Merge remote-tracking branch 'stefanha/block' into staging

# By Kevin Wolf (22) and Fam Zheng (1)
# Via Stefan Hajnoczi
* stefanha/block: (23 commits)
  vmdk: refuse to open higher version than supported
  block: Always enable discard on the protocol level
  qcow2: Batch discards
  qcow2: Options to enable discard for freed clusters
  qcow2: Add refcount update reason to all callers
  Revert "block: Disable driver-specific options for 1.5"
  ide: Clean up ide_exec_cmd()
  ide: Convert SMART commands to ide_cmd_table handler
  ide: Convert CF-ATA commands to ide_cmd_table handler
  ide: Convert ATAPI commands to ide_cmd_table handler
  ide: Convert SEEK to ide_cmd_table handler
  ide: Convert FLUSH CACHE to ide_cmd_table handler
  ide: Convert SET FEATURES to ide_cmd_table handler
  ide: Convert CHECK POWER MDOE to ide_cmd_table handler
  ide: Convert READ NATIVE MAX ADDRESS to ide_cmd_table handler
  ide: Convert DMA read/write commands to ide_cmd_table handler
  ide: Convert PIO read/write commands to ide_cmd_table handler
  ide: Convert read/write multiple commands to ide_cmd_table handler
  ide: Convert verify commands to ide_cmd_table handler
  ide: Convert cmd_nop commands to ide_cmd_table handler
  ...

Message-id: 1372065035-19601-1-git-send-email-stefanha@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
diff --git a/Makefile b/Makefile
index 3cfa7d0..c06bfab 100644
--- a/Makefile
+++ b/Makefile
@@ -146,10 +146,11 @@
 	(cd $(SRC_PATH)/pixman; autoreconf -v --install)
 
 DTC_MAKE_ARGS=-I$(SRC_PATH)/dtc VPATH=$(SRC_PATH)/dtc -C dtc V="$(V)" LIBFDT_srcdir=$(SRC_PATH)/dtc/libfdt
-DTC_CFLAGS=$(CFLAGS) $(QEMU_CFLAGS) -I$(BUILD_DIR)/dtc -I$(SRC_PATH)/dtc -I$(SRC_PATH)/dtc/libfdt
+DTC_CFLAGS=$(CFLAGS) $(QEMU_CFLAGS)
+DTC_CPPFLAGS=-I$(BUILD_DIR)/dtc -I$(SRC_PATH)/dtc -I$(SRC_PATH)/dtc/libfdt
 
 subdir-dtc:dtc/libfdt dtc/tests
-	$(call quiet-command,$(MAKE) $(DTC_MAKE_ARGS) CFLAGS="$(DTC_CFLAGS)" LDFLAGS="$(LDFLAGS)" ARFLAGS="$(ARFLAGS)" CC="$(CC)" AR="$(AR)" LD="$(LD)" $(SUBDIR_MAKEFLAGS) libfdt/libfdt.a,)
+	$(call quiet-command,$(MAKE) $(DTC_MAKE_ARGS) CPPFLAGS="$(DTC_CPPFLAGS)" CFLAGS="$(DTC_CFLAGS)" LDFLAGS="$(LDFLAGS)" ARFLAGS="$(ARFLAGS)" CC="$(CC)" AR="$(AR)" LD="$(LD)" $(SUBDIR_MAKEFLAGS) libfdt/libfdt.a,)
 
 dtc/%:
 	mkdir -p $@
diff --git a/audio/audio_int.h b/audio/audio_int.h
index b9b0676..fd019a0 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -243,38 +243,13 @@
     return (dst >= src) ? (dst - src) : (len - src + dst);
 }
 
-static void GCC_ATTR dolog (const char *fmt, ...)
-{
-    va_list ap;
-
-    va_start (ap, fmt);
-    AUD_vlog (AUDIO_CAP, fmt, ap);
-    va_end (ap);
-}
+#define dolog(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
 
 #ifdef DEBUG
-static void GCC_ATTR ldebug (const char *fmt, ...)
-{
-    va_list ap;
-
-    va_start (ap, fmt);
-    AUD_vlog (AUDIO_CAP, fmt, ap);
-    va_end (ap);
-}
+#define ldebug(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
 #else
-#if defined NDEBUG && defined __GNUC__
-#define ldebug(...)
-#elif defined NDEBUG && defined _MSC_VER
-#define ldebug __noop
-#else
-static void GCC_ATTR ldebug (const char *fmt, ...)
-{
-    (void) fmt;
-}
+#define ldebug(fmt, ...) (void)0
 #endif
-#endif
-
-#undef GCC_ATTR
 
 #define AUDIO_STRINGIFY_(n) #n
 #define AUDIO_STRINGIFY(n) AUDIO_STRINGIFY_(n)
diff --git a/configure b/configure
index ad32f87..0e0adde 100755
--- a/configure
+++ b/configure
@@ -2529,7 +2529,7 @@
     fdt_libs="-L\$(BUILD_DIR)/dtc/libfdt $fdt_libs"
   elif test "$fdt" = "yes" ; then
     # have neither and want - prompt for system/submodule install
-    error_exit "ERROR: DTC not present. Your options:" \
+    error_exit "DTC not present. Your options:" \
         "  (1) Preferred: Install the DTC devel package" \
         "  (2) Fetch the DTC submodule, using:" \
         "      git submodule update --init dtc"
@@ -3329,6 +3329,7 @@
 int main (void) {
   a = a + b;
   b = a * b;
+  a = a * a;
   return 0;
 }
 EOF
diff --git a/hw/block/nand.c b/hw/block/nand.c
index 087ca14..43401a0 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -298,10 +298,8 @@
 
