diff --git a/.gitignore b/.gitignore
index 7641bf6..bf06366 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,4 @@ qemu-kvm-0.13.0-25fdf4a.tar.gz
 /qemu-1.3.0.tar.bz2
 /qemu-1.4.0.tar.bz2
 /qemu-1.4.1.tar.bz2
+/qemu-1.5.0.tar.bz2
diff --git a/0001-char-Split-out-tcp-socket-close-code-in-a-separate-f.patch b/0001-char-Split-out-tcp-socket-close-code-in-a-separate-f.patch
deleted file mode 100644
index 7322db2..0000000
--- a/0001-char-Split-out-tcp-socket-close-code-in-a-separate-f.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From bed754a15e27a3630681959cf1d3161084f29fe9 Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Mon, 21 Mar 2011 21:57:47 +0100
-Subject: [PATCH] char: Split out tcp socket close code in a separate function
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- qemu-char.c | 25 ++++++++++++++++---------
- 1 file changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/qemu-char.c b/qemu-char.c
-index f4a74ac..ac2abeb 100644
---- a/qemu-char.c
-+++ b/qemu-char.c
-@@ -2155,6 +2155,21 @@ typedef struct {
- 
- static void tcp_chr_accept(void *opaque);
- 
-+static void tcp_closed(void *opaque)
-+{
-+    CharDriverState *chr = opaque;
-+    TCPCharDriver *s = chr->opaque;
-+
-+    s->connected = 0;
-+    if (s->listen_fd >= 0) {
-+        qemu_set_fd_handler2(s->listen_fd, NULL, tcp_chr_accept, NULL, chr);
-+    }
-+    qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
-+    closesocket(s->fd);
-+    s->fd = -1;
-+    qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
-+}
-+
- static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
- {
-     TCPCharDriver *s = chr->opaque;
-@@ -2316,15 +2331,7 @@ static void tcp_chr_read(void *opaque)
-         len = s->max_size;
-     size = tcp_chr_recv(chr, (void *)buf, len);
-     if (size == 0) {
--        /* connection closed */
--        s->connected = 0;
--        if (s->listen_fd >= 0) {
--            qemu_set_fd_handler2(s->listen_fd, NULL, tcp_chr_accept, NULL, chr);
--        }
--        qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
--        closesocket(s->fd);
--        s->fd = -1;
--        qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
-+        tcp_closed(chr);
-     } else if (size > 0) {
-         if (s->do_telnetopt)
-             tcp_chr_process_IAC_bytes(chr, s, buf, &size);
diff --git a/0001-configure-Add-enable-migration-from-qemu-kvm.patch b/0001-configure-Add-enable-migration-from-qemu-kvm.patch
new file mode 100644
index 0000000..6e9de6d
--- /dev/null
+++ b/0001-configure-Add-enable-migration-from-qemu-kvm.patch
@@ -0,0 +1,64 @@
+From 7cd5a50e02ed4866932c2a70680bec48a75dae72 Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Tue, 19 Feb 2013 14:39:05 -0500
+Subject: [PATCH] configure: Add --enable-migration-from-qemu-kvm
+
+This switch will turn on all the migration compat bits needed to
+perform migration from qemu-kvm to qemu. It's just a stub for now.
+
+This compat will break incoming migration from qemu < 1.3, but for
+distros where qemu-kvm was the only shipped package for years it's
+not a big loss (and I don't know any way to avoid it).
+---
+ configure | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/configure b/configure
+index 5ae7e4a..fb41cb6 100755
+--- a/configure
++++ b/configure
+@@ -179,6 +179,7 @@ xfs=""
+ vhost_net="no"
+ vhost_scsi="no"
+ kvm="no"
++migrate_from_kvm="no"
+ gprof="no"
+ debug_tcg="no"
+ debug="no"
+@@ -777,6 +778,8 @@ for opt do
+   ;;
+   --enable-kvm) kvm="yes"
+   ;;
++  --enable-migration-from-qemu-kvm) migrate_from_kvm="yes"
++  ;;
+   --disable-tcg-interpreter) tcg_interpreter="no"
+   ;;
+   --enable-tcg-interpreter) tcg_interpreter="yes"
+@@ -1136,6 +1139,9 @@ echo "  --enable-bluez           enable bluez stack connectivity"
+ echo "  --disable-slirp          disable SLIRP userspace network connectivity"
+ echo "  --disable-kvm            disable KVM acceleration support"
+ echo "  --enable-kvm             enable KVM acceleration support"
++echo "  --enable-migration-from-qemu-kvm  Allow migration from qemu-kvm."
++echo "                                    This will break migration from "
++echo "                                    qemu < 1.3 in most cases"
+ echo "  --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)"
+ echo "  --disable-nptl           disable usermode NPTL support"
+ echo "  --enable-nptl            enable usermode NPTL support"
+@@ -3554,6 +3560,7 @@ echo "Linux AIO support $linux_aio"
+ echo "ATTR/XATTR support $attr"
+ echo "Install blobs     $blobs"
+ echo "KVM support       $kvm"
++echo "Migrate from qemu-kvm $migrate_from_kvm"
+ echo "TCG interpreter   $tcg_interpreter"
+ echo "fdt support       $fdt"
+ echo "preadv support    $preadv"
+@@ -3863,6 +3870,9 @@ fi
+ if test "$signalfd" = "yes" ; then
+   echo "CONFIG_SIGNALFD=y" >> $config_host_mak
+ fi
++if test "$migrate_from_kvm" = "yes"; then
++  echo "CONFIG_MIGRATE_FROM_QEMU_KVM=y" >> $config_host_mak
++fi
+ if test "$tcg_interpreter" = "yes" ; then
+   echo "CONFIG_TCG_INTERPRETER=y" >> $config_host_mak
+ fi
diff --git a/0002-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch b/0002-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch
new file mode 100644
index 0000000..d6107a8
--- /dev/null
+++ b/0002-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch
@@ -0,0 +1,51 @@
+From 9df0fd5765377d32a0e9f2d855dc1d428c19f767 Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Tue, 19 Feb 2013 14:44:49 -0500
+Subject: [PATCH] acpi_piix4: Drop minimum_version_id to handle qemu-kvm
+ migration
+
+qemu-kvm 1.2 advertised version_id=2, but it was not the same
+format as qemu.git version_id=2.
+
+commit b0b873a07872f7ab7f66f259c73fb9dd42aa66a9 added the qemu-kvm
+format to qemu.git, but was forced to call it version_id=3, and
+bumped minimum_version_id to 3. This breaks incoming migration from
+qemu-kvm.
+
+If --enable-migration-from-qemu-kvm is enabled, drop minimum_version_id
+to 2. Migration from qemu-kvm version_id=2 and qemu 1.3+ version_id=3
+works, but migration from qemu < 1.3 is broken.
