From f94a950f790aabb33fcb75f0a4a3bbaaa6e3810b Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 22 Nov 2011 11:59:06 +0100
Subject: [PATCH 01/35] console: Clean up confusing indentation in
 console_putchar()

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 console.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/console.c b/console.c
index f6fe44195b..374fcba4b5 100644
--- a/console.c
+++ b/console.c
@@ -1009,16 +1009,16 @@ static void console_putchar(TextConsole *s, int ch)
                             console_clear_xy(s, x, y);
                         }
                     }
-                break;
+                    break;
                 }
             case 'K':
                 switch (s->esc_params[0]) {
                 case 0:
-                /* clear to eol */
-                for(x = s->x; x < s->width; x++) {
+                    /* clear to eol */
+                    for(x = s->x; x < s->width; x++) {
                         console_clear_xy(s, x, s->y);
-                }
-                break;
+                    }
+                    break;
                 case 1:
                     /* clear from beginning of line */
                     for (x = 0; x <= s->x; x++) {
@@ -1030,12 +1030,12 @@ static void console_putchar(TextConsole *s, int ch)
                     for(x = 0; x < s->width; x++) {
                         console_clear_xy(s, x, s->y);
                     }
-                break;
-            }
+                    break;
+                }
                 break;
             case 'm':
-            console_handle_escape(s);
-            break;
+                console_handle_escape(s);
+                break;
             case 'n':
                 /* report cursor position */
                 /* TODO: send ESC[row;colR */

From 95d8f9f41c313c458dd34e0a54162c414a352111 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 22 Nov 2011 11:59:07 +0100
Subject: [PATCH 02/35] console: Fix console_putchar() for CSI J

It falls through to the code for CSI K.  "Erase Down" also does "Erase
End of Line", "Erase Up" also does "Erase Start of Line", and "Erase
Screen" also does "Erase Line".  Happens not to be visible.  Fix it
anyway.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 console.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/console.c b/console.c
index 374fcba4b5..ce0429df8c 100644
--- a/console.c
+++ b/console.c
@@ -1011,6 +1011,7 @@ static void console_putchar(TextConsole *s, int ch)
                     }
                     break;
                 }
+                break;
             case 'K':
                 switch (s->esc_params[0]) {
                 case 0:

From 0eba62e03292ff91201358fd544cadfbff36f1bf Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 22 Nov 2011 12:56:10 +0100
Subject: [PATCH 03/35] console: Fix qemu_default_pixelformat() for 24 bpp

Falls through to 32 bpp.  Harmless, because the only difference is the
alpha component, and we're not using that.  Spotted by Coverity.

Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 console.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/console.c b/console.c
index ce0429df8c..223f8fd9a4 100644
--- a/console.c
+++ b/console.c
@@ -1688,6 +1688,7 @@ PixelFormat qemu_default_pixelformat(int bpp)
             pf.rbits = 8;
             pf.gbits = 8;
             pf.bbits = 8;
+            break;
         case 32:
             pf.rmask = 0x00FF0000;
             pf.gmask = 0x0000FF00;

From fd786e1aee5d3a0a304fccaa5cb6ae2cbbeb435e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 23 Nov 2011 17:26:43 +0000
Subject: [PATCH 04/35] configure: Include #define name in check_define
 compiler error

Include the name of the #define being tested for in the compiler
error produced when a check_define test is run and fails. This
appears only in the config.log, but it does make it a little easier
to debug problems by inspecting config.log.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 configure | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index 5fbd81285f..c98aed1c64 100755
--- a/configure
+++ b/configure
@@ -249,7 +249,7 @@ source_path=`cd "$source_path"; pwd`
 check_define() {
 cat > $TMPC <<EOF
 #if !defined($1)
-#error Not defined
+#error $1 not defined
 #endif
 int main(void) { return 0; }
 EOF

From b48e361194530539d3d420528b9c29a3287b77dd Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 23 Nov 2011 17:26:44 +0000
Subject: [PATCH 05/35] configure: Print a banner comment at the top of
 config.log

Print a banner comment at the top of config.log identifying
when configure was run and the arguments used. This is occasionally
useful for debugging purposes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 configure | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/configure b/configure
index c98aed1c64..452b8cf036 100755
--- a/configure
+++ b/configure
@@ -20,6 +20,11 @@ TMPE="${TMPDIR1}/qemu-conf-${RANDOM}-$$-${RANDOM}.exe"
 trap "rm -f $TMPC $TMPO $TMPE" EXIT INT QUIT TERM
 rm -f config.log
 
+# Print a helpful header at the top of config.log
+echo "# QEMU configure log $(date)" >> config.log
+echo "# produced by $0 $*" >> config.log
+echo "#" >> config.log
+
 compile_object() {
   echo $cc $QEMU_CFLAGS -c -o $TMPO $TMPC >> config.log
   $cc $QEMU_CFLAGS -c -o $TMPO $TMPC >> config.log 2>&1

From c7ee8f683d93c7ea346a5eb86495da672ce7e7da Mon Sep 17 00:00:00 2001
From: Zhi Hui Li <zhihuili@linux.vnet.ibm.com>
Date: Thu, 24 Nov 2011 16:23:00 +0800
Subject: [PATCH 06/35] net/socket.c : fix memory leak

Signed-off-by: Li Zhi Hui <zhihuili@linux.vnet.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 net/socket.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/socket.c b/net/socket.c
index e9ef12877f..0f091645ed 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -409,6 +409,7 @@ static int net_socket_listen_init(VLANState *vlan,
     fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
     if (fd < 0) {
         perror("socket");
+        g_free(s);
         return -1;
     }
     socket_set_nonblock(fd);
@@ -420,11 +421,13 @@ static int net_socket_listen_init(VLANState *vlan,
     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
     if (ret < 0) {
         perror("bind");
+        g_free(s);
         return -1;
     }
     ret = listen(fd, 0);
     if (ret < 0) {
         perror("listen");
+        g_free(s);
         return -1;
     }
     s->vlan = vlan;

From 91a9ecefb6d7f066c6eecc09f7231ce7969d1817 Mon Sep 17 00:00:00 2001
From: Zhi Hui Li <zhihuili@linux.vnet.ibm.com>
Date: Thu, 24 Nov 2011 16:27:52 +0800
Subject: [PATCH 07/35] win32: fix memory leak

string is allocated by g_malloc, will not be used after putenv, should be
free before return.

Paolo Bonzini <pbonzini@redhat.com> confirmed this is safe under Wine:

"1) the underlying Win32 APIs require separate arguments for the
variable and value; 2) even though in the end Wine stores the
environment as name=value
(http://source.winehq.org/source/dlls/ntdll/env.c), it does so in a
single consecutive block of memory, not as a char* array like POSIX
does.  While (2) might apply only to Wine, (1) surely applies to Windows
as well."

Tested-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Li Zhi Hui <zhihuili@linux.vnet.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 os-win32.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/os-win32.c b/os-win32.c
index 8ad5fa1fc3..8523d8d0c4 100644
--- a/os-win32.c
+++ b/os-win32.c
@@ -44,6 +44,13 @@ int setenv(const char *name, const char *value, int overwrite)
         char *string = g_malloc(length);
         snprintf(string, length, "%s=%s", name, value);
         result = putenv(string);
+
+        /* Windows takes a copy and does not continue to use our string.
+         * Therefore it can be safely freed on this platform.  POSIX code
+         * typically has to leak the string because according to the spec it
+         * becomes part of the environment.
+         */
+        g_free(string);
     }
     return result;
 }

From 3a93113a002db694657fcf24ff0c96aef83303b8 Mon Sep 17 00:00:00 2001
From: Dong Xu Wang <wdongxu@linux.vnet.ibm.com>
Date: Tue, 29 Nov 2011 16:52:38 +0800
Subject: [PATCH 08/35] fix typo: delete redundant semicolon

Double semicolons should be single.

Signed-off-by: Dong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 block/nbd.c                | 4 ++--
 cpus.c                     | 2 +-
 hw/9pfs/codir.c            | 6 +++---
 hw/9pfs/virtio-9p-handle.c | 2 +-
 hw/9pfs/virtio-9p.c        | 4 ++--
 hw/acpi.c                  | 2 +-
 hw/eepro100.c              | 2 +-
 hw/ide/via.c               | 2 +-
 hw/ppc.c                   | 2 +-
 hw/smc91c111.c             | 2 +-
 linux-user/syscall.c       | 2 +-
 net/tap-solaris.c          | 2 +-
 target-s390x/op_helper.c   | 4 ++--
 ui/vnc.c                   | 2 +-
 usb-redir.c                | 4 ++--
 15 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/block/nbd.c b/block/nbd.c
index 882b2dc84a..95212dac64 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -189,7 +189,7 @@ static int nbd_read(BlockDriverState *bs, int64_t sector_num,
 
     request.type = NBD_CMD_READ;
     request.handle = (uint64_t)(intptr_t)bs;
-    request.from = sector_num * 512;;
+    request.from = sector_num * 512;
     request.len = nb_sectors * 512;
 
     if (nbd_send_request(s->sock, &request) == -1)
@@ -219,7 +219,7 @@ static int nbd_write(BlockDriverState *bs, int64_t sector_num,
 
     request.type = NBD_CMD_WRITE;
     request.handle = (uint64_t)(intptr_t)bs;
-    request.from = sector_num * 512;;
+    request.from = sector_num * 512;
     request.len = nb_sectors * 512;
 
     if (nbd_send_request(s->sock, &request) == -1)
diff --git a/cpus.c b/cpus.c
index ca46ec6523..a53276ac32 100644
--- a/cpus.c
+++ b/cpus.c
@@ -89,7 +89,7 @@ TimersState timers_state;
 int64_t cpu_get_icount(void)
 {
     int64_t icount;
-    CPUState *env = cpu_single_env;;
+    CPUState *env = cpu_single_env;
 
     icount = qemu_icount;
     if (env) {
diff --git a/hw/9pfs/codir.c b/hw/9pfs/codir.c
index 9b6d47d91d..3d188284ba 100644
--- a/hw/9pfs/codir.c
+++ b/hw/9pfs/codir.c
@@ -90,7 +90,7 @@ int v9fs_co_mkdir(V9fsPDU *pdu, V9fsFidState *fidp, V9fsString *name,
     V9fsState *s = pdu->s;
 
     if (v9fs_request_cancelled(pdu)) {
-        return -EINTR;;
+        return -EINTR;
     }
     cred_init(&cred);
     cred.fc_mode = mode;
@@ -124,7 +124,7 @@ int v9fs_co_opendir(V9fsPDU *pdu, V9fsFidState *fidp)
     V9fsState *s = pdu->s;
 
     if (v9fs_request_cancelled(pdu)) {
-        return -EINTR;;
+        return -EINTR;
     }
     v9fs_path_read_lock(s);
     v9fs_co_run_in_worker(
@@ -152,7 +152,7 @@ int v9fs_co_closedir(V9fsPDU *pdu, V9fsFidOpenState *fs)
     V9fsState *s = pdu->s;
 
     if (v9fs_request_cancelled(pdu)) {
-        return -EINTR;;
+        return -EINTR;
     }
     v9fs_co_run_in_worker(
         {
diff --git a/hw/9pfs/virtio-9p-handle.c b/hw/9pfs/virtio-9p-handle.c
index f97d8984bd..755e8e0f47 100644
--- a/hw/9pfs/virtio-9p-handle.c
+++ b/hw/9pfs/virtio-9p-handle.c
@@ -59,7 +59,7 @@ static inline int open_by_handle(int mountfd, const char *fh, int flags)
 static int handle_update_file_cred(int dirfd, const char *name, FsCred *credp)
 {
     int fd, ret;
-    fd = openat(dirfd, name, O_NONBLOCK | O_NOFOLLOW);;
+    fd = openat(dirfd, name, O_NONBLOCK | O_NOFOLLOW);
     if (fd < 0) {
         return fd;
     }
diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c
index dd432091ff..36a862f1f1 100644
--- a/hw/9pfs/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -1492,7 +1492,7 @@ static void v9fs_walk(void *opaque)
     int32_t fid, newfid;
     V9fsString *wnames = NULL;
     V9fsFidState *fidp;
-    V9fsFidState *newfidp = NULL;;
+    V9fsFidState *newfidp = NULL;
     V9fsPDU *pdu = opaque;
     V9fsState *s = pdu->s;
 
@@ -2398,7 +2398,7 @@ static void v9fs_link(void *opaque)
     V9fsState *s = pdu->s;
     int32_t dfid, oldfid;
     V9fsFidState *dfidp, *oldfidp;
-    V9fsString name;;
+    V9fsString name;
     size_t offset = 7;
     int err = 0;
 
diff --git a/hw/acpi.c b/hw/acpi.c
index 1cf35e116a..9c35f2d510 100644
--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -304,7 +304,7 @@ void acpi_pm_tmr_calc_overflow_time(ACPIPMTimer *tmr)
 
 uint32_t acpi_pm_tmr_get(ACPIPMTimer *tmr)
 {
-    uint32_t d = acpi_pm_tmr_get_clock();;
+    uint32_t d = acpi_pm_tmr_get_clock();
     return d & 0xffffff;
 }
 
diff --git a/hw/eepro100.c b/hw/eepro100.c
index 29ec5b44f8..e430f56b29 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -258,7 +258,7 @@ typedef struct {
 
     /* Data in mem is always in the byte order of the controller (le).
      * It must be dword aligned to allow direct access to 32 bit values. */
-    uint8_t mem[PCI_MEM_SIZE] __attribute__((aligned(8)));;
+    uint8_t mem[PCI_MEM_SIZE] __attribute__((aligned(8)));
 
