetical order within sections [settings] Allow for multiple definitions of each predefined setting [settings] Merge SETTING_IPv4 and SETTING_IPv6 [dhcpv6] Add DHCPv6 "filename" setting [ipv6] Expose NDP-provided settings (including the DNS server) [vesafb] Work around data corruption bug in bochs/qemu VBE implementation [settings] Adapt user interface to fit display size [login] Adapt user interface to fit display size [menu] Adapt user interface to fit display size [console] Allow consoles to update the recorded console size [fbcon] Update the console width and height after changing mode [lkrnprefix] Include iPXE version string in image header [fbcon] Always draw cursor using current foreground and background colours [console] Add centralised concept of colours and colour pairs [mucurses] Use centralised concept of colour pairs [cmdline] Add the "colour" and "cpair" commands [console] Add concept of a "magic" colour [vesafb] Set "magic" colour to transparent when a background picture is used [build] Remove obsolete check for GNU as version 2.9.1 [ipv6] Fix compilation under FreeBSD [build] Build ROMs used by qemu and VMware as part of "make all" [libc] Add isprint() [test] Add okx() macro taking an explicit file name and line number [deflate] Add support for DEFLATE decompression [deflate] Fix literal data length calculation [libc] Add abs() [uaccess] Add memcmp_user() [test] Rewrite pnm_ok() using okx() [test] Generalise pnm_ok() to pixbuf_ok() [png] Add support for PNG images [vesafb] Handle failures from fbcon_init() [fbcon] Centre background picture on console [fbcon] Allow for an arbitrary margin around the text area [vesafb] Allow for an arbitrary margin around the text area [cmdline] Rename "console" command's --bpp option to --depth [cmdline] Add margin options to the "console" command [fbcon] Allow ANSI CUP with missing arguments [cmdline] Always clear screen after reconfiguring console [intel] Add some missing PCI IDs [dns] Support DNS search lists [dns] Update end-of-name pointer after processing CNAME record [dhcp] Copy exactly the required length when resizing DHCP options [settings] Remove "uristring" setting type [params] Use reference counters for form parameter lists [uri] Refactor URI parsing and formatting [image] Ensure every image has a fully resolved URI [tcpip] Add IP statistics collection as per RFC 4293 [cmdline] Add the "ipstat" command [prefix] Ignore PCI autoboot device location if set to 00:00.0 [tcpip] Provide tcpip_netdev() to determine the transmitting network device [tcpip] Provide tcpip_mtu() to determine the maximum transmission unit [tcp] Calculate correct MSS from peer address [bzimage] Report exact initrd length via bzImage header [realtek] Include link status register details in debug messages [romprefix] Do not clobber stack segment when returning to BIOS [netdevice] Mark devices as open before calling open() method [tcp] Update window even if ACK does not acknowledge new data [linux] Avoid starting currticks() from zero every time [http] Use a retry timer to trigger retried requests [http] Automatically retry request on a 503 Service Unavailable [mii] Add mii_dump() to dump all MII registers [realtek] Dump all MII register contents when link status changes [monojob] Reset timeout when progress is made [image] Add "--timeout" parameter to image downloading commands [efi] Allow for 64-bit EFI_STATUS codes [efi] Allow driver to be unloaded [efi] Connect driver to devices as part of installation [console] Fix display of characters with top bit set [lotest] Allow loopback testing on shared networks [netdevice] Notify upper-layer drivers when RX processing is (un)frozen [efi] Avoid accidentally calling main() twice [efi] Unload our own image before exiting UEFI application [efi] Disable SNP devices when running iPXE as the application [realtek] Add ability to dump all internal registers [realtek] Clear bit 24 of RCR [bios] Fix screen clearing on even more buggy BIOSes [http] Accept Content-Length header with trailing whitespace [crypto] Remove dynamically-allocated storage for certificate name [crypto] Remove dynamically-allocated storage for certificate OCSP URI [build] Remove long-obsolete mechanism for wrapping embedded images [build] Disable ccache for all relevant build targets [build] Add dependency of generated files upon Makefile [crypto] Add pubkey_match() to check for matching public/private key pairs [crypto] Generalise X.509 cache to a full certificate store [crypto] Use fingerprint when no common name is available for debug messages [crypto] Allow signed timestamp error margin to be configured at build time [test] Rewrite X.509 tests using okx() [test] Rewrite CMS tests using okx() [test] Add tests for x509_check_name() [test] Add subject alternative names to X.509 server test certificate [crypto] Add support for subjectAltName and wildcard certificates [crypto] Allow wildcard matches on commonName as well as subjectAltName [intel] Avoid completely filling the TX descriptor ring [test] Rewrite TCP/IP tests using okx() [test] Add self-tests for flsl() [libc] Add inline assembly implementation of flsl() using BSR instruction [test] Add tests for 64-bit division [build] Fix __libgcc attribute for recent gcc versions [test] Check for correct -mrtd assumption on libgcc arithmetic functions [libc] Add isqrt() function to find integer square roots [libc] Add flsll() [profile] Add generic profiling infrastructure [cmdline] Add "profstat" command to display profiling statistics [netdevice] Profile common operations [intel] Profile common virtual machine operations [intel] Push new RX descriptors in batches [librm] Use genuine real mode to accelerate operation in virtual machines [ipv4] Profile transmit and receive datapaths [tcp] Profile transmit and receive datapaths [http] Profile receive datapath [downloader] Profile receive datapath [build] Allow for a debug level of zero [librm] Allow interrupts in protected mode [comboot] Use built-in interrupt reflector [pcbios] Do not switch to real mode to check for timer interrupt [pcbios] Do not switch to real mode to sleep the CPU [test] Print out profiling statistics after a successful test run [librm] Add a profiling self-test for measuring mode transition times [librm] Add meaningful labels at section changes [librm] Speed up protected-to-real mode transition under KVM [librm] Speed up real-to-protected mode transition under KVM [librm] Speed up protected-mode calls under KVM [profile] Provide methods for profiling individual stages of operations [librm] Add profiling self-tests for complete real_call and prot_call cycles [pxe] Profile all PXE API calls [pxe] Profile UNDI transmit datapath [pxe] Work around missing PXENV_UNDI_OPEN only when necessary [undi] Profile all PXE API calls [undi] Profile transmit and receive datapaths [undi] Report any PXENV_UNDI_ISR errors via netdev_rx_err() [undi] Do not switch to real mode to check for NIC interrupt [undi] Place an upper limit on the number of PXENV_UNDI_ISR calls per poll Peter Pickford (1): [serial] Enable UART FIFOs Robin Smidsrød (2): [settings] Add "version" builtin setting [build] Include ipxe.pxe in default build Stefan Hajnoczi (2): [netdevice] Add vlan_tag() to get the VLAN tag of a network device [iscsi] Include 802.1Q VLAN identifier in iBFT Thomas Miletich (3): [3c90x] Stall upload engine before setting RX ring address [3c90x] Don't round up transmit packet length [3c90x] Fix High-MTU packet reception lolipop (1): [intel] Add Intel I217 Gigabit Ethernet PCI ID Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
seabios: update to 1.7.5-rc1
2014-05-15 14:24:05 +02:00 · 2014-05-15 14:05:26 +02:00 · 2014-05-13 18:36:19 +01:00 · 2014-05-13 10:16:07 -07:00 · 2014-05-13 13:16:37 +01:00 · 2014-05-13 12:48:52 +01:00
486 changed files with 14467 additions and 8138 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -18,8 +18,8 @@
 /*-darwin-user
 /*-linux-user
 /*-bsd-user
-libdis*
+/libdis*
-libuser
+/libuser
 /linux-headers/asm
 /qga/qapi-generated
 /qapi-generated
@@ -49,19 +49,9 @@ libuser
 /qemu-monitor.texi
 /qmp-commands.txt
 /vscclient
 /test-bitops
 /test-coroutine
 /test-int128
 /test-opts-visitor
 /test-qmp-input-visitor
 /test-qmp-output-visitor
 /test-string-input-visitor
 /test-string-output-visitor
 /test-visitor-serialization
 /fsdev/virtfs-proxy-helper
 /fsdev/virtfs-proxy-helper.1
 /fsdev/virtfs-proxy-helper.pod
 /.gdbinit
 *.a
 *.aux
 *.cp
@@ -90,12 +80,8 @@ libuser
 *.pc
 .libs
 .sdk
 *.swp
 *.orig
 .pc
 *.gcda
 *.gcno
 patches
 /pc-bios/bios-pq/status
 /pc-bios/vgabios-pq/status
 /pc-bios/optionrom/linuxboot.asm
--- a/24
+++ b/24
@@ -52,6 +52,13 @@ General Project Administration
 ------------------------------
 M: Anthony Liguori <aliguori@amazon.com>
 Responsible Disclosure, Reporting Security Issues
 ------------------------------
 W: http://wiki.qemu.org/SecurityProcess
 M: Michael S. Tsirkin <mst@redhat.com>
 M: Anthony Liguori <aliguori@amazon.com>
 L: secalert@redhat.com
 Guest CPU cores (TCG):
 ----------------------
 Alpha
@@ -601,6 +608,7 @@ USB
 M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: hw/usb/*
 F: tests/usb-hcd-ehci-test.c
 VFIO
 M: Alex Williamson <alex.williamson@redhat.com>
@@ -666,6 +674,9 @@ M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: audio/
 F: hw/audio/
 F: tests/ac97-test.c
 F: tests/es1370-test.c
 F: tests/intel-hda-test.c
 Block
 M: Kevin Wolf <kwolf@redhat.com>
@@ -674,6 +685,8 @@ S: Supported
 F: block*
 F: block/
 F: hw/block/
 F: qemu-img*
 F: qemu-io*
 T: git git://repo.or.cz/qemu/kevin.git block
 T: git git://github.com/stefanha/qemu.git block
@@ -778,6 +791,17 @@ S: Supported
 F: qapi-schema.json
 T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp
 QOM
 M: Anthony Liguori <aliguori@amazon.com>
 M: Andreas Färber <afaerber@suse.de>
 S: Supported
 T: git git://github.com/afaerber/qemu-cpu.git qom-next
 F: include/qom/
 X: include/qom/cpu.h
 F: qom/
 X: qom/cpu.c
 F: tests/qom-test.c
 QMP
 M: Luiz Capitulino <lcapitulino@redhat.com>
 S: Maintained
--- a/46
+++ b/46
@@ -148,10 +148,6 @@ endif
 all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all modules
 vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)
 vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)
 config-host.h: config-host.h-timestamp
 config-host.h-timestamp: config-host.mak
 qemu-options.def: $(SRC_PATH)/qemu-options.hx
@@ -195,8 +191,6 @@ ALL_SUBDIRS=$(TARGET_DIRS) $(patsubst %,pc-bios/%, $(ROMS))
 recurse-all: $(SUBDIR_RULES) $(ROMSUBDIR_RULES)
 bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)
 $(BUILD_DIR)/version.o: $(SRC_PATH)/version.rc $(BUILD_DIR)/config-host.h | $(BUILD_DIR)/version.lo
 	$(call quiet-command,$(WINDRES) -I$(BUILD_DIR) -o $@ $<,"  RC    version.o")
 $(BUILD_DIR)/version.lo: $(SRC_PATH)/version.rc $(BUILD_DIR)/config-host.h
@@ -238,23 +232,35 @@ qapi-py = $(SRC_PATH)/scripts/qapi.py $(SRC_PATH)/scripts/ordereddict.py
 qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
 		$(gen-out-type) -o qga/qapi-generated -p "qga-" -i $<, \
 		"  GEN   $@")
 qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
 		$(gen-out-type) -o qga/qapi-generated -p "qga-" -i $<, \
 		"  GEN   $@")
 qga/qapi-generated/qga-qmp-commands.h qga/qapi-generated/qga-qmp-marshal.c :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
 		$(gen-out-type) -o qga/qapi-generated -p "qga-" -i $<, \
 		"  GEN   $@")
 qapi-types.c qapi-types.h :\
 $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o "." -b < $<, "  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
 		$(gen-out-type) -o "." -b -i $<, \
 		"  GEN   $@")
 qapi-visit.c qapi-visit.h :\
 $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o "." -b < $<, "  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
 		$(gen-out-type) -o "." -b -i $<, \
 		"  GEN   $@")
 qmp-commands.h qmp-marshal.c :\
 $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -m -o "." < $<, "  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
 		$(gen-out-type) -o "." -m -i $<, \
 		"  GEN   $@")
 QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
 $(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)
@@ -372,17 +378,25 @@ install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig \
 install-datadir install-localstatedir
 	$(INSTALL_DIR) "$(DESTDIR)$(bindir)"
 ifneq ($(TOOLS),)
-	$(INSTALL_PROG) $(STRIP_OPT) $(TOOLS) "$(DESTDIR)$(bindir)"
+	$(INSTALL_PROG) $(TOOLS) "$(DESTDIR)$(bindir)"
 ifneq ($(STRIP),)
 	$(STRIP) $(TOOLS:%="$(DESTDIR)$(bindir)/%")
 endif
 endif
 ifneq ($(CONFIG_MODULES),)
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_moddir)"
-	for s in $(patsubst %.mo,%$(DSOSUF),$(modules-m)); do \
+	for s in $(modules-m:.mo=$(DSOSUF)); do \
-		$(INSTALL_PROG) $(STRIP_OPT) $$s "$(DESTDIR)$(qemu_moddir)/$$(echo $$s | tr / -)"; \
+		t="$(DESTDIR)$(qemu_moddir)/$$(echo $$s | tr / -)"; \
 		$(INSTALL_LIB) $$s "$$t"; \
 		test -z "$(STRIP)" || $(STRIP) "$$t"; \
 	done
 endif
 ifneq ($(HELPERS-y),)
 	$(INSTALL_DIR) "$(DESTDIR)$(libexecdir)"
-	$(INSTALL_PROG) $(STRIP_OPT) $(HELPERS-y) "$(DESTDIR)$(libexecdir)"
+	$(INSTALL_PROG) $(HELPERS-y) "$(DESTDIR)$(libexecdir)"
 ifneq ($(STRIP),)
 	$(STRIP) $(HELPERS-y:%="$(DESTDIR)$(libexecdir)/%")
 endif
 endif
 ifneq ($(BLOBS),)
 	set -e; for x in $(BLOBS); do \
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -31,6 +31,8 @@ libcacard-y += libcacard/vcard_emul_nss.o
 libcacard-y += libcacard/vcard_emul_type.o
 libcacard-y += libcacard/card_7816.o
 libcacard-y += libcacard/vcardt.o
 libcacard/vcard_emul_nss.o-cflags := $(NSS_CFLAGS)
 libcacard/vcard_emul_nss.o-libs := $(NSS_LIBS)
 ######################################################################
 # Target independent part of system emulation. The long term path is to
@@ -64,9 +66,11 @@ common-obj-y += hw/
 common-obj-y += ui/
 common-obj-y += bt-host.o bt-vhci.o
 bt-host.o-cflags := $(BLUEZ_CFLAGS)
 common-obj-y += dma-helpers.o
 common-obj-y += vl.o
 vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS)
 common-obj-y += tpm.o
 common-obj-$(CONFIG_SLIRP) += slirp/
--- a/Makefile.target
+++ b/Makefile.target
@@ -16,19 +16,22 @@ QEMU_CFLAGS+=-I$(SRC_PATH)/include
 ifdef CONFIG_USER_ONLY
 # user emulator name
 QEMU_PROG=qemu-$(TARGET_NAME)
 QEMU_PROG_BUILD = $(QEMU_PROG)
 else
 # system emulator name
 QEMU_PROG=qemu-system-$(TARGET_NAME)$(EXESUF)
 ifneq (,$(findstring -mwindows,$(libs_softmmu)))
 # Terminate program name with a 'w' because the linker builds a windows executable.
 QEMU_PROGW=qemu-system-$(TARGET_NAME)w$(EXESUF)
-endif # windows executable
+$(QEMU_PROG): $(QEMU_PROGW)
-QEMU_PROG=qemu-system-$(TARGET_NAME)$(EXESUF)
+	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
 QEMU_PROG_BUILD = $(QEMU_PROGW)
 else
 QEMU_PROG_BUILD = $(QEMU_PROG)
 endif
 endif
-PROGS=$(QEMU_PROG)
+PROGS=$(QEMU_PROG) $(QEMU_PROGW)
 ifdef QEMU_PROGW
 PROGS+=$(QEMU_PROGW)
 endif
 STPFILES=
 config-target.h: config-target.h-timestamp
@@ -120,8 +123,10 @@ obj-y += dump.o
 LIBS+=$(libs_softmmu)
 # xen support
-obj-$(CONFIG_XEN) += xen-all.o xen-mapcache.o
+obj-$(CONFIG_XEN) += xen-common.o
-obj-$(call lnot,$(CONFIG_XEN)) += xen-stub.o
+obj-$(CONFIG_XEN_I386) += xen-hvm.o xen-mapcache.o
 obj-$(call lnot,$(CONFIG_XEN)) += xen-common-stub.o
 obj-$(call lnot,$(CONFIG_XEN_I386)) += xen-hvm-stub.o
 # Hardware support
 ifeq ($(TARGET_NAME), sparc64)
@@ -138,10 +143,7 @@ endif # CONFIG_SOFTMMU
 %/translate.o: QEMU_CFLAGS += $(TRANSLATE_OPT_CFLAGS)
 dummy := $(call unnest-vars,,obj-y)
-
+all-obj-y := $(obj-y)
 # we are making another call to unnest-vars with different vars, protect obj-y,
 # it can be overriden in subdir Makefile.objs
 obj-y-save := $(obj-y)
 block-obj-y :=
 common-obj-y :=
@@ -151,27 +153,16 @@ dummy := $(call unnest-vars,.., \
               block-obj-m \
               common-obj-y \
               common-obj-m)
-
+all-obj-y += $(common-obj-y)
 # Now restore obj-y
 obj-y := $(obj-y-save)
 all-obj-y = $(obj-y) $(common-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y)
 ifndef CONFIG_HAIKU
 LIBS+=-lm
 endif
-ifdef QEMU_PROGW
+# build either PROG or PROGW
-# The linker builds a windows executable. Make also a console executable.
+$(QEMU_PROG_BUILD): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
 $(QEMU_PROGW): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
 	$(call LINK,$^)
 $(QEMU_PROG): $(QEMU_PROGW)
 	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
 else
 $(QEMU_PROG): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
 	$(call LINK,$^)
 endif
 gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
 	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/scripts/feature_to_c.sh $@ $(TARGET_XML_FILES),"  GEN   $(TARGET_DIR)$@")
@@ -192,9 +183,9 @@ endif
 install: all
 ifneq ($(PROGS),)
-	$(INSTALL) -m 755 $(PROGS) "$(DESTDIR)$(bindir)"
+	$(INSTALL_PROG) $(PROGS) "$(DESTDIR)$(bindir)"
 ifneq ($(STRIP),)
-	$(STRIP) $(patsubst %,"$(DESTDIR)$(bindir)/%",$(PROGS))
+	$(STRIP) $(PROGS:%="$(DESTDIR)$(bindir)/%")
 endif
 endif
 ifdef CONFIG_TRACE_SYSTEMTAP
--- a/2
+++ b/2
@@ -1 +1 @@
-2.0.0
+2.0.50
--- a/arch_init.c
+++ b/arch_init.c
@@ -45,6 +45,7 @@
 #include "hw/audio/pcspk.h"
 #include "migration/page_cache.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
 #include "qmp-commands.h"
 #include "trace.h"
 #include "exec/cpu-all.h"
@@ -110,6 +111,8 @@ static bool mig_throttle_on;
 static int dirty_rate_high_cnt;
 static void check_guest_throttling(void);
 static uint64_t bitmap_sync_count;
 /***********************************************************/
 /* ram save/restore */
@@ -167,11 +170,8 @@ static struct {
    /* Cache for XBZRLE, Protected by lock. */
    PageCache *cache;
    QemuMutex lock;
-} XBZRLE = {
+} XBZRLE;
-    .encoded_buf = NULL,
+
    .current_buf = NULL,
    .cache = NULL,
 };
 /* buffer used for XBZRLE decoding */
 static uint8_t *xbzrle_decoded_buf;
@@ -187,41 +187,44 @@ static void XBZRLE_cache_unlock(void)
        qemu_mutex_unlock(&XBZRLE.lock);
 }
 /*
 * called from qmp_migrate_set_cache_size in main thread, possibly while
 * a migration is in progress.
 * A running migration maybe using the cache and might finish during this
 * call, hence changes to the cache are protected by XBZRLE.lock().
 */
 int64_t xbzrle_cache_resize(int64_t new_size)
 {
-    PageCache *new_cache, *cache_to_free;
+    PageCache *new_cache;
    int64_t ret;
    if (new_size < TARGET_PAGE_SIZE) {
        return -1;
    }
-    /* no need to lock, the current thread holds qemu big lock */
+    XBZRLE_cache_lock();
    if (XBZRLE.cache != NULL) {
        /* check XBZRLE.cache again later */
        if (pow2floor(new_size) == migrate_xbzrle_cache_size()) {
-            return pow2floor(new_size);
+            goto out_new_size;
        }
        new_cache = cache_init(new_size / TARGET_PAGE_SIZE,
                                        TARGET_PAGE_SIZE);
        if (!new_cache) {
-            DPRINTF("Error creating cache\n");
+            error_report("Error creating cache");
-            return -1;
+            ret = -1;
            goto out;
        }
-        XBZRLE_cache_lock();
+        cache_fini(XBZRLE.cache);
-        /* the XBZRLE.cache may have be destroyed, check it again */
+        XBZRLE.cache = new_cache;
        if (XBZRLE.cache != NULL) {
            cache_to_free = XBZRLE.cache;
            XBZRLE.cache = new_cache;
        } else {
            cache_to_free = new_cache;
        }
        XBZRLE_cache_unlock();
        cache_fini(cache_to_free);
    }
-    return pow2floor(new_size);
+out_new_size:
    ret = pow2floor(new_size);
 out:
    XBZRLE_cache_unlock();
    return ret;
 }
 /* accounting for migration statistics */
@@ -233,6 +236,7 @@ typedef struct AccountingInfo {
    uint64_t xbzrle_bytes;
    uint64_t xbzrle_pages;
    uint64_t xbzrle_cache_miss;
    double xbzrle_cache_miss_rate;
    uint64_t xbzrle_overflows;
 } AccountingInfo;
@@ -288,6 +292,11 @@ uint64_t xbzrle_mig_pages_cache_miss(void)
    return acct_info.xbzrle_cache_miss;
 }
 double xbzrle_mig_cache_miss_rate(void)
 {
    return acct_info.xbzrle_cache_miss_rate;
 }
 uint64_t xbzrle_mig_pages_overflow(void)
 {
    return acct_info.xbzrle_overflows;
@@ -340,7 +349,7 @@ static void xbzrle_cache_zero_page(ram_addr_t current_addr)
 #define ENCODING_FLAG_XBZRLE 0x1
-static int save_xbzrle_page(QEMUFile *f, uint8_t *current_data,
+static int save_xbzrle_page(QEMUFile *f, uint8_t **current_data,
                            ram_addr_t current_addr, RAMBlock *block,
                            ram_addr_t offset, int cont, bool last_stage)
 {
@@ -348,19 +357,23 @@ static int save_xbzrle_page(QEMUFile *f, uint8_t *current_data,
    uint8_t *prev_cached_page;
    if (!cache_is_cached(XBZRLE.cache, current_addr)) {
        acct_info.xbzrle_cache_miss++;
        if (!last_stage) {
-            if (cache_insert(XBZRLE.cache, current_addr, current_data) == -1) {
+            if (cache_insert(XBZRLE.cache, current_addr, *current_data) == -1) {
                return -1;
            } else {
                /* update *current_data when the page has been
                   inserted into cache */
                *current_data = get_cached_data(XBZRLE.cache, current_addr);
            }
        }
        acct_info.xbzrle_cache_miss++;
        return -1;
    }
    prev_cached_page = get_cached_data(XBZRLE.cache, current_addr);
    /* save current buffer into memory */
-    memcpy(XBZRLE.current_buf, current_data, TARGET_PAGE_SIZE);
+    memcpy(XBZRLE.current_buf, *current_data, TARGET_PAGE_SIZE);
    /* XBZRLE encoding (if there is no overflow) */
    encoded_len = xbzrle_encode_buffer(prev_cached_page, XBZRLE.current_buf,
@@ -373,7 +386,10 @@ static int save_xbzrle_page(QEMUFile *f, uint8_t *current_data,
        DPRINTF("Overflow\n");
        acct_info.xbzrle_overflows++;
        /* update data in the cache */
-        memcpy(prev_cached_page, current_data, TARGET_PAGE_SIZE);
+        if (!last_stage) {
            memcpy(prev_cached_page, *current_data, TARGET_PAGE_SIZE);
            *current_data = prev_cached_page;
        }
        return -1;
    }
@@ -479,6 +495,10 @@ static void migration_bitmap_sync(void)
    static int64_t num_dirty_pages_period;
    int64_t end_time;
    int64_t bytes_xfer_now;
    static uint64_t xbzrle_cache_miss_prev;
    static uint64_t iterations_prev;
    bitmap_sync_count++;
    if (!bytes_xfer_prev) {
        bytes_xfer_prev = ram_bytes_transferred();
@@ -520,11 +540,22 @@ static void migration_bitmap_sync(void)
        } else {
             mig_throttle_on = false;
        }
        if (migrate_use_xbzrle()) {
            if (iterations_prev != 0) {
                acct_info.xbzrle_cache_miss_rate =
                   (double)(acct_info.xbzrle_cache_miss -
                            xbzrle_cache_miss_prev) /
                   (acct_info.iterations - iterations_prev);
            }
            iterations_prev = acct_info.iterations;
            xbzrle_cache_miss_prev = acct_info.xbzrle_cache_miss;
        }
        s->dirty_pages_rate = num_dirty_pages_period * 1000
            / (end_time - start_time);
        s->dirty_bytes_rate = s->dirty_pages_rate * TARGET_PAGE_SIZE;
        start_time = end_time;
        num_dirty_pages_period = 0;
        s->dirty_sync_count = bitmap_sync_count;
    }
 }
@@ -598,15 +629,9 @@ static int ram_save_block(QEMUFile *f, bool last_stage)
                 */
                xbzrle_cache_zero_page(current_addr);
            } else if (!ram_bulk_stage && migrate_use_xbzrle()) {
-                bytes_sent = save_xbzrle_page(f, p, current_addr, block,
+                bytes_sent = save_xbzrle_page(f, &p, current_addr, block,
                                              offset, cont, last_stage);
                if (!last_stage) {
                    /* We must send exactly what's in the xbzrle cache
                     * even if the page wasn't xbzrle compressed, so that
                     * it's right next time.
                     */
                    p = get_cached_data(XBZRLE.cache, current_addr);
                    /* Can't send this cached data async, since the cache page
                     * might get updated before it gets to the wire
                     */
@@ -726,37 +751,34 @@ static void reset_ram_globals(void)
 static int ram_save_setup(QEMUFile *f, void *opaque)
 {
    RAMBlock *block;
-    int64_t ram_pages = last_ram_offset() >> TARGET_PAGE_BITS;
+    int64_t ram_bitmap_pages; /* Size of bitmap in pages, including gaps */
    migration_bitmap = bitmap_new(ram_pages);
    bitmap_set(migration_bitmap, 0, ram_pages);
    migration_dirty_pages = ram_pages;
    mig_throttle_on = false;
    dirty_rate_high_cnt = 0;
    bitmap_sync_count = 0;
    if (migrate_use_xbzrle()) {
-        qemu_mutex_lock_iothread();
+        XBZRLE_cache_lock();
        XBZRLE.cache = cache_init(migrate_xbzrle_cache_size() /
                                  TARGET_PAGE_SIZE,
                                  TARGET_PAGE_SIZE);
        if (!XBZRLE.cache) {
-            qemu_mutex_unlock_iothread();
+            XBZRLE_cache_unlock();
-            DPRINTF("Error creating cache\n");
+            error_report("Error creating cache");
            return -1;
        }
-        qemu_mutex_init(&XBZRLE.lock);
+        XBZRLE_cache_unlock();
        qemu_mutex_unlock_iothread();
        /* We prefer not to abort if there is no memory */
        XBZRLE.encoded_buf = g_try_malloc0(TARGET_PAGE_SIZE);
        if (!XBZRLE.encoded_buf) {
-            DPRINTF("Error allocating encoded_buf\n");
+            error_report("Error allocating encoded_buf");
            return -1;
        }
        XBZRLE.current_buf = g_try_malloc(TARGET_PAGE_SIZE);
        if (!XBZRLE.current_buf) {
-            DPRINTF("Error allocating current_buf\n");
+            error_report("Error allocating current_buf");
            g_free(XBZRLE.encoded_buf);
            XBZRLE.encoded_buf = NULL;
            return -1;
@@ -770,6 +792,22 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
    bytes_transferred = 0;
    reset_ram_globals();
    ram_bitmap_pages = last_ram_offset() >> TARGET_PAGE_BITS;
    migration_bitmap = bitmap_new(ram_bitmap_pages);
    bitmap_set(migration_bitmap, 0, ram_bitmap_pages);
    /*
     * Count the total number of pages used by ram blocks not including any
     * gaps due to alignment or unplugs.