+---
+ hw/acpi/piix4.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
+index c4af1cc..95d227d 100644
+--- a/hw/acpi/piix4.c
++++ b/hw/acpi/piix4.c
+@@ -269,16 +269,19 @@ static int acpi_load_old(QEMUFile *f, void *opaque, int version_id)
+     return ret;
+ }
+ 
+-/* qemu-kvm 1.2 uses version 3 but advertised as 2
+- * To support incoming qemu-kvm 1.2 migration, change version_id
+- * and minimum_version_id to 2 below (which breaks migration from
+- * qemu 1.2).
+- *
+- */
+ static const VMStateDescription vmstate_acpi = {
+     .name = "piix4_pm",
+     .version_id = 3,
++#ifdef CONFIG_MIGRATE_FROM_QEMU_KVM
++    /*
++     * qemu-kvm 1.2 uses qemu.git version 3 format, but advertised as 2.
++     * This allows incoming migration from qemu-kvm, but breaks incoming
++     * migration from qemu < 1.3.
++     */
++    .minimum_version_id = 2,
++#else
+     .minimum_version_id = 3,
++#endif
+     .minimum_version_id_old = 1,
+     .load_state_old = acpi_load_old,
+     .post_load = vmstate_acpi_post_load,
diff --git a/0002-char-Add-a-QemuChrHandlers-struct-to-initialise-char.patch b/0002-char-Add-a-QemuChrHandlers-struct-to-initialise-char.patch
deleted file mode 100644
index e96d513..0000000
--- a/0002-char-Add-a-QemuChrHandlers-struct-to-initialise-char.patch
+++ /dev/null
@@ -1,1068 +0,0 @@
-From de768f74c31d04063889c5dc588d55bc19cf7315 Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Mon, 21 Mar 2011 20:31:45 +0100
-Subject: [PATCH] char: Add a QemuChrHandlers struct to initialise chardev
- handlers
-
-Instead of passing each handler in the qemu_add_handlers() function,
-create a struct of handlers that can be passed to the function instead.
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- backends/rng-egd.c          | 12 +++++++++---
- gdbstub.c                   |  9 +++++++--
- hw/cadence_uart.c           |  9 +++++++--
- hw/ccid-card-passthru.c     | 11 +++++++----
- hw/debugcon.c               |  2 +-
- hw/escc.c                   |  9 +++++++--
- hw/etraxfs_ser.c            | 13 +++++++++----
- hw/exynos4210_uart.c        |  9 +++++++--
- hw/grlib_apbuart.c          | 12 +++++++-----
- hw/imx_serial.c             |  9 +++++++--
- hw/ipoctal232.c             |  9 +++++++--
- hw/ivshmem.c                | 28 ++++++++++++++++++++++------
- hw/lm32_juart.c             |  8 +++++++-
- hw/lm32_uart.c              |  8 +++++++-
- hw/mcf_uart.c               |  9 +++++++--
- hw/milkymist-uart.c         |  8 +++++++-
- hw/pl011.c                  |  9 +++++++--
- hw/pxa2xx.c                 | 13 +++++++++----
- hw/qdev-properties-system.c |  2 +-
- hw/s390x/sclpconsole.c      |  9 +++++++--
- hw/serial.c                 | 11 ++++++++---
- hw/sh_serial.c              | 12 +++++++++---
- hw/spapr_vty.c              |  8 ++++++--
- hw/strongarm.c              | 12 +++++++-----
- hw/usb/dev-serial.c         | 11 ++++++++---
- hw/usb/redirect.c           |  9 +++++++--
- hw/virtio-console.c         |  9 +++++++--
- hw/xen_console.c            | 16 +++++++++++-----
- hw/xilinx_uartlite.c        | 11 +++++++++--
- include/char/char.h         | 13 +++++++++----
- monitor.c                   | 18 ++++++++++++++----
- net/slirp.c                 |  8 ++++++--
- qemu-char.c                 | 32 ++++++++++++++++++++++----------
- qtest.c                     |  9 ++++++++-
- 34 files changed, 280 insertions(+), 97 deletions(-)
-
-diff --git a/backends/rng-egd.c b/backends/rng-egd.c
-index 5e012e9..b09876a 100644
---- a/backends/rng-egd.c
-+++ b/backends/rng-egd.c
-@@ -133,6 +133,13 @@ static void rng_egd_cancel_requests(RngBackend *b)
-     rng_egd_free_requests(s);
- }
- 
-+static const QemuChrHandlers rng_egd_handlers = {
-+    .fd_can_read = rng_egd_chr_can_read,
-+    .fd_read = rng_egd_chr_read,
-+    .fd_event = NULL,
-+};
-+
-+
- static void rng_egd_opened(RngBackend *b, Error **errp)
- {
-     RngEgd *s = RNG_EGD(b);
-@@ -150,8 +157,7 @@ static void rng_egd_opened(RngBackend *b, Error **errp)
-     }
- 
-     /* FIXME we should resubmit pending requests when the CDS reconnects. */
--    qemu_chr_add_handlers(s->chr, rng_egd_chr_can_read, rng_egd_chr_read,
--                          NULL, s);
-+    qemu_chr_add_handlers(s->chr, &rng_egd_handlers, s);
- }
- 
- static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
-@@ -190,7 +196,7 @@ static void rng_egd_finalize(Object *obj)
-     RngEgd *s = RNG_EGD(obj);
- 
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL);
-+        qemu_chr_add_handlers(s->chr, NULL, NULL);
-     }
- 
-     g_free(s->chr_name);
-diff --git a/gdbstub.c b/gdbstub.c
-index 6cd26f1..2da07e9 100644
---- a/gdbstub.c
-+++ b/gdbstub.c
-@@ -2992,6 +2992,12 @@ static void gdb_sigterm_handler(int signal)
- }
- #endif
- 
-+static const QemuChrHandlers gdb_handlers = {
-+    .fd_can_read = gdb_chr_can_receive,
-+    .fd_read = gdb_chr_receive,
-+    .fd_event = gdb_chr_event,
-+};
-+
- int gdbserver_start(const char *device)
- {
-     GDBState *s;
-@@ -3021,8 +3027,7 @@ int gdbserver_start(const char *device)
-         if (!chr)
-             return -1;
- 
--        qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
--                              gdb_chr_event, NULL);
-+        qemu_chr_add_handlers(chr, &gdb_handlers, NULL);
-     }
- 
-     s = gdbserver_state;
-diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
-index 5766d38..dd1a7d6 100644
---- a/hw/cadence_uart.c
-+++ b/hw/cadence_uart.c
-@@ -439,6 +439,12 @@ static void cadence_uart_reset(UartState *s)
-     s->rx_wpos = 0;
- }
- 
-+static const QemuChrHandlers cadence_uart_handlers = {
-+    .fd_can_read = uart_can_receive,
-+    .fd_read = uart_receive,
-+    .fd_event = uart_event,
-+};
-+
- static int cadence_uart_init(SysBusDevice *dev)
- {