     /* Configuration bytes. */
     uint8_t configuration[22];
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 098f150bb2..a57134c12a 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -172,7 +172,7 @@ static void vt82c686b_init_ports(PCIIDEState *d) {
 /* via ide func */
 static int vt82c686b_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);;
+    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
     uint8_t *pci_conf = d->dev.config;
 
     pci_config_set_prog_interface(pci_conf, 0x8a); /* legacy ATA mode */
diff --git a/hw/ppc.c b/hw/ppc.c
index d29af0bb35..59882e2ecd 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -1153,7 +1153,7 @@ void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
 /* NVRAM helpers */
 static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
 {
-    return (*nvram->read_fn)(nvram->opaque, addr);;
+    return (*nvram->read_fn)(nvram->opaque, addr);
 }
 
 static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
diff --git a/hw/smc91c111.c b/hw/smc91c111.c
index 9a3eddf25d..82b8811459 100644
--- a/hw/smc91c111.c
+++ b/hw/smc91c111.c
@@ -429,7 +429,7 @@ static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
             smc91c111_update(s);
             return;
         }
-        break;;
+        break;
 
     case 3:
         switch (offset) {
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index f227097801..c84cc65f7a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2377,7 +2377,7 @@ static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
         return -TARGET_EFAULT;
     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
-        return -TARGET_EFAULT;;
+        return -TARGET_EFAULT;
     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
     target_sd->sem_otime = tswapal(host_sd->sem_otime);
     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index c216d28267..cf764634ef 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -65,7 +65,7 @@ static int tap_alloc(char *dev, size_t dev_size)
     static int arp_fd = 0;
     int ip_muxid, arp_muxid;
     struct strioctl  strioc_if, strioc_ppa;
-    int link_type = I_PLINK;;
+    int link_type = I_PLINK;
     struct lifreq ifr;
     char actual_name[32] = "";
 
diff --git a/target-s390x/op_helper.c b/target-s390x/op_helper.c
index 137bae74a0..b8a1a8a54f 100644
--- a/target-s390x/op_helper.c
+++ b/target-s390x/op_helper.c
@@ -1336,7 +1336,7 @@ void HELPER(meeb)(uint32_t f1, uint32_t val)
 uint32_t HELPER(cebr)(uint32_t f1, uint32_t f2)
 {
     float32 v1 = env->fregs[f1].l.upper;
-    float32 v2 = env->fregs[f2].l.upper;;
+    float32 v2 = env->fregs[f2].l.upper;
     HELPER_LOG("%s: comparing 0x%d from f%d and 0x%d\n", __FUNCTION__,
                v1, f1, v2);
     return set_cc_f32(v1, v2);
@@ -1346,7 +1346,7 @@ uint32_t HELPER(cebr)(uint32_t f1, uint32_t f2)
 uint32_t HELPER(cdbr)(uint32_t f1, uint32_t f2)
 {
     float64 v1 = env->fregs[f1].d;
-    float64 v2 = env->fregs[f2].d;;
+    float64 v2 = env->fregs[f2].d;
     HELPER_LOG("%s: comparing 0x%ld from f%d and 0x%ld\n", __FUNCTION__,
                v1, f1, v2);
     return set_cc_f64(v1, v2);
diff --git a/ui/vnc.c b/ui/vnc.c
index e85ee66fb0..6767ada7d2 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2183,7 +2183,7 @@ static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
 
 #ifdef CONFIG_VNC_TLS
        case VNC_AUTH_VENCRYPT:
-           VNC_DEBUG("Accept VeNCrypt auth\n");;
+           VNC_DEBUG("Accept VeNCrypt auth\n");
            start_auth_vencrypt(vs);
            break;
 #endif /* CONFIG_VNC_TLS */
diff --git a/usb-redir.c b/usb-redir.c
index fb91c926a9..a36f2a7cda 100644
--- a/usb-redir.c
+++ b/usb-redir.c
@@ -542,9 +542,9 @@ static int usbredir_handle_data(USBDevice *udev, USBPacket *p)
     case USB_ENDPOINT_XFER_ISOC:
         return usbredir_handle_iso_data(dev, p, ep);
     case USB_ENDPOINT_XFER_BULK:
-        return usbredir_handle_bulk_data(dev, p, ep);;
+        return usbredir_handle_bulk_data(dev, p, ep);
     case USB_ENDPOINT_XFER_INT:
-        return usbredir_handle_interrupt_data(dev, p, ep);;
+        return usbredir_handle_interrupt_data(dev, p, ep);
     default:
         ERROR("handle_data ep %02X has unknown type %d\n", ep,
               dev->endpoint[EP2I(ep)].type);

From 66a0a2cb81fb9d0e4e372a21cb62c1d0d877b112 Mon Sep 17 00:00:00 2001
From: Dong Xu Wang <wdongxu@linux.vnet.ibm.com>
Date: Tue, 29 Nov 2011 16:52:39 +0800
Subject: [PATCH 09/35] fix spelling in hw sub directory

Correct obvious spelling errors in qemu/hw directory.

Signed-off-by: Dong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hw/9pfs/virtio-9p-coth.h   | 2 +-
 hw/9pfs/virtio-9p-handle.c | 2 +-
 hw/alpha_dp264.c           | 2 +-
 hw/arm_gic.c               | 2 +-
 hw/bt-hci-csr.c            | 2 +-
 hw/cirrus_vga.c            | 2 +-
 hw/e1000_hw.h              | 2 +-
 hw/etraxfs_dma.c           | 2 +-
 hw/etraxfs_pic.c           | 2 +-
 hw/fmopl.c                 | 8 ++++----
 hw/gusemu.h                | 2 +-
 hw/gusemu_hal.c            | 4 ++--
 hw/ide/core.c              | 2 +-
 hw/lan9118.c               | 4 ++--
 hw/omap2.c                 | 6 +++---
 hw/pc.c                    | 2 +-
 hw/pcie_aer.c              | 2 +-
 hw/pl110.c                 | 2 +-
 hw/pl181.c                 | 4 ++--
 hw/sh7750_regs.h           | 2 +-
 hw/spapr.h                 | 2 +-
 hw/wdt_ib700.c             | 2 +-
 22 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/hw/9pfs/virtio-9p-coth.h b/hw/9pfs/virtio-9p-coth.h
index c4b74b0221..c31c96578b 100644
--- a/hw/9pfs/virtio-9p-coth.h
+++ b/hw/9pfs/virtio-9p-coth.h
@@ -44,7 +44,7 @@ typedef struct V9fsThPool {
                             qemu_coroutine_self());                     \
         qemu_bh_schedule(co_bh);                                        \
         /*                                                              \
-         * yeild in qemu thread and re-enter back                       \
+         * yield in qemu thread and re-enter back                       \
          * in glib worker thread                                        \
          */                                                             \
         qemu_coroutine_yield();                                         \
diff --git a/hw/9pfs/virtio-9p-handle.c b/hw/9pfs/virtio-9p-handle.c
index 755e8e0f47..b556e39702 100644
--- a/hw/9pfs/virtio-9p-handle.c
+++ b/hw/9pfs/virtio-9p-handle.c
@@ -520,7 +520,7 @@ static int handle_name_to_path(FsContext *ctx, V9fsPath *dir_path,
     }
     fh = g_malloc(sizeof(struct file_handle) + data->handle_bytes);
     fh->handle_bytes = data->handle_bytes;
-    /* add a "./" at the begining of the path */
+    /* add a "./" at the beginning of the path */
     snprintf(buffer, PATH_MAX, "./%s", name);
     /* flag = 0 imply don't follow symlink */
     ret = name_to_handle(dirfd, buffer, fh, &mnt_id, 0);
diff --git a/hw/alpha_dp264.c b/hw/alpha_dp264.c
index fcc20e973d..598b830e92 100644
--- a/hw/alpha_dp264.c
+++ b/hw/alpha_dp264.c
@@ -2,7 +2,7 @@
  * QEMU Alpha DP264/CLIPPER hardware system emulator.
  *
  * Choose CLIPPER IRQ mappings over, say, DP264, MONET, or WEBBRICK
- * variants because CLIPPER doesn't have an SMC669 SuperIO controler
+ * variants because CLIPPER doesn't have an SMC669 SuperIO controller
  * that we need to emulate as well.
  */
 
diff --git a/hw/arm_gic.c b/hw/arm_gic.c
index 527c9cec39..1a896fbcb3 100644
--- a/hw/arm_gic.c
+++ b/hw/arm_gic.c
@@ -602,7 +602,7 @@ static uint32_t gic_cpu_read(gic_state *s, int cpu, int offset)
         return 0;
     case 0x0c: /* Acknowledge */
         return gic_acknowledge_irq(s, cpu);
-    case 0x14: /* Runing Priority */
+    case 0x14: /* Running Priority */
         return s->running_priority[cpu];
     case 0x18: /* Highest Pending Interrupt */
         return s->current_pending[cpu];
diff --git a/hw/bt-hci-csr.c b/hw/bt-hci-csr.c
index 0dcf897421..772b677ba1 100644
--- a/hw/bt-hci-csr.c
+++ b/hw/bt-hci-csr.c
@@ -222,7 +222,7 @@ static void csrhci_in_packet(struct csrhci_s *s, uint8_t *pkt)
 
         rpkt = csrhci_out_packet_csr(s, H4_NEG_PKT, 10);
 
-        *rpkt ++ = 0x20;	/* Operational settings negotation Ok */
+        *rpkt ++ = 0x20;	/* Operational settings negotiation Ok */
         memcpy(rpkt, pkt, 7); rpkt += 7;
         *rpkt ++ = 0xff;
         *rpkt = 0xff;
diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
index c7e365b2a6..1b216e8813 100644
--- a/hw/cirrus_vga.c
+++ b/hw/cirrus_vga.c
@@ -783,7 +783,7 @@ static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)
                 s->cirrus_srccounter -= s->cirrus_blt_srcpitch;
                 if (s->cirrus_srccounter <= 0)
                     goto the_end;
-                /* more bytes than needed can be transfered because of
+                /* more bytes than needed can be transferred because of
                    word alignment, so we keep them for the next line */
                 /* XXX: keep alignment to speed up transfer */
                 end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
diff --git a/hw/e1000_hw.h b/hw/e1000_hw.h
index 2e341ac27e..9e29af8c82 100644
--- a/hw/e1000_hw.h
+++ b/hw/e1000_hw.h
@@ -295,7 +295,7 @@
 
 #define E1000_KUMCTRLSTA 0x00034 /* MAC-PHY interface - RW */
 #define E1000_MDPHYA     0x0003C  /* PHY address - RW */
-#define E1000_MANC2H     0x05860  /* Managment Control To Host - RW */
+#define E1000_MANC2H     0x05860  /* Management Control To Host - RW */
 #define E1000_SW_FW_SYNC 0x05B5C /* Software-Firmware Synchronization - RW */
 
 #define E1000_GCR       0x05B00 /* PCI-Ex Control */
diff --git a/hw/etraxfs_dma.c b/hw/etraxfs_dma.c
index 02d01836ce..d2bd584bc5 100644
--- a/hw/etraxfs_dma.c
+++ b/hw/etraxfs_dma.c
@@ -180,7 +180,7 @@ struct fs_dma_channel
 	struct dma_descr_context current_c;
 	struct dma_descr_data current_d;
 
-	/* Controll registers.  */
+	/* Control registers.  */
 	uint32_t regs[DMA_REG_MAX];
 };
 
diff --git a/hw/etraxfs_pic.c b/hw/etraxfs_pic.c
index 72cbdb8c89..993d6a8885 100644
--- a/hw/etraxfs_pic.c
+++ b/hw/etraxfs_pic.c
@@ -53,7 +53,7 @@ static void pic_update(struct etrax_pic *fs)
 
     fs->regs[R_R_MASKED_VECT] = fs->regs[R_R_VECT] & fs->regs[R_RW_MASK];
 
-    /* The ETRAX interrupt controller signals interrupts to teh core
+    /* The ETRAX interrupt controller signals interrupts to the core
        through an interrupt request wire and an irq vector bus. If 
        multiple interrupts are simultaneously active it chooses vector 
        0x30 and lets the sw choose the priorities.  */
diff --git a/hw/fmopl.c b/hw/fmopl.c
index 5ad52ab7d2..6198b89ccb 100644
--- a/hw/fmopl.c
+++ b/hw/fmopl.c
@@ -715,7 +715,7 @@ static void OPLCloseTable( void )
 	free(VIB_TABLE);
 }
 
-/* CSM Key Controll */
+/* CSM Key Control */
 INLINE void CSMKeyControll(OPL_CH *CH)
 {
 	OPL_SLOT *slot1 = &CH->SLOT[SLOT1];
@@ -762,7 +762,7 @@ static void OPLWriteReg(FM_OPL *OPL, int r, int v)
 
 	switch(r&0xe0)
 	{
-	case 0x00: /* 00-1f:controll */
+	case 0x00: /* 00-1f:control */
 		switch(r&0x1f)
 		{
 		case 0x01:
@@ -826,7 +826,7 @@ static void OPLWriteReg(FM_OPL *OPL, int r, int v)
 					LOG(LOG_WAR,("OPL:write unmapped KEYBOARD port\n"));
 			}
 			return;
-		case 0x07:	/* DELTA-T controll : START,REC,MEMDATA,REPT,SPOFF,x,x,RST */
+		case 0x07:	/* DELTA-T control : START,REC,MEMDATA,REPT,SPOFF,x,x,RST */
 			if(OPL->type&OPL_TYPE_ADPCM)
 				YM_DELTAT_ADPCM_Write(OPL->deltat,r-0x07,v);
 			return;
@@ -1380,7 +1380,7 @@ int OPLTimerOver(FM_OPL *OPL,int c)
 	else
 	{	/* Timer A */
 		OPL_STATUS_SET(OPL,0x40);
-		/* CSM mode key,TL controll */
+		/* CSM mode key,TL control */
 		if( OPL->mode & 0x80 )
 		{	/* CSM mode total level latch and auto key on */
 			int ch;
diff --git a/hw/gusemu.h b/hw/gusemu.h
index 50937678e9..34872aa101 100644
--- a/hw/gusemu.h
+++ b/hw/gusemu.h
@@ -83,7 +83,7 @@ void gus_dma_transferdata(GUSEmuState *state, char *dma_addr, unsigned int count
 /* it is possible to break down a single transfer into multiple ones, but take care that: */
 /* -dma_count is actually count-1 */
 /* -before and during a transfer, DREQ is set and TC cleared */
-/* -when calling gus_dma_transferdata(), TC is only set true for call transfering the last byte */
+/* -when calling gus_dma_transferdata(), TC is only set true for call transferring the last byte */
 /* -after the last transfer, DREQ is cleared and TC is set */
 