     */
    migration_dirty_pages = 0;
    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
        uint64_t block_pages;
        block_pages = block->length >> TARGET_PAGE_BITS;
        migration_dirty_pages += block_pages;
    }
    memory_global_dirty_log_start();
    migration_bitmap_sync();
    qemu_mutex_unlock_iothread();
@@ -997,8 +1035,9 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
    seq_iter++;
-    if (version_id < 4 || version_id > 4) {
+    if (version_id != 4) {
-        return -EINVAL;
+        ret = -EINVAL;
        goto done;
    }
    do {
@@ -1008,44 +1047,42 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
        addr &= TARGET_PAGE_MASK;
        if (flags & RAM_SAVE_FLAG_MEM_SIZE) {
-            if (version_id == 4) {
+            /* Synchronize RAM block list */
-                /* Synchronize RAM block list */
+            char id[256];
-                char id[256];
+            ram_addr_t length;
-                ram_addr_t length;
+            ram_addr_t total_ram_bytes = addr;
                ram_addr_t total_ram_bytes = addr;
-                while (total_ram_bytes) {
+            while (total_ram_bytes) {
-                    RAMBlock *block;
+                RAMBlock *block;
-                    uint8_t len;
+                uint8_t len;
-                    len = qemu_get_byte(f);
+                len = qemu_get_byte(f);
-                    qemu_get_buffer(f, (uint8_t *)id, len);
+                qemu_get_buffer(f, (uint8_t *)id, len);
-                    id[len] = 0;
+                id[len] = 0;
-                    length = qemu_get_be64(f);
+                length = qemu_get_be64(f);
-                    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
+                QTAILQ_FOREACH(block, &ram_list.blocks, next) {
-                        if (!strncmp(id, block->idstr, sizeof(id))) {
+                    if (!strncmp(id, block->idstr, sizeof(id))) {
-                            if (block->length != length) {
+                        if (block->length != length) {
-                                fprintf(stderr,
+                            fprintf(stderr,
-                                        "Length mismatch: %s: " RAM_ADDR_FMT
+                                    "Length mismatch: %s: " RAM_ADDR_FMT
-                                        " in != " RAM_ADDR_FMT "\n", id, length,
+                                    " in != " RAM_ADDR_FMT "\n", id, length,
-                                        block->length);
+                                    block->length);
-                                ret =  -EINVAL;
+                            ret =  -EINVAL;
-                                goto done;
+                            goto done;
                            }
                            break;
                        }
                        break;
                    }
                    if (!block) {
                        fprintf(stderr, "Unknown ramblock \"%s\", cannot "
                                "accept migration\n", id);
                        ret = -EINVAL;
                        goto done;
                    }
                    total_ram_bytes -= length;
                }
                if (!block) {
                    fprintf(stderr, "Unknown ramblock \"%s\", cannot "
                            "accept migration\n", id);
                    ret = -EINVAL;
                    goto done;
                }
                total_ram_bytes -= length;
            }
        }
@@ -1055,7 +1092,8 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
            host = host_from_stream_offset(f, addr, flags);
            if (!host) {
-                return -EINVAL;
+                ret = -EINVAL;
                goto done;
            }
            ch = qemu_get_byte(f);
@@ -1065,14 +1103,16 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
            host = host_from_stream_offset(f, addr, flags);
            if (!host) {
-                return -EINVAL;
+                ret = -EINVAL;
                goto done;
            }
            qemu_get_buffer(f, host, TARGET_PAGE_SIZE);
        } else if (flags & RAM_SAVE_FLAG_XBZRLE) {
            void *host = host_from_stream_offset(f, addr, flags);
            if (!host) {
-                return -EINVAL;
+                ret = -EINVAL;
                goto done;
            }
            if (load_xbzrle(f, addr, host) < 0) {
@@ -1095,7 +1135,7 @@ done:
    return ret;
 }
-SaveVMHandlers savevm_ram_handlers = {
+static SaveVMHandlers savevm_ram_handlers = {
    .save_live_setup = ram_save_setup,
    .save_live_iterate = ram_save_iterate,
    .save_live_complete = ram_save_complete,
@@ -1104,6 +1144,12 @@ SaveVMHandlers savevm_ram_handlers = {
    .cancel = ram_migration_cancel,
 };
 void ram_mig_init(void)
 {
    qemu_mutex_init(&XBZRLE.lock);
    register_savevm_live(NULL, "ram", 0, 4, &savevm_ram_handlers, NULL);
 }
 struct soundhw {
    const char *name;
    const char *descr;
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -14,4 +14,4 @@ common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
 common-obj-y += wavcapture.o
 $(obj)/audio.o $(obj)/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
-$(obj)/sdlaudio.o: QEMU_CFLAGS += $(SDL_CFLAGS)
+sdlaudio.o-cflags := $(SDL_CFLAGS)
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -3,6 +3,6 @@ common-obj-$(CONFIG_POSIX) += rng-random.o
 common-obj-y += msmouse.o
 common-obj-$(CONFIG_BRLAPI) += baum.o
-$(obj)/baum.o: QEMU_CFLAGS += $(SDL_CFLAGS) 
+baum.o-cflags := $(SDL_CFLAGS)
 common-obj-$(CONFIG_TPM) += tpm.o
--- a/backends/rng.c
+++ b/backends/rng.c
@@ -50,6 +50,7 @@ static void rng_backend_prop_set_opened(Object *obj, bool value, Error **errp)
 {
    RngBackend *s = RNG_BACKEND(obj);
    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
    Error *local_err = NULL;
    if (value == s->opened) {
        return;
@@ -61,12 +62,14 @@ static void rng_backend_prop_set_opened(Object *obj, bool value, Error **errp)
    }
    if (k->opened) {
-        k->opened(s, errp);
+        k->opened(s, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
    }
-    if (!error_is_set(errp)) {
+    s->opened = true;
        s->opened = value;
    }
 }
 static void rng_backend_init(Object *obj)
--- a/backends/tpm.c
+++ b/backends/tpm.c
@@ -112,6 +112,7 @@ static void tpm_backend_prop_set_opened(Object *obj, bool value, Error **errp)
 {
    TPMBackend *s = TPM_BACKEND(obj);
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    Error *local_err = NULL;
    if (value == s->opened) {
        return;
@@ -123,12 +124,14 @@ static void tpm_backend_prop_set_opened(Object *obj, bool value, Error **errp)
    }
    if (k->opened) {
-        k->opened(s, errp);
+        k->opened(s, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
    }
-    if (!error_is_set(errp)) {
+    s->opened = true;
        s->opened = value;
    }
 }
 static void tpm_backend_instance_init(Object *obj)
--- a/block-migration.c
+++ b/block-migration.c
@@ -310,13 +310,28 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
 /* Called with iothread lock taken.  */
-static void set_dirty_tracking(void)
+static int set_dirty_tracking(void)
 {
    BlkMigDevState *bmds;
    int ret;
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        bmds->dirty_bitmap = bdrv_create_dirty_bitmap(bmds->bs, BLOCK_SIZE);
+        bmds->dirty_bitmap = bdrv_create_dirty_bitmap(bmds->bs, BLOCK_SIZE,
                                                      NULL);
        if (!bmds->dirty_bitmap) {
            ret = -errno;
            goto fail;
        }
    }
    return 0;
 fail:
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        if (bmds->dirty_bitmap) {
            bdrv_release_dirty_bitmap(bmds->bs, bmds->dirty_bitmap);
        }
    }
    return ret;
 }
 static void unset_dirty_tracking(void)
@@ -611,10 +626,17 @@ static int block_save_setup(QEMUFile *f, void *opaque)
            block_mig_state.submitted, block_mig_state.transferred);
    qemu_mutex_lock_iothread();
    init_blk_migration(f);
    /* start track dirty blocks */
-    set_dirty_tracking();
+    ret = set_dirty_tracking();
    if (ret) {
        qemu_mutex_unlock_iothread();
        return ret;
    }
    init_blk_migration(f);
    qemu_mutex_unlock_iothread();
    ret = flush_blks(f);
--- a/block.c
+++ b/block.c
@@ -332,10 +332,21 @@ void bdrv_register(BlockDriver *bdrv)
 }
 /* create a new block device (by default it is empty) */
-BlockDriverState *bdrv_new(const char *device_name)
+BlockDriverState *bdrv_new(const char *device_name, Error **errp)
 {
    BlockDriverState *bs;
    if (bdrv_find(device_name)) {
        error_setg(errp, "Device with id '%s' already exists",
                   device_name);
        return NULL;
    }
    if (bdrv_find_node(device_name)) {
        error_setg(errp, "Device with node-name '%s' already exists",
                   device_name);
        return NULL;
    }
    bs = g_malloc0(sizeof(BlockDriverState));
    QLIST_INIT(&bs->dirty_bitmaps);
    pstrcpy(bs->device_name, sizeof(bs->device_name), device_name);
@@ -763,15 +774,54 @@ void bdrv_disable_copy_on_read(BlockDriverState *bs)
    bs->copy_on_read--;
 }
 /*
 * Returns the flags that a temporary snapshot should get, based on the
 * originally requested flags (the originally requested image will have flags
 * like a backing file)
 */
 static int bdrv_temp_snapshot_flags(int flags)
 {
    return (flags & ~BDRV_O_SNAPSHOT) | BDRV_O_TEMPORARY;
 }
 /*
 * Returns the flags that bs->file should get, based on the given flags for
 * the parent BDS
 */
 static int bdrv_inherited_flags(int flags)
 {
    /* Enable protocol handling, disable format probing for bs->file */
    flags |= BDRV_O_PROTOCOL;
    /* Our block drivers take care to send flushes and respect unmap policy,
     * so we can enable both unconditionally on lower layers. */
    flags |= BDRV_O_CACHE_WB | BDRV_O_UNMAP;
    /* Clear flags that only apply to the top layer */
    flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ);
    return flags;
 }
 /*
 * Returns the flags that bs->backing_hd should get, based on the given flags
 * for the parent BDS
 */
 static int bdrv_backing_flags(int flags)
 {
    /* backing files always opened read-only */
    flags &= ~(BDRV_O_RDWR | BDRV_O_COPY_ON_READ);
    /* snapshot=on is handled on the top layer */
    flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_TEMPORARY);
    return flags;
 }
 static int bdrv_open_flags(BlockDriverState *bs, int flags)
 {
    int open_flags = flags | BDRV_O_CACHE_WB;
    /* The backing file of a temporary snapshot is read-only */
    if (flags & BDRV_O_SNAPSHOT) {
        open_flags &= ~BDRV_O_RDWR;
    }
    /*
     * Clear flags that are internal to the block layer before opening the
     * image.
@@ -781,45 +831,43 @@ static int bdrv_open_flags(BlockDriverState *bs, int flags)
    /*
     * Snapshots should be writable.
     */
-    if (bs->is_temporary) {
+    if (flags & BDRV_O_TEMPORARY) {
        open_flags |= BDRV_O_RDWR;
    }
    return open_flags;
 }
-static int bdrv_assign_node_name(BlockDriverState *bs,
+static void bdrv_assign_node_name(BlockDriverState *bs,
-                                 const char *node_name,
+                                  const char *node_name,
-                                 Error **errp)
+                                  Error **errp)
 {
    if (!node_name) {
-        return 0;
+        return;
    }
    /* empty string node name is invalid */
    if (node_name[0] == '\0') {
        error_setg(errp, "Empty node name");
-        return -EINVAL;
+        return;
    }
    /* takes care of avoiding namespaces collisions */
    if (bdrv_find(node_name)) {
        error_setg(errp, "node-name=%s is conflicting with a device id",
                   node_name);
-        return -EINVAL;
+        return;
    }
    /* takes care of avoiding duplicates node names */
    if (bdrv_find_node(node_name)) {
        error_setg(errp, "Duplicate node name");
-        return -EINVAL;
+        return;
    }
    /* copy node name into the bs and insert it into the graph list */
    pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);
    QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);
    return 0;
 }
 /*
@@ -854,9 +902,10 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
    trace_bdrv_open_common(bs, filename ?: "", flags, drv->format_name);
    node_name = qdict_get_try_str(options, "node-name");
-    ret = bdrv_assign_node_name(bs, node_name, errp);
+    bdrv_assign_node_name(bs, node_name, &local_err);
-    if (ret < 0) {
+    if (local_err) {
-        return ret;
+        error_propagate(errp, local_err);
        return -EINVAL;
    }
    qdict_del(options, "node-name");
@@ -941,13 +990,6 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
    bdrv_refresh_limits(bs);
    assert(bdrv_opt_mem_align(bs) != 0);
    assert((bs->request_alignment != 0) || bs->sg);
 #ifndef _WIN32
    if (bs->is_temporary) {
        assert(bs->filename[0] != '\0');
        unlink(bs->filename);
    }
 #endif
    return 0;
 free_and_fail:
@@ -1058,14 +1100,14 @@ fail:
 */
 int bdrv_open_backing_file(BlockDriverState *bs, QDict *options, Error **errp)
 {
-    char backing_filename[PATH_MAX];
+    char *backing_filename = g_malloc0(PATH_MAX);
-    int back_flags, ret;
+    int ret = 0;
    BlockDriver *back_drv = NULL;
    Error *local_err = NULL;
    if (bs->backing_hd != NULL) {
        QDECREF(options);
-        return 0;
+        goto free_exit;
    }
    /* NULL means an empty set of options */
@@ -1078,31 +1120,26 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *options, Error **errp)
        backing_filename[0] = '\0';
    } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
        QDECREF(options);
-        return 0;
+        goto free_exit;
    } else {
-        bdrv_get_full_backing_filename(bs, backing_filename,
+        bdrv_get_full_backing_filename(bs, backing_filename, PATH_MAX);
                                       sizeof(backing_filename));
    }
    if (bs->backing_format[0] != '\0') {
        back_drv = bdrv_find_format(bs->backing_format);
    }
    /* backing files always opened read-only */
    back_flags = bs->open_flags & ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT |
                                    BDRV_O_COPY_ON_READ);
    assert(bs->backing_hd == NULL);
    ret = bdrv_open(&bs->backing_hd,
                    *backing_filename ? backing_filename : NULL, NULL, options,
-                    back_flags, back_drv, &local_err);
+                    bdrv_backing_flags(bs->open_flags), back_drv, &local_err);
    if (ret < 0) {
        bs->backing_hd = NULL;
        bs->open_flags |= BDRV_O_NO_BACKING;
        error_setg(errp, "Could not open backing file: %s",
                   error_get_pretty(local_err));
        error_free(local_err);
-        return ret;
+        goto free_exit;
    }
    if (bs->backing_hd->file) {
@@ -1113,7 +1150,9 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *options, Error **errp)
    /* Recalculate the BlockLimits with the backing file */
    bdrv_refresh_limits(bs);
-    return 0;
+free_exit:
    g_free(backing_filename);
    return ret;
 }
 /*
@@ -1167,11 +1206,10 @@ done:
    return ret;
 }
-void bdrv_append_temp_snapshot(BlockDriverState *bs, Error **errp)
+void bdrv_append_temp_snapshot(BlockDriverState *bs, int flags, Error **errp)
 {
    /* TODO: extra byte is a hack to ensure MAX_PATH space on Windows. */
-    char tmp_filename[PATH_MAX + 1];
+    char *tmp_filename = g_malloc0(PATH_MAX + 1);
    int64_t total_size;
    BlockDriver *bdrv_qcow2;
    QEMUOptionParameter *create_options;
@@ -1187,15 +1225,15 @@ void bdrv_append_temp_snapshot(BlockDriverState *bs, Error **errp)
    total_size = bdrv_getlength(bs);
    if (total_size < 0) {
        error_setg_errno(errp, -total_size, "Could not get image size");
-        return;
+        goto out;
    }
    total_size &= BDRV_SECTOR_MASK;
    /* Create the temporary image */
-    ret = get_tmp_filename(tmp_filename, sizeof(tmp_filename));
+    ret = get_tmp_filename(tmp_filename, PATH_MAX + 1);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "Could not get temporary filename");
-        return;
+        goto out;
    }
    bdrv_qcow2 = bdrv_find_format("qcow2");
@@ -1211,7 +1249,7 @@ void bdrv_append_temp_snapshot(BlockDriverState *bs, Error **errp)
                         "'%s': %s", tmp_filename,
                         error_get_pretty(local_err));
        error_free(local_err);
-        return;
+        goto out;
    }
    /* Prepare a new options QDict for the temporary file */
@@ -1221,17 +1259,19 @@ void bdrv_append_temp_snapshot(BlockDriverState *bs, Error **errp)
    qdict_put(snapshot_options, "file.filename",
              qstring_from_str(tmp_filename));
-    bs_snapshot = bdrv_new("");
+    bs_snapshot = bdrv_new("", &error_abort);
    bs_snapshot->is_temporary = 1;
    ret = bdrv_open(&bs_snapshot, NULL, NULL, snapshot_options,
-                    bs->open_flags & ~BDRV_O_SNAPSHOT, bdrv_qcow2, &local_err);
+                    flags, bdrv_qcow2, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
-        return;
+        goto out;
    }
    bdrv_append(bs_snapshot, bs);
 out:
    g_free(tmp_filename);
 }
 /*
@@ -1257,6 +1297,7 @@ int bdrv_open(BlockDriverState **pbs, const char *filename,
    BlockDriverState *file = NULL, *bs;
    const char *drvname;
    Error *local_err = NULL;
    int snapshot_flags = 0;
    assert(pbs);
@@ -1288,7 +1329,7 @@ int bdrv_open(BlockDriverState **pbs, const char *filename,
    if (*pbs) {
        bs = *pbs;
    } else {
-        bs = bdrv_new("");
+        bs = bdrv_new("", &error_abort);
    }
    /* NULL means an empty set of options */
@@ -1317,13 +1358,17 @@ int bdrv_open(BlockDriverState **pbs, const char *filename,
    if (flags & BDRV_O_RDWR) {
        flags |= BDRV_O_ALLOW_RDWR;
    }
    if (flags & BDRV_O_SNAPSHOT) {
        snapshot_flags = bdrv_temp_snapshot_flags(flags);
        flags = bdrv_backing_flags(flags);
    }
    assert(file == NULL);
    ret = bdrv_open_image(&file, filename, options, "file",
-                          bdrv_open_flags(bs, flags | BDRV_O_UNMAP) |
+                          bdrv_inherited_flags(flags),
-                          BDRV_O_PROTOCOL, true, &local_err);
+                          true, &local_err);
    if (ret < 0) {
-        goto unlink_and_fail;
+        goto fail;
    }
    /* Find the right image format driver */
@@ -1334,7 +1379,7 @@ int bdrv_open(BlockDriverState **pbs, const char *filename,
        if (!drv) {
            error_setg(errp, "Invalid driver: '%s'", drvname);
            ret = -EINVAL;
-            goto unlink_and_fail;
+            goto fail;
        }
    }
@@ -1344,18 +1389,18 @@ int bdrv_open(BlockDriverState **pbs, const char *filename,
        } else {
            error_setg(errp, "Must specify either driver or file");
            ret = -EINVAL;
-            goto unlink_and_fail;
+            goto fail;
        }
    }
    if (!drv) {
-        goto unlink_and_fail;
+        goto fail;
    }
    /* Open the image */
    ret = bdrv_open_common(bs, file, options, flags, drv, &local_err);
    if (ret < 0) {
-        goto unlink_and_fail;
+        goto fail;
    }
    if (file && (bs->file != file)) {
@@ -1376,8 +1421,8 @@ int bdrv_open(BlockDriverState **pbs, const char *filename,
    /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
     * temporary snapshot afterwards. */
-    if (flags & BDRV_O_SNAPSHOT) {
+    if (snapshot_flags) {
-        bdrv_append_temp_snapshot(bs, &local_err);
+        bdrv_append_temp_snapshot(bs, snapshot_flags, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            goto close_and_fail;
@@ -1417,14 +1462,10 @@ done:
    *pbs = bs;
    return 0;
-unlink_and_fail:
+fail:
    if (file != NULL) {
        bdrv_unref(file);
    }
    if (bs->is_temporary) {
        unlink(filename);
    }
 fail:
    QDECREF(bs->options);
    QDECREF(options);
    bs->options = NULL;
@@ -1488,8 +1529,11 @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
        QSIMPLEQ_INIT(bs_queue);
    }
    /* bdrv_open() masks this flag out */
    flags &= ~BDRV_O_PROTOCOL;
    if (bs->file) {
-        bdrv_reopen_queue(bs_queue, bs->file, flags);
+        bdrv_reopen_queue(bs_queue, bs->file, bdrv_inherited_flags(flags));
    }
    bs_entry = g_new0(BlockReopenQueueEntry, 1);
@@ -1704,11 +1748,6 @@ void bdrv_close(BlockDriverState *bs)
        }
        bs->drv->bdrv_close(bs);
        g_free(bs->opaque);
 #ifdef _WIN32
        if (bs->is_temporary) {
            unlink(bs->filename);
        }
 #endif
        bs->opaque = NULL;
        bs->drv = NULL;
        bs->copy_on_read = 0;
@@ -1832,7 +1871,6 @@ static void bdrv_move_feature_fields(BlockDriverState *bs_dest,
                                     BlockDriverState *bs_src)
 {
    /* move some fields that need to stay attached to the device */
    bs_dest->open_flags         = bs_src->open_flags;
    /* dev info */
    bs_dest->dev_ops            = bs_src->dev_ops;
@@ -2581,6 +2619,10 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
 {
    int64_t len;
    if (size > INT_MAX) {
        return -EIO;
    }
    if (!bdrv_is_inserted(bs))
        return -ENOMEDIUM;
@@ -2601,7 +2643,7 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
 static int bdrv_check_request(BlockDriverState *bs, int64_t sector_num,
                              int nb_sectors)
 {
-    if (nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {
+    if (nb_sectors < 0 || nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {
        return -EIO;
    }
@@ -2686,6 +2728,10 @@ static int bdrv_rw_co(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
        .iov_len = nb_sectors * BDRV_SECTOR_SIZE,
    };
    if (nb_sectors < 0 || nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {
        return -EINVAL;
    }
    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_prwv_co(bs, sector_num << BDRV_SECTOR_BITS,
                        &qiov, is_write, flags);
@@ -2741,10 +2787,16 @@ int bdrv_write_zeroes(BlockDriverState *bs, int64_t sector_num,
 */
 int bdrv_make_zero(BlockDriverState *bs, BdrvRequestFlags flags)
 {
-    int64_t target_size = bdrv_getlength(bs) / BDRV_SECTOR_SIZE;
+    int64_t target_size;
    int64_t ret, nb_sectors, sector_num = 0;
    int n;
    target_size = bdrv_getlength(bs);
    if (target_size < 0) {
        return target_size;
    }
    target_size /= BDRV_SECTOR_SIZE;
    for (;;) {
        nb_sectors = target_size - sector_num;
        if (nb_sectors <= 0) {
@@ -3574,10 +3626,25 @@ void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
                         void *opaque)
 {
    BlockDriver *drv;
    int count = 0;
    const char **formats = NULL;
    QLIST_FOREACH(drv, &bdrv_drivers, list) {
-        it(opaque, drv->format_name);
+        if (drv->format_name) {
            bool found = false;
            int i = count;
            while (formats && i && !found) {
                found = !strcmp(formats[--i], drv->format_name);
            }
            if (!found) {
                formats = g_realloc(formats, (count + 1) * sizeof(char *));
                formats[count++] = drv->format_name;
                it(opaque, drv->format_name);
            }
        }
    }
    g_free(formats);
 }
 /* This function is to find block backend bs */
@@ -5096,7 +5163,8 @@ bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
    return true;
 }
-BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs, int granularity)
+BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs, int granularity,
                                          Error **errp)
 {
    int64_t bitmap_size;
    BdrvDirtyBitmap *bitmap;
@@ -5105,7 +5173,13 @@ BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs, int granularity)
    granularity >>= BDRV_SECTOR_BITS;
    assert(granularity);
-    bitmap_size = (bdrv_getlength(bs) >> BDRV_SECTOR_BITS);
+    bitmap_size = bdrv_getlength(bs);
    if (bitmap_size < 0) {
        error_setg_errno(errp, -bitmap_size, "could not get length of device");
        errno = -bitmap_size;
        return NULL;
    }
    bitmap_size >>= BDRV_SECTOR_BITS;
    bitmap = g_malloc0(sizeof(BdrvDirtyBitmap));
    bitmap->bitmap = hbitmap_alloc(bitmap_size, ffs(granularity) - 1);
    QLIST_INSERT_HEAD(&bs->dirty_bitmaps, bitmap, list);
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -187,13 +187,14 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
    uint64_t offset = sector_num * 512;
    uint64_t extent_index, extent_offset, bitmap_offset;
    char bitmap_entry;
    int ret;
    // seek to sector
    extent_index = offset / s->extent_size;
    extent_offset = (offset % s->extent_size) / 512;
    if (s->catalog_bitmap[extent_index] == 0xffffffff) {
-	return -1; /* not allocated */
+	return 0; /* not allocated */
    }
    bitmap_offset = s->data_offset +
@@ -201,13 +202,14 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
        (s->extent_blocks + s->bitmap_blocks));
    /* read in bitmap for current extent */
-    if (bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
+    ret = bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
-                   &bitmap_entry, 1) != 1) {
+                     &bitmap_entry, 1);
-        return -1;
+    if (ret < 0) {
        return ret;
    }
    if (!((bitmap_entry >> (extent_offset % 8)) & 1)) {
-	return -1; /* not allocated */
+	return 0; /* not allocated */
    }
    return bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
@@ -220,13 +222,16 @@ static int bochs_read(BlockDriverState *bs, int64_t sector_num,
    while (nb_sectors > 0) {
        int64_t block_offset = seek_to_sector(bs, sector_num);
-        if (block_offset >= 0) {
+        if (block_offset < 0) {
            return block_offset;
        } else if (block_offset > 0) {
            ret = bdrv_pread(bs->file, block_offset, buf, 512);
-            if (ret != 512) {
+            if (ret < 0) {
-                return -1;
+                return ret;
            }
-        } else
+        } else {
            memset(buf, 0, 512);
        }
        nb_sectors--;
        sector_num++;
        buf += 512;
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -72,7 +72,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
    }
    s->block_size = be32_to_cpu(s->block_size);
    if (s->block_size % 512) {
-        error_setg(errp, "block_size %u must be a multiple of 512",
+        error_setg(errp, "block_size %" PRIu32 " must be a multiple of 512",
                   s->block_size);
        return -EINVAL;
    }
@@ -86,7 +86,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
     * need a buffer this big.
     */
    if (s->block_size > MAX_BLOCK_SIZE) {
-        error_setg(errp, "block_size %u must be %u MB or less",
+        error_setg(errp, "block_size %" PRIu32 " must be %u MB or less",
                   s->block_size,
                   MAX_BLOCK_SIZE / (1024 * 1024));
        return -EINVAL;
@@ -101,7 +101,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
    /* read offsets */
    if (s->n_blocks > (UINT32_MAX - 1) / sizeof(uint64_t)) {
        /* Prevent integer overflow */
-        error_setg(errp, "n_blocks %u must be %zu or less",
+        error_setg(errp, "n_blocks %" PRIu32 " must be %zu or less",
                   s->n_blocks,
                   (UINT32_MAX - 1) / sizeof(uint64_t));
        return -EINVAL;
@@ -133,7 +133,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
        if (s->offsets[i] < s->offsets[i - 1]) {
            error_setg(errp, "offsets not monotonically increasing at "
-                       "index %u, image file is corrupt", i);
+                       "index %" PRIu32 ", image file is corrupt", i);
            ret = -EINVAL;
            goto fail;
        }
@@ -146,8 +146,8 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
         * ridiculous s->compressed_block allocation.
         */
        if (size > 2 * MAX_BLOCK_SIZE) {
-            error_setg(errp, "invalid compressed block size at index %u, "
+            error_setg(errp, "invalid compressed block size at index %" PRIu32
-                       "image file is corrupt", i);
+                       ", image file is corrupt", i);
            ret = -EINVAL;
            goto fail;
        }
--- a/block/commit.c
+++ b/block/commit.c
@@ -194,7 +194,7 @@ void commit_start(BlockDriverState *bs, BlockDriverState *base,
    if ((on_error == BLOCKDEV_ON_ERROR_STOP ||
         on_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
        !bdrv_iostatus_is_enabled(bs)) {
-        error_set(errp, QERR_INVALID_PARAMETER_COMBINATION);
+        error_setg(errp, "Invalid parameter combination");
        return;
    }
--- a/block/cow.c
+++ b/block/cow.c
@@ -82,7 +82,7 @@ static int cow_open(BlockDriverState *bs, QDict *options, int flags,
    if (be32_to_cpu(cow_header.version) != COW_VERSION) {
        char version[64];
        snprintf(version, sizeof(version),
-               "COW version %d", cow_header.version);
+               "COW version %" PRIu32, cow_header.version);
        error_set(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
            bs->device_name, "cow", version);
        ret = -ENOTSUP;
--- a/block/curl.c
+++ b/block/curl.c
@@ -71,6 +71,7 @@ typedef struct CURLState
    struct BDRVCURLState *s;
    CURLAIOCB *acb[CURL_NUM_ACB];
    CURL *curl;
    curl_socket_t sock_fd;
    char *orig_buf;
    size_t buf_start;
    size_t buf_off;
@@ -92,6 +93,7 @@ typedef struct BDRVCURLState {
 static void curl_clean_state(CURLState *s);
 static void curl_multi_do(void *arg);
 static void curl_multi_read(void *arg);
 #ifdef NEED_CURL_TIMER_CALLBACK
 static int curl_timer_cb(CURLM *multi, long timeout_ms, void *opaque)
@@ -113,16 +115,20 @@ static int curl_timer_cb(CURLM *multi, long timeout_ms, void *opaque)
 static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
                        void *s, void *sp)
 {
    CURLState *state = NULL;
    curl_easy_getinfo(curl, CURLINFO_PRIVATE, (char **)&state);
    state->sock_fd = fd;
    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, fd);
    switch (action) {
        case CURL_POLL_IN:
-            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, s);
+            qemu_aio_set_fd_handler(fd, curl_multi_read, NULL, state);
            break;
        case CURL_POLL_OUT:
-            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, s);
+            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, state);
            break;
        case CURL_POLL_INOUT:
-            qemu_aio_set_fd_handler(fd, curl_multi_do, curl_multi_do, s);
+            qemu_aio_set_fd_handler(fd, curl_multi_read, curl_multi_do, state);
            break;
        case CURL_POLL_REMOVE:
            qemu_aio_set_fd_handler(fd, NULL, NULL, NULL);
@@ -155,7 +161,7 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
    DPRINTF("CURL: Just reading %zd bytes\n", realsize);
    if (!s || !s->orig_buf)
-        goto read_end;
+        return 0;
    if (s->buf_off >= s->buf_len) {
        /* buffer full, read nothing */
@@ -180,7 +186,6 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
        }
    }
 read_end:
    return realsize;
 }
@@ -215,7 +220,8 @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
        }
        // Wait for unfinished chunks
-        if ((start >= state->buf_start) &&
+        if (state->in_use &&
            (start >= state->buf_start) &&
            (start <= buf_fend) &&
            (end >= state->buf_start) &&
            (end <= buf_fend))
@@ -237,68 +243,69 @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
    return FIND_RET_NONE;
 }
-static void curl_multi_read(BDRVCURLState *s)
+static void curl_multi_check_completion(BDRVCURLState *s)
 {
    int msgs_in_queue;
    /* Try to find done transfers, so we can free the easy
     * handle again. */
-    do {
+    for (;;) {
        CURLMsg *msg;
        msg = curl_multi_info_read(s->multi, &msgs_in_queue);
        /* Quit when there are no more completions */
        if (!msg)
            break;
        if (msg->msg == CURLMSG_NONE)
            break;
-        switch (msg->msg) {
+        if (msg->msg == CURLMSG_DONE) {
-            case CURLMSG_DONE:
+            CURLState *state = NULL;
-            {
+            curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE,
-                CURLState *state = NULL;
+                              (char **)&state);
                curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE, (char**)&state);
-                /* ACBs for successful messages get completed in curl_read_cb */
+            /* ACBs for successful messages get completed in curl_read_cb */
-                if (msg->data.result != CURLE_OK) {
+            if (msg->data.result != CURLE_OK) {
-                    int i;
+                int i;
-                    for (i = 0; i < CURL_NUM_ACB; i++) {
+                for (i = 0; i < CURL_NUM_ACB; i++) {
-                        CURLAIOCB *acb = state->acb[i];
+                    CURLAIOCB *acb = state->acb[i];
-                        if (acb == NULL) {
+                    if (acb == NULL) {
-                            continue;
+                        continue;
                        }
                        acb->common.cb(acb->common.opaque, -EIO);
                        qemu_aio_release(acb);
                        state->acb[i] = NULL;
                    }
                }
-                curl_clean_state(state);
+                    acb->common.cb(acb->common.opaque, -EIO);
-                break;
+                    qemu_aio_release(acb);
                    state->acb[i] = NULL;
                }
            }
-            default:
+
-                msgs_in_queue = 0;
+            curl_clean_state(state);
-                break;
+            break;
        }
-    } while(msgs_in_queue);
+    }
 }
 static void curl_multi_do(void *arg)
 {
-    BDRVCURLState *s = (BDRVCURLState *)arg;
+    CURLState *s = (CURLState *)arg;
    int running;
    int r;
-    if (!s->multi) {
+    if (!s->s->multi) {
        return;
    }
    do {
-        r = curl_multi_socket_all(s->multi, &running);
+        r = curl_multi_socket_action(s->s->multi, s->sock_fd, 0, &running);
    } while(r == CURLM_CALL_MULTI_PERFORM);
-    curl_multi_read(s);
+}
 static void curl_multi_read(void *arg)
 {
    CURLState *s = (CURLState *)arg;
    curl_multi_do(arg);
    curl_multi_check_completion(s->s);
 }
 static void curl_multi_timeout_do(void *arg)
@@ -313,7 +320,7 @@ static void curl_multi_timeout_do(void *arg)
    curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
-    curl_multi_read(s);
+    curl_multi_check_completion(s);
 #else
    abort();
 #endif
@@ -337,44 +344,42 @@ static CURLState *curl_init_state(BDRVCURLState *s)
            break;
        }
        if (!state) {
-            g_usleep(100);
+            qemu_aio_wait();
            curl_multi_do(s);
        }
    } while(!state);
-    if (state->curl)
+    if (!state->curl) {
-        goto has_curl;
+        state->curl = curl_easy_init();
        if (!state->curl) {
            return NULL;
        }
        curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
        curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, 5);
        curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION,
                         (void *)curl_read_cb);
        curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state);
        curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state);
        curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1);
        curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
        curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
        curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
        curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
-    state->curl = curl_easy_init();
+        /* Restrict supported protocols to avoid security issues in the more
-    if (!state->curl)
+         * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
-        return NULL;
+         * CVE-2013-0249.
-    curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
+         *
-    curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, 5);
+         * Restricting protocols is only supported from 7.19.4 upwards.
-    curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION, (void *)curl_read_cb);
+         */
    curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state);
    curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state);
    curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1);
    curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
    curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
    curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
    curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
    /* Restrict supported protocols to avoid security issues in the more
     * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
     * CVE-2013-0249.
     *
     * Restricting protocols is only supported from 7.19.4 upwards.
