Merge branch 'master' of git://git.sv.gnu.org/qemu

* 'master' of git://git.sv.gnu.org/qemu: (11 commits)
  Use hxtool to generate monitor documentation and C structures
  Use correct type for SPARC cpu_cc_op
  Fix typo
  qdev: add monitor command to dump the tree.
  Record device property types
  Fix elf loader range checking
  Remove ARM NVIC initialization hack
  Add --enable-debug
  qdev: kill DeviceState->name
  fix gdbstub support for multiple threads in usermode, v3
  CRIS: Remove duplicated flag defines.

Conflicts:
	monitor.c

Signed-off-by: Mark McLoughlin <markmc@redhat.com>

20 files changed, 872 insertions, 536 deletions

diff --git a/Makefile b/Makefile
index 6802f54fc..943913138 100644
--- a/Makefile
+++ b/Makefile
@@ -354,7 +354,10 @@ cscope:
 qemu-options.texi: $(SRC_PATH)/qemu-options.hx
 	$(call quiet-command,sh $(SRC_PATH)/hxtool -t < $< > $@,"  GEN   $@")
 
-qemu.1: qemu-doc.texi qemu-options.texi
+qemu-monitor.texi: $(SRC_PATH)/qemu-monitor.hx
+	$(call quiet-command,sh $(SRC_PATH)/hxtool -t < $< > $@,"  GEN   $@")
+
+qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/texi2pod.pl $< qemu.pod && \
 	  pod2man --section=1 --center=" " --release=" " qemu.pod > $@, \
@@ -378,7 +381,7 @@ dvi: qemu-doc.dvi qemu-tech.dvi
 
 html: qemu-doc.html qemu-tech.html
 
-qemu-doc.dvi qemu-doc.html qemu-doc.info: qemu-img.texi qemu-nbd.texi qemu-options.texi
+qemu-doc.dvi qemu-doc.html qemu-doc.info: qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-monitor.texi
 
 VERSION ?= $(shell cat VERSION)
 FILE = qemu-$(VERSION)
diff --git a/Makefile.target b/Makefile.target
index da18f487a..a75c78d3e 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -806,6 +806,8 @@ endif
 
 vl.o: qemu-options.h
 
+monitor.o: qemu-monitor.h
+
 $(QEMU_PROG): LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS) $(CURL_LIBS)
 $(QEMU_PROG): ARLIBS=../libqemu_common.a libqemu.a $(HWLIB)
 $(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a $(HWLIB)
@@ -826,9 +828,13 @@ endif
 qemu-options.h: $(SRC_PATH)/qemu-options.hx
 	$(call quiet-command,sh $(SRC_PATH)/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
 
+qemu-monitor.h: $(SRC_PATH)/qemu-monitor.hx
+	$(call quiet-command,sh $(SRC_PATH)/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
+
 clean:
-	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o qemu-options.h gdbstub-xml.c
+	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
 	rm -f *.d */*.d tcg/*.o
+	rm -f qemu-options.h qemu-monitor.h gdbstub-xml.c
 
 install: all
 ifneq ($(PROGS),)
diff --git a/configure b/configure
index 68fd70c36..a33d9492a 100755
--- a/configure
+++ b/configure
@@ -168,6 +168,7 @@ kvm_version() {
 
 gprof="no"
 debug_tcg="no"
+debug="no"
 sparse="no"
 strip_opt="yes"
 bigendian="no"
@@ -443,6 +444,12 @@ for opt do
   ;;
   --disable-debug-tcg) debug_tcg="no"
   ;;
+  --enable-debug)
+      # Enable debugging options that aren't excessively noisy
+      debug_tcg="yes"
+      debug="yes"
+      strip_opt="no"
+  ;;
   --enable-sparse) sparse="yes"
   ;;
   --disable-sparse) sparse="no"
@@ -540,7 +547,10 @@ for opt do
 done
 
 # default flags for all hosts
-CFLAGS="$CFLAGS -O2 -g -fno-strict-aliasing"
+CFLAGS="$CFLAGS -g -fno-strict-aliasing"
+if test "$debug" = "no" ; then
+  CFLAGS="$CFLAGS -O2"
+fi
 CFLAGS="$CFLAGS -Wall -Wundef -Wendif-labels -Wwrite-strings -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls"
 LDFLAGS="$LDFLAGS -g"
 if test "$werror" = "yes" ; then
@@ -625,6 +635,7 @@ echo "  --install=INSTALL        use specified install [$install]"
 echo "  --static                 enable static build [$static]"
 echo "  --enable-debug-tcg       enable TCG debugging"
 echo "  --disable-debug-tcg      disable TCG debugging (default)"
+echo "  --disable-debug          enable common debug build options"
 echo "  --enable-sparse          enable sparse checker"
 echo "  --disable-sparse         disable sparse checker (default)"
 echo "  --disable-strip          disable stripping binaries"
@@ -1629,6 +1640,9 @@ esac
 if test "$debug_tcg" = "yes" ; then
   echo "#define DEBUG_TCG 1" >> $config_h
 fi
+if test "$debug" = "yes" ; then
+  echo "#define DEBUG_EXEC 1" >> $config_h
+fi
 if test "$sparse" = "yes" ; then
   echo "CC      := REAL_CC=\"\$(CC)\" cgcc"       >> $config_mak
   echo "HOST_CC := REAL_CC=\"\$(HOST_CC)\" cgcc"  >> $config_mak
diff --git a/cpu-defs.h b/cpu-defs.h
index 5f541e016..e17209a75 100644
--- a/cpu-defs.h
+++ b/cpu-defs.h
@@ -200,6 +200,7 @@ struct KVMCPUState {
                                                                         \
     CPUState *next_cpu; /* next CPU sharing TB cache */                 \
     int cpu_index; /* CPU index (informative) */                        \
+    uint32_t host_tid; /* host thread ID */                             \
     int numa_node; /* NUMA node this cpu is belonging to  */            \
     int running; /* Nonzero if cpu is currently running(usermode).  */  \
     int thread_id;							\
diff --git a/elf_ops.h b/elf_ops.h
index 485442a93..72cd83eb7 100644
--- a/elf_ops.h
+++ b/elf_ops.h
@@ -185,7 +185,7 @@ static int glue(load_elf, SZ)(int fd, int64_t address_offset,
     struct elf_phdr *phdr = NULL, *ph;
     int size, i, total_size;
     elf_word mem_size;
-    uint64_t addr, low = 0, high = 0;
+    uint64_t addr, low = (uint64_t)-1, high = 0;
     uint8_t *data = NULL;
 
     if (read(fd, &ehdr, sizeof(ehdr)) != sizeof(ehdr))
@@ -249,9 +249,9 @@ static int glue(load_elf, SZ)(int fd, int64_t address_offset,
             cpu_physical_memory_write_rom(addr, data, mem_size);
 
             total_size += mem_size;
-            if (!low || addr < low)
+            if (addr < low)
                 low = addr;
-            if (!high || (addr + mem_size) > high)
+            if ((addr + mem_size) > high)
                 high = addr + mem_size;
 
             qemu_free(data);
diff --git a/exec.c b/exec.c
index 7c777c25a..b8ffaf100 100644
--- a/exec.c
+++ b/exec.c
@@ -565,7 +565,7 @@ void cpu_exec_init(CPUState *env)
     penv = &first_cpu;
     cpu_index = 0;
     while (*penv != NULL) {
-        penv = (CPUState **)&(*penv)->next_cpu;
+        penv = &(*penv)->next_cpu;
         cpu_index++;
     }
     env->cpu_index = cpu_index;
diff --git a/gdbstub.c b/gdbstub.c
index 9d99f7540..834e39cdb 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1568,11 +1568,34 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 #endif
 }
 
