Merge branch 'master' of git://git.sv.gnu.org/qemu

* 'master' of git://git.sv.gnu.org/qemu: (37 commits)
  Incorporate changes from v2 of Gleb's RTC reset patch
  etrax: Don't pass CPUState to peripherals.
  Fix warning in qemu-nbd.c
  raw-posix: cleanup ioctl methods
  block: add bdrv_probe_device method
  raw-posix: split hdev drivers
  raw-posix: add a raw_open_common helper
  raw-posix: always store open flags
  fix qemu_aio_flush
  Add rtc reset function.
  migrate_fd_close: delete associated io-handler before closing the fd
  exec-migration: handle EINTR in popen_get_buffer()
  Fix prototype of function zfree.
  Add static to local machine declaration.
  Don't use cpu_index as apic_id.
  Apic creation should not depend on pci
  Add -no-virtio-balloon command-line option
  Fix SDL include path.
  Really enable -Werror
  Avoid collision with system NGROUPS definition
  ...

Conflicts:
	hw/apic.c
	hw/pc.c
	hw/pc.h

Signed-off-by: Avi Kivity <avi@redhat.com>

69 files changed, 743 insertions, 527 deletions

diff --git a/aio.c b/aio.c
index 11fbb6c0c..dc9b85d16 100644
--- a/aio.c
+++ b/aio.c
@@ -103,11 +103,15 @@ void qemu_aio_flush(void)
     do {
         ret = 0;
 
+	/*
+	 * If there are pending emulated aio start them now so flush
+	 * will be able to return 1.
+	 */
+        qemu_aio_wait();
+
         LIST_FOREACH(node, &aio_handlers, node) {
             ret |= node->io_flush(node->opaque);
         }
-
-        qemu_aio_wait();
     } while (ret > 0);
 }
 
diff --git a/block.c b/block.c
index e6b91c60a..c7e0dcbc5 100644
--- a/block.c
+++ b/block.c
@@ -209,7 +209,7 @@ static int is_windows_drive_prefix(const char *filename)
             filename[1] == ':');
 }
 
-static int is_windows_drive(const char *filename)
+int is_windows_drive(const char *filename)
 {
     if (is_windows_drive_prefix(filename) &&
         filename[2] == '\0')
@@ -249,8 +249,28 @@ static BlockDriver *find_protocol(const char *filename)
     return NULL;
 }
 
-/* XXX: force raw format if block or character device ? It would
-   simplify the BSD case */
+/*
+ * Detect host devices. By convention, /dev/cdrom[N] is always
+ * recognized as a host CDROM.
+ */
+static BlockDriver *find_hdev_driver(const char *filename)
+{
+    int score_max = 0, score;
+    BlockDriver *drv = NULL, *d;
+
+    for (d = first_drv; d; d = d->next) {
+        if (d->bdrv_probe_device) {
+            score = d->bdrv_probe_device(filename);
+            if (score > score_max) {
+                score_max = score;
+                drv = d;
+            }
+        }
+    }
+
+    return drv;
+}
+
 static BlockDriver *find_image_format(const char *filename)
 {
     int ret, score, score_max;
@@ -258,23 +278,6 @@ static BlockDriver *find_image_format(const char *filename)
     uint8_t buf[2048];
     BlockDriverState *bs;
 
-    /* detect host devices. By convention, /dev/cdrom[N] is always
-       recognized as a host CDROM */
-    if (strstart(filename, "/dev/cdrom", NULL))
-        return bdrv_find_format("host_device");
-#ifdef _WIN32
-    if (is_windows_drive(filename))
-        return bdrv_find_format("host_device");
-#else
-    {
-        struct stat st;
-        if (stat(filename, &st) >= 0 &&
-            (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode))) {
-            return bdrv_find_format("host_device");
-        }
-    }
-#endif
-
     drv = find_protocol(filename);
     /* no need to test disk image formats for vvfat */
     if (drv && strcmp(drv->format_name, "vvfat") == 0)
@@ -394,7 +397,10 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
     if (flags & BDRV_O_FILE) {
         drv = find_protocol(filename);
     } else if (!drv) {
-        drv = find_image_format(filename);
+        drv = find_hdev_driver(filename);
+        if (!drv) {
+            drv = find_image_format(filename);
+        }
     }
     if (!drv) {
         ret = -ENOENT;
diff --git a/block/raw-posix.c b/block/raw-posix.c
index 848aff054..1ed8d5be3 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -105,17 +105,14 @@ typedef struct BDRVRawState {
     int fd;
     int type;
     unsigned int lseek_err_cnt;
+    int open_flags;
 #if defined(__linux__)
     /* linux floppy specific */
-    int fd_open_flags;
     int64_t fd_open_time;
     int64_t fd_error_time;
     int fd_got_error;
     int fd_media_changed;
 #endif
-#if defined(__FreeBSD__)
-    int cd_open_flags;
-#endif
     uint8_t* aligned_buf;
 } BDRVRawState;
 
@@ -124,40 +121,36 @@ static int posix_aio_init(void);
 static int fd_open(BlockDriverState *bs);
 
 #if defined(__FreeBSD__)
-static int cd_open(BlockDriverState *bs);
+static int cdrom_reopen(BlockDriverState *bs);
 #endif
 
-static int raw_is_inserted(BlockDriverState *bs);
-
-static int raw_open(BlockDriverState *bs, const char *filename, int flags)
+static int raw_open_common(BlockDriverState *bs, const char *filename,
+        int flags)
 {
     BDRVRawState *s = bs->opaque;
-    int fd, open_flags, ret;
+    int fd, ret;
 
     posix_aio_init();
 
     s->lseek_err_cnt = 0;
 
-    open_flags = O_BINARY;
+    s->open_flags |= O_BINARY;
     if ((flags & BDRV_O_ACCESS) == O_RDWR) {
-        open_flags |= O_RDWR;
+        s->open_flags |= O_RDWR;
     } else {
-        open_flags |= O_RDONLY;
+        s->open_flags |= O_RDONLY;
         bs->read_only = 1;
     }
-    if (flags & BDRV_O_CREAT)
-        open_flags |= O_CREAT | O_TRUNC;
 
     /* Use O_DSYNC for write-through caching, no flags for write-back caching,
      * and O_DIRECT for no caching. */
     if ((flags & BDRV_O_NOCACHE))
-        open_flags |= O_DIRECT;
+        s->open_flags |= O_DIRECT;
     else if (!(flags & BDRV_O_CACHE_WB))
-        open_flags |= O_DSYNC;
+        s->open_flags |= O_DSYNC;
 
-    s->type = FTYPE_FILE;
-
-    fd = open(filename, open_flags, 0644);
+    s->fd = -1;
+    fd = open(filename, s->open_flags, 0644);
     if (fd < 0) {
         ret = -errno;
         if (ret == -EROFS)
@@ -177,6 +170,17 @@ static int raw_open(BlockDriverState *bs, const char *filename, int flags)
     return 0;
 }
 
+static int raw_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+
+    s->type = FTYPE_FILE;
+    if (flags & BDRV_O_CREAT)
+        s->open_flags |= O_CREAT | O_TRUNC;
+
+    return raw_open_common(bs, filename, flags);
+}
+
 /* XXX: use host sector size if necessary with:
 #ifdef DIOCGSECTORSIZE
         {
@@ -800,7 +804,7 @@ again:
             if (size == 2048LL * (unsigned)-1)
                 size = 0;
             /* XXX no disc?  maybe we need to reopen... */
-            if (size <= 0 && !reopened && cd_open(bs) >= 0) {
+            if (size <= 0 && !reopened && cdrom_reopen(bs) >= 0) {
                 reopened = 1;
                 goto again;
             }
@@ -947,12 +951,25 @@ kern_return_t GetBSDPath( io_iterator_t mediaIterator, char *bsdPath, CFIndex ma
 
 #endif
 
+static int hdev_probe_device(const char *filename)
+{
+    struct stat st;
+
+    /* allow a dedicated CD-ROM driver to match with a higher priority */
+    if (strstart(filename, "/dev/cdrom", NULL))
+        return 50;
+
+    if (stat(filename, &st) >= 0 &&
+            (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode))) {
+        return 100;
+    }
+
+    return 0;
+}
+
 static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVRawState *s = bs->opaque;
-    int fd, open_flags, ret;
-
-    posix_aio_init();
 
 #ifdef CONFIG_COCOA
     if (strstart(filename, "/dev/cdrom", NULL)) {
@@ -980,67 +997,15 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
             IOObjectRelease( mediaIterator );
     }
 #endif
-    open_flags = O_BINARY;
-    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
-        open_flags |= O_RDWR;
-    } else {
-        open_flags |= O_RDONLY;
-        bs->read_only = 1;
-    }
-    /* Use O_DSYNC for write-through caching, no flags for write-back caching,
-     * and O_DIRECT for no caching. */
-    if ((flags & BDRV_O_NOCACHE))
-        open_flags |= O_DIRECT;
-    else if (!(flags & BDRV_O_CACHE_WB))
-        open_flags |= O_DSYNC;
 
     s->type = FTYPE_FILE;
-#if defined(__linux__)
-    if (strstart(filename, "/dev/cd", NULL)) {
-        /* open will not fail even if no CD is inserted */
-        open_flags |= O_NONBLOCK;
-        s->type = FTYPE_CD;
-    } else if (strstart(filename, "/dev/fd", NULL)) {
-        s->type = FTYPE_FD;
-        s->fd_open_flags = open_flags;
-        /* open will not fail even if no floppy is inserted */
-        open_flags |= O_NONBLOCK;
-#ifdef CONFIG_AIO
-    } else if (strstart(filename, "/dev/sg", NULL)) {
+#if defined(__linux__) && defined(CONFIG_AIO)
+    if (strstart(filename, "/dev/sg", NULL)) {
         bs->sg = 1;
-#endif
-    }
-#endif
-#if defined(__FreeBSD__)
-    if (strstart(filename, "/dev/cd", NULL) ||
-        strstart(filename, "/dev/acd", NULL)) {
-        s->type = FTYPE_CD;
-        s->cd_open_flags = open_flags;
     }
 #endif
-    s->fd = -1;
-    fd = open(filename, open_flags, 0644);
-    if (fd < 0) {
-        ret = -errno;
-        if (ret == -EROFS)
-            ret = -EACCES;
-        return ret;
-    }
-    s->fd = fd;
-#if defined(__FreeBSD__)
-    /* make sure the door isnt locked at this time */
-    if (s->type == FTYPE_CD)
-        ioctl (s->fd, CDIOCALLOW);
-#endif
-#if defined(__linux__)
-    /* close fd so that we can reopen it as needed */
-    if (s->type == FTYPE_FD) {
-        close(s->fd);
-        s->fd = -1;
-        s->fd_media_changed = 1;
-    }
-#endif
-    return 0;
+
+    return raw_open_common(bs, filename, flags);
 }
 
 #if defined(__linux__)
@@ -1071,7 +1036,7 @@ static int fd_open(BlockDriverState *bs)
 #endif
             return -EIO;
         }
-        s->fd = open(bs->filename, s->fd_open_flags);
+        s->fd = open(bs->filename, s->open_flags & ~O_NONBLOCK);
         if (s->fd < 0) {
             s->fd_error_time = qemu_get_clock(rt_clock);
             s->fd_got_error = 1;
@@ -1093,106 +1058,7 @@ static int fd_open(BlockDriverState *bs)
     return 0;
 }
 
-static int raw_is_inserted(BlockDriverState *bs)
-{
-    BDRVRawState *s = bs->opaque;
-    int ret;
-
-    switch(s->type) {
-    case FTYPE_CD:
-        ret = ioctl(s->fd, CDROM_DRIVE_STATUS, CDSL_CURRENT);
-        if (ret == CDS_DISC_OK)
-            return 1;
-        else
-            return 0;
-        break;
-    case FTYPE_FD:
-        ret = fd_open(bs);
-        return (ret >= 0);
-    default:
-        return 1;
-    }
-}
-
-/* currently only used by fdc.c, but a CD version would be good too */
-static int raw_media_changed(BlockDriverState *bs)
-{
-    BDRVRawState *s = bs->opaque;
-
-    switch(s->type) {
-    case FTYPE_FD:
-        {
-            int ret;
-            /* XXX: we do not have a true media changed indication. It
-               does not work if the floppy is changed without trying
-               to read it */
-            fd_open(bs);
-            ret = s->fd_media_changed;
-            s->fd_media_changed = 0;
-#ifdef DEBUG_FLOPPY
-            printf("Floppy changed=%d\n", ret);
-#endif
-            return ret;
-        }
-    default:
-        return -ENOTSUP;
-    }
-}
-
-static int raw_eject(BlockDriverState *bs, int eject_flag)
-{
-    BDRVRawState *s = bs->opaque;
-
-    switch(s->type) {
-    case FTYPE_CD:
-        if (eject_flag) {
-            if (ioctl (s->fd, CDROMEJECT, NULL) < 0)
-                perror("CDROMEJECT");
-        } else {
-            if (ioctl (s->fd, CDROMCLOSETRAY, NULL) < 0)
-                perror("CDROMEJECT");
-        }
-        break;
-    case FTYPE_FD:
-        {
-            int fd;
-            if (s->fd >= 0) {
-                close(s->fd);
-                s->fd = -1;
-            }
-            fd = open(bs->filename, s->fd_open_flags | O_NONBLOCK);
-            if (fd >= 0) {
-                if (ioctl(fd, FDEJECT, 0) < 0)
-                    perror("FDEJECT");
-                close(fd);
-            }
-        }
-        break;
-    default:
-        return -ENOTSUP;
-    }
-    return 0;
-}
-
-static int raw_set_locked(BlockDriverState *bs, int locked)
-{
-    BDRVRawState *s = bs->opaque;
-
-    switch(s->type) {
-    case FTYPE_CD:
-        if (ioctl (s->fd, CDROM_LOCKDOOR, locked) < 0) {
-            /* Note: an error can happen if the distribution automatically
-               mounts the CD-ROM */
-            //        perror("CDROM_LOCKDOOR");
-        }
-        break;
-    default:
-        return -ENOTSUP;
-    }
-    return 0;
-}
-
-static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+static int hdev_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
 {
     BDRVRawState *s = bs->opaque;
 
@@ -1200,7 +1066,7 @@ static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
 }
 