     case NAND_CMD_BLOCKERASE2:
         s->addr &= (1ull << s->addrlen * 8) - 1;
-        if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP)
-            s->addr <<= 16;
-        else
-            s->addr <<= 8;
+        s->addr <<= nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP ?
+                                                                    16 : 8;
 
         if (s->wp) {
             s->blk_erase(s);
@@ -464,10 +462,11 @@
     s->ce = ce;
     s->wp = wp;
     s->gnd = gnd;
-    if (wp)
+    if (wp) {
         s->status |= NAND_IOSTATUS_UNPROTCT;
-    else
+    } else {
         s->status &= ~NAND_IOSTATUS_UNPROTCT;
+    }
 }
 
 void nand_getpins(DeviceState *dev, int *rb)
@@ -489,13 +488,12 @@
                 return;
             }
         }
-        if (value == NAND_CMD_READ0)
+        if (value == NAND_CMD_READ0) {
             s->offset = 0;
-	else if (value == NAND_CMD_READ1) {
+        } else if (value == NAND_CMD_READ1) {
             s->offset = 0x100;
             value = NAND_CMD_READ0;
-        }
-	else if (value == NAND_CMD_READ2) {
+        } else if (value == NAND_CMD_READ2) {
             s->offset = 1 << s->page_shift;
             value = NAND_CMD_READ0;
         }
@@ -508,8 +506,9 @@
                 s->cmd == NAND_CMD_BLOCKERASE2 ||
                 s->cmd == NAND_CMD_NOSERIALREAD2 ||
                 s->cmd == NAND_CMD_RANDOMREAD2 ||
-                s->cmd == NAND_CMD_RESET)
+                s->cmd == NAND_CMD_RESET) {
             nand_command(s);
+        }
 
         if (s->cmd != NAND_CMD_RANDOMREAD2) {
             s->addrlen = 0;
@@ -596,8 +595,9 @@
             s->iolen = (1 << s->page_shift) + (1 << s->oob_shift) - offset;
     }
 
-    if (s->ce || s->iolen <= 0)
+    if (s->ce || s->iolen <= 0) {
         return 0;
+    }
 
     for (offset = s->buswidth; offset--;) {
         x |= s->ioaddr[offset] << (offset << 3);
@@ -696,8 +696,9 @@
     uint8_t iobuf[0x200] = { [0 ... 0x1ff] = 0xff, };
     addr = s->addr & ~((1 << (ADDR_SHIFT + s->erase_shift)) - 1);
 
-    if (PAGE(addr) >= s->pages)
+    if (PAGE(addr) >= s->pages) {
         return;
+    }
 
     if (!s->bdrv) {
         memset(s->storage + PAGE_START(addr),
@@ -725,11 +726,12 @@
         memset(iobuf, 0xff, 0x200);
         i = (addr & ~0x1ff) + 0x200;
         for (addr += ((PAGE_SIZE + OOB_SIZE) << s->erase_shift) - 0x200;
-                        i < addr; i += 0x200)
+                        i < addr; i += 0x200) {
             if (bdrv_write(s->bdrv, i >> 9, iobuf, 1) < 0) {
                 printf("%s: write error in sector %" PRIu64 "\n",
                        __func__, i >> 9);
             }
+        }
 
         page = i >> 9;
         if (bdrv_read(s->bdrv, page, iobuf, 1) < 0) {
@@ -745,8 +747,9 @@
 static void glue(nand_blk_load_, PAGE_SIZE)(NANDFlashState *s,
                 uint64_t addr, int offset)
 {
-    if (PAGE(addr) >= s->pages)
+    if (PAGE(addr) >= s->pages) {
         return;
+    }
 
     if (s->bdrv) {
         if (s->mem_oob) {
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index c2a7834..205e125 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -297,9 +297,7 @@
         return;
     }
 
-    while (size) {
-        size -= qemu_chr_fe_write(s->chr, buf, size);
-    }
+    qemu_chr_fe_write_all(s->chr, buf, size);
 }
 
 static void uart_receive(void *opaque, const uint8_t *buf, int size)
diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index f511a62..269b1a7 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -199,7 +199,7 @@
     c->hot_y = cursor->header.hot_spot_y;
     switch (cursor->header.type) {
     case SPICE_CURSOR_TYPE_ALPHA:
-        size = cursor->header.width * cursor->header.height * sizeof(uint32_t);
+        size = sizeof(uint32_t) * cursor->header.width * cursor->header.height;
         memcpy(c->data, cursor->chunk.data, size);
         if (qxl->debug > 2) {
             cursor_print_ascii_art(c, "qxl/alpha");
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index c475cb1..937a402 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -387,6 +387,7 @@
     d->ram->int_pending = cpu_to_le32(0);
     d->ram->int_mask    = cpu_to_le32(0);
     d->ram->update_surface = 0;
+    d->ram->monitors_config = 0;
     SPICE_RING_INIT(&d->ram->cmd_ring);
     SPICE_RING_INIT(&d->ram->cursor_ring);
     SPICE_RING_INIT(&d->ram->release_ring);
diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index ff85590..1fb7ad4 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -548,6 +548,7 @@
     if (fscanf(f, "%li\n", &id) == 1) {
         *val = id;
     } else {
+        fclose(f);
         return -1;
     }
     fclose(f);
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 97362f2..7972443 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -622,6 +622,18 @@
             .driver   = "virtio-serial-pci",\
             .property = "vectors",\
             .value    = stringify(0),\
+        },{\
+            .driver   = "usb-mouse",\
+            .property = "serial",\
+            .value    = "1",\
+        },{\
+            .driver   = "usb-tablet",\
+            .property = "serial",\
+            .value    = "1",\
+        },{\
+            .driver   = "usb-kbd",\
+            .property = "serial",\
+            .value    = "1",\
         }
 