-     UartState *s = FROM_SYSBUS(UartState, dev);
-@@ -460,8 +466,7 @@ static int cadence_uart_init(SysBusDevice *dev)
-     cadence_uart_reset(s);
- 
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr, uart_can_receive, uart_receive,
--                              uart_event, s);
-+        qemu_chr_add_handlers(s->chr, &cadence_uart_handlers, s);
-     }
- 
-     return 0;
-diff --git a/hw/ccid-card-passthru.c b/hw/ccid-card-passthru.c
-index 984bd0b..0dde761 100644
---- a/hw/ccid-card-passthru.c
-+++ b/hw/ccid-card-passthru.c
-@@ -274,6 +274,12 @@ static const uint8_t *passthru_get_atr(CCIDCardState *base, uint32_t *len)
-     return card->atr;
- }
- 
-+static const QemuChrHandlers passthru_handlers = {
-+    .fd_can_read = ccid_card_vscard_can_read,
-+    .fd_read = ccid_card_vscard_read,
-+    .fd_event = ccid_card_vscard_event,
-+};
-+
- static int passthru_initfn(CCIDCardState *base)
- {
-     PassthruState *card = DO_UPCAST(PassthruState, base, base);
-@@ -282,10 +288,7 @@ static int passthru_initfn(CCIDCardState *base)
-     card->vscard_in_hdr = 0;
-     if (card->cs) {
-         DPRINTF(card, D_INFO, "initing chardev\n");
--        qemu_chr_add_handlers(card->cs,
--            ccid_card_vscard_can_read,
--            ccid_card_vscard_read,
--            ccid_card_vscard_event, card);
-+        qemu_chr_add_handlers(card->cs, &passthru_handlers, card);
-         ccid_card_vscard_send_init(card);
-     } else {
-         error_report("missing chardev");
-diff --git a/hw/debugcon.c b/hw/debugcon.c
-index 81b2bb0..58e1f90 100644
---- a/hw/debugcon.c
-+++ b/hw/debugcon.c
-@@ -88,7 +88,7 @@ static void debugcon_init_core(DebugconState *s)
-         exit(1);
-     }
- 
--    qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, s);
-+    qemu_chr_add_handlers(s->chr, NULL, s);
- }
- 
- static int debugcon_isa_initfn(ISADevice *dev)
-diff --git a/hw/escc.c b/hw/escc.c
-index 18c0292..a29784a 100644
---- a/hw/escc.c
-+++ b/hw/escc.c
-@@ -867,6 +867,12 @@ void slavio_serial_ms_kbd_init(hwaddr base, qemu_irq irq,
-     sysbus_mmio_map(s, 0, base);
- }
- 
-+static const QemuChrHandlers serial_handlers = {
-+    .fd_can_read = serial_can_receive,
-+    .fd_read = serial_receive1,
-+    .fd_event = serial_event,
-+};
-+
- static int escc_init1(SysBusDevice *dev)
- {
-     SerialState *s = FROM_SYSBUS(SerialState, dev);
-@@ -879,8 +885,7 @@ static int escc_init1(SysBusDevice *dev)
-         s->chn[i].chn = 1 - i;
-         s->chn[i].clock = s->frequency / 2;
-         if (s->chn[i].chr) {
--            qemu_chr_add_handlers(s->chn[i].chr, serial_can_receive,
--                                  serial_receive1, serial_event, &s->chn[i]);
-+            qemu_chr_add_handlers(s->chn[i].chr, &serial_handlers, &s->chn[i]);
-         }
-     }
-     s->chn[0].otherchn = &s->chn[1];
-diff --git a/hw/etraxfs_ser.c b/hw/etraxfs_ser.c
-index 72c8868..eb93166 100644
---- a/hw/etraxfs_ser.c
-+++ b/hw/etraxfs_ser.c
-@@ -208,6 +208,12 @@ static void etraxfs_ser_reset(DeviceState *d)
- 
- }
- 
-+static const QemuChrHandlers serial_handlers = {
-+    .fd_can_read = serial_can_receive,
-+    .fd_read = serial_receive,
-+    .fd_event = serial_event,
-+};
-+
- static int etraxfs_ser_init(SysBusDevice *dev)
- {
-     struct etrax_serial *s = FROM_SYSBUS(typeof (*s), dev);
-@@ -217,10 +223,9 @@ static int etraxfs_ser_init(SysBusDevice *dev)
-     sysbus_init_mmio(dev, &s->mmio);
- 
-     s->chr = qemu_char_get_next_serial();
--    if (s->chr)
--        qemu_chr_add_handlers(s->chr,
--                      serial_can_receive, serial_receive,
--                      serial_event, s);
-+    if (s->chr) {
-+        qemu_chr_add_handlers(s->chr, &serial_handlers, s);
-+    }
-     return 0;
- }
- 
-diff --git a/hw/exynos4210_uart.c b/hw/exynos4210_uart.c
-index bdf797a..8419deb 100644
---- a/hw/exynos4210_uart.c
-+++ b/hw/exynos4210_uart.c
-@@ -625,6 +625,12 @@ DeviceState *exynos4210_uart_create(hwaddr addr,
-     return dev;
- }
- 
-+static const QemuChrHandlers exynos4210_handlers = {
-+    .fd_can_read = exynos4210_uart_can_receive,
-+    .fd_read     = exynos4210_uart_receive,
-+    .fd_event    = exynos4210_uart_event,
-+};
-+
- static int exynos4210_uart_init(SysBusDevice *dev)
- {
-     Exynos4210UartState *s = FROM_SYSBUS(Exynos4210UartState, dev);
-@@ -636,8 +642,7 @@ static int exynos4210_uart_init(SysBusDevice *dev)
- 
-     sysbus_init_irq(dev, &s->irq);
- 
--    qemu_chr_add_handlers(s->chr, exynos4210_uart_can_receive,
--                          exynos4210_uart_receive, exynos4210_uart_event, s);
-+    qemu_chr_add_handlers(s->chr, &exynos4210_handlers, s);
- 
-     return 0;
- }
-diff --git a/hw/grlib_apbuart.c b/hw/grlib_apbuart.c
-index 760bed0..7ede2be 100644
---- a/hw/grlib_apbuart.c
-+++ b/hw/grlib_apbuart.c
-@@ -222,15 +222,17 @@ static const MemoryRegionOps grlib_apbuart_ops = {
-     .endianness = DEVICE_NATIVE_ENDIAN,
- };
- 
-+static const QemuChrHandlers grlib_handlers = {
-+    .fd_can_read = grlib_apbuart_can_receive,
-+    .fd_read = grlib_apbuart_receive,
-+    .fd_event = grlib_apbuart_event,
-+};
-+
- static int grlib_apbuart_init(SysBusDevice *dev)
- {
-     UART *uart = FROM_SYSBUS(typeof(*uart), dev);
- 
--    qemu_chr_add_handlers(uart->chr,
--                          grlib_apbuart_can_receive,
--                          grlib_apbuart_receive,
--                          grlib_apbuart_event,
--                          uart);
-+    qemu_chr_add_handlers(uart->chr, &grlib_handlers, uart);
- 
-     sysbus_init_irq(dev, &uart->irq);
- 
-diff --git a/hw/imx_serial.c b/hw/imx_serial.c
-index 2d8253e..b0401a1 100644
---- a/hw/imx_serial.c
-+++ b/hw/imx_serial.c
-@@ -381,6 +381,12 @@ static const struct MemoryRegionOps imx_serial_ops = {