     */
 #if LIBCURL_VERSION_NUM >= 0x071304
-    curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
+        curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
-    curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
+        curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
 #endif
 #ifdef DEBUG_VERBOSE
-    curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
+        curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif
-
+    }
 has_curl:
    state->s = s;
@@ -531,19 +536,17 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    // initialize the multi interface!
    s->multi = curl_multi_init();
    curl_multi_setopt(s->multi, CURLMOPT_SOCKETDATA, s);
    curl_multi_setopt(s->multi, CURLMOPT_SOCKETFUNCTION, curl_sock_cb);
 #ifdef NEED_CURL_TIMER_CALLBACK
    curl_multi_setopt(s->multi, CURLMOPT_TIMERDATA, s);
    curl_multi_setopt(s->multi, CURLMOPT_TIMERFUNCTION, curl_timer_cb);
 #endif
    curl_multi_do(s);
    qemu_opts_del(opts);
    return 0;
 out:
-    fprintf(stderr, "CURL: Error opening file: %s\n", state->errmsg);
+    error_setg(errp, "CURL: Error opening file: %s", state->errmsg);
    curl_easy_cleanup(state->curl);
    state->curl = NULL;
 out_noclean:
@@ -566,6 +569,7 @@ static const AIOCBInfo curl_aiocb_info = {
 static void curl_readv_bh_cb(void *p)
 {
    CURLState *state;
    int running;
    CURLAIOCB *acb = p;
    BDRVCURLState *s = acb->common.bs->opaque;
@@ -614,8 +618,9 @@ static void curl_readv_bh_cb(void *p)
    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);
    curl_multi_add_handle(s->multi, state->curl);
    curl_multi_do(s);
    /* Tell curl it needs to kick things off */
    curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
 }
 static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -248,8 +248,8 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
                offset += 8;
                if (s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
-                    error_report("sector count %" PRIu64 " for chunk %u is "
+                    error_report("sector count %" PRIu64 " for chunk %" PRIu32
-                                 "larger than max (%u)",
+                                 " is larger than max (%u)",
                                 s->sectorcounts[i], i, DMG_SECTORCOUNTS_MAX);
                    ret = -EINVAL;
                    goto fail;
@@ -269,8 +269,8 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
                offset += 8;
                if (s->lengths[i] > DMG_LENGTHS_MAX) {
-                    error_report("length %" PRIu64 " for chunk %u is larger "
+                    error_report("length %" PRIu64 " for chunk %" PRIu32
-                                 "than max (%u)",
+                                 " is larger than max (%u)",
                                 s->lengths[i], i, DMG_LENGTHS_MAX);
                    ret = -EINVAL;
                    goto fail;
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -207,6 +207,11 @@ static struct glfs *qemu_gluster_init(GlusterConf *gconf, const char *filename,
                         "volume=%s image=%s transport=%s", gconf->server,
                         gconf->port, gconf->volname, gconf->image,
                         gconf->transport);
        /* glfs_init sometimes doesn't set errno although docs suggest that */
        if (errno == 0)
            errno = EINVAL;
        goto out;
    }
    return glfs;
@@ -482,7 +487,7 @@ static int qemu_gluster_create(const char *filename,
    glfs = qemu_gluster_init(gconf, filename, errp);
    if (!glfs) {
-        ret = -EINVAL;
+        ret = -errno;
        goto out;
    }
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -2,7 +2,7 @@
 * QEMU Block driver for iSCSI images
 *
 * Copyright (c) 2010-2011 Ronnie Sahlberg <ronniesahlberg@gmail.com>
- * Copyright (c) 2012-2013 Peter Lieven <pl@kamp.de>
+ * Copyright (c) 2012-2014 Peter Lieven <pl@kamp.de>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -1095,16 +1095,15 @@ static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
    *inq = scsi_datain_unmarshall(task);
    if (*inq == NULL) {
        error_setg(errp, "iSCSI: failed to unmarshall inquiry datain blob");
-        goto fail;
+        goto fail_with_err;
    }
    return task;
 fail:
-    if (!error_is_set(errp)) {
+    error_setg(errp, "iSCSI: Inquiry command failed : %s",
-        error_setg(errp, "iSCSI: Inquiry command failed : %s",
+               iscsi_get_error(iscsi));
-                   iscsi_get_error(iscsi));
+fail_with_err:
    }
    if (task != NULL) {
        scsi_free_scsi_task(task);
    }
@@ -1401,7 +1400,7 @@ static int iscsi_create(const char *filename, QEMUOptionParameter *options,
    IscsiLun *iscsilun = NULL;
    QDict *bs_options;
-    bs = bdrv_new("");
+    bs = bdrv_new("", &error_abort);
    /* Read out options */
    while (options && options->name) {
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -325,11 +325,11 @@ static void coroutine_fn mirror_run(void *opaque)
    s->common.len = bdrv_getlength(bs);
    if (s->common.len <= 0) {
-        block_job_completed(&s->common, s->common.len);
+        ret = s->common.len;
-        return;
+        goto immediate_exit;
    }
-    length = (bdrv_getlength(bs) + s->granularity - 1) / s->granularity;
+    length = DIV_ROUND_UP(s->common.len, s->granularity);
    s->in_flight_bitmap = bitmap_new(length);
    /* If we have no backing file yet in the destination, we cannot let
@@ -339,7 +339,10 @@ static void coroutine_fn mirror_run(void *opaque)
    bdrv_get_backing_filename(s->target, backing_filename,
                              sizeof(backing_filename));
    if (backing_filename[0] && !s->target->backing_hd) {
-        bdrv_get_info(s->target, &bdi);
+        ret = bdrv_get_info(s->target, &bdi);
        if (ret < 0) {
            goto immediate_exit;
        }
        if (s->granularity < bdi.cluster_size) {
            s->buf_size = MAX(s->buf_size, bdi.cluster_size);
            s->cow_bitmap = bitmap_new(length);
@@ -605,7 +608,10 @@ static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target,
    s->granularity = granularity;
    s->buf_size = MAX(buf_size, granularity);
-    s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity);
+    s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity, errp);
    if (!s->dirty_bitmap) {
        return;
    }
    bdrv_set_enable_write_cache(s->target, true);
    bdrv_set_on_error(s->target, on_target_error, on_target_error);
    bdrv_iostatus_enable(s->target);
@@ -677,7 +683,7 @@ void commit_active_start(BlockDriverState *bs, BlockDriverState *base,
    mirror_start_job(bs, base, speed, 0, 0,
                     on_error, on_error, cb, opaque, &local_err,
                     &commit_active_job_driver, false, base);
-    if (error_is_set(&local_err)) {
+    if (local_err) {
        error_propagate(errp, local_err);
        goto error_restore_flags;
    }
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -175,7 +175,7 @@ static void nbd_parse_filename(const char *filename, QDict *options,
        InetSocketAddress *addr = NULL;
        addr = inet_parse(host_spec, errp);
-        if (error_is_set(errp)) {
+        if (!addr) {
            goto out;
        }
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -256,6 +256,10 @@ static int64_t nfs_client_open(NFSClient *client, const char *filename,
        error_setg(errp, "Invalid URL specified");
        goto fail;
    }
    if (!uri->server) {
        error_setg(errp, "Invalid URL specified");
        goto fail;
    }
    strp = strrchr(uri->path, '/');
    if (strp == NULL) {
        error_setg(errp, "Invalid URL specified");
@@ -343,7 +347,7 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
+    if (local_err) {
        error_propagate(errp, local_err);
        return -EINVAL;
    }
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -532,12 +532,11 @@ static void dump_qdict(fprintf_function func_fprintf, void *f, int indentation,
 void bdrv_image_info_specific_dump(fprintf_function func_fprintf, void *f,
                                   ImageInfoSpecific *info_spec)
 {
    Error *local_err = NULL;
    QmpOutputVisitor *ov = qmp_output_visitor_new();
    QObject *obj, *data;
    visit_type_ImageInfoSpecific(qmp_output_get_visitor(ov), &info_spec, NULL,
-                                 &local_err);
+                                 &error_abort);
    obj = qmp_output_get_qobject(ov);
    assert(qobject_type(obj) == QTYPE_QDICT);
    data = qdict_get(qobject_to_qdict(obj), "data");
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -119,7 +119,8 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
    }
    if (header.version != QCOW_VERSION) {
        char version[64];
-        snprintf(version, sizeof(version), "QCOW version %d", header.version);
+        snprintf(version, sizeof(version), "QCOW version %" PRIu32,
                 header.version);
        error_set(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
                  bs->device_name, "qcow", version);
        ret = -ENOTSUP;
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -42,6 +42,13 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
    if (min_size <= s->l1_size)
        return 0;
    /* Do a sanity check on min_size before trying to calculate new_l1_size
     * (this prevents overflows during the while loop for the calculation of
     * new_l1_size) */
    if (min_size > INT_MAX / sizeof(uint64_t)) {
        return -EFBIG;
    }
    if (exact_size) {
        new_l1_size = min_size;
    } else {
@@ -1360,9 +1367,9 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
    for (i = 0; i < nb_clusters; i++) {
-        uint64_t old_offset;
+        uint64_t old_l2_entry;
-        old_offset = be64_to_cpu(l2_table[l2_index + i]);
+        old_l2_entry = be64_to_cpu(l2_table[l2_index + i]);
        /*
         * Make sure that a discarded area reads back as zeroes for v3 images
@@ -1373,12 +1380,22 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
         * TODO We might want to use bdrv_get_block_status(bs) here, but we're
         * holding s->lock, so that doesn't work today.
         */
-        if (old_offset & QCOW_OFLAG_ZERO) {
+        switch (qcow2_get_cluster_type(old_l2_entry)) {
-            continue;
+            case QCOW2_CLUSTER_UNALLOCATED:
-        }
+                if (!bs->backing_hd) {
                    continue;
                }
                break;
-        if ((old_offset & L2E_OFFSET_MASK) == 0 && !bs->backing_hd) {
+            case QCOW2_CLUSTER_ZERO:
-            continue;
+                continue;
            case QCOW2_CLUSTER_NORMAL:
            case QCOW2_CLUSTER_COMPRESSED:
                break;
            default:
                abort();
        }
        /* First remove L2 entries */
@@ -1390,7 +1407,7 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
        }
        /* Then decrease the refcount */
-        qcow2_free_any_clusters(bs, old_offset, 1, type);
+        qcow2_free_any_clusters(bs, old_l2_entry, 1, type);
    }
    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -653,6 +653,15 @@ retry:
            goto retry;
        }
    }
    /* Make sure that all offsets in the "allocated" range are representable
     * in an int64_t */
    if (s->free_cluster_index > 0 &&
        s->free_cluster_index - 1 > (INT64_MAX >> s->cluster_bits))
    {
        return -EFBIG;
    }
 #ifdef DEBUG_ALLOC2
    fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
            size,
@@ -1480,6 +1489,11 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
    int ret;
    size = bdrv_getlength(bs->file);
    if (size < 0) {
        res->check_errors++;
        return size;
    }
    nb_clusters = size_to_clusters(s, size);
    if (nb_clusters > INT_MAX) {
        res->check_errors++;
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -124,8 +124,9 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
        case QCOW2_EXT_MAGIC_BACKING_FORMAT:
            if (ext.len >= sizeof(bs->backing_format)) {
-                error_setg(errp, "ERROR: ext_backing_format: len=%u too large"
+                error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
-                           " (>=%zu)", ext.len, sizeof(bs->backing_format));
+                           " too large (>=%zu)", ext.len,
                           sizeof(bs->backing_format));
                return 2;
            }
            ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
@@ -483,7 +484,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }
    if (header.version < 2 || header.version > 3) {
-        report_unsupported(bs, errp, "QCOW version %d", header.version);
+        report_unsupported(bs, errp, "QCOW version %" PRIu32, header.version);
        ret = -ENOTSUP;
        goto fail;
    }
@@ -493,7 +494,8 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
    /* Initialise cluster size */
    if (header.cluster_bits < MIN_CLUSTER_BITS ||
        header.cluster_bits > MAX_CLUSTER_BITS) {
-        error_setg(errp, "Unsupported cluster size: 2^%i", header.cluster_bits);
+        error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
                   header.cluster_bits);
        ret = -EINVAL;
        goto fail;
    }
@@ -591,7 +593,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
    s->refcount_order = header.refcount_order;
    if (header.crypt_method > QCOW_CRYPT_AES) {
-        error_setg(errp, "Unsupported encryption method: %i",
+        error_setg(errp, "Unsupported encryption method: %" PRIu32,
                   header.crypt_method);
        ret = -EINVAL;
        goto fail;
--- a/block/qed.c
+++ b/block/qed.c
@@ -650,19 +650,21 @@ static int bdrv_qed_create(const char *filename, QEMUOptionParameter *options,
    }
    if (!qed_is_cluster_size_valid(cluster_size)) {
-        fprintf(stderr, "QED cluster size must be within range [%u, %u] and power of 2\n",
+        error_setg(errp, "QED cluster size must be within range [%u, %u] "
-                QED_MIN_CLUSTER_SIZE, QED_MAX_CLUSTER_SIZE);
+                         "and power of 2",
                   QED_MIN_CLUSTER_SIZE, QED_MAX_CLUSTER_SIZE);
        return -EINVAL;
    }
    if (!qed_is_table_size_valid(table_size)) {
-        fprintf(stderr, "QED table size must be within range [%u, %u] and power of 2\n",
+        error_setg(errp, "QED table size must be within range [%u, %u] "
-                QED_MIN_TABLE_SIZE, QED_MAX_TABLE_SIZE);
+                         "and power of 2",
                   QED_MIN_TABLE_SIZE, QED_MAX_TABLE_SIZE);
        return -EINVAL;
    }
    if (!qed_is_image_size_valid(image_size, cluster_size, table_size)) {
-        fprintf(stderr, "QED image size must be a non-zero multiple of "
+        error_setg(errp, "QED image size must be a non-zero multiple of "
-                        "cluster size and less than %" PRIu64 " bytes\n",
+                         "cluster size and less than %" PRIu64 " bytes",
-                qed_max_image_size(cluster_size, table_size));
+                   qed_max_image_size(cluster_size, table_size));
        return -EINVAL;
    }
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -753,7 +753,7 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
    opts = qemu_opts_create(&quorum_runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
+    if (local_err) {
        ret = -EINVAL;
        goto exit;
    }
@@ -828,7 +828,7 @@ close_exit:
    g_free(opened);
 exit:
    /* propagate error */
-    if (error_is_set(&local_err)) {
+    if (local_err) {
        error_propagate(errp, local_err);
    }
    QDECREF(list);
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -146,6 +146,9 @@ typedef struct BDRVRawState {
    bool has_discard:1;
    bool has_write_zeroes:1;
    bool discard_zeroes:1;
 #ifdef CONFIG_FIEMAP
    bool skip_fiemap;
 #endif
 } BDRVRawState;
 typedef struct BDRVRawReopenState {
@@ -366,7 +369,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    BDRVRawState *s = bs->opaque;
    QemuOpts *opts;
    Error *local_err = NULL;
-    const char *filename;
+    const char *filename = NULL;
    int fd, ret;
    struct stat st;
@@ -446,6 +449,9 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    ret = 0;
 fail:
    if (filename && (bdrv_flags & BDRV_O_TEMPORARY)) {
        unlink(filename);
    }
    qemu_opts_del(opts);
    return ret;
 }
@@ -1269,6 +1275,83 @@ static int raw_create(const char *filename, QEMUOptionParameter *options,
    return result;
 }
 static int64_t try_fiemap(BlockDriverState *bs, off_t start, off_t *data,
                          off_t *hole, int nb_sectors, int *pnum)
 {
 #ifdef CONFIG_FIEMAP
    BDRVRawState *s = bs->opaque;
    int64_t ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
    struct {
        struct fiemap fm;
        struct fiemap_extent fe;
    } f;
    if (s->skip_fiemap) {
        return -ENOTSUP;
    }
    f.fm.fm_start = start;
    f.fm.fm_length = (int64_t)nb_sectors * BDRV_SECTOR_SIZE;
    f.fm.fm_flags = 0;
    f.fm.fm_extent_count = 1;
    f.fm.fm_reserved = 0;
    if (ioctl(s->fd, FS_IOC_FIEMAP, &f) == -1) {
        s->skip_fiemap = true;
        return -errno;
    }
    if (f.fm.fm_mapped_extents == 0) {
        /* No extents found, data is beyond f.fm.fm_start + f.fm.fm_length.
         * f.fm.fm_start + f.fm.fm_length must be clamped to the file size!
         */
        off_t length = lseek(s->fd, 0, SEEK_END);
        *hole = f.fm.fm_start;
        *data = MIN(f.fm.fm_start + f.fm.fm_length, length);
    } else {
        *data = f.fe.fe_logical;
        *hole = f.fe.fe_logical + f.fe.fe_length;
        if (f.fe.fe_flags & FIEMAP_EXTENT_UNWRITTEN) {
            ret |= BDRV_BLOCK_ZERO;
        }
    }
    return ret;
 #else
    return -ENOTSUP;
 #endif
 }
 static int64_t try_seek_hole(BlockDriverState *bs, off_t start, off_t *data,
                             off_t *hole, int *pnum)
 {
 #if defined SEEK_HOLE && defined SEEK_DATA
    BDRVRawState *s = bs->opaque;
    *hole = lseek(s->fd, start, SEEK_HOLE);
    if (*hole == -1) {
        /* -ENXIO indicates that sector_num was past the end of the file.
         * There is a virtual hole there.  */
        assert(errno != -ENXIO);
        return -errno;
    }
    if (*hole > start) {
        *data = start;
    } else {
        /* On a hole.  We need another syscall to find its end.  */
        *data = lseek(s->fd, start, SEEK_DATA);
        if (*data == -1) {
            *data = lseek(s->fd, 0, SEEK_END);
        }
    }
    return BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
 #else
    return -ENOTSUP;
 #endif
 }
 /*
 * Returns true iff the specified sector is present in the disk image. Drivers
 * not implementing the functionality are assumed to not support backing files,
@@ -1285,10 +1368,10 @@ static int raw_create(const char *filename, QEMUOptionParameter *options,
 * beyond the end of the disk image it will be clamped.
 */
 static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,
-                                            int64_t sector_num,
+                                                    int64_t sector_num,
-                                            int nb_sectors, int *pnum)
+                                                    int nb_sectors, int *pnum)
 {
-    off_t start, data, hole;
+    off_t start, data = 0, hole = 0;
    int64_t ret;
    ret = fd_open(bs);
@@ -1297,71 +1380,18 @@ static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,
    }
    start = sector_num * BDRV_SECTOR_SIZE;
    ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
-#ifdef CONFIG_FIEMAP
+    ret = try_fiemap(bs, start, &data, &hole, nb_sectors, pnum);
-
+    if (ret < 0) {
-    BDRVRawState *s = bs->opaque;
+        ret = try_seek_hole(bs, start, &data, &hole, pnum);
-    struct {
+        if (ret < 0) {
-        struct fiemap fm;
+            /* Assume everything is allocated. */
-        struct fiemap_extent fe;
+            data = 0;
-    } f;
+            hole = start + nb_sectors * BDRV_SECTOR_SIZE;
-
+            ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
    f.fm.fm_start = start;
    f.fm.fm_length = (int64_t)nb_sectors * BDRV_SECTOR_SIZE;
    f.fm.fm_flags = 0;
    f.fm.fm_extent_count = 1;
    f.fm.fm_reserved = 0;
    if (ioctl(s->fd, FS_IOC_FIEMAP, &f) == -1) {
        /* Assume everything is allocated.  */
        *pnum = nb_sectors;
        return ret;
    }
    if (f.fm.fm_mapped_extents == 0) {
        /* No extents found, data is beyond f.fm.fm_start + f.fm.fm_length.
         * f.fm.fm_start + f.fm.fm_length must be clamped to the file size!
         */
        off_t length = lseek(s->fd, 0, SEEK_END);
        hole = f.fm.fm_start;
        data = MIN(f.fm.fm_start + f.fm.fm_length, length);
    } else {
        data = f.fe.fe_logical;
        hole = f.fe.fe_logical + f.fe.fe_length;
        if (f.fe.fe_flags & FIEMAP_EXTENT_UNWRITTEN) {
            ret |= BDRV_BLOCK_ZERO;
        }
    }
 #elif defined SEEK_HOLE && defined SEEK_DATA
    BDRVRawState *s = bs->opaque;
    hole = lseek(s->fd, start, SEEK_HOLE);
    if (hole == -1) {
        /* -ENXIO indicates that sector_num was past the end of the file.
         * There is a virtual hole there.  */
        assert(errno != -ENXIO);
        /* Most likely EINVAL.  Assume everything is allocated.  */
        *pnum = nb_sectors;
        return ret;
    }
    if (hole > start) {
        data = start;
    } else {
        /* On a hole.  We need another syscall to find its end.  */
        data = lseek(s->fd, start, SEEK_DATA);
        if (data == -1) {
            data = lseek(s->fd, 0, SEEK_END);
        }
    }
 #else
    data = 0;
    hole = start + nb_sectors * BDRV_SECTOR_SIZE;
 #endif
    if (data <= start) {
        /* On a data extent, compute sectors to the end of the extent.  */
        *pnum = MIN(nb_sectors, (hole - start) / BDRV_SECTOR_SIZE);
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -390,6 +390,9 @@ static void raw_close(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
    CloseHandle(s->hfile);
    if (bs->open_flags & BDRV_O_TEMPORARY) {
        unlink(bs->filename);
    }
 }
 static int raw_truncate(BlockDriverState *bs, int64_t offset)
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -1099,7 +1099,7 @@ static int find_vdi_name(BDRVSheepdogState *s, const char *filename,
    }
    if (rsp->result != SD_RES_SUCCESS) {
-        error_report("cannot get vdi info, %s, %s %d %s",
+        error_report("cannot get vdi info, %s, %s %" PRIu32 " %s",
                     sd_strerror(rsp->result), filename, snapid, tag);
        if (rsp->result == SD_RES_NO_VDI) {
            ret = -ENOENT;
@@ -2316,8 +2316,8 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
            sn_tab[found].vm_state_size = inode.vm_state_size;
            sn_tab[found].vm_clock_nsec = inode.vm_clock_nsec;
-            snprintf(sn_tab[found].id_str, sizeof(sn_tab[found].id_str), "%u",
+            snprintf(sn_tab[found].id_str, sizeof(sn_tab[found].id_str),
-                     inode.snap_id);
+                     "%" PRIu32, inode.snap_id);
            pstrcpy(sn_tab[found].name,
                    MIN(sizeof(sn_tab[found].name), sizeof(inode.tag)),
                    inode.tag);
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -408,34 +408,35 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
    }
    if (header.signature != VDI_SIGNATURE) {
-        error_setg(errp, "Image not in VDI format (bad signature %08x)", header.signature);
+        error_setg(errp, "Image not in VDI format (bad signature %08" PRIx32
                   ")", header.signature);
        ret = -EINVAL;
        goto fail;
    } else if (header.version != VDI_VERSION_1_1) {
-        error_setg(errp, "unsupported VDI image (version %u.%u)",
+        error_setg(errp, "unsupported VDI image (version %" PRIu32 ".%" PRIu32
-                   header.version >> 16, header.version & 0xffff);
+                   ")", header.version >> 16, header.version & 0xffff);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_bmap % SECTOR_SIZE != 0) {
        /* We only support block maps which start on a sector boundary. */
        error_setg(errp, "unsupported VDI image (unaligned block map offset "
-                   "0x%x)", header.offset_bmap);
+                   "0x%" PRIx32 ")", header.offset_bmap);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_data % SECTOR_SIZE != 0) {
        /* We only support data blocks which start on a sector boundary. */
-        error_setg(errp, "unsupported VDI image (unaligned data offset 0x%x)",
+        error_setg(errp, "unsupported VDI image (unaligned data offset 0x%"
-                   header.offset_data);
+                   PRIx32 ")", header.offset_data);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.sector_size != SECTOR_SIZE) {
-        error_setg(errp, "unsupported VDI image (sector size %u is not %u)",
+        error_setg(errp, "unsupported VDI image (sector size %" PRIu32
-                   header.sector_size, SECTOR_SIZE);
+                   " is not %u)", header.sector_size, SECTOR_SIZE);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.block_size != DEFAULT_CLUSTER_SIZE) {
-        error_setg(errp, "unsupported VDI image (block size %u is not %u)",
+        error_setg(errp, "unsupported VDI image (block size %" PRIu32
-                   header.block_size, DEFAULT_CLUSTER_SIZE);
+                   " is not %u)", header.block_size, DEFAULT_CLUSTER_SIZE);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.disk_size >
@@ -755,6 +756,7 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options,
    vdi_header_to_le(&header);
    if (write(fd, &header, sizeof(header)) < 0) {
        result = -errno;
        goto close_and_exit;
    }
    if (bmap_size > 0) {
@@ -768,6 +770,8 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options,
        }
        if (write(fd, bmap, bmap_size) < 0) {
            result = -errno;
            g_free(bmap);
            goto close_and_exit;
        }
        g_free(bmap);
    }
@@ -775,10 +779,12 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options,
    if (image_type == VDI_TYPE_STATIC) {
        if (ftruncate(fd, sizeof(header) + bmap_size + blocks * block_size)) {
            result = -errno;
            goto close_and_exit;
        }
    }
-    if (close(fd) < 0) {
+close_and_exit:
    if ((close(fd) < 0) && !result) {
        result = -errno;
    }
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -262,7 +262,7 @@ static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
    p_name = strstr(desc, cid_str);
    if (p_name != NULL) {
        p_name += cid_str_size;
-        sscanf(p_name, "%x", &cid);
+        sscanf(p_name, "%" SCNx32, &cid);
    }
    return cid;
@@ -290,7 +290,7 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
    p_name = strstr(desc, "CID");
    if (p_name != NULL) {
        p_name += sizeof("CID");
-        snprintf(p_name, sizeof(desc) - (p_name - desc), "%x\n", cid);
+        snprintf(p_name, sizeof(desc) - (p_name - desc), "%" PRIx32 "\n", cid);
        pstrcat(desc, sizeof(desc), tmp_desc);
    }
@@ -640,7 +640,7 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
    if (le32_to_cpu(header.version) > 3) {
        char buf[64];
-        snprintf(buf, sizeof(buf), "VMDK version %d",
+        snprintf(buf, sizeof(buf), "VMDK version %" PRId32,
                 le32_to_cpu(header.version));
        error_set(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
                  bs->device_name, "vmdk", buf);
@@ -671,8 +671,9 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
    }
    if (bdrv_getlength(file) <
            le64_to_cpu(header.grain_offset) * BDRV_SECTOR_SIZE) {
-        error_setg(errp, "File truncated, expecting at least %lld bytes",
+        error_setg(errp, "File truncated, expecting at least %" PRId64 " bytes",
-                   le64_to_cpu(header.grain_offset) * BDRV_SECTOR_SIZE);
+                   (int64_t)(le64_to_cpu(header.grain_offset)
                             * BDRV_SECTOR_SIZE));
        return -EINVAL;
    }
@@ -1495,6 +1496,19 @@ static coroutine_fn int vmdk_co_write(BlockDriverState *bs, int64_t sector_num,
    return ret;
 }
 static int vmdk_write_compressed(BlockDriverState *bs,
                                 int64_t sector_num,
                                 const uint8_t *buf,
                                 int nb_sectors)
 {
    BDRVVmdkState *s = bs->opaque;
    if (s->num_extents == 1 && s->extents[0].compressed) {
        return vmdk_write(bs, sector_num, buf, nb_sectors, false, false);
    } else {
        return -ENOTSUP;
    }
 }
 static int coroutine_fn vmdk_co_write_zeroes(BlockDriverState *bs,
                                             int64_t sector_num,
                                             int nb_sectors,
@@ -1707,8 +1721,8 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options,
    const char desc_template[] =
        "# Disk DescriptorFile\n"
        "version=1\n"
-        "CID=%x\n"
+        "CID=%" PRIx32 "\n"
-        "parentCID=%x\n"
+        "parentCID=%" PRIx32 "\n"
        "createType=\"%s\"\n"
        "%s"
        "\n"
@@ -1720,7 +1734,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options,
        "\n"
        "ddb.virtualHWVersion = \"%d\"\n"
        "ddb.geometry.cylinders = \"%" PRId64 "\"\n"
-        "ddb.geometry.heads = \"%d\"\n"
+        "ddb.geometry.heads = \"%" PRIu32 "\"\n"
        "ddb.geometry.sectors = \"63\"\n"
        "ddb.adapterType = \"%s\"\n";
@@ -1780,9 +1794,9 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options,
             strcmp(fmt, "twoGbMaxExtentFlat"));
    compress = !strcmp(fmt, "streamOptimized");
    if (flat) {
-        desc_extent_line = "RW %lld FLAT \"%s\" 0\n";
+        desc_extent_line = "RW %" PRId64 " FLAT \"%s\" 0\n";
    } else {
-        desc_extent_line = "RW %lld SPARSE \"%s\"\n";
+        desc_extent_line = "RW %" PRId64 " SPARSE \"%s\"\n";
    }
    if (flat && backing_file) {
        error_setg(errp, "Flat image can't have backing file");
@@ -1850,7 +1864,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options,
    }
    /* generate descriptor file */
    desc = g_strdup_printf(desc_template,
-                           (unsigned int)time(NULL),
+                           (uint32_t)time(NULL),
                           parent_cid,
                           fmt,
                           parent_desc_line,
@@ -2062,6 +2076,26 @@ static ImageInfoSpecific *vmdk_get_specific_info(BlockDriverState *bs)
    return spec_info;
 }
 static int vmdk_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
    int i;
    BDRVVmdkState *s = bs->opaque;
    assert(s->num_extents);
    bdi->needs_compressed_writes = s->extents[0].compressed;
    if (!s->extents[0].flat) {
        bdi->cluster_size = s->extents[0].cluster_sectors << BDRV_SECTOR_BITS;
    }
    /* See if we have multiple extents but they have different cases */
    for (i = 1; i < s->num_extents; i++) {
        if (bdi->needs_compressed_writes != s->extents[i].compressed ||
            (bdi->cluster_size && bdi->cluster_size !=
                s->extents[i].cluster_sectors << BDRV_SECTOR_BITS)) {
            return -ENOTSUP;
        }
    }
    return 0;
 }
 static QEMUOptionParameter vmdk_create_options[] = {
    {
        .name = BLOCK_OPT_SIZE,
@@ -2108,6 +2142,7 @@ static BlockDriver bdrv_vmdk = {
    .bdrv_reopen_prepare          = vmdk_reopen_prepare,
    .bdrv_read                    = vmdk_co_read,
    .bdrv_write                   = vmdk_co_write,
    .bdrv_write_compressed        = vmdk_write_compressed,
    .bdrv_co_write_zeroes         = vmdk_co_write_zeroes,
    .bdrv_close                   = vmdk_close,
    .bdrv_create                  = vmdk_create,
@@ -2117,6 +2152,7 @@ static BlockDriver bdrv_vmdk = {
    .bdrv_has_zero_init           = vmdk_has_zero_init,
    .bdrv_get_specific_info       = vmdk_get_specific_info,
    .bdrv_refresh_limits          = vmdk_refresh_limits,
    .bdrv_get_info                = vmdk_get_info,
    .create_options               = vmdk_create_options,
 };
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -2947,7 +2947,7 @@ static int enable_write_target(BDRVVVFATState *s)
    unlink(s->qcow_filename);
 #endif
-    s->bs->backing_hd = bdrv_new("");
+    s->bs->backing_hd = bdrv_new("", &error_abort);
    s->bs->backing_hd->drv = &vvfat_write_target;
    s->bs->backing_hd->opaque = g_malloc(sizeof(void*));
    *(void**)s->bs->backing_hd->opaque = s;
--- a/blockdev.c
+++ b/blockdev.c
@@ -452,16 +452,14 @@ static DriveInfo *blockdev_init(const char *file, QDict *bs_opts,
        }
    }
    if (bdrv_find_node(qemu_opts_id(opts))) {
        error_setg(errp, "device id=%s is conflicting with a node-name",
                   qemu_opts_id(opts));
        goto early_err;
    }
    /* init */
    dinfo = g_malloc0(sizeof(*dinfo));
    dinfo->id = g_strdup(qemu_opts_id(opts));
-    dinfo->bdrv = bdrv_new(dinfo->id);
+    dinfo->bdrv = bdrv_new(dinfo->id, &error);
    if (error) {
        error_propagate(errp, error);
        goto bdrv_new_err;
    }
    dinfo->bdrv->open_flags = snapshot ? BDRV_O_SNAPSHOT : 0;
    dinfo->bdrv->read_only = ro;
    dinfo->refcount = 1;
@@ -523,8 +521,9 @@ static DriveInfo *blockdev_init(const char *file, QDict *bs_opts,
 err:
    bdrv_unref(dinfo->bdrv);
    g_free(dinfo->id);
    QTAILQ_REMOVE(&drives, dinfo, next);
 bdrv_new_err:
    g_free(dinfo->id);
    g_free(dinfo);
 early_err:
    QDECREF(bs_opts);
@@ -1116,6 +1115,7 @@ typedef struct InternalSnapshotState {
 static void internal_snapshot_prepare(BlkTransactionState *common,
                                      Error **errp)
 {
    Error *local_err = NULL;
    const char *device;
    const char *name;
    BlockDriverState *bs;
@@ -1164,8 +1164,10 @@ static void internal_snapshot_prepare(BlkTransactionState *common,
    }
    /* check whether a snapshot with name exist */
-    ret = bdrv_snapshot_find_by_id_and_name(bs, NULL, name, &old_sn, errp);
+    ret = bdrv_snapshot_find_by_id_and_name(bs, NULL, name, &old_sn,
-    if (error_is_set(errp)) {
+                                            &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        return;
    } else if (ret) {
        error_setg(errp,
@@ -1521,14 +1523,16 @@ static void eject_device(BlockDriverState *bs, int force, Error **errp)
        return;
    }
    if (!bdrv_dev_has_removable_media(bs)) {
-        error_set(errp, QERR_DEVICE_NOT_REMOVABLE, bdrv_get_device_name(bs));
+        error_setg(errp, "Device '%s' is not removable",
                   bdrv_get_device_name(bs));
        return;
    }
    if (bdrv_dev_is_medium_locked(bs) && !bdrv_dev_is_tray_open(bs)) {
        bdrv_dev_eject_request(bs, force);
        if (!force) {
-            error_set(errp, QERR_DEVICE_LOCKED, bdrv_get_device_name(bs));
+            error_setg(errp, "Device '%s' is locked",
                       bdrv_get_device_name(bs));
            return;
        }
    }
@@ -2220,7 +2224,8 @@ void qmp_block_job_cancel(const char *device,
        return;
    }
    if (job->paused && !force) {
-        error_set(errp, QERR_BLOCK_JOB_PAUSED, device);
+        error_setg(errp, "The block job for device '%s' is currently paused",
                   device);
        return;
    }
--- a/blockjob.c
+++ b/blockjob.c
@@ -88,7 +88,7 @@ void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
    Error *local_err = NULL;
    if (!job->driver->set_speed) {
-        error_set(errp, QERR_NOT_SUPPORTED);
+        error_set(errp, QERR_UNSUPPORTED);
        return;
    }
    job->driver->set_speed(job, speed, &local_err);
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -43,7 +43,7 @@ unsigned long reserved_va;
 #endif
 static const char *interp_prefix = CONFIG_QEMU_INTERP_PREFIX;
-const char *qemu_uname_release = CONFIG_UNAME_RELEASE;
+const char *qemu_uname_release;
 extern char **environ;
 enum BSDType bsd_type;
--- a/62
+++ b/62
@@ -285,7 +285,6 @@ softmmu="yes"
 linux_user="no"
 bsd_user="no"
 guest_base="yes"
 uname_release=""
 aix="no"
 blobs="yes"
 pkgversion=""
