Add release tag for 0.10.1 release

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/tags/release_0_10_1@6881 c046a42c-6fe2-441c-8c8c-71466251a162
Add release_0_10_1 tag
2009-03-21 23:04:14 +00:00 · 2009-03-21 22:34:21 +00:00
76 changed files with 519 additions and 1738 deletions
--- a/84
+++ b/84
@@ -1,87 +1,3 @@
-version 0.10.6:
-  - e1000: ignore reset command (Kevin Wolf)
-  - fix VNC memory allocation (Stefan Weil)
-  - fix raw_pread_aligned return value (Christoph Hellwig)
-  - allow monitor interaction when using -incoming exec: (Chris Lalancette)
-  - fix -net socket,listen (Jan Kiszka)
-  - live migration: don't send gratuitous packets all at once (Gleb Natapov)
-  - serial: fix lost characters after sysrq (Jason Wessel)
-  - Fix prototype of zfree (Stefan Weil)
-  - Handle EINTR with exec: migration (Uri Lublin)
-  - Delete io-handler before closing fd after migration (Uri Lublin)
-  - Fix qemu_aio_flush (Andrea Arcangeli)
-  - lsi53c895a: Implement additional registers (Sebastian Herbszt)
-  - virtio-blk: fix warning (Gerd Hoffman)
-  - i386: fix cpu reset (Nitin Kamble)
-  - kvm: fix irq injection into full queue (Jan Kiszka)
-  - Prevent CD-ROM eject while device is locked (Mark McLoughlin)
-  - Fix screen dump with blank screen (Eduardo Habkost)
-  - Fix memory leak with cpu_unregister_map_client (Isaku Yamahata)
-  - Fix memory leak in SDL (Jan Kiszka)
-  - Fix build on OS X 10.4 (John Arbuckle)
-  - Fix leak of vlan clients after hot remove (Mark McLoughlin)
-  - Fix migration after hot remove with eepro100 (Mark McLoughlin)
-  - Don't start a VM after failed migration if stopped (Anthony Liguori)
-  - Fix live migration under heavy IO load (Glauber Costa)
-  - Honor -S on incoming migration (Paolo Bonzini)
-  - Reset HPET config register on reset (Beth Kon)
-  - Reset PS2 keyboard/mouse on reset (Dinesh Subraveti)
-
-version 0.10.5:
-  - kvm: trim unsupported cpu features from cpuid (Avi Kivity)
-  - kvm: provide a better error message for -smp > 1 (Mark McLoughlin)
-  - Remove initrd printfs (Richard Jones)
-  - Initial variables found by valgrind (Jean-Christophe Dubois)
-  - Fix -initrd with > 4GB guests (Glauber Costa)
-  - Fix busy loop on live migration for certain platforms (Uri Lublin)
-  - Remove GCC 3.x requirements from docs (Hollis Blanchard)
-  - ETRAX: fixes for kernel command line, ethernet address, bmi (Edgar Iglesias)
-  - CRIS: Fix bmi (Edgar Iglesias)
-  - Fix bounce buffer errors (Avi Kivity)
-  - Fix regression in -kernel (Anthony Liguori)
-
-version 0.10.4:
-  - Improve block range checks to remove integer overflow (Kevin Wolf)
-  - e1000: do not re-init PCI config space 0 (Amit Shah)
-  - fix AIO deletion race (Alex Graf)
-  - reset option roms on reboot (Glauber Costa)
-  - fix qcow2 corruption in cluster freeing (Gleb Natapov)
-  - Enable power button event generation (Gleb Natapov)
-
-version 0.10.3:
-  - fix AIO cancellations (Avi Kivity)
-  - fix live migration error path on incoming
-  - avoid SEGV on pci hotplug failure (Chris Wright)
-  - fix serial option in -drive
-  - support DDIM for option roms (Glauber Costa)
-  - avoid fork/exec on pre-2.6.27 kernels with KVM (Jan Kiszka)
-  - block-vpc: don't silently create smaller images than requested (Kevin Wolf)
-  - Fix non-ACPI timer interrupt routing (Beth Kon)
-  - hpet: fix emulation of HPET_TN_SETVAL (Jan Kiszka)
-  - kvm: fix cpuid initialization (Jan Kiszka)
-  - qcow2: fix corruption on little endian hosts (Kevin Wolf)
-  - avoid leaing memory on hot unplug (Mark McLoughlin)
-  - fix savevm/migration after hot unplug (Mark McLoughlin)
-  - Fix keyboard mapping on newer Xords with non-default keymaps (balrog)
-  - Make PCI config status register read-only (Anthony Liguori)
-  - Fix crash on resolution change -> screen dump -> vga redraw (Avi Kivity)
-
-version 0.10.2:
-
-  - fix savevm/loadvm (Anthony Liguori)
-  - live migration: fix dirty tracking windows (Glauber Costa)
-  - live migration: improve error propogation (Glauber Costa)
-  - qcow2: fix image creation for > ~2TB images (Chris Wright)
-  - hotplug: fix error handling for if= parameter (Eduardo Habkost)
-  - qcow2: fix data corruption (Nolan Leake)
-  - virtio: fix guest oops with 2.6.25 kernels (Rusty Russell)
-  - SH4: add support for -kernel (Takashi Yoshii, Aurelien Jarno)
-  - hotplug: fix closing of char devices (Jan Kiszka)
-  - hotplug: remove incorrect check for device name (Eduardo Habkost)
-  - enable -k on win32 (Herve Poussineau)
-  - configure: use LANG=C for grep (Andreas Faerber)
-  - fix VGA regression (malc)
-	
 version 0.10.1:

  - virtio-net: allow masking of notifications on empty queue (Alex Williamson)
--- a/2
+++ b/2
@@ -1 +1 @@
-0.10.6
+0.10.1
--- a/aio.c
+++ b/aio.c
@@ -44,8 +44,7 @@ static AioHandler *find_aio_handler(int fd)

    LIST_FOREACH(node, &aio_handlers, node) {
        if (node->fd == fd)
-            if (!node->deleted)
-                return node;
+            return node;
    }

    return NULL;
@@ -103,16 +102,12 @@ void qemu_aio_flush(void)
    do {
        ret = 0;

-	/*
-	 * If there are pending emulated aio start them now so flush
-	 * will be able to return 1.
-	 */
-        qemu_aio_wait();
-
        LIST_FOREACH(node, &aio_handlers, node) {
            ret |= node->io_flush(node->opaque);
        }
-    } while (qemu_bh_poll() || ret > 0);
+
+        qemu_aio_wait();
+    } while (ret > 0);
 }

 void qemu_aio_wait(void)
--- a/block-qcow2.c
+++ b/block-qcow2.c
@@ -670,10 +670,6 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,

    nb_available = (nb_available >> 9) + index_in_cluster;

-    if (nb_needed > nb_available) {
-        nb_needed = nb_available;
-    }
-
    cluster_offset = 0;

    /* seek the the l2 offset in the l1 table */
@@ -903,12 +899,6 @@ static int alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset,
        goto err;

    for (i = 0; i < m->nb_clusters; i++) {
-        /* if two concurrent writes happen to the same unallocated cluster
-	 * each write allocates separate cluster and writes data concurrently.
-	 * The first one to complete updates l2 table with pointer to its
-	 * cluster the second one has to do RMW (which is done above by
-	 * copy_sectors()), update l2 table with its cluster pointer and free
-	 * old cluster. This is what this loop does */
        if(l2_table[l2_index + i] != 0)
            old_cluster[j++] = l2_table[l2_index + i];

@@ -922,8 +912,7 @@ static int alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset,
        goto err;

    for (i = 0; i < j; i++)
-        free_any_clusters(bs, be64_to_cpu(old_cluster[i]) & ~QCOW_OFLAG_COPIED,
-                          1);
+        free_any_clusters(bs, old_cluster[i], 1);

    ret = 0;
 err:
@@ -1469,7 +1458,6 @@ static int qcow_create(const char *filename, int64_t total_size,
                      const char *backing_file, int flags)
 {
    int fd, header_size, backing_filename_len, l1_size, i, shift, l2_bits;
-    int ref_clusters;
    QCowHeader header;
    uint64_t tmp, offset;
    QCowCreateState s1, *s = &s1;
@@ -1510,28 +1498,22 @@ static int qcow_create(const char *filename, int64_t total_size,
    offset += align_offset(l1_size * sizeof(uint64_t), s->cluster_size);

    s->refcount_table = qemu_mallocz(s->cluster_size);
+    s->refcount_block = qemu_mallocz(s->cluster_size);

    s->refcount_table_offset = offset;
    header.refcount_table_offset = cpu_to_be64(offset);
    header.refcount_table_clusters = cpu_to_be32(1);
    offset += s->cluster_size;
+
+    s->refcount_table[0] = cpu_to_be64(offset);
    s->refcount_block_offset = offset;
-
-    /* count how many refcount blocks needed */
-    tmp = offset >> s->cluster_bits;
-    ref_clusters = (tmp >> (s->cluster_bits - REFCOUNT_SHIFT)) + 1;
-    for (i=0; i < ref_clusters; i++) {
-        s->refcount_table[i] = cpu_to_be64(offset);
-        offset += s->cluster_size;
-    }
-
-    s->refcount_block = qemu_mallocz(ref_clusters * s->cluster_size);
+    offset += s->cluster_size;

    /* update refcounts */
    create_refcount_update(s, 0, header_size);
    create_refcount_update(s, s->l1_table_offset, l1_size * sizeof(uint64_t));
    create_refcount_update(s, s->refcount_table_offset, s->cluster_size);
-    create_refcount_update(s, s->refcount_block_offset, ref_clusters * s->cluster_size);
+    create_refcount_update(s, s->refcount_block_offset, s->cluster_size);

    /* write all the data */
    write(fd, &header, sizeof(header));
@@ -1547,7 +1529,7 @@ static int qcow_create(const char *filename, int64_t total_size,
    write(fd, s->refcount_table, s->cluster_size);

    lseek(fd, s->refcount_block_offset, SEEK_SET);
-    write(fd, s->refcount_block, ref_clusters * s->cluster_size);
+    write(fd, s->refcount_block, s->cluster_size);

    qemu_free(s->refcount_table);
    qemu_free(s->refcount_block);
@@ -2608,31 +2590,6 @@ static void dump_refcounts(BlockDriverState *bs)
 #endif
 #endif

-static int qcow_put_buffer(BlockDriverState *bs, const uint8_t *buf,
-                           int64_t pos, int size)
-{
-    int growable = bs->growable;
-
-    bs->growable = 1;
-    bdrv_pwrite(bs, pos, buf, size);
-    bs->growable = growable;
-
-    return size;
-}
-
-static int qcow_get_buffer(BlockDriverState *bs, uint8_t *buf,
-                           int64_t pos, int size)
-{
-    int growable = bs->growable;
-    int ret;
-
-    bs->growable = 1;
-    ret = bdrv_pread(bs, pos, buf, size);
-    bs->growable = growable;
-
-    return ret;
-}
-
 BlockDriver bdrv_qcow2 = {
    "qcow2",
    sizeof(BDRVQcowState),
@@ -2658,7 +2615,4 @@ BlockDriver bdrv_qcow2 = {
    .bdrv_snapshot_delete = qcow_snapshot_delete,
    .bdrv_snapshot_list = qcow_snapshot_list,
    .bdrv_get_info = qcow_get_info,
-
-    .bdrv_put_buffer    = qcow_put_buffer,
-    .bdrv_get_buffer    = qcow_get_buffer,
 };
--- a/block-raw-posix.c
+++ b/block-raw-posix.c
@@ -75,11 +75,7 @@

 /* OS X does not have O_DSYNC */
 #ifndef O_DSYNC
-#ifdef O_SYNC
 #define O_DSYNC O_SYNC
-#elif defined(O_FSYNC)
-#define O_DSYNC O_FSYNC
-#endif
 #endif

 /* Approximate O_DIRECT with O_DSYNC if O_DIRECT isn't available */
@@ -238,7 +234,7 @@ static int raw_pread_aligned(BlockDriverState *bs, int64_t offset,

 label__raw_read__success:

-    return  (ret < 0) ? -errno : ret;
+    return ret;
 }

 /*
--- a/block-raw-win32.c
+++ b/block-raw-win32.c
@@ -399,15 +399,10 @@ static int find_device_type(BlockDriverState *bs, const char *filename)
            return FTYPE_HARDDISK;
        snprintf(s->drive_path, sizeof(s->drive_path), "%c:\\", p[0]);
        type = GetDriveType(s->drive_path);
-        switch (type) {
-        case DRIVE_REMOVABLE:
-        case DRIVE_FIXED:
-            return FTYPE_HARDDISK;
-        case DRIVE_CDROM:
+        if (type == DRIVE_CDROM)
            return FTYPE_CD;
-        default:
+        else
            return FTYPE_FILE;
-        }
    } else {
        return FTYPE_FILE;
    }
--- a/block-vmdk.c
+++ b/block-vmdk.c
@@ -169,7 +169,7 @@ static int vmdk_is_cid_valid(BlockDriverState *bs)
 {
 #ifdef CHECK_CID
    BDRVVmdkState *s = bs->opaque;
-    BlockDriverState *p_bs = bs->backing_hd;
+    BlockDriverState *p_bs = s->hd->backing_hd;
    uint32_t cur_pcid;

    if (p_bs) {
@@ -337,26 +337,26 @@ static int vmdk_parent_open(BlockDriverState *bs, const char * filename)
        p_name += sizeof("parentFileNameHint") + 1;
        if ((end_name = strchr(p_name,'\"')) == 0)
            return -1;
-        if ((end_name - p_name) > sizeof (bs->backing_file) - 1)
+        if ((end_name - p_name) > sizeof (s->hd->backing_file) - 1)
            return -1;

-        pstrcpy(bs->backing_file, end_name - p_name + 1, p_name);
-        if (stat(bs->backing_file, &file_buf) != 0) {
+        pstrcpy(s->hd->backing_file, end_name - p_name + 1, p_name);
+        if (stat(s->hd->backing_file, &file_buf) != 0) {
            path_combine(parent_img_name, sizeof(parent_img_name),
-                         filename, bs->backing_file);
+                         filename, s->hd->backing_file);
        } else {
            pstrcpy(parent_img_name, sizeof(parent_img_name),
-                    bs->backing_file);
+                    s->hd->backing_file);
        }

-        bs->backing_hd = bdrv_new("");
-        if (!bs->backing_hd) {
+        s->hd->backing_hd = bdrv_new("");
+        if (!s->hd->backing_hd) {
            failure:
            bdrv_close(s->hd);
            return -1;
        }
        parent_open = 1;
-        if (bdrv_open(bs->backing_hd, parent_img_name, BDRV_O_RDONLY) < 0)
+        if (bdrv_open(s->hd->backing_hd, parent_img_name, BDRV_O_RDONLY) < 0)
            goto failure;
        parent_open = 0;
    }
@@ -463,14 +463,13 @@ static int get_whole_cluster(BlockDriverState *bs, uint64_t cluster_offset,

    // we will be here if it's first write on non-exist grain(cluster).
    // try to read from parent image, if exist
-    if (bs->backing_hd) {
-        BDRVVmdkState *ps = bs->backing_hd->opaque;
+    if (s->hd->backing_hd) {
+        BDRVVmdkState *ps = s->hd->backing_hd->opaque;

        if (!vmdk_is_cid_valid(bs))
            return -1;

-        parent_cluster_offset = get_cluster_offset(bs->backing_hd, NULL,
-            offset, allocate);
+        parent_cluster_offset = get_cluster_offset(s->hd->backing_hd, NULL, offset, allocate);

        if (parent_cluster_offset) {
            BDRVVmdkState *act_s = activeBDRV.hd->opaque;
@@ -621,10 +620,10 @@ static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
            n = nb_sectors;
        if (!cluster_offset) {
            // try to read from parent image, if exist
-            if (bs->backing_hd) {
+            if (s->hd->backing_hd) {
                if (!vmdk_is_cid_valid(bs))
                    return -1;
-                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
+                ret = bdrv_read(s->hd->backing_hd, sector_num, buf, n);
                if (ret < 0)
                    return -1;
            } else {
--- a/block-vpc.c
+++ b/block-vpc.c
@@ -433,16 +433,14 @@ static int vpc_write(BlockDriverState *bs, int64_t sector_num,
 *
 * Note that the geometry doesn't always exactly match total_sectors but
 * may round it down.
- *
- * Returns 0 on success, -EFBIG if the size is larger than 127 GB
 */
-static int calculate_geometry(int64_t total_sectors, uint16_t* cyls,
+static void calculate_geometry(int64_t total_sectors, uint16_t* cyls,
    uint8_t* heads, uint8_t* secs_per_cyl)
 {
    uint32_t cyls_times_heads;

    if (total_sectors > 65535 * 16 * 255)
-        return -EFBIG;
+        total_sectors = 65535 * 16 * 255;

    if (total_sectors > 65535 * 16 * 63) {
        *secs_per_cyl = 255;
@@ -472,8 +470,6 @@ static int calculate_geometry(int64_t total_sectors, uint16_t* cyls,
    // Note: Rounding up deviates from the Virtual PC behaviour
    // However, we need this to avoid truncating images in qemu-img convert
    *cyls = (cyls_times_heads + *heads - 1) / *heads;
-
-    return 0;
 }

 static int vpc_create(const char *filename, int64_t total_sectors,
@@ -497,8 +493,7 @@ static int vpc_create(const char *filename, int64_t total_sectors,
        return -EIO;

    // Calculate matching total_size and geometry
-    if (calculate_geometry(total_sectors, &cyls, &heads, &secs_per_cyl))
-        return -EFBIG;
+    calculate_geometry(total_sectors, &cyls, &heads, &secs_per_cyl);
    total_sectors = (int64_t) cyls * heads * secs_per_cyl;

    // Prepare the Hard Disk Footer
--- a/block.c
+++ b/block.c
@@ -41,8 +41,6 @@
 #define SECTOR_BITS 9
 #define SECTOR_SIZE (1 << SECTOR_BITS)

-static AIOPool vectored_aio_pool;
-
 typedef struct BlockDriverAIOCBSync {
    BlockDriverAIOCB common;
    QEMUBH *bh;
@@ -143,7 +141,6 @@ static void bdrv_register(BlockDriver *bdrv)
        bdrv->bdrv_read = bdrv_read_em;
        bdrv->bdrv_write = bdrv_write_em;
    }
-    aio_pool_init(&bdrv->aio_pool, bdrv->aiocb_size, bdrv->bdrv_aio_cancel);
    bdrv->next = first_drv;
    first_drv = bdrv;
 }
@@ -533,10 +530,7 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,

    len = bdrv_getlength(bs);

-    if (offset < 0)
-        return -EIO;
-
-    if ((offset > len) || (len - offset < size))
+    if ((offset + size) > len)
        return -EIO;

    return 0;
@@ -1173,8 +1167,6 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
        return -ENOMEDIUM;
    if (!drv->bdrv_write_compressed)
        return -ENOTSUP;
-    if (bdrv_check_request(bs, sector_num, nb_sectors))
-        return -EIO;
    return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
 }

@@ -1189,26 +1181,6 @@ int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    return drv->bdrv_get_info(bs, bdi);
 }

-int bdrv_put_buffer(BlockDriverState *bs, const uint8_t *buf, int64_t pos, int size)
-{
-    BlockDriver *drv = bs->drv;
-    if (!drv)
-        return -ENOMEDIUM;
-    if (!drv->bdrv_put_buffer)
-        return -ENOTSUP;
-    return drv->bdrv_put_buffer(bs, buf, pos, size);
-}
-
-int bdrv_get_buffer(BlockDriverState *bs, uint8_t *buf, int64_t pos, int size)
-{
-    BlockDriver *drv = bs->drv;
-    if (!drv)
-        return -ENOMEDIUM;
-    if (!drv->bdrv_get_buffer)
-        return -ENOTSUP;
-    return drv->bdrv_get_buffer(bs, buf, pos, size);
-}
-
 /**************************************************************/
 /* handling of snapshots */

@@ -1332,32 +1304,24 @@ char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn)
 /**************************************************************/
 /* async I/Os */

-typedef struct VectorTranslationAIOCB {
-    BlockDriverAIOCB common;
+typedef struct VectorTranslationState {
    QEMUIOVector *iov;
    uint8_t *bounce;
    int is_write;
    BlockDriverAIOCB *aiocb;
-} VectorTranslationAIOCB;
-
-static void bdrv_aio_cancel_vector(BlockDriverAIOCB *_acb)
-{
-    VectorTranslationAIOCB *acb
-        = container_of(_acb, VectorTranslationAIOCB, common);
-
-    bdrv_aio_cancel(acb->aiocb);
-}
+    BlockDriverAIOCB *this_aiocb;
+} VectorTranslationState;

 static void bdrv_aio_rw_vector_cb(void *opaque, int ret)
 {
-    VectorTranslationAIOCB *s = (VectorTranslationAIOCB *)opaque;
+    VectorTranslationState *s = opaque;

    if (!s->is_write) {
        qemu_iovec_from_buffer(s->iov, s->bounce, s->iov->size);
    }
    qemu_vfree(s->bounce);
-    s->common.cb(s->common.opaque, ret);
-    qemu_aio_release(s);
+    s->this_aiocb->cb(s->this_aiocb->opaque, ret);
+    qemu_aio_release(s->this_aiocb);
 }

 static BlockDriverAIOCB *bdrv_aio_rw_vector(BlockDriverState *bs,
@@ -1369,9 +1333,10 @@ static BlockDriverAIOCB *bdrv_aio_rw_vector(BlockDriverState *bs,
                                            int is_write)

 {
-    VectorTranslationAIOCB *s = qemu_aio_get_pool(&vectored_aio_pool, bs,
-                                                  cb, opaque);
+    VectorTranslationState *s = qemu_mallocz(sizeof(*s));
+    BlockDriverAIOCB *aiocb = qemu_aio_get(bs, cb, opaque);

+    s->this_aiocb = aiocb;
    s->iov = iov;
    s->bounce = qemu_memalign(512, nb_sectors * 512);
    s->is_write = is_write;
@@ -1383,12 +1348,7 @@ static BlockDriverAIOCB *bdrv_aio_rw_vector(BlockDriverState *bs,
        s->aiocb = bdrv_aio_read(bs, sector_num, s->bounce, nb_sectors,
                                 bdrv_aio_rw_vector_cb, s);
    }
-    if (!s->aiocb) {
-        qemu_vfree(s->bounce);
-        qemu_aio_release(s);
-        return NULL;
-    }
-    return &s->common;
+    return aiocb;
 }

 BlockDriverAIOCB *bdrv_aio_readv(BlockDriverState *bs, int64_t sector_num,
@@ -1463,7 +1423,14 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,

 void bdrv_aio_cancel(BlockDriverAIOCB *acb)
 {
-    acb->pool->cancel(acb);
+    BlockDriver *drv = acb->bs->drv;
+
+    if (acb->cb == bdrv_aio_rw_vector_cb) {
+        VectorTranslationState *s = acb->opaque;
+        acb = s->aiocb;
+    }
+
+    drv->bdrv_aio_cancel(acb);
 }