 static QEMUMachine pc_machine_v0_12 = {
diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index d5944bc..61a8aad 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -250,7 +250,7 @@
     DriveInfo *dinfo;
 
     dinfo = drive_get_next(IF_SD);
-    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, 0);
+    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     s->enabled = dinfo ? bdrv_is_inserted(dinfo->bdrv) : 0;
 
     memory_region_init_io(&s->regs_region, &memcard_mmio_ops, s,
diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index d4079cd..ba9f4b3 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -592,7 +592,7 @@
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     /* Instantiate the storage */
-    s->card = sd_init(bd, 0);
+    s->card = sd_init(bd, false);
 
     return s;
 }
@@ -617,7 +617,7 @@
     omap_l4_attach(ta, 0, &s->iomem);
 
     /* Instantiate the storage */
-    s->card = sd_init(bd, 0);
+    s->card = sd_init(bd, false);
 
     s->cdet = qemu_allocate_irqs(omap_mmc_cover_cb, s, 1)[0];
     sd_set_cb(s->card, NULL, s->cdet);
diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index 2527296..e08fd04 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -485,7 +485,7 @@
     sysbus_init_irq(dev, &s->irq[1]);
     qdev_init_gpio_out(&s->busdev.qdev, s->cardstatus, 2);
     dinfo = drive_get_next(IF_SD);
-    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, 0);
+    s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     return 0;
 }
 
diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c
index 2db1cab..0574d6b 100644
--- a/hw/sd/pxa2xx_mmci.c
+++ b/hw/sd/pxa2xx_mmci.c
@@ -538,7 +538,7 @@
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
     /* Instantiate the actual storage */
-    s->card = sd_init(bd, 0);
+    s->card = sd_init(bd, false);
 
     register_savevm(NULL, "pxa2xx_mmci", 0, 0,
                     pxa2xx_mmci_save, pxa2xx_mmci_load, s);
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 0065067..b9dd4be 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1165,7 +1165,7 @@
     DriveInfo *di;
 
     di = drive_get_next(IF_SD);
-    s->card = sd_init(di ? di->bdrv : NULL, 0);
+    s->card = sd_init(di ? di->bdrv : NULL, false);
     s->eject_cb = qemu_allocate_irqs(sdhci_insert_eject_cb, s, 1)[0];
     s->ro_cb = qemu_allocate_irqs(sdhci_card_readonly_cb, s, 1)[0];
     sd_set_cb(s->card, s->ro_cb, s->eject_cb);
diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index 4d3c4f6..d47e237 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -245,7 +245,7 @@
 
     s->mode = SSI_SD_CMD;
     dinfo = drive_get_next(IF_SD);
-    s->sd = sd_init(dinfo ? dinfo->bdrv : NULL, 1);
+    s->sd = sd_init(dinfo ? dinfo->bdrv : NULL, true);
     register_savevm(&dev->qdev, "ssi_sd", -1, 1, ssi_sd_save, ssi_sd_load, s);
     return 0;
 }
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index d1827be..f83d1de 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -13,6 +13,7 @@
 
 static Property usb_props[] = {
     DEFINE_PROP_STRING("port", USBDevice, port_path),
+    DEFINE_PROP_STRING("serial", USBDevice, serial),
     DEFINE_PROP_BIT("full-path", USBDevice, flags,
                     USB_DEV_FLAG_FULL_PATH, true),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/usb/desc.c b/hw/usb/desc.c
index fce303e..bf6c522 100644
--- a/hw/usb/desc.c
+++ b/hw/usb/desc.c
@@ -566,6 +566,12 @@
     char *path;
     int dst;
 
+    if (dev->serial) {
+        /* 'serial' usb bus property has priority if present */
+        usb_desc_set_string(dev, index, dev->serial);
+        return;
+    }
+
     assert(index != 0 && desc->str[index] != NULL);
     dst = snprintf(serial, sizeof(serial), "%s", desc->str[index]);
     path = qdev_get_dev_path(hcd);
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index b48899d..31f3cde 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -560,6 +560,9 @@
 {
     USBHIDState *us = DO_UPCAST(USBHIDState, dev, dev);
 
+    if (dev->serial) {
+        usb_desc_set_string(dev, STR_SERIALNUMBER, dev->serial);
+    }
     usb_desc_init(dev);
     us->intr = usb_ep_get(dev, USB_TOKEN_IN, 1);
     hid_init(&us->hid, kind, usb_hid_changed);
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 1073901..fe914ab 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -58,7 +58,6 @@
     USBPacket *packet;
     /* usb-storage only */
     BlockConf conf;
-    char *serial;
     uint32_t removable;
 } MSDState;
 
@@ -602,7 +601,7 @@
         return -1;
     }
 
-    blkconf_serial(&s->conf, &s->serial);
+    blkconf_serial(&s->conf, &dev->serial);
 
     /*
      * Hack alert: this pretends to be a block device, but it's really
@@ -616,16 +615,11 @@
     bdrv_detach_dev(bs, &s->dev.qdev);
     s->conf.bs = NULL;
 