@@ -404,6 +403,14 @@ fi
 # make source path absolute
 source_path=`cd "$source_path"; pwd`
 # running configure in the source tree?
 # we know that's the case if configure is there.
 if test -f "./configure"; then
    pwd_is_source_path="y"
 else
    pwd_is_source_path="n"
 fi
 check_define() {
 cat > $TMPC <<EOF
 #if !defined($1)
@@ -945,8 +952,6 @@ for opt do
  ;;
  --disable-pie) pie="no"
  ;;
  --enable-uname-release=*) uname_release="$optarg"
  ;;
  --enable-werror) werror="yes"
  ;;
  --disable-werror) werror="no"
@@ -1087,7 +1092,10 @@ for opt do
  ;;
  --enable-quorum) quorum="yes"
  ;;
-  *) echo "ERROR: unknown option $opt"; show_help="yes"
+  *)
      echo "ERROR: unknown option $opt"
      echo "Try '$0 --help' for more information"
      exit 1
  ;;
  esac
 done
@@ -1217,8 +1225,8 @@ Advanced options (experts only):
  --enable-modules         enable modules support
  --enable-debug-tcg       enable TCG debugging
  --disable-debug-tcg      disable TCG debugging (default)
-  --enable-debug-info       enable debugging information (default)
+  --enable-debug-info      enable debugging information (default)
-  --disable-debug-info      disable debugging information
+  --disable-debug-info     disable debugging information
  --enable-debug           enable common debug build options
  --enable-sparse          enable sparse checker
  --disable-sparse         disable sparse checker (default)
@@ -1230,6 +1238,7 @@ Advanced options (experts only):
  --with-sdlabi            select preferred SDL ABI 1.2 or 2.0
  --disable-gtk            disable gtk UI
  --enable-gtk             enable gtk UI
  --with-gtkabi            select preferred GTK ABI 2.0 or 3.0
  --disable-virtfs         disable VirtFS
  --enable-virtfs          enable VirtFS
  --disable-vnc            disable VNC
@@ -1291,7 +1300,6 @@ Advanced options (experts only):
  --fmod-lib               path to FMOD library
  --fmod-inc               path to FMOD includes
  --oss-lib                path to OSS library
  --enable-uname-release=R Return R for uname -r in usermode emulation
  --cpu=CPU                Build for host CPU [$cpu]
  --disable-uuid           disable uuid support
  --enable-uuid            enable uuid support
@@ -1353,7 +1361,7 @@ Advanced options (experts only):
 NOTE: The object files are built at the place where configure is launched
 EOF
-exit 1
+exit 0
 fi
 # Now we have handled --enable-tcg-interpreter and know we're not just
@@ -2624,7 +2632,7 @@ done
 if test "$modules" = yes; then
    shacmd_probe="sha1sum sha1 shasum"
    for c in $shacmd_probe; do
-        if which $c &>/dev/null; then
+        if which $c >/dev/null 2>&1; then
            shacmd="$c"
            break
        fi
@@ -2940,7 +2948,7 @@ EOF
    fdt=yes
    dtc_internal="yes"
    mkdir -p dtc
-    if [ "$source_path" != `pwd` ] ; then
+    if [ "$pwd_is_source_path" != "y" ] ; then
       symlink "$source_path/dtc/Makefile" "dtc/Makefile"
       symlink "$source_path/dtc/scripts" "dtc/scripts"
    fi
@@ -3462,10 +3470,10 @@ if test "$smartcard_nss" != "no"; then
 #include <pk11pub.h>
 int main(void) { PK11_FreeSlot(0); return 0; }
 EOF
-    smartcard_includes="-I\$(SRC_PATH)/libcacard"
+    # FIXME: do not include $glib_* in here
-    libcacard_libs="$($pkg_config --libs nss 2>/dev/null) $glib_libs"
+    nss_libs="$($pkg_config --libs nss 2>/dev/null) $glib_libs"
-    libcacard_cflags="$($pkg_config --cflags nss 2>/dev/null) $glib_cflags"
+    nss_cflags="$($pkg_config --cflags nss 2>/dev/null) $glib_cflags"
-    test_cflags="$libcacard_cflags"
+    test_cflags="$nss_cflags"
    # The header files in nss < 3.13.3 have a bug which causes them to
    # emit a warning. If we're going to compile QEMU with -Werror, then
    # test that the headers don't have this bug. Otherwise we would pass
@@ -3475,11 +3483,8 @@ EOF
    fi
    if test -n "$libtool" &&
       $pkg_config --atleast-version=3.12.8 nss && \
-      compile_prog "$test_cflags" "$libcacard_libs"; then
+      compile_prog "$test_cflags" "$nss_libs"; then
        smartcard_nss="yes"
        QEMU_CFLAGS="$QEMU_CFLAGS $libcacard_cflags"
        QEMU_INCLUDES="$QEMU_INCLUDES $smartcard_includes"
        libs_softmmu="$libcacard_libs $libs_softmmu"
    else
        if test "$smartcard_nss" = "yes"; then
            feature_not_found "nss"
@@ -4095,7 +4100,6 @@ echo "sparse enabled    $sparse"
 echo "strip binaries    $strip_opt"
 echo "profiler          $profiler"
 echo "static build      $static"
 echo "-Werror enabled   $werror"
 if test "$darwin" = "yes" ; then
    echo "Cocoa support     $cocoa"
 fi
@@ -4125,8 +4129,6 @@ echo "xen support       $xen"
 echo "brlapi support    $brlapi"
 echo "bluez  support    $bluez"
 echo "Documentation     $docs"
 [ ! -z "$uname_release" ] && \
 echo "uname -r          $uname_release"
 echo "GUEST_BASE        $guest_base"
 echo "PIE               $pie"
 echo "vde support       $vde"
@@ -4148,7 +4150,9 @@ echo "libcap-ng support $cap_ng"
 echo "vhost-net support $vhost_net"
 echo "vhost-scsi support $vhost_scsi"
 echo "Trace backend     $trace_backend"
 if test "$trace_backend" = "simple"; then
 echo "Trace output file $trace_file-<pid>"
 fi
 if test "$spice" = "yes"; then
 echo "spice support     $spice ($spice_protocol_version/$spice_server_version)"
 else
@@ -4347,6 +4351,7 @@ if test "$modules" = "yes"; then
 fi
 if test "$sdl" = "yes" ; then
  echo "CONFIG_SDL=y" >> $config_host_mak
  echo "CONFIG_SDLABI=$sdlabi" >> $config_host_mak
  echo "SDL_CFLAGS=$sdl_cflags" >> $config_host_mak
 fi
 if test "$cocoa" = "yes" ; then
@@ -4430,6 +4435,7 @@ fi
 echo "GLIB_CFLAGS=$glib_cflags" >> $config_host_mak
 if test "$gtk" = "yes" ; then
  echo "CONFIG_GTK=y" >> $config_host_mak
  echo "CONFIG_GTKABI=$gtkabi" >> $config_host_mak
  echo "GTK_CFLAGS=$gtk_cflags" >> $config_host_mak
 fi
 if test "$vte" = "yes" ; then
@@ -4492,8 +4498,8 @@ fi
 if test "$smartcard_nss" = "yes" ; then
  echo "CONFIG_SMARTCARD_NSS=y" >> $config_host_mak
-  echo "libcacard_libs=$libcacard_libs" >> $config_host_mak
+  echo "NSS_LIBS=$nss_libs" >> $config_host_mak
-  echo "libcacard_cflags=$libcacard_cflags" >> $config_host_mak
+  echo "NSS_CFLAGS=$nss_cflags" >> $config_host_mak
 fi
 if test "$libusb" = "yes" ; then
@@ -4539,8 +4545,6 @@ if [ "$bsd" = "yes" ] ; then
  echo "CONFIG_BSD=y" >> $config_host_mak
 fi
 echo "CONFIG_UNAME_RELEASE=\"$uname_release\"" >> $config_host_mak
 if test "$zero_malloc" = "yes" ; then
  echo "CONFIG_ZERO_MALLOC=y" >> $config_host_mak
 fi
@@ -4764,6 +4768,12 @@ if test "$gcov" = "yes" ; then
  echo "GCOV=$gcov_tool" >> $config_host_mak
 fi
 iotests_common_env="tests/qemu-iotests/common.env"
 echo "# Automatically generated by configure - do not modify" > $iotests_common_env
 echo >> $iotests_common_env
 echo "PYTHON='$python'" >> $iotests_common_env
 # use included Linux headers
 if test "$linux" = "yes" ; then
  mkdir -p linux-headers
@@ -5179,7 +5189,7 @@ do
 done
 mkdir -p $DIRS
 for f in $FILES ; do
-    if [ -e "$source_path/$f" ] && [ "$source_path" != `pwd` ]; then
+    if [ -e "$source_path/$f" ] && [ "$pwd_is_source_path" != "y" ]; then
        symlink "$source_path/$f" "$f"
    fi
 done
--- a/coroutine-gthread.c
+++ b/coroutine-gthread.c
@@ -115,14 +115,11 @@ static inline GThread *create_thread(GThreadFunc func, gpointer data)
 static void __attribute__((constructor)) coroutine_init(void)
 {
    if (!g_thread_supported()) {
 #if !GLIB_CHECK_VERSION(2, 31, 0)
    if (!g_thread_supported()) {
        g_thread_init(NULL);
 #else
        fprintf(stderr, "glib threading failed to initialize.\n");
        exit(1);
 #endif
    }
 #endif
    init_coroutine_cond();
 }
--- a/cpus.c
+++ b/cpus.c
@@ -1454,7 +1454,7 @@ void qmp_pmemsave(int64_t addr, int64_t size, const char *filename,
        l = sizeof(buf);
        if (l > size)
            l = size;
-        cpu_physical_memory_rw(addr, buf, l, 0);
+        cpu_physical_memory_read(addr, buf, l);
        if (fwrite(buf, 1, l, f) != l) {
            error_set(errp, QERR_IO_ERROR);
            goto exit;
--- a/default-configs/usb.mak
+++ b/default-configs/usb.mak
@@ -1,6 +1,7 @@
 CONFIG_USB_TABLET_WACOM=y
 CONFIG_USB_STORAGE_BOT=y
 CONFIG_USB_STORAGE_UAS=y
 CONFIG_USB_STORAGE_MTP=y
 CONFIG_USB_SMARTCARD=y
 CONFIG_USB_AUDIO=y
 CONFIG_USB_SERIAL=y
--- a/device-hotplug.c
+++ b/device-hotplug.c
@@ -40,7 +40,7 @@ DriveInfo *add_init_drive(const char *optstr)
        return NULL;
    mc = MACHINE_GET_CLASS(current_machine);
-    dinfo = drive_init(opts, mc->qemu_machine->block_default_type);
+    dinfo = drive_init(opts, mc->block_default_type);
    if (!dinfo) {
        qemu_opts_del(opts);
        return NULL;
--- a/disas/Makefile.objs
+++ b/disas/Makefile.objs
@@ -4,7 +4,7 @@ common-obj-$(CONFIG_ARM_DIS) += arm.o
 common-obj-$(CONFIG_ARM_A64_DIS) += arm-a64.o
 common-obj-$(CONFIG_ARM_A64_DIS) += libvixl/
 libvixldir = $(SRC_PATH)/disas/libvixl
-$(obj)/arm-a64.o: QEMU_CFLAGS += -I$(libvixldir)
+arm-a64.o-cflags := -I$(libvixldir)
 common-obj-$(CONFIG_CRIS_DIS) += cris.o
 common-obj-$(CONFIG_HPPA_DIS) += hppa.o
 common-obj-$(CONFIG_I386_DIS) += i386.o
--- a/docs/memory.txt
+++ b/docs/memory.txt
@@ -232,8 +232,8 @@ various constraints can be supplied to control how these callbacks are called:
   (in bytes) supported by the *implementation*; other access sizes will be
   emulated using the ones available.  For example a 4-byte write will be
   emulated using four 1-byte writes, if .impl.max_access_size = 1.
- - .impl.valid specifies that the *implementation* only supports unaligned
+ - .impl.unaligned specifies that the *implementation* supports unaligned
-   accesses; unaligned accesses will be emulated by two aligned accesses.
+   accesses; if false, unaligned accesses will be emulated by two aligned
- - .old_portio and .old_mmio can be used to ease porting from code using
+   accesses.
-   cpu_register_io_memory() and register_ioport().  They should not be used
+ - .old_mmio can be used to ease porting from code using
-   in new code.
+   cpu_register_io_memory(). It should not be used in new code.
--- a/docs/migration.txt
+++ b/docs/migration.txt
@@ -139,7 +139,6 @@ static const VMStateDescription vmstate_kbd = {
    .name = "pckbd",
    .version_id = 3,
    .minimum_version_id = 3,
    .minimum_version_id_old = 3,
    .fields      = (VMStateField []) {
        VMSTATE_UINT8(write_cmd, KBDState),
        VMSTATE_UINT8(status, KBDState),
@@ -168,12 +167,13 @@ You can see that there are several version fields:
 - minimum_version_id: the minimum version_id that VMState is able to understand
  for that device.
 - minimum_version_id_old: For devices that were not able to port to vmstate, we can
-  assign a function that knows how to read this old state.
+  assign a function that knows how to read this old state. This field is
  ignored if there is no load_state_old handler.
 So, VMState is able to read versions from minimum_version_id to
-version_id.  And the function load_state_old() is able to load state
+version_id.  And the function load_state_old() (if present) is able to
-from minimum_version_id_old to minimum_version_id.  This function is
+load state from minimum_version_id_old to minimum_version_id.  This
-deprecated and will be removed when no more users are left.
+function is deprecated and will be removed when no more users are left.
 ===  Massaging functions ===
@@ -255,7 +255,6 @@ const VMStateDescription vmstate_ide_drive_pio_state = {
    .name = "ide_drive/pio_state",
    .version_id = 1,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .pre_save = ide_drive_pio_pre_save,
    .post_load = ide_drive_pio_post_load,
    .fields      = (VMStateField []) {
@@ -275,7 +274,6 @@ const VMStateDescription vmstate_ide_drive = {
    .name = "ide_drive",
    .version_id = 3,
    .minimum_version_id = 0,
    .minimum_version_id_old = 0,
    .post_load = ide_drive_post_load,
    .fields      = (VMStateField []) {
        .... several fields ....
--- a/docs/qapi-code-gen.txt
+++ b/docs/qapi-code-gen.txt
@@ -40,6 +40,17 @@ enumeration types and union types.
 Generally speaking, types definitions should always use CamelCase for the type
 names. Command names should be all lower case with words separated by a hyphen.
 === Includes ===
 The QAPI schema definitions can be modularized using the 'include' directive:
 { 'include': 'path/to/file.json'}
 The directive is evaluated recursively, and include paths are relative to the
 file using the directive.
 === Complex types ===
 A complex type is a dictionary containing a single key whose value is a
@@ -49,10 +60,34 @@ example of a complex type is:
 { 'type': 'MyType',
   'data': { 'member1': 'str', 'member2': 'int', '*member3': 'str' } }
-The use of '*' as a prefix to the name means the member is optional.  Optional
+The use of '*' as a prefix to the name means the member is optional.
 members should always be added to the end of the dictionary to preserve
 backwards compatibility.
 The default initialization value of an optional argument should not be changed
 between versions of QEMU unless the new default maintains backward
 compatibility to the user-visible behavior of the old default.
 With proper documentation, this policy still allows some flexibility; for
 example, documenting that a default of 0 picks an optimal buffer size allows
 one release to declare the optimal size at 512 while another release declares
 the optimal size at 4096 - the user-visible behavior is not the bytes used by
 the buffer, but the fact that the buffer was optimal size.
 On input structures (only mentioned in the 'data' side of a command), changing
 from mandatory to optional is safe (older clients will supply the option, and
 newer clients can benefit from the default); changing from optional to
 mandatory is backwards incompatible (older clients may be omitting the option,
 and must continue to work).
 On output structures (only mentioned in the 'returns' side of a command),
 changing from mandatory to optional is in general unsafe (older clients may be
 expecting the field, and could crash if it is missing), although it can be done
 if the only way that the optional argument will be omitted is when it is
 triggered by the presence of a new input flag to the command that older clients
 don't know to send.  Changing from optional to mandatory is safe.
 A structure that is used in both input and output of various commands
 must consider the backwards compatibility constraints of both directions
 of use.
 A complex type definition can specify another complex type as its base.
 In this case, the fields of the base type are included as top-level fields
@@ -221,7 +256,7 @@ created code.
 Example:
    mdroth@illuin:~/w/qemu2.git$ python scripts/qapi-types.py \
-      --output-dir="qapi-generated" --prefix="example-" < example-schema.json
+      --output-dir="qapi-generated" --prefix="example-" --input-file=example-schema.json
    mdroth@illuin:~/w/qemu2.git$ cat qapi-generated/example-qapi-types.c
    /* AUTOMATICALLY GENERATED, DO NOT MODIFY */
@@ -291,7 +326,7 @@ $(prefix)qapi-visit.h: declarations for previously mentioned visitor
 Example:
    mdroth@illuin:~/w/qemu2.git$ python scripts/qapi-visit.py \
-        --output-dir="qapi-generated" --prefix="example-" < example-schema.json
+        --output-dir="qapi-generated" --prefix="example-" --input-file=example-schema.json
    mdroth@illuin:~/w/qemu2.git$ cat qapi-generated/example-qapi-visit.c
    /* THIS FILE IS AUTOMATICALLY GENERATED, DO NOT MODIFY */
--- a/docs/specs/standard-vga.txt
+++ b/docs/specs/standard-vga.txt
@@ -5,9 +5,10 @@ QEMU Standard VGA
 Exists in two variants, for isa and pci.
 command line switches:
-    -vga std            [ picks isa for -M isapc, otherwise pci ]
+    -vga std               [ picks isa for -M isapc, otherwise pci ]
-    -device VGA         [ pci variant ]
+    -device VGA            [ pci variant ]
-    -device isa-vga     [ isa variant ]
+    -device isa-vga        [ isa variant ]
    -device secondary-vga  [ legacy-free pci variant ]
 PCI spec
@@ -31,9 +32,15 @@ PCI ROM Region:
   Holds the vgabios (qemu 0.14+).
 The legacy-free variant has no ROM and has PCI_CLASS_DISPLAY_OTHER
 instead of PCI_CLASS_DISPLAY_VGA.
 IO ports used
 -------------
 Doesn't apply to the legacy-free pci variant, use the MMIO bar instead.
 03c0 - 03df : standard vga ports
 01ce        : bochs vbe interface index port
 01cf        : bochs vbe interface data port (x86 only)
--- a/docs/writing-qmp-commands.txt
+++ b/docs/writing-qmp-commands.txt
@@ -308,12 +308,12 @@ Here's the implementation of the "hello-world" HMP command:
 void hmp_hello_world(Monitor *mon, const QDict *qdict)
 {
    const char *message = qdict_get_try_str(qdict, "message");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_hello_world(!!message, message, &errp);
+    qmp_hello_world(!!message, message, &err);
-    if (error_is_set(&errp)) {
+    if (err) {
-        monitor_printf(mon, "%s\n", error_get_pretty(errp));
+        monitor_printf(mon, "%s\n", error_get_pretty(err));
-        error_free(errp);
+        error_free(err);
        return;
    }
 }
@@ -328,7 +328,7 @@ There are three important points to be noticed:
 2. hmp_hello_world() performs error checking. In this example we just print
   the error description to the user, but we could do more, like taking
   different actions depending on the error qmp_hello_world() returns
-3. The "errp" variable must be initialized to NULL before performing the
+3. The "err" variable must be initialized to NULL before performing the
   QMP call
 There's one last step to actually make the command available to monitor users,
@@ -480,12 +480,12 @@ Here's the HMP counterpart of the query-alarm-clock command:
 void hmp_info_alarm_clock(Monitor *mon)
 {
    QemuAlarmClock *clock;
-    Error *errp = NULL;
+    Error *err = NULL;
-    clock = qmp_query_alarm_clock(&errp);
+    clock = qmp_query_alarm_clock(&err);
-    if (error_is_set(&errp)) {
+    if (err) {
        monitor_printf(mon, "Could not query alarm clock information\n");
-        error_free(errp);
+        error_free(err);
        return;
    }
@@ -631,12 +631,12 @@ has to traverse the list, it's shown below for reference:
 void hmp_info_alarm_methods(Monitor *mon)
 {
    TimerAlarmMethodList *method_list, *method;
-    Error *errp = NULL;
+    Error *err = NULL;
-    method_list = qmp_query_alarm_methods(&errp);
+    method_list = qmp_query_alarm_methods(&err);
-    if (error_is_set(&errp)) {
+    if (err) {
        monitor_printf(mon, "Could not query alarm methods\n");
-        error_free(errp);
+        error_free(err);
        return;
    }
--- a/dump.c
+++ b/dump.c
@@ -86,7 +86,6 @@ typedef struct DumpState {
    bool has_filter;
    int64_t begin;
    int64_t length;
    Error **errp;
    uint8_t *note_buf;          /* buffer for notes */
    size_t note_buf_offset;     /* the writing place in note_buf */
@@ -1570,7 +1569,6 @@ static int dump_init(DumpState *s, int fd, bool has_format,
        nr_cpus++;
    }
    s->errp = errp;
    s->fd = fd;
    s->has_filter = has_filter;
    s->begin = begin;
@@ -1780,11 +1778,11 @@ void qmp_dump_guest_memory(bool paging, const char *file, bool has_begin,
    }
    if (has_format && format != DUMP_GUEST_MEMORY_FORMAT_ELF) {
-        if (create_kdump_vmcore(s) < 0 && !error_is_set(s->errp)) {
+        if (create_kdump_vmcore(s) < 0) {
            error_set(errp, QERR_IO_ERROR);
        }
    } else {
-        if (create_vmcore(s) < 0 && !error_is_set(s->errp)) {
+        if (create_vmcore(s) < 0) {
            error_set(errp, QERR_IO_ERROR);
        }
    }
--- a/exec.c
+++ b/exec.c
@@ -380,7 +380,7 @@ MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,
        as = iotlb.target_as;
    }
-    if (memory_access_is_direct(mr, is_write)) {
+    if (xen_enabled() && memory_access_is_direct(mr, is_write)) {
        hwaddr page = ((addr & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE) - addr;
        len = MIN(page, len);
    }
--- a/fsdev/virtfs-proxy-helper.c
+++ b/fsdev/virtfs-proxy-helper.c
@@ -760,6 +760,7 @@ static int proxy_socket(const char *path, uid_t uid, gid_t gid)
        return -1;
    }
    size = sizeof(qemu);
    client = accept(sock, (struct sockaddr *)&qemu, &size);
    if (client < 0) {
        do_perror("accept");
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -176,7 +176,7 @@ ETEXI
    {
        .name       = "drive_del",
-        .args_type  = "id:s",
+        .args_type  = "id:B",
        .params     = "device",
        .help       = "remove host block device",
        .user_print = monitor_user_noop,
@@ -658,6 +658,7 @@ ETEXI
        .help       = "add device, like -device on the command line",
        .user_print = monitor_user_noop,
        .mhandler.cmd_new = do_device_add,
        .command_completion = device_add_completion,
    },
 STEXI
@@ -673,6 +674,7 @@ ETEXI
        .params     = "device",
        .help       = "remove device",
        .mhandler.cmd = hmp_device_del,
        .command_completion = device_del_completion,
    },
 STEXI
@@ -998,26 +1000,34 @@ ETEXI
    {
        .name       = "dump-guest-memory",
-        .args_type  = "paging:-p,filename:F,begin:i?,length:i?",
+        .args_type  = "paging:-p,zlib:-z,lzo:-l,snappy:-s,filename:F,begin:i?,length:i?",
-        .params     = "[-p] filename [begin] [length]",
+        .params     = "[-p] [-z|-l|-s] filename [begin length]",
-        .help       = "dump guest memory to file"
+        .help       = "dump guest memory into file 'filename'.\n\t\t\t"
-                      "\n\t\t\t begin(optional): the starting physical address"
+                      "-p: do paging to get guest's memory mapping.\n\t\t\t"
-                      "\n\t\t\t length(optional): the memory size, in bytes",
+                      "-z: dump in kdump-compressed format, with zlib compression.\n\t\t\t"
                      "-l: dump in kdump-compressed format, with lzo compression.\n\t\t\t"
                      "-s: dump in kdump-compressed format, with snappy compression.\n\t\t\t"
                      "begin: the starting physical address.\n\t\t\t"
                      "length: the memory size, in bytes.",
        .mhandler.cmd = hmp_dump_guest_memory,
    },
 STEXI
-@item dump-guest-memory [-p] @var{protocol} @var{begin} @var{length}
+@item dump-guest-memory [-p] @var{filename} @var{begin} @var{length}
@item dump-guest-memory [-z|-l|-s] @var{filename}
@findex dump-guest-memory
 Dump guest memory to @var{protocol}. The file can be processed with crash or
-gdb.
+gdb. Without -z|-l|-s, the dump format is ELF.
-  filename: dump file name
+        -p: do paging to get guest's memory mapping.
-    paging: do paging to get guest's memory mapping
+        -z: dump in kdump-compressed format, with zlib compression.
        -l: dump in kdump-compressed format, with lzo compression.
        -s: dump in kdump-compressed format, with snappy compression.
  filename: dump file name.
     begin: the starting physical address. It's optional, and should be
-            specified with length together.
+            specified together with length.
    length: the memory size, in bytes. It's optional, and should be specified
-            with begin together.
+            together with begin.