 #ifdef CONFIG_AIO
-static BlockDriverAIOCB *raw_aio_ioctl(BlockDriverState *bs,
+static BlockDriverAIOCB *hdev_aio_ioctl(BlockDriverState *bs,
         unsigned long int req, void *buf,
         BlockDriverCompletionFunc *cb, void *opaque)
 {
@@ -1233,7 +1099,6 @@ static BlockDriverAIOCB *raw_aio_ioctl(BlockDriverState *bs,
 #endif
 
 #elif defined(__FreeBSD__)
-
 static int fd_open(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
@@ -1243,207 +1108,392 @@ static int fd_open(BlockDriverState *bs)
         return 0;
     return -EIO;
 }
+#else /* !linux && !FreeBSD */
 
-static int cd_open(BlockDriverState *bs)
+static int fd_open(BlockDriverState *bs)
+{
+    return 0;
+}
+
+#endif /* !linux && !FreeBSD */
+
+static int hdev_create(const char *filename, QEMUOptionParameter *options)
 {
-#if defined(__FreeBSD__)
-    BDRVRawState *s = bs->opaque;
     int fd;
+    int ret = 0;
+    struct stat stat_buf;
+    int64_t total_size = 0;
 
-    switch(s->type) {
-    case FTYPE_CD:
-        /* XXX force reread of possibly changed/newly loaded disc,
-         * FreeBSD seems to not notice sometimes... */
-        if (s->fd >= 0)
-            close (s->fd);
-        fd = open(bs->filename, s->cd_open_flags, 0644);
-        if (fd < 0) {
-            s->fd = -1;
-            return -EIO;
+    /* Read out options */
+    while (options && options->name) {
+        if (!strcmp(options->name, "size")) {
+            total_size = options->value.n / 512;
         }
-        s->fd = fd;
-        /* make sure the door isnt locked at this time */
-        ioctl (s->fd, CDIOCALLOW);
+        options++;
     }
+
+    fd = open(filename, O_WRONLY | O_BINARY);
+    if (fd < 0)
+        return -EIO;
+
+    if (fstat(fd, &stat_buf) < 0)
+        ret = -EIO;
+    else if (!S_ISBLK(stat_buf.st_mode) && !S_ISCHR(stat_buf.st_mode))
+        ret = -EIO;
+    else if (lseek(fd, 0, SEEK_END) < total_size * 512)
+        ret = -ENOSPC;
+
+    close(fd);
+    return ret;
+}
+
+static BlockDriver bdrv_host_device = {
+    .format_name	= "host_device",
+    .instance_size	= sizeof(BDRVRawState),
+    .bdrv_probe_device	= hdev_probe_device,
+    .bdrv_open		= hdev_open,
+    .bdrv_close		= raw_close,
+    .bdrv_create        = hdev_create,
+    .bdrv_flush		= raw_flush,
+
+#ifdef CONFIG_AIO
+    .bdrv_aio_readv	= raw_aio_readv,
+    .bdrv_aio_writev	= raw_aio_writev,
 #endif
+
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
+    .bdrv_getlength	= raw_getlength,
+
+    /* generic scsi device */
+#ifdef __linux__
+    .bdrv_ioctl         = hdev_ioctl,
+#ifdef CONFIG_AIO
+    .bdrv_aio_ioctl     = hdev_aio_ioctl,
+#endif
+#endif
+};
+
+#ifdef __linux__
+static int floppy_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    posix_aio_init();
+
+    s->type = FTYPE_FD;
+    /* open will not fail even if no floppy is inserted */
+    s->open_flags |= O_NONBLOCK;
+
+    ret = raw_open_common(bs, filename, flags);
+    if (ret)
+        return ret;
+
+    /* close fd so that we can reopen it as needed */
+    close(s->fd);
+    s->fd = -1;
+    s->fd_media_changed = 1;
+
     return 0;
 }
 
-static int raw_is_inserted(BlockDriverState *bs)
+static int floppy_probe_device(const char *filename)
 {
-    BDRVRawState *s = bs->opaque;
+    if (strstart(filename, "/dev/fd", NULL))
+        return 100;
+    return 0;
+}
 
-    switch(s->type) {
-    case FTYPE_CD:
-        return (raw_getlength(bs) > 0);
-    case FTYPE_FD:
-        /* XXX handle this */
-        /* FALLTHRU */
-    default:
-        return 1;
-    }
+
+static int floppy_is_inserted(BlockDriverState *bs)
+{
+    return fd_open(bs) >= 0;
 }
 
-static int raw_media_changed(BlockDriverState *bs)
+static int floppy_media_changed(BlockDriverState *bs)
 {
-    return -ENOTSUP;
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    /*
+     * XXX: we do not have a true media changed indication.
+     * It does not work if the floppy is changed without trying to read it.
+     */
+    fd_open(bs);
+    ret = s->fd_media_changed;
+    s->fd_media_changed = 0;
+#ifdef DEBUG_FLOPPY
+    printf("Floppy changed=%d\n", ret);
+#endif
+    return ret;
 }
 
-static int raw_eject(BlockDriverState *bs, int eject_flag)
+static int floppy_eject(BlockDriverState *bs, int eject_flag)
 {
     BDRVRawState *s = bs->opaque;
+    int fd;
 
-    switch(s->type) {
-    case FTYPE_CD:
-        if (s->fd < 0)
-            return -ENOTSUP;
-        (void) ioctl (s->fd, CDIOCALLOW);
-        if (eject_flag) {
-            if (ioctl (s->fd, CDIOCEJECT) < 0)
-                perror("CDIOCEJECT");
-        } else {
-            if (ioctl (s->fd, CDIOCCLOSE) < 0)
-                perror("CDIOCCLOSE");
-        }
-        if (cd_open(bs) < 0)
-            return -ENOTSUP;
-        break;
-    case FTYPE_FD:
-        /* XXX handle this */
-        /* FALLTHRU */
-    default:
-        return -ENOTSUP;
+    if (s->fd >= 0) {
+        close(s->fd);
+        s->fd = -1;
     }
+    fd = open(bs->filename, s->open_flags | O_NONBLOCK);
+    if (fd >= 0) {
+        if (ioctl(fd, FDEJECT, 0) < 0)
+            perror("FDEJECT");
+        close(fd);
+    }
+
     return 0;
 }
 
-static int raw_set_locked(BlockDriverState *bs, int locked)
+static BlockDriver bdrv_host_floppy = {
+    .format_name        = "host_floppy",
+    .instance_size      = sizeof(BDRVRawState),
+    .bdrv_probe_device	= floppy_probe_device,
+    .bdrv_open          = floppy_open,
+    .bdrv_close         = raw_close,
+    .bdrv_create        = hdev_create,
+    .bdrv_flush         = raw_flush,
+
+#ifdef CONFIG_AIO
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
+#endif
+
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
+    .bdrv_getlength	= raw_getlength,
+
+    /* removable device support */
+    .bdrv_is_inserted   = floppy_is_inserted,
+    .bdrv_media_changed = floppy_media_changed,
+    .bdrv_eject         = floppy_eject,
+};
+
+static int cdrom_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVRawState *s = bs->opaque;
 
-    switch(s->type) {
-    case FTYPE_CD:
-        if (s->fd < 0)
-            return -ENOTSUP;
-        if (ioctl (s->fd, (locked ? CDIOCPREVENT : CDIOCALLOW)) < 0) {
-            /* Note: an error can happen if the distribution automatically
-               mounts the CD-ROM */
-            //        perror("CDROM_LOCKDOOR");
-        }
-        break;
-    default:
-        return -ENOTSUP;
-    }
-    return 0;
+    /* open will not fail even if no CD is inserted */
+    s->open_flags |= O_NONBLOCK;
+    s->type = FTYPE_CD;
+
+    return raw_open_common(bs, filename, flags);
 }
 
-static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+static int cdrom_probe_device(const char *filename)
 {
-    return -ENOTSUP;
+    if (strstart(filename, "/dev/cd", NULL))
+        return 100;
+    return 0;
 }
-#else /* !linux && !FreeBSD */
 
-static int fd_open(BlockDriverState *bs)
+static int cdrom_is_inserted(BlockDriverState *bs)
 {
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    ret = ioctl(s->fd, CDROM_DRIVE_STATUS, CDSL_CURRENT);
+    if (ret == CDS_DISC_OK)
+        return 1;
     return 0;
 }
 
-static int raw_is_inserted(BlockDriverState *bs)
+static int cdrom_eject(BlockDriverState *bs, int eject_flag)
 {
-    return 1;
+    BDRVRawState *s = bs->opaque;
+
+    if (eject_flag) {
+        if (ioctl(s->fd, CDROMEJECT, NULL) < 0)
+            perror("CDROMEJECT");
+    } else {
+        if (ioctl(s->fd, CDROMCLOSETRAY, NULL) < 0)
+            perror("CDROMEJECT");
+    }
+
+    return 0;
 }
 
-static int raw_media_changed(BlockDriverState *bs)
+static int cdrom_set_locked(BlockDriverState *bs, int locked)
 {
-    return -ENOTSUP;
+    BDRVRawState *s = bs->opaque;
+
+    if (ioctl(s->fd, CDROM_LOCKDOOR, locked) < 0) {
+        /*
+         * Note: an error can happen if the distribution automatically
+         * mounts the CD-ROM
+         */
+        /* perror("CDROM_LOCKDOOR"); */
+    }
+
+    return 0;
 }
 
-static int raw_eject(BlockDriverState *bs, int eject_flag)
+static BlockDriver bdrv_host_cdrom = {
+    .format_name        = "host_cdrom",
+    .instance_size      = sizeof(BDRVRawState),
+    .bdrv_probe_device	= cdrom_probe_device,
+    .bdrv_open          = cdrom_open,
+    .bdrv_close         = raw_close,
+    .bdrv_create        = hdev_create,
+    .bdrv_flush         = raw_flush,
+
+#ifdef CONFIG_AIO
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
+#endif
+
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
+    .bdrv_getlength     = raw_getlength,
+
+    /* removable device support */
+    .bdrv_is_inserted   = cdrom_is_inserted,
+    .bdrv_eject         = cdrom_eject,
+    .bdrv_set_locked    = cdrom_set_locked,
+
+    /* generic scsi device */
+    .bdrv_ioctl         = hdev_ioctl,
+#ifdef CONFIG_AIO
+    .bdrv_aio_ioctl     = hdev_aio_ioctl,
+#endif
+};
+#endif /* __linux__ */
+
+#ifdef __FreeBSD__
+static int cdrom_open(BlockDriverState *bs, const char *filename, int flags)
 {
-    return -ENOTSUP;
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    s->type = FTYPE_CD;
+
+    ret = raw_open_common(bs, filename, flags);
+    if (ret)
+        return ret;
+
+    /* make sure the door isnt locked at this time */
+    ioctl(s->fd, CDIOCALLOW);
+    return 0;
 }
 
-static int raw_set_locked(BlockDriverState *bs, int locked)
+static int cdrom_probe_device(const char *filename)
 {
-    return -ENOTSUP;
+    if (strstart(filename, "/dev/cd", NULL) ||
+            strstart(filename, "/dev/acd", NULL))
+        return 100;
+    return 0;
 }
 
-static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+static int cdrom_reopen(BlockDriverState *bs)
 {
-    return -ENOTSUP;
+    BDRVRawState *s = bs->opaque;
+    int fd;
+
+    /*
+     * Force reread of possibly changed/newly loaded disc,
+     * FreeBSD seems to not notice sometimes...
+     */
+    if (s->fd >= 0)
+        close(s->fd);
+    fd = open(bs->filename, s->open_flags, 0644);
+    if (fd < 0) {
+        s->fd = -1;
+        return -EIO;
+    }
+    s->fd = fd;
+
+    /* make sure the door isnt locked at this time */
+    ioctl(s->fd, CDIOCALLOW);
+    return 0;
 }
 
-static BlockDriverAIOCB *raw_aio_ioctl(BlockDriverState *bs,
-        unsigned long int req, void *buf,
-        BlockDriverCompletionFunc *cb, void *opaque)
+static int cdrom_is_inserted(BlockDriverState *bs)
 {
-    return NULL;
+    return raw_getlength(bs) > 0;
 }
-#endif /* !linux && !FreeBSD */
 
-static int hdev_create(const char *filename, QEMUOptionParameter *options)
+static int cdrom_eject(BlockDriverState *bs, int eject_flag)
 {
-    int fd;
-    int ret = 0;
-    struct stat stat_buf;
-    int64_t total_size = 0;
+    BDRVRawState *s = bs->opaque;
 
-    /* Read out options */
-    while (options && options->name) {
-        if (!strcmp(options->name, "size")) {
-            total_size = options->value.n / 512;
-        }
-        options++;
+    if (s->fd < 0)
+        return -ENOTSUP;
+
+    (void) ioctl(s->fd, CDIOCALLOW);
+
+    if (eject_flag) {
+        if (ioctl(s->fd, CDIOCEJECT) < 0)
+            perror("CDIOCEJECT");
+    } else {
+        if (ioctl(s->fd, CDIOCCLOSE) < 0)
+            perror("CDIOCCLOSE");
     }
 
-    fd = open(filename, O_WRONLY | O_BINARY);
-    if (fd < 0)
-        return -EIO;
+    if (cdrom_reopen(bs) < 0)
+        return -ENOTSUP;
+    return 0;
+}
 
-    if (fstat(fd, &stat_buf) < 0)
-        ret = -EIO;
-    else if (!S_ISBLK(stat_buf.st_mode) && !S_ISCHR(stat_buf.st_mode))
-        ret = -EIO;
-    else if (lseek(fd, 0, SEEK_END) < total_size * 512)
-        ret = -ENOSPC;
+static int cdrom_set_locked(BlockDriverState *bs, int locked)
+{
+    BDRVRawState *s = bs->opaque;
 
-    close(fd);
-    return ret;
+    if (s->fd < 0)
+        return -ENOTSUP;
+    if (ioctl(s->fd, (locked ? CDIOCPREVENT : CDIOCALLOW)) < 0) {
+        /*
+         * Note: an error can happen if the distribution automatically
+         * mounts the CD-ROM
+         */
+        /* perror("CDROM_LOCKDOOR"); */
+    }
+
+    return 0;
 }
 