@@ -1564,9 +1531,6 @@ static int bdrv_write_em(BlockDriverState *bs, int64_t sector_num,

 void bdrv_init(void)
 {
-    aio_pool_init(&vectored_aio_pool, sizeof(VectorTranslationAIOCB),
-                  bdrv_aio_cancel_vector);
-
    bdrv_register(&bdrv_raw);
    bdrv_register(&bdrv_host_device);
 #ifndef _WIN32
@@ -1584,25 +1548,18 @@ void bdrv_init(void)
    bdrv_register(&bdrv_nbd);
 }

-void aio_pool_init(AIOPool *pool, int aiocb_size,
-                   void (*cancel)(BlockDriverAIOCB *acb))
-{
-    pool->aiocb_size = aiocb_size;
-    pool->cancel = cancel;
-    pool->free_aiocb = NULL;
-}
-
-void *qemu_aio_get_pool(AIOPool *pool, BlockDriverState *bs,
-                        BlockDriverCompletionFunc *cb, void *opaque)
+void *qemu_aio_get(BlockDriverState *bs, BlockDriverCompletionFunc *cb,
+                   void *opaque)
 {
+    BlockDriver *drv;
    BlockDriverAIOCB *acb;

-    if (pool->free_aiocb) {
-        acb = pool->free_aiocb;
-        pool->free_aiocb = acb->next;
+    drv = bs->drv;
+    if (drv->free_aiocb) {
+        acb = drv->free_aiocb;
+        drv->free_aiocb = acb->next;
    } else {
-        acb = qemu_mallocz(pool->aiocb_size);
-        acb->pool = pool;
+        acb = qemu_mallocz(drv->aiocb_size);
    }
    acb->bs = bs;
    acb->cb = cb;
@@ -1610,18 +1567,12 @@ void *qemu_aio_get_pool(AIOPool *pool, BlockDriverState *bs,
    return acb;
 }

-void *qemu_aio_get(BlockDriverState *bs, BlockDriverCompletionFunc *cb,
-                   void *opaque)
-{
-    return qemu_aio_get_pool(&bs->drv->aio_pool, bs, cb, opaque);
-}
-
 void qemu_aio_release(void *p)
 {
-    BlockDriverAIOCB *acb = (BlockDriverAIOCB *)p;
-    AIOPool *pool = acb->pool;
-    acb->next = pool->free_aiocb;
-    pool->free_aiocb = acb;
+    BlockDriverAIOCB *acb = p;
+    BlockDriver *drv = acb->bs->drv;
+    acb->next = drv->free_aiocb;
+    drv->free_aiocb = acb;
 }

 /**************************************************************/
@@ -1664,15 +1615,11 @@ int bdrv_media_changed(BlockDriverState *bs)
 /**
 * If eject_flag is TRUE, eject the media. Otherwise, close the tray
 */
-int bdrv_eject(BlockDriverState *bs, int eject_flag)
+void bdrv_eject(BlockDriverState *bs, int eject_flag)
 {
    BlockDriver *drv = bs->drv;
    int ret;

-    if (bs->locked) {
-        return -EBUSY;
-    }
-
    if (!drv || !drv->bdrv_eject) {
        ret = -ENOTSUP;
    } else {
@@ -1681,10 +1628,7 @@ int bdrv_eject(BlockDriverState *bs, int eject_flag)
    if (ret == -ENOTSUP) {
        if (eject_flag)
            bdrv_close(bs);
-        ret = 0;
    }
-
-    return ret;
 }

 int bdrv_is_locked(BlockDriverState *bs)
--- a/block.h
+++ b/block.h
@@ -132,7 +132,7 @@ int bdrv_is_inserted(BlockDriverState *bs);
 int bdrv_media_changed(BlockDriverState *bs);
 int bdrv_is_locked(BlockDriverState *bs);
 void bdrv_set_locked(BlockDriverState *bs, int locked);
-int bdrv_eject(BlockDriverState *bs, int eject_flag);
+void bdrv_eject(BlockDriverState *bs, int eject_flag);
 void bdrv_set_change_cb(BlockDriverState *bs,
                        void (*change_cb)(void *opaque), void *opaque);
 void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
@@ -169,9 +169,4 @@ void path_combine(char *dest, int dest_size,
                  const char *base_path,
                  const char *filename);

-int bdrv_put_buffer(BlockDriverState *bs, const uint8_t *buf,
-                    int64_t pos, int size);
-
-int bdrv_get_buffer(BlockDriverState *bs, uint8_t *buf, int64_t pos, int size);
-
 #endif
--- a/block_int.h
+++ b/block_int.h
@@ -30,12 +30,6 @@
 #define BLOCK_FLAG_COMPRESS	2
 #define BLOCK_FLAG_COMPAT6	4

-typedef struct AIOPool {
-    void (*cancel)(BlockDriverAIOCB *acb);
-    int aiocb_size;
-    BlockDriverAIOCB *free_aiocb;
-} AIOPool;
-
 struct BlockDriver {
    const char *format_name;
    int instance_size;
@@ -82,11 +76,6 @@ struct BlockDriver {
                              QEMUSnapshotInfo **psn_info);
    int (*bdrv_get_info)(BlockDriverState *bs, BlockDriverInfo *bdi);

-    int (*bdrv_put_buffer)(BlockDriverState *bs, const uint8_t *buf,
-                           int64_t pos, int size);
-    int (*bdrv_get_buffer)(BlockDriverState *bs, uint8_t *buf,
-                           int64_t pos, int size);
-
    /* removable device specific */
    int (*bdrv_is_inserted)(BlockDriverState *bs);
    int (*bdrv_media_changed)(BlockDriverState *bs);
@@ -96,7 +85,7 @@ struct BlockDriver {
    /* to control generic scsi devices */
    int (*bdrv_ioctl)(BlockDriverState *bs, unsigned long int req, void *buf);

-    AIOPool aio_pool;
+    BlockDriverAIOCB *free_aiocb;
    struct BlockDriver *next;
 };

@@ -146,7 +135,6 @@ struct BlockDriverState {
 };

 struct BlockDriverAIOCB {
-    AIOPool *pool;
    BlockDriverState *bs;
    BlockDriverCompletionFunc *cb;
    void *opaque;
@@ -155,13 +143,8 @@ struct BlockDriverAIOCB {

 void get_tmp_filename(char *filename, int size);

-void aio_pool_init(AIOPool *pool, int aiocb_size,
-                   void (*cancel)(BlockDriverAIOCB *acb));
-
 void *qemu_aio_get(BlockDriverState *bs, BlockDriverCompletionFunc *cb,
                   void *opaque);
-void *qemu_aio_get_pool(AIOPool *pool, BlockDriverState *bs,
-                        BlockDriverCompletionFunc *cb, void *opaque);
 void qemu_aio_release(void *p);

 extern BlockDriverState *bdrv_first;
--- a/2
+++ b/2
@@ -1013,7 +1013,7 @@ EOF
    kvm="no";
    if [ -x "`which awk 2>/dev/null`" ] && \
       [ -x "`which grep 2>/dev/null`" ]; then
-      kvmerr=`LANG=C $cc $ARCH_CFLAGS -o $TMPE ${OS_CFLAGS} $kvm_cflags $TMPC 2>&1 \
+      kvmerr=`$cc $ARCH_CFLAGS -o $TMPE ${OS_CFLAGS} $kvm_cflags $TMPC 2>&1 \
 	| grep "error: " \
 	| awk -F "error: " '{if (NR>1) printf(", "); printf("%s",$2);}'`
      if test "$kvmerr" != "" ; then
--- a/curses.c
+++ b/curses.c
@@ -370,4 +370,7 @@ void curses_display_init(DisplayState *ds, int full_screen)
    ds->surface = qemu_create_displaysurface_from(640, 400, 0, 0, (uint8_t*) screen);

    invalidate = 1;
+
+    /* Standard VGA initial text mode dimensions */
+    curses_resize(ds);
 }
--- a/dma-helpers.c
+++ b/dma-helpers.c
@@ -10,8 +10,6 @@
 #include "dma.h"
 #include "block_int.h"

-static AIOPool dma_aio_pool;
-
 void qemu_sglist_init(QEMUSGList *qsg, int alloc_hint)
 {
    qsg->sg = qemu_malloc(alloc_hint * sizeof(ScatterGatherEntry));
@@ -39,7 +37,6 @@ void qemu_sglist_destroy(QEMUSGList *qsg)
 }

 typedef struct {
-    BlockDriverAIOCB common;
    BlockDriverState *bs;
    BlockDriverAIOCB *acb;
    QEMUSGList *sg;
@@ -49,13 +46,13 @@ typedef struct {
    target_phys_addr_t sg_cur_byte;
    QEMUIOVector iov;
    QEMUBH *bh;
-} DMAAIOCB;
+} DMABlockState;

 static void dma_bdrv_cb(void *opaque, int ret);

 static void reschedule_dma(void *opaque)
 {
-    DMAAIOCB *dbs = (DMAAIOCB *)opaque;
+    DMABlockState *dbs = (DMABlockState *)opaque;

    qemu_bh_delete(dbs->bh);
    dbs->bh = NULL;
@@ -64,38 +61,32 @@ static void reschedule_dma(void *opaque)

 static void continue_after_map_failure(void *opaque)
 {
-    DMAAIOCB *dbs = (DMAAIOCB *)opaque;
+    DMABlockState *dbs = (DMABlockState *)opaque;

    dbs->bh = qemu_bh_new(reschedule_dma, dbs);
    qemu_bh_schedule(dbs->bh);
 }

-static void dma_bdrv_unmap(DMAAIOCB *dbs)
+static void dma_bdrv_cb(void *opaque, int ret)
 {
+    DMABlockState *dbs = (DMABlockState *)opaque;
+    target_phys_addr_t cur_addr, cur_len;
+    void *mem;
    int i;

+    dbs->sector_num += dbs->iov.size / 512;
    for (i = 0; i < dbs->iov.niov; ++i) {
        cpu_physical_memory_unmap(dbs->iov.iov[i].iov_base,
                                  dbs->iov.iov[i].iov_len, !dbs->is_write,
                                  dbs->iov.iov[i].iov_len);
    }
-}
-
-void dma_bdrv_cb(void *opaque, int ret)
-{
-    DMAAIOCB *dbs = (DMAAIOCB *)opaque;
-    target_phys_addr_t cur_addr, cur_len;
-    void *mem;
-
-    dbs->acb = NULL;
-    dbs->sector_num += dbs->iov.size / 512;
-    dma_bdrv_unmap(dbs);
    qemu_iovec_reset(&dbs->iov);

    if (dbs->sg_cur_index == dbs->sg->nsg || ret < 0) {
-        dbs->common.cb(dbs->common.opaque, ret);
+        dbs->acb->cb(dbs->acb->opaque, ret);
        qemu_iovec_destroy(&dbs->iov);
-        qemu_aio_release(dbs);
+        qemu_aio_release(dbs->acb);
+        qemu_free(dbs);
        return;
    }

@@ -119,16 +110,11 @@ void dma_bdrv_cb(void *opaque, int ret)
    }

    if (dbs->is_write) {
-        dbs->acb = bdrv_aio_writev(dbs->bs, dbs->sector_num, &dbs->iov,
-                                   dbs->iov.size / 512, dma_bdrv_cb, dbs);
+        bdrv_aio_writev(dbs->bs, dbs->sector_num, &dbs->iov,
+                        dbs->iov.size / 512, dma_bdrv_cb, dbs);
    } else {
-        dbs->acb = bdrv_aio_readv(dbs->bs, dbs->sector_num, &dbs->iov,
-                                  dbs->iov.size / 512, dma_bdrv_cb, dbs);
-    }
-    if (!dbs->acb) {
-        dma_bdrv_unmap(dbs);
-        qemu_iovec_destroy(&dbs->iov);
-        return;
+        bdrv_aio_readv(dbs->bs, dbs->sector_num, &dbs->iov,
+                       dbs->iov.size / 512, dma_bdrv_cb, dbs);
    }
 }

@@ -137,10 +123,10 @@ static BlockDriverAIOCB *dma_bdrv_io(
    BlockDriverCompletionFunc *cb, void *opaque,
    int is_write)
 {
-    DMAAIOCB *dbs =  qemu_aio_get_pool(&dma_aio_pool, bs, cb, opaque);
+    DMABlockState *dbs = qemu_malloc(sizeof(*dbs));

-    dbs->acb = NULL;
    dbs->bs = bs;
+    dbs->acb = qemu_aio_get(bs, cb, opaque);
    dbs->sg = sg;
    dbs->sector_num = sector_num;
    dbs->sg_cur_index = 0;
@@ -149,11 +135,7 @@ static BlockDriverAIOCB *dma_bdrv_io(
    dbs->bh = NULL;
    qemu_iovec_init(&dbs->iov, sg->nsg);
    dma_bdrv_cb(dbs, 0);
-    if (!dbs->acb) {
-        qemu_aio_release(dbs);
-        return NULL;
-    }
-    return &dbs->common;
+    return dbs->acb;
 }


@@ -171,16 +153,3 @@ BlockDriverAIOCB *dma_bdrv_write(BlockDriverState *bs,
    return dma_bdrv_io(bs, sg, sector, cb, opaque, 1);
 }

-static void dma_aio_cancel(BlockDriverAIOCB *acb)
-{
-    DMAAIOCB *dbs = container_of(acb, DMAAIOCB, common);
-
-    if (dbs->acb) {
-        bdrv_aio_cancel(dbs->acb);
-    }
-}
-
-void dma_helper_init(void)
-{
-    aio_pool_init(&dma_aio_pool, sizeof(DMAAIOCB), dma_aio_cancel);
-}
--- a/dma.h
+++ b/dma.h
@@ -37,6 +37,5 @@ BlockDriverAIOCB *dma_bdrv_read(BlockDriverState *bs,
 BlockDriverAIOCB *dma_bdrv_write(BlockDriverState *bs,
                                 QEMUSGList *sg, uint64_t sector,
                                 BlockDriverCompletionFunc *cb, void *opaque);
-void dma_helper_init(void);

 #endif
--- a/exec-all.h
+++ b/exec-all.h
@@ -35,7 +35,7 @@
 typedef struct TranslationBlock TranslationBlock;

 /* XXX: make safe guess about sizes */
-#define MAX_OP_PER_INSTR 96
+#define MAX_OP_PER_INSTR 64
 /* A Call op needs up to 6 + 2N parameters (N = number of arguments).  */
 #define MAX_OPC_PARAM 10
 #define OPC_BUF_SIZE 512
--- a/exec.c
+++ b/exec.c
@@ -2386,10 +2386,6 @@ ram_addr_t qemu_ram_alloc(ram_addr_t size)
    }
    addr = phys_ram_alloc_offset;
    phys_ram_alloc_offset = TARGET_PAGE_ALIGN(phys_ram_alloc_offset + size);
-
-    if (kvm_enabled())
-        kvm_setup_guest_memory(phys_ram_base + addr, size);
-
    return addr;
 }

@@ -3110,7 +3106,6 @@ void cpu_unregister_map_client(void *_client)
    MapClient *client = (MapClient *)_client;

    LIST_REMOVE(client, link);
-    qemu_free(client);
 }

 static void cpu_notify_map_clients(void)
@@ -3120,7 +3115,7 @@ static void cpu_notify_map_clients(void)
    while (!LIST_EMPTY(&map_client_list)) {
        client = LIST_FIRST(&map_client_list);
        client->callback(client->opaque);
-        cpu_unregister_map_client(client);
+        LIST_REMOVE(client, link);
    }
 }

--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -604,7 +604,7 @@ static uint32_t gpe_readb(void *opaque, uint32_t addr)
    }

 #if defined(DEBUG)
-    printf("gpe read %x == %x\n", addr, val);
+    printf("gpe read %lx == %lx\n", addr, val);
 #endif
    return val;
 }
@@ -646,7 +646,7 @@ static void gpe_writeb(void *opaque, uint32_t addr, uint32_t val)
   }

 #if defined(DEBUG)
-    printf("gpe write %x <== %d\n", addr, val);
+    printf("gpe write %lx <== %d\n", addr, val);
 #endif
 }

@@ -666,7 +666,7 @@ static uint32_t pcihotplug_read(void *opaque, uint32_t addr)
    }

 #if defined(DEBUG)
-    printf("pcihotplug read %x == %x\n", addr, val);
+    printf("pcihotplug read %lx == %lx\n", addr, val);
 #endif
    return val;
 }
@@ -684,14 +684,14 @@ static void pcihotplug_write(void *opaque, uint32_t addr, uint32_t val)
   }

 #if defined(DEBUG)
-    printf("pcihotplug write %x <== %d\n", addr, val);
+    printf("pcihotplug write %lx <== %d\n", addr, val);
 #endif
 }

 static uint32_t pciej_read(void *opaque, uint32_t addr)
 {
 #if defined(DEBUG)
-    printf("pciej read %x\n", addr);
+    printf("pciej read %lx == %lx\n", addr, val);
 #endif
    return 0;
 }
@@ -705,7 +705,7 @@ static void pciej_write(void *opaque, uint32_t addr, uint32_t val)
 #endif

 #if defined(DEBUG)
-    printf("pciej write %x <== %d\n", addr, val);
+    printf("pciej write %lx <== %d\n", addr, val);
 #endif
 }

--- a/hw/arm_sysctl.c
+++ b/hw/arm_sysctl.c
@@ -8,7 +8,6 @@
 */

 #include "hw.h"
-#include "qemu-timer.h"
 #include "primecell.h"
 #include "sysemu.h"

@@ -71,7 +70,8 @@ static uint32_t arm_sysctl_read(void *opaque, target_phys_addr_t offset)
    case 0x58: /* BOOTCS */
        return 0;
    case 0x5c: /* 24MHz */
-        return muldiv64(qemu_get_clock(vm_clock), 24000000, ticks_per_sec);
+        /* ??? not implemented.  */
+        return 0;
    case 0x60: /* MISC */
        return 0;
    case 0x84: /* PROCID0 */
--- a/hw/axis_dev88.c
+++ b/hw/axis_dev88.c
@@ -349,10 +349,10 @@ void axisdev88_init (ram_addr_t ram_size, int vga_ram_size,
                fprintf(stderr, "Too long CRIS kernel cmdline (max 256)\n");
                exit(1);
            }
+            pstrcpy_targphys(high, 256, kernel_cmdline);
            /* Let the kernel know we are modifying the cmdline.  */
            env->regs[10] = 0x87109563;
-            env->regs[11] = 0x40000000;
-            pstrcpy_targphys(env->regs[11], 256, kernel_cmdline);
+            env->regs[11] = high;
        }
    }
    env->pc = bootstrap_pc;
--- a/hw/device-hotplug.c
+++ b/hw/device-hotplug.c
@@ -55,7 +55,12 @@ void destroy_nic(dev_match_fn *match_fn, void *arg)
        nic = &nd_table[i];
        if (nic->used) {
            if (nic->private && match_fn(nic->private, arg)) {
-                qemu_del_vlan_client(nic->vc);
+                if (nic->vlan) {
+                    VLANClientState *vc;
+                    vc = qemu_find_vlan_client(nic->vlan, nic->private);
+                    if (vc)
+                        qemu_del_vlan_client(vc);
+                }
                net_client_uninit(nic);
            }
        }
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -75,6 +75,7 @@ enum {
 typedef struct E1000State_st {
    PCIDevice dev;
    VLANClientState *vc;
+    NICInfo *nd;
    int mmio_index;

    uint32_t mac_reg[0x8000];
@@ -155,7 +156,6 @@ set_interrupt_cause(E1000State *s, int index, uint32_t val)
    if (val)
        val |= E1000_ICR_INT_ASSERTED;
    s->mac_reg[ICR] = val;
-    s->mac_reg[ICS] = val;
    qemu_set_irq(s->dev.irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);
 }

@@ -190,13 +190,6 @@ rxbufsize(uint32_t v)
    return 2048;
 }

-static void
-set_ctrl(E1000State *s, int index, uint32_t val)
-{
-    /* RST is self clearing */
-    s->mac_reg[CTRL] = val & ~E1000_CTRL_RST;
-}
-
 static void
 set_rx_control(E1000State *s, int index, uint32_t val)
 {
@@ -263,11 +256,6 @@ set_eecd(E1000State *s, int index, uint32_t val)
    }
    if (!(val & E1000_EECD_CS)) {		// rising, no CS (EEPROM reset)
        memset(&s->eecd_state, 0, sizeof s->eecd_state);
-        /*
-         * restore old_eecd's E1000_EECD_SK (known to be on)
-         * to avoid false detection of a clock edge
-         */
-        s->eecd_state.old_eecd = E1000_EECD_SK;
        return;
    }
    s->eecd_state.val_in <<= 1;
@@ -288,14 +276,10 @@ flash_eerd_read(E1000State *s, int x)
 {
    unsigned int index, r = s->mac_reg[EERD] & ~E1000_EEPROM_RW_REG_START;

-    if ((s->mac_reg[EERD] & E1000_EEPROM_RW_REG_START) == 0)
-        return (s->mac_reg[EERD]);
-
    if ((index = r >> E1000_EEPROM_RW_ADDR_SHIFT) > EEPROM_CHECKSUM_REG)
-        return (E1000_EEPROM_RW_REG_DONE | r);
-
-    return ((s->eeprom_data[index] << E1000_EEPROM_RW_REG_DATA) |
-           E1000_EEPROM_RW_REG_DONE | r);
+        return 0;
+    return (s->eeprom_data[index] << E1000_EEPROM_RW_REG_DATA) |
+           E1000_EEPROM_RW_REG_DONE | r;
 }

 static void
@@ -784,7 +768,7 @@ static uint32_t (*macreg_readops[])(E1000State *, int) = {
    getreg(WUFC),	getreg(TDT),	getreg(CTRL),	getreg(LEDCTL),
    getreg(MANC),	getreg(MDIC),	getreg(SWSM),	getreg(STATUS),
    getreg(TORL),	getreg(TOTL),	getreg(IMS),	getreg(TCTL),
-    getreg(RDH),	getreg(RDT),	getreg(VET),	getreg(ICS),
+    getreg(RDH),	getreg(RDT),	getreg(VET),