 ETEXI
    {
@@ -1254,6 +1264,7 @@ ETEXI
        .params     = "[qom-type=]type,id=str[,prop=value][,...]",
        .help       = "create QOM object",
        .mhandler.cmd = hmp_object_add,
        .command_completion = object_add_completion,
    },
 STEXI
@@ -1268,6 +1279,7 @@ ETEXI
        .params     = "id",
        .help       = "destroy QOM object",
        .mhandler.cmd = hmp_object_del,
        .command_completion = object_del_completion,
    },
 STEXI
--- a/hmp.c
+++ b/hmp.c
@@ -28,7 +28,8 @@
 static void hmp_handle_error(Monitor *mon, Error **errp)
 {
-    if (error_is_set(errp)) {
+    assert(errp);
    if (*errp) {
        monitor_printf(mon, "%s\n", error_get_pretty(*errp));
        error_free(*errp);
    }
@@ -188,6 +189,8 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
                       info->ram->normal);
        monitor_printf(mon, "normal bytes: %" PRIu64 " kbytes\n",
                       info->ram->normal_bytes >> 10);
        monitor_printf(mon, "dirty sync count: %" PRIu64 "\n",
                       info->ram->dirty_sync_count);
        if (info->ram->dirty_pages_rate) {
            monitor_printf(mon, "dirty pages rate: %" PRIu64 " pages\n",
                           info->ram->dirty_pages_rate);
@@ -212,6 +215,8 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
                       info->xbzrle_cache->pages);
        monitor_printf(mon, "xbzrle cache miss: %" PRIu64 "\n",
                       info->xbzrle_cache->cache_miss);
        monitor_printf(mon, "xbzrle cache miss rate: %0.2f\n",
                       info->xbzrle_cache->cache_miss_rate);
        monitor_printf(mon, "xbzrle overflow : %" PRIu64 "\n",
                       info->xbzrle_cache->overflow);
    }
@@ -750,10 +755,10 @@ void hmp_memsave(Monitor *mon, const QDict *qdict)
    uint32_t size = qdict_get_int(qdict, "size");
    const char *filename = qdict_get_str(qdict, "filename");
    uint64_t addr = qdict_get_int(qdict, "val");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_memsave(addr, size, filename, true, monitor_get_cpu_index(), &errp);
+    qmp_memsave(addr, size, filename, true, monitor_get_cpu_index(), &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_pmemsave(Monitor *mon, const QDict *qdict)
@@ -761,21 +766,21 @@ void hmp_pmemsave(Monitor *mon, const QDict *qdict)
    uint32_t size = qdict_get_int(qdict, "size");
    const char *filename = qdict_get_str(qdict, "filename");
    uint64_t addr = qdict_get_int(qdict, "val");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_pmemsave(addr, size, filename, &errp);
+    qmp_pmemsave(addr, size, filename, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_ringbuf_write(Monitor *mon, const QDict *qdict)
 {
    const char *chardev = qdict_get_str(qdict, "device");
    const char *data = qdict_get_str(qdict, "data");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_ringbuf_write(chardev, data, false, 0, &errp);
+    qmp_ringbuf_write(chardev, data, false, 0, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_ringbuf_read(Monitor *mon, const QDict *qdict)
@@ -783,13 +788,13 @@ void hmp_ringbuf_read(Monitor *mon, const QDict *qdict)
    uint32_t size = qdict_get_int(qdict, "size");
    const char *chardev = qdict_get_str(qdict, "device");
    char *data;
-    Error *errp = NULL;
+    Error *err = NULL;
    int i;
-    data = qmp_ringbuf_read(chardev, size, false, 0, &errp);
+    data = qmp_ringbuf_read(chardev, size, false, 0, &err);
-    if (errp) {
+    if (err) {
-        monitor_printf(mon, "%s\n", error_get_pretty(errp));
+        monitor_printf(mon, "%s\n", error_get_pretty(err));
-        error_free(errp);
+        error_free(err);
        return;
    }
@@ -824,7 +829,7 @@ static bool key_is_missing(const BlockInfo *bdev)
 void hmp_cont(Monitor *mon, const QDict *qdict)
 {
    BlockInfoList *bdev_list, *bdev;
-    Error *errp = NULL;
+    Error *err = NULL;
    bdev_list = qmp_query_block(NULL);
    for (bdev = bdev_list; bdev; bdev = bdev->next) {
@@ -835,8 +840,8 @@ void hmp_cont(Monitor *mon, const QDict *qdict)
        }
    }
-    qmp_cont(&errp);
+    qmp_cont(&err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 out:
    qapi_free_BlockInfoList(bdev_list);
@@ -849,41 +854,41 @@ void hmp_system_wakeup(Monitor *mon, const QDict *qdict)
 void hmp_inject_nmi(Monitor *mon, const QDict *qdict)
 {
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_inject_nmi(&errp);
+    qmp_inject_nmi(&err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_set_link(Monitor *mon, const QDict *qdict)
 {
    const char *name = qdict_get_str(qdict, "name");
    int up = qdict_get_bool(qdict, "up");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_set_link(name, up, &errp);
+    qmp_set_link(name, up, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_block_passwd(Monitor *mon, const QDict *qdict)
 {
    const char *device = qdict_get_str(qdict, "device");
    const char *password = qdict_get_str(qdict, "password");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_block_passwd(true, device, false, NULL, password, &errp);
+    qmp_block_passwd(true, device, false, NULL, password, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_balloon(Monitor *mon, const QDict *qdict)
 {
    int64_t value = qdict_get_int(qdict, "value");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_balloon(value, &errp);
+    qmp_balloon(value, &err);
-    if (errp) {
+    if (err) {
-        monitor_printf(mon, "balloon: %s\n", error_get_pretty(errp));
+        monitor_printf(mon, "balloon: %s\n", error_get_pretty(err));
-        error_free(errp);
+        error_free(err);
    }
 }
@@ -891,10 +896,10 @@ void hmp_block_resize(Monitor *mon, const QDict *qdict)
 {
    const char *device = qdict_get_str(qdict, "device");
    int64_t size = qdict_get_int(qdict, "size");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_block_resize(true, device, false, NULL, size, &errp);
+    qmp_block_resize(true, device, false, NULL, size, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_drive_mirror(Monitor *mon, const QDict *qdict)
@@ -905,11 +910,11 @@ void hmp_drive_mirror(Monitor *mon, const QDict *qdict)
    int reuse = qdict_get_try_bool(qdict, "reuse", 0);
    int full = qdict_get_try_bool(qdict, "full", 0);
    enum NewImageMode mode;
-    Error *errp = NULL;
+    Error *err = NULL;
    if (!filename) {
-        error_set(&errp, QERR_MISSING_PARAMETER, "target");
+        error_set(&err, QERR_MISSING_PARAMETER, "target");
-        hmp_handle_error(mon, &errp);
+        hmp_handle_error(mon, &err);
        return;
    }
@@ -922,8 +927,8 @@ void hmp_drive_mirror(Monitor *mon, const QDict *qdict)
    qmp_drive_mirror(device, filename, !!format, format,
                     full ? MIRROR_SYNC_MODE_FULL : MIRROR_SYNC_MODE_TOP,
                     true, mode, false, 0, false, 0, false, 0,
-                     false, 0, false, 0, &errp);
+                     false, 0, false, 0, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_drive_backup(Monitor *mon, const QDict *qdict)
@@ -934,11 +939,11 @@ void hmp_drive_backup(Monitor *mon, const QDict *qdict)
    int reuse = qdict_get_try_bool(qdict, "reuse", 0);
    int full = qdict_get_try_bool(qdict, "full", 0);
    enum NewImageMode mode;
-    Error *errp = NULL;
+    Error *err = NULL;
    if (!filename) {
-        error_set(&errp, QERR_MISSING_PARAMETER, "target");
+        error_set(&err, QERR_MISSING_PARAMETER, "target");
-        hmp_handle_error(mon, &errp);
+        hmp_handle_error(mon, &err);
        return;
    }
@@ -950,8 +955,8 @@ void hmp_drive_backup(Monitor *mon, const QDict *qdict)
    qmp_drive_backup(device, filename, !!format, format,
                     full ? MIRROR_SYNC_MODE_FULL : MIRROR_SYNC_MODE_TOP,
-                     true, mode, false, 0, false, 0, false, 0, &errp);
+                     true, mode, false, 0, false, 0, false, 0, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_snapshot_blkdev(Monitor *mon, const QDict *qdict)
@@ -961,13 +966,13 @@ void hmp_snapshot_blkdev(Monitor *mon, const QDict *qdict)
    const char *format = qdict_get_try_str(qdict, "format");
    int reuse = qdict_get_try_bool(qdict, "reuse", 0);
    enum NewImageMode mode;
-    Error *errp = NULL;
+    Error *err = NULL;
    if (!filename) {
        /* In the future, if 'snapshot-file' is not specified, the snapshot
           will be taken internally. Today it's actually required. */
-        error_set(&errp, QERR_MISSING_PARAMETER, "snapshot-file");
+        error_set(&err, QERR_MISSING_PARAMETER, "snapshot-file");
-        hmp_handle_error(mon, &errp);
+        hmp_handle_error(mon, &err);
        return;
    }
@@ -975,18 +980,18 @@ void hmp_snapshot_blkdev(Monitor *mon, const QDict *qdict)
    qmp_blockdev_snapshot_sync(true, device, false, NULL,
                               filename, false, NULL,
                               !!format, format,
-                               true, mode, &errp);
+                               true, mode, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_snapshot_blkdev_internal(Monitor *mon, const QDict *qdict)
 {
    const char *device = qdict_get_str(qdict, "device");
    const char *name = qdict_get_str(qdict, "name");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_blockdev_snapshot_internal_sync(device, name, &errp);
+    qmp_blockdev_snapshot_internal_sync(device, name, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_snapshot_delete_blkdev_internal(Monitor *mon, const QDict *qdict)
@@ -994,11 +999,11 @@ void hmp_snapshot_delete_blkdev_internal(Monitor *mon, const QDict *qdict)
    const char *device = qdict_get_str(qdict, "device");
    const char *name = qdict_get_str(qdict, "name");
    const char *id = qdict_get_try_str(qdict, "id");
-    Error *errp = NULL;
+    Error *err = NULL;
    qmp_blockdev_snapshot_delete_internal_sync(device, !!id, id,
-                                               true, name, &errp);
+                                               true, name, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_migrate_cancel(Monitor *mon, const QDict *qdict)
@@ -1306,18 +1311,37 @@ void hmp_device_del(Monitor *mon, const QDict *qdict)
 void hmp_dump_guest_memory(Monitor *mon, const QDict *qdict)
 {
-    Error *errp = NULL;
+    Error *err = NULL;
    int paging = qdict_get_try_bool(qdict, "paging", 0);
    int zlib = qdict_get_try_bool(qdict, "zlib", 0);
    int lzo = qdict_get_try_bool(qdict, "lzo", 0);
    int snappy = qdict_get_try_bool(qdict, "snappy", 0);
    const char *file = qdict_get_str(qdict, "filename");
    bool has_begin = qdict_haskey(qdict, "begin");
    bool has_length = qdict_haskey(qdict, "length");
    /* kdump-compressed format is not supported for HMP */
    bool has_format = false;
    int64_t begin = 0;
    int64_t length = 0;
    enum DumpGuestMemoryFormat dump_format = DUMP_GUEST_MEMORY_FORMAT_ELF;
    char *prot;
    if (zlib + lzo + snappy > 1) {
        error_setg(&err, "only one of '-z|-l|-s' can be set");
        hmp_handle_error(mon, &err);
        return;
    }
    if (zlib) {
        dump_format = DUMP_GUEST_MEMORY_FORMAT_KDUMP_ZLIB;
    }
    if (lzo) {
        dump_format = DUMP_GUEST_MEMORY_FORMAT_KDUMP_LZO;
    }
    if (snappy) {
        dump_format = DUMP_GUEST_MEMORY_FORMAT_KDUMP_SNAPPY;
    }
    if (has_begin) {
        begin = qdict_get_int(qdict, "begin");
    }
@@ -1328,8 +1352,8 @@ void hmp_dump_guest_memory(Monitor *mon, const QDict *qdict)
    prot = g_strconcat("file:", file, NULL);
    qmp_dump_guest_memory(paging, prot, has_begin, begin, has_length, length,
-                          has_format, dump_format, &errp);
+                          true, dump_format, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
    g_free(prot);
 }
@@ -1421,19 +1445,19 @@ out:
 void hmp_getfd(Monitor *mon, const QDict *qdict)
 {
    const char *fdname = qdict_get_str(qdict, "fdname");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_getfd(fdname, &errp);
+    qmp_getfd(fdname, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_closefd(Monitor *mon, const QDict *qdict)
 {
    const char *fdname = qdict_get_str(qdict, "fdname");
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_closefd(fdname, &errp);
+    qmp_closefd(fdname, &err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_send_key(Monitor *mon, const QDict *qdict)
@@ -1583,10 +1607,10 @@ void hmp_nbd_server_add(Monitor *mon, const QDict *qdict)
 void hmp_nbd_server_stop(Monitor *mon, const QDict *qdict)
 {
-    Error *errp = NULL;
+    Error *err = NULL;
-    qmp_nbd_server_stop(&errp);
+    qmp_nbd_server_stop(&err);
-    hmp_handle_error(mon, &errp);
+    hmp_handle_error(mon, &err);
 }
 void hmp_cpu_add(Monitor *mon, const QDict *qdict)
--- a/hmp.h
+++ b/hmp.h
@@ -15,6 +15,7 @@
 #define HMP_H
 #include "qemu-common.h"
 #include "qemu/readline.h"
 #include "qapi-types.h"
 #include "qapi/qmp/qdict.h"
@@ -92,5 +93,9 @@ void hmp_qemu_io(Monitor *mon, const QDict *qdict);
 void hmp_cpu_add(Monitor *mon, const QDict *qdict);
 void hmp_object_add(Monitor *mon, const QDict *qdict);
 void hmp_object_del(Monitor *mon, const QDict *qdict);
 void object_add_completion(ReadLineState *rs, int nb_args, const char *str);
 void object_del_completion(ReadLineState *rs, int nb_args, const char *str);
 void device_add_completion(ReadLineState *rs, int nb_args, const char *str);
 void device_del_completion(ReadLineState *rs, int nb_args, const char *str);
 #endif
--- a/hw/9pfs/virtio-9p-local.c
+++ b/hw/9pfs/virtio-9p-local.c
@@ -14,6 +14,7 @@
 #include "hw/virtio/virtio.h"
 #include "virtio-9p.h"
 #include "virtio-9p-xattr.h"
 #include "fsdev/qemu-fsdev.h"   /* local_ops */
 #include <arpa/inet.h>
 #include <pwd.h>
 #include <grp.h>
--- a/hw/9pfs/virtio-9p-synth.c
+++ b/hw/9pfs/virtio-9p-synth.c
@@ -21,7 +21,7 @@
 #include <sys/stat.h>
 /* Root node for synth file system */
-V9fsSynthNode v9fs_synth_root = {
+static V9fsSynthNode v9fs_synth_root = {
    .name = "/",
    .actual_attr = {
        .mode = 0555 | S_IFDIR,
--- a/hw/9pfs/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -987,8 +987,9 @@ static void v9fs_attach(void *opaque)
     */
    if (!s->migration_blocker) {
        s->root_fid = fid;
-        error_set(&s->migration_blocker, QERR_VIRTFS_FEATURE_BLOCKS_MIGRATION,
+        error_setg(&s->migration_blocker,
-                  s->ctx.fs_root ? s->ctx.fs_root : "NULL", s->tag);
+                   "Migration is disabled when VirtFS export path '%s' is mounted in the guest using mount_tag '%s'",
                   s->ctx.fs_root ? s->ctx.fs_root : "NULL", s->tag);
        migrate_add_blocker(s->migration_blocker);
    }
 out:
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -63,16 +63,18 @@ typedef struct AcpiPciHpFind {
 static int acpi_pcihp_get_bsel(PCIBus *bus)
 {
-    QObject *o = object_property_get_qobject(OBJECT(bus),
+    Error *local_err = NULL;
-                                             ACPI_PCIHP_PROP_BSEL, NULL);
+    int64_t bsel = object_property_get_int(OBJECT(bus), ACPI_PCIHP_PROP_BSEL,
-    int64_t bsel = -1;
+                                           &local_err);
-    if (o) {
+
-        bsel = qint_get_int(qobject_to_qint(o));
+    if (local_err || bsel < 0 || bsel >= ACPI_PCIHP_MAX_HOTPLUG_BUS) {
-    }
+        if (local_err) {
-    if (bsel < 0) {
+            error_free(local_err);
        }
        return -1;
    } else {
        return bsel;
    }
    return bsel;
 }
 static void acpi_pcihp_test_hotplug_bus(PCIBus *bus, void *opaque)
--- a/hw/arm/cubieboard.c
+++ b/hw/arm/cubieboard.c
@@ -43,6 +43,19 @@ static void cubieboard_init(QEMUMachineInitArgs *args)
        exit(1);
    }
    object_property_set_int(OBJECT(&s->a10->timer), 32768, "clk0-freq", &err);
    if (err != NULL) {
        error_report("Couldn't set clk0 frequency: %s", error_get_pretty(err));
        exit(1);
    }
    object_property_set_int(OBJECT(&s->a10->timer), 24000000, "clk1-freq",
                            &err);
    if (err != NULL) {
        error_report("Couldn't set clk1 frequency: %s", error_get_pretty(err));
        exit(1);
    }
    object_property_set_bool(OBJECT(s->a10), true, "realized", &err);
    if (err != NULL) {
        error_report("Couldn't realize Allwinner A10: %s",
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -732,7 +732,7 @@ static void pxa2xx_ssp_save(QEMUFile *f, void *opaque)
 static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)
 {
    PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;
-    int i;
+    int i, v;
    s->enable = qemu_get_be32(f);
@@ -746,7 +746,11 @@ static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)
    qemu_get_8s(f, &s->ssrsa);
    qemu_get_8s(f, &s->ssacd);
-    s->rx_level = qemu_get_byte(f);
+    v = qemu_get_byte(f);
    if (v < 0 || v > ARRAY_SIZE(s->rx_fifo)) {
        return -EINVAL;
    }
    s->rx_level = v;
    s->rx_start = 0;
    for (i = 0; i < s->rx_level; i ++)
        s->rx_fifo[i] = qemu_get_byte(f);
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -75,8 +75,6 @@ typedef struct MemMapEntry {
 typedef struct VirtBoardInfo {
    struct arm_boot_info bootinfo;
    const char *cpu_model;
    const char *qdevname;
    const char *gic_compatible;
    const MemMapEntry *memmap;
    const int *irqmap;
    int smp_cpus;
@@ -98,10 +96,10 @@ typedef struct VirtBoardInfo {
 static const MemMapEntry a15memmap[] = {
    /* Space up to 0x8000000 is reserved for a boot ROM */
    [VIRT_FLASH] = { 0, 0x8000000 },
-    [VIRT_CPUPERIPHS] = { 0x8000000, 0x8000 },
+    [VIRT_CPUPERIPHS] = { 0x8000000, 0x20000 },
    /* GIC distributor and CPU interfaces sit inside the CPU peripheral space */
-    [VIRT_GIC_DIST] = { 0x8001000, 0x1000 },
+    [VIRT_GIC_DIST] = { 0x8000000, 0x10000 },
-    [VIRT_GIC_CPU] = { 0x8002000, 0x1000 },
+    [VIRT_GIC_CPU] = { 0x8010000, 0x10000 },
    [VIRT_UART] = { 0x9000000, 0x1000 },
    [VIRT_MMIO] = { 0xa000000, 0x200 },
    /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
@@ -117,16 +115,16 @@ static const int a15irqmap[] = {
 static VirtBoardInfo machines[] = {
    {
        .cpu_model = "cortex-a15",
-        .qdevname = "a15mpcore_priv",
+        .memmap = a15memmap,
-        .gic_compatible = "arm,cortex-a15-gic",
+        .irqmap = a15irqmap,
    },
    {
        .cpu_model = "cortex-a57",
        .memmap = a15memmap,
        .irqmap = a15irqmap,
    },
    {
        .cpu_model = "host",
        /* We use the A15 private peripheral model to get a V2 GIC */
        .qdevname = "a15mpcore_priv",
        .gic_compatible = "arm,cortex-a15-gic",
        .memmap = a15memmap,
        .irqmap = a15irqmap,
    },
@@ -251,8 +249,9 @@ static void fdt_add_gic_node(const VirtBoardInfo *vbi)
    qemu_fdt_setprop_cell(vbi->fdt, "/", "interrupt-parent", gic_phandle);
    qemu_fdt_add_subnode(vbi->fdt, "/intc");
    /* 'cortex-a15-gic' means 'GIC v2' */
    qemu_fdt_setprop_string(vbi->fdt, "/intc", "compatible",
-                                vbi->gic_compatible);
+                            "arm,cortex-a15-gic");
    qemu_fdt_setprop_cell(vbi->fdt, "/intc", "#interrupt-cells", 3);
    qemu_fdt_setprop(vbi->fdt, "/intc", "interrupt-controller", NULL, 0);
    qemu_fdt_setprop_sized_cells(vbi->fdt, "/intc", "reg",
@@ -263,6 +262,56 @@ static void fdt_add_gic_node(const VirtBoardInfo *vbi)
    qemu_fdt_setprop_cell(vbi->fdt, "/intc", "phandle", gic_phandle);
 }
 static void create_gic(const VirtBoardInfo *vbi, qemu_irq *pic)
 {
    /* We create a standalone GIC v2 */
    DeviceState *gicdev;
    SysBusDevice *gicbusdev;
    const char *gictype = "arm_gic";
    int i;
    if (kvm_irqchip_in_kernel()) {
        gictype = "kvm-arm-gic";
    }
    gicdev = qdev_create(NULL, gictype);
    qdev_prop_set_uint32(gicdev, "revision", 2);
    qdev_prop_set_uint32(gicdev, "num-cpu", smp_cpus);
    /* Note that the num-irq property counts both internal and external
     * interrupts; there are always 32 of the former (mandated by GIC spec).
     */
    qdev_prop_set_uint32(gicdev, "num-irq", NUM_IRQS + 32);
    qdev_init_nofail(gicdev);
    gicbusdev = SYS_BUS_DEVICE(gicdev);
    sysbus_mmio_map(gicbusdev, 0, vbi->memmap[VIRT_GIC_DIST].base);
    sysbus_mmio_map(gicbusdev, 1, vbi->memmap[VIRT_GIC_CPU].base);
    /* Wire the outputs from each CPU's generic timer to the
     * appropriate GIC PPI inputs, and the GIC's IRQ output to
     * the CPU's IRQ input.
     */
    for (i = 0; i < smp_cpus; i++) {
        DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
        int ppibase = NUM_IRQS + i * 32;
        /* physical timer; we wire it up to the non-secure timer's ID,
         * since a real A15 always has TrustZone but QEMU doesn't.
         */
        qdev_connect_gpio_out(cpudev, 0,
                              qdev_get_gpio_in(gicdev, ppibase + 30));
        /* virtual timer */
        qdev_connect_gpio_out(cpudev, 1,
                              qdev_get_gpio_in(gicdev, ppibase + 27));
        sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
    }
    for (i = 0; i < NUM_IRQS; i++) {
        pic[i] = qdev_get_gpio_in(gicdev, i);
    }
    fdt_add_gic_node(vbi);
 }
 static void create_uart(const VirtBoardInfo *vbi, qemu_irq *pic)
 {
    char *nodename;
@@ -340,8 +389,6 @@ static void machvirt_init(QEMUMachineInitArgs *args)
    MemoryRegion *sysmem = get_system_memory();
    int n;
    MemoryRegion *ram = g_new(MemoryRegion, 1);
    DeviceState *dev;
    SysBusDevice *busdev;
    const char *cpu_model = args->cpu_model;
    VirtBoardInfo *vbi;
@@ -404,25 +451,7 @@ static void machvirt_init(QEMUMachineInitArgs *args)
    vmstate_register_ram_global(ram);
    memory_region_add_subregion(sysmem, vbi->memmap[VIRT_MEM].base, ram);
-    dev = qdev_create(NULL, vbi->qdevname);
+    create_gic(vbi, pic);
    qdev_prop_set_uint32(dev, "num-cpu", smp_cpus);
    /* Note that the num-irq property counts both internal and external
     * interrupts; there are always 32 of the former (mandated by GIC spec).
     */
    qdev_prop_set_uint32(dev, "num-irq", NUM_IRQS + 32);
    qdev_init_nofail(dev);
    busdev = SYS_BUS_DEVICE(dev);
    sysbus_mmio_map(busdev, 0, vbi->memmap[VIRT_CPUPERIPHS].base);
    fdt_add_gic_node(vbi);
    for (n = 0; n < smp_cpus; n++) {
        DeviceState *cpudev = DEVICE(qemu_get_cpu(n));
        sysbus_connect_irq(busdev, n, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
    }
    for (n = 0; n < NUM_IRQS; n++) {
        pic[n] = qdev_get_gpio_in(dev, n);
    }
    create_uart(vbi, pic);
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -86,6 +86,7 @@ typedef struct {
 #ifndef HAS_YMF262
    FM_OPL *opl;
 #endif
    PortioList port_list;
 } AdlibState;
 static AdlibState *glob_adlib;
@@ -293,7 +294,6 @@ static MemoryRegionPortio adlib_portio_list[] = {
 static void adlib_realizefn (DeviceState *dev, Error **errp)
 {
    AdlibState *s = ADLIB(dev);
    PortioList *port_list = g_new(PortioList, 1);
    struct audsettings as;
    if (glob_adlib) {
@@ -349,8 +349,8 @@ static void adlib_realizefn (DeviceState *dev, Error **errp)
    adlib_portio_list[0].offset = s->port;
    adlib_portio_list[1].offset = s->port + 8;
-    portio_list_init (port_list, OBJECT(s), adlib_portio_list, s, "adlib");
+    portio_list_init (&s->port_list, OBJECT(s), adlib_portio_list, s, "adlib");
-    portio_list_add (port_list, isa_address_space_io(&s->parent_obj), 0);
+    portio_list_add (&s->port_list, isa_address_space_io(&s->parent_obj), 0);
 }
 static Property adlib_properties[] = {
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -261,6 +261,9 @@ static void hda_audio_set_amp(HDAAudioStream *st)
    left = left * 255 / QEMU_HDA_AMP_STEPS;
    right = right * 255 / QEMU_HDA_AMP_STEPS;
    if (!st->state->mixer) {
        return;
    }
    if (st->output) {
        AUD_set_volume_out(st->voice.out, muted, left, right);
    } else {
--- a/hw/block/xen_blkif.h
+++ b/hw/block/xen_blkif.h
@@ -79,6 +79,12 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
 	if (src->operation == BLKIF_OP_DISCARD) {
 		struct blkif_request_discard *s = (void *)src;
 		struct blkif_request_discard *d = (void *)dst;
 		d->nr_sectors = s->nr_sectors;
 		return;
 	}
 	if (n > src->nr_segments)
 		n = src->nr_segments;
 	for (i = 0; i < n; i++)
@@ -94,6 +100,12 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
 	if (src->operation == BLKIF_OP_DISCARD) {
 		struct blkif_request_discard *s = (void *)src;
 		struct blkif_request_discard *d = (void *)dst;
 		d->nr_sectors = s->nr_sectors;
 		return;
 	}
 	if (n > src->nr_segments)
 		n = src->nr_segments;
 	for (i = 0; i < n; i++)
--- a/hw/block/xen_disk.c
+++ b/hw/block/xen_disk.c
@@ -114,6 +114,7 @@ struct XenBlkDev {
    int                 requests_finished;
    /* Persistent grants extension */
    gboolean            feature_discard;
    gboolean            feature_persistent;
    GTree               *persistent_gnts;
    unsigned int        persistent_gnt_count;
@@ -253,6 +254,8 @@ static int ioreq_parse(struct ioreq *ioreq)
    case BLKIF_OP_WRITE:
        ioreq->prot = PROT_READ; /* from memory */
        break;
    case BLKIF_OP_DISCARD:
        return 0;
    default:
        xen_be_printf(&blkdev->xendev, 0, "error: unknown operation (%d)\n",
                      ioreq->req.operation);
@@ -492,6 +495,7 @@ static void qemu_aio_complete(void *opaque, int ret)
    case BLKIF_OP_READ:
        bdrv_acct_done(ioreq->blkdev->bs, &ioreq->acct);
        break;
    case BLKIF_OP_DISCARD:
    default:
        break;
    }
@@ -532,6 +536,15 @@ static int ioreq_runio_qemu_aio(struct ioreq *ioreq)
                        &ioreq->v, ioreq->v.size / BLOCK_SIZE,
                        qemu_aio_complete, ioreq);
        break;
    case BLKIF_OP_DISCARD:
    {
        struct blkif_request_discard *discard_req = (void *)&ioreq->req;
        ioreq->aio_inflight++;
        bdrv_aio_discard(blkdev->bs,
                        discard_req->sector_number, discard_req->nr_sectors,
                        qemu_aio_complete, ioreq);
        break;
    }
    default:
        /* unknown operation (shouldn't happen -- parse catches this) */
        goto err;
@@ -710,6 +723,21 @@ static void blk_alloc(struct XenDevice *xendev)
    }
 }
 static void blk_parse_discard(struct XenBlkDev *blkdev)
 {
    int enable;
    blkdev->feature_discard = true;
    if (xenstore_read_be_int(&blkdev->xendev, "discard-enable", &enable) == 0) {
        blkdev->feature_discard = !!enable;
    }
    if (blkdev->feature_discard) {
        xenstore_write_be_int(&blkdev->xendev, "feature-discard", 1);
    }
 }
 static int blk_init(struct XenDevice *xendev)
 {
    struct XenBlkDev *blkdev = container_of(xendev, struct XenBlkDev, xendev);
@@ -777,6 +805,8 @@ static int blk_init(struct XenDevice *xendev)
    xenstore_write_be_int(&blkdev->xendev, "feature-persistent", 1);
    xenstore_write_be_int(&blkdev->xendev, "info", info);
    blk_parse_discard(blkdev);
    g_free(directiosafe);
    return 0;
@@ -812,16 +842,22 @@ static int blk_connect(struct XenDevice *xendev)
        qflags |= BDRV_O_RDWR;
        readonly = false;
    }
    if (blkdev->feature_discard) {
        qflags |= BDRV_O_UNMAP;
    }
    /* init qemu block driver */
    index = (blkdev->xendev.dev - 202 * 256) / 16;
    blkdev->dinfo = drive_get(IF_XEN, 0, index);
    if (!blkdev->dinfo) {
        Error *local_err = NULL;
        /* setup via xenbus -> create new block driver instance */
        xen_be_printf(&blkdev->xendev, 2, "create new bdrv (xenbus setup)\n");
-        blkdev->bs = bdrv_new(blkdev->dev);
+        blkdev->bs = bdrv_new(blkdev->dev, &local_err);
        if (local_err) {
            blkdev->bs = NULL;
        }
        if (blkdev->bs) {
            Error *local_err = NULL;
            BlockDriver *drv = bdrv_find_whitelisted_format(blkdev->fileproto,
                                                           readonly);
            if (bdrv_open(&blkdev->bs, blkdev->filename, NULL, NULL, qflags,
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -338,13 +338,13 @@ PropertyInfo qdev_prop_vlan = {
 int qdev_prop_set_drive(DeviceState *dev, const char *name,
                        BlockDriverState *value)
 {
-    Error *errp = NULL;
+    Error *err = NULL;
    const char *bdrv_name = value ? bdrv_get_device_name(value) : "";
    object_property_set_str(OBJECT(dev), bdrv_name,
-                            name, &errp);
+                            name, &err);
-    if (errp) {
+    if (err) {
-        qerror_report_err(errp);
+        qerror_report_err(err);
-        error_free(errp);
+        error_free(err);
        return -1;
    }
    return 0;
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -587,8 +587,9 @@ static void set_blocksize(Object *obj, Visitor *v, void *opaque,
    /* We rely on power-of-2 blocksizes for bitmasks */
    if ((value & (value - 1)) != 0) {
-        error_set(errp, QERR_PROPERTY_VALUE_NOT_POWER_OF_2,
+        error_setg(errp,
-                  dev->id?:"", name, (int64_t)value);
+                  "Property %s.%s doesn't take value '%" PRId64 "', it's not a power of 2",
                  dev->id ?: "", name, (int64_t)value);
        return;
    }
@@ -750,6 +751,7 @@ static void set_prop_arraylen(Object *obj, Visitor *v, void *opaque,
    Property *prop = opaque;
    uint32_t *alenptr = qdev_get_prop_ptr(dev, prop);
    void **arrayptr = (void *)dev + prop->arrayoffset;
    Error *local_err = NULL;
    void *eltptr;
    const char *arrayname;
    int i;
@@ -763,8 +765,9 @@ static void set_prop_arraylen(Object *obj, Visitor *v, void *opaque,
                   name);
        return;
    }
-    visit_type_uint32(v, alenptr, name, errp);
+    visit_type_uint32(v, alenptr, name, &local_err);
-    if (error_is_set(errp)) {
+    if (local_err) {
        error_propagate(errp, local_err);
        return;
    }
    if (!*alenptr) {
@@ -801,8 +804,9 @@ static void set_prop_arraylen(Object *obj, Visitor *v, void *opaque,
                            arrayprop->prop.info->get,
                            arrayprop->prop.info->set,
                            array_element_release,
-                            arrayprop, errp);
+                            arrayprop, &local_err);
-        if (error_is_set(errp)) {
+        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
    }
@@ -853,7 +857,7 @@ void error_set_from_qdev_prop_error(Error **errp, int ret, DeviceState *dev,
 {
    switch (ret) {
    case -EEXIST:
-        error_set(errp, QERR_PROPERTY_VALUE_IN_USE,
+        error_setg(errp, "Property '%s.%s' can't take value '%s', it's in use",
                  object_get_typename(OBJECT(dev)), prop->name, value);
        break;
    default:
@@ -862,7 +866,7 @@ void error_set_from_qdev_prop_error(Error **errp, int ret, DeviceState *dev,
                  object_get_typename(OBJECT(dev)), prop->name, value);
        break;
    case -ENOENT:
-        error_set(errp, QERR_PROPERTY_VALUE_NOT_FOUND,
+        error_setg(errp, "Property '%s.%s' can't find value '%s'",
                  object_get_typename(OBJECT(dev)), prop->name, value);
        break;
    case 0:
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -174,14 +174,14 @@ int qdev_init(DeviceState *dev)
    return 0;
 }
-static void device_realize(DeviceState *dev, Error **err)
+static void device_realize(DeviceState *dev, Error **errp)
 {
    DeviceClass *dc = DEVICE_GET_CLASS(dev);
    if (dc->init) {
        int rc = dc->init(dev);
        if (rc < 0) {
-            error_setg(err, "Device initialization failed.");
+            error_setg(errp, "Device initialization failed.");
            return;
        }
    }
@@ -504,14 +504,14 @@ static void bus_unparent(Object *obj)
    }
 }
-static bool bus_get_realized(Object *obj, Error **err)
+static bool bus_get_realized(Object *obj, Error **errp)
 {
    BusState *bus = BUS(obj);
    return bus->realized;
 }
-static void bus_set_realized(Object *obj, bool value, Error **err)
+static void bus_set_realized(Object *obj, bool value, Error **errp)
 {
    BusState *bus = BUS(obj);
    BusClass *bc = BUS_GET_CLASS(bus);
@@ -540,7 +540,7 @@ static void bus_set_realized(Object *obj, bool value, Error **err)
    return;
 error:
-    error_propagate(err, local_err);
+    error_propagate(errp, local_err);
 }
 void qbus_create_inplace(void *bus, size_t size, const char *typename,
@@ -660,8 +660,8 @@ static void qdev_get_legacy_property(Object *obj, Visitor *v, void *opaque,
 * Legacy properties are string versions of other OOM properties.  The format
 * of the string depends on the property type.