-    if (s->serial) {
-        usb_desc_set_string(dev, STR_SERIALNUMBER, s->serial);
-    } else {
-        usb_desc_create_serial(dev);
-    }
-
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
     scsi_bus_new(&s->bus, &s->dev.qdev, &usb_msd_scsi_info_storage, NULL);
     scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0, !!s->removable,
-                                            s->conf.bootindex, s->serial);
+                                            s->conf.bootindex, dev->serial);
     if (!scsi_dev) {
         return -1;
     }
@@ -734,7 +728,6 @@
 
 static Property msd_properties[] = {
     DEFINE_BLOCK_PROPERTIES(MSDState, conf),
-    DEFINE_PROP_STRING("serial", MSDState, serial),
     DEFINE_PROP_BIT("removable", MSDState, removable, 0, false),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index f1b5f5d..5d229bc 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -60,20 +60,30 @@
     pci_conf[0x6e] = 0x00;
     pci_conf[0x6f] = 0xc0;  /* USBLEFCTLSTS */
 
-    s->caps[0x09] = 0x68;        /* EECP */
-
     s->irq = dev->irq[3];
     s->as = pci_get_address_space(dev);
 
-    s->capsbase = 0x00;
-    s->opregbase = 0x20;
-
-    usb_ehci_initfn(s, DEVICE(dev));
+    usb_ehci_realize(s, DEVICE(dev), NULL);
     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
 
     return 0;
 }
 
+static void usb_ehci_pci_init(Object *obj)
+{
+    EHCIPCIState *i = PCI_EHCI(obj);
+    EHCIState *s = &i->ehci;
+
+    s->caps[0x09] = 0x68;        /* EECP */
+
+    s->capsbase = 0x00;
+    s->opregbase = 0x20;
+    s->portscbase = 0x44;
+    s->portnr = NB_PORTS;
+
+    usb_ehci_init(s, DEVICE(obj));
+}
+
 static void usb_ehci_pci_write_config(PCIDevice *dev, uint32_t addr,
                                       uint32_t val, int l)
 {
@@ -122,6 +132,7 @@
     .name = TYPE_PCI_EHCI,
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(EHCIPCIState),
+    .instance_init = usb_ehci_pci_init,
     .abstract = true,
     .class_init = ehci_class_init,
 };
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index f9e4fd3..e7d4f74 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -32,28 +32,42 @@
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static int usb_ehci_sysbus_initfn(SysBusDevice *dev)
+static void usb_ehci_sysbus_realize(DeviceState *dev, Error **errp)
 {
+    SysBusDevice *d = SYS_BUS_DEVICE(dev);
     EHCISysBusState *i = SYS_BUS_EHCI(dev);
-    SysBusEHCIClass *sec = SYS_BUS_EHCI_GET_CLASS(dev);
+    EHCIState *s = &i->ehci;
+
+    usb_ehci_realize(s, dev, errp);
+    sysbus_init_irq(d, &s->irq);
+}
+
+static void ehci_sysbus_init(Object *obj)
+{
+    SysBusDevice *d = SYS_BUS_DEVICE(obj);
+    EHCISysBusState *i = SYS_BUS_EHCI(obj);
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_GET_CLASS(obj);
     EHCIState *s = &i->ehci;
 
     s->capsbase = sec->capsbase;
     s->opregbase = sec->opregbase;
+    s->portscbase = sec->portscbase;
+    s->portnr = sec->portnr;
     s->as = &address_space_memory;
 
-    usb_ehci_initfn(s, DEVICE(dev));
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_mmio(dev, &s->mem);
-    return 0;
+    usb_ehci_init(s, DEVICE(obj));
+    sysbus_init_mmio(d, &s->mem);
 }
 
 static void ehci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(klass);
 
-    k->init = usb_ehci_sysbus_initfn;
+    sec->portscbase = 0x44;
+    sec->portnr = NB_PORTS;
+
+    dc->realize = usb_ehci_sysbus_realize;
     dc->vmsd = &vmstate_ehci_sysbus;
     dc->props = ehci_sysbus_properties;
 }
@@ -62,6 +76,7 @@
     .name          = TYPE_SYS_BUS_EHCI,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(EHCISysBusState),
+    .instance_init = ehci_sysbus_init,
     .abstract      = true,
     .class_init    = ehci_sysbus_class_init,
     .class_size    = sizeof(SysBusEHCIClass),
@@ -95,11 +110,101 @@
     .class_init    = ehci_exynos4210_class_init,
 };
 