+static inline int gdb_id(CPUState *env)
+{
+#if defined(CONFIG_USER_ONLY) && defined(USE_NPTL)
+    return env->host_tid;
+#else
+    return env->cpu_index + 1;
+#endif
+}
+
+static CPUState *find_cpu(uint32_t thread_id)
+{
+    CPUState *env;
+
+    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        if (gdb_id(env) == thread_id) {
+            return env;
+        }
+    }
+
+    return NULL;
+}
+
 static int gdb_handle_packet(GDBState *s, const char *line_buf)
 {
     CPUState *env;
     const char *p;
-    int ch, reg_size, type, res, thread;
+    uint32_t thread;
+    int ch, reg_size, type, res;
     char buf[MAX_PACKET_LENGTH];
     uint8_t mem_buf[MAX_PACKET_LENGTH];
     uint8_t *registers;
@@ -1587,7 +1610,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
     case '?':
         /* TODO: Make this return the correct value for user-mode.  */
         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
-                 s->c_cpu->cpu_index+1);
+                 gdb_id(s->c_cpu));
         put_packet(s, buf);
         /* Remove all the breakpoints when this query is issued,
          * because gdb is doing and initial connect and the state
@@ -1751,9 +1774,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             put_packet(s, "OK");
             break;
         }
-        for (env = first_cpu; env != NULL; env = env->next_cpu)
-            if (env->cpu_index + 1 == thread)
-                break;
+        env = find_cpu(thread);
         if (env == NULL) {
             put_packet(s, "E22");
             break;
@@ -1774,14 +1795,13 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         break;
     case 'T':
         thread = strtoull(p, (char **)&p, 16);
-#ifndef CONFIG_USER_ONLY
-        if (thread > 0 && thread < smp_cpus + 1)
-#else
-        if (thread == 1)
-#endif
-             put_packet(s, "OK");
-        else
+        env = find_cpu(thread);
+
+        if (env != NULL) {
+            put_packet(s, "OK");
+        } else {
             put_packet(s, "E22");
+        }
         break;
     case 'q':
     case 'Q':
@@ -1819,7 +1839,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         } else if (strcmp(p,"sThreadInfo") == 0) {
         report_cpuinfo:
             if (s->query_cpu) {
-                snprintf(buf, sizeof(buf), "m%x", s->query_cpu->cpu_index+1);
+                snprintf(buf, sizeof(buf), "m%x", gdb_id(s->query_cpu));
                 put_packet(s, buf);
                 s->query_cpu = s->query_cpu->next_cpu;
             } else
@@ -1827,16 +1847,15 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             break;
         } else if (strncmp(p,"ThreadExtraInfo,", 16) == 0) {
             thread = strtoull(p+16, (char **)&p, 16);
-            for (env = first_cpu; env != NULL; env = env->next_cpu)
-                if (env->cpu_index + 1 == thread) {
-                    cpu_synchronize_state(env, 0);
-                    len = snprintf((char *)mem_buf, sizeof(mem_buf),
-                                   "CPU#%d [%s]", env->cpu_index,
-                                   env->halted ? "halted " : "running");
-                    memtohex(buf, mem_buf, len);
-                    put_packet(s, buf);
-                    break;
-                }
+            env = find_cpu(thread);
+            if (env != NULL) {
+                cpu_synchronize_state(env, 0);
+                len = snprintf((char *)mem_buf, sizeof(mem_buf),
+                               "CPU#%d [%s]", env->cpu_index,
+                               env->halted ? "halted " : "running");
+                memtohex(buf, mem_buf, len);
+                put_packet(s, buf);
+            }
             break;
         }
 #ifdef CONFIG_USER_ONLY
@@ -1966,7 +1985,7 @@ static void gdb_vm_state_change(void *opaque, int running, int reason)
             }
             snprintf(buf, sizeof(buf),
                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
-                     GDB_SIGNAL_TRAP, env->cpu_index+1, type,
+                     GDB_SIGNAL_TRAP, gdb_id(env), type,
                      env->watchpoint_hit->vaddr);
             put_packet(s, buf);
             env->watchpoint_hit = NULL;
@@ -1977,7 +1996,7 @@ static void gdb_vm_state_change(void *opaque, int running, int reason)
     } else {
         ret = GDB_SIGNAL_INT;
     }
-    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, env->cpu_index+1);
+    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, gdb_id(env));
     put_packet(s, buf);
 }
 #endif
diff --git a/hw/armv7m.c b/hw/armv7m.c
index 9657ed1f1..c3c5b9e34 100644
--- a/hw/armv7m.c
+++ b/hw/armv7m.c
@@ -198,7 +198,7 @@ qemu_irq *armv7m_init(int flash_size, int sram_size,
     armv7m_bitband_init();
 
     nvic = qdev_create(NULL, "armv7m_nvic");
-    qdev_set_prop_ptr(nvic, "cpu", env);
+    env->v7m.nvic = nvic;
     qdev_init(nvic);
     cpu_pic = arm_pic_init_cpu(env);
     sysbus_connect_irq(sysbus_from_qdev(nvic), 0, cpu_pic[ARM_PIC_CPU_IRQ]);
diff --git a/hw/armv7m_nvic.c b/hw/armv7m_nvic.c
index 2a948ac34..f789c785f 100644
--- a/hw/armv7m_nvic.c
+++ b/hw/armv7m_nvic.c
@@ -393,15 +393,10 @@ static int nvic_load(QEMUFile *f, void *opaque, int version_id)
 static void armv7m_nvic_init(SysBusDevice *dev)
 {
     nvic_state *s= FROM_SYSBUSGIC(nvic_state, dev);
-    CPUState *env;
 
-    env = qdev_get_prop_ptr(&dev->qdev, "cpu");
     gic_init(&s->gic);
     cpu_register_physical_memory(0xe000e000, 0x1000, s->gic.iomemtype);
     s->systick.timer = qemu_new_timer(vm_clock, systick_timer_tick, s);
-    if (env->v7m.nvic)
-        hw_error("CPU can only have one NVIC\n");
-    env->v7m.nvic = s;
     register_savevm("armv7m_nvic", -1, 1, nvic_save, nvic_load, s);
 }
 
diff --git a/hw/qdev.c b/hw/qdev.c
index d945ff953..5175fe17f 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -29,9 +29,11 @@
 #include "net.h"
 #include "qdev.h"
 #include "sysemu.h"
+#include "monitor.h"
 
 struct DeviceProperty {
     const char *name;
+    DevicePropType type;
     union {
         uint64_t i;
         void *ptr;
@@ -84,7 +86,6 @@ DeviceState *qdev_create(BusState *bus, const char *name)
     }
 
     dev = qemu_mallocz(t->size);
-    dev->name = name;
     dev->type = t;
 
     if (!bus) {
@@ -120,13 +121,15 @@ void qdev_free(DeviceState *dev)
     free(dev);
 }
 
-static DeviceProperty *create_prop(DeviceState *dev, const char *name)
+static DeviceProperty *create_prop(DeviceState *dev, const char *name,
+                                   DevicePropType type)
 {
     DeviceProperty *prop;
 
     /* TODO: Check for duplicate properties.  */
     prop = qemu_mallocz(sizeof(*prop));
     prop->name = qemu_strdup(name);
+    prop->type = type;
     prop->next = dev->props;
     dev->props = prop;
 
@@ -137,15 +140,23 @@ void qdev_set_prop_int(DeviceState *dev, const char *name, uint64_t value)
 {
     DeviceProperty *prop;
 
-    prop = create_prop(dev, name);
+    prop = create_prop(dev, name, PROP_TYPE_INT);
     prop->value.i = value;
 }
 
+void qdev_set_prop_dev(DeviceState *dev, const char *name, DeviceState *value)
+{
+    DeviceProperty *prop;
+
+    prop = create_prop(dev, name, PROP_TYPE_DEV);
+    prop->value.ptr = value;
+}
+
 void qdev_set_prop_ptr(DeviceState *dev, const char *name, void *value)
 {
     DeviceProperty *prop;
 
-    prop = create_prop(dev, name);
+    prop = create_prop(dev, name, PROP_TYPE_PTR);
     prop->value.ptr = value;
 }
 
@@ -162,7 +173,7 @@ CharDriverState *qdev_init_chardev(DeviceState *dev)
     static int next_serial;
     static int next_virtconsole;
     /* FIXME: This is a nasty hack that needs to go away.  */
-    if (strncmp(dev->name, "virtio", 6) == 0) {
+    if (strncmp(dev->type->name, "virtio", 6) == 0) {
         return virtcon_hds[next_virtconsole++];
     } else {
         return serial_hds[next_serial++];
@@ -174,12 +185,14 @@ BusState *qdev_get_parent_bus(DeviceState *dev)
     return dev->parent_bus;
 }
 
-static DeviceProperty *find_prop(DeviceState *dev, const char *name)
+static DeviceProperty *find_prop(DeviceState *dev, const char *name,
+                                 DevicePropType type)
 {
     DeviceProperty *prop;
 
     for (prop = dev->props; prop; prop = prop->next) {
         if (strcmp(prop->name, name) == 0) {
+            assert (prop->type == type);
             return prop;
         }
     }
@@ -190,9 +203,10 @@ uint64_t qdev_get_prop_int(DeviceState *dev, const char *name, uint64_t def)
 {
     DeviceProperty *prop;
 
-    prop = find_prop(dev, name);
-    if (!prop)
+    prop = find_prop(dev, name, PROP_TYPE_INT);
+    if (!prop) {
         return def;
+    }
 
     return prop->value.i;
 }
@@ -201,11 +215,22 @@ void *qdev_get_prop_ptr(DeviceState *dev, const char *name)
 {
     DeviceProperty *prop;
 
-    prop = find_prop(dev, name);
+    prop = find_prop(dev, name, PROP_TYPE_PTR);
     assert(prop);
     return prop->value.ptr;
 }
 