 */
-void qdev_property_add_legacy(DeviceState *dev, Property *prop,
+static void qdev_property_add_legacy(DeviceState *dev, Property *prop,
-                              Error **errp)
+                                     Error **errp)
 {
    gchar *name;
@@ -724,13 +724,13 @@ void qdev_property_add_static(DeviceState *dev, Property *prop,
    }
 }
-static bool device_get_realized(Object *obj, Error **err)
+static bool device_get_realized(Object *obj, Error **errp)
 {
    DeviceState *dev = DEVICE(obj);
    return dev->realized;
 }
-static void device_set_realized(Object *obj, bool value, Error **err)
+static void device_set_realized(Object *obj, bool value, Error **errp)
 {
    DeviceState *dev = DEVICE(obj);
    DeviceClass *dc = DEVICE_GET_CLASS(dev);
@@ -738,7 +738,7 @@ static void device_set_realized(Object *obj, bool value, Error **err)
    Error *local_err = NULL;
    if (dev->hotplugged && !dc->hotpluggable) {
-        error_set(err, QERR_DEVICE_NO_HOTPLUG, object_get_typename(obj));
+        error_set(errp, QERR_DEVICE_NO_HOTPLUG, object_get_typename(obj));
        return;
    }
@@ -797,14 +797,14 @@ static void device_set_realized(Object *obj, bool value, Error **err)
    }
    if (local_err != NULL) {
-        error_propagate(err, local_err);
+        error_propagate(errp, local_err);
        return;
    }
    dev->realized = value;
 }
-static bool device_get_hotpluggable(Object *obj, Error **err)
+static bool device_get_hotpluggable(Object *obj, Error **errp)
 {
    DeviceClass *dc = DEVICE_GET_CLASS(obj);
    DeviceState *dev = DEVICE(obj);
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2913,7 +2913,7 @@ static void isa_cirrus_vga_realizefn(DeviceState *dev, Error **errp)
    ISACirrusVGAState *d = ISA_CIRRUS_VGA(dev);
    VGACommonState *s = &d->cirrus_vga.vga;
-    vga_common_init(s, OBJECT(dev));
+    vga_common_init(s, OBJECT(dev), true);
    cirrus_init_common(&d->cirrus_vga, OBJECT(dev), CIRRUS_ID_CLGD5430, 0,
                       isa_address_space(isadev),
                       isa_address_space_io(isadev));
@@ -2960,7 +2960,7 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
     int16_t device_id = pc->device_id;
     /* setup VGA */
-     vga_common_init(&s->vga, OBJECT(dev));
+     vga_common_init(&s->vga, OBJECT(dev), true);
     cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
                        pci_address_space_io(dev));
     s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2055,19 +2055,18 @@ static int qxl_init_primary(PCIDevice *dev)
 {
    PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev);
    VGACommonState *vga = &qxl->vga;
    PortioList *qxl_vga_port_list = g_new(PortioList, 1);
    int rc;
    qxl->id = 0;
    qxl_init_ramsize(qxl);
    vga->vram_size_mb = qxl->vga.vram_size >> 20;
-    vga_common_init(vga, OBJECT(dev));
+    vga_common_init(vga, OBJECT(dev), true);
    vga_init(vga, OBJECT(dev),
             pci_address_space(dev), pci_address_space_io(dev), false);
-    portio_list_init(qxl_vga_port_list, OBJECT(dev), qxl_vga_portio_list,
+    portio_list_init(&qxl->vga_port_list, OBJECT(dev), qxl_vga_portio_list,
                     vga, "vga");
-    portio_list_set_flush_coalesced(qxl_vga_port_list);
+    portio_list_set_flush_coalesced(&qxl->vga_port_list);
-    portio_list_add(qxl_vga_port_list, pci_address_space_io(dev), 0x3b0);
+    portio_list_add(&qxl->vga_port_list, pci_address_space_io(dev), 0x3b0);
    vga->con = graphic_console_init(DEVICE(dev), 0, &qxl_ops, qxl);
    qemu_spice_display_init_common(&qxl->ssd);
--- a/hw/display/qxl.h
+++ b/hw/display/qxl.h
@@ -32,6 +32,7 @@ enum qxl_mode {
 typedef struct PCIQXLDevice {
    PCIDevice          pci;
    PortioList         vga_port_list;
    SimpleSpiceDisplay ssd;
    int                id;
    uint32_t           debug;
--- a/hw/display/ssd0323.c
+++ b/hw/display/ssd0323.c
@@ -312,18 +312,42 @@ static int ssd0323_load(QEMUFile *f, void *opaque, int version_id)
        return -EINVAL;
    s->cmd_len = qemu_get_be32(f);
    if (s->cmd_len < 0 || s->cmd_len > ARRAY_SIZE(s->cmd_data)) {
        return -EINVAL;
    }
    s->cmd = qemu_get_be32(f);
    for (i = 0; i < 8; i++)
        s->cmd_data[i] = qemu_get_be32(f);
    s->row = qemu_get_be32(f);
    if (s->row < 0 || s->row >= 80) {
        return -EINVAL;
    }
    s->row_start = qemu_get_be32(f);
    if (s->row_start < 0 || s->row_start >= 80) {
        return -EINVAL;
    }
    s->row_end = qemu_get_be32(f);
    if (s->row_end < 0 || s->row_end >= 80) {
        return -EINVAL;
    }
    s->col = qemu_get_be32(f);
    if (s->col < 0 || s->col >= 64) {
        return -EINVAL;
    }
    s->col_start = qemu_get_be32(f);
    if (s->col_start < 0 || s->col_start >= 64) {
        return -EINVAL;
    }
    s->col_end = qemu_get_be32(f);
    if (s->col_end < 0 || s->col_end >= 64) {
        return -EINVAL;
    }
    s->redraw = qemu_get_be32(f);
    s->remap = qemu_get_be32(f);
    s->mode = qemu_get_be32(f);
    if (s->mode != SSD0323_CMD && s->mode != SSD0323_DATA) {
        return -EINVAL;
    }
    qemu_get_buffer(f, s->framebuffer, sizeof(s->framebuffer));
    ss->cs = qemu_get_be32(f);
--- a/hw/display/vga-isa-mm.c
+++ b/hw/display/vga-isa-mm.c
@@ -132,7 +132,7 @@ int isa_vga_mm_init(hwaddr vram_base,
    s = g_malloc0(sizeof(*s));
    s->vga.vram_size_mb = VGA_RAM_SIZE >> 20;
-    vga_common_init(&s->vga, NULL);
+    vga_common_init(&s->vga, NULL, true);
    vga_mm_init(s, vram_base, ctrl_base, it_shift, address_space);
    s->vga.con = graphic_console_init(NULL, 0, s->vga.hw_ops, s);
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -56,7 +56,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
    MemoryRegion *vga_io_memory;
    const MemoryRegionPortio *vga_ports, *vbe_ports;
-    vga_common_init(s, OBJECT(dev));
+    vga_common_init(s, OBJECT(dev), true);
    s->legacy_address_space = isa_address_space(isadev);
    vga_io_memory = vga_init_io(s, OBJECT(dev), &vga_ports, &vbe_ports);
    isa_register_portio_list(isadev, 0x3b0, vga_ports, s, "vga");
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -147,7 +147,7 @@ static int pci_std_vga_initfn(PCIDevice *dev)
    VGACommonState *s = &d->vga;
    /* vga + console init */
-    vga_common_init(s, OBJECT(dev));
+    vga_common_init(s, OBJECT(dev), true);
    vga_init(s, OBJECT(dev), pci_address_space(dev), pci_address_space_io(dev),
             true);
@@ -179,12 +179,51 @@ static int pci_std_vga_initfn(PCIDevice *dev)
    return 0;
 }
 static int pci_secondary_vga_initfn(PCIDevice *dev)
 {
    PCIVGAState *d = DO_UPCAST(PCIVGAState, dev, dev);
    VGACommonState *s = &d->vga;
    /* vga + console init */
    vga_common_init(s, OBJECT(dev), false);
    s->con = graphic_console_init(DEVICE(dev), 0, s->hw_ops, s);
    /* mmio bar */
    memory_region_init(&d->mmio, OBJECT(dev), "vga.mmio", 4096);
    memory_region_init_io(&d->ioport, OBJECT(dev), &pci_vga_ioport_ops, d,
                          "vga ioports remapped", PCI_VGA_IOPORT_SIZE);
    memory_region_init_io(&d->bochs, OBJECT(dev), &pci_vga_bochs_ops, d,
                          "bochs dispi interface", PCI_VGA_BOCHS_SIZE);
    memory_region_add_subregion(&d->mmio, PCI_VGA_IOPORT_OFFSET,
                                &d->ioport);
    memory_region_add_subregion(&d->mmio, PCI_VGA_BOCHS_OFFSET,
                                &d->bochs);
    pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->vram);
    pci_register_bar(&d->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
    return 0;
 }
 static void pci_secondary_vga_reset(DeviceState *dev)
 {
    PCIVGAState *d = DO_UPCAST(PCIVGAState, dev.qdev, dev);
    vga_common_reset(&d->vga);
 }
 static Property vga_pci_properties[] = {
    DEFINE_PROP_UINT32("vgamem_mb", PCIVGAState, vga.vram_size_mb, 16),
    DEFINE_PROP_BIT("mmio", PCIVGAState, flags, PCI_VGA_FLAG_ENABLE_MMIO, true),
    DEFINE_PROP_END_OF_LIST(),
 };
 static Property secondary_pci_properties[] = {
    DEFINE_PROP_UINT32("vgamem_mb", PCIVGAState, vga.vram_size_mb, 16),
    DEFINE_PROP_END_OF_LIST(),
 };
 static void vga_class_init(ObjectClass *klass, void *data)
 {
    DeviceClass *dc = DEVICE_CLASS(klass);
@@ -201,6 +240,20 @@ static void vga_class_init(ObjectClass *klass, void *data)
    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 static void secondary_class_init(ObjectClass *klass, void *data)
 {
    DeviceClass *dc = DEVICE_CLASS(klass);
    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
    k->init = pci_secondary_vga_initfn;
    k->vendor_id = PCI_VENDOR_ID_QEMU;
    k->device_id = PCI_DEVICE_ID_QEMU_VGA;
    k->class_id = PCI_CLASS_DISPLAY_OTHER;
    dc->vmsd = &vmstate_vga_pci;
    dc->props = secondary_pci_properties;
    dc->reset = pci_secondary_vga_reset;
 }
 static const TypeInfo vga_info = {
    .name          = "VGA",
    .parent        = TYPE_PCI_DEVICE,
@@ -208,9 +261,17 @@ static const TypeInfo vga_info = {
    .class_init    = vga_class_init,
 };
 static const TypeInfo secondary_info = {
    .name          = "secondary-vga",
    .parent        = TYPE_PCI_DEVICE,
    .instance_size = sizeof(PCIVGAState),
    .class_init    = secondary_class_init,
 };
 static void vga_register_types(void)
 {
    type_register_static(&vga_info);
    type_register_static(&secondary_info);
 }
 type_init(vga_register_types)
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -171,6 +171,10 @@ static void vga_update_memory_access(VGACommonState *s)
    MemoryRegion *region, *old_region = s->chain4_alias;
    hwaddr base, offset, size;
    if (s->legacy_address_space == NULL) {
        return;
    }
    s->chain4_alias = NULL;
    if ((s->sr[VGA_SEQ_PLANE_WRITE] & VGA_SR02_ALL_PLANES) ==
@@ -2252,7 +2256,7 @@ static const GraphicHwOps vga_ops = {
    .text_update = vga_update_text,
 };
-void vga_common_init(VGACommonState *s, Object *obj)
+void vga_common_init(VGACommonState *s, Object *obj, bool global_vmstate)
 {
    int i, j, v, b;
@@ -2289,7 +2293,7 @@ void vga_common_init(VGACommonState *s, Object *obj)
    s->is_vbe_vmstate = 1;
    memory_region_init_ram(&s->vram, obj, "vga.vram", s->vram_size);
-    vmstate_register_ram_global(&s->vram);
+    vmstate_register_ram(&s->vram, global_vmstate ? NULL : DEVICE(obj));
    xen_register_framebuffer(&s->vram);
    s->vram_ptr = memory_region_get_ram_ptr(&s->vram);
    s->get_bpp = vga_get_bpp;
@@ -2351,8 +2355,6 @@ void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
 {
    MemoryRegion *vga_io_memory;
    const MemoryRegionPortio *vga_ports, *vbe_ports;
    PortioList *vga_port_list = g_new(PortioList, 1);
    PortioList *vbe_port_list = g_new(PortioList, 1);
    qemu_register_reset(vga_reset, s);
@@ -2367,13 +2369,13 @@ void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
                                        1);
    memory_region_set_coalescing(vga_io_memory);
    if (init_vga_ports) {
-        portio_list_init(vga_port_list, obj, vga_ports, s, "vga");
+        portio_list_init(&s->vga_port_list, obj, vga_ports, s, "vga");
-        portio_list_set_flush_coalesced(vga_port_list);
+        portio_list_set_flush_coalesced(&s->vga_port_list);
-        portio_list_add(vga_port_list, address_space_io, 0x3b0);
+        portio_list_add(&s->vga_port_list, address_space_io, 0x3b0);
    }
    if (vbe_ports) {
-        portio_list_init(vbe_port_list, obj, vbe_ports, s, "vbe");
+        portio_list_init(&s->vbe_port_list, obj, vbe_ports, s, "vbe");
-        portio_list_add(vbe_port_list, address_space_io, 0x1ce);
+        portio_list_add(&s->vbe_port_list, address_space_io, 0x1ce);
    }
 }
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -124,6 +124,8 @@ typedef struct VGACommonState {
    void (*get_resolution)(struct VGACommonState *s,
                        int *pwidth,
                        int *pheight);
    PortioList vga_port_list;
    PortioList vbe_port_list;
    /* bochs vbe state */
    uint16_t vbe_index;
    uint16_t vbe_regs[VBE_DISPI_INDEX_NB];
@@ -177,7 +179,7 @@ static inline int c6_to_8(int v)
    return (v << 2) | (b << 1) | b;
 }
-void vga_common_init(VGACommonState *s, Object *obj);
+void vga_common_init(VGACommonState *s, Object *obj, bool global_vmstate);
 void vga_init(VGACommonState *s, Object *obj, MemoryRegion *address_space,
              MemoryRegion *address_space_io, bool init_vga_ports);
 MemoryRegion *vga_init_io(VGACommonState *s, Object *obj,
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1207,7 +1207,7 @@ static void vmsvga_init(DeviceState *dev, struct vmsvga_state_s *s,
    vmstate_register_ram_global(&s->fifo_ram);
    s->fifo_ptr = memory_region_get_ram_ptr(&s->fifo_ram);
-    vga_common_init(&s->vga, OBJECT(dev));
+    vga_common_init(&s->vga, OBJECT(dev), true);
    vga_init(&s->vga, OBJECT(dev), address_space, io, true);
    vmstate_register(NULL, 0, &vmstate_vga_common, &s->vga);
    s->new_depth = 32;
--- a/hw/dma/i82374.c
+++ b/hw/dma/i82374.c
@@ -39,6 +39,7 @@ do { fprintf(stderr, "i82374 ERROR: " fmt , ## __VA_ARGS__); } while (0)
 typedef struct I82374State {
    uint8_t commands[8];
    qemu_irq out;
    PortioList port_list;
 } I82374State;
 static const VMStateDescription vmstate_i82374 = {
@@ -137,10 +138,10 @@ static void i82374_isa_realize(DeviceState *dev, Error **errp)
 {
    ISAi82374State *isa = I82374(dev);
    I82374State *s = &isa->state;
    PortioList *port_list = g_new(PortioList, 1);
-    portio_list_init(port_list, OBJECT(isa), i82374_portio_list, s, "i82374");
+    portio_list_init(&s->port_list, OBJECT(isa), i82374_portio_list, s,
-    portio_list_add(port_list, isa_address_space_io(&isa->parent_obj),
+                     "i82374");
    portio_list_add(&s->port_list, isa_address_space_io(&isa->parent_obj),
                    isa->iobase);
    i82374_realize(s, errp);
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -534,24 +534,24 @@ static void xilinx_axidma_realize(DeviceState *dev, Error **errp)
    XilinxAXIDMAStreamSlave *ds = XILINX_AXI_DMA_DATA_STREAM(&s->rx_data_dev);
    XilinxAXIDMAStreamSlave *cs = XILINX_AXI_DMA_CONTROL_STREAM(
                                                            &s->rx_control_dev);
-    Error *local_errp = NULL;
+    Error *local_err = NULL;
    object_property_add_link(OBJECT(ds), "dma", TYPE_XILINX_AXI_DMA,
                             (Object **)&ds->dma,
                             object_property_allow_set_link,
                             OBJ_PROP_LINK_UNREF_ON_RELEASE,
-                             &local_errp);
+                             &local_err);
    object_property_add_link(OBJECT(cs), "dma", TYPE_XILINX_AXI_DMA,
                             (Object **)&cs->dma,
                             object_property_allow_set_link,
                             OBJ_PROP_LINK_UNREF_ON_RELEASE,
-                             &local_errp);
+                             &local_err);
-    if (local_errp) {
+    if (local_err) {
        goto xilinx_axidma_realize_fail;
    }
-    object_property_set_link(OBJECT(ds), OBJECT(s), "dma", &local_errp);
+    object_property_set_link(OBJECT(ds), OBJECT(s), "dma", &local_err);
-    object_property_set_link(OBJECT(cs), OBJECT(s), "dma", &local_errp);
+    object_property_set_link(OBJECT(cs), OBJECT(s), "dma", &local_err);
-    if (local_errp) {
+    if (local_err) {
        goto xilinx_axidma_realize_fail;
    }
@@ -567,7 +567,7 @@ static void xilinx_axidma_realize(DeviceState *dev, Error **errp)
 xilinx_axidma_realize_fail:
    if (!*errp) {
-        *errp = local_errp;
+        *errp = local_err;
    }
 }
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -203,6 +203,15 @@ static bool is_version_0 (void *opaque, int version_id)
    return version_id == 0;
 }
 static bool vmstate_scoop_validate(void *opaque, int version_id)
 {
    ScoopInfo *s = opaque;
    return !(s->prev_level & 0xffff0000) &&
        !(s->gpio_level & 0xffff0000) &&
        !(s->gpio_dir & 0xffff0000);
 }
 static const VMStateDescription vmstate_scoop_regs = {
    .name = "scoop",
    .version_id = 1,
@@ -215,6 +224,7 @@ static const VMStateDescription vmstate_scoop_regs = {
        VMSTATE_UINT32(gpio_level, ScoopInfo),
        VMSTATE_UINT32(gpio_dir, ScoopInfo),
        VMSTATE_UINT32(prev_level, ScoopInfo),
        VMSTATE_VALIDATE("irq levels are 16 bit", vmstate_scoop_validate),
        VMSTATE_UINT16(mcr, ScoopInfo),
        VMSTATE_UINT16(cdr, ScoopInfo),
        VMSTATE_UINT16(ccr, ScoopInfo),
--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -60,59 +60,78 @@ static void smb_transaction(PMSMBus *s)
    uint8_t cmd = s->smb_cmd;
    uint8_t addr = s->smb_addr >> 1;
    I2CBus *bus = s->smbus;
    int ret;
    SMBUS_DPRINTF("SMBus trans addr=0x%02x prot=0x%02x\n", addr, prot);
    /* Transaction isn't exec if STS_DEV_ERR bit set */
    if ((s->smb_stat & STS_DEV_ERR) != 0)  {
-            goto error;
+        goto error;
-        }
+    }
    switch(prot) {
    case 0x0:
-        smbus_quick_command(bus, addr, read);
+        ret = smbus_quick_command(bus, addr, read);
-        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
+        goto done;
        break;
    case 0x1:
        if (read) {
-            s->smb_data0 = smbus_receive_byte(bus, addr);
+            ret = smbus_receive_byte(bus, addr);
            goto data8;
        } else {
-            smbus_send_byte(bus, addr, cmd);
+            ret = smbus_send_byte(bus, addr, cmd);
            goto done;
        }
        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
        break;
    case 0x2:
        if (read) {
-            s->smb_data0 = smbus_read_byte(bus, addr, cmd);
+            ret = smbus_read_byte(bus, addr, cmd);
            goto data8;
        } else {
-            smbus_write_byte(bus, addr, cmd, s->smb_data0);
+            ret = smbus_write_byte(bus, addr, cmd, s->smb_data0);
            goto done;
        }
        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
        break;
    case 0x3:
        if (read) {
-            uint16_t val;
+            ret = smbus_read_word(bus, addr, cmd);
-            val = smbus_read_word(bus, addr, cmd);
+            goto data16;
            s->smb_data0 = val;
            s->smb_data1 = val >> 8;
        } else {
-            smbus_write_word(bus, addr, cmd, (s->smb_data1 << 8) | s->smb_data0);
+            ret = smbus_write_word(bus, addr, cmd, (s->smb_data1 << 8) | s->smb_data0);
            goto done;
        }
        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
        break;
    case 0x5:
        if (read) {
-            s->smb_data0 = smbus_read_block(bus, addr, cmd, s->smb_data);
+            ret = smbus_read_block(bus, addr, cmd, s->smb_data);
            goto data8;
        } else {
-            smbus_write_block(bus, addr, cmd, s->smb_data, s->smb_data0);
+            ret = smbus_write_block(bus, addr, cmd, s->smb_data, s->smb_data0);
            goto done;
        }
        s->smb_stat |= STS_BYTE_DONE | STS_INTR;
        break;
    default:
        goto error;
    }
    abort();
 data16:
    if (ret < 0) {
        goto error;
    }
    s->smb_data1 = ret >> 8;
 data8:
    if (ret < 0) {
        goto error;
    }
    s->smb_data0 = ret;
 done:
    if (ret < 0) {
        goto error;
    }
    s->smb_stat |= STS_BYTE_DONE | STS_INTR;
    return;
-  error:
+error:
    s->smb_stat |= STS_DEV_ERR;
    return;
 }
 static void smb_ioport_writeb(void *opaque, hwaddr addr, uint64_t val,
--- a/hw/i2c/smbus.c
+++ b/hw/i2c/smbus.c
@@ -208,34 +208,44 @@ static int smbus_device_init(I2CSlave *i2c)
 }
 /* Master device commands.  */
-void smbus_quick_command(I2CBus *bus, uint8_t addr, int read)
+int smbus_quick_command(I2CBus *bus, uint8_t addr, int read)
 {
-    i2c_start_transfer(bus, addr, read);
+    if (i2c_start_transfer(bus, addr, read)) {
        return -1;
    }
    i2c_end_transfer(bus);
    return 0;
 }
-uint8_t smbus_receive_byte(I2CBus *bus, uint8_t addr)
+int smbus_receive_byte(I2CBus *bus, uint8_t addr)
 {
    uint8_t data;
-    i2c_start_transfer(bus, addr, 1);
+    if (i2c_start_transfer(bus, addr, 1)) {
        return -1;
    }
    data = i2c_recv(bus);
    i2c_nack(bus);
    i2c_end_transfer(bus);
    return data;
 }
-void smbus_send_byte(I2CBus *bus, uint8_t addr, uint8_t data)
+int smbus_send_byte(I2CBus *bus, uint8_t addr, uint8_t data)
 {
-    i2c_start_transfer(bus, addr, 0);
+    if (i2c_start_transfer(bus, addr, 0)) {
        return -1;
    }
    i2c_send(bus, data);
    i2c_end_transfer(bus);
    return 0;
 }
-uint8_t smbus_read_byte(I2CBus *bus, uint8_t addr, uint8_t command)
+int smbus_read_byte(I2CBus *bus, uint8_t addr, uint8_t command)
 {
    uint8_t data;
-    i2c_start_transfer(bus, addr, 0);
+    if (i2c_start_transfer(bus, addr, 0)) {
        return -1;
    }
    i2c_send(bus, command);
    i2c_start_transfer(bus, addr, 1);
    data = i2c_recv(bus);
@@ -244,18 +254,23 @@ uint8_t smbus_read_byte(I2CBus *bus, uint8_t addr, uint8_t command)
    return data;
 }
-void smbus_write_byte(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t data)
+int smbus_write_byte(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t data)
 {
-    i2c_start_transfer(bus, addr, 0);
+    if (i2c_start_transfer(bus, addr, 0)) {
        return -1;
    }
    i2c_send(bus, command);
    i2c_send(bus, data);
    i2c_end_transfer(bus);
    return 0;
 }
-uint16_t smbus_read_word(I2CBus *bus, uint8_t addr, uint8_t command)
+int smbus_read_word(I2CBus *bus, uint8_t addr, uint8_t command)
 {
    uint16_t data;
-    i2c_start_transfer(bus, addr, 0);
+    if (i2c_start_transfer(bus, addr, 0)) {
        return -1;
    }
    i2c_send(bus, command);
    i2c_start_transfer(bus, addr, 1);
    data = i2c_recv(bus);
@@ -265,13 +280,16 @@ uint16_t smbus_read_word(I2CBus *bus, uint8_t addr, uint8_t command)
    return data;
 }
-void smbus_write_word(I2CBus *bus, uint8_t addr, uint8_t command, uint16_t data)
+int smbus_write_word(I2CBus *bus, uint8_t addr, uint8_t command, uint16_t data)
 {
-    i2c_start_transfer(bus, addr, 0);
+    if (i2c_start_transfer(bus, addr, 0)) {
        return -1;
    }
    i2c_send(bus, command);
    i2c_send(bus, data & 0xff);
    i2c_send(bus, data >> 8);
    i2c_end_transfer(bus);
    return 0;
 }
 int smbus_read_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data)
@@ -279,33 +297,41 @@ int smbus_read_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data)
    int len;
    int i;
-    i2c_start_transfer(bus, addr, 0);
+    if (i2c_start_transfer(bus, addr, 0)) {
        return -1;
    }
    i2c_send(bus, command);
    i2c_start_transfer(bus, addr, 1);
    len = i2c_recv(bus);
-    if (len > 32)
+    if (len > 32) {
        len = 0;
-    for (i = 0; i < len; i++)
+    }
    for (i = 0; i < len; i++) {
        data[i] = i2c_recv(bus);
    }
    i2c_nack(bus);
    i2c_end_transfer(bus);
    return len;
 }
-void smbus_write_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data,
+int smbus_write_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data,
-                       int len)
+                      int len)
 {
    int i;
    if (len > 32)
        len = 32;
-    i2c_start_transfer(bus, addr, 0);
+    if (i2c_start_transfer(bus, addr, 0)) {
        return -1;
    }
    i2c_send(bus, command);
    i2c_send(bus, len);
-    for (i = 0; i < len; i++)
+    for (i = 0; i < len; i++) {
        i2c_send(bus, data[i]);
    }
    i2c_end_transfer(bus);
    return 0;
 }
 static void smbus_device_class_init(ObjectClass *klass, void *data)
--- a/hw/i2c/smbus_eeprom.c
+++ b/hw/i2c/smbus_eeprom.c
@@ -71,7 +71,7 @@ static void eeprom_write_data(SMBusDevice *dev, uint8_t cmd, uint8_t *buf, int l
    printf("eeprom_write_byte: addr=0x%02x cmd=0x%02x val=0x%02x\n",
           dev->i2c.address, cmd, buf[0]);
 #endif
-    /* An page write operation is not a valid SMBus command.
+    /* A page write operation is not a valid SMBus command.
       It is a block write without a length byte.  Fortunately we
       get the full block anyway.  */
    /* TODO: Should this set the current location?  */
--- a/hw/i386/Makefile.objs
+++ b/hw/i386/Makefile.objs
@@ -2,7 +2,7 @@ obj-$(CONFIG_KVM) += kvm/
 obj-y += multiboot.o smbios.o
 obj-y += pc.o pc_piix.o pc_q35.o
 obj-y += pc_sysfw.o
-obj-$(CONFIG_XEN) += xen_domainbuild.o xen_machine_pv.o
+obj-$(CONFIG_XEN) += ../xenpv/ xen/
 obj-y += kvmvapic.o
 obj-y += acpi-build.o
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -156,18 +156,21 @@ static void acpi_get_pm_info(AcpiPmInfo *pm)
    } else {
        pm->s3_disabled = false;
    }
    qobject_decref(o);
    o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_DISABLED, NULL);
    if (o) {
        pm->s4_disabled = qint_get_int(qobject_to_qint(o));
    } else {
        pm->s4_disabled = false;
    }
    qobject_decref(o);
    o = object_property_get_qobject(obj, ACPI_PM_PROP_S4_VAL, NULL);
    if (o) {
        pm->s4_val = qint_get_int(qobject_to_qint(o));
    } else {
        pm->s4_val = false;
    }
    qobject_decref(o);
    /* Fill in mandatory properties */
    pm->sci_int = object_property_get_int(obj, ACPI_PM_PROP_SCI_INT, NULL);
@@ -973,6 +976,7 @@ static void build_pci_bus_end(PCIBus *bus, void *bus_state)
        }
    }
    qobject_decref(bsel);
    build_free_array(bus_table);
    build_pci_bus_state_cleanup(child);
    g_free(child);
@@ -1362,10 +1366,12 @@ static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg)
        return false;
    }
    mcfg->mcfg_base = qint_get_int(qobject_to_qint(o));
    qobject_decref(o);
    o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_SIZE, NULL);
    assert(o);
    mcfg->mcfg_size = qint_get_int(qobject_to_qint(o));
    qobject_decref(o);
    return true;
 }
@@ -1410,15 +1416,16 @@ void acpi_build(PcGuestInfo *guest_info, AcpiBuildTables *tables)
    /* ACPI tables pointed to by RSDT */
    acpi_add_table(table_offsets, tables->table_data);
    build_fadt(tables->table_data, tables->linker, &pm, facs, dsdt);
    acpi_add_table(table_offsets, tables->table_data);
    acpi_add_table(table_offsets, tables->table_data);
    build_ssdt(tables->table_data, tables->linker, &cpu, &pm, &misc, &pci,
               guest_info);
    acpi_add_table(table_offsets, tables->table_data);
    build_madt(tables->table_data, tables->linker, &cpu, guest_info);
    acpi_add_table(table_offsets, tables->table_data);
    build_madt(tables->table_data, tables->linker, &cpu, guest_info);
    if (misc.has_hpet) {
        acpi_add_table(table_offsets, tables->table_data);
        build_hpet(tables->table_data, tables->linker);
    }
    if (guest_info->numa_nodes) {
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -394,9 +394,10 @@ static uint8_t pci_find_cap_offset(PCIDevice *d, uint8_t cap, uint8_t start)
    return 0;
 }
-static int assigned_dev_register_regions(PCIRegion *io_regions,
+static void assigned_dev_register_regions(PCIRegion *io_regions,
-                                         unsigned long regions_num,
+                                          unsigned long regions_num,
-                                         AssignedDevice *pci_dev)
+                                          AssignedDevice *pci_dev,
                                          Error **errp)
 {
    uint32_t i;
    PCIRegion *cur_region = io_regions;
@@ -425,9 +426,9 @@ static int assigned_dev_register_regions(PCIRegion *io_regions,
            if (pci_dev->v_addrs[i].u.r_virtbase == MAP_FAILED) {
                pci_dev->v_addrs[i].u.r_virtbase = NULL;
-                error_report("%s: Error: Couldn't mmap 0x%" PRIx64 "!",
+                error_setg_errno(errp, errno, "Couldn't mmap 0x%" PRIx64 "!",
-                             __func__, cur_region->base_addr);
+                                 cur_region->base_addr);
-                return -1;
+                return;
            }
            pci_dev->v_addrs[i].r_size = cur_region->size;
@@ -496,10 +497,10 @@ static int assigned_dev_register_regions(PCIRegion *io_regions,
    }
    /* success */
    return 0;
 }
-static int get_real_id(const char *devpath, const char *idname, uint16_t *val)
+static void get_real_id(const char *devpath, const char *idname, uint16_t *val,
                        Error **errp)
 {
    FILE *f;
    char name[128];
@@ -508,39 +509,39 @@ static int get_real_id(const char *devpath, const char *idname, uint16_t *val)
    snprintf(name, sizeof(name), "%s%s", devpath, idname);
    f = fopen(name, "r");
    if (f == NULL) {
-        error_report("%s: %s: %m", __func__, name);
+        error_setg_file_open(errp, errno, name);
-        return -1;
+        return;
    }
    if (fscanf(f, "%li\n", &id) == 1) {
        *val = id;
    } else {
-        fclose(f);
+        error_setg(errp, "Failed to parse contents of '%s'", name);
        return -1;
    }
    fclose(f);
    return 0;
 }
-static int get_real_vendor_id(const char *devpath, uint16_t *val)
+static void get_real_vendor_id(const char *devpath, uint16_t *val,
                               Error **errp)
 {
-    return get_real_id(devpath, "vendor", val);
+    get_real_id(devpath, "vendor", val, errp);
 }
-static int get_real_device_id(const char *devpath, uint16_t *val)
+static void get_real_device_id(const char *devpath, uint16_t *val,
                               Error **errp)
 {
-    return get_real_id(devpath, "device", val);
+    get_real_id(devpath, "device", val, errp);
 }
-static int get_real_device(AssignedDevice *pci_dev)
+static void get_real_device(AssignedDevice *pci_dev, Error **errp)
 {
    char dir[128], name[128];
-    int fd, r = 0, v;
+    int fd, r = 0;
    FILE *f;
    uint64_t start, end, size, flags;
    uint16_t id;
    PCIRegion *rp;
    PCIDevRegions *dev = &pci_dev->real_device;
    Error *local_err = NULL;
    dev->region_number = 0;
@@ -551,16 +552,19 @@ static int get_real_device(AssignedDevice *pci_dev)
    snprintf(name, sizeof(name), "%sconfig", dir);
    if (pci_dev->configfd_name && *pci_dev->configfd_name) {
-        dev->config_fd = monitor_handle_fd_param(cur_mon, pci_dev->configfd_name);
+        dev->config_fd = monitor_handle_fd_param2(cur_mon,
-        if (dev->config_fd < 0) {
+                                                  pci_dev->configfd_name,
-            return 1;
+                                                  &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
    } else {
        dev->config_fd = open(name, O_RDWR);
        if (dev->config_fd == -1) {
-            error_report("%s: %s: %m", __func__, name);
+            error_setg_file_open(errp, errno, name);
-            return 1;
+            return;
        }
    }
 again:
@@ -570,7 +574,10 @@ again:
        if (errno == EINTR || errno == EAGAIN) {
            goto again;
        }
-        error_report("%s: read failed, errno = %d", __func__, errno);
+        error_setg_errno(errp, errno, "read(\"%s\")",
                         (pci_dev->configfd_name && *pci_dev->configfd_name) ?
                         pci_dev->configfd_name : name);
        return;
    }
    /* Restore or clear multifunction, this is always controlled by qemu */
@@ -590,8 +597,8 @@ again:
    f = fopen(name, "r");
    if (f == NULL) {
-        error_report("%s: %s: %m", __func__, name);
+        error_setg_file_open(errp, errno, name);
-        return 1;
+        return;
    }
    for (r = 0; r < PCI_ROM_SLOT; r++) {
@@ -634,17 +641,19 @@ again:
    fclose(f);
    /* read and fill vendor ID */
-    v = get_real_vendor_id(dir, &id);
+    get_real_vendor_id(dir, &id, &local_err);
-    if (v) {
+    if (local_err) {
-        return 1;
+        error_propagate(errp, local_err);
        return;
    }
    pci_dev->dev.config[0] = id & 0xff;
    pci_dev->dev.config[1] = (id & 0xff00) >> 8;
    /* read and fill device ID */
-    v = get_real_device_id(dir, &id);
+    get_real_device_id(dir, &id, &local_err);
-    if (v) {
+    if (local_err) {
-        return 1;
+        error_propagate(errp, local_err);
        return;
    }
    pci_dev->dev.config[2] = id & 0xff;
    pci_dev->dev.config[3] = (id & 0xff00) >> 8;
@@ -653,7 +662,6 @@ again:
                                 PCI_COMMAND_MASTER | PCI_COMMAND_INTX_DISABLE);
    dev->region_number = r;
    return 0;
 }
 static void free_msi_virqs(AssignedDevice *dev)
@@ -726,11 +734,17 @@ static void free_assigned_device(AssignedDevice *dev)
    free_msi_virqs(dev);
 }
-static void assign_failed_examine(AssignedDevice *dev)
+/* This function tries to determine the cause of the PCI assignment failure. It
 * always returns the cause as a dynamically allocated, human readable string.