    [TOTH] = mac_read_clr8,	[TORH] = mac_read_clr8,	[GPRC] = mac_read_clr4,
    [GPTC] = mac_read_clr4,	[TPR] = mac_read_clr4,	[TPT] = mac_read_clr4,
@@ -800,12 +784,12 @@ enum { NREADOPS = ARRAY_SIZE(macreg_readops) };
 static void (*macreg_writeops[])(E1000State *, int, uint32_t) = {
    putreg(PBA),	putreg(EERD),	putreg(SWSM),	putreg(WUFC),
    putreg(TDBAL),	putreg(TDBAH),	putreg(TXDCTL),	putreg(RDBAH),
-    putreg(RDBAL),	putreg(LEDCTL), putreg(VET),
+    putreg(RDBAL),	putreg(LEDCTL), putreg(CTRL),	putreg(VET),
    [TDLEN] = set_dlen,	[RDLEN] = set_dlen,	[TCTL] = set_tctl,
    [TDT] = set_tctl,	[MDIC] = set_mdic,	[ICS] = set_ics,
    [TDH] = set_16bit,	[RDH] = set_16bit,	[RDT] = set_rdt,
    [IMC] = set_imc,	[IMS] = set_ims,	[ICR] = set_icr,
-    [EECD] = set_eecd,	[RCTL] = set_rx_control, [CTRL] = set_ctrl,
+    [EECD] = set_eecd,	[RCTL] = set_rx_control,
    [RA ... RA+31] = &mac_writereg,
    [MTA ... MTA+127] = &mac_writereg,
    [VFTA ... VFTA+127] = &mac_writereg,
@@ -1050,14 +1034,6 @@ e1000_mmio_map(PCIDevice *pci_dev, int region_num,
                                     excluded_regs[i] - 4);
 }

-static void
-e1000_cleanup(VLANClientState *vc)
-{
-    E1000State *d = vc->opaque;
-
-    unregister_savevm("e1000", d);
-}
-
 static int
 pci_e1000_uninit(PCIDevice *dev)
 {
@@ -1080,10 +1056,8 @@ pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
    d = (E1000State *)pci_register_device(bus, "e1000",
                sizeof(E1000State), devfn, NULL, NULL);

-    if (!d)
-	return NULL;
-
    pci_conf = d->dev.config;
+    memset(pci_conf, 0, 256);

    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
    pci_config_set_device_id(pci_conf, E1000_DEVID);
@@ -1104,6 +1078,7 @@ pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
    pci_register_io_region((PCIDevice *)d, 1, IOPORT_SIZE,
                           PCI_ADDRESS_SPACE_IO, ioport_map);

+    d->nd = nd;
    memmove(d->eeprom_data, e1000_eeprom_template,
        sizeof e1000_eeprom_template);
    for (i = 0; i < 3; i++)
@@ -1121,11 +1096,10 @@ pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
    memset(&d->tx, 0, sizeof d->tx);

    d->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 e1000_receive, e1000_can_receive,
-                                 e1000_cleanup, d);
+                                 e1000_receive, e1000_can_receive, d);
    d->vc->link_status_changed = e1000_set_link_status;

-    qemu_format_nic_info_str(d->vc, nd->macaddr);
+    qemu_format_nic_info_str(d->vc, d->nd->macaddr);

    register_savevm(info_str, -1, 2, nic_save, nic_load, d);
    d->dev.unregister = pci_e1000_uninit;
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -1735,39 +1735,17 @@ static void nic_save(QEMUFile * f, void *opaque)
    qemu_put_buffer(f, s->configuration, sizeof(s->configuration));
 }

-static void nic_cleanup(VLANClientState *vc)
-{
-    EEPRO100State *s = vc->opaque;
-
-    unregister_savevm(vc->model, s);
-
-    eeprom93xx_free(s->eeprom);
-}
-
-static int pci_nic_uninit(PCIDevice *dev)
-{
-    PCIEEPRO100State *d = (PCIEEPRO100State *) dev;
-    EEPRO100State *s = &d->eepro100;
-
-    cpu_unregister_io_memory(s->mmio_index);
-
-    return 0;
-}
-
-static PCIDevice *nic_init(PCIBus * bus, NICInfo * nd, uint32_t device)
+static PCIDevice *nic_init(PCIBus * bus, NICInfo * nd,
+                     const char *name, uint32_t device)
 {
    PCIEEPRO100State *d;
    EEPRO100State *s;

    logout("\n");

-    d = (PCIEEPRO100State *) pci_register_device(bus, nd->model,
+    d = (PCIEEPRO100State *) pci_register_device(bus, name,
                                                 sizeof(PCIEEPRO100State), -1,
                                                 NULL, NULL);
-    if (!d)
-        return NULL;
-
-    d->dev.unregister = pci_nic_uninit;

    s = &d->eepro100;
    s->device = device;
@@ -1798,30 +1776,30 @@ static PCIDevice *nic_init(PCIBus * bus, NICInfo * nd, uint32_t device)
    nic_reset(s);

    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 nic_receive, nic_can_receive,
-                                 nic_cleanup, s);
+                                 nic_receive, nic_can_receive, s);

    qemu_format_nic_info_str(s->vc, s->macaddr);

    qemu_register_reset(nic_reset, s);

-    register_savevm(s->vc->model, -1, 3, nic_save, nic_load, s);
+    register_savevm(name, -1, 3, nic_save, nic_load, s);
    return (PCIDevice *)d;
 }

 PCIDevice *pci_i82551_init(PCIBus * bus, NICInfo * nd, int devfn)
 {
-    return nic_init(bus, nd, i82551);
+    return nic_init(bus, nd, "i82551", i82551);
+    //~ uint8_t *pci_conf = d->dev.config;
 }

 PCIDevice *pci_i82557b_init(PCIBus * bus, NICInfo * nd, int devfn)
 {
-    return nic_init(bus, nd, i82557B);
+    return nic_init(bus, nd, "i82557b", i82557B);
 }

 PCIDevice *pci_i82559er_init(PCIBus * bus, NICInfo * nd, int devfn)
 {
-    return nic_init(bus, nd, i82559ER);
+    return nic_init(bus, nd, "i82559er", i82559ER);
 }

 /* eof */
--- a/hw/eeprom93xx.c
+++ b/hw/eeprom93xx.c
@@ -301,7 +301,6 @@ void eeprom93xx_free(eeprom_t *eeprom)
 {
    /* Destroy EEPROM. */
    logout("eeprom = 0x%p\n", eeprom);
-    unregister_savevm("eeprom", eeprom);
    qemu_free(eeprom);
 }

--- a/hw/etraxfs.c
+++ b/hw/etraxfs.c
@@ -140,10 +140,10 @@ void bareetraxfs_init (ram_addr_t ram_size, int vga_ram_size,
                fprintf(stderr, "Too long CRIS kernel cmdline (max 256)\n");
                exit(1);
            }
+            pstrcpy_targphys(high, 256, kernel_cmdline);
            /* Let the kernel know we are modifying the cmdline.  */
            env->regs[10] = 0x87109563;
-            env->regs[11] = 0x40000000;
-            pstrcpy_targphys(env->regs[11], 256, kernel_cmdline);
+            env->regs[11] = high;
        }
    }
    env->pc = bootstrap_pc;
--- a/hw/etraxfs_eth.c
+++ b/hw/etraxfs_eth.c
@@ -401,8 +401,8 @@ static void eth_update_ma(struct fs_eth *eth, int ma)
 	eth->macaddr[ma][i++] = eth->regs[reg] >> 8;
 	eth->macaddr[ma][i++] = eth->regs[reg] >> 16;
 	eth->macaddr[ma][i++] = eth->regs[reg] >> 24;
-	eth->macaddr[ma][i++] = eth->regs[reg + 1];
-	eth->macaddr[ma][i++] = eth->regs[reg + 1] >> 8;
+	eth->macaddr[ma][i++] = eth->regs[reg + 4];
+	eth->macaddr[ma][i++] = eth->regs[reg + 4] >> 8;

 	D(printf("set mac%d=%x.%x.%x.%x.%x.%x\n", ma,
 		 eth->macaddr[ma][0], eth->macaddr[ma][1],
@@ -554,16 +554,6 @@ static CPUWriteMemoryFunc *eth_write[] = {
 	&eth_writel,
 };

-static void eth_cleanup(VLANClientState *vc)
-{
-        struct fs_eth *eth = vc->opaque;
-
-        cpu_unregister_io_memory(eth->ethregs);
-
-        qemu_free(eth->dma_out);
-        qemu_free(eth);
-}
-
 void *etraxfs_eth_init(NICInfo *nd, CPUState *env, 
 		       qemu_irq *irq, target_phys_addr_t base, int phyaddr)
 {
@@ -594,9 +584,8 @@ void *etraxfs_eth_init(NICInfo *nd, CPUState *env,
 	eth->ethregs = cpu_register_io_memory(0, eth_read, eth_write, eth);
 	cpu_register_physical_memory (base, 0x5c, eth->ethregs);

-	eth->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                                eth_receive, eth_can_receive,
-                                                eth_cleanup, eth);
+	eth->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+				       eth_receive, eth_can_receive, eth);
 	eth->vc->opaque = eth;
 	eth->vc->link_status_changed = eth_set_link;

--- a/hw/hpet.c
+++ b/hw/hpet.c
@@ -411,7 +411,7 @@ static void hpet_ram_writel(void *opaque, target_phys_addr_t addr,
                           (timer->config & HPET_TN_SETVAL))
                    timer->cmp = (timer->cmp & 0xffffffff00000000ULL)
                                  | new_val;
-                if (timer_is_periodic(timer)) {
+                else {
                    /*
                     * FIXME: Clamp period to reasonable min value?
                     * Clamp period to reasonable max value
@@ -554,7 +554,6 @@ static void hpet_reset(void *opaque) {
    /* 64-bit main counter; 3 timers supported; LegacyReplacementRoute. */
    s->capability = 0x8086a201ULL;
    s->capability |= ((HPET_CLK_PERIOD) << 32);
-    s->config = 0ULL;
    if (count > 0)
        /* we don't enable pit when hpet_reset is first called (by hpet_init)
         * because hpet is taking over for pit here. On subsequent invocations,
--- a/hw/hw.h
+++ b/hw/hw.h
@@ -37,7 +37,6 @@ QEMUFile *qemu_fopen(const char *filename, const char *mode);
 QEMUFile *qemu_fopen_socket(int fd);
 QEMUFile *qemu_popen(FILE *popen_file, const char *mode);
 QEMUFile *qemu_popen_cmd(const char *command, const char *mode);
-int qemu_popen_fd(QEMUFile *f);
 void qemu_fflush(QEMUFile *f);
 int qemu_fclose(QEMUFile *f);
 void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size);
@@ -68,7 +67,6 @@ unsigned int qemu_get_be32(QEMUFile *f);
 uint64_t qemu_get_be64(QEMUFile *f);
 int qemu_file_rate_limit(QEMUFile *f);
 int qemu_file_has_error(QEMUFile *f);
-void qemu_file_set_error(QEMUFile *f);

 /* Try to send any outstanding data.  This function is useful when output is
 * halted due to rate limiting or EAGAIN errors occur as it can be used to
@@ -240,8 +238,6 @@ int register_savevm_live(const char *idstr,
                         LoadStateHandler *load_state,
                         void *opaque);

-void unregister_savevm(const char *idstr, void *opaque);
-
 typedef void QEMUResetHandler(void *opaque);

 void qemu_register_reset(QEMUResetHandler *func, void *opaque);
--- a/hw/ide.c
+++ b/hw/ide.c
@@ -359,7 +359,6 @@
 #define ASC_INCOMPATIBLE_FORMAT              0x30
 #define ASC_MEDIUM_NOT_PRESENT               0x3a
 #define ASC_SAVING_PARAMETERS_NOT_SUPPORTED  0x39
-#define ASC_MEDIA_REMOVAL_PREVENTED          0x53

 #define CFA_NO_ERROR            0x00
 #define CFA_MISC_ERROR          0x09
@@ -418,7 +417,6 @@ typedef struct IDEState {
    /* ATAPI specific */
    uint8_t sense_key;
    uint8_t asc;
-    uint8_t cdrom_changed;
    int packet_transfer_size;
    int elementary_transfer_size;
    int io_buffer_index;
@@ -1641,10 +1639,9 @@ static void ide_atapi_cmd(IDEState *s)
    }
    switch(s->io_buffer[0]) {
    case GPCMD_TEST_UNIT_READY:
-        if (bdrv_is_inserted(s->bs) && !s->cdrom_changed) {
+        if (bdrv_is_inserted(s->bs)) {
            ide_atapi_cmd_ok(s);
        } else {
-            s->cdrom_changed = 0;
            ide_atapi_cmd_error(s, SENSE_NOT_READY,
                                ASC_MEDIUM_NOT_PRESENT);
        }
@@ -1821,27 +1818,18 @@ static void ide_atapi_cmd(IDEState *s)
        break;
    case GPCMD_START_STOP_UNIT:
        {
-            int start, eject, err = 0;
+            int start, eject;
            start = packet[4] & 1;
            eject = (packet[4] >> 1) & 1;

-            if (eject) {
-                err = bdrv_eject(s->bs, !start);
-            }
-
-            switch (err) {
-            case 0:
-                ide_atapi_cmd_ok(s);
-                break;
-            case -EBUSY:
-                ide_atapi_cmd_error(s, SENSE_NOT_READY,
-                                    ASC_MEDIA_REMOVAL_PREVENTED);
-                break;
-            default:
-                ide_atapi_cmd_error(s, SENSE_NOT_READY,
-                                    ASC_MEDIUM_NOT_PRESENT);
-                break;
+            if (eject && !start) {
+                /* eject the disk */
+                bdrv_eject(s->bs, 1);
+            } else if (eject && start) {
+                /* close the tray */
+                bdrv_eject(s->bs, 0);
            }
+            ide_atapi_cmd_ok(s);
        }
        break;
    case GPCMD_MECHANISM_STATUS:
@@ -2104,7 +2092,7 @@ static void cdrom_change_cb(void *opaque)

    s->sense_key = SENSE_UNIT_ATTENTION;
    s->asc = ASC_MEDIUM_MAY_HAVE_CHANGED;
-    s->cdrom_changed = 1;
+
    ide_set_irq(s);
 }

@@ -2872,7 +2860,7 @@ static void ide_save(QEMUFile* f, IDEState *s)
 }

 /* load per IDE drive data */
-static void ide_load(QEMUFile* f, IDEState *s, int version_id)
+static void ide_load(QEMUFile* f, IDEState *s)
 {
    s->mult_sectors=qemu_get_be32(f);
    s->identify_set=qemu_get_be32(f);
@@ -2896,13 +2884,6 @@ static void ide_load(QEMUFile* f, IDEState *s, int version_id)

    qemu_get_8s(f, &s->sense_key);
    qemu_get_8s(f, &s->asc);
-    if (version_id == 3) {
-        qemu_get_8s(f, &s->cdrom_changed);
-    } else {
-        if (s->sense_key == SENSE_UNIT_ATTENTION &&
-                       s->asc == ASC_MEDIUM_MAY_HAVE_CHANGED)
-            s->cdrom_changed = 1;
-    }
    /* XXX: if a transfer is pending, we do not save it yet */
 }

@@ -3224,7 +3205,7 @@ static int pci_ide_load(QEMUFile* f, void *opaque, int version_id)
    PCIIDEState *d = opaque;
    int ret, i;

-    if (version_id != 2 && version_id != 3)
+    if (version_id != 2)
        return -EINVAL;
    ret = pci_device_load(&d->dev, f);
    if (ret < 0)
@@ -3254,7 +3235,7 @@ static int pci_ide_load(QEMUFile* f, void *opaque, int version_id)

    /* per IDE drive data */
    for(i = 0; i < 4; i++) {
-        ide_load(f, &d->ide_if[i], version_id);
+        ide_load(f, &d->ide_if[i]);
    }
    return 0;
 }
@@ -3344,7 +3325,7 @@ void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
    ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], irq[0]);
    ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], irq[1]);

-    register_savevm("ide", 0, 3, pci_ide_save, pci_ide_load, d);
+    register_savevm("ide", 0, 2, pci_ide_save, pci_ide_load, d);
    qemu_register_reset(cmd646_reset, d);
    cmd646_reset(d);
 }
@@ -3403,7 +3384,7 @@ void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
        if (hd_table[i])
            hd_table[i]->private = &d->dev;

-    register_savevm("ide", 0, 3, pci_ide_save, pci_ide_load, d);
+    register_savevm("ide", 0, 2, pci_ide_save, pci_ide_load, d);
 }

 /* hd_table must contain 4 block drivers */
@@ -3439,7 +3420,7 @@ void pci_piix4_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
    ide_init_ioport(&d->ide_if[0], 0x1f0, 0x3f6);
    ide_init_ioport(&d->ide_if[2], 0x170, 0x376);

-    register_savevm("ide", 0, 3, pci_ide_save, pci_ide_load, d);
+    register_savevm("ide", 0, 2, pci_ide_save, pci_ide_load, d);
 }

 #if defined(TARGET_PPC)
@@ -3727,7 +3708,7 @@ static int pmac_ide_load(QEMUFile *f, void *opaque, int version_id)
    uint8_t drive1_selected;
    unsigned int i;

-    if (version_id != 1 && version_id != 3)
+    if (version_id != 1)
        return -EINVAL;

    /* per IDE interface data */
@@ -3737,7 +3718,7 @@ static int pmac_ide_load(QEMUFile *f, void *opaque, int version_id)

    /* per IDE drive data */
    for(i = 0; i < 2; i++) {
-        ide_load(f, &s[i], version_id);
+        ide_load(f, &s[i]);
    }
    return 0;
 }
@@ -3768,7 +3749,7 @@ int pmac_ide_init (BlockDriverState **hd_table, qemu_irq irq,

    pmac_ide_memory = cpu_register_io_memory(0, pmac_ide_read,
                                             pmac_ide_write, d);
-    register_savevm("ide", 0, 3, pmac_ide_save, pmac_ide_load, d);
+    register_savevm("ide", 0, 1, pmac_ide_save, pmac_ide_load, d);
    qemu_register_reset(pmac_ide_reset, d);
    pmac_ide_reset(d);

@@ -4161,9 +4142,6 @@ static int md_load(QEMUFile *f, void *opaque, int version_id)
    int i;
    uint8_t drive1_selected;

-    if (version_id != 0 && version_id != 3)
-        return -EINVAL;
-
    qemu_get_8s(f, &s->opt);
    qemu_get_8s(f, &s->stat);
    qemu_get_8s(f, &s->pins);
@@ -4177,7 +4155,7 @@ static int md_load(QEMUFile *f, void *opaque, int version_id)
    s->ide->cur_drive = &s->ide[(drive1_selected != 0)];

    for (i = 0; i < 2; i ++)
-        ide_load(f, &s->ide[i], version_id);
+        ide_load(f, &s->ide[i]);

    return 0;
 }
@@ -4408,7 +4386,7 @@ struct pcmcia_card_s *dscm1xxxx_init(BlockDriverState *bdrv)
    md->ide->mdata_size = METADATA_SIZE;
    md->ide->mdata_storage = (uint8_t *) qemu_mallocz(METADATA_SIZE);

-    register_savevm("microdrive", -1, 3, md_save, md_load, md);
+    register_savevm("microdrive", -1, 0, md_save, md_load, md);

    return &md->card;
 }
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -10,8 +10,6 @@
 /* ??? Need to check if the {read,write}[wl] routines work properly on
   big-endian targets.  */

-#include <assert.h>                             \
-
 #include "hw.h"
 #include "pci.h"
 #include "scsi-disk.h"
@@ -264,7 +262,6 @@ typedef struct {
    uint32_t sbc;
    uint32_t csbc;
    uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
-    uint8_t sbr;

    /* Script ram is stored as 32-bit words in host byteorder.  */
    uint32_t script_ram[2048];
@@ -333,7 +330,6 @@ static void lsi_soft_reset(LSIState *s)
    s->ia = 0;
    s->sbc = 0;
    s->csbc = 0;
-    s->sbr = 0;
 }

 static int lsi_dma_40bit(LSIState *s)
@@ -1404,7 +1400,6 @@ static uint8_t lsi_reg_readb(LSIState *s, int offset)
    CASE_GET_REG24(dbc, 0x24)
    case 0x27: /* DCMD */
        return s->dcmd;
-    CASE_GET_REG32(dnad, 0x28)
    CASE_GET_REG32(dsp, 0x2c)
    CASE_GET_REG32(dsps, 0x30)
    CASE_GET_REG32(scratch[0], 0x34)
@@ -1412,8 +1407,6 @@ static uint8_t lsi_reg_readb(LSIState *s, int offset)
        return s->dmode;
    case 0x39: /* DIEN */
        return s->dien;
-    case 0x3a: /* SBR */
-        return s->sbr;
    case 0x3b: /* DCNTL */
        return s->dcntl;
    case 0x40: /* SIEN0 */
@@ -1493,11 +1486,6 @@ static uint8_t lsi_reg_readb(LSIState *s, int offset)

 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
 {
-#define CASE_SET_REG24(name, addr) \
-    case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
-    case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
-    case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
-
 #define CASE_SET_REG32(name, addr) \
    case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
    case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
@@ -1602,8 +1590,6 @@ static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
        }
        s->ctest5 = val;
        break;
-    CASE_SET_REG24(dbc, 0x24)
-    CASE_SET_REG32(dnad, 0x28)
    case 0x2c: /* DSP[0:7] */
        s->dsp &= 0xffffff00;
        s->dsp |= val;
@@ -1635,9 +1621,6 @@ static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
        s->dien = val;
        lsi_update_irq(s);
        break;
-    case 0x3a: /* SBR */
-        s->sbr = val;
-        break;
    case 0x3b: /* DCNTL */
        s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
        if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
@@ -1717,7 +1700,6 @@ static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
            BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
        }
    }
-#undef CASE_SET_REG24
 #undef CASE_SET_REG32
 }

@@ -1982,174 +1964,6 @@ void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
    bd->private = &s->pci_dev;
 }