+DeviceState *qdev_get_prop_dev(DeviceState *dev, const char *name)
+{
+    DeviceProperty *prop;
+
+    prop = find_prop(dev, name, PROP_TYPE_DEV);
+    if (!prop) {
+        return NULL;
+    }
+    return prop->value.ptr;
+}
+
 void qdev_init_gpio_in(DeviceState *dev, qemu_irq_handler handler, int n)
 {
     assert(dev->num_gpio_in == 0);
@@ -313,3 +338,75 @@ BusState *qbus_create(BusType type, size_t size,
     }
     return bus;
 }
+
+static const char *bus_type_names[] = {
+    "System",
+    "PCI",
+    "SCSI",
+    "I2C",
+    "SSI"
+};
+
+#define qdev_printf(fmt, ...) monitor_printf(mon, "%*s" fmt, indent, "", ## __VA_ARGS__)
+static void qbus_print(Monitor *mon, BusState *bus, int indent);
+
+static void qdev_print(Monitor *mon, DeviceState *dev, int indent)
+{
+    DeviceProperty *prop;
+    BusState *child;
+    qdev_printf("dev: %s\n", dev->type->name);
+    indent += 2;
+    if (dev->num_gpio_in) {
+        qdev_printf("gpio-in %d\n", dev->num_gpio_in);
+    }
+    if (dev->num_gpio_out) {
+        qdev_printf("gpio-out %d\n", dev->num_gpio_out);
+    }
+    for (prop = dev->props; prop; prop = prop->next) {
+        switch (prop->type) {
+        case PROP_TYPE_INT:
+            qdev_printf("prop-int %s 0x%" PRIx64 "\n", prop->name,
+                        prop->value.i);
+            break;
+        case PROP_TYPE_PTR:
+            qdev_printf("prop-ptr %s\n", prop->name);
+            break;
+        case PROP_TYPE_DEV:
+            qdev_printf("prop-dev %s %s\n", prop->name,
+                        ((DeviceState *)prop->value.ptr)->type->name);
+            break;
+        default:
+            qdev_printf("prop-unknown%d %s\n", prop->type, prop->name);
+            break;
+        }
+    }
+    switch (dev->parent_bus->type) {
+    case BUS_TYPE_SYSTEM:
+        sysbus_dev_print(mon, dev, indent);
+        break;
+    default:
+        break;
+    }
+    LIST_FOREACH(child, &dev->child_bus, sibling) {
+        qbus_print(mon, child, indent);
+    }
+}
+
+static void qbus_print(Monitor *mon, BusState *bus, int indent)
+{
+    struct DeviceState *dev;
+
+    qdev_printf("bus: %s\n", bus->name);
+    indent += 2;
+    qdev_printf("type %s\n", bus_type_names[bus->type]);
+    LIST_FOREACH(dev, &bus->children, sibling) {
+        qdev_print(mon, dev, indent);
+    }
+}
+#undef qdev_printf
+
+void do_info_qtree(Monitor *mon)
+{
+    if (main_system_bus)
+        qbus_print(mon, main_system_bus, 0);
+}
diff --git a/hw/qdev.h b/hw/qdev.h
index 143a1f873..7291805b4 100644
--- a/hw/qdev.h
+++ b/hw/qdev.h
@@ -13,7 +13,6 @@ typedef struct BusState BusState;
 /* This structure should not be accessed directly.  We declare it here
    so that it can be embedded in individual device state structures.  */
 struct DeviceState {
-    const char *name;
     DeviceType *type;
     BusState *parent_bus;
     DeviceProperty *props;
@@ -50,6 +49,7 @@ void qdev_free(DeviceState *dev);
 
 /* Set properties between creation and init.  */
 void qdev_set_prop_int(DeviceState *dev, const char *name, uint64_t value);
+void qdev_set_prop_dev(DeviceState *dev, const char *name, DeviceState *value);
 void qdev_set_prop_ptr(DeviceState *dev, const char *name, void *value);
 void qdev_set_netdev(DeviceState *dev, NICInfo *nd);
 
@@ -60,6 +60,17 @@ BusState *qdev_get_child_bus(DeviceState *dev, const char *name);
 
 /*** Device API.  ***/
 
+typedef enum {
+    PROP_TYPE_INT,
+    PROP_TYPE_PTR,
+    PROP_TYPE_DEV
+} DevicePropType;
+
+typedef struct {
+    const char *name;
+    DevicePropType type;
+} DevicePropList;
+
 typedef struct DeviceInfo DeviceInfo;
 
 typedef void (*qdev_initfn)(DeviceState *dev, DeviceInfo *info);
@@ -69,6 +80,7 @@ typedef void (*SCSIAttachFn)(DeviceState *host, BlockDriverState *bdrv,
 struct DeviceInfo {
     qdev_initfn init;
     BusType bus_type;
+    DevicePropList *props;
 };
 
 void qdev_register(const char *name, int size, DeviceInfo *info);
@@ -84,6 +96,8 @@ CharDriverState *qdev_init_chardev(DeviceState *dev);
 
 BusState *qdev_get_parent_bus(DeviceState *dev);
 uint64_t qdev_get_prop_int(DeviceState *dev, const char *name, uint64_t def);
+DeviceState *qdev_get_prop_dev(DeviceState *dev, const char *name);
+/* FIXME: Remove opaque pointer properties.  */
 void *qdev_get_prop_ptr(DeviceState *dev, const char *name);
 
 /* Convery from a base type to a parent type, with compile time checking.  */
@@ -103,4 +117,9 @@ BusState *qbus_create(BusType type, size_t size,
 
 #define FROM_QBUS(type, dev) DO_UPCAST(type, qbus, dev)
 
+/*** monitor commands ***/
+
+void do_info_qtree(Monitor *mon);
+void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent);
+
 #endif
diff --git a/hw/syborg_timer.c b/hw/syborg_timer.c
index a84ad8602..b833330e5 100644
--- a/hw/syborg_timer.c
+++ b/hw/syborg_timer.c
@@ -226,10 +226,20 @@ static void syborg_timer_init(SysBusDevice *dev)
                     syborg_timer_save, syborg_timer_load, s);
 }
 
+static SysBusDeviceInfo syborg_timer_info = {
+    .init = syborg_timer_init,
+    .qdev = {
+        .props = (DevicePropList[]) {
+              {.name = "frequency", .type = PROP_TYPE_INT},
+              {.name = NULL}
+        }
+    }
+};
+
 static void syborg_timer_register_devices(void)
 {
-    sysbus_register_dev("syborg,timer", sizeof(SyborgTimerState),
-                        syborg_timer_init);
+    sysbus_register_withprop("syborg,timer", sizeof(SyborgTimerState),
+                            &syborg_timer_info);
 }
 
 device_init(syborg_timer_register_devices)
diff --git a/hw/sysbus.c b/hw/sysbus.c
index 13d81f541..fbd2ddf39 100644
--- a/hw/sysbus.c
+++ b/hw/sysbus.c
@@ -20,11 +20,7 @@
 
 #include "sysbus.h"
 #include "sysemu.h"
-
-typedef struct {
-    DeviceInfo qdev;
-    sysbus_initfn init;
-} SysBusDeviceInfo;
+#include "monitor.h"
 
 void sysbus_connect_irq(SysBusDevice *dev, int n, qemu_irq irq)
 {
@@ -109,12 +105,9 @@ static void sysbus_device_init(DeviceState *dev, DeviceInfo *base)
     info->init(sysbus_from_qdev(dev));
 }
 
-void sysbus_register_dev(const char *name, size_t size, sysbus_initfn init)
+void sysbus_register_withprop(const char *name, size_t size,
+                              SysBusDeviceInfo *info)
 {
-    SysBusDeviceInfo *info;
-
-    info = qemu_mallocz(sizeof(*info));
-    info->init = init;
     info->qdev.init = sysbus_device_init;
     info->qdev.bus_type = BUS_TYPE_SYSTEM;
 
@@ -122,6 +115,15 @@ void sysbus_register_dev(const char *name, size_t size, sysbus_initfn init)
     qdev_register(name, size, &info->qdev);
 }
 
+void sysbus_register_dev(const char *name, size_t size, sysbus_initfn init)
+{
+    SysBusDeviceInfo *info;
+
+    info = qemu_mallocz(sizeof(*info));
+    info->init = init;
+    sysbus_register_withprop(name, size, info);
+}
+
 DeviceState *sysbus_create_varargs(const char *name,
                                    target_phys_addr_t addr, ...)
 {
@@ -149,3 +151,14 @@ DeviceState *sysbus_create_varargs(const char *name,
     }
     return dev;
 }
+
+void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
+{
+    SysBusDevice *s = sysbus_from_qdev(dev);
+    int i;
+
+    for (i = 0; i < s->num_mmio; i++) {
+        monitor_printf(mon, "%*smmio " TARGET_FMT_plx "/" TARGET_FMT_plx "\n",
+                       indent, "", s->mmio[i].addr, s->mmio[i].size);
+    }
+}
diff --git a/hw/sysbus.h b/hw/sysbus.h
index 44ed792d2..297366166 100644
--- a/hw/sysbus.h
+++ b/hw/sysbus.h
@@ -31,7 +31,14 @@ typedef void (*sysbus_initfn)(SysBusDevice *dev);
 #define sysbus_from_qdev(dev) ((SysBusDevice *)(dev))
 #define FROM_SYSBUS(type, dev) DO_UPCAST(type, busdev, dev)
 