-     .endianness = DEVICE_NATIVE_ENDIAN,
- };
- 
-+static const QemuChrHandlers imx_handlers = {
-+    .fd_can_read = imx_can_receive,
-+    .fd_read = imx_receive,
-+    .fd_event = imx_event,
-+};
-+
- static int imx_serial_init(SysBusDevice *dev)
- {
-     IMXSerialState *s = FROM_SYSBUS(IMXSerialState, dev);
-@@ -391,8 +397,7 @@ static int imx_serial_init(SysBusDevice *dev)
-     sysbus_init_irq(dev, &s->irq);
- 
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr, imx_can_receive, imx_receive,
--                              imx_event, s);
-+        qemu_chr_add_handlers(s->chr, &imx_handlers, s);
-     } else {
-         DPRINTF("No char dev for uart at 0x%lx\n",
-                 (unsigned long)s->iomem.ram_addr);
-diff --git a/hw/ipoctal232.c b/hw/ipoctal232.c
-index c1e3b19..9d1eacf 100644
---- a/hw/ipoctal232.c
-+++ b/hw/ipoctal232.c
-@@ -535,6 +535,12 @@ static void hostdev_event(void *opaque, int event)
-     }
- }
- 
-+static const QemuChrHandlers ipoctal_chr_handlers = {
-+    .fd_can_read = hostdev_can_receive,
-+    .fd_read = hostdev_receive,
-+    .fd_event = hostdev_event,
-+};
-+
- static int ipoctal_init(IPackDevice *ip)
- {
-     IPOctalState *s = IPOCTAL(ip);
-@@ -556,8 +562,7 @@ static int ipoctal_init(IPackDevice *ip)
- 
-             if (ch->dev) {
-                 index++;
--                qemu_chr_add_handlers(ch->dev, hostdev_can_receive,
--                                      hostdev_receive, hostdev_event, ch);
-+                qemu_chr_add_handlers(ch->dev, &ipoctal_chr_handlers, ch);
-                 DPRINTF("Redirecting channel %u to %s (%s)\n",
-                         i, ch->devpath, label);
-             } else {
-diff --git a/hw/ivshmem.c b/hw/ivshmem.c
-index afaf9b3..7577307 100644
---- a/hw/ivshmem.c
-+++ b/hw/ivshmem.c
-@@ -278,6 +278,18 @@ static void fake_irqfd(void *opaque, const uint8_t *buf, int size) {
-     msix_notify(pdev, entry->vector);
- }
- 
-+static const QemuChrHandlers ivshmem_handlers = {
-+    .fd_can_read = ivshmem_can_receive,
-+    .fd_read = ivshmem_receive,
-+    .fd_event = ivshmem_event,
-+};
-+
-+static const QemuChrHandlers ivshmem_msi_handlers = {
-+    .fd_can_read = ivshmem_can_receive,
-+    .fd_read = fake_irqfd,
-+    .fd_event = ivshmem_event,
-+};
-+
- static CharDriverState* create_eventfd_chr_device(void * opaque, EventNotifier *n,
-                                                   int vector)
- {
-@@ -298,11 +310,10 @@ static CharDriverState* create_eventfd_chr_device(void * opaque, EventNotifier *
-         s->eventfd_table[vector].pdev = &s->dev;
-         s->eventfd_table[vector].vector = vector;
- 
--        qemu_chr_add_handlers(chr, ivshmem_can_receive, fake_irqfd,
--                      ivshmem_event, &s->eventfd_table[vector]);
-+        qemu_chr_add_handlers(chr, &ivshmem_msi_handlers,
-+                              &s->eventfd_table[vector]);
-     } else {
--        qemu_chr_add_handlers(chr, ivshmem_can_receive, ivshmem_receive,
--                      ivshmem_event, s);
-+        qemu_chr_add_handlers(chr, &ivshmem_handlers, s);
-     }
- 
-     return chr;
-@@ -636,6 +647,12 @@ static void ivshmem_write_config(PCIDevice *pci_dev, uint32_t address,
-     msix_write_config(pci_dev, address, val, len);
- }
- 
-+static const QemuChrHandlers ivshmem_server_handlers = {
-+    .fd_can_read = ivshmem_can_receive,
-+    .fd_read = ivshmem_read,
-+    .fd_event = ivshmem_event,
-+};
-+
- static int pci_ivshmem_init(PCIDevice *dev)
- {
-     IVShmemState *s = DO_UPCAST(IVShmemState, dev, dev);
-@@ -726,8 +743,7 @@ static int pci_ivshmem_init(PCIDevice *dev)
- 
-         s->eventfd_chr = g_malloc0(s->vectors * sizeof(CharDriverState *));
- 
--        qemu_chr_add_handlers(s->server_chr, ivshmem_can_receive, ivshmem_read,
--                     ivshmem_event, s);
-+        qemu_chr_add_handlers(s->server_chr, &ivshmem_server_handlers, s);
-     } else {
-         /* just map the file immediately, we're not using a server */
-         int fd;
-diff --git a/hw/lm32_juart.c b/hw/lm32_juart.c
-index 8c82c85..840f588 100644
---- a/hw/lm32_juart.c
-+++ b/hw/lm32_juart.c
-@@ -110,13 +110,19 @@ static void juart_reset(DeviceState *d)
-     s->jrx = 0;
- }
- 
-+static const QemuChrHandlers juart_handlers = {
-+    .fd_can_read = juart_can_rx,
-+    .fd_read = juart_rx,
-+    .fd_event = juart_event,
-+};
-+
- static int lm32_juart_init(SysBusDevice *dev)
- {
-     LM32JuartState *s = FROM_SYSBUS(typeof(*s), dev);
- 
-     s->chr = qemu_char_get_next_serial();
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr, juart_can_rx, juart_rx, juart_event, s);
-+        qemu_chr_add_handlers(s->chr, &juart_handlers, s);
-     }
- 
-     return 0;
-diff --git a/hw/lm32_uart.c b/hw/lm32_uart.c
-index 9c89cca..19cfd01 100644
---- a/hw/lm32_uart.c
-+++ b/hw/lm32_uart.c
-@@ -243,6 +243,12 @@ static void uart_reset(DeviceState *d)
-     s->regs[R_LSR] = LSR_THRE | LSR_TEMT;
- }
- 
-+static const QemuChrHandlers uart_handlers = {
-+    .fd_can_read = uart_can_rx,
-+    .fd_read = uart_rx,
-+    .fd_event = uart_event,
-+};
-+
- static int lm32_uart_init(SysBusDevice *dev)
- {
-     LM32UartState *s = FROM_SYSBUS(typeof(*s), dev);
-@@ -254,7 +260,7 @@ static int lm32_uart_init(SysBusDevice *dev)
- 
-     s->chr = qemu_char_get_next_serial();
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr, uart_can_rx, uart_rx, uart_event, s);
-+        qemu_chr_add_handlers(s->chr, &uart_handlers, s);
-     }
- 
-     return 0;
-diff --git a/hw/mcf_uart.c b/hw/mcf_uart.c
-index c443443..fc491f1 100644
---- a/hw/mcf_uart.c
-+++ b/hw/mcf_uart.c
-@@ -272,6 +272,12 @@ static void mcf_uart_receive(void *opaque, const uint8_t *buf, int size)
-     mcf_uart_push_byte(s, buf[0]);