-static void lsi_scsi_save(QEMUFile *f, void *opaque)
-{
-    LSIState *s = opaque;
-
-    assert(s->dma_buf == NULL);
-    assert(s->current_dma_len == 0);
-    assert(s->active_commands == 0);
-
-    pci_device_save(&s->pci_dev, f);
-
-    qemu_put_sbe32s(f, &s->carry);
-    qemu_put_sbe32s(f, &s->sense);
-    qemu_put_sbe32s(f, &s->msg_action);
-    qemu_put_sbe32s(f, &s->msg_len);
-    qemu_put_buffer(f, s->msg, sizeof (s->msg));
-    qemu_put_sbe32s(f, &s->waiting);
-
-    qemu_put_be32s(f, &s->dsa);
-    qemu_put_be32s(f, &s->temp);
-    qemu_put_be32s(f, &s->dnad);
-    qemu_put_be32s(f, &s->dbc);
-    qemu_put_8s(f, &s->istat0);
-    qemu_put_8s(f, &s->istat1);
-    qemu_put_8s(f, &s->dcmd);
-    qemu_put_8s(f, &s->dstat);
-    qemu_put_8s(f, &s->dien);
-    qemu_put_8s(f, &s->sist0);
-    qemu_put_8s(f, &s->sist1);
-    qemu_put_8s(f, &s->sien0);
-    qemu_put_8s(f, &s->sien1);
-    qemu_put_8s(f, &s->mbox0);
-    qemu_put_8s(f, &s->mbox1);
-    qemu_put_8s(f, &s->dfifo);
-    qemu_put_8s(f, &s->ctest2);
-    qemu_put_8s(f, &s->ctest3);
-    qemu_put_8s(f, &s->ctest4);
-    qemu_put_8s(f, &s->ctest5);
-    qemu_put_8s(f, &s->ccntl0);
-    qemu_put_8s(f, &s->ccntl1);
-    qemu_put_be32s(f, &s->dsp);
-    qemu_put_be32s(f, &s->dsps);
-    qemu_put_8s(f, &s->dmode);
-    qemu_put_8s(f, &s->dcntl);
-    qemu_put_8s(f, &s->scntl0);
-    qemu_put_8s(f, &s->scntl1);
-    qemu_put_8s(f, &s->scntl2);
-    qemu_put_8s(f, &s->scntl3);
-    qemu_put_8s(f, &s->sstat0);
-    qemu_put_8s(f, &s->sstat1);
-    qemu_put_8s(f, &s->scid);
-    qemu_put_8s(f, &s->sxfer);
-    qemu_put_8s(f, &s->socl);
-    qemu_put_8s(f, &s->sdid);
-    qemu_put_8s(f, &s->ssid);
-    qemu_put_8s(f, &s->sfbr);
-    qemu_put_8s(f, &s->stest1);
-    qemu_put_8s(f, &s->stest2);
-    qemu_put_8s(f, &s->stest3);
-    qemu_put_8s(f, &s->sidl);
-    qemu_put_8s(f, &s->stime0);
-    qemu_put_8s(f, &s->respid0);
-    qemu_put_8s(f, &s->respid1);
-    qemu_put_be32s(f, &s->mmrs);
-    qemu_put_be32s(f, &s->mmws);
-    qemu_put_be32s(f, &s->sfs);
-    qemu_put_be32s(f, &s->drs);
-    qemu_put_be32s(f, &s->sbms);
-    qemu_put_be32s(f, &s->dbms);
-    qemu_put_be32s(f, &s->dnad64);
-    qemu_put_be32s(f, &s->pmjad1);
-    qemu_put_be32s(f, &s->pmjad2);
-    qemu_put_be32s(f, &s->rbc);
-    qemu_put_be32s(f, &s->ua);
-    qemu_put_be32s(f, &s->ia);
-    qemu_put_be32s(f, &s->sbc);
-    qemu_put_be32s(f, &s->csbc);
-    qemu_put_buffer(f, (uint8_t *)s->scratch, sizeof (s->scratch));
-    qemu_put_8s(f, &s->sbr);
-
-    qemu_put_buffer(f, (uint8_t *)s->script_ram, sizeof (s->script_ram));
-}
-
-static int lsi_scsi_load(QEMUFile *f, void *opaque, int version_id)
-{
-    LSIState *s = opaque;
-    int ret;
-
-    if (version_id > 0) {
-        return -EINVAL;
-    }
-
-    if ((ret = pci_device_load(&s->pci_dev, f)) < 0)
-        return ret;
-
-    qemu_get_sbe32s(f, &s->carry);
-    qemu_get_sbe32s(f, &s->sense);
-    qemu_get_sbe32s(f, &s->msg_action);
-    qemu_get_sbe32s(f, &s->msg_len);
-    qemu_get_buffer(f, s->msg, sizeof (s->msg));
-    qemu_get_sbe32s(f, &s->waiting);
-
-    qemu_get_be32s(f, &s->dsa);
-    qemu_get_be32s(f, &s->temp);
-    qemu_get_be32s(f, &s->dnad);
-    qemu_get_be32s(f, &s->dbc);
-    qemu_get_8s(f, &s->istat0);
-    qemu_get_8s(f, &s->istat1);
-    qemu_get_8s(f, &s->dcmd);
-    qemu_get_8s(f, &s->dstat);
-    qemu_get_8s(f, &s->dien);
-    qemu_get_8s(f, &s->sist0);
-    qemu_get_8s(f, &s->sist1);
-    qemu_get_8s(f, &s->sien0);
-    qemu_get_8s(f, &s->sien1);
-    qemu_get_8s(f, &s->mbox0);
-    qemu_get_8s(f, &s->mbox1);
-    qemu_get_8s(f, &s->dfifo);
-    qemu_get_8s(f, &s->ctest2);
-    qemu_get_8s(f, &s->ctest3);
-    qemu_get_8s(f, &s->ctest4);
-    qemu_get_8s(f, &s->ctest5);
-    qemu_get_8s(f, &s->ccntl0);
-    qemu_get_8s(f, &s->ccntl1);
-    qemu_get_be32s(f, &s->dsp);
-    qemu_get_be32s(f, &s->dsps);
-    qemu_get_8s(f, &s->dmode);
-    qemu_get_8s(f, &s->dcntl);
-    qemu_get_8s(f, &s->scntl0);
-    qemu_get_8s(f, &s->scntl1);
-    qemu_get_8s(f, &s->scntl2);
-    qemu_get_8s(f, &s->scntl3);
-    qemu_get_8s(f, &s->sstat0);
-    qemu_get_8s(f, &s->sstat1);
-    qemu_get_8s(f, &s->scid);
-    qemu_get_8s(f, &s->sxfer);
-    qemu_get_8s(f, &s->socl);
-    qemu_get_8s(f, &s->sdid);
-    qemu_get_8s(f, &s->ssid);
-    qemu_get_8s(f, &s->sfbr);
-    qemu_get_8s(f, &s->stest1);
-    qemu_get_8s(f, &s->stest2);
-    qemu_get_8s(f, &s->stest3);
-    qemu_get_8s(f, &s->sidl);
-    qemu_get_8s(f, &s->stime0);
-    qemu_get_8s(f, &s->respid0);
-    qemu_get_8s(f, &s->respid1);
-    qemu_get_be32s(f, &s->mmrs);
-    qemu_get_be32s(f, &s->mmws);
-    qemu_get_be32s(f, &s->sfs);
-    qemu_get_be32s(f, &s->drs);
-    qemu_get_be32s(f, &s->sbms);
-    qemu_get_be32s(f, &s->dbms);
-    qemu_get_be32s(f, &s->dnad64);
-    qemu_get_be32s(f, &s->pmjad1);
-    qemu_get_be32s(f, &s->pmjad2);
-    qemu_get_be32s(f, &s->rbc);
-    qemu_get_be32s(f, &s->ua);
-    qemu_get_be32s(f, &s->ia);
-    qemu_get_be32s(f, &s->sbc);
-    qemu_get_be32s(f, &s->csbc);
-    qemu_get_buffer(f, (uint8_t *)s->scratch, sizeof (s->scratch));
-    qemu_get_8s(f, &s->sbr);
-
-    qemu_get_buffer(f, (uint8_t *)s->script_ram, sizeof (s->script_ram));
-
-    return 0;
-}
-
 static int lsi_scsi_uninit(PCIDevice *d)
 {
    LSIState *s = (LSIState *) d;
@@ -2208,8 +2022,5 @@ void *lsi_scsi_init(PCIBus *bus, int devfn)

    lsi_soft_reset(s);

-    register_savevm("lsiscsi", -1, 0, lsi_scsi_save, lsi_scsi_load, s);
-
    return s;
-
 }
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -24,7 +24,6 @@ do { printf("mcf_fec: " fmt , ##args); } while (0)

 typedef struct {
    qemu_irq *irq;
-    int mmio_index;
    VLANClientState *vc;
    uint32_t irq_state;
    uint32_t eir;
@@ -442,30 +441,21 @@ static CPUWriteMemoryFunc *mcf_fec_writefn[] = {
   mcf_fec_write
 };

-static void mcf_fec_cleanup(VLANClientState *vc)
-{
-    mcf_fec_state *s = vc->opaque;
-
-    cpu_unregister_io_memory(s->mmio_index);
-
-    qemu_free(s);
-}
-
 void mcf_fec_init(NICInfo *nd, target_phys_addr_t base, qemu_irq *irq)
 {
    mcf_fec_state *s;
+    int iomemtype;

    qemu_check_nic_model(nd, "mcf_fec");

    s = (mcf_fec_state *)qemu_mallocz(sizeof(mcf_fec_state));
    s->irq = irq;
-    s->mmio_index = cpu_register_io_memory(0, mcf_fec_readfn,
-                                           mcf_fec_writefn, s);
-    cpu_register_physical_memory(base, 0x400, s->mmio_index);
+    iomemtype = cpu_register_io_memory(0, mcf_fec_readfn,
+                                       mcf_fec_writefn, s);
+    cpu_register_physical_memory(base, 0x400, iomemtype);

-    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                          mcf_fec_receive, mcf_fec_can_receive,
-                                          mcf_fec_cleanup, s);
+    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                 mcf_fec_receive, mcf_fec_can_receive, s);
    memcpy(s->macaddr, nd->macaddr, 6);
    qemu_format_nic_info_str(s->vc, s->macaddr);
 }
--- a/hw/mipsnet.c
+++ b/hw/mipsnet.c
@@ -33,9 +33,9 @@ typedef struct MIPSnetState {
    uint32_t intctl;
    uint8_t rx_buffer[MAX_ETH_FRAME_SIZE];
    uint8_t tx_buffer[MAX_ETH_FRAME_SIZE];
-    int io_base;
    qemu_irq irq;
    VLANClientState *vc;
+    NICInfo *nd;
 } MIPSnetState;

 static void mipsnet_reset(MIPSnetState *s)
@@ -232,17 +232,6 @@ static int mipsnet_load(QEMUFile *f, void *opaque, int version_id)
    return 0;
 }

-static void mipsnet_cleanup(VLANClientState *vc)
-{
-    MIPSnetState *s = vc->opaque;
-
-    unregister_savevm("mipsnet", s);
-
-    isa_unassign_ioport(s->io_base, 36);
-
-    qemu_free(s);
-}
-
 void mipsnet_init (int base, qemu_irq irq, NICInfo *nd)
 {
    MIPSnetState *s;
@@ -258,18 +247,16 @@ void mipsnet_init (int base, qemu_irq irq, NICInfo *nd)
    register_ioport_write(base, 36, 4, mipsnet_ioport_write, s);
    register_ioport_read(base, 36, 4, mipsnet_ioport_read, s);

-    s->io_base = base;
    s->irq = irq;
+    s->nd = nd;
    if (nd && nd->vlan) {
-        s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                              mipsnet_receive,
-                                              mipsnet_can_receive,
-                                              mipsnet_cleanup, s);
+        s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                     mipsnet_receive, mipsnet_can_receive, s);
    } else {
        s->vc = NULL;
    }

-    qemu_format_nic_info_str(s->vc, nd->macaddr);
+    qemu_format_nic_info_str(s->vc, s->nd->macaddr);

    mipsnet_reset(s);
    register_savevm("mipsnet", 0, 0, mipsnet_save, mipsnet_load, s);
--- a/hw/musicpal.c
+++ b/hw/musicpal.c
@@ -545,7 +545,6 @@ typedef struct mv88w8618_eth_state {
    uint32_t smir;
    uint32_t icr;
    uint32_t imr;
-    int mmio_index;
    int vlan_header;
    mv88w8618_tx_desc *tx_queue[2];
    mv88w8618_rx_desc *rx_queue[4];
@@ -706,29 +705,20 @@ static CPUWriteMemoryFunc *mv88w8618_eth_writefn[] = {
    mv88w8618_eth_write
 };

-static void eth_cleanup(VLANClientState *vc)
-{
-    mv88w8618_eth_state *s = vc->opaque;
-
-    cpu_unregister_io_memory(s->mmio_index);
-
-    qemu_free(s);
-}
-
 static void mv88w8618_eth_init(NICInfo *nd, uint32_t base, qemu_irq irq)
 {
    mv88w8618_eth_state *s;
+    int iomemtype;

    qemu_check_nic_model(nd, "mv88w8618");

    s = qemu_mallocz(sizeof(mv88w8618_eth_state));
    s->irq = irq;
    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 eth_receive, eth_can_receive,
-                                 eth_cleanup, s);
-    s->mmio_index = cpu_register_io_memory(0, mv88w8618_eth_readfn,
-                                           mv88w8618_eth_writefn, s);
-    cpu_register_physical_memory(base, MP_ETH_SIZE, s->mmio_index);
+                                 eth_receive, eth_can_receive, s);
+    iomemtype = cpu_register_io_memory(0, mv88w8618_eth_readfn,
+                                       mv88w8618_eth_writefn, s);
+    cpu_register_physical_memory(base, MP_ETH_SIZE, iomemtype);
 }

 /* LCD register offsets */
--- a/hw/ne2000.c
+++ b/hw/ne2000.c
@@ -140,7 +140,6 @@ typedef struct NE2000State {
    uint8_t curpag;
    uint8_t mult[8]; /* multicast mask array */
    qemu_irq irq;
-    int isa_io_base;
    PCIDevice *pci_dev;
    VLANClientState *vc;
    uint8_t macaddr[6];
@@ -719,19 +718,6 @@ static int ne2000_load(QEMUFile* f,void* opaque,int version_id)
 	return 0;
 }

-static void isa_ne2000_cleanup(VLANClientState *vc)
-{
-    NE2000State *s = vc->opaque;
-
-    unregister_savevm("ne2000", s);
-
-    isa_unassign_ioport(s->isa_io_base, 16);
-    isa_unassign_ioport(s->isa_io_base + 0x10, 2);
-    isa_unassign_ioport(s->isa_io_base + 0x1f, 1);
-
-    qemu_free(s);
-}
-
 void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd)
 {
    NE2000State *s;
@@ -750,15 +736,13 @@ void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd)

    register_ioport_write(base + 0x1f, 1, 1, ne2000_reset_ioport_write, s);
    register_ioport_read(base + 0x1f, 1, 1, ne2000_reset_ioport_read, s);
-    s->isa_io_base = base;
    s->irq = irq;
    memcpy(s->macaddr, nd->macaddr, 6);

    ne2000_reset(s);

-    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                          ne2000_receive, ne2000_can_receive,
-                                          isa_ne2000_cleanup, s);
+    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                 ne2000_receive, ne2000_can_receive, s);

    qemu_format_nic_info_str(s->vc, s->macaddr);

@@ -793,13 +777,6 @@ static void ne2000_map(PCIDevice *pci_dev, int region_num,
    register_ioport_read(addr + 0x1f, 1, 1, ne2000_reset_ioport_read, s);
 }

-static void ne2000_cleanup(VLANClientState *vc)
-{
-    NE2000State *s = vc->opaque;
-
-    unregister_savevm("ne2000", s);
-}
-
 PCIDevice *pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn)
 {
    PCINE2000State *d;
@@ -810,9 +787,6 @@ PCIDevice *pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn)
                                              "NE2000", sizeof(PCINE2000State),
                                              devfn,
                                              NULL, NULL);
-    if (!d)
-       return NULL;
-
    pci_conf = d->dev.config;
    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REALTEK);
    pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REALTEK_RTL8029);
@@ -828,8 +802,7 @@ PCIDevice *pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn)
    memcpy(s->macaddr, nd->macaddr, 6);
    ne2000_reset(s);
    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 ne2000_receive, ne2000_can_receive,
-                                 ne2000_cleanup, s);
+                                 ne2000_receive, ne2000_can_receive, s);

    qemu_format_nic_info_str(s->vc, s->macaddr);

--- a/hw/pc.c
+++ b/hw/pc.c
@@ -63,30 +63,6 @@ static PITState *pit;
 static IOAPICState *ioapic;
 static PCIDevice *i440fx_state;

-typedef struct rom_reset_data {
-    uint8_t *data;
-    target_phys_addr_t addr;
-    unsigned size;
-} RomResetData;
-
-static void option_rom_reset(void *_rrd)
-{
-    RomResetData *rrd = _rrd;
-
-    cpu_physical_memory_write_rom(rrd->addr, rrd->data, rrd->size);
-}
-
-static void option_rom_setup_reset(target_phys_addr_t addr, unsigned size)
-{
-    RomResetData *rrd = qemu_malloc(sizeof *rrd);
-
-    rrd->data = qemu_malloc(size);
-    cpu_physical_memory_read(addr, rrd->data, size);
-    rrd->addr = addr;
-    rrd->size = size;
-    qemu_register_reset(option_rom_reset, rrd);
-}
-
 static void ioport80_write(void *opaque, uint32_t addr, uint32_t data)
 {
 }
@@ -471,7 +447,7 @@ static void bochs_bios_init(void)

 /* Generate an initial boot sector which sets state and jump to
   a specified vector */
-static void generate_bootsect(target_phys_addr_t option_rom,
+static void generate_bootsect(uint8_t *option_rom,
                              uint32_t gpr[8], uint16_t segs[6], uint16_t ip)
 {
    uint8_t rom[512], *p, *reloc;
@@ -545,8 +521,7 @@ static void generate_bootsect(target_phys_addr_t option_rom,
        sum += rom[i];
    rom[sizeof(rom) - 1] = -sum;

-    cpu_physical_memory_write_rom(option_rom, rom, sizeof(rom));
-    option_rom_setup_reset(option_rom, sizeof (rom));
+    memcpy(option_rom, rom, sizeof(rom));
 }

 static long get_file_size(FILE *f)
@@ -563,11 +538,10 @@ static long get_file_size(FILE *f)
    return size;
 }

-static void load_linux(target_phys_addr_t option_rom,
+static void load_linux(uint8_t *option_rom,
                       const char *kernel_filename,
 		       const char *initrd_filename,
-		       const char *kernel_cmdline,
-               target_phys_addr_t max_ram_size)
+		       const char *kernel_cmdline)
 {
    uint16_t protocol;
    uint32_t gpr[8];
@@ -633,8 +607,8 @@ static void load_linux(target_phys_addr_t option_rom,
    else
 	initrd_max = 0x37ffffff;

-    if (initrd_max >= max_ram_size-ACPI_DATA_SIZE)
-    	initrd_max = max_ram_size-ACPI_DATA_SIZE-1;
+    if (initrd_max >= ram_size-ACPI_DATA_SIZE)
+	initrd_max = ram_size-ACPI_DATA_SIZE-1;

    /* kernel command line */
    pstrcpy_targphys(cmdline_addr, 4096, kernel_cmdline);
@@ -676,6 +650,9 @@ static void load_linux(target_phys_addr_t option_rom,
 	initrd_size = get_file_size(fi);
 	initrd_addr = (initrd_max-initrd_size) & ~4095;

+        fprintf(stderr, "qemu: loading initrd (%#x bytes) at 0x" TARGET_FMT_plx
+                "\n", initrd_size, initrd_addr);
+
 	if (!fread_targphys_ok(initrd_addr, initrd_size, fi)) {
 	    fprintf(stderr, "qemu: read error on initial ram disk '%s'\n",
 		    initrd_filename);
@@ -712,12 +689,6 @@ static void load_linux(target_phys_addr_t option_rom,
    memset(gpr, 0, sizeof gpr);
    gpr[4] = cmdline_addr-real_addr-16;	/* SP (-16 is paranoia) */

-    option_rom_setup_reset(real_addr, setup_size);
-    option_rom_setup_reset(prot_addr, kernel_size);
-    option_rom_setup_reset(cmdline_addr, cmdline_size);
-    if (initrd_filename)
-        option_rom_setup_reset(initrd_addr, initrd_size);
-
    generate_bootsect(option_rom, gpr, seg, 0);
 }

@@ -925,10 +896,10 @@ vga_bios_error:
        offset = 0;
        if (linux_boot) {
            option_rom_offset = qemu_ram_alloc(TARGET_PAGE_SIZE);
+            load_linux(phys_ram_base + option_rom_offset,
+                       kernel_filename, initrd_filename, kernel_cmdline);
            cpu_register_physical_memory(0xd0000, TARGET_PAGE_SIZE,
-                                         option_rom_offset);
-            load_linux(0xd0000,
-                       kernel_filename, initrd_filename, kernel_cmdline, below_4g_mem_size);
+                                         option_rom_offset | IO_MEM_ROM);
            offset = TARGET_PAGE_SIZE;
        }

--- a/hw/pci-hotplug.c
+++ b/hw/pci-hotplug.c
@@ -37,10 +37,10 @@ static PCIDevice *qemu_pci_hot_add_nic(PCIBus *pci_bus, const char *opts)
 {
    int ret;

-    ret = net_client_init("nic", opts);
-    if (ret < 0)
+    ret = net_client_init ("nic", opts);
+    if (ret < 0 || !nd_table[ret].model)
        return NULL;
-    return pci_nic_init(pci_bus, &nd_table[ret], -1, "rtl8139");
+    return pci_nic_init (pci_bus, &nd_table[ret], -1, "rtl8139");
 }

 void drive_hot_add(const char *pci_addr, const char *opts)
@@ -95,22 +95,19 @@ static PCIDevice *qemu_pci_hot_add_storage(PCIBus *pci_bus, const char *opts)
            type = IF_SCSI;
        else if (!strcmp(buf, "virtio")) {
            type = IF_VIRTIO;
-        } else {
-            term_printf("type %s not a hotpluggable PCI device.\n", buf);
-            goto out;
        }
    } else {
        term_printf("no if= specified\n");
-        goto out;
+        return NULL;
    }

    if (get_param_value(buf, sizeof(buf), "file", opts)) {
        drive_idx = add_init_drive(opts);
        if (drive_idx < 0)
-            goto out;
+            return NULL;
    } else if (type == IF_VIRTIO) {
        term_printf("virtio requires a backing file/device.\n");
-        goto out;
+        return NULL;
    }

    switch (type) {
@@ -123,9 +120,10 @@ static PCIDevice *qemu_pci_hot_add_storage(PCIBus *pci_bus, const char *opts)
    case IF_VIRTIO:
        opaque = virtio_blk_init (pci_bus, drives_table[drive_idx].bdrv);
        break;
+    default:
+        term_printf ("type %s not a hotpluggable PCI device.\n", buf);
    }

-out:
    return opaque;
 }

--- a/hw/pci.c
+++ b/hw/pci.c
@@ -494,8 +494,6 @@ void pci_default_write_config(PCIDevice *d,
            case 0x01:
            case 0x02:
            case 0x03:
-            case 0x06:
-            case 0x07:
            case 0x08:
            case 0x09:
            case 0x0a:
@@ -519,8 +517,6 @@ void pci_default_write_config(PCIDevice *d,
            case 0x01:
            case 0x02:
            case 0x03:
-            case 0x06:
-            case 0x07:
            case 0x08:
            case 0x09:
            case 0x0a:
--- a/hw/pcnet.c
+++ b/hw/pcnet.c
@@ -75,7 +75,6 @@ struct PCNetState_st {
    uint8_t buffer[4096];
    int tx_busy;
    qemu_irq irq;
-    qemu_irq *reset_irq;
    void (*phys_mem_read)(void *dma_opaque, target_phys_addr_t addr,
                         uint8_t *buf, int len, int do_bswap);
    void (*phys_mem_write)(void *dma_opaque, target_phys_addr_t addr,
@@ -1930,15 +1929,7 @@ static int pcnet_load(QEMUFile *f, void *opaque, int version_id)
    return 0;
 }