+typedef struct {
+    DeviceInfo qdev;
+    sysbus_initfn init;
+} SysBusDeviceInfo;
+
 void sysbus_register_dev(const char *name, size_t size, sysbus_initfn init);
+void sysbus_register_withprop(const char *name, size_t size,
+                              SysBusDeviceInfo *info);
 void *sysbus_new(void);
 void sysbus_init_mmio(SysBusDevice *dev, target_phys_addr_t size, int iofunc);
 void sysbus_init_mmio_cb(SysBusDevice *dev, target_phys_addr_t size,
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index a0915a455..59c91f8da 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3202,6 +3202,7 @@ static void *clone_func(void *arg)
     env = info->env;
     thread_env = env;
     info->tid = gettid();
+    env->host_tid = info->tid;
     if (info->child_tidptr)
         put_user_u32(info->tid, info->child_tidptr);
     if (info->parent_tidptr)
@@ -3792,6 +3793,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
       /* FIXME: This probably breaks if a signal arrives.  We should probably
          be disabling signals.  */
       if (first_cpu->next_cpu) {
+          TaskState *ts;
           CPUState **lastp;
           CPUState *p;
 
@@ -3809,7 +3811,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
           /* Remove the CPU from the list.  */
           *lastp = p->next_cpu;
           cpu_list_unlock();
-          TaskState *ts = ((CPUState *)cpu_env)->opaque;
+          ts = ((CPUState *)cpu_env)->opaque;
           if (ts->child_tidptr) {
               put_user_u32(0, ts->child_tidptr);
               sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
diff --git a/monitor.c b/monitor.c
index 540e95b34..7d4d06042 100644
--- a/monitor.c
+++ b/monitor.c
@@ -23,6 +23,7 @@
  */
 #include <dirent.h>
 #include "hw/hw.h"
+#include "hw/qdev.h"
 #include "hw/usb.h"
 #include "hw/pcmcia.h"
 #include "hw/pc.h"
@@ -1516,6 +1517,7 @@ static void do_info_capture(Monitor *mon)
     }
 }
 
+#ifdef HAS_AUDIO
 static void do_stop_capture(Monitor *mon, int n)
 {
     int i;
@@ -1531,7 +1533,6 @@ static void do_stop_capture(Monitor *mon, int n)
     }
 }
 
-#ifdef HAS_AUDIO
 static void do_wav_capture(Monitor *mon, const char *path,
                            int has_freq, int freq,
                            int has_bits, int bits,
@@ -1682,129 +1683,12 @@ static void do_acl(Monitor *mon,
     }
 }
 
-/* Please update qemu-doc.texi when adding or changing commands */
 static const mon_cmd_t mon_cmds[] = {
-    { "help|?", "s?", help_cmd,
-      "[cmd]", "show the help" },
-    { "commit", "s", do_commit,
-      "device|all", "commit changes to the disk images (if -snapshot is used) or backing files" },
-    { "info", "s?", do_info,
-      "[subcommand]", "show various information about the system state" },
-    { "q|quit", "", do_quit,
-      "", "quit the emulator" },
-    { "eject", "-fB", do_eject,
-      "[-f] device", "eject a removable medium (use -f to force it)" },
-    { "change", "BFs?", do_change,
-      "device filename [format]", "change a removable medium, optional format" },
-    { "screendump", "F", do_screen_dump,
-      "filename", "save screen into PPM image 'filename'" },
-    { "logfile", "F", do_logfile,
-      "filename", "output logs to 'filename'" },
-    { "log", "s", do_log,
-      "item1[,...]", "activate logging of the specified items to '/tmp/qemu.log'" },
-    { "savevm", "s?", do_savevm,
-      "[tag|id]", "save a VM snapshot. If no tag or id are provided, a new snapshot is created" },
-    { "loadvm", "s", do_loadvm,
-      "tag|id", "restore a VM snapshot from its tag or id" },
-    { "delvm", "s", do_delvm,
-      "tag|id", "delete a VM snapshot from its tag or id" },
-    { "singlestep", "s?", do_singlestep,
-      "[on|off]", "run emulation in singlestep mode or switch to normal mode", },
-    { "stop", "", do_stop,
-      "", "stop emulation", },
-    { "c|cont", "", do_cont,
-      "", "resume emulation", },
-    { "gdbserver", "s?", do_gdbserver,
-      "[device]", "start gdbserver on given device (default 'tcp::1234'), stop with 'none'", },
-    { "x", "/l", do_memory_dump,
-      "/fmt addr", "virtual memory dump starting at 'addr'", },
-    { "xp", "/l", do_physical_memory_dump,
-      "/fmt addr", "physical memory dump starting at 'addr'", },
-    { "p|print", "/l", do_print,
-      "/fmt expr", "print expression value (use $reg for CPU register access)", },
-    { "i", "/ii.", do_ioport_read,
-      "/fmt addr", "I/O port read" },
-
-    { "sendkey", "si?", do_sendkey,
-      "keys [hold_ms]", "send keys to the VM (e.g. 'sendkey ctrl-alt-f1', default hold time=100 ms)" },
-    { "system_reset", "", do_system_reset,
-      "", "reset the system" },
-    { "system_powerdown", "", do_system_powerdown,
-      "", "send system power down event" },
-    { "sum", "ii", do_sum,
-      "addr size", "compute the checksum of a memory region" },
-    { "usb_add", "s", do_usb_add,
-      "device", "add USB device (e.g. 'host:bus.addr' or 'host:vendor_id:product_id')" },
-    { "usb_del", "s", do_usb_del,
-      "device", "remove USB device 'bus.addr'" },
-    { "cpu", "i", do_cpu_set,
-      "index", "set the default CPU" },
-    { "mouse_move", "sss?", do_mouse_move,
-      "dx dy [dz]", "send mouse move events" },
-    { "mouse_button", "i", do_mouse_button,
-      "state", "change mouse button state (1=L, 2=M, 4=R)" },
-    { "mouse_set", "i", do_mouse_set,
-      "index", "set which mouse device receives events" },
-#ifdef HAS_AUDIO
-    { "wavcapture", "si?i?i?", do_wav_capture,
-      "path [frequency [bits [channels]]]",
-      "capture audio to a wave file (default frequency=44100 bits=16 channels=2)" },
-#endif
-    { "stopcapture", "i", do_stop_capture,
-      "capture index", "stop capture" },
-    { "memsave", "lis", do_memory_save,
-      "addr size file", "save to disk virtual memory dump starting at 'addr' of size 'size'", },
-    { "pmemsave", "lis", do_physical_memory_save,
-      "addr size file", "save to disk physical memory dump starting at 'addr' of size 'size'", },
-    { "boot_set", "s", do_boot_set,
-      "bootdevice", "define new values for the boot device list" },
-#if defined(TARGET_I386)
-    { "nmi", "i", do_inject_nmi,
-      "cpu", "inject an NMI on the given CPU", },
-#endif
-    { "migrate", "-ds", do_migrate,
-      "[-d] uri", "migrate to URI (using -d to not wait for completion)" },
-    { "migrate_cancel", "", do_migrate_cancel,
-      "", "cancel the current VM migration" },
-    { "migrate_set_speed", "s", do_migrate_set_speed,
-      "value", "set maximum speed (in bytes) for migrations" },
-#if defined(TARGET_I386)
-    { "drive_add", "ss", drive_hot_add, "pci_addr=[[<domain>:]<bus>:]<slot>\n"
-                                         "[file=file][,if=type][,bus=n]\n"
-                                        "[,unit=m][,media=d][index=i]\n"
-                                        "[,cyls=c,heads=h,secs=s[,trans=t]]\n"
-                                        "[snapshot=on|off][,cache=on|off]",
-                                        "add drive to PCI storage controller" },
-    { "pci_add", "sss", pci_device_hot_add, "pci_addr=auto|[[<domain>:]<bus>:]<slot> nic|storage|host [[vlan=n][,macaddr=addr][,model=type]] [file=file][,if=type][,bus=nr]... [host=02:00.0[,name=string][,dma=none]", "hot-add PCI device" },
-    { "pci_del", "s", pci_device_hot_remove, "pci_addr=[[<domain>:]<bus>:]<slot>", "hot remove PCI device" },
-#endif
-    { "host_net_add", "ss?", net_host_device_add,
-      "tap|user|socket|vde|dump [options]", "add host VLAN client" },
-    { "host_net_remove", "is", net_host_device_remove,
-      "vlan_id name", "remove host VLAN client" },
-#ifdef CONFIG_SLIRP
-    { "host_net_redir", "ss?", net_slirp_redir,
-      "[tcp|udp]:host-port:[guest-host]:guest-port", "redirect TCP or UDP connections from host to guest (requires -net user)\n"
-      "host_net_redir remove [tcp:|udp:]host-port -- remove redirection\n"
-      "host_net_redir list -- show all redirections" },
-#endif
-    { "balloon", "i", do_balloon,
-      "target", "request VM to change it's memory allocation (in MB)" },
-    { "set_link", "ss", do_set_link,
-      "name up|down", "change the link status of a network adapter" },
-    { "watchdog_action", "s", do_watchdog_action,
-      "[reset|shutdown|poweroff|pause|debug|none]", "change watchdog action" },
-    { "acl", "sss?i?", do_acl, "<command> <aclname> [<match> [<index>]]\n",
-                               "acl show vnc.username\n"
-                               "acl policy vnc.username deny\n"
-                               "acl allow vnc.username fred\n"
-                               "acl deny vnc.username bob\n"
-                               "acl reset vnc.username\n" },
-    { "cpu_set", "is", do_cpu_set_nr, "cpu [online|offline]", "change cpu state" },
+#include "qemu-monitor.h"
     { NULL, NULL, },
 };
 