+static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
+{
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+
+    sec->capsbase = 0x100;
+    sec->opregbase = 0x140;
+}
+
+static const TypeInfo ehci_tegra2_type_info = {
+    .name          = TYPE_TEGRA2_EHCI,
+    .parent        = TYPE_SYS_BUS_EHCI,
+    .class_init    = ehci_tegra2_class_init,
+};
+
+/*
+ * Faraday FUSBH200 USB 2.0 EHCI
+ */
+
+/**
+ * FUSBH200EHCIRegs:
+ * @FUSBH200_REG_EOF_ASTR: EOF/Async. Sleep Timer Register
+ * @FUSBH200_REG_BMCSR: Bus Monitor Control/Status Register
+ */
+enum FUSBH200EHCIRegs {
+    FUSBH200_REG_EOF_ASTR = 0x34,
+    FUSBH200_REG_BMCSR    = 0x40,
+};
+
+static uint64_t fusbh200_ehci_read(void *opaque, hwaddr addr, unsigned size)
+{
+    EHCIState *s = opaque;
+    hwaddr off = s->opregbase + s->portscbase + 4 * s->portnr + addr;
+
+    switch (off) {
+    case FUSBH200_REG_EOF_ASTR:
+        return 0x00000041;
+    case FUSBH200_REG_BMCSR:
+        /* High-Speed, VBUS valid, interrupt level-high active */
+        return (2 << 9) | (1 << 8) | (1 << 3);
+    }
+
+    return 0;
+}
+
+static void fusbh200_ehci_write(void *opaque, hwaddr addr, uint64_t val,
+                                unsigned size)
+{
+}
+
+static const MemoryRegionOps fusbh200_ehci_mmio_ops = {
+    .read = fusbh200_ehci_read,
+    .write = fusbh200_ehci_write,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void fusbh200_ehci_init(Object *obj)
+{
+    EHCISysBusState *i = SYS_BUS_EHCI(obj);
+    FUSBH200EHCIState *f = FUSBH200_EHCI(obj);
+    EHCIState *s = &i->ehci;
+
+    memory_region_init_io(&f->mem_vendor, &fusbh200_ehci_mmio_ops, s,
+                          "fusbh200", 0x4c);
+    memory_region_add_subregion(&s->mem,
+                                s->opregbase + s->portscbase + 4 * s->portnr,
+                                &f->mem_vendor);
+}
+
+static void fusbh200_ehci_class_init(ObjectClass *oc, void *data)
+{
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+
+    sec->capsbase = 0x0;
+    sec->opregbase = 0x10;
+    sec->portscbase = 0x20;
+    sec->portnr = 1;
+}
+
+static const TypeInfo ehci_fusbh200_type_info = {
+    .name          = TYPE_FUSBH200_EHCI,
+    .parent        = TYPE_SYS_BUS_EHCI,
+    .instance_size = sizeof(FUSBH200EHCIState),
+    .instance_init = fusbh200_ehci_init,
+    .class_init    = fusbh200_ehci_class_init,
+};
+
 static void ehci_sysbus_register_types(void)
 {
     type_register_static(&ehci_type_info);
     type_register_static(&ehci_xlnx_type_info);
     type_register_static(&ehci_exynos4210_type_info);
+    type_register_static(&ehci_tegra2_type_info);
+    type_register_static(&ehci_fusbh200_type_info);
 }
 
 type_init(ehci_sysbus_register_types)
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 1ad2159..16d6356 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -995,7 +995,7 @@
     uint32_t val;
 
     val = s->portsc[addr >> 2];
-    trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val);
+    trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val);
     return val;
 }
 
@@ -1036,7 +1036,7 @@
     uint32_t old = *portsc;
     USBDevice *dev = s->ports[port].dev;
 
-    trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val);
+    trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val);
 
     /* Clear rwc bits */
     *portsc &= ~(val & PORTSC_RWC_MASK);
@@ -1069,7 +1069,7 @@
 
     *portsc &= ~PORTSC_RO_MASK;
     *portsc |= val;
-    trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old);
+    trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old);
 }
 
 static void ehci_opreg_write(void *ptr, hwaddr addr,
@@ -2508,25 +2508,18 @@
     }
 };
 
-void usb_ehci_initfn(EHCIState *s, DeviceState *dev)
+void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
 {
     int i;
 
-    /* 2.2 host controller interface version */
-    s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
-    s->caps[0x01] = 0x00;
-    s->caps[0x02] = 0x00;
-    s->caps[0x03] = 0x01;        /* HC version */
-    s->caps[0x04] = NB_PORTS;    /* Number of downstream ports */
-    s->caps[0x05] = 0x00;        /* No companion ports at present */
-    s->caps[0x06] = 0x00;
-    s->caps[0x07] = 0x00;
-    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
-    s->caps[0x0a] = 0x00;
-    s->caps[0x0b] = 0x00;
+    if (s->portnr > NB_PORTS) {
+        error_setg(errp, "Too many ports! Max. port number is %d.",
+                   NB_PORTS);
+        return;
+    }
 
     usb_bus_new(&s->bus, &ehci_bus_ops, dev);
-    for(i = 0; i < NB_PORTS; i++) {
+    for (i = 0; i < s->portnr; i++) {
         usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
                           USB_SPEED_MASK_HIGH);
         s->ports[i].dev = 0;
@@ -2534,24 +2527,41 @@
 
     s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
     s->async_bh = qemu_bh_new(ehci_frame_timer, s);
-    QTAILQ_INIT(&s->aqueues);
-    QTAILQ_INIT(&s->pqueues);
-    usb_packet_init(&s->ipacket);
 
     qemu_register_reset(ehci_reset, s);
     qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
+}
+
+void usb_ehci_init(EHCIState *s, DeviceState *dev)
+{
+    /* 2.2 host controller interface version */
+    s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
+    s->caps[0x01] = 0x00;
+    s->caps[0x02] = 0x00;
+    s->caps[0x03] = 0x01;        /* HC version */
+    s->caps[0x04] = s->portnr;   /* Number of downstream ports */
+    s->caps[0x05] = 0x00;        /* No companion ports at present */
+    s->caps[0x06] = 0x00;
+    s->caps[0x07] = 0x00;
+    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
+    s->caps[0x0a] = 0x00;
+    s->caps[0x0b] = 0x00;
+
+    QTAILQ_INIT(&s->aqueues);
+    QTAILQ_INIT(&s->pqueues);
+    usb_packet_init(&s->ipacket);
 
     memory_region_init(&s->mem, "ehci", MMIO_SIZE);
     memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
                           "capabilities", CAPA_SIZE);
     memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
-                          "operational", PORTSC_BEGIN);
+                          "operational", s->portscbase);
     memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
-                          "ports", PORTSC_END - PORTSC_BEGIN);
+                          "ports", 4 * s->portnr);
 
     memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
     memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
-    memory_region_add_subregion(&s->mem, s->opregbase + PORTSC_BEGIN,
+    memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase,
                                 &s->mem_ports);
 }
 