-static void pcnet_common_cleanup(PCNetState *d)
-{
-    unregister_savevm("pcnet", d);
-
-    qemu_del_timer(d->poll_timer);
-    qemu_free_timer(d->poll_timer);
-}
-
-static void pcnet_common_init(PCNetState *d, NICInfo *nd, NetCleanup *cleanup)
+static void pcnet_common_init(PCNetState *d, NICInfo *nd)
 {
    d->poll_timer = qemu_new_timer(vm_clock, pcnet_poll_timer, d);

@@ -1946,8 +1937,7 @@ static void pcnet_common_init(PCNetState *d, NICInfo *nd, NetCleanup *cleanup)

    if (nd && nd->vlan) {
        d->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                     pcnet_receive, pcnet_can_receive,
-                                     cleanup, d);
+                                     pcnet_receive, pcnet_can_receive, d);

        qemu_format_nic_info_str(d->vc, d->nd->macaddr);
    } else {
@@ -1995,22 +1985,6 @@ static void pci_physical_memory_read(void *dma_opaque, target_phys_addr_t addr,
    cpu_physical_memory_read(addr, buf, len);
 }

-static void pci_pcnet_cleanup(VLANClientState *vc)
-{
-    PCNetState *d = vc->opaque;
-
-    pcnet_common_cleanup(d);
-}
-
-static int pci_pcnet_uninit(PCIDevice *dev)
-{
-    PCNetState *d = (PCNetState *)dev;
-
-    cpu_unregister_io_memory(d->mmio_index);
-
-    return 0;
-}
-
 PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)
 {
    PCNetState *d;
@@ -2023,10 +1997,6 @@ PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)

    d = (PCNetState *)pci_register_device(bus, "PCNet", sizeof(PCNetState),
                                          devfn, NULL, NULL);
-    if (!d)
-	return NULL;
-
-    d->dev.unregister = pci_pcnet_uninit;

    pci_conf = d->dev.config;

@@ -2061,8 +2031,7 @@ PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)
    d->phys_mem_write = pci_physical_memory_write;
    d->pci_dev = &d->dev;

-    pcnet_common_init(d, nd, pci_pcnet_cleanup);
-
+    pcnet_common_init(d, nd);
    return (PCIDevice *)d;
 }

@@ -2112,42 +2081,29 @@ static CPUWriteMemoryFunc *lance_mem_write[3] = {
    NULL,
 };

-static void lance_cleanup(VLANClientState *vc)
-{
-    PCNetState *d = vc->opaque;
-
-    pcnet_common_cleanup(d);
-
-    qemu_free_irqs(d->reset_irq);
-
-    cpu_unregister_io_memory(d->mmio_index);
-
-    qemu_free(d);
-}
-
 void lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
                qemu_irq irq, qemu_irq *reset)
 {
    PCNetState *d;
+    int lance_io_memory;

    qemu_check_nic_model(nd, "lance");

    d = qemu_mallocz(sizeof(PCNetState));

-    d->mmio_index =
+    lance_io_memory =
        cpu_register_io_memory(0, lance_mem_read, lance_mem_write, d);

    d->dma_opaque = dma_opaque;

-    d->reset_irq = qemu_allocate_irqs(parent_lance_reset, d, 1);
-    *reset = *d->reset_irq;
+    *reset = *qemu_allocate_irqs(parent_lance_reset, d, 1);

-    cpu_register_physical_memory(leaddr, 4, d->mmio_index);
+    cpu_register_physical_memory(leaddr, 4, lance_io_memory);

    d->irq = irq;
    d->phys_mem_read = ledma_memory_read;
    d->phys_mem_write = ledma_memory_write;

-    pcnet_common_init(d, nd, lance_cleanup);
+    pcnet_common_init(d, nd);
 }
 #endif /* TARGET_SPARC */
--- a/hw/ps2.c
+++ b/hw/ps2.c
@@ -488,8 +488,9 @@ void ps2_write_mouse(void *opaque, int val)
    }
 }

-static void ps2_common_reset(PS2State *s)
+static void ps2_reset(void *opaque)
 {
+    PS2State *s = (PS2State *)opaque;
    PS2Queue *q;
    s->write_cmd = -1;
    q = &s->queue;
@@ -499,33 +500,6 @@ static void ps2_common_reset(PS2State *s)
    s->update_irq(s->update_arg, 0);
 }

-static void ps2_kbd_reset(void *opaque)
-{
-    PS2KbdState *s = (PS2KbdState *) opaque;
-
-    ps2_common_reset(&s->common);
-    s->scan_enabled = 0;
-    s->translate = 0;
-    s->scancode_set = 0;
-}
-
-static void ps2_mouse_reset(void *opaque)
-{
-    PS2MouseState *s = (PS2MouseState *) opaque;
-
-    ps2_common_reset(&s->common);
-    s->mouse_status = 0;
-    s->mouse_resolution = 0;
-    s->mouse_sample_rate = 0;
-    s->mouse_wrap = 0;
-    s->mouse_type = 0;
-    s->mouse_detect_state = 0;
-    s->mouse_dx = 0;
-    s->mouse_dy = 0;
-    s->mouse_dz = 0;
-    s->mouse_buttons = 0;
-}
-
 static void ps2_common_save (QEMUFile *f, PS2State *s)
 {
    qemu_put_be32 (f, s->write_cmd);
@@ -616,10 +590,10 @@ void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg)
    s->common.update_irq = update_irq;
    s->common.update_arg = update_arg;
    s->scancode_set = 2;
-    ps2_kbd_reset(s);
+    ps2_reset(&s->common);
    register_savevm("ps2kbd", 0, 3, ps2_kbd_save, ps2_kbd_load, s);
    qemu_add_kbd_event_handler(ps2_put_keycode, s);
-    qemu_register_reset(ps2_kbd_reset, s);
+    qemu_register_reset(ps2_reset, &s->common);
    return s;
 }

@@ -629,9 +603,9 @@ void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg)

    s->common.update_irq = update_irq;
    s->common.update_arg = update_arg;
-    ps2_mouse_reset(s);
+    ps2_reset(&s->common);
    register_savevm("ps2mouse", 0, 2, ps2_mouse_save, ps2_mouse_load, s);
    qemu_add_mouse_event_handler(ps2_mouse_event, s, 0, "QEMU PS/2 Mouse");
-    qemu_register_reset(ps2_mouse_reset, s);
+    qemu_register_reset(ps2_reset, &s->common);
    return s;
 }
--- a/hw/r2d.c
+++ b/hw/r2d.c
@@ -37,9 +37,6 @@

 #define SM501_VRAM_SIZE 0x800000

-/* CONFIG_BOOT_LINK_OFFSET of Linux kernel */
-#define LINUX_LOAD_OFFSET 0x800000
-
 #define PA_IRLMSK	0x00
 #define PA_POWOFF	0x30
 #define PA_VERREG	0x32
@@ -236,27 +233,20 @@ static void r2d_init(ram_addr_t ram_size, int vga_ram_size,
        pci_nic_init(pci, &nd_table[i], (i==0)? 2<<3: -1, "rtl8139");

    /* Todo: register on board registers */
-    if (kernel_filename) {
+    {
      int kernel_size;
      /* initialization which should be done by firmware */
      stl_phys(SH7750_BCR1, 1<<3); /* cs3 SDRAM */
      stw_phys(SH7750_BCR2, 3<<(3*2)); /* cs3 32bit */

-      if (kernel_cmdline) {
-          kernel_size = load_image_targphys(kernel_filename,
-				   SDRAM_BASE + LINUX_LOAD_OFFSET,
-				   SDRAM_SIZE - LINUX_LOAD_OFFSET);
-          env->pc = (SDRAM_BASE + LINUX_LOAD_OFFSET) | 0xa0000000;
-          pstrcpy_targphys(SDRAM_BASE + 0x10100, 256, kernel_cmdline);
-      } else {
-          kernel_size = load_image_targphys(kernel_filename, SDRAM_BASE, SDRAM_SIZE);
-          env->pc = SDRAM_BASE | 0xa0000000; /* Start from P2 area */
-      }
+      kernel_size = load_image(kernel_filename, phys_ram_base);

      if (kernel_size < 0) {
        fprintf(stderr, "qemu: could not load kernel '%s'\n", kernel_filename);
        exit(1);
      }
+
+      env->pc = SDRAM_BASE | 0xa0000000; /* Start from P2 area */
    }
 }

--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -3414,33 +3414,6 @@ static void rtl8139_timer(void *opaque)
 }
 #endif /* RTL8139_ONBOARD_TIMER */

-static void rtl8139_cleanup(VLANClientState *vc)
-{
-    RTL8139State *s = vc->opaque;
-
-    if (s->cplus_txbuffer) {
-        qemu_free(s->cplus_txbuffer);
-        s->cplus_txbuffer = NULL;
-    }
-
-#ifdef RTL8139_ONBOARD_TIMER
-    qemu_del_timer(s->timer);
-    qemu_free_timer(s->timer);
-#endif
-
-    unregister_savevm("rtl8139", s);
-}
-
-static int pci_rtl8139_uninit(PCIDevice *dev)
-{
-    PCIRTL8139State *d = (PCIRTL8139State *)dev;
-    RTL8139State *s = &d->rtl8139;
-
-    cpu_unregister_io_memory(s->rtl8139_mmio_io_addr);
-
-    return 0;
-}
-
 PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn)
 {
    PCIRTL8139State *d;
@@ -3451,11 +3424,6 @@ PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn)
                                              "RTL8139", sizeof(PCIRTL8139State),
                                              devfn,
                                              NULL, NULL);
-    if (!d)
-	return NULL;
-
-    d->dev.unregister = pci_rtl8139_uninit;
-
    pci_conf = d->dev.config;
    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REALTEK);
    pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REALTEK_8139);
@@ -3482,8 +3450,7 @@ PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn)
    memcpy(s->macaddr, nd->macaddr, 6);
    rtl8139_reset(s);
    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 rtl8139_receive, rtl8139_can_receive,
-                                 rtl8139_cleanup, s);
+                                 rtl8139_receive, rtl8139_can_receive, s);

    qemu_format_nic_info_str(s->vc, s->macaddr);

--- a/hw/serial.c
+++ b/hw/serial.c
@@ -586,8 +586,6 @@ static int serial_can_receive(SerialState *s)
 static void serial_receive_break(SerialState *s)
 {
    s->rbr = 0;
-    /* When the LSR_DR is set a null byte is pushed into the fifo */
-    fifo_put(s, RECV_FIFO, '\0');
    s->lsr |= UART_LSR_BI | UART_LSR_DR;
    serial_update_irq(s);
 }
--- a/hw/smc91c111.c
+++ b/hw/smc91c111.c
@@ -42,7 +42,6 @@ typedef struct {
    uint8_t int_level;
    uint8_t int_mask;
    uint8_t macaddr[6];
-    int mmio_index;
 } smc91c111_state;

 #define RCR_SOFT_RST  0x8000
@@ -691,32 +690,24 @@ static CPUWriteMemoryFunc *smc91c111_writefn[] = {
    smc91c111_writel
 };

-static void smc91c111_cleanup(VLANClientState *vc)
-{
-    smc91c111_state *s = vc->opaque;
-
-    cpu_unregister_io_memory(s->mmio_index);
-    qemu_free(s);
-}
-
 void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
 {
    smc91c111_state *s;
+    int iomemtype;

    qemu_check_nic_model(nd, "smc91c111");

    s = (smc91c111_state *)qemu_mallocz(sizeof(smc91c111_state));
-    s->mmio_index = cpu_register_io_memory(0, smc91c111_readfn,
-                                           smc91c111_writefn, s);
-    cpu_register_physical_memory(base, 16, s->mmio_index);
+    iomemtype = cpu_register_io_memory(0, smc91c111_readfn,
+                                       smc91c111_writefn, s);
+    cpu_register_physical_memory(base, 16, iomemtype);
    s->irq = irq;
    memcpy(s->macaddr, nd->macaddr, 6);

    smc91c111_reset(s);

    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 smc91c111_receive, smc91c111_can_receive,
-                                 smc91c111_cleanup, s);
+                                 smc91c111_receive, smc91c111_can_receive, s);
    qemu_format_nic_info_str(s->vc, s->macaddr);
    /* ??? Save/restore.  */
 }
--- a/hw/stellaris_enet.c
+++ b/hw/stellaris_enet.c
@@ -69,7 +69,6 @@ typedef struct {
    VLANClientState *vc;
    qemu_irq irq;
    uint8_t macaddr[6];
-    int mmio_index;
 } stellaris_enet_state;

 static void stellaris_enet_update(stellaris_enet_state *s)
@@ -385,35 +384,23 @@ static int stellaris_enet_load(QEMUFile *f, void *opaque, int version_id)
    return 0;
 }

-static void stellaris_enet_cleanup(VLANClientState *vc)
-{
-    stellaris_enet_state *s = vc->opaque;
-
-    unregister_savevm("stellaris_enet", s);
-
-    cpu_unregister_io_memory(s->mmio_index);
-
-    qemu_free(s);
-}
-
 void stellaris_enet_init(NICInfo *nd, uint32_t base, qemu_irq irq)
 {
    stellaris_enet_state *s;
+    int iomemtype;

    qemu_check_nic_model(nd, "stellaris");

    s = (stellaris_enet_state *)qemu_mallocz(sizeof(stellaris_enet_state));
-    s->mmio_index = cpu_register_io_memory(0, stellaris_enet_readfn,
-                                           stellaris_enet_writefn, s);
-    cpu_register_physical_memory(base, 0x00001000, s->mmio_index);
+    iomemtype = cpu_register_io_memory(0, stellaris_enet_readfn,
+                                       stellaris_enet_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
    s->irq = irq;
    memcpy(s->macaddr, nd->macaddr, 6);

    if (nd->vlan) {
        s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                     stellaris_enet_receive,
-                                     stellaris_enet_can_receive,
-                                     stellaris_enet_cleanup, s);
+                                     stellaris_enet_receive, stellaris_enet_can_receive, s);
        qemu_format_nic_info_str(s->vc, s->macaddr);
    }

--- a/hw/usb-net.c
+++ b/hw/usb-net.c
@@ -1415,20 +1415,14 @@ static int usbnet_can_receive(void *opaque)
    return !s->in_len;
 }

-static void usbnet_cleanup(VLANClientState *vc)
-{
-    USBNetState *s = vc->opaque;
-
-    rndis_clear_responsequeue(s);
-    qemu_free(s);
-}
-
 static void usb_net_handle_destroy(USBDevice *dev)
 {
    USBNetState *s = (USBNetState *) dev;

    /* TODO: remove the nd_table[] entry */
    qemu_del_vlan_client(s->vc);
+    rndis_clear_responsequeue(s);
+    qemu_free(s);
 }

 USBDevice *usb_net_init(NICInfo *nd)
@@ -1457,10 +1451,8 @@ USBDevice *usb_net_init(NICInfo *nd)

    pstrcpy(s->dev.devname, sizeof(s->dev.devname),
                    "QEMU USB Network Interface");
-    s->vc = nd->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                          usbnet_receive,
-                                          usbnet_can_receive,
-                                          usbnet_cleanup, s);
+    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                    usbnet_receive, usbnet_can_receive, s);

    qemu_format_nic_info_str(s->vc, s->mac);

--- a/hw/vga.c
+++ b/hw/vga.c
@@ -1616,16 +1616,6 @@ static void vga_draw_graphic(VGAState *s, int full_update)
        s->double_scan = double_scan;
    }

-    if (shift_control == 0) {
-        if (s->sr[0x01] & 8) {
-            disp_width <<= 1;
-        }
-    } else if (shift_control == 1) {
-        if (s->sr[0x01] & 8) {
-            disp_width <<= 1;
-        }
-    }
-
    depth = s->get_bpp(s);
    if (s->line_offset != s->last_line_offset ||
        disp_width != s->last_width ||
@@ -1671,6 +1661,7 @@ static void vga_draw_graphic(VGAState *s, int full_update)
        full_update |= update_palette16(s);
        if (s->sr[0x01] & 8) {
            v = VGA_DRAW_LINE4D2;
+            disp_width <<= 1;
        } else {
            v = VGA_DRAW_LINE4;
        }
@@ -1679,6 +1670,7 @@ static void vga_draw_graphic(VGAState *s, int full_update)
        full_update |= update_palette16(s);
        if (s->sr[0x01] & 8) {
            v = VGA_DRAW_LINE2D2;
+            disp_width <<= 1;
        } else {
            v = VGA_DRAW_LINE2;
        }
@@ -2606,9 +2598,8 @@ static void vga_screen_dump_blank(VGAState *s, const char *filename)
 {
    FILE *f;
    unsigned int y, x, w, h;
-    unsigned char blank_sample[3] = { 0, 0, 0 };

-    w = s->last_scr_width;
+    w = s->last_scr_width * sizeof(uint32_t);
    h = s->last_scr_height;

    f = fopen(filename, "wb");
@@ -2617,7 +2608,7 @@ static void vga_screen_dump_blank(VGAState *s, const char *filename)
    fprintf(f, "P6\n%d %d\n%d\n", w, h, 255);
    for (y = 0; y < h; y++) {
        for (x = 0; x < w; x++) {
-            fwrite(blank_sample, 3, 1, f);
+            fputc(0, f);
        }
    }
    fclose(f);
@@ -2679,5 +2670,4 @@ static void vga_screen_dump(void *opaque, const char *filename)
        vga_screen_dump_graphic(s, filename);
    else
        vga_screen_dump_text(s, filename);
-    vga_invalidate_display(s);
 }
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -247,7 +247,6 @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)

    bdrv_get_geometry(s->bs, &capacity);
    bdrv_get_geometry_hint(s->bs, &cylinders, &heads, &secs);
-    memset(&blkcfg, 0, sizeof(blkcfg));
    stq_raw(&blkcfg.capacity, capacity);
    stl_raw(&blkcfg.seg_max, 128 - 2);
    stw_raw(&blkcfg.cylinders, cylinders);
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -113,21 +113,6 @@ static uint32_t virtio_net_get_features(VirtIODevice *vdev)
    return features;
 }

-static uint32_t virtio_net_bad_features(VirtIODevice *vdev)
-{
-    uint32_t features = 0;
-
-    /* Linux kernel 2.6.25.  It understood MAC (as everyone must),
-     * but also these: */
-    features |= (1 << VIRTIO_NET_F_MAC);
-    features |= (1 << VIRTIO_NET_F_GUEST_CSUM);
-    features |= (1 << VIRTIO_NET_F_GUEST_TSO4);
-    features |= (1 << VIRTIO_NET_F_GUEST_TSO6);
-    features |= (1 << VIRTIO_NET_F_GUEST_ECN);
-
-    return features & virtio_net_get_features(vdev);
-}
-
 static void virtio_net_set_features(VirtIODevice *vdev, uint32_t features)
 {
    VirtIONet *n = to_virtio_net(vdev);
@@ -338,6 +323,11 @@ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
    if (n->promisc)
        return 1;

+#ifdef TAP_VNET_HDR
+    if (tap_has_vnet_hdr(n->vc->vlan->first_client))
+        ptr += sizeof(struct virtio_net_hdr);
+#endif
+
    if (!memcmp(&ptr[12], vlan, sizeof(vlan))) {
        int vid = be16_to_cpup((uint16_t *)(ptr + 14)) & 0xfff;
        if (!(n->vlans[vid >> 5] & (1U << (vid & 0x1f))))
@@ -570,21 +560,6 @@ static int virtio_net_load(QEMUFile *f, void *opaque, int version_id)
    return 0;
 }

-static void virtio_net_cleanup(VLANClientState *vc)
-{
-    VirtIONet *n = vc->opaque;
-
-    unregister_savevm("virtio-net", n);
-
-    qemu_free(n->mac_table.macs);
-    qemu_free(n->vlans);
-
-    qemu_del_timer(n->tx_timer);
-    qemu_free_timer(n->tx_timer);
-
-    virtio_cleanup(&n->vdev);
-}
-
 PCIDevice *virtio_net_init(PCIBus *bus, NICInfo *nd, int devfn)
 {
    VirtIONet *n;
@@ -605,7 +580,6 @@ PCIDevice *virtio_net_init(PCIBus *bus, NICInfo *nd, int devfn)
    n->vdev.set_config = virtio_net_set_config;
    n->vdev.get_features = virtio_net_get_features;
    n->vdev.set_features = virtio_net_set_features;
-    n->vdev.bad_features = virtio_net_bad_features;
    n->vdev.reset = virtio_net_reset;
    n->rx_vq = virtio_add_queue(&n->vdev, 256, virtio_net_handle_rx);
    n->tx_vq = virtio_add_queue(&n->vdev, 256, virtio_net_handle_tx);
@@ -613,9 +587,7 @@ PCIDevice *virtio_net_init(PCIBus *bus, NICInfo *nd, int devfn)
    memcpy(n->mac, nd->macaddr, ETH_ALEN);
    n->status = VIRTIO_NET_S_LINK_UP;
    n->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                 virtio_net_receive,
-                                 virtio_net_can_receive,
-                                 virtio_net_cleanup, n);
+                                 virtio_net_receive, virtio_net_can_receive, n);
    n->vc->link_status_changed = virtio_net_set_link_status;

    qemu_format_nic_info_str(n->vc, n->mac);
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -516,13 +516,6 @@ static void virtio_ioport_write(void *opaque, uint32_t addr, uint32_t val)

    switch (addr) {
    case VIRTIO_PCI_GUEST_FEATURES:
-	/* Guest does not negotiate properly?  We have to assume nothing. */
-	if (val & (1 << VIRTIO_F_BAD_FEATURE)) {
-	    if (vdev->bad_features)
-		val = vdev->bad_features(vdev);
-	    else
-		val = 0;
-	}
        if (vdev->set_features)
            vdev->set_features(vdev, val);
        vdev->features = val;
@@ -562,7 +555,7 @@ static uint32_t virtio_ioport_read(void *opaque, uint32_t addr)
    switch (addr) {
    case VIRTIO_PCI_HOST_FEATURES:
        ret = vdev->get_features(vdev);
-        ret |= (1 << VIRTIO_F_NOTIFY_ON_EMPTY) | (1 << VIRTIO_F_BAD_FEATURE);
+        ret |= (1 << VIRTIO_F_NOTIFY_ON_EMPTY);
        break;
    case VIRTIO_PCI_GUEST_FEATURES:
        ret = vdev->features;
@@ -815,13 +808,6 @@ void virtio_load(VirtIODevice *vdev, QEMUFile *f)
    virtio_update_irq(vdev);
 }