-/* Please update qemu-doc.texi when adding or changing commands */
+/* Please update qemu-monitor.hx when adding or changing commands */
 static const mon_cmd_t info_cmds[] = {
     { "version", "", do_info_version,
       "", "show the version of QEMU" },
@@ -1879,6 +1763,8 @@ static const mon_cmd_t info_cmds[] = {
     { "migrate", "", do_info_migrate, "", "show migration status" },
     { "balloon", "", do_info_balloon,
       "", "show balloon information" },
+    { "qtree", "", do_info_qtree,
+      "", "show device tree" },
     { NULL, NULL, },
 };
 
diff --git a/qemu-doc.texi b/qemu-doc.texi
index 837c2a4e5..6eed6efdb 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -318,357 +318,7 @@ from a disk file.
 
 The following commands are available:
 
-@table @option
-
-@item help or ? [@var{cmd}]
-Show the help for all commands or just for command @var{cmd}.
-
-@item commit
-Commit changes to the disk images (if -snapshot is used).
-
-@item info @var{subcommand}
-Show various information about the system state.
-
-@table @option
-@item info version
-show the version of QEMU
-@item info network
-show the various VLANs and the associated devices
-@item info chardev
-show the character devices
-@item info block
-show the block devices
-@item info block
-show block device statistics
-@item info registers
-show the cpu registers
-@item info cpus
-show infos for each CPU
-@item info history
-show the command line history
-@item info irq
-show the interrupts statistics (if available)
-@item info pic
-show i8259 (PIC) state
-@item info pci
-show emulated PCI device info
-@item info tlb
-show virtual to physical memory mappings (i386 only)
-@item info mem
-show the active virtual memory mappings (i386 only)
-@item info hpet
-show state of HPET (i386 only)
-@item info kqemu
-show KQEMU information
-@item info kvm
-show KVM information
-@item info usb
-show USB devices plugged on the virtual USB hub
-@item info usbhost
-show all USB host devices
-@item info profile
-show profiling information
-@item info capture
-show information about active capturing
-@item info snapshots
-show list of VM snapshots
-@item info status
-show the current VM status (running|paused)
-@item info pcmcia
-show guest PCMCIA status
-@item info mice
-show which guest mouse is receiving events
-@item info vnc
-show the vnc server status
-@item info name
-show the current VM name
-@item info uuid
-show the current VM UUID
-@item info cpustats
-show CPU statistics
-@item info slirp
-show SLIRP statistics (if available)
-@item info migrate
-show migration status
-@item info balloon
-show balloon information
-@end table
-
-@item q or quit
-Quit the emulator.
-
-@item eject [-f] @var{device}
-Eject a removable medium (use -f to force it).
-
-@item change @var{device} @var{setting}
-
-Change the configuration of a device.
-
-@table @option
-@item change @var{diskdevice} @var{filename} [@var{format}]
-Change the medium for a removable disk device to point to @var{filename}. eg
-
-@example
-(qemu) change ide1-cd0 /path/to/some.iso
-@end example
-
-@var{format} is optional.
-
-@item change vnc @var{display},@var{options}
-Change the configuration of the VNC server. The valid syntax for @var{display}
-and @var{options} are described at @ref{sec_invocation}. eg
-
-@example
-(qemu) change vnc localhost:1
-@end example
-
-@item change vnc password [@var{password}]
-
-Change the password associated with the VNC server. If the new password is not
-supplied, the monitor will prompt for it to be entered. VNC passwords are only
-significant up to 8 letters. eg
-
-@example
-(qemu) change vnc password
-Password: ********
-@end example
-
-@end table
-
-@item acl @var{subcommand} @var{aclname} @var{match} @var{index}
-
-Manage access control lists for network services. There are currently
-two named access control lists, @var{vnc.x509dname} and @var{vnc.username}
-matching on the x509 client certificate distinguished name, and SASL
-username respectively.
-
-@table @option
-@item acl show <aclname>
-list all the match rules in the access control list, and the default
-policy
-@item acl policy <aclname> @code{allow|deny}
-set the default access control list policy, used in the event that
-none of the explicit rules match. The default policy at startup is
-always @code{deny}
-@item acl allow <aclname> <match> [<index>]
-add a match to the access control list, allowing access. The match will
-normally be an exact username or x509 distinguished name, but can
-optionally include wildcard globs. eg @code{*@@EXAMPLE.COM} to allow
-all users in the @code{EXAMPLE.COM} kerberos realm. The match will
-normally be appended to the end of the ACL, but can be inserted
-earlier in the list if the optional @code{index} parameter is supplied.
-@item acl deny <aclname> <match> [<index>]
-add a match to the access control list, denying access. The match will
-normally be an exact username or x509 distinguished name, but can
-optionally include wildcard globs. eg @code{*@@EXAMPLE.COM} to allow
-all users in the @code{EXAMPLE.COM} kerberos realm. The match will
-normally be appended to the end of the ACL, but can be inserted
-earlier in the list if the optional @code{index} parameter is supplied.
-@item acl remove <aclname> <match>
-remove the specified match rule from the access control list.
-@item acl reset <aclname>
-remove all matches from the access control list, and set the default
-policy back to @code{deny}.
-@end table
-
-@item screendump @var{filename}
-Save screen into PPM image @var{filename}.
-
-@item logfile @var{filename}
-Output logs to @var{filename}.
-
-@item log @var{item1}[,...]
-Activate logging of the specified items to @file{/tmp/qemu.log}.
-
-@item savevm [@var{tag}|@var{id}]
-Create a snapshot of the whole virtual machine. If @var{tag} is
-provided, it is used as human readable identifier. If there is already
-a snapshot with the same tag or ID, it is replaced. More info at
-@ref{vm_snapshots}.
-
-@item loadvm @var{tag}|@var{id}
-Set the whole virtual machine to the snapshot identified by the tag
-@var{tag} or the unique snapshot ID @var{id}.
-
-@item delvm @var{tag}|@var{id}
-Delete the snapshot identified by @var{tag} or @var{id}.
-
-@item singlestep [off]
-Run the emulation in single step mode.
-If called with option off, the emulation returns to normal mode.
-
-@item stop
-Stop emulation.
-
-@item c or cont
-Resume emulation.
-
-@item gdbserver [@var{port}]
-Start gdbserver session (default @var{port}=1234)
-
-@item x/fmt @var{addr}
-Virtual memory dump starting at @var{addr}.
-
-@item xp /@var{fmt} @var{addr}
-Physical memory dump starting at @var{addr}.
-
-@var{fmt} is a format which tells the command how to format the
-data. Its syntax is: @option{/@{count@}@{format@}@{size@}}
-
-@table @var
-@item count
-is the number of items to be dumped.
-
-@item format
-can be x (hex), d (signed decimal), u (unsigned decimal), o (octal),
-c (char) or i (asm instruction).
-
-@item size
-can be b (8 bits), h (16 bits), w (32 bits) or g (64 bits). On x86,
-@code{h} or @code{w} can be specified with the @code{i} format to
-respectively select 16 or 32 bit code instruction size.
-
-@end table
-
-Examples:
-@itemize
-@item
-Dump 10 instructions at the current instruction pointer:
-@example
-(qemu) x/10i $eip
-0x90107063:  ret
-0x90107064:  sti
-0x90107065:  lea    0x0(%esi,1),%esi
-0x90107069:  lea    0x0(%edi,1),%edi
-0x90107070:  ret
-0x90107071:  jmp    0x90107080
-0x90107073:  nop
-0x90107074:  nop
-0x90107075:  nop
-0x90107076:  nop
-@end example
-
-@item
-Dump 80 16 bit values at the start of the video memory.
-@smallexample
-(qemu) xp/80hx 0xb8000
-0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42
-0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41
-0x000b8020: 0x0b42 0x0b69 0x0b6f 0x0b73 0x0b20 0x0b63 0x0b75 0x0b72
-0x000b8030: 0x0b72 0x0b65 0x0b6e 0x0b74 0x0b2d 0x0b63 0x0b76 0x0b73
-0x000b8040: 0x0b20 0x0b30 0x0b35 0x0b20 0x0b4e 0x0b6f 0x0b76 0x0b20
-0x000b8050: 0x0b32 0x0b30 0x0b30 0x0b33 0x0720 0x0720 0x0720 0x0720
-0x000b8060: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
-0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
-0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
-0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
-@end smallexample
-@end itemize
-
-@item p or print/@var{fmt} @var{expr}
-
-Print expression value. Only the @var{format} part of @var{fmt} is
-used.
-
-@item sendkey @var{keys}
-
-Send @var{keys} to the emulator. @var{keys} could be the name of the
-key or @code{#} followed by the raw value in either decimal or hexadecimal
-format. Use @code{-} to press several keys simultaneously. Example:
-@example
-sendkey ctrl-alt-f1
-@end example
-
-This command is useful to send keys that your graphical user interface
-intercepts at low level, such as @code{ctrl-alt-f1} in X Window.
-
-@item system_reset
-
-Reset the system.
-
-@item system_powerdown
-
-Power down the system (if supported).
-
-@item sum @var{addr} @var{size}
-
-Compute the checksum of a memory region.
-
-@item usb_add @var{devname}
-
-Add the USB device @var{devname}.  For details of available devices see
-@ref{usb_devices}
-
-@item usb_del @var{devname}
-
-Remove the USB device @var{devname} from the QEMU virtual USB
-hub. @var{devname} has the syntax @code{bus.addr}. Use the monitor
-command @code{info usb} to see the devices you can remove.
-
-@item mouse_move @var{dx} @var{dy} [@var{dz}]
-Move the active mouse to the specified coordinates @var{dx} @var{dy}
-with optional scroll axis @var{dz}.
-
-@item mouse_button @var{val}
-Change the active mouse button state @var{val} (1=L, 2=M, 4=R).
-
-@item mouse_set @var{index}
-Set which mouse device receives events at given @var{index}, index
-can be obtained with
-@example
-info mice
-@end example
-
-@item wavcapture @var{filename} [@var{frequency} [@var{bits} [@var{channels}]]]
-Capture audio into @var{filename}. Using sample rate @var{frequency}
-bits per sample @var{bits} and number of channels @var{channels}.
-
-Defaults:
-@itemize @minus
-@item Sample rate = 44100 Hz - CD quality
-@item Bits = 16
-@item Number of channels = 2 - Stereo
-@end itemize
-
-@item stopcapture @var{index}
-Stop capture with a given @var{index}, index can be obtained with
-@example
-info capture
-@end example
-
-@item memsave @var{addr} @var{size} @var{file}
-save to disk virtual memory dump starting at @var{addr} of size @var{size}.
-
-@item pmemsave @var{addr} @var{size} @var{file}
-save to disk physical memory dump starting at @var{addr} of size @var{size}.
-
-@item boot_set @var{bootdevicelist}
-
-Define new values for the boot device list. Those values will override
-the values specified on the command line through the @code{-boot} option.
-
-The values that can be specified here depend on the machine type, but are
-the same that can be specified in the @code{-boot} command line option.
-
-@item nmi @var{cpu}
-Inject an NMI on the given CPU.
-
-@item migrate [-d] @var{uri}
-Migrate to @var{uri} (using -d to not wait for completion).
-
-@item migrate_cancel
-Cancel the current VM migration.
-
-@item migrate_set_speed @var{value}
-Set maximum speed to @var{value} (in bytes) for migrations.
-
-@item balloon @var{value}
-Request VM to change its memory allocation to @var{value} (in MB).
-
-@item set_link @var{name} [up|down]
-Set link @var{name} up or down.
-
-@end table
+@include qemu-monitor.texi
 