- }
- 
-+static const QemuChrHandlers mcf_uart_handlers = {
-+    .fd_can_read = mcf_uart_can_receive,
-+    .fd_read = mcf_uart_receive,
-+    .fd_event = mcf_uart_event,
-+};
-+
- void *mcf_uart_init(qemu_irq irq, CharDriverState *chr)
- {
-     mcf_uart_state *s;
-@@ -280,8 +286,7 @@ void *mcf_uart_init(qemu_irq irq, CharDriverState *chr)
-     s->chr = chr;
-     s->irq = irq;
-     if (chr) {
--        qemu_chr_add_handlers(chr, mcf_uart_can_receive, mcf_uart_receive,
--                              mcf_uart_event, s);
-+        qemu_chr_add_handlers(chr, &mcf_uart_handlers, s);
-     }
-     mcf_uart_reset(s);
-     return s;
-diff --git a/hw/milkymist-uart.c b/hw/milkymist-uart.c
-index e73eb84..3e03c5c 100644
---- a/hw/milkymist-uart.c
-+++ b/hw/milkymist-uart.c
-@@ -189,6 +189,12 @@ static void milkymist_uart_reset(DeviceState *d)
-     s->regs[R_STAT] = STAT_THRE;
- }
- 
-+static const QemuChrHandlers uart_handlers = {
-+    .fd_can_read = uart_can_rx,
-+    .fd_read = uart_rx,
-+    .fd_event = uart_event,
-+};
-+
- static int milkymist_uart_init(SysBusDevice *dev)
- {
-     MilkymistUartState *s = FROM_SYSBUS(typeof(*s), dev);
-@@ -201,7 +207,7 @@ static int milkymist_uart_init(SysBusDevice *dev)
- 
-     s->chr = qemu_char_get_next_serial();
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr, uart_can_rx, uart_rx, uart_event, s);
-+        qemu_chr_add_handlers(s->chr, &uart_handlers, s);
-     }
- 
-     return 0;
-diff --git a/hw/pl011.c b/hw/pl011.c
-index 002a50e..3224bc9 100644
---- a/hw/pl011.c
-+++ b/hw/pl011.c
-@@ -261,6 +261,12 @@ static const VMStateDescription vmstate_pl011 = {
-     }
- };
- 
-+static const QemuChrHandlers pl011_handlers = {
-+    .fd_can_read = pl011_can_receive,
-+    .fd_read = pl011_receive,
-+    .fd_event = pl011_event,
-+};
-+
- static int pl011_init(SysBusDevice *dev, const unsigned char *id)
- {
-     pl011_state *s = FROM_SYSBUS(pl011_state, dev);
-@@ -276,8 +282,7 @@ static int pl011_init(SysBusDevice *dev, const unsigned char *id)
-     s->cr = 0x300;
-     s->flags = 0x90;
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr, pl011_can_receive, pl011_receive,
--                              pl011_event, s);
-+        qemu_chr_add_handlers(s->chr, &pl011_handlers, s);
-     }
-     vmstate_register(&dev->qdev, -1, &vmstate_pl011, s);
-     return 0;
-diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
-index d303320..06f43d5 100644
---- a/hw/pxa2xx.c
-+++ b/hw/pxa2xx.c
-@@ -1962,6 +1962,12 @@ static int pxa2xx_fir_load(QEMUFile *f, void *opaque, int version_id)
-     return 0;
- }
- 
-+static const QemuChrHandlers pxa2xx_handlers = {
-+    .fd_can_read = pxa2xx_fir_is_empty,
-+    .fd_read = pxa2xx_fir_rx,
-+    .fd_event = pxa2xx_fir_event,
-+};
-+
- static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
-                 hwaddr base,
-                 qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma,
-@@ -1980,10 +1986,9 @@ static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion *sysmem,
-     memory_region_init_io(&s->iomem, &pxa2xx_fir_ops, s, "pxa2xx-fir", 0x1000);
-     memory_region_add_subregion(sysmem, base, &s->iomem);
- 
--    if (chr)
--        qemu_chr_add_handlers(chr, pxa2xx_fir_is_empty,
--                        pxa2xx_fir_rx, pxa2xx_fir_event, s);
--
-+    if (chr) {
-+        qemu_chr_add_handlers(chr, &pxa2xx_handlers, s);
-+    }
-     register_savevm(NULL, "pxa2xx_fir", 0, 0, pxa2xx_fir_save,
-                     pxa2xx_fir_load, s);
- 
-diff --git a/hw/qdev-properties-system.c b/hw/qdev-properties-system.c
-index ce3af22..dd37f58 100644
---- a/hw/qdev-properties-system.c
-+++ b/hw/qdev-properties-system.c
-@@ -138,7 +138,7 @@ static void release_chr(Object *obj, const char *name, void *opaque)
-     CharDriverState **ptr = qdev_get_prop_ptr(dev, prop);
- 
-     if (*ptr) {
--        qemu_chr_add_handlers(*ptr, NULL, NULL, NULL, NULL);
-+        qemu_chr_add_handlers(*ptr, NULL, NULL);
-     }
- }
- 
-diff --git a/hw/s390x/sclpconsole.c b/hw/s390x/sclpconsole.c
-index effe511..7a77d64 100644
---- a/hw/s390x/sclpconsole.c
-+++ b/hw/s390x/sclpconsole.c
-@@ -238,6 +238,12 @@ static void trigger_ascii_console_data(void *env, int n, int level)
-     sclp_service_interrupt(0);
- }
- 
-+static const QemuChrHandlers sclp_chr_handlers = {
-+    .fd_can_read = chr_can_read,
-+    .fd_read = chr_read,
-+    .fd_event = chr_event,
-+};
-+
- /* qemu object creation and initialization functions */
- 
- /* tell character layer our call-back functions */
-@@ -254,8 +260,7 @@ static int console_init(SCLPEvent *event)
-     console_available = true;
-     event->event_type = SCLP_EVENT_ASCII_CONSOLE_DATA;
-     if (scon->chr) {
--        qemu_chr_add_handlers(scon->chr, chr_can_read,
--                              chr_read, chr_event, scon);
-+        qemu_chr_add_handlers(scon->chr, &sclp_chr_handlers, scon);
-     }
-     scon->irq_read_vt220 = *qemu_allocate_irqs(trigger_ascii_console_data,
-                                                NULL, 1);
-diff --git a/hw/serial.c b/hw/serial.c
-index f0ce9b0..589c18a 100644
---- a/hw/serial.c
-+++ b/hw/serial.c
-@@ -674,6 +674,12 @@ static void serial_reset(void *opaque)
-     qemu_irq_lower(s->irq);
- }
- 
-+static const QemuChrHandlers serial_handlers = {
-+    .fd_can_read = serial_can_receive1,
-+    .fd_read = serial_receive1,
-+    .fd_event = serial_event,
-+};
-+
- void serial_init_core(SerialState *s)
- {
-     if (!s->chr) {
-@@ -688,13 +694,12 @@ void serial_init_core(SerialState *s)
- 
-     qemu_register_reset(serial_reset, s);
- 
--    qemu_chr_add_handlers(s->chr, serial_can_receive1, serial_receive1,
--                          serial_event, s);
-+    qemu_chr_add_handlers(s->chr, &serial_handlers, s);