 /* ** GF1 mixer emulation functions: */
diff --git a/hw/gusemu_hal.c b/hw/gusemu_hal.c
index c6f9537483..6096690735 100644
--- a/hw/gusemu_hal.c
+++ b/hw/gusemu_hal.c
@@ -502,7 +502,7 @@ void gus_dma_transferdata(GUSEmuState * state, char *dma_addr, unsigned int coun
     /* this function gets called by the callback function as soon as a DMA transfer is about to start
      * dma_addr is a translated address within accessible memory, not the physical one,
      * count is (real dma count register)+1
-     * note that the amount of bytes transfered is fully determined by values in the DMA registers
+     * note that the amount of bytes transferred is fully determined by values in the DMA registers
      * do not forget to update DMA states after transferring the entire block:
      * DREQ cleared & TC asserted after the _whole_ transfer */
 
@@ -517,7 +517,7 @@ void gus_dma_transferdata(GUSEmuState * state, char *dma_addr, unsigned int coun
         int             offset = (GUSregw(GUS42DMAStart) << 4) + (GUSregb(GUS50DMAHigh) & 0xf);
         if (state->gusdma >= 4)
             offset = (offset & 0xc0000) + (2 * (offset & 0x1fff0)); /* 16 bit address translation */
-        destaddr = (char *) state->himemaddr + offset; /* wavetable RAM adress */
+        destaddr = (char *) state->himemaddr + offset; /* wavetable RAM address */
     }
 
     GUSregw(GUS42DMAStart) += (GUSword)  (count >> 4);                           /* ToDo: add 16bit GUS page limit? */
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 93a1a689c4..49847bd3ea 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1000,7 +1000,7 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
     printf("ide: CMD=%02x\n", val);
 #endif
     s = idebus_active_if(bus);
-    /* ignore commands to non existant slave */
+    /* ignore commands to non existent slave */
     if (s != bus->ifs && !s->bs)
         return;
 
diff --git a/hw/lan9118.c b/hw/lan9118.c
index ee8b2eab06..7e64c5dee3 100644
--- a/hw/lan9118.c
+++ b/hw/lan9118.c
@@ -697,7 +697,7 @@ static uint32_t do_phy_read(lan9118_state *s, int reg)
         return 0x0007;
     case 3: /* ID2 */
         return 0xc0d1;
-    case 4: /* Auto-neg advertisment */
+    case 4: /* Auto-neg advertisement */
         return s->phy_advertise;
     case 5: /* Auto-neg Link Partner Ability */
         return 0x0f71;
@@ -731,7 +731,7 @@ static void do_phy_write(lan9118_state *s, int reg, uint32_t val)
             s->phy_status |= 0x0020;
         }
         break;
-    case 4: /* Auto-neg advertisment */
+    case 4: /* Auto-neg advertisement */
         s->phy_advertise = (val & 0x2d7f) | 0x80;
         break;
         /* TODO 17, 18, 27, 31 */
diff --git a/hw/omap2.c b/hw/omap2.c
index 91577ae128..c09c04a50f 100644
--- a/hw/omap2.c
+++ b/hw/omap2.c
@@ -1616,7 +1616,7 @@ static void omap_prcm_write(void *opaque, target_phys_addr_t addr,
     case 0x500:	/* CM_CLKEN_PLL */
         if (value & 0xffffff30)
             fprintf(stderr, "%s: write 0s in CM_CLKEN_PLL for "
-                            "future compatiblity\n", __FUNCTION__);
+                            "future compatibility\n", __FUNCTION__);
         if ((s->clken[9] ^ value) & 0xcc) {
             s->clken[9] &= ~0xcc;
             s->clken[9] |= value & 0xcc;
@@ -1635,7 +1635,7 @@ static void omap_prcm_write(void *opaque, target_phys_addr_t addr,
     case 0x540:	/* CM_CLKSEL1_PLL */
         if (value & 0xfc4000d7)
             fprintf(stderr, "%s: write 0s in CM_CLKSEL1_PLL for "
-                            "future compatiblity\n", __FUNCTION__);
+                            "future compatibility\n", __FUNCTION__);
         if ((s->clksel[5] ^ value) & 0x003fff00) {
             s->clksel[5] = value & 0x03bfff28;
             omap_prcm_dpll_update(s);
@@ -1647,7 +1647,7 @@ static void omap_prcm_write(void *opaque, target_phys_addr_t addr,
     case 0x544:	/* CM_CLKSEL2_PLL */
         if (value & ~3)
             fprintf(stderr, "%s: write 0s in CM_CLKSEL2_PLL[31:2] for "
-                            "future compatiblity\n", __FUNCTION__);
+                            "future compatibility\n", __FUNCTION__);
         if (s->clksel[6] != (value & 3)) {
             s->clksel[6] = value & 3;
             omap_prcm_dpll_update(s);
diff --git a/hw/pc.c b/hw/pc.c
index 33778fe422..b6dcba2067 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -983,7 +983,7 @@ void pc_memory_init(MemoryRegion *system_memory,
     linux_boot = (kernel_filename != NULL);
 
     /* Allocate RAM.  We allocate it as a single memory region and use
-     * aliases to address portions of it, mostly for backwards compatiblity
+     * aliases to address portions of it, mostly for backwards compatibility
      * with older qemus that used qemu_ram_alloc().
      */
     ram = g_malloc(sizeof(*ram));
diff --git a/hw/pcie_aer.c b/hw/pcie_aer.c
index 62c06eafd6..b9d1097936 100644
--- a/hw/pcie_aer.c
+++ b/hw/pcie_aer.c
@@ -826,7 +826,7 @@ typedef struct PCIEAERErrorName {
 } PCIEAERErrorName;
 
 /*
- * AER error name -> value convertion table
+ * AER error name -> value conversion table
  * This naming scheme is same to linux aer-injection tool.
  */
 static const struct PCIEAERErrorName pcie_aer_error_list[] = {
diff --git a/hw/pl110.c b/hw/pl110.c
index 7aef8a4e25..cc1eb6d986 100644
--- a/hw/pl110.c
+++ b/hw/pl110.c
@@ -358,7 +358,7 @@ static void pl110_write(void *opaque, target_phys_addr_t offset,
     int n;
 
     /* For simplicity invalidate the display whenever a control register
-       is writen to.  */
+       is written to.  */
     s->invalidate = 1;
     if (offset >= 0x200 && offset < 0x400) {
         /* Pallette.  */
diff --git a/hw/pl181.c b/hw/pl181.c
index 46855f69de..d05bc191be 100644
--- a/hw/pl181.c
+++ b/hw/pl181.c
@@ -311,9 +311,9 @@ static uint64_t pl181_read(void *opaque, target_phys_addr_t offset,
     case 0x48: /* FifoCnt */
         /* The documentation is somewhat vague about exactly what FifoCnt
            does.  On real hardware it appears to be when decrememnted
-           when a word is transfered between the FIFO and the serial
+           when a word is transferred between the FIFO and the serial
            data engine.  DataCnt is decremented after each byte is
-           transfered between the serial engine and the card.
+           transferred between the serial engine and the card.
            We don't emulate this level of detail, so both can be the same.  */
         tmp = (s->datacnt + 3) >> 2;
         if (s->linux_hack) {
diff --git a/hw/sh7750_regs.h b/hw/sh7750_regs.h
index 6ec13ab6fe..534aa48403 100644
--- a/hw/sh7750_regs.h
+++ b/hw/sh7750_regs.h
@@ -157,7 +157,7 @@
  * Exeption-related registers
  */
 
-/* Immediate data for TRAPA instuction - TRA */
+/* Immediate data for TRAPA instruction - TRA */
 #define SH7750_TRA_REGOFS     0x000020	/* offset */
 #define SH7750_TRA            SH7750_P4_REG32(SH7750_TRA_REGOFS)
 #define SH7750_TRA_A7         SH7750_A7_REG32(SH7750_TRA_REGOFS)
diff --git a/hw/spapr.h b/hw/spapr.h
index df88f6abad..d624841362 100644
--- a/hw/spapr.h
+++ b/hw/spapr.h
@@ -141,7 +141,7 @@ typedef struct sPAPREnvironment {
 #define H_DABRX_KERNEL     (1ULL<<(63-62))
 #define H_DABRX_USER       (1ULL<<(63-63))
 
-/* Each control block has to be on a 4K bondary */
+/* Each control block has to be on a 4K boundary */
 #define H_CB_ALIGNMENT     4096
 
 /* pSeries hypervisor opcodes */
diff --git a/hw/wdt_ib700.c b/hw/wdt_ib700.c
index 81f22d0261..ba1d92d615 100644
--- a/hw/wdt_ib700.c
+++ b/hw/wdt_ib700.c
@@ -42,7 +42,7 @@ typedef struct IB700state {
 
 /* This is the timer.  We use a global here because the watchdog
  * code ensures there is only one watchdog (it is located at a fixed,
- * unchangable IO port, so there could only ever be one anyway).
+ * unchangeable IO port, so there could only ever be one anyway).
  */
 
 /* A write to this register enables the timer. */

From 1f3392b7b3790e0207e6d1fc717f02949ae17190 Mon Sep 17 00:00:00 2001
From: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Date: Wed, 30 Nov 2011 12:39:47 +0800
Subject: [PATCH 10/35] pcie_aer: adjust do_pcie_aer_inejct_error ->
 do_pcie_aer_inject_error

This function name is a bit wrong. Although it doesn't impact function, it is a bit necessary that we should fixup it.

Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hmp-commands.hx | 2 +-
 hw/pci-stub.c   | 2 +-
 hw/pcie_aer.c   | 2 +-
 sysemu.h        | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hmp-commands.hx b/hmp-commands.hx
index 79a919526d..54b2abf458 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -923,7 +923,7 @@ ETEXI
                       "<tlb header> = 32bit x 4\n\t\t\t"
                       "<tlb header prefix> = 32bit x 4",
         .user_print  = pcie_aer_inject_error_print,
-        .mhandler.cmd_new = do_pcie_aer_inejct_error,
+        .mhandler.cmd_new = do_pcie_aer_inject_error,
     },
 
 STEXI
diff --git a/hw/pci-stub.c b/hw/pci-stub.c
index 636171c16f..134c4484b6 100644
--- a/hw/pci-stub.c
+++ b/hw/pci-stub.c
@@ -34,7 +34,7 @@ static void pci_error_message(Monitor *mon)
     monitor_printf(mon, "PCI devices not supported\n");
 }
 
-int do_pcie_aer_inejct_error(Monitor *mon,
+int do_pcie_aer_inject_error(Monitor *mon,
                              const QDict *qdict, QObject **ret_data)
 {
     pci_error_message(mon);
diff --git a/hw/pcie_aer.c b/hw/pcie_aer.c
index b9d1097936..3b6981c7b7 100644
--- a/hw/pcie_aer.c
+++ b/hw/pcie_aer.c
@@ -951,7 +951,7 @@ static int pcie_aer_parse_error_string(const char *error_name,
     return -EINVAL;
 }
 
-int do_pcie_aer_inejct_error(Monitor *mon,
+int do_pcie_aer_inject_error(Monitor *mon,
                              const QDict *qdict, QObject **ret_data)
 {
     const char *id = qdict_get_str(qdict, "id");
diff --git a/sysemu.h b/sysemu.h
index 22cd720016..3806901fba 100644
--- a/sysemu.h
+++ b/sysemu.h
@@ -148,7 +148,7 @@ void do_pci_device_hot_remove(Monitor *mon, const QDict *qdict);
 
 /* pcie aer error injection */
 void pcie_aer_inject_error_print(Monitor *mon, const QObject *data);
-int do_pcie_aer_inejct_error(Monitor *mon,
+int do_pcie_aer_inject_error(Monitor *mon,
                              const QDict *qdict, QObject **ret_data);
 
 /* serial ports */

From 6efd751789896dd6ac05c12f5149bba29c12ccae Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 30 Nov 2011 11:59:04 +0000
Subject: [PATCH 11/35] configure: Pull linux-headers/asm symlink creation out
 of loop

Pull the creation of the linux-headers/asm symlink out of the loop
so we don't pointlessly delete and recreate it once for each target.
Also move the setting of the includes variable up so that it is
in the same place as the other code which sets this variable.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 configure | 37 ++++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/configure b/configure
index 452b8cf036..4bcb8efe29 100755
--- a/configure
+++ b/configure
@@ -3286,6 +3286,22 @@ for d in libdis libdis-user; do
     echo > $d/config.mak
 done
 
+# use included Linux headers
+if test "$linux" = "yes" ; then
+  mkdir -p linux-headers
+  case "$cpu" in
+  i386|x86_64)
+    symlink $source_path/linux-headers/asm-x86 linux-headers/asm
+    ;;
+  ppcemb|ppc|ppc64)
+    symlink $source_path/linux-headers/asm-powerpc linux-headers/asm
+    ;;
+  s390x)
+    symlink $source_path/linux-headers/asm-s390 linux-headers/asm
+    ;;
+  esac
+fi
+
 for target in $target_list; do
 target_dir="$target"
 config_target_mak=$target_dir/config-target.mak
@@ -3611,6 +3627,10 @@ else
 fi
 includes="-I\$(SRC_PATH)/tcg $includes"
 