 @subsection Integer expressions
 
diff --git a/qemu-monitor.hx b/qemu-monitor.hx
new file mode 100644
index 000000000..1e7210ecc
--- /dev/null
+++ b/qemu-monitor.hx
@@ -0,0 +1,615 @@
+HXCOMM Use DEFHEADING() to define headings in both help text and texi
+HXCOMM Text between STEXI and ETEXI are copied to texi version and
+HXCOMM discarded from C version
+HXCOMM DEF(command, args, callback, arg_string, help) is used to construct
+HXCOMM monitor commands
+HXCOMM HXCOMM can be used for comments, discarded from both texi and C
+
+STEXI
+@table @option
+ETEXI
+
+    { "help|?", "s?", help_cmd, "[cmd]", "show the help" },
+STEXI
+@item help or ? [@var{cmd}]
+Show the help for all commands or just for command @var{cmd}.
+ETEXI
+
+    { "commit", "s", do_commit,
+      "device|all", "commit changes to the disk images (if -snapshot is used) or backing files" },
+STEXI
+@item commit
+Commit changes to the disk images (if -snapshot is used) or backing files.
+ETEXI
+
+    { "info", "s?", do_info,
+      "[subcommand]", "show various information about the system state" },
+STEXI
+@item info @var{subcommand}
+Show various information about the system state.
+
+@table @option
+@item info version
+show the version of QEMU
+@item info network
+show the various VLANs and the associated devices
+@item info chardev
+show the character devices
+@item info block
+show the block devices
+@item info block
+show block device statistics
+@item info registers
+show the cpu registers
+@item info cpus
+show infos for each CPU
+@item info history
+show the command line history
+@item info irq
+show the interrupts statistics (if available)
+@item info pic
+show i8259 (PIC) state
+@item info pci
+show emulated PCI device info
+@item info tlb
+show virtual to physical memory mappings (i386 only)
+@item info mem
+show the active virtual memory mappings (i386 only)
+@item info hpet
+show state of HPET (i386 only)
+@item info kqemu
+show KQEMU information
+@item info kvm
+show KVM information
+@item info usb
+show USB devices plugged on the virtual USB hub
+@item info usbhost
+show all USB host devices
+@item info profile
+show profiling information
+@item info capture
+show information about active capturing
+@item info snapshots
+show list of VM snapshots
+@item info status
+show the current VM status (running|paused)
+@item info pcmcia
+show guest PCMCIA status
+@item info mice
+show which guest mouse is receiving events
+@item info vnc
+show the vnc server status
+@item info name
+show the current VM name
+@item info uuid
+show the current VM UUID
+@item info cpustats
+show CPU statistics
+@item info slirp
+show SLIRP statistics (if available)
+@item info migrate
+show migration status
+@item info balloon
+show balloon information
+@item info qtree
+show device tree
+@end table
+ETEXI
+
+    { "q|quit", "", do_quit,
+      "", "quit the emulator" },
+STEXI
+@item q or quit
+Quit the emulator.
+ETEXI
+
+    { "eject", "-fB", do_eject,
+      "[-f] device", "eject a removable medium (use -f to force it)" },
+STEXI
+@item eject [-f] @var{device}
+Eject a removable medium (use -f to force it).
+ETEXI
+
+    { "change", "BFs?", do_change,
+      "device filename [format]", "change a removable medium, optional format" },
+STEXI
+@item change @var{device} @var{setting}
+
+Change the configuration of a device.
+
+@table @option
+@item change @var{diskdevice} @var{filename} [@var{format}]
+Change the medium for a removable disk device to point to @var{filename}. eg
+
+@example
+(qemu) change ide1-cd0 /path/to/some.iso
+@end example
+
+@var{format} is optional.
+
+@item change vnc @var{display},@var{options}
+Change the configuration of the VNC server. The valid syntax for @var{display}
+and @var{options} are described at @ref{sec_invocation}. eg
+
+@example
+(qemu) change vnc localhost:1
+@end example
+
+@item change vnc password [@var{password}]
+
+Change the password associated with the VNC server. If the new password is not
+supplied, the monitor will prompt for it to be entered. VNC passwords are only
+significant up to 8 letters. eg
+
+@example
+(qemu) change vnc password
+Password: ********
+@end example
+
+@end table
+ETEXI
+
+    { "screendump", "F", do_screen_dump,
+      "filename", "save screen into PPM image 'filename'" },
+STEXI
+@item screendump @var{filename}
+Save screen into PPM image @var{filename}.
+ETEXI
+
+    { "logfile", "F", do_logfile,
+      "filename", "output logs to 'filename'" },
+STEXI
+@item logfile @var{filename}
+Output logs to @var{filename}.
+ETEXI
+
+    { "log", "s", do_log,
+      "item1[,...]", "activate logging of the specified items to '/tmp/qemu.log'" },
+STEXI
+@item log @var{item1}[,...]
+Activate logging of the specified items to @file{/tmp/qemu.log}.
+ETEXI
+
+    { "savevm", "s?", do_savevm,
+      "[tag|id]", "save a VM snapshot. If no tag or id are provided, a new snapshot is created" },
+STEXI
+@item savevm [@var{tag}|@var{id}]
+Create a snapshot of the whole virtual machine. If @var{tag} is
+provided, it is used as human readable identifier. If there is already
+a snapshot with the same tag or ID, it is replaced. More info at
+@ref{vm_snapshots}.
+ETEXI
+
+    { "loadvm", "s", do_loadvm,
+      "tag|id", "restore a VM snapshot from its tag or id" },
+STEXI
+@item loadvm @var{tag}|@var{id}
+Set the whole virtual machine to the snapshot identified by the tag
+@var{tag} or the unique snapshot ID @var{id}.
+ETEXI
+
+    { "delvm", "s", do_delvm,
+      "tag|id", "delete a VM snapshot from its tag or id" },
+STEXI
+@item delvm @var{tag}|@var{id}
+Delete the snapshot identified by @var{tag} or @var{id}.
+ETEXI
+
+    { "singlestep", "s?", do_singlestep,
+      "[on|off]", "run emulation in singlestep mode or switch to normal mode", },
+STEXI
+@item singlestep [off]
+Run the emulation in single step mode.
+If called with option off, the emulation returns to normal mode.
+ETEXI
+
+    { "stop", "", do_stop,
+      "", "stop emulation", },
+STEXI
+@item stop
+Stop emulation.
+ETEXI
+
+    { "c|cont", "", do_cont,
+      "", "resume emulation", },
+STEXI
+@item c or cont
+Resume emulation.
+ETEXI
+
+    { "gdbserver", "s?", do_gdbserver,
+      "[device]", "start gdbserver on given device (default 'tcp::1234'), stop with 'none'", },
+STEXI
+@item gdbserver [@var{port}]
+Start gdbserver session (default @var{port}=1234)
+ETEXI
+
+    { "x", "/l", do_memory_dump,
+      "/fmt addr", "virtual memory dump starting at 'addr'", },
+STEXI
+@item x/fmt @var{addr}
+Virtual memory dump starting at @var{addr}.
+ETEXI
+
+    { "xp", "/l", do_physical_memory_dump,