- }
- 
- void serial_exit_core(SerialState *s)
- {
--    qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL);
-+    qemu_chr_add_handlers(s->chr, NULL, NULL);
-     qemu_unregister_reset(serial_reset, s);
- }
- 
-diff --git a/hw/sh_serial.c b/hw/sh_serial.c
-index 21c5b13..1cae7e9 100644
---- a/hw/sh_serial.c
-+++ b/hw/sh_serial.c
-@@ -352,6 +352,12 @@ static const MemoryRegionOps sh_serial_ops = {
-     .endianness = DEVICE_NATIVE_ENDIAN,
- };
- 
-+static const QemuChrHandlers sh_serial_handlers = {
-+    .fd_can_read = sh_serial_can_receive1,
-+    .fd_read = sh_serial_receive1,
-+    .fd_event = sh_serial_event,
-+};
-+
- void sh_serial_init(MemoryRegion *sysmem,
-                     hwaddr base, int feat,
-                     uint32_t freq, CharDriverState *chr,
-@@ -396,9 +402,9 @@ void sh_serial_init(MemoryRegion *sysmem,
- 
-     s->chr = chr;
- 
--    if (chr)
--        qemu_chr_add_handlers(chr, sh_serial_can_receive1, sh_serial_receive1,
--			      sh_serial_event, s);
-+    if (chr) {
-+        qemu_chr_add_handlers(chr, &sh_serial_handlers, s);
-+    }
- 
-     s->eri = eri_source;
-     s->rxi = rxi_source;
-diff --git a/hw/spapr_vty.c b/hw/spapr_vty.c
-index 5c63eaa..af2173a 100644
---- a/hw/spapr_vty.c
-+++ b/hw/spapr_vty.c
-@@ -54,6 +54,11 @@ void vty_putchars(VIOsPAPRDevice *sdev, uint8_t *buf, int len)
-     qemu_chr_fe_write(dev->chardev, buf, len);
- }
- 
-+static const QemuChrHandlers vty_handlers = {
-+    .fd_can_read = vty_can_receive,
-+    .fd_read = vty_receive,
-+};
-+
- static int spapr_vty_init(VIOsPAPRDevice *sdev)
- {
-     VIOsPAPRVTYDevice *dev = (VIOsPAPRVTYDevice *)sdev;
-@@ -63,8 +68,7 @@ static int spapr_vty_init(VIOsPAPRDevice *sdev)
-         exit(1);
-     }
- 
--    qemu_chr_add_handlers(dev->chardev, vty_can_receive,
--                          vty_receive, NULL, dev);
-+    qemu_chr_add_handlers(dev->chardev, &vty_handlers, dev);
- 
-     return 0;
- }
-diff --git a/hw/strongarm.c b/hw/strongarm.c
-index ab736e3..9099a06 100644
---- a/hw/strongarm.c
-+++ b/hw/strongarm.c
-@@ -1200,6 +1200,12 @@ static const MemoryRegionOps strongarm_uart_ops = {
-     .endianness = DEVICE_NATIVE_ENDIAN,
- };
- 
-+static const QemuChrHandlers strongarm_uart_handlers = {
-+    .fd_can_read = strongarm_uart_can_receive,
-+    .fd_read = strongarm_uart_receive,
-+    .fd_event = strongarm_uart_event,
-+};
-+
- static int strongarm_uart_init(SysBusDevice *dev)
- {
-     StrongARMUARTState *s = FROM_SYSBUS(StrongARMUARTState, dev);
-@@ -1212,11 +1218,7 @@ static int strongarm_uart_init(SysBusDevice *dev)
-     s->tx_timer = qemu_new_timer_ns(vm_clock, strongarm_uart_tx, s);
- 
-     if (s->chr) {
--        qemu_chr_add_handlers(s->chr,
--                        strongarm_uart_can_receive,
--                        strongarm_uart_receive,
--                        strongarm_uart_event,
--                        s);
-+        qemu_chr_add_handlers(s->chr, &strongarm_uart_handlers, s);
-     }
- 
-     return 0;
-diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
-index 47ac8c9..2f8757f 100644
---- a/hw/usb/dev-serial.c
-+++ b/hw/usb/dev-serial.c
-@@ -414,7 +414,7 @@ static void usb_serial_handle_destroy(USBDevice *dev)
- {
-     USBSerialState *s = (USBSerialState *)dev;
- 
--    qemu_chr_add_handlers(s->cs, NULL, NULL, NULL, NULL);
-+    qemu_chr_add_handlers(s->cs, NULL, NULL);
- }
- 
- static int usb_serial_can_read(void *opaque)
-@@ -478,6 +478,12 @@ static void usb_serial_event(void *opaque, int event)
-     }
- }
- 
-+static const QemuChrHandlers usb_serial_handlers = {
-+    .fd_can_read = usb_serial_can_read,
-+    .fd_read = usb_serial_read,
-+    .fd_event = usb_serial_event,
-+};
-+
- static int usb_serial_initfn(USBDevice *dev)
- {
-     USBSerialState *s = DO_UPCAST(USBSerialState, dev, dev);
-@@ -491,8 +497,7 @@ static int usb_serial_initfn(USBDevice *dev)
-         return -1;
-     }
- 
--    qemu_chr_add_handlers(s->cs, usb_serial_can_read, usb_serial_read,
--                          usb_serial_event, s);
-+    qemu_chr_add_handlers(s->cs, &usb_serial_handlers, s);
-     usb_serial_handle_reset(dev);
- 
-     if (s->cs->opened && !dev->attached) {
-diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
-index 8c0ead0..bb07c62 100644
---- a/hw/usb/redirect.c
-+++ b/hw/usb/redirect.c
-@@ -1227,6 +1227,12 @@ static void usbredir_chardev_event(void *opaque, int event)
-     }
- }
- 
-+static const QemuChrHandlers usbredir_chr_handlers = {
-+    .fd_can_read = usbredir_chardev_can_read,
-+    .fd_read = usbredir_chardev_read,
-+    .fd_event = usbredir_chardev_event,
-+};
-+
- /*
-  * init + destroy
-  */
-@@ -1288,8 +1294,7 @@ static int usbredir_initfn(USBDevice *udev)
- 
-     /* Let the backend know we are ready */
-     qemu_chr_fe_open(dev->cs);
--    qemu_chr_add_handlers(dev->cs, usbredir_chardev_can_read,
--                          usbredir_chardev_read, usbredir_chardev_event, dev);
-+    qemu_chr_add_handlers(dev->cs, &usbredir_chr_handlers, dev);
- 
-     qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
-     add_boot_device_path(dev->bootindex, &udev->qdev, NULL);
-diff --git a/hw/virtio-console.c b/hw/virtio-console.c
-index 46072a0..dd6f614 100644
---- a/hw/virtio-console.c
-+++ b/hw/virtio-console.c
-@@ -106,6 +106,12 @@ static void chr_event(void *opaque, int event)
-     }
- }
- 
-+static const QemuChrHandlers chr_handlers = {
-+    .fd_can_read = chr_can_read,
-+    .fd_read = chr_read,
-+    .fd_event = chr_event,
-+};
-+
- static int virtconsole_initfn(VirtIOSerialPort *port)
- {
-     VirtConsole *vcon = DO_UPCAST(VirtConsole, port, port);
-@@ -117,8 +123,7 @@ static int virtconsole_initfn(VirtIOSerialPort *port)
-     }
- 
-     if (vcon->chr) {