-static BlockDriver bdrv_host_device = {
-    .format_name	= "host_device",
-    .instance_size	= sizeof(BDRVRawState),
-    .bdrv_open		= hdev_open,
-    .bdrv_close		= raw_close,
+static BlockDriver bdrv_host_cdrom = {
+    .format_name        = "host_cdrom",
+    .instance_size      = sizeof(BDRVRawState),
+    .bdrv_probe_device	= cdrom_probe_device,
+    .bdrv_open          = cdrom_open,
+    .bdrv_close         = raw_close,
     .bdrv_create        = hdev_create,
-    .bdrv_flush		= raw_flush,
+    .bdrv_flush         = raw_flush,
 
 #ifdef CONFIG_AIO
-    .bdrv_aio_readv	= raw_aio_readv,
-    .bdrv_aio_writev	= raw_aio_writev,
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
 #endif
 
     .bdrv_read          = raw_read,
     .bdrv_write         = raw_write,
-    .bdrv_getlength	= raw_getlength,
+    .bdrv_getlength     = raw_getlength,
 
     /* removable device support */
-    .bdrv_is_inserted	= raw_is_inserted,
-    .bdrv_media_changed	= raw_media_changed,
-    .bdrv_eject		= raw_eject,
-    .bdrv_set_locked	= raw_set_locked,
-    /* generic scsi device */
-    .bdrv_ioctl		= raw_ioctl,
-#ifdef CONFIG_AIO
-    .bdrv_aio_ioctl	= raw_aio_ioctl,
-#endif
+    .bdrv_is_inserted   = cdrom_is_inserted,
+    .bdrv_eject         = cdrom_eject,
+    .bdrv_set_locked    = cdrom_set_locked,
 };
+#endif /* __FreeBSD__ */
 
 static void bdrv_raw_init(void)
 {
+    /*
+     * Register all the drivers.  Note that order is important, the driver
+     * registered last will get probed first.
+     */
     bdrv_register(&bdrv_raw);
     bdrv_register(&bdrv_host_device);
+#ifdef __linux__
+    bdrv_register(&bdrv_host_floppy);
+    bdrv_register(&bdrv_host_cdrom);
+#endif
+#ifdef __FreeBSD__
+    bdrv_register(&bdrv_host_cdrom);
+#endif
 }
 
 block_init(bdrv_raw_init);
diff --git a/block/raw-win32.c b/block/raw-win32.c
index 1e95153d5..72acad58f 100644
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -306,6 +306,15 @@ static int find_device_type(BlockDriverState *bs, const char *filename)
     }
 }
 
+static int hdev_probe_device(const char *filename)
+{
+    if (strstart(filename, "/dev/cdrom", NULL))
+        return 100;
+    if (is_windows_drive(filename))
+        return 100;
+    return 0;
+}
+
 static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVRawState *s = bs->opaque;
@@ -391,6 +400,7 @@ static int raw_set_locked(BlockDriverState *bs, int locked)
 static BlockDriver bdrv_host_device = {
     .format_name	= "host_device",
     .instance_size	= sizeof(BDRVRawState),
+    .bdrv_probe_device	= hdev_probe_device,
     .bdrv_open		= hdev_open,
     .bdrv_close		= raw_close,
     .bdrv_flush		= raw_flush,
diff --git a/block_int.h b/block_int.h
index 8d0da7cfd..830b7e9c9 100644
--- a/block_int.h
+++ b/block_int.h
@@ -48,6 +48,7 @@ struct BlockDriver {
     const char *format_name;
     int instance_size;
     int (*bdrv_probe)(const uint8_t *buf, int buf_size, const char *filename);
+    int (*bdrv_probe_device)(const char *filename);
     int (*bdrv_open)(BlockDriverState *bs, const char *filename, int flags);
     int (*bdrv_read)(BlockDriverState *bs, int64_t sector_num,
                      uint8_t *buf, int nb_sectors);
@@ -177,4 +178,8 @@ void *qemu_blockalign(BlockDriverState *bs, size_t size);
 
 extern BlockDriverState *bdrv_first;
 
+#ifdef _WIN32
+int is_windows_drive(const char *filename);
+#endif
+
 #endif /* BLOCK_INT_H */
diff --git a/bsd-user/bsdload.c b/bsd-user/bsdload.c
index 3c3a04770..05fd20acd 100644
--- a/bsd-user/bsdload.c
+++ b/bsd-user/bsdload.c
@@ -10,7 +10,7 @@
 
 #include "qemu.h"
 
-#define NGROUPS 32
+#define TARGET_NGROUPS 32
 
 /* ??? This should really be somewhere else.  */
 abi_long memcpy_to_target(abi_ulong dest, const void *src,
@@ -31,9 +31,9 @@ static int in_group_p(gid_t g)
     /* return TRUE if we're in the specified group, FALSE otherwise */
     int         ngroup;
     int         i;
-    gid_t       grouplist[NGROUPS];
+    gid_t       grouplist[TARGET_NGROUPS];
 
-    ngroup = getgroups(NGROUPS, grouplist);
+    ngroup = getgroups(TARGET_NGROUPS, grouplist);
     for(i = 0; i < ngroup; i++) {
         if(grouplist[i] == g) {
             return 1;
diff --git a/configure b/configure
index 995fd2348..7616e98a9 100755
--- a/configure
+++ b/configure
@@ -388,11 +388,7 @@ else
 fi
 [ -f "$workdir/vl.c" ] || source_path_used="yes"
 
-werror="no"
-# generate compile errors on warnings for development builds
-#if grep cvs $source_path/VERSION > /dev/null 2>&1 ; then
-#werror="yes";
-#fi
+werror=""
 
 for opt do
   optarg=`expr "x$opt" : 'x[^=]*=\(.*\)'`
@@ -553,8 +549,21 @@ if test "$debug" = "no" ; then
 fi
 CFLAGS="$CFLAGS -Wall -Wundef -Wendif-labels -Wwrite-strings -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls"
 LDFLAGS="$LDFLAGS -g"
+
+# Consult white-list to determine whether to enable werror
+# by default.  Only enable by default for git builds
+if test -z "$werror" ; then
+    z_version=`cut -f3 -d. $source_path/VERSION`
+    if test "$z_version" = "50" -a \
+        "$linux" = "yes" ; then
+        werror="yes"
+    else
+        werror="no"
+    fi
+fi
+
 if test "$werror" = "yes" ; then
-CFLAGS="$CFLAGS -Werror"
+    CFLAGS="$CFLAGS -Werror"
 fi
 
 if test "$solaris" = "no" ; then
diff --git a/hw/ads7846.c b/hw/ads7846.c
index 1c65ffe15..7d1cbc711 100644
--- a/hw/ads7846.c
+++ b/hw/ads7846.c
@@ -155,13 +155,15 @@ static void ads7846_init(SSISlave *dev)
 }
 
 static SSISlaveInfo ads7846_info = {
+    .qdev.name ="ads7846",
+    .qdev.size = sizeof(ADS7846State),
     .init = ads7846_init,
     .transfer = ads7846_transfer
 };
 
 static void ads7846_register_devices(void)
 {
-    ssi_register_slave("ads7846", sizeof(ADS7846State), &ads7846_info);
+    ssi_register_slave(&ads7846_info);
 }
 
 device_init(ads7846_register_devices)
diff --git a/hw/apic.c b/hw/apic.c
index eac54fd30..5680cb01e 100644
--- a/hw/apic.c
+++ b/hw/apic.c
@@ -85,12 +85,13 @@ typedef struct APICState {
     int count_shift;
     uint32_t initial_count;
     int64_t initial_count_load_time, next_time;
+    uint32_t idx;
     QEMUTimer *timer;
 } APICState;
 
 static int apic_io_memory;
 static APICState *local_apics[MAX_APICS + 1];
-static int last_apic_id = 0;
+static int last_apic_idx = 0;
 static int apic_irq_delivered;
 
 
@@ -410,6 +411,23 @@ static void apic_eoi(APICState *s)
     apic_update_irq(s);
 }
 
+static int apic_find_dest(uint8_t dest)
+{
+    APICState *apic = local_apics[dest];
+    int i;
+
+    if (apic && apic->id == dest)
+        return dest;  /* shortcut in case apic->id == apic->idx */
+
+    for (i = 0; i < MAX_APICS; i++) {
+        apic = local_apics[i];
+	if (apic && apic->id == dest)
+            return i;
+    }
+
+    return -1;
+}
+
 static void apic_get_delivery_bitmask(uint32_t *deliver_bitmask,
                                       uint8_t dest, uint8_t dest_mode)
 {
@@ -420,8 +438,10 @@ static void apic_get_delivery_bitmask(uint32_t *deliver_bitmask,
         if (dest == 0xff) {
             memset(deliver_bitmask, 0xff, MAX_APIC_WORDS * sizeof(uint32_t));
         } else {
+            int idx = apic_find_dest(dest);
             memset(deliver_bitmask, 0x00, MAX_APIC_WORDS * sizeof(uint32_t));
-            set_bit(deliver_bitmask, dest);
+            if (idx >= 0)
+                set_bit(deliver_bitmask, idx);
         }
     } else {
         /* XXX: cluster mode */
@@ -467,8 +487,7 @@ static void apic_init_ipi(APICState *s)
 
     cpu_reset(s->cpu_env);
 
-    if (!(s->apicbase & MSR_IA32_APICBASE_BSP))
-        s->cpu_env->halted = 1;
+    s->cpu_env->halted = !(s->apicbase & MSR_IA32_APICBASE_BSP);
 
     if (kvm_enabled() && !qemu_kvm_irqchip_in_kernel())
         kvm_apic_init(s->cpu_env);
@@ -502,14 +521,14 @@ static void apic_deliver(APICState *s, uint8_t dest, uint8_t dest_mode,
         break;
     case 1:
         memset(deliver_bitmask, 0x00, sizeof(deliver_bitmask));
-        set_bit(deliver_bitmask, s->id);
+        set_bit(deliver_bitmask, s->idx);
         break;
     case 2:
         memset(deliver_bitmask, 0xff, sizeof(deliver_bitmask));
         break;
     case 3:
         memset(deliver_bitmask, 0xff, sizeof(deliver_bitmask));
-        reset_bit(deliver_bitmask, s->id);
+        reset_bit(deliver_bitmask, s->idx);
         break;
     }
 
@@ -980,13 +999,14 @@ static int apic_load(QEMUFile *f, void *opaque, int version_id)
 static void apic_reset(void *opaque)
 {
     APICState *s = opaque;
+    int bsp = cpu_is_bsp(s->cpu_env);
 
     s->apicbase = 0xfee00000 |
-        (s->id ? 0 : MSR_IA32_APICBASE_BSP) | MSR_IA32_APICBASE_ENABLE;
+        (bsp ? MSR_IA32_APICBASE_BSP : 0) | MSR_IA32_APICBASE_ENABLE;
 
     apic_init_ipi(s);
 
-    if (s->id == 0) {
+    if (bsp) {
         /*
          * LINT0 delivery mode on CPU #0 is set to ExtInt at initialization
          * time typically by BIOS, so PIC interrupt can be delivered to the
@@ -1013,12 +1033,12 @@ int apic_init(CPUState *env)
 {
     APICState *s;
 
-    if (last_apic_id >= MAX_APICS)
+    if (last_apic_idx >= MAX_APICS)
         return -1;
     s = qemu_mallocz(sizeof(APICState));
     env->apic_state = s;
-    s->id = last_apic_id++;
-    env->cpuid_apic_id = s->id;
+    s->idx = last_apic_idx++;
+    s->id = env->cpuid_apic_id;
     s->cpu_env = env;
 
     apic_reset(s);
@@ -1034,10 +1054,10 @@ int apic_init(CPUState *env)
     }
     s->timer = qemu_new_timer(vm_clock, apic_timer, s);
 
-    register_savevm("apic", s->id, 2, apic_save, apic_load, s);
+    register_savevm("apic", s->idx, 2, apic_save, apic_load, s);
     qemu_register_reset(apic_reset, 0, s);
 
-    local_apics[s->id] = s;
+    local_apics[s->idx] = s;
     return 0;
 }
 
diff --git a/hw/axis_dev88.c b/hw/axis_dev88.c
index fc527cbec..c4e09dd5e 100644
--- a/hw/axis_dev88.c
+++ b/hw/axis_dev88.c
@@ -309,16 +309,16 @@ void axisdev88_init (ram_addr_t ram_size,
     nmi[0] = qdev_get_gpio_in(dev, 30);
     nmi[1] = qdev_get_gpio_in(dev, 31);
 
-    etraxfs_dmac = etraxfs_dmac_init(env, 0x30000000, 10);
+    etraxfs_dmac = etraxfs_dmac_init(0x30000000, 10);
     for (i = 0; i < 10; i++) {
         /* On ETRAX, odd numbered channels are inputs.  */
         etraxfs_dmac_connect(etraxfs_dmac, i, irq + 7 + i, i & 1);
     }
 
     /* Add the two ethernet blocks.  */
-    eth[0] = etraxfs_eth_init(&nd_table[0], env, 0x30034000, 1);
+    eth[0] = etraxfs_eth_init(&nd_table[0], 0x30034000, 1);
     if (nb_nics > 1)
-        eth[1] = etraxfs_eth_init(&nd_table[1], env, 0x30036000, 2);
+        eth[1] = etraxfs_eth_init(&nd_table[1], 0x30036000, 2);
 
     /* The DMA Connector block is missing, hardwire things for now.  */
     etraxfs_dmac_connect_client(etraxfs_dmac, 0, eth[0]);
diff --git a/hw/baum.c b/hw/baum.c
index f6d6e67d4..b47ea34c4 100644
--- a/hw/baum.c
+++ b/hw/baum.c
@@ -30,7 +30,7 @@
 #include <brlapi_constants.h>
 #include <brlapi_keycodes.h>
 #ifdef CONFIG_SDL
-#include <SDL/SDL_syswm.h>
+#include <SDL_syswm.h>
 #endif
 