-void virtio_cleanup(VirtIODevice *vdev)
-{
-    if (vdev->config)
-        qemu_free(vdev->config);
-    qemu_free(vdev->vq);
-}
-
 VirtIODevice *virtio_init_pci(PCIBus *bus, const char *name,
                              uint16_t vendor, uint16_t device,
                              uint16_t subvendor, uint16_t subdevice,
--- a/hw/virtio.h
+++ b/hw/virtio.h
@@ -32,8 +32,6 @@
 /* We notify when the ring is completely used, even if the guest is supressing
 * callbacks */
 #define VIRTIO_F_NOTIFY_ON_EMPTY        24
-/* A guest should never accept this.  It implies negotiation is broken. */
-#define VIRTIO_F_BAD_FEATURE		30

 /* from Linux's linux/virtio_ring.h */

@@ -84,7 +82,6 @@ struct VirtIODevice
    size_t config_len;
    void *config;
    uint32_t (*get_features)(VirtIODevice *vdev);
-    uint32_t (*bad_features)(VirtIODevice *vdev);
    void (*set_features)(VirtIODevice *vdev, uint32_t val);
    void (*get_config)(VirtIODevice *vdev, uint8_t *config);
    void (*set_config)(VirtIODevice *vdev, const uint8_t *config);
@@ -117,8 +114,6 @@ void virtio_save(VirtIODevice *vdev, QEMUFile *f);

 void virtio_load(VirtIODevice *vdev, QEMUFile *f);

-void virtio_cleanup(VirtIODevice *vdev);
-
 void virtio_notify_config(VirtIODevice *vdev);

 void virtio_queue_set_notification(VirtQueue *vq, int enable);
--- a/hw/zaurus.c
+++ b/hw/zaurus.c
@@ -160,7 +160,7 @@ static CPUWriteMemoryFunc *scoop_writefn[] = {

 void scoop_gpio_set(void *opaque, int line, int level)
 {
-    struct scoop_info_s *s = (struct scoop_info_s *) opaque;
+    struct scoop_info_s *s = (struct scoop_info_s *) s;

    if (level)
        s->gpio_level |= (1 << line);
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -280,28 +280,14 @@ int kvm_uncoalesce_mmio_region(target_phys_addr_t start, ram_addr_t size)
    return ret;
 }

-int kvm_check_extension(KVMState *s, unsigned int extension)
-{
-    int ret;
-
-    ret = kvm_ioctl(s, KVM_CHECK_EXTENSION, extension);
-    if (ret < 0) {
-        ret = 0;
-    }
-
-    return ret;
-}
-
 int kvm_init(int smp_cpus)
 {
    KVMState *s;
    int ret;
    int i;

-    if (smp_cpus > 1) {
-        fprintf(stderr, "No SMP KVM support, use '-smp 1'\n");
+    if (smp_cpus > 1)
        return -EINVAL;
-    }

    s = qemu_mallocz(sizeof(KVMState));

@@ -339,8 +325,10 @@ int kvm_init(int smp_cpus)
     * just use a user allocated buffer so we can use phys_ram_base
     * unmodified.  Make sure we have a sufficiently modern version of KVM.
     */
-    if (!kvm_check_extension(s, KVM_CAP_USER_MEMORY)) {
-        ret = -EINVAL;
+    ret = kvm_ioctl(s, KVM_CHECK_EXTENSION, KVM_CAP_USER_MEMORY);
+    if (ret <= 0) {
+        if (ret == 0)
+            ret = -EINVAL;
        fprintf(stderr, "kvm does not support KVM_CAP_USER_MEMORY\n");
        goto err;
    }
@@ -348,8 +336,11 @@ int kvm_init(int smp_cpus)
    /* There was a nasty bug in < kvm-80 that prevents memory slots from being
     * destroyed properly.  Since we rely on this capability, refuse to work
     * with any kernel without this capability. */
-    if (!kvm_check_extension(s, KVM_CAP_DESTROY_MEMORY_REGION_WORKS)) {
-        ret = -EINVAL;
+    ret = kvm_ioctl(s, KVM_CHECK_EXTENSION,
+                    KVM_CAP_DESTROY_MEMORY_REGION_WORKS);
+    if (ret <= 0) {
+        if (ret == 0)
+            ret = -EINVAL;

        fprintf(stderr,
                "KVM kernel module broken (DESTROY_MEMORY_REGION)\n"
@@ -357,10 +348,11 @@ int kvm_init(int smp_cpus)
        goto err;
    }

-#ifdef KVM_CAP_COALESCED_MMIO
-    s->coalesced_mmio = kvm_check_extension(s, KVM_CAP_COALESCED_MMIO);
-#else
    s->coalesced_mmio = 0;
+#ifdef KVM_CAP_COALESCED_MMIO
+    ret = kvm_ioctl(s, KVM_CHECK_EXTENSION, KVM_CAP_COALESCED_MMIO);
+    if (ret > 0)
+        s->coalesced_mmio = ret;
 #endif

    ret = kvm_arch_init(s, smp_cpus);
@@ -451,13 +443,14 @@ int kvm_cpu_exec(CPUState *env)
    dprintf("kvm_cpu_exec()\n");

    do {
+        kvm_arch_pre_run(env, run);
+
        if (env->exit_request) {
            dprintf("interrupt exit requested\n");
            ret = 0;
            break;
        }

-        kvm_arch_pre_run(env, run);
        ret = kvm_vcpu_ioctl(env, KVM_RUN, 0);
        kvm_arch_post_run(env, run);

@@ -657,26 +650,9 @@ int kvm_has_sync_mmu(void)
 #ifdef KVM_CAP_SYNC_MMU
    KVMState *s = kvm_state;

-    return kvm_check_extension(s, KVM_CAP_SYNC_MMU);
-#else
+    if (kvm_ioctl(s, KVM_CHECK_EXTENSION, KVM_CAP_SYNC_MMU) > 0)
+        return 1;
+#endif
+
    return 0;
-#endif
-}
-
-void kvm_setup_guest_memory(void *start, size_t size)
-{
-    if (!kvm_has_sync_mmu()) {
-#ifdef MADV_DONTFORK
-        int ret = madvise(start, size, MADV_DONTFORK);
-
-        if (ret) {
-            perror("madvice");
-            exit(1);
-        }
-#else
-        fprintf(stderr,
-                "Need MADV_DONTFORK in absence of synchronous KVM MMU\n");
-        exit(1);
-#endif
-    }
 }
--- a/kvm.h
+++ b/kvm.h
@@ -46,8 +46,6 @@ int kvm_log_stop(target_phys_addr_t phys_addr, target_phys_addr_t len);

 int kvm_has_sync_mmu(void);

-void kvm_setup_guest_memory(void *start, size_t size);
-
 int kvm_coalesce_mmio_region(target_phys_addr_t start, ram_addr_t size);
 int kvm_uncoalesce_mmio_region(target_phys_addr_t start, ram_addr_t size);

@@ -78,8 +76,4 @@ int kvm_arch_init(KVMState *s, int smp_cpus);

 int kvm_arch_init_vcpu(CPUState *env);

-int kvm_check_extension(KVMState *s, unsigned int extension);
-
-uint32_t kvm_arch_get_supported_cpuid(CPUState *env, uint32_t function,
-                                      int reg);
 #endif
--- a/loader.c
+++ b/loader.c
@@ -90,12 +90,11 @@ int fread_targphys(target_phys_addr_t dst_addr, size_t nbytes, FILE *f)
    while (nbytes) {
 	want = nbytes > sizeof(buf) ? sizeof(buf) : nbytes;
 	did = fread(buf, 1, want, f);
+	if (did != want) break;

 	cpu_physical_memory_write_rom(dst_addr, buf, did);
 	dst_addr += did;
 	nbytes -= did;
-	if (did != want)
-	    break;
    }
    return dst_addr - dst_begin;
 }
@@ -383,7 +382,7 @@ static void *zalloc(void *x, unsigned items, unsigned size)
    return (p);
 }

-static void zfree(void *x, void *addr)
+static void zfree(void *x, void *addr, unsigned nb)
 {
    qemu_free(addr);
 }
@@ -431,7 +430,7 @@ static ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src,
    }

    s.zalloc = zalloc;
-    s.zfree = zfree;
+    s.zfree = (free_func)zfree;

    r = inflateInit2(&s, -MAX_WBITS);
    if (r != Z_OK) {
--- a/migration-exec.c
+++ b/migration-exec.c
@@ -74,7 +74,10 @@ MigrationState *exec_start_outgoing_migration(const char *command,
        goto err_after_open;
    }

-    socket_set_nonblock(s->fd);
+    if (fcntl(s->fd, F_SETFD, O_NONBLOCK) == -1) {
+        dprintf("Unable to set nonblocking mode on file descriptor\n");
+        goto err_after_open;
+    }

    s->opaque = qemu_popen(f, "w");

@@ -105,29 +108,9 @@ err_after_alloc:
    return NULL;
 }

-static void exec_accept_incoming_migration(void *opaque)
-{
-    QEMUFile *f = opaque;
-    int ret;
-
-    ret = qemu_loadvm_state(f);
-    if (ret < 0) {
-        fprintf(stderr, "load of migration failed\n");
-        goto err;
-    }
-    qemu_announce_self();
-    dprintf("successfully loaded vm state\n");
-    /* we've successfully migrated, close the fd */
-    qemu_set_fd_handler2(qemu_popen_fd(f), NULL, NULL, NULL, NULL);
-    if (autostart)
-        vm_start();
-
-err:
-    qemu_fclose(f);
-}
-
 int exec_start_incoming_migration(const char *command)
 {
+    int ret;
    QEMUFile *f;

    dprintf("Attempting to start an incoming migration\n");
@@ -136,10 +119,19 @@ int exec_start_incoming_migration(const char *command)
        dprintf("Unable to apply qemu wrapper to popen file\n");
        return -errno;
    }
-
-    qemu_set_fd_handler2(qemu_popen_fd(f), NULL,
-			 exec_accept_incoming_migration, NULL,
-			 (void *)(unsigned long)f);
-
+    vm_stop(0); /* just in case */
+    ret = qemu_loadvm_state(f);
+    if (ret < 0) {
+        fprintf(stderr, "load of migration failed\n");
+        goto err;
+    }
+    qemu_announce_self();
+    dprintf("successfully loaded vm state\n");
+    vm_start();
+    qemu_fclose(f);
    return 0;
+
+err:
+    qemu_fclose(f);
+    return -errno;
 }
--- a/migration-tcp.c
+++ b/migration-tcp.c
@@ -159,6 +159,7 @@ static void tcp_accept_incoming_migration(void *opaque)
        goto out;
    }

+    vm_stop(0); /* just in case */
    ret = qemu_loadvm_state(f);
    if (ret < 0) {
        fprintf(stderr, "load of migration failed\n");
@@ -170,8 +171,8 @@ static void tcp_accept_incoming_migration(void *opaque)
    /* we've successfully migrated, close the server socket */
    qemu_set_fd_handler2(s, NULL, NULL, NULL, NULL);
    close(s);
-    if (autostart)
-        vm_start();
+
+    vm_start();

 out_fopen:
    qemu_fclose(f);
--- a/migration.c
+++ b/migration.c
@@ -168,7 +168,7 @@ ssize_t migrate_fd_put_buffer(void *opaque, const void *data, size_t size)

    do {
        ret = s->write(s, data, size);
-    } while (ret == -1 && ((s->get_error(s)) == EINTR));
+    } while (ret == -1 && ((s->get_error(s)) == EINTR || (s->get_error(s)) == EWOULDBLOCK));

    if (ret == -1)
        ret = -(s->get_error(s));
@@ -212,24 +212,13 @@ void migrate_fd_put_ready(void *opaque)

    dprintf("iterate\n");
    if (qemu_savevm_state_iterate(s->file) == 1) {
-        int state;
-        int old_vm_running = vm_running;
-
        dprintf("done iterating\n");
        vm_stop(0);

-        qemu_aio_flush();
        bdrv_flush_all();
-        if ((qemu_savevm_state_complete(s->file)) < 0) {
-            if (old_vm_running) {
-                vm_start();
-            }
-            state = MIG_STATE_ERROR;
-        } else {
-            state = MIG_STATE_COMPLETED;
-        }
+        qemu_savevm_state_complete(s->file);
+        s->state = MIG_STATE_COMPLETED;
        migrate_fd_cleanup(s);
-        s->state = state;
    }
 }

@@ -288,7 +277,5 @@ void migrate_fd_wait_for_unfreeze(void *opaque)
 int migrate_fd_close(void *opaque)
 {
    FdMigrationState *s = opaque;
-
-    qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
    return s->close(s);
 }
--- a/net.c
+++ b/net.c
@@ -329,7 +329,6 @@ VLANClientState *qemu_new_vlan_client(VLANState *vlan,
                                      const char *name,
                                      IOReadHandler *fd_read,
                                      IOCanRWHandler *fd_can_read,
-                                      NetCleanup *cleanup,
                                      void *opaque)
 {
    VLANClientState *vc, **pvc;
@@ -341,7 +340,6 @@ VLANClientState *qemu_new_vlan_client(VLANState *vlan,
        vc->name = assign_name(vc, model);
    vc->fd_read = fd_read;
    vc->fd_can_read = fd_can_read;
-    vc->cleanup = cleanup;
    vc->opaque = opaque;
    vc->vlan = vlan;

@@ -360,12 +358,9 @@ void qemu_del_vlan_client(VLANClientState *vc)
    while (*pvc != NULL)
        if (*pvc == vc) {
            *pvc = vc->next;
-            if (vc->cleanup) {
-                vc->cleanup(vc);
-            }
            free(vc->name);
            free(vc->model);
-            qemu_free(vc);
+            free(vc);
            break;
        } else
            pvc = &(*pvc)->next;
@@ -522,7 +517,7 @@ static int net_slirp_init(VLANState *vlan, const char *model, const char *name)
        slirp_init(slirp_restrict, slirp_ip);
    }
    slirp_vc = qemu_new_vlan_client(vlan, model, name,
-                                    slirp_receive, NULL, NULL, NULL);
+                                    slirp_receive, NULL, NULL);
    slirp_vc->info_str[0] = '\0';
    return 0;
 }
@@ -703,8 +698,7 @@ typedef struct TAPState {
    char down_script_arg[128];
 } TAPState;

-static int launch_script(const char *setup_script, const char *ifname, int fd);
-
+#ifdef HAVE_IOVEC
 static ssize_t tap_receive_iov(void *opaque, const struct iovec *iov,
                               int iovcnt)
 {
@@ -717,6 +711,7 @@ static ssize_t tap_receive_iov(void *opaque, const struct iovec *iov,

    return len;
 }
+#endif

 static void tap_receive(void *opaque, const uint8_t *buf, int size)
 {
@@ -751,18 +746,6 @@ static void tap_send(void *opaque)
    }
 }

-static void tap_cleanup(VLANClientState *vc)
-{
-    TAPState *s = vc->opaque;
-
-    if (s->down_script[0])
-        launch_script(s->down_script, s->down_script_arg, s->fd);
-
-    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-    close(s->fd);
-    qemu_free(s);
-}
-
 /* fd support */

 static TAPState *net_tap_fd_init(VLANState *vlan,
@@ -774,9 +757,10 @@ static TAPState *net_tap_fd_init(VLANState *vlan,

    s = qemu_mallocz(sizeof(TAPState));
    s->fd = fd;
-    s->vc = qemu_new_vlan_client(vlan, model, name, tap_receive,
-                                 NULL, tap_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, model, name, tap_receive, NULL, s);
+#ifdef HAVE_IOVEC
    s->vc->fd_readv = tap_receive_iov;
+#endif
    qemu_set_fd_handler(s->fd, tap_send, NULL, s);
    snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
    return s;
@@ -1031,6 +1015,8 @@ static int net_tap_init(VLANState *vlan, const char *model,
 	    return -1;
    }
    s = net_tap_fd_init(vlan, model, name, fd);
+    if (!s)
+        return -1;
    snprintf(s->vc->info_str, sizeof(s->vc->info_str),
             "ifname=%s,script=%s,downscript=%s",
             ifname, setup_script, down_script);
@@ -1074,14 +1060,6 @@ static void vde_from_qemu(void *opaque, const uint8_t *buf, int size)
    }
 }

-static void vde_cleanup(VLANClientState *vc)
-{
-    VDEState *s = vc->opaque;
-    qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
-    vde_close(s->vde);
-    qemu_free(s);
-}
-
 static int net_vde_init(VLANState *vlan, const char *model,
                        const char *name, const char *sock,
                        int port, const char *group, int mode)
@@ -1102,8 +1080,7 @@ static int net_vde_init(VLANState *vlan, const char *model,
        free(s);
        return -1;
    }
-    s->vc = qemu_new_vlan_client(vlan, model, name, vde_from_qemu,
-                                 NULL, vde_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, model, name, vde_from_qemu, NULL, s);
    qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
    snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
             sock, vde_datafd(s->vde));
@@ -1288,14 +1265,6 @@ fail:
    return -1;
 }

-static void net_socket_cleanup(VLANClientState *vc)
-{
-    NetSocketState *s = vc->opaque;
-    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-    close(s->fd);
-    qemu_free(s);
-}
-
 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
                                                const char *model,
                                                const char *name,
@@ -1340,8 +1309,7 @@ static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
    s = qemu_mallocz(sizeof(NetSocketState));
    s->fd = fd;

-    s->vc = qemu_new_vlan_client(vlan, model, name, net_socket_receive_dgram,
-                                 NULL, net_socket_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, model, name, net_socket_receive_dgram, NULL, s);
    qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);

    /* mcast: save bound address as dst */
@@ -1368,8 +1336,8 @@ static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
    NetSocketState *s;
    s = qemu_mallocz(sizeof(NetSocketState));
    s->fd = fd;
-    s->vc = qemu_new_vlan_client(vlan, model, name, net_socket_receive,
-                                 NULL, net_socket_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, model, name,
+                                 net_socket_receive, NULL, s);
    snprintf(s->vc->info_str, sizeof(s->vc->info_str),
             "socket: fd=%d", fd);
    if (is_connected) {
@@ -1468,7 +1436,7 @@ static int net_socket_listen_init(VLANState *vlan,
    }
    s->vlan = vlan;
    s->model = strdup(model);
-    s->name = name ? strdup(name) : NULL;
+    s->name = strdup(name);
    s->fd = fd;
    qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
    return 0;
@@ -1628,7 +1596,10 @@ int net_client_init(const char *device, const char *p)
        vlan_id = strtol(buf, NULL, 0);
    }
    vlan = qemu_find_vlan(vlan_id);
-
+    if (!vlan) {
+        fprintf(stderr, "Could not create vlan %d\n", vlan_id);
+        return -1;
+    }
    if (get_param_value(buf, sizeof(buf), "name", p)) {
        name = strdup(buf);
    }
@@ -1639,8 +1610,7 @@ int net_client_init(const char *device, const char *p)

        if (idx == -1 || nb_nics >= MAX_NICS) {
            fprintf(stderr, "Too Many NICs\n");
-            ret = -1;
-            goto out;
+            return -1;
        }
        nd = &nd_table[idx];
        macaddr = nd->macaddr;
@@ -1654,8 +1624,7 @@ int net_client_init(const char *device, const char *p)
        if (get_param_value(buf, sizeof(buf), "macaddr", p)) {
            if (parse_macaddr(macaddr, buf) < 0) {
                fprintf(stderr, "invalid syntax for ethernet address\n");
-                ret = -1;
-                goto out;
+                return -1;
            }
        }
        if (get_param_value(buf, sizeof(buf), "model", p)) {
@@ -1695,9 +1664,8 @@ int net_client_init(const char *device, const char *p)
        port = strtol(p, &devname, 10);
        devname++;
        if (port < 1 || port > 65535) {
-            fprintf(stderr, "vmchannel wrong port number\n");
-            ret = -1;
-            goto out;
+            fprintf(stderr, "vmchannel wrong port number\n"); 
+            return -1;
        }
        vmc = malloc(sizeof(struct VMChannel));
        snprintf(name, 20, "vmchannel%ld", port);
@@ -1705,8 +1673,7 @@ int net_client_init(const char *device, const char *p)
        if (!vmc->hd) {
            fprintf(stderr, "qemu: could not open vmchannel device"
                    "'%s'\n", devname);
-            ret = -1;
-            goto out;
+            return -1;
        }
        vmc->port = port;
        slirp_add_exec(3, vmc->hd, 4, port);
@@ -1720,8 +1687,7 @@ int net_client_init(const char *device, const char *p)
        char ifname[64];
        if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
            fprintf(stderr, "tap: no interface name\n");
-            ret = -1;
-            goto out;
+            return -1;
        }
        vlan->nb_host_devs++;
        ret = tap_win32_init(vlan, device, name, ifname);
@@ -1736,8 +1702,9 @@ int net_client_init(const char *device, const char *p)
        if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
            fd = strtol(buf, NULL, 0);
            fcntl(fd, F_SETFL, O_NONBLOCK);
-            net_tap_fd_init(vlan, device, name, fd);
-            ret = 0;
+            ret = -1;
+            if (net_tap_fd_init(vlan, device, name, fd))
+                ret = 0;
        } else {
            if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
                ifname[0] = '\0';
@@ -1767,8 +1734,7 @@ int net_client_init(const char *device, const char *p)
            ret = net_socket_mcast_init(vlan, device, name, buf);
        } else {
            fprintf(stderr, "Unknown socket options: %s\n", p);
-            ret = -1;
-            goto out;
+            return -1;
        }
        vlan->nb_host_devs++;
    } else
@@ -1798,13 +1764,13 @@ int net_client_init(const char *device, const char *p)
 #endif
    {
        fprintf(stderr, "Unknown network device: %s\n", device);
-        ret = -1;
-        goto out;
+        if (name)
+            free(name);
+        return -1;
    }
    if (ret < 0) {
        fprintf(stderr, "Could not initialize device '%s'\n", device);
    }
-out:
    if (name)
        free(name);
    return ret;
@@ -1852,7 +1818,16 @@ void net_host_device_remove(int vlan_id, const char *device)
    VLANState *vlan;
    VLANClientState *vc;

+    if (!net_host_check_device(device)) {
+        term_printf("invalid host network device %s\n", device);
+        return;
+    }
+
    vlan = qemu_find_vlan(vlan_id);
+    if (!vlan) {
+        term_printf("can't find vlan %d\n", vlan_id);
+        return;
+    }

   for(vc = vlan->first_client; vc != NULL; vc = vc->next)
        if (!strcmp(vc->name, device))
@@ -1931,18 +1906,27 @@ void net_cleanup(void)
 {
    VLANState *vlan;

+#if !defined(_WIN32)
    /* close network clients */
    for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
-        VLANClientState *vc = vlan->first_client;
+        VLANClientState *vc;

-        while (vc) {
-            VLANClientState *next = vc->next;
+        for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
+            if (vc->fd_read == tap_receive) {
+                TAPState *s = vc->opaque;