+if test "$linux" = "yes" ; then
+  includes="-I\$(SRC_PATH)/linux-headers $includes"
+fi
+
 if test "$target_user_only" = "yes" ; then
     libdis_config_mak=libdis-user/config.mak
 else
@@ -3742,23 +3762,6 @@ if test "$target_linux_user" = "yes" -o "$target_bsd_user" = "yes" ; then
   esac
 fi
 
-# use included Linux headers
-if test "$linux" = "yes" ; then
-  includes="-I\$(SRC_PATH)/linux-headers $includes"
-  mkdir -p linux-headers
-  case "$cpu" in
-  i386|x86_64)
-    symlink $source_path/linux-headers/asm-x86 linux-headers/asm
-    ;;
-  ppcemb|ppc|ppc64)
-    symlink $source_path/linux-headers/asm-powerpc linux-headers/asm
-    ;;
-  s390x)
-    symlink $source_path/linux-headers/asm-s390 linux-headers/asm
-    ;;
-  esac
-fi
-
 echo "LDFLAGS+=$ldflags" >> $config_target_mak
 echo "QEMU_CFLAGS+=$cflags" >> $config_target_mak
 echo "QEMU_INCLUDES+=$includes" >> $config_target_mak

From bcc4e41ffd0bd17977b1497a653dd33984d012e4 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Fri, 2 Dec 2011 10:30:41 +0100
Subject: [PATCH 12/35] Convert source files to UTF-8 encoding

Most QEMU files either are pure ASCII or use UTF-8.
Convert some files which still used ISO-8859-1 to UTF-8.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hw/ds1225y.c           | 2 +-
 hw/fdc.c               | 2 +-
 hw/jazz_led.c          | 2 +-
 hw/tc6393xb_template.h | 2 +-
 hw/vmport.c            | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/ds1225y.c b/hw/ds1225y.c
index 59d224edfe..7aa0832266 100644
--- a/hw/ds1225y.c
+++ b/hw/ds1225y.c
@@ -1,7 +1,7 @@
 /*
  * QEMU NVRAM emulation for DS1225Y chip
  *
- * Copyright (c) 2007-2008 Herv� Poussineau
+ * Copyright (c) 2007-2008 Hervé Poussineau
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/hw/fdc.c b/hw/fdc.c
index 2adfb44b3b..70aa5c7b56 100644
--- a/hw/fdc.c
+++ b/hw/fdc.c
@@ -2,7 +2,7 @@
  * QEMU Floppy disk emulator (Intel 82078)
  *
  * Copyright (c) 2003, 2007 Jocelyn Mayer
- * Copyright (c) 2008 Herv� Poussineau
+ * Copyright (c) 2008 Hervé Poussineau
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/hw/jazz_led.c b/hw/jazz_led.c
index 6fab334253..f8a218252c 100644
--- a/hw/jazz_led.c
+++ b/hw/jazz_led.c
@@ -1,7 +1,7 @@
 /*
  * QEMU JAZZ LED emulator.
  *
- * Copyright (c) 2007 Herv� Poussineau
+ * Copyright (c) 2007 Hervé Poussineau
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/hw/tc6393xb_template.h b/hw/tc6393xb_template.h
index 1ccf6e8dfe..4cbbad5dae 100644
--- a/hw/tc6393xb_template.h
+++ b/hw/tc6393xb_template.h
@@ -5,7 +5,7 @@
  *
  * FB support code. Based on G364 fb emulator
  *
- * Copyright (c) 2007 Herv� Poussineau
+ * Copyright (c) 2007 Hervé Poussineau
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
diff --git a/hw/vmport.c b/hw/vmport.c
index b5c6fa19cd..0a3dbc5ef5 100644
--- a/hw/vmport.c
+++ b/hw/vmport.c
@@ -1,7 +1,7 @@
 /*
  * QEMU VMPort emulation
  *
- * Copyright (C) 2007 Herv� Poussineau
+ * Copyright (C) 2007 Hervé Poussineau
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal

From a828f1b0091ddac5ece1bb6f92f6aa4957b7465b Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Sat, 3 Dec 2011 10:45:25 +0100
Subject: [PATCH 13/35] Convert keymap file to UTF-8 encoding

Most QEMU files either are pure ASCII or use UTF-8.
Convert this keymap file which still used ISO-8859-1 to UTF-8.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 pc-bios/keymaps/is | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/keymaps/is b/pc-bios/keymaps/is
index 21dc1fd3ca..935ac1da7a 100644
--- a/pc-bios/keymaps/is
+++ b/pc-bios/keymaps/is
@@ -1,4 +1,4 @@
-# 2004-03-16 Halld�r Gu�mundsson and Morten Lange
+# 2004-03-16 Halldór Guðmundsson and Morten Lange
 # Keyboard definition file for the Icelandic keyboard
 # to be used in rdesktop 1.3.x ( See rdesktop.org)
 # generated from XKB map de, and changed manually

From 7ff60e158b19a5126ad2c05092f0bb3700546c99 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 2 Dec 2011 19:30:44 +0000
Subject: [PATCH 14/35] linux-user/cpu-uname.c: Convert to UTF-8

Convert comment from ISO-8859-1 encoding to UTF-8 to match the rest
of QEMU's source code.

Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 linux-user/cpu-uname.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/cpu-uname.c b/linux-user/cpu-uname.c
index 23afedeb9b..ddc37be4f9 100644
--- a/linux-user/cpu-uname.c
+++ b/linux-user/cpu-uname.c
@@ -1,7 +1,7 @@
 /*
  *  cpu to uname machine name map
  *
- *  Copyright (c) 2009 Lo�c Minier
+ *  Copyright (c) 2009 Loïc Minier
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by

From 75dfbc16cf8a7a6a0db461cf0f77f0cca40bb654 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 2 Dec 2011 19:30:45 +0000
Subject: [PATCH 15/35] linux-user/arm/nwfpe/fpopcode.h: Fix non-UTF-8
 characters

Fix some stray non-UTF-8 characters used in some ASCII art tables
by converting them to plain ASCII '|' instead.

Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 linux-user/arm/nwfpe/fpopcode.h | 34 ++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/linux-user/arm/nwfpe/fpopcode.h b/linux-user/arm/nwfpe/fpopcode.h
index e7d100941c..1b1137f3c8 100644
--- a/linux-user/arm/nwfpe/fpopcode.h
+++ b/linux-user/arm/nwfpe/fpopcode.h
@@ -75,11 +75,11 @@ TABLE 1
 +-------------------------+---+---+---------+---------+
 |  Precision              | u | v | FPSR.EP | length  |
 +-------------------------+---+---+---------+---------+
-| Single                  | 0 � 0 |    x    | 1 words |
-| Double                  | 1 � 1 |    x    | 2 words |
-| Extended                | 1 � 1 |    x    | 3 words |
-| Packed decimal          | 1 � 1 |    0    | 3 words |
-| Expanded packed decimal | 1 � 1 |    1    | 4 words |
+| Single                  | 0 | 0 |    x    | 1 words |
+| Double                  | 1 | 1 |    x    | 2 words |
+| Extended                | 1 | 1 |    x    | 3 words |
+| Packed decimal          | 1 | 1 |    0    | 3 words |
+| Expanded packed decimal | 1 | 1 |    1    | 4 words |
 +-------------------------+---+---+---------+---------+
 Note: x = don't care
 */
@@ -89,10 +89,10 @@ TABLE 2
 +---+---+---------------------------------+
 | w | x | Number of registers to transfer |
 +---+---+---------------------------------+
-| 0 � 1 |  1                              |
-| 1 � 0 |  2                              |
-| 1 � 1 |  3                              |
-| 0 � 0 |  4                              |
+| 0 | 1 |  1                              |
+| 1 | 0 |  2                              |
+| 1 | 1 |  3                              |
+| 0 | 0 |  4                              |
 +---+---+---------------------------------+
 */
 
@@ -153,10 +153,10 @@ TABLE 5
 +-------------------------+---+---+
 |  Rounding Precision     | e | f |
 +-------------------------+---+---+
-| IEEE Single precision   | 0 � 0 |
-| IEEE Double precision   | 0 � 1 |
-| IEEE Extended precision | 1 � 0 |
-| undefined (trap)        | 1 � 1 |
+| IEEE Single precision   | 0 | 0 |
+| IEEE Double precision   | 0 | 1 |
+| IEEE Extended precision | 1 | 0 |
+| undefined (trap)        | 1 | 1 |
 +-------------------------+---+---+
 */
 
@@ -165,10 +165,10 @@ TABLE 5
 +---------------------------------+---+---+
 |  Rounding Mode                  | g | h |
 +---------------------------------+---+---+
-| Round to nearest (default)      | 0 � 0 |
-| Round toward plus infinity      | 0 � 1 |
-| Round toward negative infinity  | 1 � 0 |
-| Round toward zero               | 1 � 1 |
+| Round to nearest (default)      | 0 | 0 |
+| Round toward plus infinity      | 0 | 1 |
+| Round toward negative infinity  | 1 | 0 |
+| Round toward zero               | 1 | 1 |
 +---------------------------------+---+---+
 */
 

From 4a2dd92d7b89d00cb8afa90aa588fef44a79aa88 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Mon, 5 Dec 2011 15:18:54 +0100
Subject: [PATCH 16/35] Rename get_tls to tls_var

get_tls() can serve as a lvalue as well, so 'get' might be confusing.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 cpu-all.h  | 2 +-
 qemu-tls.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/cpu-all.h b/cpu-all.h
index 7246a67236..9d787151e1 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -336,7 +336,7 @@ void QEMU_NORETURN cpu_abort(CPUState *env, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
 extern CPUState *first_cpu;
 DECLARE_TLS(CPUState *,cpu_single_env);
-#define cpu_single_env get_tls(cpu_single_env)
+#define cpu_single_env tls_var(cpu_single_env)
 
 /* Flags for use in ENV->INTERRUPT_PENDING.
 
diff --git a/qemu-tls.h b/qemu-tls.h
index 5b70f10f8f..b92ea9d7da 100644
--- a/qemu-tls.h
+++ b/qemu-tls.h
@@ -41,12 +41,12 @@
 #ifdef __linux__
 #define DECLARE_TLS(type, x) extern DEFINE_TLS(type, x)
 #define DEFINE_TLS(type, x)  __thread __typeof__(type) tls__##x
-#define get_tls(x)           tls__##x
+#define tls_var(x)           tls__##x
 #else
 /* Dummy implementations which define plain global variables */
 #define DECLARE_TLS(type, x) extern DEFINE_TLS(type, x)
 #define DEFINE_TLS(type, x)  __typeof__(type) tls__##x
-#define get_tls(x)           tls__##x
+#define tls_var(x)           tls__##x
 #endif
 
 #endif

From 31b631936376042a503b5378d9716137b170b758 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 5 Dec 2011 23:11:50 +0000
Subject: [PATCH 17/35] linux-user/syscall.c: Don't skip stracing for fcntl64
 failure case

In an fcntl64 failure path, we were returning directly rather than
simply breaking out of the switch statement. This skips the strace
code for printing the syscall return value, so don't do that.

Acked-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 linux-user/syscall.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index c84cc65f7a..2bf9e7ec44 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -7521,8 +7521,10 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
 #endif
 
 	cmd = target_to_host_fcntl_cmd(arg2);
-	if (cmd == -TARGET_EINVAL)
-		return cmd;
+        if (cmd == -TARGET_EINVAL) {
+            ret = cmd;
+            break;
+        }
 
         switch(arg2) {
         case TARGET_F_GETLK64:

From 69ddaf6659c006599b530feb50604a584c79f329 Mon Sep 17 00:00:00 2001
From: Ademar de Souza Reis Jr <areis@redhat.com>
Date: Mon, 5 Dec 2011 16:54:14 -0300
Subject: [PATCH 18/35] memory: minor documentation fixes/enhancements

Fix typos and minor documentation errors in both memory.h and
docs/memory.txt.

Also add missing documentation formatting tags to transaction
functions.

Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Ademar de Souza Reis Jr <areis@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 docs/memory.txt |  6 +++---
 memory.h        | 38 ++++++++++++++++++++++----------------
 2 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/docs/memory.txt b/docs/memory.txt
index 3fc1683d88..5bbee8e85d 100644
--- a/docs/memory.txt
+++ b/docs/memory.txt
@@ -7,7 +7,7 @@ machine.  It attempts to allow modelling of:
  - ordinary RAM
  - memory-mapped I/O (MMIO)
  - memory controllers that can dynamically reroute physical memory regions
-  to different destinations
+   to different destinations
 
 The memory model provides support for
 
@@ -121,7 +121,7 @@ pci (0-2^32-1)
 
 ram: ram@0x00000000-0xffffffff
 
-The is a (simplified) PC memory map. The 4GB RAM block is mapped into the
+This is a (simplified) PC memory map. The 4GB RAM block is mapped into the
 system address space via two aliases: "lomem" is a 1:1 mapping of the first
 3.5GB; "himem" maps the last 0.5GB at address 4GB.  This leaves 0.5GB for the
 so-called PCI hole, that allows a 32-bit PCI bus to exist in a system with
@@ -164,7 +164,7 @@ various constraints can be supplied to control how these callbacks are called:
  - .impl.min_access_size, .impl.max_access_size define the access sizes
    (in bytes) supported by the *implementation*; other access sizes will be
    emulated using the ones available.  For example a 4-byte write will be
-   emulated using four 1-byte write, if .impl.max_access_size = 1.
+   emulated using four 1-byte writes, if .impl.max_access_size = 1.
  - .impl.valid specifies that the *implementation* only supports unaligned
    accesses; unaligned accesses will be emulated by two aligned accesses.
  - .old_portio and .old_mmio can be used to ease porting from code using
diff --git a/memory.h b/memory.h
index 53bf261792..beae1274d5 100644
--- a/memory.h
+++ b/memory.h
@@ -149,7 +149,7 @@ struct MemoryRegionPortio {
 /**
  * memory_region_init: Initialize a memory region
  *
- * The region typically acts as a container for other memory regions.  Us
+ * The region typically acts as a container for other memory regions.  Use
  * memory_region_add_subregion() to add subregions.
  *
  * @mr: the #MemoryRegion to be initialized
@@ -162,7 +162,7 @@ void memory_region_init(MemoryRegion *mr,
 /**
  * memory_region_init_io: Initialize an I/O memory region.
  *
- * Accesses into the region will be cause the callbacks in @ops to be called.
+ * Accesses into the region will cause the callbacks in @ops to be called.
  * if @size is nonzero, subregions will be clipped to @size.
  *
  * @mr: the #MemoryRegion to be initialized.
@@ -180,7 +180,7 @@ void memory_region_init_io(MemoryRegion *mr,
 
 /**
  * memory_region_init_ram:  Initialize RAM memory region.  Accesses into the
- *                          region will be modify memory directly.
+ *                          region will modify memory directly.
  *
  * @mr: the #MemoryRegion to be initialized.
  * @dev: a device associated with the region; may be %NULL.
@@ -196,7 +196,7 @@ void memory_region_init_ram(MemoryRegion *mr,
 
 /**
  * memory_region_init_ram:  Initialize RAM memory region from a user-provided.
- *                          pointer.  Accesses into the region will be modify
+ *                          pointer.  Accesses into the region will modify
  *                          memory directly.
  *
  * @mr: the #MemoryRegion to be initialized.
@@ -250,7 +250,7 @@ void memory_region_init_rom_device(MemoryRegion *mr,
                                    uint64_t size);
 
 /**
- * memory_region_destroy: Destroy a memory region and relaim all resources.
+ * memory_region_destroy: Destroy a memory region and reclaim all resources.
  *
  * @mr: the region to be destroyed.  May not currently be a subregion
  *      (see memory_region_add_subregion()) or referenced in an alias
@@ -417,7 +417,7 @@ void memory_region_clear_coalescing(MemoryRegion *mr);
  *
  * Marks a word in an IO region (initialized with memory_region_init_io())
  * as a trigger for an eventfd event.  The I/O callback will not be called.
- * The caller must be prepared to handle failure (hat is, take the required
+ * The caller must be prepared to handle failure (that is, take the required
  * action if the callback _is_ called).
  *
  * @mr: the memory region being updated.
@@ -435,10 +435,10 @@ void memory_region_add_eventfd(MemoryRegion *mr,
                                int fd);
 
 /**
- * memory_region_del_eventfd: Cancel and eventfd.
+ * memory_region_del_eventfd: Cancel an eventfd.
  *
- * Cancels an eventfd trigger request by a previous memory_region_add_eventfd()
- * call.
+ * Cancels an eventfd trigger requested by a previous
+ * memory_region_add_eventfd() call.
  *
  * @mr: the memory region being updated.
  * @addr: the address within @mr that is to be monitored
@@ -454,9 +454,9 @@ void memory_region_del_eventfd(MemoryRegion *mr,
                                uint64_t data,
                                int fd);
 /**
- * memory_region_add_subregion: Add a sub-region to a container.
+ * memory_region_add_subregion: Add a subregion to a container.
  *
- * Adds a sub-region at @offset.  The sub-region may not overlap with other
+ * Adds a subregion at @offset.  The subregion may not overlap with other
  * subregions (except for those explicitly marked as overlapping).  A region
  * may only be added once as a subregion (unless removed with
  * memory_region_del_subregion()); use memory_region_init_alias() if you
@@ -471,9 +471,9 @@ void memory_region_add_subregion(MemoryRegion *mr,
                                  target_phys_addr_t offset,
                                  MemoryRegion *subregion);
 /**
- * memory_region_add_subregion: Add a sub-region to a container, with overlap.
+ * memory_region_add_subregion: Add a subregion to a container, with overlap.
  *
- * Adds a sub-region at @offset.  The sub-region may overlap with other
+ * Adds a subregion at @offset.  The subregion may overlap with other
  * subregions.  Conflicts are resolved by having a higher @priority hide a
  * lower @priority. Subregions without priority are taken as @priority 0.
  * A region may only be added once as a subregion (unless removed with
@@ -501,11 +501,17 @@ void memory_region_add_subregion_overlap(MemoryRegion *mr,
 void memory_region_del_subregion(MemoryRegion *mr,
                                  MemoryRegion *subregion);
 
-/* Start a transaction; changes will be accumulated and made visible only
- * when the transaction ends.
+/**
+ * memory_region_transaction_begin: Start a transaction.
+ *
+ * During a transaction, changes will be accumulated and made visible
+ * only when the transaction ends (is commited).
  */
 void memory_region_transaction_begin(void);
-/* Commit a transaction and make changes visible to the guest.
+
+/**
+ * memory_region_transaction_commit: Commit a transaction and make changes
+ *                                   visible to the guest.
  */
 void memory_region_transaction_commit(void);
 

From a30cfee5ee6d4c6737de4549be1cb75c3ec539c8 Mon Sep 17 00:00:00 2001
From: Chen Rui <chennrui@gmail.com>
Date: Sun, 13 Nov 2011 19:42:42 +0800
Subject: [PATCH 19/35] mips_malta: resolve endless loop when loading bios

Tested-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Chen Rui <chennrui@gmail.com>
---
 hw/mips_malta.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index bb49749569..e7dfbd6632 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -911,6 +911,7 @@ void mips_malta_init (ram_addr_t ram_size,
             uint32_t *end = addr + bios_size;
             while (addr < end) {
                 bswap32s(addr);
+                addr++;
             }
         }
 #endif

From 46d5dee007d3300210968308983b4834d4d1403f Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Wed, 7 Dec 2011 23:31:46 +0100
Subject: [PATCH 20/35] tcg: Remove redundant declarations of
 TCG_TARGET_REG_BITS

TCG_TARGET_REG_BITS is declared in tcg.h for all TCG targets.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 tcg/i386/tcg-target.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index 7756e7b03c..adbb036905 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -23,11 +23,6 @@
  */
 #define TCG_TARGET_I386 1
 
-#if defined(__x86_64__)
-# define TCG_TARGET_REG_BITS 64
-#else
-# define TCG_TARGET_REG_BITS 32
-#endif
 //#define TCG_TARGET_WORDS_BIGENDIAN
 
 #if TCG_TARGET_REG_BITS == 64

From e7764a465855568d2813d6ff1099b75f3edd53e8 Mon Sep 17 00:00:00 2001
From: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Date: Tue, 15 Nov 2011 20:47:07 +0800
Subject: [PATCH 21/35] tests/Makefile: Remove qruncom target

  Remove qruncom target from the Makefile file.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 tests/Makefile | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/tests/Makefile b/tests/Makefile
index 430e0c1776..15e36a208c 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -115,12 +115,6 @@ speed: sha1 sha1-i386
 	time ./sha1
 	time $(QEMU) ./sha1-i386
 
-# broken test
-# NOTE: -fomit-frame-pointer is currently needed : this is a bug in libqemu
-qruncom: qruncom.c ../ioport-user.c ../i386-user/libqemu.a
-	$(CC) $(CFLAGS) -fomit-frame-pointer $(LDFLAGS) -I../target-i386 -I.. -I../i386-user -I../fpu \
-              -o $@ $(filter %.c, $^) -L../i386-user -lqemu -lm
-
 # arm test
 hello-arm: hello-arm.o
 	arm-linux-ld -o $@ $<

From e4aeadcb5685cdb421275025c5b22f530f830105 Mon Sep 17 00:00:00 2001
From: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Date: Tue, 15 Nov 2011 20:47:08 +0800
Subject: [PATCH 22/35] tests/qruncom.c: Remove libqemu.a example

  Remove libqemu example since libqemu.a is not available anymore.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 tests/qruncom.c | 284 ------------------------------------------------
 1 file changed, 284 deletions(-)
 delete mode 100644 tests/qruncom.c

diff --git a/tests/qruncom.c b/tests/qruncom.c
deleted file mode 100644
index 2e93aafb87..0000000000
--- a/tests/qruncom.c
+++ /dev/null
@@ -1,284 +0,0 @@
-/*
- * Example of use of user mode libqemu: launch a basic .com DOS
- * executable
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/mman.h>
-#include <signal.h>
-#include <malloc.h>
-
-#include "cpu.h"
-
-//#define SIGTEST
-
-int cpu_get_pic_interrupt(CPUState *env)
-{
-    return -1;
-}
-
-uint64_t cpu_get_tsc(CPUState *env)
-{
-    return 0;
-}
-
-static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
-                     unsigned long addr, unsigned int sel)
-{
-    unsigned int e1, e2;
-    e1 = (addr & 0xffff) | (sel << 16);
-    e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
-    stl((uint8_t *)ptr, e1);
-    stl((uint8_t *)ptr + 4, e2);
-}
-
-uint64_t idt_table[256];
-
-/* only dpl matters as we do only user space emulation */
-static void set_idt(int n, unsigned int dpl)
-{
-    set_gate(idt_table + n, 0, dpl, 0, 0);
-}
-
-void g_free(void *ptr)
-{
-    free(ptr);
-}
-
-void *g_malloc(size_t size)
-{
-    return malloc(size);
-}
-
-void *g_malloc0(size_t size)
-{
-    void *ptr;
-    ptr = g_malloc(size);
-    if (!ptr)
-        return NULL;
-    memset(ptr, 0, size);
-    return ptr;
-}
-
-void *qemu_vmalloc(size_t size)
-{
-    return memalign(4096, size);
-}
-
-void qemu_vfree(void *ptr)
-{
-    free(ptr);
-}
-
-void qemu_printf(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    vprintf(fmt, ap);
-    va_end(ap);
-}
-
-/* XXX: this is a bug in helper2.c */
-int errno;
-
-/**********************************************/
-
-#define COM_BASE_ADDR    0x10100
-
-static void usage(void)
-{
-    printf("qruncom version 0.1 (c) 2003 Fabrice Bellard\n"
-           "usage: qruncom file.com\n"
-           "user mode libqemu demo: run simple .com DOS executables\n");
-    exit(1);
-}
-
-static inline uint8_t *seg_to_linear(unsigned int seg, unsigned int reg)
-{
-    return (uint8_t *)((seg << 4) + (reg & 0xffff));
-}
-
-static inline void pushw(CPUState *env, int val)
-{
-    env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | ((env->regs[R_ESP] - 2) & 0xffff);
-    *(uint16_t *)seg_to_linear(env->segs[R_SS].selector, env->regs[R_ESP]) = val;
-}
-
-static void host_segv_handler(int host_signum, siginfo_t *info,
-                              void *puc)
-{
-    if (cpu_signal_handler(host_signum, info, puc)) {
-        return;
-    }
-    abort();
-}
-
-int main(int argc, char **argv)
-{
-    uint8_t *vm86_mem;
-    const char *filename;
-    int fd, ret, seg;
-    CPUState *env;
-
-    if (argc != 2)
-        usage();
-    filename = argv[1];
-
-    vm86_mem = mmap((void *)0x00000000, 0x110000,
-                    PROT_WRITE | PROT_READ | PROT_EXEC,
-                    MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0);
-    if (vm86_mem == MAP_FAILED) {
-        perror("mmap");
-        exit(1);
-    }
-
-    /* load the MSDOS .com executable */
-    fd = open(filename, O_RDONLY);
-    if (fd < 0) {
-        perror(filename);
-        exit(1);
-    }
-    ret = read(fd, vm86_mem + COM_BASE_ADDR, 65536 - 256);
-    if (ret < 0) {
-        perror("read");
-        exit(1);
-    }
-    close(fd);
-
-    /* install exception handler for CPU emulator */
-    {
-        struct sigaction act;
-
-        sigfillset(&act.sa_mask);
-        act.sa_flags = SA_SIGINFO;
-        //        act.sa_flags |= SA_ONSTACK;
-
-        act.sa_sigaction = host_segv_handler;
-        sigaction(SIGSEGV, &act, NULL);
-        sigaction(SIGBUS, &act, NULL);
-    }
-
-    //    cpu_set_log(CPU_LOG_TB_IN_ASM | CPU_LOG_TB_OUT_ASM | CPU_LOG_EXEC);
-
-    env = cpu_init("qemu32");
-
-    cpu_x86_set_cpl(env, 3);
-
-    env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
-    /* NOTE: hflags duplicates some of the virtual CPU state */
-    env->hflags |= HF_PE_MASK | VM_MASK;
-
-    /* flags setup : we activate the IRQs by default as in user
-       mode. We also activate the VM86 flag to run DOS code */
-    env->eflags |= IF_MASK | VM_MASK;
-
-    /* init basic registers */
-    env->eip = 0x100;
-    env->regs[R_ESP] = 0xfffe;
-    seg = (COM_BASE_ADDR - 0x100) >> 4;
-
-    cpu_x86_load_seg_cache(env, R_CS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_SS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_DS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_ES, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_FS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_GS, seg,
-                           (seg << 4), 0xffff, 0);
-
-    /* exception support */
-    env->idt.base = (unsigned long)idt_table;
-    env->idt.limit = sizeof(idt_table) - 1;
-    set_idt(0, 0);
-    set_idt(1, 0);
-    set_idt(2, 0);
-    set_idt(3, 3);
-    set_idt(4, 3);
-    set_idt(5, 3);
-    set_idt(6, 0);
-    set_idt(7, 0);
-    set_idt(8, 0);
-    set_idt(9, 0);
-    set_idt(10, 0);
-    set_idt(11, 0);
-    set_idt(12, 0);
-    set_idt(13, 0);
-    set_idt(14, 0);
-    set_idt(15, 0);
-    set_idt(16, 0);
-    set_idt(17, 0);
-    set_idt(18, 0);
-    set_idt(19, 0);
-
-    /* put return code */
-    *seg_to_linear(env->segs[R_CS].selector, 0) = 0xb4; /* mov ah, $0 */
-    *seg_to_linear(env->segs[R_CS].selector, 1) = 0x00;
-    *seg_to_linear(env->segs[R_CS].selector, 2) = 0xcd; /* int $0x21 */
-    *seg_to_linear(env->segs[R_CS].selector, 3) = 0x21;
-    pushw(env, 0x0000);
-
-    /* the value of these registers seem to be assumed by pi_10.com */
-    env->regs[R_ESI] = 0x100;
-    env->regs[R_ECX] = 0xff;
-    env->regs[R_EBP] = 0x0900;
-    env->regs[R_EDI] = 0xfffe;
-
-    /* inform the emulator of the mmaped memory */
-    page_set_flags(0x00000000, 0x110000,
-                   PAGE_WRITE | PAGE_READ | PAGE_EXEC | PAGE_VALID);
-
-    for(;;) {
-        ret = cpu_x86_exec(env);
-        switch(ret) {
-        case EXCP0D_GPF:
-            {
-                int int_num, ah;
-                int_num = *(uint8_t *)(env->segs[R_CS].base + env->eip + 1);
-                if (int_num != 0x21)
-                    goto unknown_int;
-                ah = (env->regs[R_EAX] >> 8) & 0xff;
-                switch(ah) {
-                case 0x00: /* exit */
-                    exit(0);
-                case 0x02: /* write char */
-                    {
-                        uint8_t c = env->regs[R_EDX];
-                        write(1, &c, 1);
-                    }
-                    break;
-                case 0x09: /* write string */
-                    {
-                        uint8_t c;
-                        for(;;) {
-                            c = *seg_to_linear(env->segs[R_DS].selector, env->regs[R_EAX]);
-                            if (c == '$')
-                                break;
-                            write(1, &c, 1);
-                        }
-                        env->regs[R_EAX] = (env->regs[R_EAX] & ~0xff) | '$';
-                    }
-                    break;
-                default:
-                unknown_int:
-                    fprintf(stderr, "unsupported int 0x%02x\n", int_num);
-                    cpu_dump_state(env, stderr, fprintf, 0);
-                    //                    exit(1);
-                }
-                env->eip += 2;
-            }
-            break;
-        default:
-            fprintf(stderr, "unhandled cpu_exec return code (0x%x)\n", ret);
-            cpu_dump_state(env, stderr, fprintf, 0);
-            exit(1);
-        }
-    }
-}