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 2fcb92f..15a28e8 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -40,11 +40,7 @@
 #define MMIO_SIZE        0x1000
 #define CAPA_SIZE        0x10
 
-#define PORTSC               0x0044
-#define PORTSC_BEGIN         PORTSC
-#define PORTSC_END           (PORTSC + 4 * NB_PORTS)
-
-#define NB_PORTS         6        /* Number of downstream ports */
+#define NB_PORTS         6        /* Max. Number of downstream ports */
 
 typedef struct EHCIPacket EHCIPacket;
 typedef struct EHCIQueue EHCIQueue;
@@ -268,6 +264,8 @@
     int companion_count;
     uint16_t capsbase;
     uint16_t opregbase;
+    uint16_t portscbase;
+    uint16_t portnr;
 
     /* properties */
     uint32_t maxframes;
@@ -278,7 +276,7 @@
      */
     uint8_t caps[CAPA_SIZE];
     union {
-        uint32_t opreg[PORTSC_BEGIN/sizeof(uint32_t)];
+        uint32_t opreg[0x44/sizeof(uint32_t)];
         struct {
             uint32_t usbcmd;
             uint32_t usbsts;
@@ -322,7 +320,8 @@
 
 extern const VMStateDescription vmstate_ehci;
 
-void usb_ehci_initfn(EHCIState *s, DeviceState *dev);
+void usb_ehci_init(EHCIState *s, DeviceState *dev);
+void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp);
 
 #define TYPE_PCI_EHCI "pci-ehci-usb"
 #define PCI_EHCI(obj) OBJECT_CHECK(EHCIPCIState, (obj), TYPE_PCI_EHCI)
@@ -338,6 +337,8 @@
 
 #define TYPE_SYS_BUS_EHCI "sysbus-ehci-usb"
 #define TYPE_EXYNOS4210_EHCI "exynos4210-ehci-usb"
+#define TYPE_TEGRA2_EHCI "tegra2-ehci-usb"
+#define TYPE_FUSBH200_EHCI "fusbh200-ehci-usb"
 
 #define SYS_BUS_EHCI(obj) \
     OBJECT_CHECK(EHCISysBusState, (obj), TYPE_SYS_BUS_EHCI)
@@ -361,6 +362,19 @@
 
     uint16_t capsbase;
     uint16_t opregbase;
+    uint16_t portscbase;
+    uint16_t portnr;
 } SysBusEHCIClass;
 
+#define FUSBH200_EHCI(obj) \
+    OBJECT_CHECK(FUSBH200EHCIState, (obj), TYPE_FUSBH200_EHCI)
+
+typedef struct FUSBH200EHCIState {
+    /*< private >*/
+    EHCISysBusState parent_obj;
+    /*< public >*/
+
+    MemoryRegion mem_vendor;
+} FUSBH200EHCIState;
+
 #endif
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index 3a582c5..e2f3cc8 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -241,7 +241,11 @@
     size_t off;
     int rc, i;
 
+#if LIBUSBX_API_VERSION >= 0x01000102
+    rc = libusb_get_port_numbers(dev, path, 7);
+#else
     rc = libusb_get_port_path(ctx, dev, path, 7);
+#endif
     if (rc < 0) {
         return 0;
     }
@@ -891,6 +895,7 @@
     USBHostDevice *s = USB_HOST_DEVICE(udev);
 
     loglevel = s->loglevel;
+    udev->flags |= (1 << USB_DEV_FLAG_IS_HOST);
     udev->auto_attach = 0;
     QTAILQ_INIT(&s->requests);
     QTAILQ_INIT(&s->isorings);
diff --git a/include/hw/usb.h b/include/hw/usb.h
index 4d9d05e..901b0da 100644
--- a/include/hw/usb.h
+++ b/include/hw/usb.h
@@ -205,6 +205,7 @@
     DeviceState qdev;
     USBPort *port;
     char *port_path;
+    char *serial;
     void *opaque;
     uint32_t flags;
 
diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index 6175c24..155b358 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -38,11 +38,9 @@
 #if defined __GNUC__
 # if !QEMU_GNUC_PREREQ(4, 4)
    /* gcc versions before 4.4.x don't support gnu_printf, so use printf. */
-#  define GCC_ATTR __attribute__((__unused__, format(printf, 1, 2)))
 #  define GCC_FMT_ATTR(n, m) __attribute__((format(printf, n, m)))
 # else
    /* Use gnu_printf when supported (qemu uses standard format strings). */
-#  define GCC_ATTR __attribute__((__unused__, format(gnu_printf, 1, 2)))
 #  define GCC_FMT_ATTR(n, m) __attribute__((format(gnu_printf, n, m)))
 #  if defined(_WIN32)
     /* Map __printf__ to __gnu_printf__ because we want standard format strings
@@ -51,7 +49,6 @@
 #  endif
 # endif
 #else
-#define GCC_ATTR /**/
 #define GCC_FMT_ATTR(n, m)
 #endif
 