 #if 0
@@ -90,7 +90,7 @@ typedef struct {
 
     brlapi_handle_t *brlapi;
     int brlapi_fd;
-    int x, y;
+    unsigned int x, y;
 
     uint8_t in_buf[BUF_SIZE];
     uint8_t in_buf_used;
@@ -356,12 +356,12 @@ static int baum_eat_packet(BaumDriverState *baum, const uint8_t *buf, int len)
             .displayNumber = BRLAPI_DISPLAY_DEFAULT,
             .regionBegin = 1,
             .regionSize = baum->x * baum->y,
-            .text = text,
+            .text = (char *)text,
             .textSize = baum->x * baum->y,
             .andMask = zero,
             .orMask = cells,
             .cursor = cursor,
-            .charset = "ISO-8859-1",
+            .charset = (char *)"ISO-8859-1",
         };
 
         if (brlapi__write(baum->brlapi, &wa) == -1)
diff --git a/hw/etraxfs.c b/hw/etraxfs.c
index 1e200553e..362d286f5 100644
--- a/hw/etraxfs.c
+++ b/hw/etraxfs.c
@@ -49,6 +49,7 @@ void bareetraxfs_init (ram_addr_t ram_size,
                        const char *initrd_filename, const char *cpu_model)
 {
     DeviceState *dev;
+    SysBusDevice *s;
     CPUState *env;
     qemu_irq irq[30], nmi[2], *cpu_irq; 
     void *etraxfs_dmac;
@@ -85,26 +86,30 @@ void bareetraxfs_init (ram_addr_t ram_size,
                           1, 2, 0x0000, 0x0000, 0x0000, 0x0000,
                           0x555, 0x2aa);
     cpu_irq = cris_pic_init_cpu(env);
-    dev = sysbus_create_varargs("etraxfs,pic", 0x3001c000,
-                                cpu_irq[0], cpu_irq[1], NULL);
+    dev = qdev_create(NULL, "etraxfs,pic");
     /* FIXME: Is there a proper way to signal vectors to the CPU core?  */
     qdev_set_prop_ptr(dev, "interrupt_vector", &env->interrupt_vector);
+    qdev_init(dev);
+    s = sysbus_from_qdev(dev);
+    sysbus_mmio_map(s, 0, 0x3001c000);
+    sysbus_connect_irq(s, 0, cpu_irq[0]);
+    sysbus_connect_irq(s, 1, cpu_irq[1]);
     for (i = 0; i < 30; i++) {
         irq[i] = qdev_get_gpio_in(dev, i);
     }
     nmi[0] = qdev_get_gpio_in(dev, 30);
     nmi[1] = qdev_get_gpio_in(dev, 31);
 
-    etraxfs_dmac = etraxfs_dmac_init(env, 0x30000000, 10);
+    etraxfs_dmac = etraxfs_dmac_init(0x30000000, 10);
     for (i = 0; i < 10; i++) {
         /* On ETRAX, odd numbered channels are inputs.  */
         etraxfs_dmac_connect(etraxfs_dmac, i, irq + 7 + i, i & 1);
     }
 
     /* Add the two ethernet blocks.  */
-    eth[0] = etraxfs_eth_init(&nd_table[0], env, 0x30034000, 1);
+    eth[0] = etraxfs_eth_init(&nd_table[0], 0x30034000, 1);
     if (nb_nics > 1)
-        eth[1] = etraxfs_eth_init(&nd_table[1], env, 0x30036000, 2);
+        eth[1] = etraxfs_eth_init(&nd_table[1], 0x30036000, 2);
 
     /* The DMA Connector block is missing, hardwire things for now.  */
     etraxfs_dmac_connect_client(etraxfs_dmac, 0, eth[0]);
diff --git a/hw/etraxfs.h b/hw/etraxfs.h
index 9cc30bee4..01fb9d3e8 100644
--- a/hw/etraxfs.h
+++ b/hw/etraxfs.h
@@ -25,5 +25,4 @@
 #include "etraxfs_dma.h"
 
 qemu_irq *cris_pic_init_cpu(CPUState *env);
-void *etraxfs_eth_init(NICInfo *nd, CPUState *env,
-                       target_phys_addr_t base, int phyaddr);
+void *etraxfs_eth_init(NICInfo *nd, target_phys_addr_t base, int phyaddr);
diff --git a/hw/etraxfs_dma.c b/hw/etraxfs_dma.c
index ba44e0d63..1b65d0345 100644
--- a/hw/etraxfs_dma.c
+++ b/hw/etraxfs_dma.c
@@ -51,7 +51,7 @@
 
 // ------------------------------------------------------------ dma_descr_group
 typedef struct dma_descr_group {
-  struct dma_descr_group       *next;
+  uint32_t                      next;
   unsigned                      eol        : 1;
   unsigned                      tol        : 1;
   unsigned                      bol        : 1;
@@ -71,7 +71,7 @@ typedef struct dma_descr_group {
 
 // ---------------------------------------------------------- dma_descr_context
 typedef struct dma_descr_context {
-  struct dma_descr_context     *next;
+  uint32_t                      next;
   unsigned                      eol        : 1;
   unsigned                                 : 3;
   unsigned                      intr       : 1;
@@ -85,14 +85,14 @@ typedef struct dma_descr_context {
   unsigned                      md2;
   unsigned                      md3;
   unsigned                      md4;
-  struct dma_descr_data        *saved_data;
-  char                         *saved_data_buf;
+  uint32_t                      saved_data;
+  uint32_t                      saved_data_buf;
 } dma_descr_context;
 
 // ------------------------------------------------------------- dma_descr_data
 typedef struct dma_descr_data {
-  struct dma_descr_data        *next;
-  char                         *buf;
+  uint32_t                      next;
+  uint32_t                      buf;
   unsigned                      eol        : 1;
   unsigned                                 : 2;
   unsigned                      out_eop    : 1;
@@ -103,7 +103,7 @@ typedef struct dma_descr_data {
   unsigned                      in_eop     : 1;
   unsigned                                 : 4;
   unsigned                      md         : 16;
-  char                         *after;
+  uint32_t                      after;
 } dma_descr_data;
 
 /* Constants */
@@ -186,8 +186,6 @@ struct fs_dma_channel
 struct fs_dma_ctrl
 {
 	int map;
-	CPUState *env;
-
 	int nr_channels;
 	struct fs_dma_channel *channels;
 
@@ -233,18 +231,18 @@ static void channel_load_g(struct fs_dma_ctrl *ctrl, int c)
 static void dump_c(int ch, struct dma_descr_context *c)
 {
 	printf("%s ch=%d\n", __func__, ch);
-	printf("next=%p\n", c->next);
-	printf("saved_data=%p\n", c->saved_data);
-	printf("saved_data_buf=%p\n", c->saved_data_buf);
+	printf("next=%x\n", c->next);
+	printf("saved_data=%x\n", c->saved_data);
+	printf("saved_data_buf=%x\n", c->saved_data_buf);
 	printf("eol=%x\n", (uint32_t) c->eol);
 }
 
 static void dump_d(int ch, struct dma_descr_data *d)
 {
 	printf("%s ch=%d\n", __func__, ch);
-	printf("next=%p\n", d->next);
-	printf("buf=%p\n", d->buf);
-	printf("after=%p\n", d->after);
+	printf("next=%x\n", d->next);
+	printf("buf=%x\n", d->buf);
+	printf("after=%x\n", d->after);
 	printf("intr=%x\n", (uint32_t) d->intr);
 	printf("out_eop=%x\n", (uint32_t) d->out_eop);
 	printf("in_eop=%x\n", (uint32_t) d->in_eop);
@@ -274,7 +272,7 @@ static void channel_load_d(struct fs_dma_ctrl *ctrl, int c)
 	target_phys_addr_t addr = channel_reg(ctrl, c, RW_SAVED_DATA);
 
 	/* Load and decode. FIXME: handle endianness.  */
-	D(printf("%s ch=%d addr=%x\n", __func__, c, addr));
+	D(printf("%s ch=%d addr=" TARGET_FMT_plx "\n", __func__, c, addr));
 	cpu_physical_memory_read (addr,
 				  (void *) &ctrl->channels[c].current_d, 
 				  sizeof ctrl->channels[c].current_d);
@@ -288,7 +286,7 @@ static void channel_store_c(struct fs_dma_ctrl *ctrl, int c)
 	target_phys_addr_t addr = channel_reg(ctrl, c, RW_GROUP_DOWN);
 
 	/* Encode and store. FIXME: handle endianness.  */
-	D(printf("%s ch=%d addr=%x\n", __func__, c, addr));
+	D(printf("%s ch=%d addr=" TARGET_FMT_plx "\n", __func__, c, addr));
 	D(dump_d(c, &ctrl->channels[c].current_d));
 	cpu_physical_memory_write (addr,
 				  (void *) &ctrl->channels[c].current_c,
@@ -300,7 +298,7 @@ static void channel_store_d(struct fs_dma_ctrl *ctrl, int c)
 	target_phys_addr_t addr = channel_reg(ctrl, c, RW_SAVED_DATA);
 
 	/* Encode and store. FIXME: handle endianness.  */
-	D(printf("%s ch=%d addr=%x\n", __func__, c, addr));
+	D(printf("%s ch=%d addr=" TARGET_FMT_plx "\n", __func__, c, addr));
 	cpu_physical_memory_write (addr,
 				  (void *) &ctrl->channels[c].current_d, 
 				  sizeof ctrl->channels[c].current_d);
@@ -347,7 +345,7 @@ static void channel_continue(struct fs_dma_ctrl *ctrl, int c)
 	/* If the current descriptor cleared the eol flag and we had already
 	   reached eol state, do the continue.  */
 	if (!ctrl->channels[c].current_d.eol && ctrl->channels[c].eol) {
-		D(printf("continue %d ok %p\n", c,
+		D(printf("continue %d ok %x\n", c,
 			 ctrl->channels[c].current_d.next));
 		ctrl->channels[c].regs[RW_SAVED_DATA] =
 			(uint32_t)(unsigned long)ctrl->channels[c].current_d.next;
@@ -406,11 +404,10 @@ static int channel_out_run(struct fs_dma_ctrl *ctrl, int c)
 		return 0;
 
 	do {
-		D(printf("ch=%d buf=%x after=%x saved_data_buf=%x\n",
+		D(printf("ch=%d buf=%x after=%x\n",
 			 c,
 			 (uint32_t)ctrl->channels[c].current_d.buf,
-			 (uint32_t)ctrl->channels[c].current_d.after,
-			 saved_data_buf));
+			 (uint32_t)ctrl->channels[c].current_d.after));
 
 		channel_load_d(ctrl, c);
 		saved_data_buf = channel_reg(ctrl, c, RW_SAVED_DATA_BUF);
@@ -507,8 +504,7 @@ static int channel_in_process(struct fs_dma_ctrl *ctrl, int c,
 		D(printf("in dscr end len=%d\n", 
 			 ctrl->channels[c].current_d.after
 			 - ctrl->channels[c].current_d.buf));
-		ctrl->channels[c].current_d.after = 
-			(void *)(unsigned long) saved_data_buf;
+		ctrl->channels[c].current_d.after = saved_data_buf;
 
 		/* Done. Step to next.  */
 		if (ctrl->channels[c].current_d.intr) {
@@ -562,7 +558,7 @@ static inline int channel_in_run(struct fs_dma_ctrl *ctrl, int c)
 
 static uint32_t dma_rinvalid (void *opaque, target_phys_addr_t addr)
 {
-        hw_error("Unsupported short access. reg=" TARGET_FMT_plx "\n", addr);
+        hw_error("Unsupported short raccess. reg=" TARGET_FMT_plx "\n", addr);
         return 0;
 }
 
@@ -587,7 +583,7 @@ dma_readl (void *opaque, target_phys_addr_t addr)
 
 		default:
 			r = ctrl->channels[c].regs[addr];
-			D(printf ("%s c=%d addr=%x\n",
+			D(printf ("%s c=%d addr=" TARGET_FMT_plx "\n",
 				  __func__, c, addr));
 			break;
 	}
@@ -597,7 +593,7 @@ dma_readl (void *opaque, target_phys_addr_t addr)
 static void
 dma_winvalid (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
-        hw_error("Unsupported short access. reg=" TARGET_FMT_plx "\n", addr);
+        hw_error("Unsupported short waccess. reg=" TARGET_FMT_plx "\n", addr);
 }
 
 static void
@@ -666,7 +662,8 @@ dma_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
 			break;
 
 	        default:
-			D(printf ("%s c=%d %x %x\n", __func__, c, addr));
+			D(printf ("%s c=%d " TARGET_FMT_plx "\n",
+				__func__, c, addr));
 			break;
         }
 }
@@ -742,8 +739,7 @@ static void DMA_run(void *opaque)
         qemu_bh_schedule_idle(etraxfs_dmac->bh);
 }
 
-void *etraxfs_dmac_init(CPUState *env, 
-			target_phys_addr_t base, int nr_channels)
+void *etraxfs_dmac_init(target_phys_addr_t base, int nr_channels)
 {
 	struct fs_dma_ctrl *ctrl = NULL;
 
@@ -751,7 +747,6 @@ void *etraxfs_dmac_init(CPUState *env,
 
         ctrl->bh = qemu_bh_new(DMA_run, ctrl);
 
-	ctrl->env = env;
 	ctrl->nr_channels = nr_channels;
 	ctrl->channels = qemu_mallocz(sizeof ctrl->channels[0] * nr_channels);
 
diff --git a/hw/etraxfs_dma.h b/hw/etraxfs_dma.h
index c29dab976..96408abab 100644
--- a/hw/etraxfs_dma.h
+++ b/hw/etraxfs_dma.h
@@ -13,8 +13,7 @@ struct etraxfs_dma_client
 	} client;
 };
 
-void *etraxfs_dmac_init(CPUState *env, target_phys_addr_t base, 
-			int nr_channels);
+void *etraxfs_dmac_init(target_phys_addr_t base, int nr_channels);
 void etraxfs_dmac_connect(void *opaque, int channel, qemu_irq *line,
 			  int input);
 void etraxfs_dmac_connect_client(void *opaque, int c, 
diff --git a/hw/etraxfs_eth.c b/hw/etraxfs_eth.c
index c7df44ee4..469be55a4 100644
--- a/hw/etraxfs_eth.c
+++ b/hw/etraxfs_eth.c
@@ -319,7 +319,6 @@ static void mdio_cycle(struct qemu_mdio *bus)
 
 struct fs_eth
 {
-	CPUState *env;
 	VLANClientState *vc;
 	int ethregs;
 