-            qemu_del_vlan_client(vc);
-
-            vc = next;
+                if (s->down_script[0])
+                    launch_script(s->down_script, s->down_script_arg, s->fd);
+            }
+#if defined(CONFIG_VDE)
+            if (vc->fd_read == vde_from_qemu) {
+                VDEState *s = vc->opaque;
+                vde_close(s->vde);
+            }
+#endif
        }
    }
+#endif
 }

 void net_client_check(void)
--- a/net.h
+++ b/net.h
@@ -9,7 +9,6 @@ typedef ssize_t (IOReadvHandler)(void *, const struct iovec *, int);

 typedef struct VLANClientState VLANClientState;

-typedef void (NetCleanup) (VLANClientState *);
 typedef void (LinkStatusChanged)(VLANClientState *);

 struct VLANClientState {
@@ -18,7 +17,6 @@ struct VLANClientState {
    /* Packets may still be sent if this returns zero.  It's used to
       rate-limit the slirp code.  */
    IOCanRWHandler *fd_can_read;
-    NetCleanup *cleanup;
    LinkStatusChanged *link_status_changed;
    int link_down;
    void *opaque;
@@ -42,7 +40,6 @@ VLANClientState *qemu_new_vlan_client(VLANState *vlan,
                                      const char *name,
                                      IOReadHandler *fd_read,
                                      IOCanRWHandler *fd_can_read,
-                                      NetCleanup *cleanup,
                                      void *opaque);
 void qemu_del_vlan_client(VLANClientState *vc);
 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque);
@@ -68,7 +65,6 @@ struct NICInfo {
    const char *model;
    const char *name;
    VLANState *vlan;
-    VLANClientState *vc;
    void *private;
    int used;
 };
--- a/pc-bios/bios-pq/0013_fix-non-acpi-timer-interrupt-routing.patch
+++ b/pc-bios/bios-pq/0013_fix-non-acpi-timer-interrupt-routing.patch
@@ -1,38 +0,0 @@
-Fix non-ACPI Timer Interrupt Routing (Beth Kon)
-
-Replicate ACPI irq0->inti2 override in mp table for non-acpi case.
-
-v1 -> v2 adds comment suggested by Ryan.
-
-Signed-off-by: Beth Kon <eak@us.ibm.com>
-Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
-
-diff --git a/bios/rombios32.c b/bios/rombios32.c
-index 7be4216..dc7b5f3 100644
--- a/bios/rombios32.c
-+++ b/bios/rombios32.c
-@@ -1168,6 +1168,12 @@ static void mptable_init(void)
- 
-     /* irqs */
-     for(i = 0; i < 16; i++) {
-+#ifdef BX_QEMU
-+        /* One entry per ioapic input. Input 2 is covered by 
-+           irq0->inti2 override (i == 0). irq 2 is unused */
-+        if (i == 2)
-+            continue;
-+#endif        
-         putb(&q, 3); /* entry type = I/O interrupt */
-         putb(&q, 0); /* interrupt type = vectored interrupt */
-         putb(&q, 0); /* flags: po=0, el=0 */
-@@ -1175,7 +1181,11 @@ static void mptable_init(void)
-         putb(&q, 0); /* source bus ID = ISA */
-         putb(&q, i); /* source bus IRQ */
-         putb(&q, ioapic_id); /* dest I/O APIC ID */
-+#ifdef BX_QEMU
-+        putb(&q, i == 0 ? 2 : i); /* dest I/O APIC interrupt in */
-+#else
-         putb(&q, i); /* dest I/O APIC interrupt in */
-+#endif        
-     }
-     /* patch length */
-     len = q - mp_config_table;
--- a/pc-bios/bios-pq/0015_enable-power-button-even-generation.patch
+++ b/pc-bios/bios-pq/0015_enable-power-button-even-generation.patch
@@ -1,20 +0,0 @@
-Enable power button event generation.
-
-Signed-off-by: Gleb Natapov <gleb@redhat.com>
-Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
-
-diff --git a/bios/rombios32.c b/bios/rombios32.c
-index 81e3bad..9986531 100644
--- a/bios/rombios32.c
-+++ b/bios/rombios32.c
-@@ -1767,8 +1767,8 @@ void acpi_bios_init(void)
-     fadt->plvl3_lat = cpu_to_le16(0xfff); // C3 state not supported
-     fadt->gpe0_blk = cpu_to_le32(0xafe0);
-     fadt->gpe0_blk_len = 4;
-    /* WBINVD + PROC_C1 + PWR_BUTTON + SLP_BUTTON + FIX_RTC */
-    fadt->flags = cpu_to_le32((1 << 0) | (1 << 2) | (1 << 4) | (1 << 5) | (1 << 6));
-+    /* WBINVD + PROC_C1 + SLP_BUTTON + FIX_RTC */
-+    fadt->flags = cpu_to_le32((1 << 0) | (1 << 2) | (1 << 5) | (1 << 6));
-     acpi_build_table_header((struct acpi_table_header *)fadt, "FACP",
-                             sizeof(*fadt), 1);
- 
--- a/pc-bios/bios-pq/series
+++ b/pc-bios/bios-pq/series
@@ -9,5 +9,3 @@
 0009_qemu-bios-pci-hotplug-support.patch
 0010_bios-mark-the-acpi-sci-interrupt-as-connected-to-irq-9.patch
 0011_read-additional-acpi-tables-from-a-vm.patch
-0013_fix-non-acpi-timer-interrupt-routing.patch
-0015_enable-power-button-even-generation.patch
--- a/pc-bios/bios.bin
+++ b/pc-bios/bios.bin
--- a/qemu-aio.h
+++ b/qemu-aio.h
@@ -24,10 +24,9 @@ typedef int (AioFlushHandler)(void *opaque);
 * outstanding AIO operations have been completed or cancelled. */
 void qemu_aio_flush(void);

-/* Wait for a single AIO completion to occur.  This function will wait
- * until a single AIO event has completed and it will ensure something
- * has moved before returning. This can issue new pending aio as
- * result of executing I/O completion or bh callbacks. */
+/* Wait for a single AIO completion to occur.  This function will until a
+ * single AIO opeartion has completed.  It is intended to be used as a looping
+ * primative when simulating synchronous IO based on asynchronous IO. */
 void qemu_aio_wait(void);

 /* Register a file descriptor and associated callbacks.  Behaves very similarly
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -917,8 +917,6 @@ static void pty_chr_close(struct CharDriverState *chr)

    qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
    close(s->fd);
-    qemu_del_timer(s->timer);
-    qemu_free_timer(s->timer);
    qemu_free(s);
 }

@@ -1748,16 +1746,6 @@ static void udp_chr_update_read_handler(CharDriverState *chr)
    }
 }

-static void udp_chr_close(CharDriverState *chr)
-{
-    NetCharDriver *s = chr->opaque;
-    if (s->fd >= 0) {
-        qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-        closesocket(s->fd);
-    }
-    qemu_free(s);
-}
-
 static CharDriverState *qemu_chr_open_udp(const char *def)
 {
    CharDriverState *chr = NULL;
@@ -1791,7 +1779,6 @@ static CharDriverState *qemu_chr_open_udp(const char *def)
    chr->opaque = s;
    chr->chr_write = udp_chr_write;
    chr->chr_update_read_handler = udp_chr_update_read_handler;
-    chr->chr_close = udp_chr_close;
    return chr;

 return_err:
@@ -1994,14 +1981,10 @@ static void tcp_chr_accept(void *opaque)
 static void tcp_chr_close(CharDriverState *chr)
 {
    TCPCharDriver *s = chr->opaque;
-    if (s->fd >= 0) {
-        qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
+    if (s->fd >= 0)
        closesocket(s->fd);
-    }
-    if (s->listen_fd >= 0) {
-        qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
+    if (s->listen_fd >= 0)
        closesocket(s->listen_fd);
-    }
    qemu_free(s);
 }

--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -3413,6 +3413,16 @@ make install
@end example
 to install QEMU in @file{/usr/local}.

+@subsection GCC version
+
+In order to compile QEMU successfully, it is very important that you
+have the right tools. The most important one is gcc. On most hosts and
+in particular on x86 ones, @emph{gcc 4.x is not supported}. If your
+Linux distribution includes a gcc 4.x compiler, you can usually
+install an older version (it is invoked by @code{gcc32} or
+@code{gcc34}). The QEMU configure script automatically probes for
+these older versions so that usually you don't have to do anything.
+
@node Windows
@section Windows

--- a/qemu-img.c
+++ b/qemu-img.c
@@ -290,8 +290,6 @@ static int img_create(int argc, char **argv)
    if (ret < 0) {
        if (ret == -ENOTSUP) {
            error("Formatting or formatting option not supported for file format '%s'", fmt);
-        } else if (ret == -EFBIG) {
-            error("The image size is too large for file format '%s'", fmt);
        } else {
            error("Error while formatting");
        }
@@ -479,9 +477,7 @@ static int img_convert(int argc, char **argv)
    ret = bdrv_create(drv, out_filename, total_sectors, out_baseimg, flags);
    if (ret < 0) {
        if (ret == -ENOTSUP) {
-            error("Formatting not supported for file format '%s'", out_fmt);
-        } else if (ret == -EFBIG) {
-            error("The image size is too large for file format '%s'", out_fmt);
+            error("Formatting not supported for file format '%s'", fmt);
        } else {
            error("Error while formatting '%s'", out_filename);
        }
--- a/savevm.c
+++ b/savevm.c
@@ -103,46 +103,31 @@ static int announce_self_create(uint8_t *buf,

    /* FIXME: should we send a different packet (arp/rarp/ping)? */

-    memset(buf, 0, 64);
    memset(buf, 0xff, 6);         /* h_dst */
    memcpy(buf + 6, mac_addr, 6); /* h_src */
    memcpy(buf + 12, &proto, 2);  /* h_proto */
    memcpy(buf + 14, &magic, 4);  /* magic */

-    return 64; /* len */
+    return 18; /* len */
 }

-static void qemu_announce_self_once(void *opaque)
+void qemu_announce_self(void)
 {
-    int i, len;
+    int i, j, len;
    VLANState *vlan;
    VLANClientState *vc;
    uint8_t buf[256];
-    static int count = SELF_ANNOUNCE_ROUNDS;
-    QEMUTimer *timer = *(QEMUTimer **)opaque;

    for (i = 0; i < MAX_NICS; i++) {
        if (!nd_table[i].used)
            continue;
        len = announce_self_create(buf, nd_table[i].macaddr);
        vlan = nd_table[i].vlan;
-	for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
-            vc->fd_read(vc->opaque, buf, len);
+        for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
+            for (j=0; j < SELF_ANNOUNCE_ROUNDS; j++)
+                vc->fd_read(vc->opaque, buf, len);
        }
    }
-    if (count--) {
-	    qemu_mod_timer(timer, qemu_get_clock(rt_clock) + 100);
-    } else {
-	    qemu_del_timer(timer);
-	    qemu_free_timer(timer);
-    }
-}
-
-void qemu_announce_self(void)
-{
-	static QEMUTimer *timer;
-	timer = qemu_new_timer(rt_clock, qemu_announce_self_once, &timer);
-	qemu_announce_self_once(&timer);
 }

 /***********************************************************/
@@ -210,14 +195,7 @@ static int popen_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, int s
 static int popen_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
 {
    QEMUFilePopen *s = opaque;
-    FILE *fp = s->popen_file;
-    int bytes;
-
-    do {
-        clearerr(fp);
-        bytes = fread(buf, 1, size, fp);
-    } while ((bytes == 0) && ferror(fp) && (errno == EINTR));
-    return bytes;
+    return fread(buf, 1, size, s->popen_file);
 }

 static int popen_close(void *opaque)
@@ -246,6 +224,7 @@ QEMUFile *qemu_popen(FILE *popen_file, const char *mode)
    } else {
        s->file = qemu_fopen_ops(s, popen_put_buffer, NULL, popen_close, NULL);
    }
+    fprintf(stderr, "qemu_popen: returning result of qemu_fopen_ops\n");
    return s->file;
 }

@@ -261,17 +240,6 @@ QEMUFile *qemu_popen_cmd(const char *command, const char *mode)
    return qemu_popen(popen_file, mode);
 }

-int qemu_popen_fd(QEMUFile *f)
-{
-    QEMUFilePopen *p;
-    int fd;
-
-    p = (QEMUFilePopen *)f->opaque;
-    fd = fileno(p->popen_file);
-
-    return fd;
-}
-
 QEMUFile *qemu_fopen_socket(int fd)
 {
    QEMUFileSocket *s = qemu_mallocz(sizeof(QEMUFileSocket));
@@ -338,18 +306,18 @@ typedef struct QEMUFileBdrv
    int64_t base_offset;
 } QEMUFileBdrv;

-static int block_put_buffer(void *opaque, const uint8_t *buf,
+static int bdrv_put_buffer(void *opaque, const uint8_t *buf,
                           int64_t pos, int size)
 {
    QEMUFileBdrv *s = opaque;
-    bdrv_put_buffer(s->bs, buf, s->base_offset + pos, size);
+    bdrv_pwrite(s->bs, s->base_offset + pos, buf, size);
    return size;
 }

-static int block_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
+static int bdrv_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
 {
    QEMUFileBdrv *s = opaque;
-    return bdrv_get_buffer(s->bs, buf, s->base_offset + pos, size);
+    return bdrv_pread(s->bs, s->base_offset + pos, buf, size);
 }

 static int bdrv_fclose(void *opaque)
@@ -369,9 +337,9 @@ static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int64_t offset, int is_wr
    s->base_offset = offset;

    if (is_writable)
-        return qemu_fopen_ops(s, block_put_buffer, NULL, bdrv_fclose, NULL);
+        return qemu_fopen_ops(s, bdrv_put_buffer, NULL, bdrv_fclose, NULL);

-    return qemu_fopen_ops(s, NULL, block_get_buffer, bdrv_fclose, NULL);
+    return qemu_fopen_ops(s, NULL, bdrv_get_buffer, bdrv_fclose, NULL);
 }

 QEMUFile *qemu_fopen_ops(void *opaque, QEMUFilePutBufferFunc *put_buffer,
@@ -398,11 +366,6 @@ int qemu_file_has_error(QEMUFile *f)
    return f->has_error;
 }

-void qemu_file_set_error(QEMUFile *f)
-{
-    f->has_error = 1;
-}
-
 void qemu_fflush(QEMUFile *f)
 {
    if (!f->put_buffer)
@@ -675,22 +638,6 @@ int register_savevm(const char *idstr,
                                NULL, save_state, load_state, opaque);
 }

-void unregister_savevm(const char *idstr, void *opaque)
-{
-    SaveStateEntry **pse;
-
-    pse = &first_se;
-    while (*pse != NULL) {
-        if (strcmp((*pse)->idstr, idstr) == 0 && (*pse)->opaque == opaque) {
-            SaveStateEntry *next = (*pse)->next;
-            qemu_free(*pse);
-            *pse = next;
-            continue;
-        }
-        pse = &(*pse)->next;
-    }
-}
-
 #define QEMU_VM_FILE_MAGIC           0x5145564d
 #define QEMU_VM_FILE_VERSION_COMPAT  0x00000002
 #define QEMU_VM_FILE_VERSION         0x00000003
@@ -883,7 +830,6 @@ static int qemu_loadvm_state_v2(QEMUFile *f)
            if (ret < 0) {
                fprintf(stderr, "qemu: warning: error while loading state for instance 0x%x of device '%s'\n",
                        instance_id, idstr);
-                return ret;
            }
        }
        /* always seek to exact end of record */
--- a/sdl.c
+++ b/sdl.c
@@ -144,35 +144,32 @@ static uint8_t sdl_keyevent_to_keycode(const SDL_KeyboardEvent *ev)
 static int check_for_evdev(void)
 {
    SDL_SysWMinfo info;
-    XkbDescPtr desc = NULL;
+    XkbDescPtr desc;
    int has_evdev = 0;
-    char *keycodes = NULL;
+    const char *keycodes;

    SDL_VERSION(&info.version);
-    if (!SDL_GetWMInfo(&info)) {
+    if (!SDL_GetWMInfo(&info))
        return 0;
-    }
+
    desc = XkbGetKeyboard(info.info.x11.display,
                          XkbGBN_AllComponentsMask,
                          XkbUseCoreKbd);
-    if (desc && desc->names) {
-        keycodes = XGetAtomName(info.info.x11.display, desc->names->keycodes);
-        if (keycodes == NULL) {
-            fprintf(stderr, "could not lookup keycode name\n");
-        } else if (strstart(keycodes, "evdev", NULL)) {
-            has_evdev = 1;
-        } else if (!strstart(keycodes, "xfree86", NULL)) {
-            fprintf(stderr, "unknown keycodes `%s', please report to "
-                    "qemu-devel@nongnu.org\n", keycodes);
-        }
-    }
+    if (desc == NULL || desc->names == NULL)
+        return 0;
+
+    keycodes = XGetAtomName(info.info.x11.display, desc->names->keycodes);
+    if (keycodes == NULL)
+        fprintf(stderr, "could not lookup keycode name\n");
+    else if (strstart(keycodes, "evdev_", NULL))
+        has_evdev = 1;
+    else if (!strstart(keycodes, "xfree86_", NULL))
+        fprintf(stderr,
+                "unknown keycodes `%s', please report to qemu-devel@nongnu.org\n",
+                keycodes);
+
+    XkbFreeClientMap(desc, XkbGBN_AllComponentsMask, True);

-    if (desc) {
-        XkbFreeKeyboard(desc, XkbGBN_AllComponentsMask, True);
-    }
-    if (keycodes) {
-        XFree(keycodes);
-    }
    return has_evdev;
 }
 #else
--- a/sysemu.h
+++ b/sysemu.h
@@ -77,7 +77,6 @@ int tap_win32_init(VLANState *vlan, const char *model,
 /* SLIRP */
 void do_info_slirp(void);

-extern int autostart;
 extern int bios_size;
 extern int cirrus_vga_enabled;
 extern int std_vga_enabled;
--- a/tap-win32.c
+++ b/tap-win32.c
@@ -639,18 +639,6 @@ static int tap_win32_open(tap_win32_overlapped_t **phandle,
     tap_win32_overlapped_t *handle;
 } TAPState;

-static void tap_cleanup(VLANClientState *vc)
-{
-    TAPState *s = vc->opaque;
-
-    qemu_del_wait_object(s->handle->tap_semaphore, NULL, NULL);
-
-    /* FIXME: need to kill thread and close file handle:
-       tap_win32_close(s);
-    */
-    qemu_free(s);
-}
-
 static void tap_receive(void *opaque, const uint8_t *buf, int size)
 {
    TAPState *s = opaque;
@@ -685,8 +673,7 @@ int tap_win32_init(VLANState *vlan, const char *model,
        return -1;
    }

-    s->vc = qemu_new_vlan_client(vlan, model, name, tap_receive,
-                                 NULL, tap_cleanup, s);
+    s->vc = qemu_new_vlan_client(vlan, model, name, tap_receive, NULL, s);

    snprintf(s->vc->info_str, sizeof(s->vc->info_str),
             "tap: ifname=%s", ifname);
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -957,8 +957,7 @@ static void gen_tst_cc (DisasContext *dc, TCGv cc, int cond)
 				else if (dc->cc_size == 2)
 					bits = 15;	

-				tcg_gen_shri_tl(cc, cc_result, bits);
-				tcg_gen_andi_tl(cc, cc, 1);
+				tcg_gen_shri_tl(cc, cc_result, 31);
 			}
 			else {
 				cris_evaluate_flags(dc);
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -32,79 +32,61 @@

 //#define DEBUG_MMU

-/* feature flags taken from "Intel Processor Identification and the CPUID
- * Instruction" and AMD's "CPUID Specification". In cases of disagreement
- * about feature names, the Linux name is used. */
-static const char *feature_name[] = {
-    "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
-    "cx8", "apic", NULL, "sep", "mtrr", "pge", "mca", "cmov",
-    "pat", "pse36", "pn" /* Intel psn */, "clflush" /* Intel clfsh */, NULL, "ds" /* Intel dts */, "acpi", "mmx",
-    "fxsr", "sse", "sse2", "ss", "ht" /* Intel htt */, "tm", "ia64", "pbe",
-};
-static const char *ext_feature_name[] = {
-    "pni" /* Intel,AMD sse3 */, NULL, NULL, "monitor", "ds_cpl", "vmx", NULL /* Linux smx */, "est",
-    "tm2", "ssse3", "cid", NULL, NULL, "cx16", "xtpr", NULL,
-    NULL, NULL, "dca", NULL, NULL, NULL, NULL, "popcnt",
-       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-};
-static const char *ext2_feature_name[] = {
-    "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
-    "cx8" /* AMD CMPXCHG8B */, "apic", NULL, "syscall", "mtrr", "pge", "mca", "cmov",
-    "pat", "pse36", NULL, NULL /* Linux mp */, "nx" /* Intel xd */, NULL, "mmxext", "mmx",
-    "fxsr", "fxsr_opt" /* AMD ffxsr */, "pdpe1gb" /* AMD Page1GB */, "rdtscp", NULL, "lm" /* Intel 64 */, "3dnowext", "3dnow",
-};
-static const char *ext3_feature_name[] = {
-    "lahf_lm" /* AMD LahfSahf */, "cmp_legacy", "svm", "extapic" /* AMD ExtApicSpace */, "cr8legacy" /* AMD AltMovCr8 */, "abm", "sse4a", "misalignsse",
-    "3dnowprefetch", "osvw", NULL /* Linux ibs */, NULL, "skinit", "wdt", NULL, NULL,
-    NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-    NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-};
-
 static void add_flagname_to_bitmaps(char *flagname, uint32_t *features, 
                                    uint32_t *ext_features, 
                                    uint32_t *ext2_features, 
                                    uint32_t *ext3_features)
 {
    int i;
-    int found = 0;
+    /* feature flags taken from "Intel Processor Identification and the CPUID
+     * Instruction" and AMD's "CPUID Specification". In cases of disagreement 
+     * about feature names, the Linux name is used. */
+    static const char *feature_name[] = {
+        "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
+        "cx8", "apic", NULL, "sep", "mtrr", "pge", "mca", "cmov",
+        "pat", "pse36", "pn" /* Intel psn */, "clflush" /* Intel clfsh */, NULL, "ds" /* Intel dts */, "acpi", "mmx",
+        "fxsr", "sse", "sse2", "ss", "ht" /* Intel htt */, "tm", "ia64", "pbe",
+    };
+    static const char *ext_feature_name[] = {
+       "pni" /* Intel,AMD sse3 */, NULL, NULL, "monitor", "ds_cpl", "vmx", NULL /* Linux smx */, "est",
+       "tm2", "ssse3", "cid", NULL, NULL, "cx16", "xtpr", NULL,
+       NULL, NULL, "dca", NULL, NULL, NULL, NULL, "popcnt",
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+    };
+    static const char *ext2_feature_name[] = {
+       "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
+       "cx8" /* AMD CMPXCHG8B */, "apic", NULL, "syscall", "mtrr", "pge", "mca", "cmov",
+       "pat", "pse36", NULL, NULL /* Linux mp */, "nx" /* Intel xd */, NULL, "mmxext", "mmx",
+       "fxsr", "fxsr_opt" /* AMD ffxsr */, "pdpe1gb" /* AMD Page1GB */, "rdtscp", NULL, "lm" /* Intel 64 */, "3dnowext", "3dnow",
+    };
+    static const char *ext3_feature_name[] = {
+       "lahf_lm" /* AMD LahfSahf */, "cmp_legacy", "svm", "extapic" /* AMD ExtApicSpace */, "cr8legacy" /* AMD AltMovCr8 */, "abm", "sse4a", "misalignsse",
+       "3dnowprefetch", "osvw", NULL /* Linux ibs */, NULL, "skinit", "wdt", NULL, NULL,
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+    };