--        qemu_chr_add_handlers(vcon->chr, chr_can_read, chr_read, chr_event,
--                              vcon);
-+        qemu_chr_add_handlers(vcon->chr, &chr_handlers, vcon);
-     }
- 
-     return 0;
-diff --git a/hw/xen_console.c b/hw/xen_console.c
-index 44141f8..db1eea5 100644
---- a/hw/xen_console.c
-+++ b/hw/xen_console.c
-@@ -215,6 +215,11 @@ out:
-     return ret;
- }
- 
-+static const QemuChrHandlers xencons_handlers = {
-+    .fd_can_read = xencons_can_receive,
-+    .fd_read = xencons_receive,
-+};
-+
- static int con_initialise(struct XenDevice *xendev)
- {
-     struct XenConsole *con = container_of(xendev, struct XenConsole, xendev);
-@@ -241,9 +246,9 @@ static int con_initialise(struct XenDevice *xendev)
- 	return -1;
- 
-     xen_be_bind_evtchn(&con->xendev);
--    if (con->chr)
--        qemu_chr_add_handlers(con->chr, xencons_can_receive, xencons_receive,
--                              NULL, con);
-+    if (con->chr) {
-+        qemu_chr_add_handlers(con->chr, &xencons_handlers, con);
-+    }
- 
-     xen_be_printf(xendev, 1, "ring mfn %d, remote port %d, local port %d, limit %zd\n",
- 		  con->ring_ref,
-@@ -260,8 +265,9 @@ static void con_disconnect(struct XenDevice *xendev)
-     if (!xendev->dev) {
-         return;
-     }
--    if (con->chr)
--        qemu_chr_add_handlers(con->chr, NULL, NULL, NULL, NULL);
-+    if (con->chr) {
-+        qemu_chr_add_handlers(con->chr, NULL, NULL);
-+    }
-     xen_be_unbind_evtchn(&con->xendev);
- 
-     if (con->sring) {
-diff --git a/hw/xilinx_uartlite.c b/hw/xilinx_uartlite.c
-index 9963982..f5e4cde 100644
---- a/hw/xilinx_uartlite.c
-+++ b/hw/xilinx_uartlite.c
-@@ -192,6 +192,12 @@ static void uart_event(void *opaque, int event)
- 
- }
- 
-+static const QemuChrHandlers uart_handlers = {
-+    .fd_can_read = uart_can_rx,
-+    .fd_read = uart_rx,
-+    .fd_event = uart_event,
-+};
-+
- static int xilinx_uartlite_init(SysBusDevice *dev)
- {
-     struct xlx_uartlite *s = FROM_SYSBUS(typeof (*s), dev);
-@@ -204,8 +210,9 @@ static int xilinx_uartlite_init(SysBusDevice *dev)
-     sysbus_init_mmio(dev, &s->mmio);
- 
-     s->chr = qemu_char_get_next_serial();
--    if (s->chr)
--        qemu_chr_add_handlers(s->chr, uart_can_rx, uart_rx, uart_event, s);
-+    if (s->chr) {
-+        qemu_chr_add_handlers(s->chr, &uart_handlers, s);
-+    }
-     return 0;
- }
- 
-diff --git a/include/char/char.h b/include/char/char.h
-index c91ce3c..3027cc1 100644
---- a/include/char/char.h
-+++ b/include/char/char.h
-@@ -225,10 +225,15 @@ void qemu_chr_be_write(CharDriverState *s, uint8_t *buf, int len);
-  */
- void qemu_chr_be_event(CharDriverState *s, int event);
- 
--void qemu_chr_add_handlers(CharDriverState *s,
--                           IOCanReadHandler *fd_can_read,
--                           IOReadHandler *fd_read,
--                           IOEventHandler *fd_event,
-+
-+typedef struct QemuChrHandlers {
-+    IOCanReadHandler *fd_can_read;
-+    IOReadHandler *fd_read;
-+    IOHandler *fd_write_unblocked;
-+    IOEventHandler *fd_event;
-+} QemuChrHandlers;
-+
-+void qemu_chr_add_handlers(CharDriverState *s, const QemuChrHandlers *handlers,
-                            void *opaque);
- 
- void qemu_chr_generic_open(CharDriverState *s);
-diff --git a/monitor.c b/monitor.c
-index 20bd19b..be83dd6 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -4701,6 +4701,18 @@ static void sortcmdlist(void)
-  * End:
-  */
- 
-+static const QemuChrHandlers monitor_handlers = {
-+    .fd_can_read = monitor_can_read,
-+    .fd_read = monitor_read,
-+    .fd_event = monitor_event,
-+};
-+
-+static const QemuChrHandlers monitor_control_handlers = {
-+    .fd_can_read = monitor_can_read,
-+    .fd_read = monitor_control_read,
-+    .fd_event = monitor_control_event,
-+};
-+
- void monitor_init(CharDriverState *chr, int flags)
- {
-     static int is_first_init = 1;
-@@ -4723,14 +4735,12 @@ void monitor_init(CharDriverState *chr, int flags)
-     if (monitor_ctrl_mode(mon)) {
-         mon->mc = g_malloc0(sizeof(MonitorControl));
-         /* Control mode requires special handlers */
--        qemu_chr_add_handlers(chr, monitor_can_read, monitor_control_read,
--                              monitor_control_event, mon);
-+        qemu_chr_add_handlers(chr, &monitor_control_handlers, mon);
-         qemu_chr_fe_set_echo(chr, true);
- 
-         json_message_parser_init(&mon->mc->parser, handle_qmp_command);
-     } else {
--        qemu_chr_add_handlers(chr, monitor_can_read, monitor_read,
--                              monitor_event, mon);
-+        qemu_chr_add_handlers(chr, &monitor_handlers, mon);
-     }
- 
-     QLIST_INSERT_HEAD(&mon_list, mon, entry);
-diff --git a/net/slirp.c b/net/slirp.c
-index 4df550f..2868229 100644
---- a/net/slirp.c
-+++ b/net/slirp.c
-@@ -595,6 +595,11 @@ static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
-     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
- }
- 
-+static const QemuChrHandlers guestfwd_handlers = {
-+    .fd_can_read = guestfwd_can_read,
-+    .fd_read = guestfwd_read,
-+};
-+
- static int slirp_guestfwd(SlirpState *s, const char *config_str,
-                           int legacy_format)
- {
-@@ -660,8 +665,7 @@ static int slirp_guestfwd(SlirpState *s, const char *config_str,
-         fwd->port = port;
-         fwd->slirp = s->slirp;
- 
--        qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
--                              NULL, fwd);
-+        qemu_chr_add_handlers(fwd->hd, &guestfwd_handlers, fwd);
-     }
-     return 0;
- 
-diff --git a/qemu-char.c b/qemu-char.c
-index ac2abeb..0c97bdf 100644
---- a/qemu-char.c
-+++ b/qemu-char.c
-@@ -192,19 +192,26 @@ void qemu_chr_fe_printf(CharDriverState *s, const char *fmt, ...)