@@ -565,8 +564,7 @@ static void eth_cleanup(VLANClientState *vc)
         qemu_free(eth);
 }
 
-void *etraxfs_eth_init(NICInfo *nd, CPUState *env, 
-		       target_phys_addr_t base, int phyaddr)
+void *etraxfs_eth_init(NICInfo *nd, target_phys_addr_t base, int phyaddr)
 {
 	struct etraxfs_dma_client *dma = NULL;	
 	struct fs_eth *eth = NULL;
@@ -574,7 +572,6 @@ void *etraxfs_eth_init(NICInfo *nd, CPUState *env,
 	qemu_check_nic_model(nd, "fseth");
 
 	dma = qemu_mallocz(sizeof *dma * 2);
-
 	eth = qemu_mallocz(sizeof *eth);
 
 	dma[0].client.push = eth_tx_push;
@@ -582,7 +579,6 @@ void *etraxfs_eth_init(NICInfo *nd, CPUState *env,
 	dma[1].client.opaque = eth;
 	dma[1].client.pull = NULL;
 
-	eth->env = env;
 	eth->dma_out = dma;
 	eth->dma_in = dma + 1;
 
diff --git a/hw/i2c.c b/hw/i2c.c
index 8a0c4d7a7..838f40f88 100644
--- a/hw/i2c.c
+++ b/hw/i2c.c
@@ -152,12 +152,12 @@ static void i2c_slave_qdev_init(DeviceState *dev, DeviceInfo *base)
     info->init(s);
 }
 
-void i2c_register_slave(const char *name, int size, I2CSlaveInfo *info)
+void i2c_register_slave(I2CSlaveInfo *info)
 {
-    assert(size >= sizeof(i2c_slave));
+    assert(info->qdev.size >= sizeof(i2c_slave));
     info->qdev.init = i2c_slave_qdev_init;
     info->qdev.bus_type = BUS_TYPE_I2C;
-    qdev_register(name, size, &info->qdev);
+    qdev_register(&info->qdev);
 }
 
 DeviceState *i2c_create_slave(i2c_bus *bus, const char *name, int addr)
diff --git a/hw/i2c.h b/hw/i2c.h
index f15c70c5e..c4df39988 100644
--- a/hw/i2c.h
+++ b/hw/i2c.h
@@ -57,7 +57,7 @@ void i2c_slave_load(QEMUFile *f, i2c_slave *dev);
 #define I2C_SLAVE_FROM_QDEV(dev) DO_UPCAST(i2c_slave, qdev, dev)
 #define FROM_I2C_SLAVE(type, dev) DO_UPCAST(type, i2c, dev)
 
-void i2c_register_slave(const char *name, int size, I2CSlaveInfo *type);
+void i2c_register_slave(I2CSlaveInfo *type);
 
 DeviceState *i2c_create_slave(i2c_bus *bus, const char *name, int addr);
 
diff --git a/hw/lm832x.c b/hw/lm832x.c
index 74eeca2e9..18ea1f59a 100644
--- a/hw/lm832x.c
+++ b/hw/lm832x.c
@@ -526,6 +526,8 @@ void lm832x_key_event(struct i2c_slave *i2c, int key, int state)
 }
 
 static I2CSlaveInfo lm8323_info = {
+    .qdev.name = "lm8323",
+    .qdev.size = sizeof(LM823KbdState),
     .init = lm8323_init,
     .event = lm_i2c_event,
     .recv = lm_i2c_rx,
@@ -534,7 +536,7 @@ static I2CSlaveInfo lm8323_info = {
 
 static void lm832x_register_devices(void)
 {
-    i2c_register_slave("lm8323", sizeof(LM823KbdState), &lm8323_info);
+    i2c_register_slave(&lm8323_info);
 }
 
 device_init(lm832x_register_devices)
diff --git a/hw/max111x.c b/hw/max111x.c
index 217233cff..f7023a8e9 100644
--- a/hw/max111x.c
+++ b/hw/max111x.c
@@ -164,19 +164,23 @@ void max111x_set_input(DeviceState *dev, int line, uint8_t value)
 }
 
 static SSISlaveInfo max1110_info = {
+    .qdev.name = "max1110",
+    .qdev.size = sizeof(MAX111xState),
     .init = max1110_init,
     .transfer = max111x_transfer
 };
 
 static SSISlaveInfo max1111_info = {
+    .qdev.name = "max1111",
+    .qdev.size = sizeof(MAX111xState),
     .init = max1111_init,
     .transfer = max111x_transfer
 };
 
 static void max111x_register_devices(void)
 {
-    ssi_register_slave("max1110", sizeof(MAX111xState), &max1110_info);
-    ssi_register_slave("max1111", sizeof(MAX111xState), &max1111_info);
+    ssi_register_slave(&max1110_info);
+    ssi_register_slave(&max1111_info);
 }
 
 device_init(max111x_register_devices)
diff --git a/hw/max7310.c b/hw/max7310.c
index 69ede32a6..a571e57e9 100644
--- a/hw/max7310.c
+++ b/hw/max7310.c
@@ -218,6 +218,8 @@ void max7310_gpio_out_set(i2c_slave *i2c, int line, qemu_irq handler)
 }
 
 static I2CSlaveInfo max7310_info = {
+    .qdev.name = "max7310",
+    .qdev.size = sizeof(MAX7310State),
     .init = max7310_init,
     .event = max7310_event,
     .recv = max7310_rx,
@@ -226,7 +228,7 @@ static I2CSlaveInfo max7310_info = {
 
 static void max7310_register_devices(void)
 {
-    i2c_register_slave("max7310", sizeof(MAX7310State), &max7310_info);
+    i2c_register_slave(&max7310_info);
 }
 
 device_init(max7310_register_devices)
diff --git a/hw/mc146818rtc.c b/hw/mc146818rtc.c
index 888b85a9d..8c446e186 100644
--- a/hw/mc146818rtc.c
+++ b/hw/mc146818rtc.c
@@ -57,6 +57,11 @@
 #define REG_B_SQWE 0x08
 #define REG_B_DM   0x04
 
+#define REG_C_UF   0x10
+#define REG_C_IRQF 0x80
+#define REG_C_PF   0x40
+#define REG_C_AF   0x20
+
 struct RTCState {
     uint8_t cmos_data[128];
     uint8_t cmos_index;
@@ -568,6 +573,21 @@ static int rtc_load_td(QEMUFile *f, void *opaque, int version_id)
 }
 #endif
 
+static void rtc_reset(void *opaque)
+{
+    RTCState *s = opaque;
+
+    s->cmos_data[RTC_REG_B] &= ~(REG_B_PIE | REG_B_AIE | REG_B_SQWE);
+    s->cmos_data[RTC_REG_C] &= ~(REG_C_UF | REG_C_IRQF | REG_C_PF | REG_C_AF);
+
+    qemu_irq_lower(s->irq);
+
+#ifdef TARGET_I386
+    if (rtc_td_hack)
+	    s->irq_coalesced = 0;
+#endif
+}
+
 RTCState *rtc_init_sqw(int base, qemu_irq irq, qemu_irq sqw_irq, int base_year)
 {
     RTCState *s;
@@ -606,6 +626,8 @@ RTCState *rtc_init_sqw(int base, qemu_irq irq, qemu_irq sqw_irq, int base_year)
     if (rtc_td_hack)
         register_savevm("mc146818rtc-td", base, 1, rtc_save_td, rtc_load_td, s);
 #endif
+    qemu_register_reset(rtc_reset, 0, s);
+
     return s;
 }
 
@@ -721,5 +743,6 @@ RTCState *rtc_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq,
     if (rtc_td_hack)
         register_savevm("mc146818rtc-td", base, 1, rtc_save_td, rtc_load_td, s);
 #endif
+    qemu_register_reset(rtc_reset, 0, s);
     return s;
 }
diff --git a/hw/pc.c b/hw/pc.c
index 8f250c0b8..6c19f558e 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -834,6 +834,11 @@ static int load_option_rom(const char *oprom, target_phys_addr_t start,
         return size;
 }
 
+int cpu_is_bsp(CPUState *env)
+{
+	return env->cpuid_apic_id == 0;
+}
+
 CPUState *pc_new_cpu(int cpu, const char *cpu_model, int pci_enabled)
 {
         CPUState *env = cpu_init(cpu_model);
@@ -843,9 +848,9 @@ CPUState *pc_new_cpu(int cpu, const char *cpu_model, int pci_enabled)
         }
         if (cpu != 0)
             env->halted = 1;
-        if (smp_cpus > 1) {
-            /* XXX: enable it in all cases */
-            env->cpuid_features |= CPUID_APIC;
+        if ((env->cpuid_features & CPUID_APIC) || smp_cpus > 1) {
+            env->cpuid_apic_id = env->cpu_index;
+            apic_init(env);
         }
         qemu_register_reset(main_cpu_reset, 0, env);
         if (pci_enabled) {
@@ -1189,7 +1194,7 @@ static void pc_init1(ram_addr_t ram_size,
     }
 
     /* Add virtio balloon device */
-    if (pci_enabled) {
+    if (pci_enabled && !no_virtio_balloon) {
         pci_create_simple(pci_bus, -1, "virtio-balloon-pci");
     }
 
diff --git a/hw/pc.h b/hw/pc.h
index 3af22f2bf..d396d71f0 100644
--- a/hw/pc.h
+++ b/hw/pc.h
@@ -180,4 +180,6 @@ void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd);
 
 void extboot_init(BlockDriverState *bs, int cmd);
 
+int cpu_is_bsp(CPUState *env);
+
 #endif
diff --git a/hw/pci.c b/hw/pci.c
index 68ea84a41..2fd258a9d 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -1042,11 +1042,13 @@ void pci_qdev_register(const char *name, int size, pci_qdev_initfn init)
     PCIDeviceInfo *info;
 
     info = qemu_mallocz(sizeof(*info));
+    info->qdev.name = qemu_strdup(name);
+    info->qdev.size = size;
     info->init = init;
     info->qdev.init = pci_qdev_init;
     info->qdev.bus_type = BUS_TYPE_PCI;
 
-    qdev_register(name, size, &info->qdev);
+    qdev_register(&info->qdev);
 }
 
 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name)
diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index febe52749..e001d1fc7 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -1485,6 +1485,8 @@ static void pxa2xx_i2c_slave_init(i2c_slave *i2c)
 }
 
 static I2CSlaveInfo pxa2xx_i2c_slave_info = {
+    .qdev.name = "pxa2xx-i2c-slave",
+    .qdev.size = sizeof(PXA2xxI2CSlaveState),
     .init = pxa2xx_i2c_slave_init,
     .event = pxa2xx_i2c_event,
     .recv = pxa2xx_i2c_rx,
@@ -2258,8 +2260,7 @@ PXA2xxState *pxa255_init(unsigned int sdram_size)
 
 static void pxa2xx_register_devices(void)
 {
-    i2c_register_slave("pxa2xx-i2c-slave", sizeof(PXA2xxI2CSlaveState),
-                       &pxa2xx_i2c_slave_info);
+    i2c_register_slave(&pxa2xx_i2c_slave_info);
     sysbus_register_dev("pxa2xx-ssp", sizeof(PXA2xxSSPState), pxa2xx_ssp_init);
 }
 
diff --git a/hw/qdev.c b/hw/qdev.c
index d23298ca0..385e7099b 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -42,9 +42,7 @@ struct DeviceProperty {
 };
 
 struct DeviceType {
-    const char *name;
     DeviceInfo *info;
-    int size;
     DeviceType *next;
 };
 
@@ -54,17 +52,15 @@ static BusState *main_system_bus;
 static DeviceType *device_type_list;
 
 /* Register a new device type.  */
-void qdev_register(const char *name, int size, DeviceInfo *info)
+void qdev_register(DeviceInfo *info)
 {
     DeviceType *t;
 
-    assert(size >= sizeof(DeviceState));
+    assert(info->size >= sizeof(DeviceState));
 
     t = qemu_mallocz(sizeof(DeviceType));
     t->next = device_type_list;
     device_type_list = t;
-    t->name = qemu_strdup(name);
-    t->size = size;
     t->info = info;
 }
 
@@ -77,7 +73,7 @@ DeviceState *qdev_create(BusState *bus, const char *name)
     DeviceState *dev;
 
     for (t = device_type_list; t; t = t->next) {
-        if (strcmp(t->name, name) == 0) {
+        if (strcmp(t->info->name, name) == 0) {
             break;
         }
     }
@@ -85,7 +81,7 @@ DeviceState *qdev_create(BusState *bus, const char *name)
         hw_error("Unknown device '%s'\n", name);
     }
 
-    dev = qemu_mallocz(t->size);
+    dev = qemu_mallocz(t->info->size);
     dev->type = t;
 
     if (!bus) {
@@ -173,7 +169,7 @@ CharDriverState *qdev_init_chardev(DeviceState *dev)
     static int next_serial;
     static int next_virtconsole;
     /* FIXME: This is a nasty hack that needs to go away.  */
-    if (strncmp(dev->type->name, "virtio", 6) == 0) {
+    if (strncmp(dev->type->info->name, "virtio", 6) == 0) {
         return virtcon_hds[next_virtconsole++];
     } else {
         return serial_hds[next_serial++];
@@ -355,7 +351,7 @@ static void qdev_print(Monitor *mon, DeviceState *dev, int indent)
 {
     DeviceProperty *prop;
     BusState *child;
-    qdev_printf("dev: %s\n", dev->type->name);
+    qdev_printf("dev: %s\n", dev->type->info->name);
     indent += 2;
     if (dev->num_gpio_in) {
         qdev_printf("gpio-in %d\n", dev->num_gpio_in);
@@ -374,7 +370,7 @@ static void qdev_print(Monitor *mon, DeviceState *dev, int indent)
             break;
         case PROP_TYPE_DEV:
             qdev_printf("prop-dev %s %s\n", prop->name,
-                        ((DeviceState *)prop->value.ptr)->type->name);
+                        ((DeviceState *)prop->value.ptr)->type->info->name);
             break;
         default:
             qdev_printf("prop-unknown%d %s\n", prop->type, prop->name);
diff --git a/hw/qdev.h b/hw/qdev.h
index 7291805b4..ad104992a 100644
--- a/hw/qdev.h
+++ b/hw/qdev.h
@@ -78,12 +78,16 @@ typedef void (*SCSIAttachFn)(DeviceState *host, BlockDriverState *bdrv,
               int unit);
 
 struct DeviceInfo {
+    const char *name;
+    size_t size;
+    DevicePropList *props;
+
+    /* Private to qdev / bus.  */
     qdev_initfn init;
     BusType bus_type;
-    DevicePropList *props;
 };
 