diff --git a/include/ui/console.h b/include/ui/console.h
index f1d79f9..98edf41 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -314,7 +314,7 @@
 /* vnc.c */
 void vnc_display_init(DisplayState *ds);
 void vnc_display_open(DisplayState *ds, const char *display, Error **errp);
-void vnc_display_add_client(DisplayState *ds, int csock, int skipauth);
+void vnc_display_add_client(DisplayState *ds, int csock, bool skipauth);
 char *vnc_display_local_addr(DisplayState *ds);
 #ifdef CONFIG_VNC
 int vnc_display_password(DisplayState *ds, const char *password);
diff --git a/libcacard/vcard_emul_nss.c b/libcacard/vcard_emul_nss.c
index 1a3e568..fb429b1 100644
--- a/libcacard/vcard_emul_nss.c
+++ b/libcacard/vcard_emul_nss.c
@@ -90,17 +90,13 @@
 /*
  * allocate the set of arrays for certs, cert_len, key
  */
-static PRBool
+static void
 vcard_emul_alloc_arrays(unsigned char ***certsp, int **cert_lenp,
                         VCardKey ***keysp, int cert_count)
 {
-    *certsp = NULL;
-    *cert_lenp = NULL;
-    *keysp = NULL;
     *certsp = (unsigned char **)g_malloc(sizeof(unsigned char *)*cert_count);
     *cert_lenp = (int *)g_malloc(sizeof(int)*cert_count);
     *keysp = (VCardKey **)g_malloc(sizeof(VCardKey *)*cert_count);
-    return PR_TRUE;
 }
 
 /*
@@ -601,7 +597,6 @@
     int *cert_len;
     VCardKey **keys;
     PK11SlotInfo *slot;
-    PRBool ret;
     VCard *card;
 
     slot = vcard_emul_reader_get_slot(vreader);
@@ -627,10 +622,7 @@
     }
 
     /* allocate the arrays */
-    ret = vcard_emul_alloc_arrays(&certs, &cert_len, &keys, cert_count);
-    if (ret == PR_FALSE) {
-        return NULL;
-    }
+    vcard_emul_alloc_arrays(&certs, &cert_len, &keys, cert_count);
 
     /* fill in the arrays */
     cert_count = 0;
@@ -878,7 +870,7 @@
 vcard_emul_init(const VCardEmulOptions *options)
 {
     SECStatus rv;
-    PRBool ret, has_readers = PR_FALSE;
+    PRBool has_readers = PR_FALSE;
     VReader *vreader;
     VReaderEmul *vreader_emul;
     SECMODListLock *module_lock;
@@ -944,11 +936,9 @@
         vreader_add_reader(vreader);
         cert_count = options->vreader[i].cert_count;
 
-        ret = vcard_emul_alloc_arrays(&certs, &cert_len, &keys,
-                                      options->vreader[i].cert_count);
-        if (ret == PR_FALSE) {
-            continue;
-        }
+        vcard_emul_alloc_arrays(&certs, &cert_len, &keys,
+                                options->vreader[i].cert_count);
+
         cert_count = 0;
         for (j = 0; j < options->vreader[i].cert_count; j++) {
             /* we should have a better way of identifying certs than by
diff --git a/qapi-schema.json b/qapi-schema.json
index a80ee40..6cc07c2 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -391,7 +391,7 @@
 #
 # Since: 1.4
 ##
-{ 'enum': 'DataFormat'
+{ 'enum': 'DataFormat',
   'data': [ 'utf8', 'base64' ] }
 
 ##
@@ -1595,7 +1595,7 @@
 #
 # Since: 1.1
 ##
-{ 'enum': 'NewImageMode'
+{ 'enum': 'NewImageMode',
   'data': [ 'existing', 'absolute-paths' ] }
 
 ##
diff --git a/qemu-char.c b/qemu-char.c
index 2c3cfe6..a030e6b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2679,19 +2679,12 @@
     CharDriverState *chr = NULL;
     Error *local_err = NULL;
     int fd = -1;
-    int is_listen;
-    int is_waitconnect;
-    int do_nodelay;
-    int is_unix;
-    int is_telnet;
 
-    is_listen      = qemu_opt_get_bool(opts, "server", 0);
-    is_waitconnect = qemu_opt_get_bool(opts, "wait", 1);
-    is_telnet      = qemu_opt_get_bool(opts, "telnet", 0);
-    do_nodelay     = !qemu_opt_get_bool(opts, "delay", 1);
-    is_unix        = qemu_opt_get(opts, "path") != NULL;
-    if (!is_listen)
-        is_waitconnect = 0;
+    bool is_listen      = qemu_opt_get_bool(opts, "server", false);
+    bool is_waitconnect = is_listen && qemu_opt_get_bool(opts, "wait", true);
+    bool is_telnet      = qemu_opt_get_bool(opts, "telnet", false);
+    bool do_nodelay     = !qemu_opt_get_bool(opts, "delay", true);
+    bool is_unix        = qemu_opt_get(opts, "path") != NULL;
 
     if (is_unix) {
         if (is_listen) {
diff --git a/qemu-img.c b/qemu-img.c
index 809b4f1..f8c97d3 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -128,7 +128,7 @@
     exit(1);
 }
 
-static int qprintf(bool quiet, const char *fmt, ...)
+static int GCC_FMT_ATTR(2, 3) qprintf(bool quiet, const char *fmt, ...)
 {
     int ret = 0;
     if (!quiet) {
diff --git a/qemu-options.hx b/qemu-options.hx
index 8355f9b..ca6fdf6 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -917,8 +917,8 @@
     "       [,jpeg-wan-compression=[auto|never|always]]\n"
     "       [,zlib-glz-wan-compression=[auto|never|always]]\n"
     "       [,streaming-video=[off|all|filter]][,disable-copy-paste]\n"
-    "       [,agent-mouse=[on|off]][,playback-compression=[on|off]]\n"
-    "       [,seamless-migration=[on|off]]\n"
+    "       [,disable-agent-file-xfer][,agent-mouse=[on|off]]\n"
+    "       [,playback-compression=[on|off]][,seamless-migration=[on|off]]\n"
     "   enable spice\n"
     "   at least one of {port, tls-port} is mandatory\n",
     QEMU_ARCH_ALL)
@@ -961,6 +961,9 @@
 @item disable-copy-paste
 Disable copy paste between the client and the guest.
 