From cc588764f4b52421f685e106498e7a9b758bdcd3 Mon Sep 17 00:00:00 2001
From: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Date: Tue, 15 Nov 2011 20:47:09 +0800
Subject: [PATCH 23/35] qemu-tech.texi: Remove libqemu related stuff from the
 document

  Remove libqemu related stuff from the document since libqemu.a is not supported
anymore.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 qemu-tech.texi | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/qemu-tech.texi b/qemu-tech.texi
index 62afe45dc2..5676fb7afd 100644
--- a/qemu-tech.texi
+++ b/qemu-tech.texi
@@ -96,10 +96,6 @@ Alpha and S390 hosts, but TCG (see below) doesn't support those yet.
 
 @item Precise exceptions support.
 
-@item The virtual CPU is a library (@code{libqemu}) which can be used
-in other projects (look at @file{qemu/tests/qruncom.c} to have an
-example of user mode @code{libqemu} usage).
-
 @item
 Floating point library supporting both full software emulation and
 native host FPU instructions.
@@ -685,7 +681,6 @@ are available. They are used for regression testing.
 @menu
 * test-i386::
 * linux-test::
-* qruncom.c::
 @end menu
 
 @node test-i386
@@ -711,11 +706,6 @@ This program tests various Linux system calls. It is used to verify
 that the system call parameters are correctly converted between target
 and host CPUs.
 
-@node qruncom.c
-@section @file{qruncom.c}
-
-Example of usage of @code{libqemu} to emulate a user mode i386 CPU.
-
 @node Index
 @chapter Index
 @printindex cp

From 1c8a80f3b975884bd6ee6f239b6e728fbcc821c2 Mon Sep 17 00:00:00 2001
From: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Date: Tue, 15 Nov 2011 20:47:10 +0800
Subject: [PATCH 24/35] Makefile.target: Remove out of date comment

  Remove the out of date comment, i.e., "# libqemu" since libqemu.a is not
available anymore.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 Makefile.target | 2 --
 1 file changed, 2 deletions(-)

diff --git a/Makefile.target b/Makefile.target
index a111521dbf..7369a89e55 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -92,8 +92,6 @@ tci-dis.o: QEMU_CFLAGS += -I$(SRC_PATH)/tcg -I$(SRC_PATH)/tcg/tci
 
 $(libobj-y): $(GENERATED_HEADERS)
 
-# libqemu
-
 translate.o: translate.c cpu.h
 
 translate-all.o: translate-all.c cpu.h

From 050d99402845d3c5915e3abd8aea7cc772b85b8e Mon Sep 17 00:00:00 2001
From: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Date: Tue, 15 Nov 2011 20:47:11 +0800
Subject: [PATCH 25/35] Makefile.objs: Remove libqemu_common.a from the comment

  Remove libqemu_common.a from the comment.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 Makefile.objs | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/Makefile.objs b/Makefile.objs
index 3a699ee7d8..281b698c3c 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -68,10 +68,9 @@ endif
 fsdev-obj-$(CONFIG_VIRTFS) += $(addprefix fsdev/, $(fsdev-nested-y))
 
 ######################################################################
-# libqemu_common.a: Target independent part of system emulation. The
-# long term path is to suppress *all* target specific code in case of
-# system emulation, i.e. a single QEMU executable should support all
-# CPUs and machines.
+# Target independent part of system emulation. The long term path is to
+# suppress *all* target specific code in case of system emulation, i.e. a
+# single QEMU executable should support all CPUs and machines.
 
 common-obj-y = $(block-obj-y) blockdev.o
 common-obj-y += $(net-obj-y)

From ee12e1f38a8bb2cbf58584688f0a90a7872f5dcf Mon Sep 17 00:00:00 2001
From: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Date: Tue, 15 Nov 2011 20:47:12 +0800
Subject: [PATCH 26/35] LICENSE: There is no libqemu.a anymore

  Remove statement about libqemu.a from LICENSE.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 LICENSE | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/LICENSE b/LICENSE
index cbd92c03e3..acae9a3b36 100644
--- a/LICENSE
+++ b/LICENSE
@@ -6,9 +6,7 @@ The following points clarify the QEMU license:
 GNU General Public License. Hence each source file contains its own
 licensing information.
 
-In particular, the QEMU virtual CPU core library (libqemu.a) is
-released under the GNU Lesser General Public License. Many hardware
-device emulation sources are released under the BSD license.
+Many hardware device emulation sources are released under the BSD license.
 
 3) The Tiny Code Generator (TCG) is released under the BSD license
    (see license headers in files).

From ad3d11e6e78f8640c1af6f67420200d8287c3267 Mon Sep 17 00:00:00 2001
From: Hui Kai Ran <hkran@linux.vnet.ibm.com>
Date: Thu, 8 Dec 2011 13:49:13 +0800
Subject: [PATCH 27/35] virtio-pci: use pci macros

Signed-off-by: Hui Kai Ran <hkran@linux.vnet.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hw/virtio-pci.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/virtio-pci.c b/hw/virtio-pci.c
index c665f5c94b..77b75bcd9a 100644
--- a/hw/virtio-pci.c
+++ b/hw/virtio-pci.c
@@ -627,9 +627,10 @@ void virtio_init_pci(VirtIOPCIProxy *proxy, VirtIODevice *vdev)
     if (proxy->class_code) {
         pci_config_set_class(config, proxy->class_code);
     }
-    pci_set_word(config + 0x2c, pci_get_word(config + PCI_VENDOR_ID));
-    pci_set_word(config + 0x2e, vdev->device_id);
-    config[0x3d] = 1;
+    pci_set_word(config + PCI_SUBSYSTEM_VENDOR_ID,
+                 pci_get_word(config + PCI_VENDOR_ID));
+    pci_set_word(config + PCI_SUBSYSTEM_ID, vdev->device_id);
+    config[PCI_INTERRUPT_PIN] = 1;
 
     memory_region_init(&proxy->msix_bar, "virtio-msix", 4096);
     if (vdev->nvectors && !msix_init(&proxy->pci_dev, vdev->nvectors,

From c11e80e299e57c64934c164b231fa0d4279db445 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Sat, 10 Dec 2011 00:19:42 +0100
Subject: [PATCH 28/35] fmopl: Fix spelling in code and comments

algorythm->algorithm
rythm->rhythm

I did not try to fix the coding standard, so checkpatch.pl
reports lots of violations.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hw/fmopl.c | 32 ++++++++++++++++----------------
 hw/fmopl.h |  4 ++--
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/hw/fmopl.c b/hw/fmopl.c
index 6198b89ccb..734d2f4aae 100644
--- a/hw/fmopl.c
+++ b/hw/fmopl.c
@@ -362,8 +362,8 @@ INLINE UINT32 OPL_CALC_SLOT( OPL_SLOT *SLOT )
 	return SLOT->TLL+ENV_CURVE[SLOT->evc>>ENV_BITS]+(SLOT->ams ? ams : 0);
 }
 
-/* set algorythm connection */
-static void set_algorythm( OPL_CH *CH)
+/* set algorithm connection */
+static void set_algorithm( OPL_CH *CH)
 {
 	INT32 *carrier = &outd[0];
 	CH->connect1 = CH->CON ? carrier : &feedback2;
@@ -498,7 +498,7 @@ INLINE void OPL_CALC_CH( OPL_CH *CH )
 	}
 }
 
-/* ---------- calcrate rythm block ---------- */
+/* ---------- calcrate rhythm block ---------- */
 #define WHITE_NOISE_db 6.0
 INLINE void OPL_CALC_RH( OPL_CH *CH )
 {
@@ -895,14 +895,14 @@ static void OPLWriteReg(FM_OPL *OPL, int r, int v)
 		case 0xbd:
 			/* amsep,vibdep,r,bd,sd,tom,tc,hh */
 			{
-			UINT8 rkey = OPL->rythm^v;
+			UINT8 rkey = OPL->rhythm^v;
 			OPL->ams_table = &AMS_TABLE[v&0x80 ? AMS_ENT : 0];
 			OPL->vib_table = &VIB_TABLE[v&0x40 ? VIB_ENT : 0];
-			OPL->rythm  = v&0x3f;
-			if(OPL->rythm&0x20)
+			OPL->rhythm  = v&0x3f;
+			if(OPL->rhythm&0x20)
 			{
 #if 0
-				usrintf_showmessage("OPL Rythm mode select");
+				usrintf_showmessage("OPL Rhythm mode select");
 #endif
 				/* BD key on/off */
 				if(rkey&0x10)
@@ -995,7 +995,7 @@ static void OPLWriteReg(FM_OPL *OPL, int r, int v)
 		int feedback = (v>>1)&7;
 		CH->FB   = feedback ? (8+1) - feedback : 0;
 		CH->CON = v&1;
-		set_algorythm(CH);
+		set_algorithm(CH);
 		}
 		return;
 	case 0xe0: /* wave type */
@@ -1049,7 +1049,7 @@ void YM3812UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 	OPLSAMPLE *buf = buffer;
 	UINT32 amsCnt  = OPL->amsCnt;
 	UINT32 vibCnt  = OPL->vibCnt;
-	UINT8 rythm = OPL->rythm&0x20;
+	UINT8 rhythm = OPL->rhythm&0x20;
 	OPL_CH *CH,*R_CH;
 
 	if( (void *)OPL != cur_chip ){
@@ -1057,7 +1057,7 @@ void YM3812UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 		/* channel pointers */
 		S_CH = OPL->P_CH;
 		E_CH = &S_CH[9];
-		/* rythm slot */
+		/* rhythm slot */
 		SLOT7_1 = &S_CH[7].SLOT[SLOT1];
 		SLOT7_2 = &S_CH[7].SLOT[SLOT2];
 		SLOT8_1 = &S_CH[8].SLOT[SLOT1];
@@ -1068,7 +1068,7 @@ void YM3812UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 		ams_table = OPL->ams_table;
 		vib_table = OPL->vib_table;
 	}
-	R_CH = rythm ? &S_CH[6] : E_CH;
+	R_CH = rhythm ? &S_CH[6] : E_CH;
     for( i=0; i < length ; i++ )
 	{
 		/*            channel A         channel B         channel C      */
@@ -1080,7 +1080,7 @@ void YM3812UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 		for(CH=S_CH ; CH < R_CH ; CH++)
 			OPL_CALC_CH(CH);
 		/* Rythn part */
-		if(rythm)
+		if(rhythm)
 			OPL_CALC_RH(S_CH);
 		/* limit check */
 		data = Limit( outd[0] , OPL_MAXOUT, OPL_MINOUT );
@@ -1110,7 +1110,7 @@ void Y8950UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 	OPLSAMPLE *buf = buffer;
 	UINT32 amsCnt  = OPL->amsCnt;
 	UINT32 vibCnt  = OPL->vibCnt;
-	UINT8 rythm = OPL->rythm&0x20;
+	UINT8 rhythm = OPL->rhythm&0x20;
 	OPL_CH *CH,*R_CH;
 	YM_DELTAT *DELTAT = OPL->deltat;
 