-void qdev_register(const char *name, int size, DeviceInfo *info);
+void qdev_register(DeviceInfo *info);
 
 /* Register device properties.  */
 /* GPIO inputs also double as IRQ sinks.  */
diff --git a/hw/smbus.c b/hw/smbus.c
index 6bea4faab..5618902e7 100644
--- a/hw/smbus.c
+++ b/hw/smbus.c
@@ -206,14 +206,14 @@ static void smbus_device_init(i2c_slave *i2c)
     t->init(dev);
 }
 
-void smbus_register_device(const char *name, int size, SMBusDeviceInfo *info)
+void smbus_register_device(SMBusDeviceInfo *info)
 {
-    assert(size >= sizeof(SMBusDevice));
+    assert(info->i2c.qdev.size >= sizeof(SMBusDevice));
     info->i2c.init = smbus_device_init;
     info->i2c.event = smbus_i2c_event;
     info->i2c.recv = smbus_i2c_recv;
     info->i2c.send = smbus_i2c_send;
-    i2c_register_slave(name, size, &info->i2c);
+    i2c_register_slave(&info->i2c);
 }
 
 /* Master device commands.  */
diff --git a/hw/smbus.h b/hw/smbus.h
index 5b6e20f91..d8c805964 100644
--- a/hw/smbus.h
+++ b/hw/smbus.h
@@ -53,7 +53,7 @@ typedef struct {
     uint8_t (*read_data)(SMBusDevice *dev, uint8_t cmd, int n);
 } SMBusDeviceInfo;
 
-void smbus_register_device(const char *name, int size, SMBusDeviceInfo *info);
+void smbus_register_device(SMBusDeviceInfo *info);
 
 /* Master device commands.  */
 void smbus_quick_command(i2c_bus *bus, int addr, int read);
diff --git a/hw/smbus_eeprom.c b/hw/smbus_eeprom.c
index 3f8b38699..05a70d9b1 100644
--- a/hw/smbus_eeprom.c
+++ b/hw/smbus_eeprom.c
@@ -105,6 +105,8 @@ static void smbus_eeprom_init(SMBusDevice *dev)
 }
 
 static SMBusDeviceInfo smbus_eeprom_info = {
+    .i2c.qdev.name = "smbus-eeprom",
+    .i2c.qdev.size = sizeof(SMBusEEPROMDevice),
     .init = smbus_eeprom_init,
     .quick_cmd = eeprom_quick_cmd,
     .send_byte = eeprom_send_byte,
@@ -115,8 +117,7 @@ static SMBusDeviceInfo smbus_eeprom_info = {
 
 static void smbus_eeprom_register_devices(void)
 {
-    smbus_register_device("smbus-eeprom", sizeof(SMBusEEPROMDevice),
-                          &smbus_eeprom_info);
+    smbus_register_device(&smbus_eeprom_info);
 }
 
 device_init(smbus_eeprom_register_devices)
diff --git a/hw/spitz.c b/hw/spitz.c
index aa1487b20..4da70609f 100644
--- a/hw/spitz.c
+++ b/hw/spitz.c
@@ -24,11 +24,7 @@
 #include "boards.h"
 
 #undef REG_FMT
-#if TARGET_PHYS_ADDR_BITS == 32
-#define REG_FMT			"0x%02x"
-#else
 #define REG_FMT			"0x%02lx"
-#endif
 
 /* Spitz Flash */
 #define FLASH_BASE		0x0c000000
@@ -87,7 +83,7 @@ static uint32_t sl_readb(void *opaque, target_phys_addr_t addr)
         return ecc_digest(&s->ecc, nand_getio(s->nand));
 
     default:
-        zaurus_printf("Bad register offset " REG_FMT "\n", addr);
+        zaurus_printf("Bad register offset " REG_FMT "\n", (unsigned long)addr);
     }
     return 0;
 }
@@ -129,7 +125,7 @@ static void sl_writeb(void *opaque, target_phys_addr_t addr,
         break;
 
     default:
-        zaurus_printf("Bad register offset " REG_FMT "\n", addr);
+        zaurus_printf("Bad register offset " REG_FMT "\n", (unsigned long)addr);
     }
 }
 
@@ -1041,7 +1037,7 @@ static void terrier_init(ram_addr_t ram_size,
                 kernel_cmdline, initrd_filename, cpu_model, terrier, 0x33f);
 }
 
-QEMUMachine akitapda_machine = {
+static QEMUMachine akitapda_machine = {
     .name = "akita",
     .desc = "Akita PDA (PXA270)",
     .init = akita_init,
@@ -1076,19 +1072,23 @@ static void spitz_machine_init(void)
 machine_init(spitz_machine_init);
 
 static SSISlaveInfo corgi_ssp_info = {
+    .qdev.name = "corgi-ssp",
+    .qdev.size = sizeof(CorgiSSPState),
     .init = corgi_ssp_init,
     .transfer = corgi_ssp_transfer
 };
 
 static SSISlaveInfo spitz_lcdtg_info = {
+    .qdev.name = "spitz-lcdtg",
+    .qdev.size = sizeof(SpitzLCDTG),
     .init = spitz_lcdtg_init,
     .transfer = spitz_lcdtg_transfer
 };
 
 static void spitz_register_devices(void)
 {
-    ssi_register_slave("corgi-ssp", sizeof(CorgiSSPState), &corgi_ssp_info);
-    ssi_register_slave("spitz-lcdtg", sizeof(SpitzLCDTG), &spitz_lcdtg_info);
+    ssi_register_slave(&corgi_ssp_info);
+    ssi_register_slave(&spitz_lcdtg_info);
 }
 
 device_init(spitz_register_devices)
diff --git a/hw/ssd0303.c b/hw/ssd0303.c
index 5a3a29e87..6872ef5e1 100644
--- a/hw/ssd0303.c
+++ b/hw/ssd0303.c
@@ -316,6 +316,8 @@ static void ssd0303_init(i2c_slave *i2c)
 }
 
 static I2CSlaveInfo ssd0303_info = {
+    .qdev.name = "ssd0303",
+    .qdev.size = sizeof(ssd0303_state),
     .init = ssd0303_init,
     .event = ssd0303_event,
     .recv = ssd0303_recv,
@@ -324,7 +326,7 @@ static I2CSlaveInfo ssd0303_info = {
 
 static void ssd0303_register_devices(void)
 {
-    i2c_register_slave("ssd0303", sizeof(ssd0303_state), &ssd0303_info);
+    i2c_register_slave(&ssd0303_info);
 }
 
 device_init(ssd0303_register_devices)
diff --git a/hw/ssd0323.c b/hw/ssd0323.c
index c083d9a7c..319ab8724 100644
--- a/hw/ssd0323.c
+++ b/hw/ssd0323.c
@@ -339,13 +339,15 @@ static void ssd0323_init(SSISlave *dev)
 }
 
 static SSISlaveInfo ssd0323_info = {
+    .qdev.name = "ssd0323",
+    .qdev.size = sizeof(ssd0323_state),
     .init = ssd0323_init,
     .transfer = ssd0323_transfer
 };
 
 static void ssd03232_register_devices(void)
 {
-    ssi_register_slave("ssd0323", sizeof(ssd0323_state), &ssd0323_info);
+    ssi_register_slave(&ssd0323_info);
 }
 
 device_init(ssd03232_register_devices)
diff --git a/hw/ssi-sd.c b/hw/ssi-sd.c
index 3e78bd2ac..4e67f143c 100644
--- a/hw/ssi-sd.c
+++ b/hw/ssi-sd.c
@@ -241,13 +241,15 @@ static void ssi_sd_init(SSISlave *dev)
 }
 
 static SSISlaveInfo ssi_sd_info = {
+    .qdev.name = "ssi-sd",
+    .qdev.size = sizeof(ssi_sd_state),
     .init = ssi_sd_init,
     .transfer = ssi_sd_transfer
 };
 
 static void ssi_sd_register_devices(void)
 {
-    ssi_register_slave("ssi-sd", sizeof(ssi_sd_state), &ssi_sd_info);
+    ssi_register_slave(&ssi_sd_info);
 }
 
 device_init(ssi_sd_register_devices)
diff --git a/hw/ssi.c b/hw/ssi.c
index 52b7b7c59..b0bcf9715 100644
--- a/hw/ssi.c
+++ b/hw/ssi.c
@@ -29,12 +29,12 @@ static void ssi_slave_init(DeviceState *dev, DeviceInfo *base_info)
     info->init(s);
 }
 
-void ssi_register_slave(const char *name, int size, SSISlaveInfo *info)
+void ssi_register_slave(SSISlaveInfo *info)
 {
-    assert(size >= sizeof(SSISlave));
+    assert(info->qdev.size >= sizeof(SSISlave));
     info->qdev.init = ssi_slave_init;
     info->qdev.bus_type = BUS_TYPE_SSI;
-    qdev_register(name, size, &info->qdev);
+    qdev_register(&info->qdev);
 }
 
 DeviceState *ssi_create_slave(SSIBus *bus, const char *name)
diff --git a/hw/ssi.h b/hw/ssi.h
index 861c4849e..6ff71e9d3 100644
--- a/hw/ssi.h
+++ b/hw/ssi.h
@@ -30,7 +30,7 @@ struct SSISlave {
 #define SSI_SLAVE_FROM_QDEV(dev) DO_UPCAST(SSISlave, qdev, dev)
 #define FROM_SSI_SLAVE(type, dev) DO_UPCAST(type, ssidev, dev)
 
-void ssi_register_slave(const char *name, int size, SSISlaveInfo *info);
+void ssi_register_slave(SSISlaveInfo *info);
 
 DeviceState *ssi_create_slave(SSIBus *bus, const char *name);
 
diff --git a/hw/stellaris.c b/hw/stellaris.c
index 38b9830e2..bf339e8aa 100644
--- a/hw/stellaris.c
+++ b/hw/stellaris.c
@@ -1444,6 +1444,8 @@ static void stellaris_machine_init(void)
 machine_init(stellaris_machine_init);
 
 static SSISlaveInfo stellaris_ssi_bus_info = {
+    .qdev.name = "evb6965-ssi",
+    .qdev.size = sizeof(stellaris_ssi_bus_state),
     .init = stellaris_ssi_bus_init,
     .transfer = stellaris_ssi_bus_transfer
 };
@@ -1456,8 +1458,7 @@ static void stellaris_register_devices(void)
                         stellaris_gptm_init);
     sysbus_register_dev("stellaris-adc", sizeof(stellaris_adc_state),
                         stellaris_adc_init);
-    ssi_register_slave("evb6965-ssi", sizeof(stellaris_ssi_bus_state),
-                       &stellaris_ssi_bus_info);
+    ssi_register_slave(&stellaris_ssi_bus_info);
 }
 
 device_init(stellaris_register_devices)
diff --git a/hw/stellaris_enet.c b/hw/stellaris_enet.c
index f5b83e445..8586db612 100644
--- a/hw/stellaris_enet.c
+++ b/hw/stellaris_enet.c
@@ -130,9 +130,9 @@ static int stellaris_enet_can_receive(VLANClientState *vc)
     return (s->np < 31);
 }
 
-static uint32_t stellaris_enet_read(VLANClientState *vc, target_phys_addr_t offset)
+static uint32_t stellaris_enet_read(void *opaque, target_phys_addr_t offset)
 {
-    stellaris_enet_state *s = vc->opaque;
+    stellaris_enet_state *s = (stellaris_enet_state *)opaque;
     uint32_t val;
 
     switch (offset) {
diff --git a/hw/syborg_timer.c b/hw/syborg_timer.c
index b833330e5..b6d7f0cd4 100644
--- a/hw/syborg_timer.c
+++ b/hw/syborg_timer.c
@@ -228,18 +228,17 @@ static void syborg_timer_init(SysBusDevice *dev)
 
 static SysBusDeviceInfo syborg_timer_info = {
     .init = syborg_timer_init,
-    .qdev = {
-        .props = (DevicePropList[]) {
-              {.name = "frequency", .type = PROP_TYPE_INT},
-              {.name = NULL}
-        }
+    .qdev.name  = "syborg,timer",
+    .qdev.size  = sizeof(SyborgTimerState),
+    .qdev.props = (DevicePropList[]) {
+        {.name = "frequency", .type = PROP_TYPE_INT},
+        {.name = NULL}
     }
 };
 
 static void syborg_timer_register_devices(void)
 {
-    sysbus_register_withprop("syborg,timer", sizeof(SyborgTimerState),
-                            &syborg_timer_info);
+    sysbus_register_withprop(&syborg_timer_info);
 }
 
 device_init(syborg_timer_register_devices)
diff --git a/hw/sysbus.c b/hw/sysbus.c
index fbd2ddf39..ef3a7011e 100644
--- a/hw/sysbus.c
+++ b/hw/sysbus.c
@@ -105,14 +105,13 @@ static void sysbus_device_init(DeviceState *dev, DeviceInfo *base)
     info->init(sysbus_from_qdev(dev));
 }
 
-void sysbus_register_withprop(const char *name, size_t size,
-                              SysBusDeviceInfo *info)
+void sysbus_register_withprop(SysBusDeviceInfo *info)
 {
     info->qdev.init = sysbus_device_init;
     info->qdev.bus_type = BUS_TYPE_SYSTEM;
 
-    assert(size >= sizeof(SysBusDevice));
-    qdev_register(name, size, &info->qdev);
+    assert(info->qdev.size >= sizeof(SysBusDevice));
+    qdev_register(&info->qdev);
 }
 
 void sysbus_register_dev(const char *name, size_t size, sysbus_initfn init)
@@ -120,8 +119,10 @@ void sysbus_register_dev(const char *name, size_t size, sysbus_initfn init)
     SysBusDeviceInfo *info;
 
     info = qemu_mallocz(sizeof(*info));
+    info->qdev.name = qemu_strdup(name);
+    info->qdev.size = size;
     info->init = init;
-    sysbus_register_withprop(name, size, info);
+    sysbus_register_withprop(info);
 }
 