+      "/fmt addr", "physical memory dump starting at 'addr'", },
+STEXI
+@item xp /@var{fmt} @var{addr}
+Physical memory dump starting at @var{addr}.
+
+@var{fmt} is a format which tells the command how to format the
+data. Its syntax is: @option{/@{count@}@{format@}@{size@}}
+
+@table @var
+@item count
+is the number of items to be dumped.
+
+@item format
+can be x (hex), d (signed decimal), u (unsigned decimal), o (octal),
+c (char) or i (asm instruction).
+
+@item size
+can be b (8 bits), h (16 bits), w (32 bits) or g (64 bits). On x86,
+@code{h} or @code{w} can be specified with the @code{i} format to
+respectively select 16 or 32 bit code instruction size.
+
+@end table
+
+Examples:
+@itemize
+@item
+Dump 10 instructions at the current instruction pointer:
+@example
+(qemu) x/10i $eip
+0x90107063:  ret
+0x90107064:  sti
+0x90107065:  lea    0x0(%esi,1),%esi
+0x90107069:  lea    0x0(%edi,1),%edi
+0x90107070:  ret
+0x90107071:  jmp    0x90107080
+0x90107073:  nop
+0x90107074:  nop
+0x90107075:  nop
+0x90107076:  nop
+@end example
+
+@item
+Dump 80 16 bit values at the start of the video memory.
+@smallexample
+(qemu) xp/80hx 0xb8000
+0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42
+0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41
+0x000b8020: 0x0b42 0x0b69 0x0b6f 0x0b73 0x0b20 0x0b63 0x0b75 0x0b72
+0x000b8030: 0x0b72 0x0b65 0x0b6e 0x0b74 0x0b2d 0x0b63 0x0b76 0x0b73
+0x000b8040: 0x0b20 0x0b30 0x0b35 0x0b20 0x0b4e 0x0b6f 0x0b76 0x0b20
+0x000b8050: 0x0b32 0x0b30 0x0b30 0x0b33 0x0720 0x0720 0x0720 0x0720
+0x000b8060: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
+0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
+0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
+0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
+@end smallexample
+@end itemize
+ETEXI
+
+    { "p|print", "/l", do_print,
+      "/fmt expr", "print expression value (use $reg for CPU register access)", },
+STEXI
+@item p or print/@var{fmt} @var{expr}
+
+Print expression value. Only the @var{format} part of @var{fmt} is
+used.
+ETEXI
+
+    { "i", "/ii.", do_ioport_read,
+      "/fmt addr", "I/O port read" },
+STEXI
+Read I/O port.
+ETEXI
+
+
+    { "sendkey", "si?", do_sendkey,
+      "keys [hold_ms]", "send keys to the VM (e.g. 'sendkey ctrl-alt-f1', default hold time=100 ms)" },
+STEXI
+@item sendkey @var{keys}
+
+Send @var{keys} to the emulator. @var{keys} could be the name of the
+key or @code{#} followed by the raw value in either decimal or hexadecimal
+format. Use @code{-} to press several keys simultaneously. Example:
+@example
+sendkey ctrl-alt-f1
+@end example
+
+This command is useful to send keys that your graphical user interface
+intercepts at low level, such as @code{ctrl-alt-f1} in X Window.
+ETEXI
+
+    { "system_reset", "", do_system_reset,
+      "", "reset the system" },
+STEXI
+@item system_reset
+
+Reset the system.
+ETEXI
+
+    { "system_powerdown", "", do_system_powerdown,
+      "", "send system power down event" },
+STEXI
+@item system_powerdown
+
+Power down the system (if supported).
+ETEXI
+
+    { "sum", "ii", do_sum,
+      "addr size", "compute the checksum of a memory region" },
+STEXI
+@item sum @var{addr} @var{size}
+
+Compute the checksum of a memory region.
+ETEXI
+
+    { "usb_add", "s", do_usb_add,
+      "device", "add USB device (e.g. 'host:bus.addr' or 'host:vendor_id:product_id')" },
+STEXI
+@item usb_add @var{devname}
+
+Add the USB device @var{devname}.  For details of available devices see
+@ref{usb_devices}
+ETEXI
+
+    { "usb_del", "s", do_usb_del,
+      "device", "remove USB device 'bus.addr'" },
+STEXI
+@item usb_del @var{devname}
+
+Remove the USB device @var{devname} from the QEMU virtual USB
+hub. @var{devname} has the syntax @code{bus.addr}. Use the monitor
+command @code{info usb} to see the devices you can remove.
+ETEXI
+
+    { "cpu", "i", do_cpu_set,
+      "index", "set the default CPU" },
+STEXI
+Set the default CPU.
+ETEXI
+
+    { "mouse_move", "sss?", do_mouse_move,
+      "dx dy [dz]", "send mouse move events" },
+STEXI
+@item mouse_move @var{dx} @var{dy} [@var{dz}]
+Move the active mouse to the specified coordinates @var{dx} @var{dy}
+with optional scroll axis @var{dz}.
+ETEXI
+
+    { "mouse_button", "i", do_mouse_button,
+      "state", "change mouse button state (1=L, 2=M, 4=R)" },
+STEXI
+@item mouse_button @var{val}
+Change the active mouse button state @var{val} (1=L, 2=M, 4=R).
+ETEXI
+
+    { "mouse_set", "i", do_mouse_set,
+      "index", "set which mouse device receives events" },
+STEXI
+@item mouse_set @var{index}
+Set which mouse device receives events at given @var{index}, index
+can be obtained with
+@example
+info mice
+@end example
+ETEXI
+
+#ifdef HAS_AUDIO
+    { "wavcapture", "si?i?i?", do_wav_capture,
+      "path [frequency [bits [channels]]]",
+      "capture audio to a wave file (default frequency=44100 bits=16 channels=2)" },
+#endif
+STEXI
+@item wavcapture @var{filename} [@var{frequency} [@var{bits} [@var{channels}]]]
+Capture audio into @var{filename}. Using sample rate @var{frequency}
+bits per sample @var{bits} and number of channels @var{channels}.
+
+Defaults:
+@itemize @minus
+@item Sample rate = 44100 Hz - CD quality
+@item Bits = 16
+@item Number of channels = 2 - Stereo
+@end itemize
+ETEXI
+
+#ifdef HAS_AUDIO
+    { "stopcapture", "i", do_stop_capture,
+      "capture index", "stop capture" },
+#endif
+STEXI
+@item stopcapture @var{index}
+Stop capture with a given @var{index}, index can be obtained with
+@example
+info capture
+@end example
+ETEXI
+
+    { "memsave", "lis", do_memory_save,
+      "addr size file", "save to disk virtual memory dump starting at 'addr' of size 'size'", },
+STEXI
+@item memsave @var{addr} @var{size} @var{file}
+save to disk virtual memory dump starting at @var{addr} of size @var{size}.
+ETEXI
+
+    { "pmemsave", "lis", do_physical_memory_save,
+      "addr size file", "save to disk physical memory dump starting at 'addr' of size 'size'", },
+STEXI
+@item pmemsave @var{addr} @var{size} @var{file}
+save to disk physical memory dump starting at @var{addr} of size @var{size}.
+ETEXI
+
+    { "boot_set", "s", do_boot_set,
+      "bootdevice", "define new values for the boot device list" },
+STEXI
+@item boot_set @var{bootdevicelist}
+
+Define new values for the boot device list. Those values will override
+the values specified on the command line through the @code{-boot} option.
+
+The values that can be specified here depend on the machine type, but are
+the same that can be specified in the @code{-boot} command line option.