@@ -1122,7 +1122,7 @@ void Y8950UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 		/* channel pointers */
 		S_CH = OPL->P_CH;
 		E_CH = &S_CH[9];
-		/* rythm slot */
+		/* rhythm slot */
 		SLOT7_1 = &S_CH[7].SLOT[SLOT1];
 		SLOT7_2 = &S_CH[7].SLOT[SLOT2];
 		SLOT8_1 = &S_CH[8].SLOT[SLOT1];
@@ -1133,7 +1133,7 @@ void Y8950UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 		ams_table = OPL->ams_table;
 		vib_table = OPL->vib_table;
 	}
-	R_CH = rythm ? &S_CH[6] : E_CH;
+	R_CH = rhythm ? &S_CH[6] : E_CH;
     for( i=0; i < length ; i++ )
 	{
 		/*            channel A         channel B         channel C      */
@@ -1148,7 +1148,7 @@ void Y8950UpdateOne(FM_OPL *OPL, INT16 *buffer, int length)
 		for(CH=S_CH ; CH < R_CH ; CH++)
 			OPL_CALC_CH(CH);
 		/* Rythn part */
-		if(rythm)
+		if(rhythm)
 			OPL_CALC_RH(S_CH);
 		/* limit check */
 		data = Limit( outd[0] , OPL_MAXOUT, OPL_MINOUT );
diff --git a/hw/fmopl.h b/hw/fmopl.h
index a01ff902c7..24ba5f4802 100644
--- a/hw/fmopl.h
+++ b/hw/fmopl.h
@@ -110,8 +110,8 @@ typedef struct fm_opl_f {
 	/* FM channel slots */
 	OPL_CH *P_CH;		/* pointer of CH                     */
 	int	max_ch;			/* maximum channel                   */
-	/* Rythm sention */
-	UINT8 rythm;		/* Rythm mode , key flag */
+	/* Rhythm sention */
+	UINT8 rhythm;		/* Rhythm mode , key flag */
 #if BUILD_Y8950
 	/* Delta-T ADPCM unit (Y8950) */
 	YM_DELTAT *deltat;			/* DELTA-T ADPCM       */

From 4d8db4e4a0280fcdc930b6709f1bf8fc2aa0404e Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Sat, 10 Dec 2011 00:19:43 +0100
Subject: [PATCH 29/35] hw: Fix spelling (licenced->licensed)

New code introduced old misspellings.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hw/lm4549.c | 2 +-
 hw/lm4549.h | 2 +-
 hw/pl041.c  | 2 +-
 hw/pl041.h  | 2 +-
 hw/pl041.hx | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/lm4549.c b/hw/lm4549.c
index 4d5b83125f..80b3ec4a5d 100644
--- a/hw/lm4549.c
+++ b/hw/lm4549.c
@@ -4,7 +4,7 @@
  * Copyright (c) 2011
  * Written by Mathieu Sonet - www.elasticsheep.com
  *
- * This code is licenced under the GPL.
+ * This code is licensed under the GPL.
  *
  * *****************************************************************
  *
diff --git a/hw/lm4549.h b/hw/lm4549.h
index 70d0ac1750..5948780e00 100644
--- a/hw/lm4549.h
+++ b/hw/lm4549.h
@@ -4,7 +4,7 @@
  * Copyright (c) 2011
  * Written by Mathieu Sonet - www.elasticsheep.com
  *
- * This code is licenced under the GPL.
+ * This code is licensed under the GPL.
  *
  * *****************************************************************
  */
diff --git a/hw/pl041.c b/hw/pl041.c
index d8e55d1ef2..4585ccf9c0 100644
--- a/hw/pl041.c
+++ b/hw/pl041.c
@@ -4,7 +4,7 @@
  * Copyright (c) 2011
  * Written by Mathieu Sonet - www.elasticsheep.com
  *
- * This code is licenced under the GPL.
+ * This code is licensed under the GPL.
  *
  * *****************************************************************
  *
diff --git a/hw/pl041.h b/hw/pl041.h
index 1f224326e5..427ab6d6f8 100644
--- a/hw/pl041.h
+++ b/hw/pl041.h
@@ -4,7 +4,7 @@
  * Copyright (c) 2011
  * Written by Mathieu Sonet - www.elasticsheep.com
  *
- * This code is licenced under the GPL.
+ * This code is licensed under the GPL.
  *
  * *****************************************************************
  */
diff --git a/hw/pl041.hx b/hw/pl041.hx
index e972996725..dd7188cbcb 100644
--- a/hw/pl041.hx
+++ b/hw/pl041.hx
@@ -4,7 +4,7 @@
  * Copyright (c) 2011
  * Written by Mathieu Sonet - www.elasticsheep.com
  *
- * This code is licenced under the GPL.
+ * This code is licensed under the GPL.
  *
  * *****************************************************************
  */

From 26404edcce09267f15aa723d1ea0a2761e91048f Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Sat, 10 Dec 2011 00:19:44 +0100
Subject: [PATCH 30/35] hw: Fix spelling in comments

adress->address
advertisment->advertisement
begining->beginning
bondary->boundary
controler->controller
controll->control
convertion->conversion
doesnt->doesn't
existant->existent
instuction->instruction
loosing->losing
managment->management
multipled->multiplied
negotation->negotiation
runing->running
teh->the
unchangable->unchangeable
writen->written
yeild->yield

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hw/gusemu.h  | 2 +-
 hw/rtl8139.c | 2 +-
 hw/ssd0303.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/gusemu.h b/hw/gusemu.h
index 34872aa101..331bb6fec0 100644
--- a/hw/gusemu.h
+++ b/hw/gusemu.h
@@ -27,7 +27,7 @@
 
 /* data types (need to be adjusted if neither a VC6 nor a C99 compatible compiler is used) */
 
-#if defined _WIN32 && defined _MSC_VER /* doesnt support other win32 compilers yet, do it yourself... */
+#if defined _WIN32 && defined _MSC_VER /* doesn't support other win32 compilers yet, do it yourself... */
  typedef unsigned char GUSbyte;
  typedef unsigned short GUSword;
  typedef unsigned int GUSdword;
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index aa8ed0a919..8aace9a4ec 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -2662,7 +2662,7 @@ static void rtl8139_IntrStatus_write(RTL8139State *s, uint32_t val)
      * Computing if we miss an interrupt here is not that correct but
      * considered that we should have had already an interrupt
      * and probably emulated is slower is better to assume this resetting was
-     * done before testing on previous rtl8139_update_irq lead to IRQ loosing
+     * done before testing on previous rtl8139_update_irq lead to IRQ losing
      */
     rtl8139_set_next_tctr_time(s, qemu_get_clock_ns(vm_clock));
     rtl8139_update_irq(s);
diff --git a/hw/ssd0303.c b/hw/ssd0303.c
index 401fdf592a..bcad7bf922 100644
--- a/hw/ssd0303.c
+++ b/hw/ssd0303.c
@@ -123,7 +123,7 @@ static int ssd0303_send(i2c_slave *i2c, uint8_t data)
             case 0xa7: /* Inverse on.  */
                 s->inverse = 1;
                 break;
-            case 0xa8: /* Set multipled ratio (Ignored).  */
+            case 0xa8: /* Set multiplied ratio (Ignored).  */
                 s->cmd_state = SSD0303_CMD_SKIP1;
                 break;
             case 0xad: /* DC-DC power control.  */

From a1b6abe76bcc7b389849744dc4196d24f625d286 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Sat, 10 Dec 2011 00:19:45 +0100
Subject: [PATCH 31/35] hw: Fix spelling in comments and code

compatiblity->compatibility
transfered->transferred
transfering->transferring

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 hw/es1370.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/es1370.c b/hw/es1370.c
index c5c16b0484..6a3ba55f6f 100644
--- a/hw/es1370.c
+++ b/hw/es1370.c
@@ -788,7 +788,7 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
     int cnt = d->frame_cnt >> 16;
     int size = d->frame_cnt & 0xffff;
     int left = ((size - cnt + 1) << 2) + d->leftover;
-    int transfered = 0;
+    int transferred = 0;
     int temp = audio_MIN (max, audio_MIN (left, csc_bytes));
     int index = d - &s->chan[0];
 
@@ -807,7 +807,7 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
 
             temp -= acquired;
             addr += acquired;
-            transfered += acquired;
+            transferred += acquired;
         }
     }
     else {
@@ -823,11 +823,11 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
                 break;
             temp -= copied;
             addr += copied;
-            transfered += copied;
+            transferred += copied;
         }
     }
 
-    if (csc_bytes == transfered) {
+    if (csc_bytes == transferred) {
         *irq = 1;
         d->scount = sc | (sc << 16);
         ldebug ("sc = %d, rate = %f\n",
@@ -836,10 +836,10 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
     }
     else {
         *irq = 0;
-        d->scount = sc | (((csc_bytes - transfered - 1) >> d->shift) << 16);
+        d->scount = sc | (((csc_bytes - transferred - 1) >> d->shift) << 16);
     }
 
-    cnt += (transfered + d->leftover) >> 2;
+    cnt += (transferred + d->leftover) >> 2;
 
     if (s->sctl & loop_sel) {
         /* Bah, how stupid is that having a 0 represent true value?
@@ -853,7 +853,7 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
             d->frame_cnt |= cnt << 16;
     }
 
-    d->leftover = (transfered + d->leftover) & 3;
+    d->leftover = (transferred + d->leftover) & 3;
 }
 
 static void es1370_run_channel (ES1370State *s, size_t chan, int free_or_avail)

From e7d81004e486b0e80a674d164d8aec0e83fa812f Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Sat, 10 Dec 2011 00:19:46 +0100
Subject: [PATCH 32/35] Fix spelling in comments, documentation and messages

accidently->accidentally
annother->another
choosen->chosen
consideres->considers
decriptor->descriptor
developement->development
paramter->parameter
preceed->precede
preceeding->preceding
priviledge->privilege
propogation->propagation
substraction->subtraction
throught->through
upto->up to
usefull->useful

Fix also grammar in posix-aio-compat.c

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 Changelog                     | 4 ++--
 audio/audio.c                 | 2 +-
 block.h                       | 2 +-
 bsd-user/x86_64/syscall.h     | 2 +-
 gdbstub.c                     | 2 +-
 linux-user/x86_64/syscall.h   | 2 +-
 pc-bios/ohw.diff              | 2 +-
 pc-bios/optionrom/multiboot.S | 2 +-
 posix-aio-compat.c            | 4 ++--
 qapi-schema-guest.json        | 2 +-
 qemu-options.hx               | 2 +-
 qerror.c                      | 2 +-
 scripts/checkpatch.pl         | 4 ++--
 target-mips/helper.c          | 2 +-
 target-s390x/cpu.h            | 8 ++++----
 ui/vnc-enc-zywrle-template.c  | 2 +-
 ui/vnc-enc-zywrle.h           | 2 +-
 17 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/Changelog b/Changelog
index 28a69afa0b..8b63258937 100644
--- a/Changelog
+++ b/Changelog
@@ -78,7 +78,7 @@ version 0.10.2:
 
   - fix savevm/loadvm (Anthony Liguori)
   - live migration: fix dirty tracking windows (Glauber Costa)
-  - live migration: improve error propogation (Glauber Costa)
+  - live migration: improve error propagation (Glauber Costa)
   - qcow2: fix image creation for > ~2TB images (Chris Wright)
   - hotplug: fix error handling for if= parameter (Eduardo Habkost)
   - qcow2: fix data corruption (Nolan Leake)
@@ -386,7 +386,7 @@ version 0.5.3:
   - support of CD-ROM change
   - multiple network interface support
   - initial x86-64 host support (Gwenole Beauchesne)
-  - lret to outer priviledge fix (OS/2 install fix)
+  - lret to outer privilege fix (OS/2 install fix)
   - task switch fixes (SkyOS boot)
   - VM save/restore commands
   - new timer API
diff --git a/audio/audio.c b/audio/audio.c
index 50d0d7183f..5fff6de966 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1665,7 +1665,7 @@ static void audio_pp_nb_voices (const char *typ, int nb)
         printf ("Theoretically supports many %s voices\n", typ);
         break;
     default:
-        printf ("Theoretically supports upto %d %s voices\n", nb, typ);
+        printf ("Theoretically supports up to %d %s voices\n", nb, typ);
         break;
     }
 
diff --git a/block.h b/block.h
index 1790f9988c..0e3ff9f233 100644
--- a/block.h
+++ b/block.h
@@ -21,7 +21,7 @@ typedef struct QEMUSnapshotInfo {
     char id_str[128]; /* unique snapshot id */
     /* the following fields are informative. They are not needed for
        the consistency of the snapshot */
-    char name[256]; /* user choosen name */
+    char name[256]; /* user chosen name */
     uint32_t vm_state_size; /* VM state info size */
     uint32_t date_sec; /* UTC date of the snapshot */
     uint32_t date_nsec;
diff --git a/bsd-user/x86_64/syscall.h b/bsd-user/x86_64/syscall.h
index 5f71b7cdcf..630514a930 100644
--- a/bsd-user/x86_64/syscall.h
+++ b/bsd-user/x86_64/syscall.h
@@ -8,7 +8,7 @@ struct target_pt_regs {
 	abi_ulong r12;
 	abi_ulong rbp;
 	abi_ulong rbx;
-/* arguments: non interrupts/non tracing syscalls only save upto here*/
+/* arguments: non interrupts/non tracing syscalls only save up to here */
  	abi_ulong r11;
 	abi_ulong r10;
 	abi_ulong r9;
diff --git a/gdbstub.c b/gdbstub.c
index 640cf4ee2a..a5806ef6c4 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2678,7 +2678,7 @@ gdb_handlesig (CPUState *env, int sig)
         }
       else if (n == 0 || errno != EAGAIN)
         {
-          /* XXX: Connection closed.  Should probably wait for annother
+          /* XXX: Connection closed.  Should probably wait for another
              connection before continuing.  */
           return sig;
         }
diff --git a/linux-user/x86_64/syscall.h b/linux-user/x86_64/syscall.h
index 2a8d696bf2..81314cfae6 100644
--- a/linux-user/x86_64/syscall.h
+++ b/linux-user/x86_64/syscall.h
@@ -8,7 +8,7 @@ struct target_pt_regs {
 	abi_ulong r12;
 	abi_ulong rbp;
 	abi_ulong rbx;
-/* arguments: non interrupts/non tracing syscalls only save upto here*/
+/* arguments: non interrupts/non tracing syscalls only save up to here */
  	abi_ulong r11;
 	abi_ulong r10;
 	abi_ulong r9;
diff --git a/pc-bios/ohw.diff b/pc-bios/ohw.diff
index 4fb542274d..c6b6623f2f 100644
--- a/pc-bios/ohw.diff
+++ b/pc-bios/ohw.diff
@@ -1065,7 +1065,7 @@ diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --
 +                        tab, 4 * sizeof(uint32_t));
 +    }
 +#if 0
-     /* escc is usefull to get MacOS X debug messages */
+     /* escc is useful to get MacOS X debug messages */
      {
          OF_regprop_t regs[8];
 @@ -2645,85 +2843,12 @@
diff --git a/pc-bios/optionrom/multiboot.S b/pc-bios/optionrom/multiboot.S
index cc5ca1b7d1..f08222a3c6 100644
--- a/pc-bios/optionrom/multiboot.S
+++ b/pc-bios/optionrom/multiboot.S
@@ -50,7 +50,7 @@ run_multiboot:
 	shr		$0x4, %ecx
 	mov		%cx, %gs
 