 DeviceState *sysbus_create_varargs(const char *name,
diff --git a/hw/sysbus.h b/hw/sysbus.h
index 297366166..7c20808f3 100644
--- a/hw/sysbus.h
+++ b/hw/sysbus.h
@@ -37,8 +37,7 @@ typedef struct {
 } SysBusDeviceInfo;
 
 void sysbus_register_dev(const char *name, size_t size, sysbus_initfn init);
-void sysbus_register_withprop(const char *name, size_t size,
-                              SysBusDeviceInfo *info);
+void sysbus_register_withprop(SysBusDeviceInfo *info);
 void *sysbus_new(void);
 void sysbus_init_mmio(SysBusDevice *dev, target_phys_addr_t size, int iofunc);
 void sysbus_init_mmio_cb(SysBusDevice *dev, target_phys_addr_t size,
diff --git a/hw/tmp105.c b/hw/tmp105.c
index 59b039804..5381b7d66 100644
--- a/hw/tmp105.c
+++ b/hw/tmp105.c
@@ -239,6 +239,8 @@ static void tmp105_init(i2c_slave *i2c)
 }
 
 static I2CSlaveInfo tmp105_info = {
+    .qdev.name = "tmp105",
+    .qdev.size = sizeof(TMP105State),
     .init = tmp105_init,
     .event = tmp105_event,
     .recv = tmp105_rx,
@@ -247,7 +249,7 @@ static I2CSlaveInfo tmp105_info = {
 
 static void tmp105_register_devices(void)
 {
-    i2c_register_slave("tmp105", sizeof(TMP105State), &tmp105_info);
+    i2c_register_slave(&tmp105_info);
 }
 
 device_init(tmp105_register_devices)
diff --git a/hw/tosa.c b/hw/tosa.c
index a606156e9..b2d66f39d 100644
--- a/hw/tosa.c
+++ b/hw/tosa.c
@@ -252,6 +252,8 @@ static void tosapda_machine_init(void)
 machine_init(tosapda_machine_init);
 
 static I2CSlaveInfo tosa_dac_info = {
+    .qdev.name = "tosa_dac",
+    .qdev.size = sizeof(TosaDACState),
     .init = tosa_dac_init,
     .event = tosa_dac_event,
     .recv = tosa_dac_recv,
@@ -259,14 +261,16 @@ static I2CSlaveInfo tosa_dac_info = {
 };
 
 static SSISlaveInfo tosa_ssp_info = {
+    .qdev.name = "tosa-ssp",
+    .qdev.size = sizeof(SSISlave),
     .init = tosa_ssp_init,
     .transfer = tosa_ssp_tansfer
 };
 
 static void tosa_register_devices(void)
 {
-    i2c_register_slave("tosa_dac", sizeof(TosaDACState), &tosa_dac_info);
-    ssi_register_slave("tosa-ssp", sizeof(SSISlave), &tosa_ssp_info);
+    i2c_register_slave(&tosa_dac_info);
+    ssi_register_slave(&tosa_ssp_info);
 }
 
 device_init(tosa_register_devices)
diff --git a/hw/twl92230.c b/hw/twl92230.c
index 3a226923b..9960acc8c 100644
--- a/hw/twl92230.c
+++ b/hw/twl92230.c
@@ -892,6 +892,8 @@ static void twl92230_init(i2c_slave *i2c)
 }
 
 static I2CSlaveInfo twl92230_info = {
+    .qdev.name ="twl92230",
+    .qdev.size = sizeof(MenelausState),
     .init = twl92230_init,
     .event = menelaus_event,
     .recv = menelaus_rx,
@@ -900,7 +902,7 @@ static I2CSlaveInfo twl92230_info = {
 
 static void twl92230_register_devices(void)
 {
-    i2c_register_slave("twl92230", sizeof(MenelausState), &twl92230_info);
+    i2c_register_slave(&twl92230_info);
 }
 
 device_init(twl92230_register_devices)
diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index 8dd3c7ac5..9a0c0674f 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -299,6 +299,7 @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
     stw_raw(&blkcfg.cylinders, cylinders);
     blkcfg.heads = heads;
     blkcfg.sectors = secs;
+    blkcfg.size_max = 0;
     memcpy(config, &blkcfg, sizeof(blkcfg));
 }
 
diff --git a/hw/wm8750.c b/hw/wm8750.c
index 9f5bd46de..0c0dbba58 100644
--- a/hw/wm8750.c
+++ b/hw/wm8750.c
@@ -726,6 +726,8 @@ void wm8750_set_bclk_in(void *opaque, int new_hz)
 }
 
 static I2CSlaveInfo wm8750_info = {
+    .qdev.name = "wm8750",
+    .qdev.size = sizeof(WM8750State),
     .init = wm8750_init,
     .event = wm8750_event,
     .recv = wm8750_rx,
@@ -734,7 +736,7 @@ static I2CSlaveInfo wm8750_info = {
 
 static void wm8750_register_devices(void)
 {
-    i2c_register_slave("wm8750", sizeof(WM8750State), &wm8750_info);
+    i2c_register_slave(&wm8750_info);
 }
 
 device_init(wm8750_register_devices)
diff --git a/hw/xen.h b/hw/xen.h
index 3c8da4105..780dcf713 100644
--- a/hw/xen.h
+++ b/hw/xen.h
@@ -6,6 +6,7 @@
  *   must not depend on any xen headers being present in
  *   /usr/include/xen, so it can be included unconditionally.
  */
+#include <inttypes.h>
 
 /* xen-machine.c */
 enum xen_mode {
diff --git a/hw/xen_disk.c b/hw/xen_disk.c
index f95e37312..659a839f9 100644
--- a/hw/xen_disk.c
+++ b/hw/xen_disk.c
@@ -179,10 +179,6 @@ static int ioreq_parse(struct ioreq *ioreq)
     switch (ioreq->req.operation) {
     case BLKIF_OP_READ:
 	ioreq->prot = PROT_WRITE; /* to memory */
-        if (ioreq->req.operation != BLKIF_OP_READ && blkdev->mode[0] != 'w') {
-	    xen_be_printf(&blkdev->xendev, 0, "error: write req for ro device\n");
-	    goto err;
-	}
 	break;
     case BLKIF_OP_WRITE_BARRIER:
 	if (!syncwrite)
@@ -199,6 +195,11 @@ static int ioreq_parse(struct ioreq *ioreq)
 	goto err;
     };
 
+    if (ioreq->req.operation != BLKIF_OP_READ && blkdev->mode[0] != 'w') {
+        xen_be_printf(&blkdev->xendev, 0, "error: write req for ro device\n");
+        goto err;
+    }
+
     ioreq->start = ioreq->req.sector_number * blkdev->file_blk;
     for (i = 0; i < ioreq->req.nr_segments; i++) {
 	if (i == BLKIF_MAX_SEGMENTS_PER_REQUEST) {
diff --git a/hw/xen_machine_pv.c b/hw/xen_machine_pv.c
index f59f633a8..6ae500090 100644
--- a/hw/xen_machine_pv.c
+++ b/hw/xen_machine_pv.c
@@ -32,7 +32,7 @@
 uint32_t xen_domid;
 enum xen_mode xen_mode = XEN_EMULATE;
 
-static void xen_init_pv(ram_addr_t ram_size, int vga_ram_size,
+static void xen_init_pv(ram_addr_t ram_size,
 			const char *boot_device,
 			const char *kernel_filename,
 			const char *kernel_cmdline,
diff --git a/hw/xen_nic.c b/hw/xen_nic.c
index 9a3c870c2..e4f71f7f6 100644
--- a/hw/xen_nic.c
+++ b/hw/xen_nic.c
@@ -356,6 +356,8 @@ static int net_connect(struct XenDevice *xendev)
 		  "remote port %d, local port %d\n",
 		  netdev->tx_ring_ref, netdev->rx_ring_ref,
 		  netdev->xendev.remote_port, netdev->xendev.local_port);
+
+    net_tx_packets(netdev);
     return 0;
 }
 
diff --git a/hw/xilinx_ethlite.c b/hw/xilinx_ethlite.c
index 780e9c05a..77cd6fb05 100644
--- a/hw/xilinx_ethlite.c
+++ b/hw/xilinx_ethlite.c
@@ -160,28 +160,28 @@ static CPUWriteMemoryFunc *eth_write[] = {
     NULL, NULL, &eth_writel,
 };
 
-static int eth_can_rx(void *opaque)
+static int eth_can_rx(VLANClientState *vc)
 {
-    struct xlx_ethlite *s = opaque;
+    struct xlx_ethlite *s = vc->opaque;
     int r;
     r = !(s->regs[R_RX_CTRL0] & CTRL_S);
     qemu_log("%s %d\n", __func__, r);
     return r;
 }
 
-static void eth_rx(void *opaque, const uint8_t *buf, int size)
+static ssize_t eth_rx(VLANClientState *vc, const uint8_t *buf, size_t size)
 {
-    struct xlx_ethlite *s = opaque;
+    struct xlx_ethlite *s = vc->opaque;
     unsigned int rxbase = s->rxbuf * (0x800 / 4);
     int i;
 
     /* DA filter.  */
     if (!(buf[0] & 0x80) && memcmp(&s->macaddr[0], buf, 6))
-        return;
+        return size;
 
     if (s->regs[rxbase + R_RX_CTRL0] & CTRL_S) {
         D(qemu_log("ethlite lost packet %x\n", s->regs[R_RX_CTRL0]));
-        return;
+        return -1;
     }
 
     D(qemu_log("%s %d rxbase=%x\n", __func__, size, rxbase));
@@ -199,7 +199,7 @@ static void eth_rx(void *opaque, const uint8_t *buf, int size)
 
     /* If c_rx_pingpong was set flip buffers.  */
     s->rxbuf ^= s->c_rx_pingpong;
-    return;
+    return size;
 }
 
 static void eth_cleanup(VLANClientState *vc)
@@ -223,7 +223,7 @@ static void xilinx_ethlite_init(SysBusDevice *dev)
 
     qdev_get_macaddr(&dev->qdev, s->macaddr);
     s->vc = qdev_get_vlan_client(&dev->qdev,
-                                 eth_rx, eth_can_rx, eth_cleanup, s);
+                                 eth_can_rx, eth_rx, NULL, eth_cleanup, s);
 }
 
 static void xilinx_ethlite_register(void)
diff --git a/hw/zaurus.c b/hw/zaurus.c
index 56e150d51..7cf47b9c9 100644
--- a/hw/zaurus.c
+++ b/hw/zaurus.c
@@ -21,11 +21,7 @@
 #include "sharpsl.h"
 
 #undef REG_FMT
-#if TARGET_PHYS_ADDR_BITS == 32
-#define REG_FMT			"0x%02x"
-#else
 #define REG_FMT			"0x%02lx"
-#endif
 
 /* SCOOP devices */
 
@@ -98,7 +94,7 @@ static uint32_t scoop_readb(void *opaque, target_phys_addr_t addr)
     case SCOOP_GPRR:
         return s->gpio_level;
     default:
-        zaurus_printf("Bad register offset " REG_FMT "\n", addr);
+        zaurus_printf("Bad register offset " REG_FMT "\n", (unsigned long)addr);
     }
 
     return 0;
@@ -143,7 +139,7 @@ static void scoop_writeb(void *opaque, target_phys_addr_t addr, uint32_t value)
         scoop_gpio_handler_update(s);
         break;
     default:
-        zaurus_printf("Bad register offset " REG_FMT "\n", addr);
+        zaurus_printf("Bad register offset " REG_FMT "\n", (unsigned long)addr);
     }
 }
 
diff --git a/loader.c b/loader.c
index 5232ee12a..9350c541d 100644
--- a/loader.c
+++ b/loader.c
@@ -382,7 +382,7 @@ static void *zalloc(void *x, unsigned items, unsigned size)
     return (p);
 }
 
-static void zfree(void *x, void *addr, unsigned nb)
+static void zfree(void *x, void *addr)
 {
     qemu_free(addr);
 }
@@ -430,7 +430,7 @@ static ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src,
     }
 
     s.zalloc = zalloc;
-    s.zfree = (free_func)zfree;
+    s.zfree = zfree;
 
     r = inflateInit2(&s, -MAX_WBITS);
     if (r != Z_OK) {
diff --git a/migration.c b/migration.c
index 401383cf0..57f2a5293 100644
--- a/migration.c
+++ b/migration.c
@@ -301,5 +301,7 @@ void migrate_fd_wait_for_unfreeze(void *opaque)
 int migrate_fd_close(void *opaque)
 {
     FdMigrationState *s = opaque;
+
+    qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
     return s->close(s);
 }
diff --git a/net.c b/net.c
index ab9126442..567dcdc18 100644
--- a/net.c
+++ b/net.c
@@ -685,7 +685,9 @@ static const char *slirp_smb_export;
 #endif
 static VLANClientState *slirp_vc;
 
+#ifndef _WIN32
 static void slirp_smb(const char *exported_dir);
+#endif
 static void slirp_redirection(Monitor *mon, const char *redir_str);
 
 int slirp_can_output(void)
@@ -1661,7 +1663,7 @@ static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf,
 {
     NetSocketState *s = vc->opaque;
 
-    return sendto(s->fd, buf, size, 0,
+    return sendto(s->fd, (const void *)buf, size, 0,
                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
 }
 
@@ -1673,7 +1675,7 @@ static void net_socket_send(void *opaque)
     uint8_t buf1[4096];
     const uint8_t *buf;
 
-    size = recv(s->fd, buf1, sizeof(buf1), 0);
+    size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
     if (size < 0) {
         err = socket_error();
         if (err != EWOULDBLOCK)
@@ -1735,7 +1737,7 @@ static void net_socket_send_dgram(void *opaque)
     NetSocketState *s = opaque;
     int size;
 
-    size = recv(s->fd, s->buf, sizeof(s->buf), 0);
+    size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
     if (size < 0)
         return;
     if (size == 0) {
diff --git a/qemu-aio.h b/qemu-aio.h
index 79678293e..f262344af 100644
--- a/qemu-aio.h
+++ b/qemu-aio.h
@@ -24,9 +24,10 @@ typedef int (AioFlushHandler)(void *opaque);
  * outstanding AIO operations have been completed or cancelled. */
 void qemu_aio_flush(void);
 