+ETEXI
+
+#if defined(TARGET_I386)
+    { "nmi", "i", do_inject_nmi,
+      "cpu", "inject an NMI on the given CPU", },
+#endif
+STEXI
+@item nmi @var{cpu}
+Inject an NMI on the given CPU (x86 only).
+ETEXI
+
+    { "migrate", "-ds", do_migrate,
+      "[-d] uri", "migrate to URI (using -d to not wait for completion)" },
+STEXI
+@item migrate [-d] @var{uri}
+Migrate to @var{uri} (using -d to not wait for completion).
+ETEXI
+
+    { "migrate_cancel", "", do_migrate_cancel,
+      "", "cancel the current VM migration" },
+STEXI
+@item migrate_cancel
+Cancel the current VM migration.
+ETEXI
+
+    { "migrate_set_speed", "s", do_migrate_set_speed,
+      "value", "set maximum speed (in bytes) for migrations" },
+STEXI
+@item migrate_set_speed @var{value}
+Set maximum speed to @var{value} (in bytes) for migrations.
+ETEXI
+
+#if defined(TARGET_I386)
+    { "drive_add", "ss", drive_hot_add, "pci_addr=[[<domain>:]<bus>:]<slot>\n"
+                                         "[file=file][,if=type][,bus=n]\n"
+                                        "[,unit=m][,media=d][index=i]\n"
+                                        "[,cyls=c,heads=h,secs=s[,trans=t]]\n"
+                                        "[snapshot=on|off][,cache=on|off]",
+                                        "add drive to PCI storage controller" },
+#endif
+STEXI
+@item drive_add
+Add drive to PCI storage controller.
+ETEXI
+
+#if defined(TARGET_I386)
+    { "pci_add", "sss", pci_device_hot_add, "pci_addr=auto|[[<domain>:]<bus>:]<slot> nic|storage|host [[vlan=n][,macaddr=addr][,model=type]] [file=file][,if=type][,bus=nr]... [host=02:00.0[,name=string][,dma=none]", "hot-add PCI device" },
+#endif
+STEXI
+@item pci_add
+Hot-add PCI device.
+ETEXI
+
+#if defined(TARGET_I386)
+    { "pci_del", "s", pci_device_hot_remove, "pci_addr=[[<domain>:]<bus>:]<slot>", "hot remove PCI device" },
+#endif
+STEXI
+@item pci_del
+Hot remove PCI device.
+ETEXI
+
+    { "host_net_add", "ss?", net_host_device_add,
+      "tap|user|socket|vde|dump [options]", "add host VLAN client" },
+STEXI
+@item host_net_add
+Add host VLAN client.
+ETEXI
+
+    { "host_net_remove", "is", net_host_device_remove,
+      "vlan_id name", "remove host VLAN client" },
+STEXI
+@item host_net_remove
+Remove host VLAN client.
+ETEXI
+
+#ifdef CONFIG_SLIRP
+    { "host_net_redir", "ss?", net_slirp_redir,
+      "[tcp|udp]:host-port:[guest-host]:guest-port", "redirect TCP or UDP connections from host to guest (requires -net user)\n"
+      "host_net_redir remove [tcp:|udp:]host-port -- remove redirection\n"
+      "host_net_redir list -- show all redirections" },
+#endif
+STEXI
+@item host_net_redir
+Redirect TCP or UDP connections from host to guest (requires -net user).
+ETEXI
+
+    { "balloon", "i", do_balloon,
+      "target", "request VM to change it's memory allocation (in MB)" },
+STEXI
+@item balloon @var{value}
+Request VM to change its memory allocation to @var{value} (in MB).
+ETEXI
+
+    { "set_link", "ss", do_set_link,
+      "name up|down", "change the link status of a network adapter" },
+STEXI
+@item set_link @var{name} [up|down]
+Set link @var{name} up or down.
+ETEXI
+
+    { "watchdog_action", "s", do_watchdog_action,
+      "[reset|shutdown|poweroff|pause|debug|none]", "change watchdog action" },
+STEXI
+@item watchdog_action
+Change watchdog action.
+ETEXI
+
+    { "acl", "sss?i?", do_acl, "<command> <aclname> [<match> [<index>]]\n",
+                               "acl show vnc.username\n"
+                               "acl policy vnc.username deny\n"
+                               "acl allow vnc.username fred\n"
+                               "acl deny vnc.username bob\n"
+                               "acl reset vnc.username\n" },
+STEXI
+@item acl @var{subcommand} @var{aclname} @var{match} @var{index}
+
+Manage access control lists for network services. There are currently
+two named access control lists, @var{vnc.x509dname} and @var{vnc.username}
+matching on the x509 client certificate distinguished name, and SASL
+username respectively.
+
+@table @option
+@item acl show <aclname>
+list all the match rules in the access control list, and the default
+policy
+@item acl policy <aclname> @code{allow|deny}
+set the default access control list policy, used in the event that
+none of the explicit rules match. The default policy at startup is
+always @code{deny}
+@item acl allow <aclname> <match> [<index>]
+add a match to the access control list, allowing access. The match will
+normally be an exact username or x509 distinguished name, but can
+optionally include wildcard globs. eg @code{*@@EXAMPLE.COM} to allow
+all users in the @code{EXAMPLE.COM} kerberos realm. The match will
+normally be appended to the end of the ACL, but can be inserted
+earlier in the list if the optional @code{index} parameter is supplied.
+@item acl deny <aclname> <match> [<index>]
+add a match to the access control list, denying access. The match will
+normally be an exact username or x509 distinguished name, but can
+optionally include wildcard globs. eg @code{*@@EXAMPLE.COM} to allow
+all users in the @code{EXAMPLE.COM} kerberos realm. The match will
+normally be appended to the end of the ACL, but can be inserted
+earlier in the list if the optional @code{index} parameter is supplied.
+@item acl remove <aclname> <match>
+remove the specified match rule from the access control list.
+@item acl reset <aclname>
+remove all matches from the access control list, and set the default
+policy back to @code{deny}.
+@end table
+ETEXI
+
+    { "cpu_set", "is", do_cpu_set_nr,
+      "cpu [online|offline]", "change cpu state" },
+STEXI
+@item cpu_set @var{cpu} [online|offline]
+Set CPU @var{cpu} online or offline.
+ETEXI
+
+STEXI
+@end table
+ETEXI
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index e98a48d65..ec8feb04a 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -67,8 +67,6 @@
 #define R_FLAG 0x100
 #define P_FLAG 0x80
 #define U_FLAG 0x40
-#define P_FLAG 0x80
-#define U_FLAG 0x40
 #define I_FLAG 0x20
 #define X_FLAG 0x10
 #define N_FLAG 0x08
diff --git a/target-sparc/translate.c b/target-sparc/translate.c
index cd22f2bf8..6de40791b 100644
--- a/target-sparc/translate.c
+++ b/target-sparc/translate.c
@@ -42,7 +42,8 @@
 
 /* global register indexes */
 static TCGv_ptr cpu_env, cpu_regwptr;
-static TCGv cpu_cc_src, cpu_cc_src2, cpu_cc_dst, cpu_cc_op;
+static TCGv cpu_cc_src, cpu_cc_src2, cpu_cc_dst;
+static TCGv_i32 cpu_cc_op;
 static TCGv_i32 cpu_psr;
 static TCGv cpu_fsr, cpu_pc, cpu_npc, cpu_gregs[8];
 static TCGv cpu_y;