    for ( i = 0 ; i < 32 ; i++ ) 
        if (feature_name[i] && !strcmp (flagname, feature_name[i])) {
            *features |= 1 << i;
-            found = 1;
+            return;
        }
    for ( i = 0 ; i < 32 ; i++ ) 
        if (ext_feature_name[i] && !strcmp (flagname, ext_feature_name[i])) {
            *ext_features |= 1 << i;
-            found = 1;
+            return;
        }
    for ( i = 0 ; i < 32 ; i++ ) 
        if (ext2_feature_name[i] && !strcmp (flagname, ext2_feature_name[i])) {
            *ext2_features |= 1 << i;
-            found = 1;
+            return;
        }
    for ( i = 0 ; i < 32 ; i++ ) 
        if (ext3_feature_name[i] && !strcmp (flagname, ext3_feature_name[i])) {
            *ext3_features |= 1 << i;
-            found = 1;
+            return;
        }
-    if (!found) {
-        fprintf(stderr, "CPU feature %s not found\n", flagname);
-    }
-}
-
-static void kvm_trim_features(uint32_t *features, uint32_t supported,
-                              const char *names[])
-{
-    int i;
-    uint32_t mask;
-
-    for (i = 0; i < 32; ++i) {
-        mask = 1U << i;
-        if ((*features & mask) && !(supported & mask)) {
-            *features &= ~mask;
-        }
-    }
+    fprintf(stderr, "CPU feature %s not found\n", flagname);
 }

 typedef struct x86_def_t {
@@ -494,23 +476,17 @@ void cpu_reset(CPUX86State *env)
    env->tr.flags = DESC_P_MASK | (11 << DESC_TYPE_SHIFT);

    cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK |
-                           DESC_R_MASK | DESC_A_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | DESC_R_MASK);
    cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
    cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
    cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
    cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
    cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);

    env->eip = 0xfff0;
    env->regs[R_EDX] = env->cpuid_version;
@@ -1694,20 +1670,5 @@ CPUX86State *cpu_x86_init(const char *cpu_model)
 #endif
    if (kvm_enabled())
        kvm_init_vcpu(env);
-    if (kvm_enabled()) {
-        kvm_trim_features(&env->cpuid_features,
-                          kvm_arch_get_supported_cpuid(env, 1, R_EDX),
-                          feature_name);
-        kvm_trim_features(&env->cpuid_ext_features,
-                          kvm_arch_get_supported_cpuid(env, 1, R_ECX),
-                          ext_feature_name);
-        kvm_trim_features(&env->cpuid_ext2_features,
-                          kvm_arch_get_supported_cpuid(env, 0x80000001, R_EDX),
-                          ext2_feature_name);
-        kvm_trim_features(&env->cpuid_ext3_features,
-                          kvm_arch_get_supported_cpuid(env, 0x80000001, R_ECX),
-                          ext3_feature_name);
-    }
-
    return env;
 }
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -33,89 +33,6 @@
    do { } while (0)
 #endif

-#ifdef KVM_CAP_EXT_CPUID
-
-static struct kvm_cpuid2 *try_get_cpuid(KVMState *s, int max)
-{
-    struct kvm_cpuid2 *cpuid;
-    int r, size;
-
-    size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
-    cpuid = (struct kvm_cpuid2 *)qemu_mallocz(size);
-    cpuid->nent = max;
-    r = kvm_ioctl(s, KVM_GET_SUPPORTED_CPUID, cpuid);
-    if (r == 0 && cpuid->nent >= max) {
-        r = -E2BIG;
-    }
-    if (r < 0) {
-        if (r == -E2BIG) {
-            qemu_free(cpuid);
-            return NULL;
-        } else {
-            fprintf(stderr, "KVM_GET_SUPPORTED_CPUID failed: %s\n",
-                    strerror(-r));
-            exit(1);
-        }
-    }
-    return cpuid;
-}
-
-uint32_t kvm_arch_get_supported_cpuid(CPUState *env, uint32_t function, int reg)
-{
-    struct kvm_cpuid2 *cpuid;
-    int i, max;
-    uint32_t ret = 0;
-    uint32_t cpuid_1_edx;
-
-    if (!kvm_check_extension(env->kvm_state, KVM_CAP_EXT_CPUID)) {
-        return -1U;
-    }
-
-    max = 1;
-    while ((cpuid = try_get_cpuid(env->kvm_state, max)) == NULL) {
-        max *= 2;
-    }
-
-    for (i = 0; i < cpuid->nent; ++i) {
-        if (cpuid->entries[i].function == function) {
-            switch (reg) {
-            case R_EAX:
-                ret = cpuid->entries[i].eax;
-                break;
-            case R_EBX:
-                ret = cpuid->entries[i].ebx;
-                break;
-            case R_ECX:
-                ret = cpuid->entries[i].ecx;
-                break;
-            case R_EDX:
-                ret = cpuid->entries[i].edx;
-                if (function == 0x80000001) {
-                    /* On Intel, kvm returns cpuid according to the Intel spec,
-                     * so add missing bits according to the AMD spec:
-                     */
-                    cpuid_1_edx = kvm_arch_get_supported_cpuid(env, 1, R_EDX);
-                    ret |= cpuid_1_edx & 0xdfeff7ff;
-                }
-                break;
-            }
-        }
-    }
-
-    qemu_free(cpuid);
-
-    return ret;
-}
-
-#else
-
-uint32_t kvm_arch_get_supported_cpuid(CPUState *env, uint32_t function, int reg)
-{
-    return -1U;
-}
-
-#endif
-
 int kvm_arch_init_vcpu(CPUState *env)
 {
    struct {
@@ -123,11 +40,12 @@ int kvm_arch_init_vcpu(CPUState *env)
        struct kvm_cpuid_entry2 entries[100];
    } __attribute__((packed)) cpuid_data;
    uint32_t limit, i, j, cpuid_i;
-    uint32_t unused;
+    uint32_t eax, ebx, ecx, edx;

    cpuid_i = 0;

-    cpu_x86_cpuid(env, 0, 0, &limit, &unused, &unused, &unused);
+    cpu_x86_cpuid(env, 0, 0, &eax, &ebx, &ecx, &edx);
+    limit = eax;

    for (i = 0; i <= limit; i++) {
        struct kvm_cpuid_entry2 *c = &cpuid_data.entries[cpuid_i++];
@@ -137,17 +55,26 @@ int kvm_arch_init_vcpu(CPUState *env)
            /* Keep reading function 2 till all the input is received */
            int times;

+            cpu_x86_cpuid(env, i, 0, &eax, &ebx, &ecx, &edx);
+            times = eax & 0xff;
+
            c->function = i;
-            c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC |
-                       KVM_CPUID_FLAG_STATE_READ_NEXT;
-            cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
-            times = c->eax & 0xff;
+            c->flags |= KVM_CPUID_FLAG_STATEFUL_FUNC;
+            c->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
+            c->eax = eax;
+            c->ebx = ebx;
+            c->ecx = ecx;
+            c->edx = edx;

            for (j = 1; j < times; ++j) {
-                c = &cpuid_data.entries[cpuid_i++];
+                cpu_x86_cpuid(env, i, 0, &eax, &ebx, &ecx, &edx);
                c->function = i;
-                c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC;
-                cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
+                c->flags |= KVM_CPUID_FLAG_STATEFUL_FUNC;
+                c->eax = eax;
+                c->ebx = ebx;
+                c->ecx = ecx;
+                c->edx = edx;
+                c = &cpuid_data.entries[++cpuid_i];
            }
            break;
        }
@@ -155,36 +82,46 @@ int kvm_arch_init_vcpu(CPUState *env)
        case 0xb:
        case 0xd:
            for (j = 0; ; j++) {
+                cpu_x86_cpuid(env, i, j, &eax, &ebx, &ecx, &edx);
                c->function = i;
                c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
                c->index = j;
-                cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
+                c->eax = eax;
+                c->ebx = ebx;
+                c->ecx = ecx;
+                c->edx = edx;
+                c = &cpuid_data.entries[++cpuid_i];

-                if (i == 4 && c->eax == 0)
+                if (i == 4 && eax == 0)
                    break;
-                if (i == 0xb && !(c->ecx & 0xff00))
+                if (i == 0xb && !(ecx & 0xff00))
                    break;
-                if (i == 0xd && c->eax == 0)
+                if (i == 0xd && eax == 0)
                    break;
-
-                c = &cpuid_data.entries[cpuid_i++];
            }
            break;
        default:
+            cpu_x86_cpuid(env, i, 0, &eax, &ebx, &ecx, &edx);
            c->function = i;
-            c->flags = 0;
-            cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
+            c->eax = eax;
+            c->ebx = ebx;
+            c->ecx = ecx;
+            c->edx = edx;
            break;
        }
    }
-    cpu_x86_cpuid(env, 0x80000000, 0, &limit, &unused, &unused, &unused);
+    cpu_x86_cpuid(env, 0x80000000, 0, &eax, &ebx, &ecx, &edx);
+    limit = eax;

    for (i = 0x80000000; i <= limit; i++) {
        struct kvm_cpuid_entry2 *c = &cpuid_data.entries[cpuid_i++];

+        cpu_x86_cpuid(env, i, 0, &eax, &ebx, &ecx, &edx);
        c->function = i;
-        c->flags = 0;
-        cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
+        c->eax = eax;
+        c->ebx = ebx;
+        c->ecx = ecx;
+        c->edx = edx;
    }

    cpuid_data.cpuid.nent = cpuid_i;
--- a/vl.c
+++ b/vl.c
@@ -201,7 +201,7 @@ ram_addr_t ram_size;
 int nb_nics;
 NICInfo nd_table[MAX_NICS];
 int vm_running;
-int autostart;
+static int autostart;
 static int rtc_utc = 1;
 static int rtc_date_offset = -1; /* -1 means no change */
 int cirrus_vga_enabled = 1;
@@ -894,7 +894,7 @@ struct qemu_alarm_timer {

 static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
 {
-    return t && (t->flags & ALARM_FLAG_DYNTICKS);
+    return t->flags & ALARM_FLAG_DYNTICKS;
 }

 static void qemu_rearm_alarm_timer(struct qemu_alarm_timer *t)
@@ -1338,7 +1338,7 @@ static void host_alarm_handler(int host_signum)
        static const char byte = 0;
        write(alarm_timer_wfd, &byte, sizeof(byte));
 #endif
-        if (alarm_timer) alarm_timer->flags |= ALARM_FLAG_EXPIRED;
+        alarm_timer->flags |= ALARM_FLAG_EXPIRED;

        if (env) {
            /* stop the currently executing cpu because a timer occured */
@@ -1528,11 +1528,6 @@ static int dynticks_start_timer(struct qemu_alarm_timer *t)

    sigaction(SIGALRM, &act, NULL);

-    /* 
-     * Initialize ev struct to 0 to avoid valgrind complaining
-     * about uninitialized data in timer_create call
-     */
-    memset(&ev, 0, sizeof(ev));
    ev.sigev_value.sival_int = 0;
    ev.sigev_notify = SIGEV_SIGNAL;
    ev.sigev_signo = SIGALRM;
@@ -2571,7 +2566,7 @@ int drive_init(struct drive_opt *arg, int snapshot, void *opaque)
    drives_table[drives_table_idx].unit = unit_id;
    drives_table[drives_table_idx].onerror = onerror;
    drives_table[drives_table_idx].drive_opt_idx = arg - drives_opt;
-    strncpy(drives_table[drives_table_idx].serial, serial, sizeof(serial));
+    strncpy(drives_table[nb_drives].serial, serial, sizeof(serial));
    nb_drives++;

    switch(type) {
@@ -3225,10 +3220,10 @@ static int ram_save_live(QEMUFile *f, int stage, void *opaque)
    /* try transferring iterative blocks of memory */

    if (stage == 3) {
+        cpu_physical_memory_set_dirty_tracking(0);

        /* flush all remaining blocks regardless of rate limiting */
        while (ram_save_block(f) != 0);
-        cpu_physical_memory_set_dirty_tracking(0);
    }

    qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
@@ -4249,7 +4244,9 @@ static const QEMUOption qemu_options[] = {
    { "boot", HAS_ARG, QEMU_OPTION_boot },
    { "snapshot", 0, QEMU_OPTION_snapshot },
    { "m", HAS_ARG, QEMU_OPTION_m },
+#ifndef _WIN32
    { "k", HAS_ARG, QEMU_OPTION_k },
+#endif
 #ifdef HAS_AUDIO
    { "audio-help", 0, QEMU_OPTION_audio_help },
    { "soundhw", HAS_ARG, QEMU_OPTION_soundhw },
@@ -5490,7 +5487,6 @@ int main(int argc, char **argv, char **envp)
    cpu_exec_init_all(tb_size * 1024 * 1024);

    bdrv_init();
-    dma_helper_init();

    /* we always create the cdrom drive, even if no disk is there */

@@ -5722,11 +5718,11 @@ int main(int argc, char **argv, char **envp)
        do_loadvm(loadvm);

    if (incoming) {
-        autostart = 0;
+        autostart = 0; /* fixme how to deal with -daemonize */
        qemu_start_incoming_migration(incoming);
    }

-    else if (autostart)
+    if (autostart)
        vm_start();

    if (daemonize) {
--- a/vnc.c
+++ b/vnc.c
@@ -200,8 +200,6 @@ static void vnc_write_u16(VncState *vs, uint16_t value);
 static void vnc_write_u8(VncState *vs, uint8_t value);
 static void vnc_flush(VncState *vs);
 static void vnc_update_client(void *opaque);
-static void vnc_disconnect_start(VncState *vs);
-static void vnc_disconnect_finish(VncState *vs);
 static void vnc_client_read(void *opaque);

 static void vnc_colordepth(VncState *vs);
@@ -635,14 +633,8 @@ static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)

 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
 {
-
-    uint8_t *src_row;
-    uint8_t *dst_row;
-    int y,pitch,depth;
-
    vnc_update_client(vs);

-    /* send bitblit op to the vnc client */
    vnc_write_u8(vs, 0);  /* msg id */
    vnc_write_u8(vs, 0);
    vnc_write_u16(vs, 1); /* number of rects */
@@ -650,43 +642,18 @@ static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, i
    vnc_write_u16(vs, src_x);
    vnc_write_u16(vs, src_y);
    vnc_flush(vs);
-
-    /* do bitblit op on the local surface too */
-    pitch = ds_get_linesize(vs->ds);
-    depth = ds_get_bytes_per_pixel(vs->ds);
-    src_row = ds_get_data(vs->ds) + pitch * src_y + depth * src_x;
-    dst_row = ds_get_data(vs->ds) + pitch * dst_y + depth * dst_x;
-    if (dst_y > src_y) {
-        /* copy backwards */
-        src_row += pitch * (h-1);
-        dst_row += pitch * (h-1);
-        pitch = -pitch;
-    }
-    for (y = 0; y < h; y++) {
-        memmove(dst_row, src_row, w * depth);
-        src_row += pitch;
-        dst_row += pitch;
-    }
 }

 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
 {
    VncDisplay *vd = ds->opaque;
-    VncState *vs, *vn;
-
-    for (vs = vd->clients; vs != NULL; vs = vn) {
-        vn = vs->next;
-        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
-            vnc_update_client(vs);
-            /* vs might be free()ed here */
-        }
-    }
-
-    for (vs = vd->clients; vs != NULL; vs = vs->next) {
+    VncState *vs = vd->clients;
+    while (vs != NULL) {
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
        else /* TODO */
            vnc_update(vs, dst_x, dst_y, w, h);
+        vs = vs->next;
    }
 }

@@ -796,8 +763,6 @@ static void vnc_update_client(void *opaque)

    if (vs->csock != -1) {
        qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
-    } else {
-        vnc_disconnect_finish(vs);
    }

 }
@@ -867,47 +832,6 @@ static void audio_del(VncState *vs)
    }
 }

-static void vnc_disconnect_start(VncState *vs)
-{
-    if (vs->csock == -1)
-        return;
-    qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
-    closesocket(vs->csock);
-    vs->csock = -1;
-}
-
-static void vnc_disconnect_finish(VncState *vs)
-{
-    qemu_del_timer(vs->timer);
-    qemu_free_timer(vs->timer);
-    if (vs->input.buffer) qemu_free(vs->input.buffer);
-    if (vs->output.buffer) qemu_free(vs->output.buffer);
-#ifdef CONFIG_VNC_TLS
-    if (vs->tls_session) {
-        gnutls_deinit(vs->tls_session);
-        vs->tls_session = NULL;
-    }
-#endif /* CONFIG_VNC_TLS */
-    audio_del(vs);
-
-    VncState *p, *parent = NULL;
-    for (p = vs->vd->clients; p != NULL; p = p->next) {
-        if (p == vs) {
-            if (parent)
-                parent->next = p->next;
-            else
-                vs->vd->clients = p->next;
-            break;
-        }
-        parent = p;
-    }
-    if (!vs->vd->clients)
-        dcl->idle = 1;
-
-    qemu_free(vs->old_data);
-    qemu_free(vs);
-}
-
 static int vnc_client_io_error(VncState *vs, int ret, int last_errno)
 {
    if (ret == 0 || ret == -1) {
@@ -925,7 +849,36 @@ static int vnc_client_io_error(VncState *vs, int ret, int last_errno)
        }

 	VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
-        vnc_disconnect_start(vs);
+	qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
+	closesocket(vs->csock);
+        qemu_del_timer(vs->timer);
+        qemu_free_timer(vs->timer);
+        if (vs->input.buffer) qemu_free(vs->input.buffer);
+        if (vs->output.buffer) qemu_free(vs->output.buffer);
+#ifdef CONFIG_VNC_TLS
+	if (vs->tls_session) {
+	    gnutls_deinit(vs->tls_session);
+	    vs->tls_session = NULL;
+	}
+#endif /* CONFIG_VNC_TLS */
+        audio_del(vs);
+
+        VncState *p, *parent = NULL;
+        for (p = vs->vd->clients; p != NULL; p = p->next) {
+            if (p == vs) {
+                if (parent)
+                    parent->next = p->next;
+                else
+                    vs->vd->clients = p->next;
+                break;
+            }
+            parent = p;
+        }
+        if (!vs->vd->clients)
+            dcl->idle = 1;
+
+        qemu_free(vs->old_data);
+        qemu_free(vs);
  
 	return 0;
    }
@@ -934,8 +887,7 @@ static int vnc_client_io_error(VncState *vs, int ret, int last_errno)

 static void vnc_client_error(VncState *vs)
 {
-    VNC_DEBUG("Closing down client sock: protocol error\n");
-    vnc_disconnect_start(vs);
+    vnc_client_io_error(vs, -1, EINVAL);
 }

 static void vnc_client_write(void *opaque)
@@ -995,11 +947,8 @@ static void vnc_client_read(void *opaque)
 #endif /* CONFIG_VNC_TLS */
 	ret = recv(vs->csock, buffer_end(&vs->input), 4096, 0);
    ret = vnc_client_io_error(vs, ret, socket_error());
-    if (!ret) {
-        if (vs->csock == -1)
-            vnc_disconnect_finish(vs);
+    if (!ret)
 	return;
-    }

    vs->input.offset += ret;

@@ -1008,10 +957,8 @@ static void vnc_client_read(void *opaque)
 	int ret;

 	ret = vs->read_handler(vs, vs->input.buffer, len);
-	if (vs->csock == -1) {
-            vnc_disconnect_finish(vs);
+	if (vs->csock == -1)
 	    return;
-        }

 	if (!ret) {
 	    memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
@@ -1026,7 +973,7 @@ static void vnc_write(VncState *vs, const void *data, size_t len)
 {
    buffer_reserve(&vs->output, len);

-    if (vs->csock != -1 && buffer_empty(&vs->output)) {
+    if (buffer_empty(&vs->output)) {
 	qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
    }

@@ -1067,7 +1014,7 @@ static void vnc_write_u8(VncState *vs, uint8_t value)

 static void vnc_flush(VncState *vs)
 {
-    if (vs->csock != -1 && vs->output.offset)
+    if (vs->output.offset)
 	vnc_client_write(vs);
 }

@@ -1269,39 +1216,30 @@ static void do_key_event(VncState *vs, int down, int keycode, int sym)
            case 0xb8:                          /* Right ALT */
                break;
            case 0xc8:
-            case 0x48:
                kbd_put_keysym(QEMU_KEY_UP);
                break;
            case 0xd0:
-            case 0x50:
                kbd_put_keysym(QEMU_KEY_DOWN);
                break;
            case 0xcb:
-            case 0x4b:
                kbd_put_keysym(QEMU_KEY_LEFT);
                break;
            case 0xcd:
-            case 0x4d:
                kbd_put_keysym(QEMU_KEY_RIGHT);
                break;
            case 0xd3:
-            case 0x53:
                kbd_put_keysym(QEMU_KEY_DELETE);
                break;
            case 0xc7:
-            case 0x47:
                kbd_put_keysym(QEMU_KEY_HOME);
                break;
            case 0xcf:
-            case 0x4f:
                kbd_put_keysym(QEMU_KEY_END);
                break;
            case 0xc9:
-            case 0x49:
                kbd_put_keysym(QEMU_KEY_PAGEUP);
                break;
            case 0xd1:
-            case 0x51:
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
                break;
            default:
@@ -2335,13 +2273,11 @@ static void vnc_connect(VncDisplay *vd, int csock)
    vnc_read_when(vs, protocol_version, 12);
    memset(vs->old_data, 0, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
+    vnc_update_client(vs);
    reset_keys(vs);

    vs->next = vd->clients;
    vd->clients = vs;
-
-    vnc_update_client(vs);
-    /* vs might be free()ed here */
 }

 static void vnc_listen_read(void *opaque)
@@ -2361,8 +2297,9 @@ static void vnc_listen_read(void *opaque)

 void vnc_display_init(DisplayState *ds)
 {
-    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
+    VncDisplay *vs;

+    vs = qemu_mallocz(sizeof(VncState));
    dcl = qemu_mallocz(sizeof(DisplayChangeListener));

    ds->opaque = vs;
@@ -2470,10 +2407,6 @@ int vnc_display_password(DisplayState *ds, const char *password)
 {
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;

-    if (!vs) {
-        return -1;
-    }
-
    if (vs->password) {
 	qemu_free(vs->password);
 	vs->password = NULL;
@@ -1 +1 @@
 .10.6
 .10.1