+@item disable-agent-file-xfer
+Disable spice-vdagent based file-xfer between the client and the guest.
+
 @item tls-port=<nr>
 Set the TCP port spice is listening on for encrypted channels.
 
@@ -2539,9 +2542,9 @@
 ETEXI
 
 DEF("mon", HAS_ARG, QEMU_OPTION_mon, \
-    "-mon chardev=[name][,mode=readline|control][,default]\n", QEMU_ARCH_ALL)
+    "-mon [chardev=]name[,mode=readline|control][,default]\n", QEMU_ARCH_ALL)
 STEXI
-@item -mon chardev=[name][,mode=readline|control][,default]
+@item -mon [chardev=]name[,mode=readline|control][,default]
 @findex -mon
 Setup monitor on chardev @var{name}.
 ETEXI
diff --git a/savevm.c b/savevm.c
index ff5ece6..48cc2a9 100644
--- a/savevm.c
+++ b/savevm.c
@@ -479,7 +479,7 @@
 
 QEMUFile *qemu_fopen_socket(int fd, const char *mode)
 {
-    QEMUFileSocket *s = g_malloc0(sizeof(QEMUFileSocket));
+    QEMUFileSocket *s;
 
     if (mode == NULL ||
         (mode[0] != 'r' && mode[0] != 'w') ||
@@ -488,6 +488,7 @@
         return NULL;
     }
 
+    s = g_malloc0(sizeof(QEMUFileSocket));
     s->fd = fd;
     if (mode[0] == 'w') {
         qemu_set_block(s->fd);
diff --git a/ui/spice-core.c b/ui/spice-core.c
index bcc4199..f308fd9 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -446,6 +446,9 @@
             .name = "disable-copy-paste",
             .type = QEMU_OPT_BOOL,
         },{
+            .name = "disable-agent-file-xfer",
+            .type = QEMU_OPT_BOOL,
+        },{
             .name = "sasl",
             .type = QEMU_OPT_BOOL,
         },{
@@ -739,6 +742,16 @@
         spice_server_set_agent_copypaste(spice_server, false);
     }
 
+    if (qemu_opt_get_bool(opts, "disable-agent-file-xfer", 0)) {
+#if SPICE_SERVER_VERSION >= 0x000c04
+        spice_server_set_agent_file_xfer(spice_server, false);
+#else
+        error_report("this qemu build does not support the "
+                     "\"disable-agent-file-xfer\" option");
+        exit(1);
+#endif
+    }
+
     compression = SPICE_IMAGE_COMPRESS_AUTO_GLZ;
     str = qemu_opt_get(opts, "image-compression");
     if (str) {
diff --git a/ui/vnc.c b/ui/vnc.c
index dfc7459..5601cc3 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2771,7 +2771,8 @@
     }
 }
 
-static void vnc_connect(VncDisplay *vd, int csock, int skipauth, bool websocket)
+static void vnc_connect(VncDisplay *vd, int csock,
+                        bool skipauth, bool websocket)
 {
     VncState *vs = g_malloc0(sizeof(VncState));
     int i;
@@ -2883,19 +2884,19 @@
     }
 
     if (csock != -1) {
-        vnc_connect(vs, csock, 0, websocket);
+        vnc_connect(vs, csock, false, websocket);
     }
 }
 
 static void vnc_listen_regular_read(void *opaque)
 {
-    vnc_listen_read(opaque, 0);
+    vnc_listen_read(opaque, false);
 }
 
 #ifdef CONFIG_VNC_WS
 static void vnc_listen_websocket_read(void *opaque)
 {
-    vnc_listen_read(opaque, 1);
+    vnc_listen_read(opaque, true);
 }
 #endif /* CONFIG_VNC_WS */
 
@@ -3283,7 +3284,7 @@
         if (csock < 0) {
             goto fail;
         }
-        vnc_connect(vs, csock, 0, 0);
+        vnc_connect(vs, csock, false, false);
     } else {
         /* listen for connects */
         char *dpy;
@@ -3341,9 +3342,9 @@
 #endif /* CONFIG_VNC_WS */
 }
 
-void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
+void vnc_display_add_client(DisplayState *ds, int csock, bool skipauth)
 {
     VncDisplay *vs = vnc_display;
 
-    vnc_connect(vs, csock, skipauth, 0);
+    vnc_connect(vs, csock, skipauth, false);
 }
diff --git a/util/acl.c b/util/acl.c
index a7f33ff..938b7ae 100644
--- a/util/acl.c
+++ b/util/acl.c
@@ -138,9 +138,9 @@
 
     if (index <= 0)
         return -1;
-    if (index >= acl->nentries)
+    if (index > acl->nentries) {
         return qemu_acl_append(acl, deny, match);
-
+    }
 
     entry = g_malloc(sizeof(*entry));
     entry->match = g_strdup(match);
diff --git a/vl.c b/vl.c
index 767e020..0a8f056 100644
--- a/vl.c
+++ b/vl.c
@@ -3472,12 +3472,11 @@
             case QEMU_OPTION_no_quit:
                 no_quit = 1;
                 break;
-#ifdef CONFIG_SDL
             case QEMU_OPTION_sdl:
+#ifdef CONFIG_SDL
                 display_type = DT_SDL;
                 break;
 #else
-            case QEMU_OPTION_sdl:
                 fprintf(stderr, "SDL support is disabled\n");
                 exit(1);
 #endif