 * If the function fails to determine the cause for any internal reason, then
 * the returned string will state that fact.
 */
 static char *assign_failed_examine(const AssignedDevice *dev)
 {
    char name[PATH_MAX], dir[PATH_MAX], driver[PATH_MAX] = {}, *ns;
    uint16_t vendor_id, device_id;
    int r;
    Error *local_err = NULL;
    snprintf(dir, sizeof(dir), "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/",
            dev->host.domain, dev->host.bus, dev->host.slot,
@@ -751,13 +765,17 @@ static void assign_failed_examine(AssignedDevice *dev)
    ns++;
-    if (get_real_vendor_id(dir, &vendor_id) ||
+    if ((get_real_vendor_id(dir, &vendor_id, &local_err), local_err) ||
-        get_real_device_id(dir, &device_id)) {
+        (get_real_device_id(dir, &device_id, &local_err), local_err)) {
        /* We're already analyzing an assignment error, so we suppress this
         * one just like the others above.
         */
        error_free(local_err);
        goto fail;
    }
-    error_printf("*** The driver '%s' is occupying your device "
+    return g_strdup_printf(
-        "%04x:%02x:%02x.%x.\n"
+        "*** The driver '%s' is occupying your device %04x:%02x:%02x.%x.\n"
        "***\n"
        "*** You can try the following commands to free it:\n"
        "***\n"
@@ -773,13 +791,11 @@ static void assign_failed_examine(AssignedDevice *dev)
        ns, dev->host.domain, dev->host.bus, dev->host.slot,
        dev->host.function, vendor_id, device_id);
    return;
 fail:
-    error_report("Couldn't find out why.");
+    return g_strdup("Couldn't find out why.");
 }
-static int assign_device(AssignedDevice *dev)
+static void assign_device(AssignedDevice *dev, Error **errp)
 {
    uint32_t flags = KVM_DEV_ASSIGN_ENABLE_IOMMU;
    int r;
@@ -787,15 +803,15 @@ static int assign_device(AssignedDevice *dev)
    /* Only pass non-zero PCI segment to capable module */
    if (!kvm_check_extension(kvm_state, KVM_CAP_PCI_SEGMENT) &&
        dev->host.domain) {
-        error_report("Can't assign device inside non-zero PCI segment "
+        error_setg(errp, "Can't assign device inside non-zero PCI segment "
-                     "as this KVM module doesn't support it.");
+                   "as this KVM module doesn't support it.");
-        return -ENODEV;
+        return;
    }
    if (!kvm_check_extension(kvm_state, KVM_CAP_IOMMU)) {
-        error_report("No IOMMU found.  Unable to assign device \"%s\"",
+        error_setg(errp, "No IOMMU found.  Unable to assign device \"%s\"",
-                     dev->dev.qdev.id);
+                   dev->dev.qdev.id);
-        return -ENODEV;
+        return;
    }
    if (dev->features & ASSIGNED_DEVICE_SHARE_INTX_MASK &&
@@ -805,36 +821,39 @@ static int assign_device(AssignedDevice *dev)
    r = kvm_device_pci_assign(kvm_state, &dev->host, flags, &dev->dev_id);
    if (r < 0) {
        error_report("Failed to assign device \"%s\" : %s",
                     dev->dev.qdev.id, strerror(-r));
        switch (r) {
-        case -EBUSY:
+        case -EBUSY: {
-            assign_failed_examine(dev);
+            char *cause;
            cause = assign_failed_examine(dev);
            error_setg_errno(errp, -r, "Failed to assign device \"%s\"\n%s",
                             dev->dev.qdev.id, cause);
            g_free(cause);
            break;
        }
        default:
            error_setg_errno(errp, -r, "Failed to assign device \"%s\"",
                             dev->dev.qdev.id);
            break;
        }
    }
    return r;
 }
-static bool check_irqchip_in_kernel(void)
+static void verify_irqchip_in_kernel(Error **errp)
 {
    if (kvm_irqchip_in_kernel()) {
-        return true;
+        return;
    }
-    error_report("pci-assign: error: requires KVM with in-kernel irqchip "
+    error_setg(errp, "pci-assign requires KVM with in-kernel irqchip enabled");
                 "enabled");
    return false;
 }
-static int assign_intx(AssignedDevice *dev)
+static int assign_intx(AssignedDevice *dev, Error **errp)
 {
    AssignedIRQType new_type;
    PCIINTxRoute intx_route;
    bool intx_host_msi;
    int r;
    Error *local_err = NULL;
    /* Interrupt PIN 0 means don't use INTx */
    if (assigned_dev_pci_read_byte(&dev->dev, PCI_INTERRUPT_PIN) == 0) {
@@ -842,7 +861,9 @@ static int assign_intx(AssignedDevice *dev)
        return 0;
    }
-    if (!check_irqchip_in_kernel()) {
+    verify_irqchip_in_kernel(&local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        return -ENOTSUP;
    }
@@ -905,10 +926,11 @@ retry:
            dev->features |= ASSIGNED_DEVICE_PREFER_MSI_MASK;
            goto retry;
        }
-        error_report("Failed to assign irq for \"%s\": %s",
+        error_setg_errno(errp, -r,
-                     dev->dev.qdev.id, strerror(-r));
+                         "Failed to assign irq for \"%s\"\n"
-        error_report("Perhaps you are assigning a device "
+                         "Perhaps you are assigning a device "
-                     "that shares an IRQ with another device?");
+                         "that shares an IRQ with another device?",
                         dev->dev.qdev.id);
        return r;
    }
@@ -934,8 +956,11 @@ static void assigned_dev_update_irq_routing(PCIDevice *dev)
    Error *err = NULL;
    int r;
-    r = assign_intx(assigned_dev);
+    r = assign_intx(assigned_dev, &err);
    if (r < 0) {
        error_report("%s", error_get_pretty(err));
        error_free(err);
        err = NULL;
        qdev_unplug(&dev->qdev, &err);
        assert(!err);
    }
@@ -986,7 +1011,13 @@ static void assigned_dev_update_msi(PCIDevice *pci_dev)
        assigned_dev->intx_route.irq = -1;
        assigned_dev->assigned_irq_type = ASSIGNED_IRQ_MSI;
    } else {
-        assign_intx(assigned_dev);
+        Error *local_err = NULL;
        assign_intx(assigned_dev, &local_err);
        if (local_err) {
            error_report("%s", error_get_pretty(local_err));
            error_free(local_err);
        }
    }
 }
@@ -1128,7 +1159,13 @@ static void assigned_dev_update_msix(PCIDevice *pci_dev)
        assigned_dev->intx_route.irq = -1;
        assigned_dev->assigned_irq_type = ASSIGNED_IRQ_MSIX;
    } else {
-        assign_intx(assigned_dev);
+        Error *local_err = NULL;
        assign_intx(assigned_dev, &local_err);
        if (local_err) {
            error_report("%s", error_get_pretty(local_err));
            error_free(local_err);
        }
    }
 }
@@ -1214,11 +1251,12 @@ static void assigned_dev_setup_cap_read(AssignedDevice *dev, uint32_t offset,
    assigned_dev_emulate_config_read(dev, offset + PCI_CAP_LIST_NEXT, 1);
 }
-static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
+static int assigned_device_pci_cap_init(PCIDevice *pci_dev, Error **errp)
 {
    AssignedDevice *dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
    PCIRegion *pci_region = dev->real_device.regions;
    int ret, pos;
    Error *local_err = NULL;
    /* Clear initial capabilities pointer and status copied from hw */
    pci_set_byte(pci_dev->config + PCI_CAPABILITY_LIST, 0);
@@ -1230,13 +1268,17 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
     * MSI capability is the 1st capability in capability config */
    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_MSI, 0);
    if (pos != 0 && kvm_check_extension(kvm_state, KVM_CAP_ASSIGN_DEV_IRQ)) {
-        if (!check_irqchip_in_kernel()) {
+        verify_irqchip_in_kernel(&local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return -ENOTSUP;
        }
        dev->cap.available |= ASSIGNED_DEVICE_CAP_MSI;
        /* Only 32-bit/no-mask currently supported */
-        ret = pci_add_capability(pci_dev, PCI_CAP_ID_MSI, pos, 10);
+        ret = pci_add_capability2(pci_dev, PCI_CAP_ID_MSI, pos, 10,
                                  &local_err);
        if (ret < 0) {
            error_propagate(errp, local_err);
            return ret;
        }
        pci_dev->msi_cap = pos;
@@ -1259,12 +1301,16 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
        int bar_nr;
        uint32_t msix_table_entry;
-        if (!check_irqchip_in_kernel()) {
+        verify_irqchip_in_kernel(&local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return -ENOTSUP;
        }
        dev->cap.available |= ASSIGNED_DEVICE_CAP_MSIX;
-        ret = pci_add_capability(pci_dev, PCI_CAP_ID_MSIX, pos, 12);
+        ret = pci_add_capability2(pci_dev, PCI_CAP_ID_MSIX, pos, 12,
                                  &local_err);
        if (ret < 0) {
            error_propagate(errp, local_err);
            return ret;
        }
        pci_dev->msix_cap = pos;
@@ -1291,8 +1337,10 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
    if (pos) {
        uint16_t pmc;
-        ret = pci_add_capability(pci_dev, PCI_CAP_ID_PM, pos, PCI_PM_SIZEOF);
+        ret = pci_add_capability2(pci_dev, PCI_CAP_ID_PM, pos, PCI_PM_SIZEOF,
                                  &local_err);
        if (ret < 0) {
            error_propagate(errp, local_err);
            return ret;
        }
@@ -1330,8 +1378,8 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
             */
            size = MIN(0x3c, PCI_CONFIG_SPACE_SIZE - pos);
            if (size < 0x34) {
-                error_report("%s: Invalid size PCIe cap-id 0x%x",
+                error_setg(errp, "Invalid size PCIe cap-id 0x%x",
-                             __func__, PCI_CAP_ID_EXP);
+                           PCI_CAP_ID_EXP);
                return -EINVAL;
            } else if (size != 0x3c) {
                error_report("WARNING, %s: PCIe cap-id 0x%x has "
@@ -1352,13 +1400,15 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
        }
        if (size == 0) {
-            error_report("%s: Unsupported PCI express capability version %d",
+            error_setg(errp, "Unsupported PCI express capability version %d",
-                         __func__, version);
+                       version);
            return -EINVAL;
        }
-        ret = pci_add_capability(pci_dev, PCI_CAP_ID_EXP, pos, size);
+        ret = pci_add_capability2(pci_dev, PCI_CAP_ID_EXP, pos, size,
                                  &local_err);
        if (ret < 0) {
            error_propagate(errp, local_err);
            return ret;
        }
@@ -1368,8 +1418,8 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
        type = (type & PCI_EXP_FLAGS_TYPE) >> 4;
        if (type != PCI_EXP_TYPE_ENDPOINT &&
            type != PCI_EXP_TYPE_LEG_END && type != PCI_EXP_TYPE_RC_END) {
-            error_report("Device assignment only supports endpoint assignment,"
+            error_setg(errp, "Device assignment only supports endpoint "
-                         " device type %d", type);
+                       "assignment, device type %d", type);
            return -EINVAL;
        }
@@ -1431,8 +1481,10 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
        uint32_t status;
        /* Only expose the minimum, 8 byte capability */
-        ret = pci_add_capability(pci_dev, PCI_CAP_ID_PCIX, pos, 8);
+        ret = pci_add_capability2(pci_dev, PCI_CAP_ID_PCIX, pos, 8,
                                  &local_err);
        if (ret < 0) {
            error_propagate(errp, local_err);
            return ret;
        }
@@ -1457,8 +1509,10 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_VPD, 0);
    if (pos) {
        /* Direct R/W passthrough */
-        ret = pci_add_capability(pci_dev, PCI_CAP_ID_VPD, pos, 8);
+        ret = pci_add_capability2(pci_dev, PCI_CAP_ID_VPD, pos, 8,
                                  &local_err);
        if (ret < 0) {
            error_propagate(errp, local_err);
            return ret;
        }
@@ -1473,8 +1527,10 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
        pos += PCI_CAP_LIST_NEXT) {
        uint8_t len = pci_get_byte(pci_dev->config + pos + PCI_CAP_FLAGS);
        /* Direct R/W passthrough */
-        ret = pci_add_capability(pci_dev, PCI_CAP_ID_VNDR, pos, len);
+        ret = pci_add_capability2(pci_dev, PCI_CAP_ID_VNDR, pos, len,
                                  &local_err);
        if (ret < 0) {
            error_propagate(errp, local_err);
            return ret;
        }
@@ -1602,20 +1658,19 @@ static void assigned_dev_msix_reset(AssignedDevice *dev)
    }
 }
-static int assigned_dev_register_msix_mmio(AssignedDevice *dev)
+static void assigned_dev_register_msix_mmio(AssignedDevice *dev, Error **errp)
 {
    dev->msix_table = mmap(NULL, MSIX_PAGE_SIZE, PROT_READ|PROT_WRITE,
                           MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
    if (dev->msix_table == MAP_FAILED) {
-        error_report("fail allocate msix_table! %s", strerror(errno));
+        error_setg_errno(errp, errno, "failed to allocate msix_table");
-        return -EFAULT;
+        return;
    }
    assigned_dev_msix_reset(dev);
    memory_region_init_io(&dev->mmio, OBJECT(dev), &assigned_dev_msix_mmio_ops,
                          dev, "assigned-dev-msix", MSIX_PAGE_SIZE);
    return 0;
 }
 static void assigned_dev_unregister_msix_mmio(AssignedDevice *dev)
@@ -1698,16 +1753,17 @@ static int assigned_initfn(struct PCIDevice *pci_dev)
    AssignedDevice *dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
    uint8_t e_intx;
    int r;
    Error *local_err = NULL;
    if (!kvm_enabled()) {
-        error_report("pci-assign: error: requires KVM support");
+        error_setg(&local_err, "pci-assign requires KVM support");
-        return -1;
+        goto exit_with_error;
    }
    if (!dev->host.domain && !dev->host.bus && !dev->host.slot &&
        !dev->host.function) {
-        error_report("pci-assign: error: no host device specified");
+        error_setg(&local_err, "no host device specified");
-        return -1;
+        goto exit_with_error;
    }
    /*
@@ -1730,27 +1786,28 @@ static int assigned_initfn(struct PCIDevice *pci_dev)
    memcpy(dev->emulate_config_write, dev->emulate_config_read,
           sizeof(dev->emulate_config_read));
-    if (get_real_device(dev)) {
+    get_real_device(dev, &local_err);
-        error_report("pci-assign: Error: Couldn't get real device (%s)!",
+    if (local_err) {
                     dev->dev.qdev.id);
        goto out;
    }
-    if (assigned_device_pci_cap_init(pci_dev) < 0) {
+    if (assigned_device_pci_cap_init(pci_dev, &local_err) < 0) {
        goto out;
    }
    /* intercept MSI-X entry page in the MMIO */
    if (dev->cap.available & ASSIGNED_DEVICE_CAP_MSIX) {
-        if (assigned_dev_register_msix_mmio(dev)) {
+        assigned_dev_register_msix_mmio(dev, &local_err);
        if (local_err) {
            goto out;
        }
    }
    /* handle real device's MMIO/PIO BARs */
-    if (assigned_dev_register_regions(dev->real_device.regions,
+    assigned_dev_register_regions(dev->real_device.regions,
-                                      dev->real_device.region_number,
+                                  dev->real_device.region_number, dev,
-                                      dev)) {
+                                  &local_err);
    if (local_err) {
        goto out;
    }
@@ -1761,13 +1818,13 @@ static int assigned_initfn(struct PCIDevice *pci_dev)
    dev->intx_route.irq = -1;
    /* assign device to guest */
-    r = assign_device(dev);
+    assign_device(dev, &local_err);
-    if (r < 0) {
+    if (local_err) {
        goto out;
    }
    /* assign legacy INTx to the device */
-    r = assign_intx(dev);
+    r = assign_intx(dev, &local_err);
    if (r < 0) {
        goto assigned_out;
    }
@@ -1780,8 +1837,14 @@ static int assigned_initfn(struct PCIDevice *pci_dev)
 assigned_out:
    deassign_device(dev);
 out:
    free_assigned_device(dev);
 exit_with_error:
    assert(local_err);
    qerror_report_err(local_err);
    error_free(local_err);
    return -1;
 }
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -124,14 +124,14 @@ static const TPRInstruction tpr_instr[] = {
 static void read_guest_rom_state(VAPICROMState *s)
 {
-    cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state,
+    cpu_physical_memory_read(s->rom_state_paddr, &s->rom_state,
-                           sizeof(GuestROMState), 0);
+                             sizeof(GuestROMState));
 }
 static void write_guest_rom_state(VAPICROMState *s)
 {
-    cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state,
+    cpu_physical_memory_write(s->rom_state_paddr, &s->rom_state,
-                           sizeof(GuestROMState), 1);
+                              sizeof(GuestROMState));
 }
 static void update_guest_rom_state(VAPICROMState *s)
@@ -311,16 +311,14 @@ static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong i
    for (pos = le32_to_cpu(s->rom_state.fixup_start);
         pos < le32_to_cpu(s->rom_state.fixup_end);
         pos += 4) {
-        cpu_physical_memory_rw(paddr + pos - s->rom_state.vaddr,
+        cpu_physical_memory_read(paddr + pos - s->rom_state.vaddr,
-                               (void *)&offset, sizeof(offset), 0);
+                                 &offset, sizeof(offset));
        offset = le32_to_cpu(offset);
-        cpu_physical_memory_rw(paddr + offset, (void *)&patch,
+        cpu_physical_memory_read(paddr + offset, &patch, sizeof(patch));
                               sizeof(patch), 0);
        patch = le32_to_cpu(patch);
        patch += rom_state_vaddr - le32_to_cpu(s->rom_state.vaddr);
        patch = cpu_to_le32(patch);
-        cpu_physical_memory_rw(paddr + offset, (void *)&patch,
+        cpu_physical_memory_write(paddr + offset, &patch, sizeof(patch));
                               sizeof(patch), 1);
    }
    read_guest_rom_state(s);
    s->vapic_paddr = paddr + le32_to_cpu(s->rom_state.vapic_vaddr) -
@@ -364,8 +362,8 @@ static int vapic_enable(VAPICROMState *s, X86CPU *cpu)
    }
    vapic_paddr = s->vapic_paddr +
        (((hwaddr)cpu_number) << VAPIC_CPU_SHIFT);
-    cpu_physical_memory_rw(vapic_paddr + offsetof(VAPICState, enabled),
+    cpu_physical_memory_write(vapic_paddr + offsetof(VAPICState, enabled),
-                           (void *)&enabled, sizeof(enabled), 1);
+                              &enabled, sizeof(enabled));
    apic_enable_vapic(cpu->apic_state, vapic_paddr);
    s->state = VAPIC_ACTIVE;
@@ -535,7 +533,7 @@ static int patch_hypercalls(VAPICROMState *s)
    uint8_t *rom;
    rom = g_malloc(s->rom_size);
-    cpu_physical_memory_rw(rom_paddr, rom, s->rom_size, 0);
+    cpu_physical_memory_read(rom_paddr, rom, s->rom_size);
    for (pos = 0; pos < s->rom_size - sizeof(vmcall_pattern); pos++) {
        if (kvm_irqchip_in_kernel()) {
@@ -551,8 +549,7 @@ static int patch_hypercalls(VAPICROMState *s)
        }
        if (memcmp(rom + pos, pattern, 7) == 0 &&
            (rom[pos + 7] == alternates[0] || rom[pos + 7] == alternates[1])) {
-            cpu_physical_memory_rw(rom_paddr + pos + 5, (uint8_t *)patch,
+            cpu_physical_memory_write(rom_paddr + pos + 5, patch, 3);
                                   3, 1);
            /*
             * Don't flush the tb here. Under ordinary conditions, the patched
             * calls are miles away from the current IP. Under malicious
@@ -760,8 +757,8 @@ static int vapic_post_load(void *opaque, int version_id)
            run_on_cpu(first_cpu, do_vapic_enable, s);
        } else {
            zero = g_malloc0(s->rom_state.vapic_size);
-            cpu_physical_memory_rw(s->vapic_paddr, zero,
+            cpu_physical_memory_write(s->vapic_paddr, zero,
-                                   s->rom_state.vapic_size, 1);
+                                      s->rom_state.vapic_size);
            g_free(zero);
        }
    }
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -612,6 +612,21 @@ int e820_add_entry(uint64_t address, uint64_t length, uint32_t type)
    return e820_entries;
 }
 int e820_get_num_entries(void)
 {
    return e820_entries;
 }
 bool e820_get_entry(int idx, uint32_t type, uint64_t *address, uint64_t *length)
 {
    if (idx < e820_entries && e820_table[idx].type == cpu_to_le32(type)) {
        *address = le64_to_cpu(e820_table[idx].address);
        *length = le64_to_cpu(e820_table[idx].length);
        return true;
    }
    return false;
 }
 /* Calculates the limit to CPU APIC ID values
 *
 * This function returns the limit for the APIC ID value, so that all
@@ -627,8 +642,8 @@ static unsigned int pc_apic_id_limit(unsigned int max_cpus)
 static FWCfgState *bochs_bios_init(void)
 {
    FWCfgState *fw_cfg;
-    uint8_t *smbios_table;
+    uint8_t *smbios_tables, *smbios_anchor;
-    size_t smbios_len;
+    size_t smbios_tables_len, smbios_anchor_len;
    uint64_t *numa_fw_cfg;
    int i, j;
    unsigned int apic_id_limit = pc_apic_id_limit(max_cpus);
@@ -655,10 +670,21 @@ static FWCfgState *bochs_bios_init(void)
                     acpi_tables, acpi_tables_len);
    fw_cfg_add_i32(fw_cfg, FW_CFG_IRQ0_OVERRIDE, kvm_allows_irq0_override());
-    smbios_table = smbios_get_table(&smbios_len);
+    smbios_tables = smbios_get_table_legacy(&smbios_tables_len);
-    if (smbios_table)
+    if (smbios_tables) {
        fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,
-                         smbios_table, smbios_len);
+                         smbios_tables, smbios_tables_len);
    }
    smbios_get_tables(&smbios_tables, &smbios_tables_len,
                      &smbios_anchor, &smbios_anchor_len);
    if (smbios_anchor) {
        fw_cfg_add_file(fw_cfg, "etc/smbios/smbios-tables",
                        smbios_tables, smbios_tables_len);
        fw_cfg_add_file(fw_cfg, "etc/smbios/smbios-anchor",
                        smbios_anchor, smbios_anchor_len);
    }
    fw_cfg_add_bytes(fw_cfg, FW_CFG_E820_TABLE,
                     &e820_reserve, sizeof(e820_reserve));
    fw_cfg_add_file(fw_cfg, "etc/e820", e820_table,
@@ -1027,6 +1053,9 @@ void pc_cpus_init(const char *cpu_model, DeviceState *icc_bridge)
        sysbus_mmio_map_overlap(SYS_BUS_DEVICE(icc_bridge), 0,
                                APIC_DEFAULT_ADDRESS, 0x1000);
    }
    /* tell smbios about cpuid version and features */
    smbios_set_cpuid(cpu->env.cpuid_version, cpu->env.features[FEAT_1_EDX]);
 }
 /* pci-info ROM file. Little endian format */
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -60,7 +60,8 @@ static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
 static bool has_pci_info;
 static bool has_acpi_build = true;
-static bool smbios_type1_defaults = true;
+static bool smbios_defaults = true;
 static bool smbios_legacy_mode;
 /* Make sure that guest addresses aligned at 1Gbyte boundaries get mapped to
 * host addresses aligned at 1Gbyte boundaries.  This way we can use 1GByte
 * pages in the host.
@@ -143,10 +144,10 @@ static void pc_init1(QEMUMachineInitArgs *args,
    guest_info->has_pci_info = has_pci_info;
    guest_info->isapc_ram_fw = !pci_enabled;
-    if (smbios_type1_defaults) {
+    if (smbios_defaults) {
        /* These values are guest ABI, do not change */
-        smbios_set_type1_defaults("QEMU", "Standard PC (i440FX + PIIX, 1996)",
+        smbios_set_defaults("QEMU", "Standard PC (i440FX + PIIX, 1996)",
-                                  args->machine->name);
+                            args->machine->name, smbios_legacy_mode);
    }
    /* allocate ram and load rom/bios */
@@ -262,9 +263,15 @@ static void pc_init_pci(QEMUMachineInitArgs *args)
    pc_init1(args, 1, 1);
 }
 static void pc_compat_2_0(QEMUMachineInitArgs *args)
 {
    smbios_legacy_mode = true;
 }
 static void pc_compat_1_7(QEMUMachineInitArgs *args)
 {
-    smbios_type1_defaults = false;
+    pc_compat_2_0(args);
    smbios_defaults = false;
    gigabyte_align = false;
    option_rom_has_mr = true;
    x86_cpu_compat_disable_kvm_features(FEAT_1_ECX, CPUID_EXT_X2APIC);
@@ -303,6 +310,12 @@ static void pc_compat_1_2(QEMUMachineInitArgs *args)
    x86_cpu_compat_disable_kvm_features(FEAT_KVM, KVM_FEATURE_PV_EOI);
 }
 static void pc_init_pci_2_0(QEMUMachineInitArgs *args)
 {
    pc_compat_2_0(args);
    pc_init_pci(args);
 }
 static void pc_init_pci_1_7(QEMUMachineInitArgs *args)
 {
    pc_compat_1_7(args);
@@ -345,7 +358,7 @@ static void pc_init_pci_no_kvmclock(QEMUMachineInitArgs *args)
 {
    has_pci_info = false;
    has_acpi_build = false;
-    smbios_type1_defaults = false;
+    smbios_defaults = false;
    x86_cpu_compat_disable_kvm_features(FEAT_KVM, KVM_FEATURE_PV_EOI);
    enable_compat_apic_id_mode();
    pc_init1(args, 1, 0);
@@ -355,7 +368,7 @@ static void pc_init_isa(QEMUMachineInitArgs *args)
 {
    has_pci_info = false;
    has_acpi_build = false;
-    smbios_type1_defaults = false;
+    smbios_defaults = false;
    if (!args->cpu_model) {
        args->cpu_model = "486";
    }
@@ -383,16 +396,28 @@ static void pc_xen_hvm_init(QEMUMachineInitArgs *args)
    .desc = "Standard PC (i440FX + PIIX, 1996)", \
    .hot_add_cpu = pc_hot_add_cpu
-#define PC_I440FX_2_0_MACHINE_OPTIONS                           \
+#define PC_I440FX_2_1_MACHINE_OPTIONS                           \
    PC_I440FX_MACHINE_OPTIONS,                                  \
    .default_machine_opts = "firmware=bios-256k.bin"
 static QEMUMachine pc_i440fx_machine_v2_1 = {
    PC_I440FX_2_1_MACHINE_OPTIONS,
    .name = "pc-i440fx-2.1",
    .alias = "pc",
    .init = pc_init_pci,
    .is_default = 1,
 };
 #define PC_I440FX_2_0_MACHINE_OPTIONS PC_I440FX_2_1_MACHINE_OPTIONS
 static QEMUMachine pc_i440fx_machine_v2_0 = {
    PC_I440FX_2_0_MACHINE_OPTIONS,
    .name = "pc-i440fx-2.0",
-    .alias = "pc",
+    .init = pc_init_pci_2_0,
-    .init = pc_init_pci,
+    .compat_props = (GlobalProperty[]) {
-    .is_default = 1,
+        PC_COMPAT_2_0,
        { /* end of list */ }
    },
 };
 #define PC_I440FX_1_7_MACHINE_OPTIONS PC_I440FX_MACHINE_OPTIONS
@@ -817,6 +842,7 @@ static QEMUMachine xenfv_machine = {
 static void pc_machine_init(void)
 {
    qemu_register_machine(&pc_i440fx_machine_v2_1);
    qemu_register_machine(&pc_i440fx_machine_v2_0);
    qemu_register_machine(&pc_i440fx_machine_v1_7);
    qemu_register_machine(&pc_i440fx_machine_v1_6);
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -50,7 +50,8 @@
 static bool has_pci_info;
 static bool has_acpi_build = true;
-static bool smbios_type1_defaults = true;
+static bool smbios_defaults = true;
 static bool smbios_legacy_mode;
 /* Make sure that guest addresses aligned at 1Gbyte boundaries get mapped to
 * host addresses aligned at 1Gbyte boundaries.  This way we can use 1GByte
 * pages in the host.