-/* Wait for a single AIO completion to occur.  This function will until a
- * single AIO opeartion has completed.  It is intended to be used as a looping
- * primative when simulating synchronous IO based on asynchronous IO. */
+/* Wait for a single AIO completion to occur.  This function will wait
+ * until a single AIO event has completed and it will ensure something
+ * has moved before returning. This can issue new pending aio as
+ * result of executing I/O completion or bh callbacks. */
 void qemu_aio_wait(void);
 
 /* Register a file descriptor and associated callbacks.  Behaves very similarly
diff --git a/qemu-char.c b/qemu-char.c
index 1c0c9f5df..a8afe94fa 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -1708,7 +1708,7 @@ static int udp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
 {
     NetCharDriver *s = chr->opaque;
 
-    return sendto(s->fd, buf, len, 0,
+    return sendto(s->fd, (const void *)buf, len, 0,
                   (struct sockaddr *)&s->daddr, sizeof(struct sockaddr_in));
 }
 
@@ -1737,7 +1737,7 @@ static void udp_chr_read(void *opaque)
 
     if (s->max_size == 0)
         return;
-    s->bufcnt = recv(s->fd, s->buf, sizeof(s->buf), 0);
+    s->bufcnt = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
     s->bufptr = s->bufcnt;
     if (s->bufcnt <= 0)
         return;
@@ -1913,7 +1913,7 @@ static void tcp_chr_read(void *opaque)
     len = sizeof(buf);
     if (len > s->max_size)
         len = s->max_size;
-    size = recv(s->fd, buf, len, 0);
+    size = recv(s->fd, (void *)buf, len, 0);
     if (size == 0) {
         /* connection closed */
         s->connected = 0;
diff --git a/qemu-nbd.c b/qemu-nbd.c
index 0af97ca2c..910148712 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -345,8 +345,12 @@ int main(int argc, char **argv)
         pid_t pid;
         int sock;
 
-        if (!verbose)
-            daemon(0, 0);	/* detach client and server */
+        if (!verbose) {
+            /* detach client and server */
+            if (daemon(0, 0) == -1) {
+                errx(errno, "Failed to daemonize");
+            }
+        }
 
         if (socket == NULL) {
             sprintf(sockpath, SOCKET_PATH, basename(device));
diff --git a/qemu-options.hx b/qemu-options.hx
index edd99dba5..c5aed0ebb 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -682,6 +682,15 @@ Disable HPET support.
 ETEXI
 
 #ifdef TARGET_I386
+DEF("no-virtio-balloon", 0, QEMU_OPTION_no_virtio_balloon,
+    "-no-virtio-balloon disable virtio balloon device\n")
+#endif
+STEXI
+@item -no-virtio-balloon
+Disable virtio-balloon device.
+ETEXI
+
+#ifdef TARGET_I386
 DEF("acpitable", HAS_ARG, QEMU_OPTION_acpitable,
     "-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,data=file1[:file2]...]\n"
     "                ACPI table description\n")
diff --git a/savevm.c b/savevm.c
index cae711762..17da35a9f 100644
--- a/savevm.c
+++ b/savevm.c
@@ -190,7 +190,7 @@ static int socket_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
     ssize_t len;
 
     do {
-        len = recv(s->fd, buf, size, 0);
+        len = recv(s->fd, (void *)buf, size, 0);
     } while (len == -1 && socket_error() == EINTR);
 
     if (len == -1)
@@ -215,7 +215,14 @@ static int popen_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, int s
 static int popen_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
 {
     QEMUFilePopen *s = opaque;
-    return fread(buf, 1, size, s->popen_file);
+    FILE *fp = s->popen_file;
+    int bytes;
+
+    do {
+        clearerr(fp);
+        bytes = fread(buf, 1, size, fp);
+    } while ((bytes == 0) && ferror(fp) && (errno == EINTR));
+    return bytes;
 }
 
 static int popen_close(void *opaque)
diff --git a/slirp/misc.c b/slirp/misc.c
index 0137e75ed..1391d491d 100644
--- a/slirp/misc.c
+++ b/slirp/misc.c
@@ -778,7 +778,7 @@ fd_nonblock(int fd)
 {
 #ifdef FIONBIO
 #ifdef _WIN32
-        long opt = 1;
+        unsigned long opt = 1;
 #else
         int opt = 1;
 #endif
@@ -797,7 +797,11 @@ void
 fd_block(int fd)
 {
 #ifdef FIONBIO
+#ifdef _WIN32
+        unsigned long opt = 0;
+#else
 	int opt = 0;
+#endif
 
 	ioctlsocket(fd, FIONBIO, &opt);
 #else
diff --git a/slirp/socket.c b/slirp/socket.c
index 098132a1b..82d026c70 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -474,7 +474,12 @@ sorecvfrom(struct socket *so)
 	  udp_detach(so);
 	} else {                            	/* A "normal" UDP packet */
 	  struct mbuf *m;
-	  int len, n;
+          int len;
+#ifdef _WIN32
+          unsigned long n;
+#else
+          int n;
+#endif
 
 	  if (!(m = m_get())) return;
 	  m->m_data += IF_MAXLINKHDR;
diff --git a/sysemu.h b/sysemu.h
index 36fd50a2c..686228d11 100644
--- a/sysemu.h
+++ b/sysemu.h
@@ -117,6 +117,7 @@ extern int win2k_install_hack;
 extern int rtc_td_hack;
 extern int alt_grab;
 extern int usb_enabled;
+extern int no_virtio_balloon;
 extern int smp_cpus;
 extern int cursor_hide;
 extern int graphic_rotate;
diff --git a/target-cris/translate.c b/target-cris/translate.c
index 6a442813a..fd9380cf6 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -2392,7 +2392,7 @@ static unsigned int dec_test_m(DisasContext *dc)
 	TCGv t[2];
 	int memsize = memsize_zz(dc);
 	int insn_len;
-	LOG_DIS("test.%d [$r%u%s] op2=%x\n",
+	LOG_DIS("test.%c [$r%u%s] op2=%x\n",
 		    memsize_char(memsize),
 		    dc->op1, dc->postinc ? "+]" : "]",
 		    dc->op2);
@@ -2416,7 +2416,7 @@ static unsigned int dec_and_m(DisasContext *dc)
 	TCGv t[2];
 	int memsize = memsize_zz(dc);
 	int insn_len;
-	LOG_DIS("and.%d [$r%u%s, $r%u\n",
+	LOG_DIS("and.%c [$r%u%s, $r%u\n",
 		    memsize_char(memsize),
 		    dc->op1, dc->postinc ? "+]" : "]",
 		    dc->op2);
@@ -2435,7 +2435,7 @@ static unsigned int dec_add_m(DisasContext *dc)
 	TCGv t[2];
 	int memsize = memsize_zz(dc);
 	int insn_len;
-	LOG_DIS("add.%d [$r%u%s, $r%u\n",
+	LOG_DIS("add.%c [$r%u%s, $r%u\n",
 		    memsize_char(memsize),
 		    dc->op1, dc->postinc ? "+]" : "]",
 		    dc->op2);
@@ -2455,7 +2455,7 @@ static unsigned int dec_addo_m(DisasContext *dc)
 	TCGv t[2];
 	int memsize = memsize_zz(dc);
 	int insn_len;
-	LOG_DIS("add.%d [$r%u%s, $r%u\n",
+	LOG_DIS("add.%c [$r%u%s, $r%u\n",
 		    memsize_char(memsize),
 		    dc->op1, dc->postinc ? "+]" : "]",
 		    dc->op2);
@@ -2474,7 +2474,7 @@ static unsigned int dec_bound_m(DisasContext *dc)
 	TCGv l[2];
 	int memsize = memsize_zz(dc);
 	int insn_len;
-	LOG_DIS("bound.%d [$r%u%s, $r%u\n",
+	LOG_DIS("bound.%c [$r%u%s, $r%u\n",
 		    memsize_char(memsize),
 		    dc->op1, dc->postinc ? "+]" : "]",
 		    dc->op2);
@@ -2537,7 +2537,7 @@ static unsigned int dec_or_m(DisasContext *dc)
 	TCGv t[2];
 	int memsize = memsize_zz(dc);
 	int insn_len;
-	LOG_DIS("or.%d [$r%u%s, $r%u pc=%x\n",
+	LOG_DIS("or.%c [$r%u%s, $r%u pc=%x\n",
 		    memsize_char(memsize),
 		    dc->op1, dc->postinc ? "+]" : "]",
 		    dc->op2, dc->pc);
@@ -2692,8 +2692,8 @@ static unsigned int dec_move_rm(DisasContext *dc)
 
 	memsize = memsize_zz(dc);
 
-	LOG_DIS("move.%d $r%u, [$r%u]\n",
-		     memsize, dc->op2, dc->op1);
+	LOG_DIS("move.%c $r%u, [$r%u]\n",
+		     memsize_char(memsize), dc->op2, dc->op1);
 
 	/* prepare store.  */
 	cris_flush_cc_state(dc);
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 4b89d29c7..451931988 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -67,10 +67,12 @@ void cpu_save(QEMUFile *f, void *opaque)
                           (env->tlb->mmu.r4k.tlb[i].V1 << 2) |
                           (env->tlb->mmu.r4k.tlb[i].D0 << 1) |
                           (env->tlb->mmu.r4k.tlb[i].D1 << 0));
+        uint8_t asid;
 
         qemu_put_betls(f, &env->tlb->mmu.r4k.tlb[i].VPN);
         qemu_put_be32s(f, &env->tlb->mmu.r4k.tlb[i].PageMask);
-        qemu_put_8s(f, &env->tlb->mmu.r4k.tlb[i].ASID);
+        asid = env->tlb->mmu.r4k.tlb[i].ASID;
+        qemu_put_8s(f, &asid);
         qemu_put_be16s(f, &flags);
         qemu_put_betls(f, &env->tlb->mmu.r4k.tlb[i].PFN[0]);
         qemu_put_betls(f, &env->tlb->mmu.r4k.tlb[i].PFN[1]);
@@ -210,10 +212,12 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_be32s(f, &env->tlb->tlb_in_use);
     for(i = 0; i < MIPS_TLB_MAX; i++) {
         uint16_t flags;
+        uint8_t asid;
 
         qemu_get_betls(f, &env->tlb->mmu.r4k.tlb[i].VPN);
         qemu_get_be32s(f, &env->tlb->mmu.r4k.tlb[i].PageMask);
-        qemu_get_8s(f, &env->tlb->mmu.r4k.tlb[i].ASID);
+        qemu_get_8s(f, &asid);
+        env->tlb->mmu.r4k.tlb[i].ASID = asid;
         qemu_get_be16s(f, &flags);
         env->tlb->mmu.r4k.tlb[i].G = (flags >> 10) & 1;
         env->tlb->mmu.r4k.tlb[i].C0 = (flags >> 7) & 3;
diff --git a/target-ppc/op_helper.c b/target-ppc/op_helper.c
index 56fab9cb0..94e530327 100644
--- a/target-ppc/op_helper.c
+++ b/target-ppc/op_helper.c
@@ -1974,7 +1974,21 @@ target_ulong helper_dlmzb (target_ulong high, target_ulong low, uint32_t update_
 SATCVT(sh, sb, int16_t, int8_t, INT8_MIN, INT8_MAX, 1, 1)
 SATCVT(sw, sh, int32_t, int16_t, INT16_MIN, INT16_MAX, 1, 1)
 SATCVT(sd, sw, int64_t, int32_t, INT32_MIN, INT32_MAX, 1, 1)
-SATCVT(uh, ub, uint16_t, uint8_t, 0, UINT8_MAX, 0, 1)
+
+/* Work around gcc problems with the macro version */
+static always_inline uint8_t cvtuhub(uint16_t x, int *sat)
+{
+    uint8_t r;
+
+    if (x > UINT8_MAX) {
+        r = UINT8_MAX;
+        *sat = 1;
+    } else {
+        r = x;
+    }
+    return r;
+}
+//SATCVT(uh, ub, uint16_t, uint8_t, 0, UINT8_MAX, 0, 1)
 SATCVT(uw, uh, uint32_t, uint16_t, 0, UINT16_MAX, 0, 1)
 SATCVT(ud, uw, uint64_t, uint32_t, 0, UINT32_MAX, 0, 1)
 SATCVT(sh, ub, int16_t, uint8_t, 0, UINT8_MAX, 1, 1)
diff --git a/vl.c b/vl.c
index c08299ce3..0b9f7ea20 100644
--- a/vl.c
+++ b/vl.c
@@ -114,7 +114,7 @@
 
 #ifdef CONFIG_SDL
 #ifdef __APPLE__
-#include <SDL/SDL.h>
+#include <SDL.h>
 int qemu_main(int argc, char **argv, char **envp);
 int main(int argc, char **argv)
 {
@@ -249,6 +249,7 @@ int smp_cpus = 1;
 const char *vnc_display;
 int acpi_enabled = 1;
 int no_hpet = 0;
+int no_virtio_balloon = 0;
 int fd_bootchk = 1;
 int no_reboot = 0;
 int no_shutdown = 0;
@@ -5661,6 +5662,9 @@ int main(int argc, char **argv, char **envp)
             case QEMU_OPTION_no_hpet:
                 no_hpet = 1;
                 break;
+            case QEMU_OPTION_no_virtio_balloon:
+                no_virtio_balloon = 1;
+                break;
 #endif
             case QEMU_OPTION_no_reboot:
                 no_reboot = 1;
diff --git a/vnc.c b/vnc.c
index dbbeb144c..e1ca9f8c7 100644
--- a/vnc.c
+++ b/vnc.c
@@ -961,7 +961,7 @@ long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
         }
     } else
 #endif /* CONFIG_VNC_TLS */
-        ret = send(vs->csock, data, datalen, 0);
+        ret = send(vs->csock, (const void *)data, datalen, 0);
     VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
     return vnc_client_io_error(vs, ret, socket_error());
 }
@@ -1066,7 +1066,7 @@ long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
         }
     } else
 #endif /* CONFIG_VNC_TLS */
-        ret = recv(vs->csock, data, datalen, 0);
+        ret = recv(vs->csock, (void *)data, datalen, 0);
     VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
     return vnc_client_io_error(vs, ret, socket_error());
 }