-	/* now push the indirect jump decriptor there */
+	/* now push the indirect jump descriptor there */
 	mov		(prot_jump), %ebx
 	add		%eax, %ebx
 	movl		%ebx, %gs:GS_PROT_JUMP
diff --git a/posix-aio-compat.c b/posix-aio-compat.c
index 0c0035cb18..c380ec148c 100644
--- a/posix-aio-compat.c
+++ b/posix-aio-compat.c
@@ -128,8 +128,8 @@ static ssize_t handle_aiocb_ioctl(struct qemu_paiocb *aiocb)
         return -errno;
 
     /*
-     * This looks weird, but the aio code only consideres a request
-     * successful if it has written the number full number of bytes.
+     * This looks weird, but the aio code only considers a request
+     * successful if it has written the full number of bytes.
      *
      * Now we overload aio_nbytes as aio_ioctl_cmd for the ioctl command,
      * so in fact we return the ioctl command here to make posix_aio_read()
diff --git a/qapi-schema-guest.json b/qapi-schema-guest.json
index fde5971e87..f4bcd1a532 100644
--- a/qapi-schema-guest.json
+++ b/qapi-schema-guest.json
@@ -13,7 +13,7 @@
 # partially-delivered JSON text in such a way that this response
 # can be obtained.
 #
-# Such clients should also preceed this command
+# Such clients should also precede this command
 # with a 0xFF byte to make such the guest agent flushes any
 # partially read JSON data from a previous session.
 #
diff --git a/qemu-options.hx b/qemu-options.hx
index b3db10c0ad..087a3b9376 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -217,7 +217,7 @@ qcow2.  If performance is more important than correctness,
 In case you don't care about data integrity over host failures, use
 cache=unsafe. This option tells qemu that it never needs to write any data
 to the disk but can instead keeps things in cache. If anything goes wrong,
-like your host losing power, the disk storage getting disconnected accidently,
+like your host losing power, the disk storage getting disconnected accidentally,
 etc. you're image will most probably be rendered unusable.   When using
 the @option{-snapshot} option, unsafe caching is always used.
 
diff --git a/qerror.c b/qerror.c
index 656efc2cf0..d9ab3969d2 100644
--- a/qerror.c
+++ b/qerror.c
@@ -253,7 +253,7 @@ static const QErrorStringTable qerror_table[] = {
     },
     {
         .error_fmt = QERR_INVALID_PARAMETER_COMBINATION,
-        .desc      = "Invalid paramter combination",
+        .desc      = "Invalid parameter combination",
     },
     {}
 };
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index cce8f86251..8850a5f436 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1907,7 +1907,7 @@ sub process {
 			my $ok = 0;
 			for (my $ln = $linenr - 1; $ln >= $first_line; $ln--) {
 				#print "CHECK<$lines[$ln - 1]\n";
-				# we have a preceeding printk if it ends
+				# we have a preceding printk if it ends
 				# with "\n" ignore it, else it is to blame
 				if ($lines[$ln - 1] =~ m{\bprintk\(}) {
 					if ($rawlines[$ln - 1] !~ m{\\n"}) {
@@ -1999,7 +1999,7 @@ sub process {
 			for (my $n = 0; $n < $#elements; $n += 2) {
 				$off += length($elements[$n]);
 
-				# Pick up the preceeding and succeeding characters.
+				# Pick up the preceding and succeeding characters.
 				my $ca = substr($opline, 0, $off);
 				my $cc = '';
 				if (length($opline) >= ($off + length($elements[$n + 1]))) {
diff --git a/target-mips/helper.c b/target-mips/helper.c
index 1c58e0cc21..722561695c 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -497,7 +497,7 @@ void do_interrupt (CPUState *env)
                 }
             } else {
                 /* For VEIC mode, the external interrupt controller feeds the
-                   vector throught the CP0Cause IP lines.  */
+                   vector through the CP0Cause IP lines.  */
                 vector = pending;
             }
             offset = 0x200 + vector * spacing;
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 202c098ee0..b8893b3027 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -513,15 +513,15 @@ enum cc_op {
 
     CC_OP_ADD_64,               /* overflow on add (64bit) */
     CC_OP_ADDU_64,              /* overflow on unsigned add (64bit) */
-    CC_OP_SUB_64,               /* overflow on substraction (64bit) */
-    CC_OP_SUBU_64,              /* overflow on unsigned substraction (64bit) */
+    CC_OP_SUB_64,               /* overflow on subtraction (64bit) */
+    CC_OP_SUBU_64,              /* overflow on unsigned subtraction (64bit) */
     CC_OP_ABS_64,               /* sign eval on abs (64bit) */
     CC_OP_NABS_64,              /* sign eval on nabs (64bit) */
 
     CC_OP_ADD_32,               /* overflow on add (32bit) */
     CC_OP_ADDU_32,              /* overflow on unsigned add (32bit) */
-    CC_OP_SUB_32,               /* overflow on substraction (32bit) */
-    CC_OP_SUBU_32,              /* overflow on unsigned substraction (32bit) */
+    CC_OP_SUB_32,               /* overflow on subtraction (32bit) */
+    CC_OP_SUBU_32,              /* overflow on unsigned subtraction (32bit) */
     CC_OP_ABS_32,               /* sign eval on abs (64bit) */
     CC_OP_NABS_32,              /* sign eval on nabs (64bit) */
 
diff --git a/ui/vnc-enc-zywrle-template.c b/ui/vnc-enc-zywrle-template.c
index 4cde6e4362..561f7bfabb 100644
--- a/ui/vnc-enc-zywrle-template.c
+++ b/ui/vnc-enc-zywrle-template.c
@@ -9,7 +9,7 @@
  *                                                                  *
  * THE 'ZYWRLE' VNC CODEC SOURCE CODE IS (C) COPYRIGHT 2006         *
  * BY Hitachi Systems & Services, Ltd.                              *
- * (Noriaki Yamazaki, Research & Developement Center)               *
+ * (Noriaki Yamazaki, Research & Development Center)               *
  *                                                                  *
  *                                                                  *
  ********************************************************************
diff --git a/ui/vnc-enc-zywrle.h b/ui/vnc-enc-zywrle.h
index ac5d27a449..1ff40b1f40 100644
--- a/ui/vnc-enc-zywrle.h
+++ b/ui/vnc-enc-zywrle.h
@@ -8,7 +8,7 @@
  *                                                                  *
  * THE 'ZYWRLE' VNC CODEC SOURCE CODE IS (C) COPYRIGHT 2006         *
  * BY Hitachi Systems & Services, Ltd.                              *
- * (Noriaki Yamazaki, Research & Developement Center)               *
+ * (Noriaki Yamazaki, Research & Development Center)               *
  *                                                                  *
  *                                                                  *
  ********************************************************************

From 73f5e3132a18654caa9705e3e8c7688f615f8c7d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Sat, 10 Dec 2011 16:35:31 +0000
Subject: [PATCH 33/35] tcg: make tcg_const_ptr actually accept a pointer
 argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make tcg_const_ptr() include a cast so that you can pass it a
pointer. This allows us to drop the casts we had in all the places
that use this macro.

Acked-by: Andreas Färber <andreas.faerber@web.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 tcg/tcg-op.h | 6 +++---
 tcg/tcg.h    | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index 82e04e7f30..169d3b2b0d 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -389,7 +389,7 @@ static inline void tcg_gen_helperN(void *func, int flags, int sizemask,
                                    TCGArg ret, int nargs, TCGArg *args)
 {
     TCGv_ptr fn;
-    fn = tcg_const_ptr((tcg_target_long)func);
+    fn = tcg_const_ptr(func);
     tcg_gen_callN(&tcg_ctx, fn, flags, sizemask, ret,
                   nargs, args);
     tcg_temp_free_ptr(fn);
@@ -405,7 +405,7 @@ static inline void tcg_gen_helper32(void *func, int sizemask, TCGv_i32 ret,
 {
     TCGv_ptr fn;
     TCGArg args[2];
-    fn = tcg_const_ptr((tcg_target_long)func);
+    fn = tcg_const_ptr(func);
     args[0] = GET_TCGV_I32(a);
     args[1] = GET_TCGV_I32(b);
     tcg_gen_callN(&tcg_ctx, fn, TCG_CALL_CONST | TCG_CALL_PURE, sizemask,
@@ -418,7 +418,7 @@ static inline void tcg_gen_helper64(void *func, int sizemask, TCGv_i64 ret,
 {
     TCGv_ptr fn;
     TCGArg args[2];
-    fn = tcg_const_ptr((tcg_target_long)func);
+    fn = tcg_const_ptr(func);
     args[0] = GET_TCGV_I64(a);
     args[1] = GET_TCGV_I64(b);
     tcg_gen_callN(&tcg_ctx, fn, TCG_CALL_CONST | TCG_CALL_PURE, sizemask,
diff --git a/tcg/tcg.h b/tcg/tcg.h
index 175000f580..5c28239682 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -544,7 +544,7 @@ void tcg_add_target_add_op_defs(const TCGTargetOpDef *tdefs);
 #define TCGV_NAT_TO_PTR(n) MAKE_TCGV_PTR(GET_TCGV_I32(n))
 #define TCGV_PTR_TO_NAT(n) MAKE_TCGV_I32(GET_TCGV_PTR(n))
 
-#define tcg_const_ptr(V) TCGV_NAT_TO_PTR(tcg_const_i32(V))
+#define tcg_const_ptr(V) TCGV_NAT_TO_PTR(tcg_const_i32((tcg_target_long)(V)))
 #define tcg_global_reg_new_ptr(R, N) \
     TCGV_NAT_TO_PTR(tcg_global_reg_new_i32((R), (N)))
 #define tcg_global_mem_new_ptr(R, O, N) \
@@ -555,7 +555,7 @@ void tcg_add_target_add_op_defs(const TCGTargetOpDef *tdefs);
 #define TCGV_NAT_TO_PTR(n) MAKE_TCGV_PTR(GET_TCGV_I64(n))
 #define TCGV_PTR_TO_NAT(n) MAKE_TCGV_I64(GET_TCGV_PTR(n))
 
-#define tcg_const_ptr(V) TCGV_NAT_TO_PTR(tcg_const_i64(V))
+#define tcg_const_ptr(V) TCGV_NAT_TO_PTR(tcg_const_i64((tcg_target_long)(V)))
 #define tcg_global_reg_new_ptr(R, N) \
     TCGV_NAT_TO_PTR(tcg_global_reg_new_i64((R), (N)))
 #define tcg_global_mem_new_ptr(R, O, N) \

From 3060eb754145996b67036ec313ce34e9f5df1c47 Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <yamahata@valinux.co.jp>
Date: Tue, 13 Dec 2011 12:40:51 +0900
Subject: [PATCH 34/35] migration.h: remove incoming_expected declarations

The variable is deleted by 1bcef683bf840a928d633755031ac572d5fdb851
So remove its declaration.

Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 migration.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/migration.h b/migration.h
index 0682179bde..78a50d31ac 100644
--- a/migration.h
+++ b/migration.h
@@ -88,8 +88,6 @@ uint64_t ram_bytes_total(void);
 int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque);
 int ram_load(QEMUFile *f, void *opaque, int version_id);
 
-extern int incoming_expected;
-
 /**
  * @migrate_add_blocker - prevent migration from proceeding
  *

From 126c79133f77d1b0b7c3849899c6d5f83b2fd410 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Wed, 14 Dec 2011 07:30:24 +0100
Subject: [PATCH 35/35] doc: Remove Symbian Virtual Platform

Commit d396a657baec8c6b7aa0c888746e0e2f78303650 removed the code
for SVP, so the documentation needs this update.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 qemu-doc.texi | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/qemu-doc.texi b/qemu-doc.texi
index 9c3cb62ee3..11f4166995 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -107,7 +107,6 @@ For system emulation, the following hardware targets are supported:
 @item MusicPal (MV88W8618 ARM processor)
 @item Gumstix "Connex" and "Verdex" motherboards (PXA255/270).
 @item Siemens SX1 smartphone (OMAP310 processor)
-@item Syborg SVP base model (ARM Cortex-A8).
 @item AXIS-Devboard88 (CRISv32 ETRAX-FS).
 @item Petalogix Spartan 3aDSP1800 MMU ref design (MicroBlaze).
 @item Avnet LX60/LX110/LX200 boards (Xtensa)
@@ -2079,28 +2078,6 @@ Secure Digital card connected to OMAP MMC/SD host
 Three on-chip UARTs
 @end itemize
 
-The "Syborg" Symbian Virtual Platform base model includes the following
-elements:
-
-@itemize @minus
-@item
-ARM Cortex-A8 CPU
-@item
-Interrupt controller
-@item
-Timer
-@item
-Real Time Clock
-@item
-Keyboard
-@item
-Framebuffer
-@item
-Touchscreen
-@item
-UARTs
-@end itemize
-
 A Linux 2.6 test image is available on the QEMU web site. More
 information is available in the QEMU mailing-list archive.