@@ -130,10 +131,10 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
    guest_info->isapc_ram_fw = false;
    guest_info->has_acpi_build = has_acpi_build;
-    if (smbios_type1_defaults) {
+    if (smbios_defaults) {
        /* These values are guest ABI, do not change */
-        smbios_set_type1_defaults("QEMU", "Standard PC (Q35 + ICH9, 2009)",
+        smbios_set_defaults("QEMU", "Standard PC (Q35 + ICH9, 2009)",
-                                  args->machine->name);
+                            args->machine->name, smbios_legacy_mode);
    }
    /* allocate ram and load rom/bios */
@@ -240,9 +241,15 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
    }
 }
 static void pc_compat_2_0(QEMUMachineInitArgs *args)
 {
    smbios_legacy_mode = true;
 }
 static void pc_compat_1_7(QEMUMachineInitArgs *args)
 {
-    smbios_type1_defaults = false;
+    pc_compat_2_0(args);
    smbios_defaults = false;
    gigabyte_align = false;
    option_rom_has_mr = true;
    x86_cpu_compat_disable_kvm_features(FEAT_1_ECX, CPUID_EXT_X2APIC);
@@ -268,6 +275,12 @@ static void pc_compat_1_4(QEMUMachineInitArgs *args)
    x86_cpu_compat_set_features("Westmere", FEAT_1_ECX, 0, CPUID_EXT_PCLMULQDQ);
 }
 static void pc_q35_init_2_0(QEMUMachineInitArgs *args)
 {
    pc_compat_2_0(args);
    pc_q35_init(args);
 }
 static void pc_q35_init_1_7(QEMUMachineInitArgs *args)
 {
    pc_compat_1_7(args);
@@ -297,15 +310,27 @@ static void pc_q35_init_1_4(QEMUMachineInitArgs *args)
    .desc = "Standard PC (Q35 + ICH9, 2009)", \
    .hot_add_cpu = pc_hot_add_cpu
-#define PC_Q35_2_0_MACHINE_OPTIONS                      \
+#define PC_Q35_2_1_MACHINE_OPTIONS                      \
    PC_Q35_MACHINE_OPTIONS,                             \
    .default_machine_opts = "firmware=bios-256k.bin"
 static QEMUMachine pc_q35_machine_v2_1 = {
    PC_Q35_2_1_MACHINE_OPTIONS,
    .name = "pc-q35-2.1",
    .alias = "q35",
    .init = pc_q35_init,
 };
 #define PC_Q35_2_0_MACHINE_OPTIONS PC_Q35_2_1_MACHINE_OPTIONS
 static QEMUMachine pc_q35_machine_v2_0 = {
    PC_Q35_2_0_MACHINE_OPTIONS,
    .name = "pc-q35-2.0",
-    .alias = "q35",
+    .init = pc_q35_init_2_0,
-    .init = pc_q35_init,
+    .compat_props = (GlobalProperty[]) {
        PC_Q35_COMPAT_2_0,
        { /* end of list */ }
    },
 };
 #define PC_Q35_1_7_MACHINE_OPTIONS PC_Q35_MACHINE_OPTIONS
@@ -358,6 +383,7 @@ static QEMUMachine pc_q35_machine_v1_4 = {
 static void pc_q35_machine_init(void)
 {
    qemu_register_machine(&pc_q35_machine_v2_1);
    qemu_register_machine(&pc_q35_machine_v2_0);
    qemu_register_machine(&pc_q35_machine_v1_7);
    qemu_register_machine(&pc_q35_machine_v1_6);
--- a/hw/i386/smbios.c
+++ b/hw/i386/smbios.c
@@ -18,12 +18,13 @@
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/cpus.h"
 #include "hw/i386/pc.h"
 #include "hw/i386/smbios.h"
 #include "hw/loader.h"
-/*
+
- * Structures shared with the BIOS
+/* legacy structures and constants for <= 2.0 machines */
 */
 struct smbios_header {
    uint16_t length;
    uint8_t type;
@@ -46,14 +47,23 @@ struct smbios_table {
 static uint8_t *smbios_entries;
 static size_t smbios_entries_len;
 static bool smbios_legacy = true;
 /* end: legacy structures & constants for <= 2.0 machines */
 static uint8_t *smbios_tables;
 static size_t smbios_tables_len;
 static unsigned smbios_table_max;
 static unsigned smbios_table_cnt;
 static struct smbios_entry_point ep;
 static int smbios_type4_count = 0;
 static bool smbios_immutable;
 static bool smbios_have_defaults;
 static uint32_t smbios_cpuid_version, smbios_cpuid_features, smbios_smp_sockets;
-static struct {
+static DECLARE_BITMAP(have_binfile_bitmap, SMBIOS_MAX_TYPE+1);
-    bool seen;
+static DECLARE_BITMAP(have_fields_bitmap, SMBIOS_MAX_TYPE+1);
    int headertype;
    Location loc;
 } first_opt[2];
 static struct {
    const char *vendor, *version, *date;
@@ -66,6 +76,22 @@ static struct {
    /* uuid is in qemu_uuid[] */
 } type1;
 static struct {
    const char *manufacturer, *product, *version, *serial, *asset, *location;
 } type2;
 static struct {
    const char *manufacturer, *version, *serial, *asset, *sku;
 } type3;
 static struct {
    const char *sock_pfx, *manufacturer, *version, *serial, *asset, *part;
 } type4;
 static struct {
    const char *loc_pfx, *bank, *manufacturer, *serial, *asset, *part;
 } type17;
 static QemuOptsList qemu_smbios_opts = {
    .name = "smbios",
    .head = QTAILQ_HEAD_INITIALIZER(qemu_smbios_opts.head),
@@ -149,6 +175,134 @@ static const QemuOptDesc qemu_smbios_type1_opts[] = {
    { /* end of list */ }
 };
 static const QemuOptDesc qemu_smbios_type2_opts[] = {
    {
        .name = "type",
        .type = QEMU_OPT_NUMBER,
        .help = "SMBIOS element type",
    },{
        .name = "manufacturer",
        .type = QEMU_OPT_STRING,
        .help = "manufacturer name",
    },{
        .name = "product",
        .type = QEMU_OPT_STRING,
        .help = "product name",
    },{
        .name = "version",
        .type = QEMU_OPT_STRING,
        .help = "version number",
    },{
        .name = "serial",
        .type = QEMU_OPT_STRING,
        .help = "serial number",
    },{
        .name = "asset",
        .type = QEMU_OPT_STRING,
        .help = "asset tag number",
    },{
        .name = "location",
        .type = QEMU_OPT_STRING,
        .help = "location in chassis",
    },
    { /* end of list */ }
 };
 static const QemuOptDesc qemu_smbios_type3_opts[] = {
    {
        .name = "type",
        .type = QEMU_OPT_NUMBER,
        .help = "SMBIOS element type",
    },{
        .name = "manufacturer",
        .type = QEMU_OPT_STRING,
        .help = "manufacturer name",
    },{
        .name = "version",
        .type = QEMU_OPT_STRING,
        .help = "version number",
    },{
        .name = "serial",
        .type = QEMU_OPT_STRING,
        .help = "serial number",
    },{
        .name = "asset",
        .type = QEMU_OPT_STRING,
        .help = "asset tag number",
    },{
        .name = "sku",
        .type = QEMU_OPT_STRING,
        .help = "SKU number",
    },
    { /* end of list */ }
 };
 static const QemuOptDesc qemu_smbios_type4_opts[] = {
    {
        .name = "type",
        .type = QEMU_OPT_NUMBER,
        .help = "SMBIOS element type",
    },{
        .name = "sock_pfx",
        .type = QEMU_OPT_STRING,
        .help = "socket designation string prefix",
    },{
        .name = "manufacturer",
        .type = QEMU_OPT_STRING,
        .help = "manufacturer name",
    },{
        .name = "version",
        .type = QEMU_OPT_STRING,
        .help = "version number",
    },{
        .name = "serial",
        .type = QEMU_OPT_STRING,
        .help = "serial number",
    },{
        .name = "asset",
        .type = QEMU_OPT_STRING,
        .help = "asset tag number",
    },{
        .name = "part",
        .type = QEMU_OPT_STRING,
        .help = "part number",
    },
    { /* end of list */ }
 };
 static const QemuOptDesc qemu_smbios_type17_opts[] = {
    {
        .name = "type",
        .type = QEMU_OPT_NUMBER,
        .help = "SMBIOS element type",
    },{
        .name = "loc_pfx",
        .type = QEMU_OPT_STRING,
        .help = "device locator string prefix",
    },{
        .name = "bank",
        .type = QEMU_OPT_STRING,
        .help = "bank locator string",
    },{
        .name = "manufacturer",
        .type = QEMU_OPT_STRING,
        .help = "manufacturer name",
    },{
        .name = "serial",
        .type = QEMU_OPT_STRING,
        .help = "serial number",
    },{
        .name = "asset",
        .type = QEMU_OPT_STRING,
        .help = "asset tag number",
    },{
        .name = "part",
        .type = QEMU_OPT_STRING,
        .help = "part number",
    },
    { /* end of list */ }
 };
 static void smbios_register_config(void)
 {
    qemu_add_opts(&qemu_smbios_opts);
@@ -158,35 +312,17 @@ machine_init(smbios_register_config);
 static void smbios_validate_table(void)
 {
-    if (smbios_type4_count && smbios_type4_count != smp_cpus) {
+    uint32_t expect_t4_count = smbios_legacy ? smp_cpus : smbios_smp_sockets;
-        error_report("Number of SMBIOS Type 4 tables must match cpu count");
+
    if (smbios_type4_count && smbios_type4_count != expect_t4_count) {
        error_report("Expected %d SMBIOS Type 4 tables, got %d instead",
                     expect_t4_count, smbios_type4_count);
        exit(1);
    }
 }
 /*
 * To avoid unresolvable overlaps in data, don't allow both
 * tables and fields for the same smbios type.
 */
 static void smbios_check_collision(int type, int entry)
 {
    if (type < ARRAY_SIZE(first_opt)) {
        if (first_opt[type].seen) {
            if (first_opt[type].headertype != entry) {
                error_report("Can't mix file= and type= for same type");
                loc_push_restore(&first_opt[type].loc);
                error_report("This is the conflicting setting");
                loc_pop(&first_opt[type].loc);
                exit(1);
            }
        } else {
            first_opt[type].seen = true;
            first_opt[type].headertype = entry;
            loc_save(&first_opt[type].loc);
        }
    }
 }
 /* legacy setup functions for <= 2.0 machines */
 static void smbios_add_field(int type, int offset, const void *data, size_t len)
 {
    struct smbios_field *field;
@@ -256,22 +392,13 @@ static void smbios_build_type_1_fields(void)
    }
 }
-void smbios_set_type1_defaults(const char *manufacturer,
+uint8_t *smbios_get_table_legacy(size_t *length)
                               const char *product, const char *version)
 {
-    if (!type1.manufacturer) {
+    if (!smbios_legacy) {
-        type1.manufacturer = manufacturer;
+        *length = 0;
        return NULL;
    }
    if (!type1.product) {
        type1.product = product;
    }
    if (!type1.version) {
        type1.version = version;
    }
 }
 uint8_t *smbios_get_table(size_t *length)
 {
    if (!smbios_immutable) {
        smbios_build_type_0_fields();
        smbios_build_type_1_fields();
@@ -281,6 +408,458 @@ uint8_t *smbios_get_table(size_t *length)
    *length = smbios_entries_len;
    return smbios_entries;
 }
 /* end: legacy setup functions for <= 2.0 machines */
 static bool smbios_skip_table(uint8_t type, bool required_table)
 {
    if (test_bit(type, have_binfile_bitmap)) {
        return true; /* user provided their own binary blob(s) */
    }
    if (test_bit(type, have_fields_bitmap)) {
        return false; /* user provided fields via command line */
    }
    if (smbios_have_defaults && required_table) {
        return false; /* we're building tables, and this one's required */
    }
    return true;
 }
 #define SMBIOS_BUILD_TABLE_PRE(tbl_type, tbl_handle, tbl_required)        \
    struct smbios_type_##tbl_type *t;                                     \
    size_t t_off; /* table offset into smbios_tables */                   \
    int str_index = 0;                                                    \
    do {                                                                  \
        /* should we skip building this table ? */                        \
        if (smbios_skip_table(tbl_type, tbl_required)) {                  \
            return;                                                       \
        }                                                                 \
                                                                          \
        /* use offset of table t within smbios_tables */                  \
        /* (pointer must be updated after each realloc) */                \
        t_off = smbios_tables_len;                                        \
        smbios_tables_len += sizeof(*t);                                  \
        smbios_tables = g_realloc(smbios_tables, smbios_tables_len);      \
        t = (struct smbios_type_##tbl_type *)(smbios_tables + t_off);     \
                                                                          \
        t->header.type = tbl_type;                                        \
        t->header.length = sizeof(*t);                                    \
        t->header.handle = tbl_handle;                                    \
    } while (0)
 #define SMBIOS_TABLE_SET_STR(tbl_type, field, value)                      \
    do {                                                                  \
        int len = (value != NULL) ? strlen(value) + 1 : 0;                \
        if (len > 1) {                                                    \
            smbios_tables = g_realloc(smbios_tables,                      \
                                      smbios_tables_len + len);           \
            memcpy(smbios_tables + smbios_tables_len, value, len);        \
            smbios_tables_len += len;                                     \
            /* update pointer post-realloc */                             \
            t = (struct smbios_type_##tbl_type *)(smbios_tables + t_off); \
            t->field = ++str_index;                                       \
        } else {                                                          \
            t->field = 0;                                                 \
        }                                                                 \
    } while (0)
 #define SMBIOS_BUILD_TABLE_POST                                           \
    do {                                                                  \
        size_t term_cnt, t_size;                                          \
                                                                          \
        /* add '\0' terminator (add two if no strings defined) */         \
        term_cnt = (str_index == 0) ? 2 : 1;                              \
        smbios_tables = g_realloc(smbios_tables,                          \
                                  smbios_tables_len + term_cnt);          \
        memset(smbios_tables + smbios_tables_len, 0, term_cnt);           \
        smbios_tables_len += term_cnt;                                    \
                                                                          \
        /* update smbios max. element size */                             \
        t_size = smbios_tables_len - t_off;                               \
        if (t_size > smbios_table_max) {                                  \
            smbios_table_max = t_size;                                    \
        }                                                                 \
                                                                          \
        /* update smbios element count */                                 \
        smbios_table_cnt++;                                               \
    } while (0)
 static void smbios_build_type_0_table(void)
 {
    SMBIOS_BUILD_TABLE_PRE(0, 0x000, false); /* optional, leave up to BIOS */
    SMBIOS_TABLE_SET_STR(0, vendor_str, type0.vendor);
    SMBIOS_TABLE_SET_STR(0, bios_version_str, type0.version);
    t->bios_starting_address_segment = 0xE800; /* hardcoded in SeaBIOS */
    SMBIOS_TABLE_SET_STR(0, bios_release_date_str, type0.date);
    t->bios_rom_size = 0; /* hardcoded in SeaBIOS with FIXME comment */
    /* BIOS characteristics not supported */
    memset(t->bios_characteristics, 0, 8);
    t->bios_characteristics[0] = 0x08;
    /* Enable targeted content distribution (needed for SVVP, per SeaBIOS) */
    t->bios_characteristics_extension_bytes[0] = 0;
    t->bios_characteristics_extension_bytes[1] = 4;
    if (type0.have_major_minor) {
        t->system_bios_major_release = type0.major;
        t->system_bios_minor_release = type0.minor;
    } else {
        t->system_bios_major_release = 0;
        t->system_bios_minor_release = 0;
    }
    /* hardcoded in SeaBIOS */
    t->embedded_controller_major_release = 0xFF;
    t->embedded_controller_minor_release = 0xFF;
    SMBIOS_BUILD_TABLE_POST;
 }
 static void smbios_build_type_1_table(void)
 {
    SMBIOS_BUILD_TABLE_PRE(1, 0x100, true); /* required */
    SMBIOS_TABLE_SET_STR(1, manufacturer_str, type1.manufacturer);
    SMBIOS_TABLE_SET_STR(1, product_name_str, type1.product);
    SMBIOS_TABLE_SET_STR(1, version_str, type1.version);
    SMBIOS_TABLE_SET_STR(1, serial_number_str, type1.serial);
    if (qemu_uuid_set) {
        memcpy(t->uuid, qemu_uuid, 16);
    } else {
        memset(t->uuid, 0, 16);
    }
    t->wake_up_type = 0x06; /* power switch */
    SMBIOS_TABLE_SET_STR(1, sku_number_str, type1.sku);
    SMBIOS_TABLE_SET_STR(1, family_str, type1.family);
    SMBIOS_BUILD_TABLE_POST;
 }
 static void smbios_build_type_2_table(void)
 {
    SMBIOS_BUILD_TABLE_PRE(2, 0x200, false); /* optional */
    SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
    SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
    SMBIOS_TABLE_SET_STR(2, version_str, type2.version);
    SMBIOS_TABLE_SET_STR(2, serial_number_str, type2.serial);
    SMBIOS_TABLE_SET_STR(2, asset_tag_number_str, type2.asset);
    t->feature_flags = 0x01; /* Motherboard */
    SMBIOS_TABLE_SET_STR(2, location_str, type2.location);
    t->chassis_handle = 0x300; /* Type 3 (System enclosure) */
    t->board_type = 0x0A; /* Motherboard */
    t->contained_element_count = 0;
    SMBIOS_BUILD_TABLE_POST;
 }
 static void smbios_build_type_3_table(void)
 {
    SMBIOS_BUILD_TABLE_PRE(3, 0x300, true); /* required */
    SMBIOS_TABLE_SET_STR(3, manufacturer_str, type3.manufacturer);
    t->type = 0x01; /* Other */
    SMBIOS_TABLE_SET_STR(3, version_str, type3.version);
    SMBIOS_TABLE_SET_STR(3, serial_number_str, type3.serial);
    SMBIOS_TABLE_SET_STR(3, asset_tag_number_str, type3.asset);
    t->boot_up_state = 0x03; /* Safe */
    t->power_supply_state = 0x03; /* Safe */
    t->thermal_state = 0x03; /* Safe */
    t->security_status = 0x02; /* Unknown */
    t->oem_defined = 0;
    t->height = 0;
    t->number_of_power_cords = 0;
    t->contained_element_count = 0;
    SMBIOS_TABLE_SET_STR(3, sku_number_str, type3.sku);
    SMBIOS_BUILD_TABLE_POST;
 }
 static void smbios_build_type_4_table(unsigned instance)
 {
    char sock_str[128];
    SMBIOS_BUILD_TABLE_PRE(4, 0x400 + instance, true); /* required */
    snprintf(sock_str, sizeof(sock_str), "%s%2x", type4.sock_pfx, instance);
    SMBIOS_TABLE_SET_STR(4, socket_designation_str, sock_str);
    t->processor_type = 0x03; /* CPU */
    SMBIOS_TABLE_SET_STR(4, processor_manufacturer_str, type4.manufacturer);
    t->processor_id[0] = smbios_cpuid_version;
    t->processor_id[1] = smbios_cpuid_features;
    SMBIOS_TABLE_SET_STR(4, processor_version_str, type4.version);
    t->voltage = 0;
    t->external_clock = 0; /* Unknown */
    t->max_speed = 0; /* Unknown */
    t->current_speed = 0; /* Unknown */
    t->status = 0x41; /* Socket populated, CPU enabled */
    t->processor_upgrade = 0x01; /* Other */
    t->l1_cache_handle = 0xFFFF; /* N/A */
    t->l2_cache_handle = 0xFFFF; /* N/A */
    t->l3_cache_handle = 0xFFFF; /* N/A */
    SMBIOS_TABLE_SET_STR(4, serial_number_str, type4.serial);
    SMBIOS_TABLE_SET_STR(4, asset_tag_number_str, type4.asset);
    SMBIOS_TABLE_SET_STR(4, part_number_str, type4.part);
    t->core_count = t->core_enabled = smp_cores;
    t->thread_count = smp_threads;
    t->processor_characteristics = 0x02; /* Unknown */
    t->processor_family = t->processor_family2 = 0x01; /* Other */
    SMBIOS_BUILD_TABLE_POST;
    smbios_type4_count++;
 }
 #define ONE_KB ((ram_addr_t)1 << 10)
 #define ONE_MB ((ram_addr_t)1 << 20)
 #define ONE_GB ((ram_addr_t)1 << 30)
 #define MAX_T16_STD_SZ 0x80000000 /* 2T in Kilobytes */
 static void smbios_build_type_16_table(unsigned dimm_cnt)
 {
    ram_addr_t size_kb;
    SMBIOS_BUILD_TABLE_PRE(16, 0x1000, true); /* required */
    t->location = 0x01; /* Other */
    t->use = 0x03; /* System memory */
    t->error_correction = 0x06; /* Multi-bit ECC (for Microsoft, per SeaBIOS) */
    size_kb = QEMU_ALIGN_UP(ram_size, ONE_KB) / ONE_KB;
    if (size_kb < MAX_T16_STD_SZ) {
        t->maximum_capacity = size_kb;
        t->extended_maximum_capacity = 0;
    } else {
        t->maximum_capacity = MAX_T16_STD_SZ;
        t->extended_maximum_capacity = ram_size;
    }
    t->memory_error_information_handle = 0xFFFE; /* Not provided */
    t->number_of_memory_devices = dimm_cnt;
    SMBIOS_BUILD_TABLE_POST;
 }
 #define MAX_T17_STD_SZ 0x7FFF /* (32G - 1M), in Megabytes */
 #define MAX_T17_EXT_SZ 0x80000000 /* 2P, in Megabytes */
 static void smbios_build_type_17_table(unsigned instance, ram_addr_t size)
 {
    char loc_str[128];
    ram_addr_t size_mb;
    SMBIOS_BUILD_TABLE_PRE(17, 0x1100 + instance, true); /* required */
    t->physical_memory_array_handle = 0x1000; /* Type 16 (Phys. Mem. Array) */
    t->memory_error_information_handle = 0xFFFE; /* Not provided */
    t->total_width = 0xFFFF; /* Unknown */
    t->data_width = 0xFFFF; /* Unknown */
    size_mb = QEMU_ALIGN_UP(size, ONE_MB) / ONE_MB;
    if (size_mb < MAX_T17_STD_SZ) {
        t->size = size_mb;
        t->extended_size = 0;
    } else {
        assert(size_mb < MAX_T17_EXT_SZ);
        t->size = MAX_T17_STD_SZ;
        t->extended_size = size_mb;
    }
    t->form_factor = 0x09; /* DIMM */
    t->device_set = 0; /* Not in a set */
    snprintf(loc_str, sizeof(loc_str), "%s %d", type17.loc_pfx, instance);
    SMBIOS_TABLE_SET_STR(17, device_locator_str, loc_str);
    SMBIOS_TABLE_SET_STR(17, bank_locator_str, type17.bank);
    t->memory_type = 0x07; /* RAM */
    t->type_detail = 0x02; /* Other */
    t->speed = 0; /* Unknown */
    SMBIOS_TABLE_SET_STR(17, manufacturer_str, type17.manufacturer);
    SMBIOS_TABLE_SET_STR(17, serial_number_str, type17.serial);
    SMBIOS_TABLE_SET_STR(17, asset_tag_number_str, type17.asset);
    SMBIOS_TABLE_SET_STR(17, part_number_str, type17.part);
    t->attributes = 0; /* Unknown */
    t->configured_clock_speed = 0; /* Unknown */
    t->minimum_voltage = 0; /* Unknown */
    t->maximum_voltage = 0; /* Unknown */
    t->configured_voltage = 0; /* Unknown */
    SMBIOS_BUILD_TABLE_POST;
 }
 static void smbios_build_type_19_table(unsigned instance,
                                       ram_addr_t start, ram_addr_t size)
 {
    ram_addr_t end, start_kb, end_kb;
    SMBIOS_BUILD_TABLE_PRE(19, 0x1300 + instance, true); /* required */
    end = start + size - 1;
    assert(end > start);
    start_kb = start / ONE_KB;
    end_kb = end / ONE_KB;
    if (start_kb < UINT32_MAX && end_kb < UINT32_MAX) {
        t->starting_address = start_kb;
        t->ending_address = end_kb;
        t->extended_starting_address = t->extended_ending_address = 0;
    } else {
        t->starting_address = t->ending_address = UINT32_MAX;
        t->extended_starting_address = start;
        t->extended_ending_address = end;
    }
    t->memory_array_handle = 0x1000; /* Type 16 (Phys. Mem. Array) */
    t->partition_width = 1; /* One device per row */
    SMBIOS_BUILD_TABLE_POST;
 }
 static void smbios_build_type_32_table(void)
 {
    SMBIOS_BUILD_TABLE_PRE(32, 0x2000, true); /* required */
    memset(t->reserved, 0, 6);
    t->boot_status = 0; /* No errors detected */
    SMBIOS_BUILD_TABLE_POST;
 }
 static void smbios_build_type_127_table(void)
 {
    SMBIOS_BUILD_TABLE_PRE(127, 0x7F00, true); /* required */
    SMBIOS_BUILD_TABLE_POST;
 }
 void smbios_set_cpuid(uint32_t version, uint32_t features)
 {
    smbios_cpuid_version = version;
    smbios_cpuid_features = features;
 }
 #define SMBIOS_SET_DEFAULT(field, value)                                  \
    if (!field) {                                                         \
        field = value;                                                    \
    }
 #define G_FREE_UNLESS_NULL(ptr)                                           \
    if (ptr != NULL) {                                                    \
        g_free(ptr);                                                      \
    }
 void smbios_set_defaults(const char *manufacturer, const char *product,
                         const char *version, bool legacy_mode)
 {
    smbios_have_defaults = true;
    smbios_legacy = legacy_mode;
    /* drop unwanted version of command-line file blob(s) */
    if (smbios_legacy) {
        G_FREE_UNLESS_NULL(smbios_tables);
        /* in legacy mode, also complain if fields were given for types > 1 */
        if (find_next_bit(have_fields_bitmap,
                          SMBIOS_MAX_TYPE+1, 2) < SMBIOS_MAX_TYPE+1) {
            error_report("can't process fields for smbios "
                         "types > 1 on machine versions < 2.1!");
            exit(1);
        }
    } else {
        G_FREE_UNLESS_NULL(smbios_entries);
    }
    SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
    SMBIOS_SET_DEFAULT(type1.product, product);
    SMBIOS_SET_DEFAULT(type1.version, version);
    SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
    SMBIOS_SET_DEFAULT(type2.product, product);
    SMBIOS_SET_DEFAULT(type2.version, version);
    SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
    SMBIOS_SET_DEFAULT(type3.version, version);
    SMBIOS_SET_DEFAULT(type4.sock_pfx, "CPU");
    SMBIOS_SET_DEFAULT(type4.manufacturer, manufacturer);
    SMBIOS_SET_DEFAULT(type4.version, version);
    SMBIOS_SET_DEFAULT(type17.loc_pfx, "DIMM");
    SMBIOS_SET_DEFAULT(type17.manufacturer, manufacturer);
 }
 static void smbios_entry_point_setup(void)
 {
    memcpy(ep.anchor_string, "_SM_", 4);
    memcpy(ep.intermediate_anchor_string, "_DMI_", 5);
    ep.length = sizeof(struct smbios_entry_point);
    ep.entry_point_revision = 0; /* formatted_area reserved, per spec v2.1+ */
    memset(ep.formatted_area, 0, 5);
    /* compliant with smbios spec v2.8 */
    ep.smbios_major_version = 2;
    ep.smbios_minor_version = 8;
    ep.smbios_bcd_revision = 0x28;
    /* set during table construction, but BIOS may override: */
    ep.structure_table_length = smbios_tables_len;
    ep.max_structure_size = smbios_table_max;
    ep.number_of_structures = smbios_table_cnt;
    /* BIOS must recalculate: */
    ep.checksum = 0;
    ep.intermediate_checksum = 0;
    ep.structure_table_address = 0; /* where BIOS has copied smbios_tables */
 }
 void smbios_get_tables(uint8_t **tables, size_t *tables_len,
                       uint8_t **anchor, size_t *anchor_len)
 {
    unsigned i, dimm_cnt, instance;
    if (smbios_legacy) {
        *tables = *anchor = NULL;
        *tables_len = *anchor_len = 0;
        return;
    }
    if (!smbios_immutable) {
        smbios_build_type_0_table();
        smbios_build_type_1_table();
        smbios_build_type_2_table();
        smbios_build_type_3_table();
        smbios_smp_sockets = smp_cpus / (smp_cores * smp_threads);
        assert(smbios_smp_sockets >= 1);
        for (i = 0; i < smbios_smp_sockets; i++) {
            smbios_build_type_4_table(i);
        }
 #define MAX_DIMM_SZ (16ll * ONE_GB)
 #define GET_DIMM_SZ ((i < dimm_cnt - 1) ? MAX_DIMM_SZ : ram_size % MAX_DIMM_SZ)
        dimm_cnt = QEMU_ALIGN_UP(ram_size, MAX_DIMM_SZ) / MAX_DIMM_SZ;
        smbios_build_type_16_table(dimm_cnt);
        for (i = 0; i < dimm_cnt; i++) {
            smbios_build_type_17_table(i, GET_DIMM_SZ);
        }
        for (i = 0, instance = 0; i < e820_get_num_entries(); i++) {
            uint64_t address, length;
            if (e820_get_entry(i, E820_RAM, &address, &length)) {
                smbios_build_type_19_table(instance++, address, length);
            }
        }
        smbios_build_type_32_table();
        smbios_build_type_127_table();
        smbios_validate_table();
        smbios_entry_point_setup();
        smbios_immutable = true;
    }
    /* return tables blob and entry point (anchor), and their sizes */
    *tables = smbios_tables;
    *tables_len = smbios_tables_len;
    *anchor = (uint8_t *)&ep;
    *anchor_len = sizeof(struct smbios_entry_point);
 }
 static void save_opt(const char **dest, QemuOpts *opts, const char *name)
 {
@@ -297,11 +876,12 @@ void smbios_entry_add(QemuOpts *opts)
    const char *val;
    assert(!smbios_immutable);
    val = qemu_opt_get(opts, "file");
    if (val) {
        struct smbios_structure_header *header;
        struct smbios_table *table;
        int size;
        struct smbios_table *table; /* legacy mode only */
        qemu_opts_validate(opts, qemu_smbios_file_opts, &local_err);
        if (local_err) {
@@ -315,31 +895,60 @@ void smbios_entry_add(QemuOpts *opts)
            exit(1);
        }
-        if (!smbios_entries) {
+        /*
-            smbios_entries_len = sizeof(uint16_t);
+         * NOTE: standard double '\0' terminator expected, per smbios spec.
-            smbios_entries = g_malloc0(smbios_entries_len);
+         * (except in legacy mode, where the second '\0' is implicit and
-        }
+         *  will be inserted by the BIOS).
         */
        smbios_tables = g_realloc(smbios_tables, smbios_tables_len + size);
        header = (struct smbios_structure_header *)(smbios_tables +
                                                    smbios_tables_len);
-        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
+        if (load_image(val, (uint8_t *)header) != size) {
                                                      sizeof(*table) + size);
        table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
        table->header.type = SMBIOS_TABLE_ENTRY;
        table->header.length = cpu_to_le16(sizeof(*table) + size);
        if (load_image(val, table->data) != size) {
            error_report("Failed to load SMBIOS file %s", val);
            exit(1);
        }
-        header = (struct smbios_structure_header *)(table->data);
+        if (test_bit(header->type, have_fields_bitmap)) {
-        smbios_check_collision(header->type, SMBIOS_TABLE_ENTRY);
+            error_report("can't load type %d struct, fields already specified!",
                         header->type);
            exit(1);
        }
        set_bit(header->type, have_binfile_bitmap);
        if (header->type == 4) {
            smbios_type4_count++;
        }
        smbios_tables_len += size;
        if (size > smbios_table_max) {
            smbios_table_max = size;
        }
        smbios_table_cnt++;
        /* add a copy of the newly loaded blob to legacy smbios_entries */
        /* NOTE: This code runs before smbios_set_defaults(), so we don't
         *       yet know which mode (legacy vs. aggregate-table) will be
         *       required. We therefore add the binary blob to both legacy
         *       (smbios_entries) and aggregate (smbios_tables) tables, and
         *       delete the one we don't need from smbios_set_defaults(),
         *       once we know which machine version has been requested.
         */
        if (!smbios_entries) {
            smbios_entries_len = sizeof(uint16_t);
            smbios_entries = g_malloc0(smbios_entries_len);
        }
        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
                                                   size + sizeof(*table));
        table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
        table->header.type = SMBIOS_TABLE_ENTRY;
        table->header.length = cpu_to_le16(sizeof(*table) + size);
        memcpy(table->data, header, size);
        smbios_entries_len += sizeof(*table) + size;
        (*(uint16_t *)smbios_entries) =
                cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
        /* end: add a copy of the newly loaded blob to legacy smbios_entries */
        return;
    }
@@ -347,7 +956,16 @@ void smbios_entry_add(QemuOpts *opts)
    if (val) {
        unsigned long type = strtoul(val, NULL, 0);
-        smbios_check_collision(type, SMBIOS_FIELD_ENTRY);
+        if (type > SMBIOS_MAX_TYPE) {
            error_report("out of range!");
            exit(1);
        }
        if (test_bit(type, have_binfile_bitmap)) {
            error_report("can't add fields, binary file already loaded!");
            exit(1);
        }
        set_bit(type, have_fields_bitmap);
        switch (type) {
        case 0:
@@ -391,6 +1009,57 @@ void smbios_entry_add(QemuOpts *opts)
                qemu_uuid_set = true;
            }
            return;
        case 2:
            qemu_opts_validate(opts, qemu_smbios_type2_opts, &local_err);
            if (local_err) {
                error_report("%s", error_get_pretty(local_err));
                exit(1);
            }
            save_opt(&type2.manufacturer, opts, "manufacturer");
            save_opt(&type2.product, opts, "product");
            save_opt(&type2.version, opts, "version");
            save_opt(&type2.serial, opts, "serial");
            save_opt(&type2.asset, opts, "asset");
            save_opt(&type2.location, opts, "location");
            return;
        case 3:
            qemu_opts_validate(opts, qemu_smbios_type3_opts, &local_err);
            if (local_err) {
                error_report("%s", error_get_pretty(local_err));
                exit(1);
            }
            save_opt(&type3.manufacturer, opts, "manufacturer");
            save_opt(&type3.version, opts, "version");
            save_opt(&type3.serial, opts, "serial");
            save_opt(&type3.asset, opts, "asset");
            save_opt(&type3.sku, opts, "sku");
            return;
        case 4:
            qemu_opts_validate(opts, qemu_smbios_type4_opts, &local_err);
            if (local_err) {
                error_report("%s", error_get_pretty(local_err));
                exit(1);
            }
            save_opt(&type4.sock_pfx, opts, "sock_pfx");
            save_opt(&type4.manufacturer, opts, "manufacturer");
            save_opt(&type4.version, opts, "version");
            save_opt(&type4.serial, opts, "serial");
            save_opt(&type4.asset, opts, "asset");
            save_opt(&type4.part, opts, "part");
            return;
        case 17:
            qemu_opts_validate(opts, qemu_smbios_type17_opts, &local_err);
            if (local_err) {
                error_report("%s", error_get_pretty(local_err));
                exit(1);
            }
            save_opt(&type17.loc_pfx, opts, "loc_pfx");
            save_opt(&type17.bank, opts, "bank");
            save_opt(&type17.manufacturer, opts, "manufacturer");
            save_opt(&type17.serial, opts, "serial");
            save_opt(&type17.asset, opts, "asset");
            save_opt(&type17.part, opts, "part");
            return;
        default:
            error_report("Don't know how to build fields for SMBIOS type %ld",
                         type);
--- a/hw/i386/xen/Makefile.objs
+++ b/hw/i386/xen/Makefile.objs
@@ -0,0 +1 @@
 obj-y += xen_platform.o xen_apic.o xen_pvdevice.o
--- a/hw/i386/xen/xen_apic.c
+++ b/hw/i386/xen/xen_apic.c
--- a/hw/i386/xen/xen_platform.c
+++ b/hw/i386/xen/xen_platform.c
--- a/hw/i386/xen/xen_pvdevice.c
+++ b/hw/i386/xen/xen_pvdevice.c
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -438,9 +438,9 @@ static void check_cmd(AHCIState *s, int port)
    if ((pr->cmd & PORT_CMD_START) && pr->cmd_issue) {
        for (slot = 0; (slot < 32) && pr->cmd_issue; slot++) {
-            if ((pr->cmd_issue & (1 << slot)) &&
+            if ((pr->cmd_issue & (1U << slot)) &&
                !handle_cmd(s, port, slot)) {
-                pr->cmd_issue &= ~(1 << slot);
+                pr->cmd_issue &= ~(1U << slot);
            }
        }
    }
@@ -1293,7 +1293,7 @@ const VMStateDescription vmstate_ahci = {
        VMSTATE_UINT32(control_regs.impl, AHCIState),
        VMSTATE_UINT32(control_regs.version, AHCIState),
        VMSTATE_UINT32(idp_index, AHCIState),
-        VMSTATE_INT32(ports, AHCIState),
+        VMSTATE_INT32_EQUAL(ports, AHCIState),
        VMSTATE_END_OF_LIST()
    },
 };
--- a/Show More
+++ b/Show More
		`@@ -0,0 +1 @@`
							`obj-y += xen_platform.o xen_apic.o xen_pvdevice.o`