-     va_end(ap);
- }
- 
-+static const QemuChrHandlers null_handlers = {
-+    /* All handlers are initialised to NULL */
-+};
-+
- void qemu_chr_add_handlers(CharDriverState *s,
--                           IOCanReadHandler *fd_can_read,
--                           IOReadHandler *fd_read,
--                           IOEventHandler *fd_event,
--                           void *opaque)
-+                           const QemuChrHandlers *handlers, void *opaque)
- {
--    if (!opaque && !fd_can_read && !fd_read && !fd_event) {
-+    if (!s) {
-+        return;
-+    }
-+    if (!opaque && !handlers) {
-         /* chr driver being released. */
-         ++s->avail_connections;
-     }
--    s->chr_can_read = fd_can_read;
--    s->chr_read = fd_read;
--    s->chr_event = fd_event;
-+    if (!handlers) {
-+        handlers = &null_handlers;
-+    }
-+    s->chr_can_read = handlers->fd_can_read;
-+    s->chr_read = handlers->fd_read;
-+    s->chr_event = handlers->fd_event;
-     s->handler_opaque = opaque;
-     if (s->chr_update_read_handler)
-         s->chr_update_read_handler(s);
-@@ -442,6 +449,12 @@ static void mux_chr_event(void *opaque, int event)
-         mux_chr_send_event(d, i, event);
- }
- 
-+static const QemuChrHandlers mux_chr_handlers = {
-+    .fd_can_read = mux_chr_can_read,
-+    .fd_read = mux_chr_read,
-+    .fd_event = mux_chr_event,
-+};
-+
- static void mux_chr_update_read_handler(CharDriverState *chr)
- {
-     MuxDriver *d = chr->opaque;
-@@ -456,8 +469,7 @@ static void mux_chr_update_read_handler(CharDriverState *chr)
-     d->chr_event[d->mux_cnt] = chr->chr_event;
-     /* Fix up the real driver with mux routines */
-     if (d->mux_cnt == 0) {
--        qemu_chr_add_handlers(d->drv, mux_chr_can_read, mux_chr_read,
--                              mux_chr_event, chr);
-+        qemu_chr_add_handlers(d->drv, &mux_chr_handlers, chr);
-     }
-     if (d->focus != -1) {
-         mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_OUT);
-diff --git a/qtest.c b/qtest.c
-index 4663a38..eb8e7ef 100644
---- a/qtest.c
-+++ b/qtest.c
-@@ -416,6 +416,13 @@ static void qtest_event(void *opaque, int event)
-     }
- }
- 
-+static const QemuChrHandlers test_handlers = {
-+    .fd_can_read = qtest_can_read,
-+    .fd_read = qtest_read,
-+    .fd_event = qtest_event,
-+};
-+
-+
- int qtest_init(void)
- {
-     CharDriverState *chr;
-@@ -425,7 +432,7 @@ int qtest_init(void)
-     configure_icount("0");
-     chr = qemu_chr_new("qtest", qtest_chrdev, NULL);
- 
--    qemu_chr_add_handlers(chr, qtest_can_read, qtest_read, qtest_event, chr);
-+    qemu_chr_add_handlers(chr, &test_handlers, chr);
-     qemu_chr_fe_set_echo(chr, true);
- 
-     inbuf = g_string_new("");
diff --git a/0003-i8254-Fix-migration-from-qemu-kvm-1.1.patch b/0003-i8254-Fix-migration-from-qemu-kvm-1.1.patch
new file mode 100644
index 0000000..44c1e8f
--- /dev/null
+++ b/0003-i8254-Fix-migration-from-qemu-kvm-1.1.patch
@@ -0,0 +1,34 @@
+From e1f0936bbf84664d7d7fe7bbbdd1595be745b539 Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Tue, 19 Feb 2013 15:04:59 -0500
+Subject: [PATCH] i8254: Fix migration from qemu-kvm < 1.1
+
+qemu-kvm commit 81bdec908fb2be0ccaff1d4ee67956c509e440ad did this,
+but the logic can't be carried unconditionally in qemu.git without
+breaking migration from qemu < 1.1.
+
+Conditionalize it with --enable-migrate-from-qemu-kvm
+---
+ hw/timer/i8254_common.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
+index 5342df4..e74afe3 100644
+--- a/hw/timer/i8254_common.c
++++ b/hw/timer/i8254_common.c
+@@ -275,7 +275,15 @@ static const VMStateDescription vmstate_pit_common = {
+     .pre_save = pit_dispatch_pre_save,
+     .post_load = pit_dispatch_post_load,
+     .fields = (VMStateField[]) {
++#ifdef CONFIG_MIGRATE_FROM_QEMU_KVM
++        /* qemu-kvm version_id=2 had 'flags' here which is equivalent
++         * This fixes incoming migration from qemu-kvm 1.0, but breaks
++         * incoming migration from qemu < 1.1
++         */
++        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState),
++#else
+         VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
++#endif
+         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
+                              vmstate_pit_channel, PITChannelState),
+         VMSTATE_INT64(channels[0].next_transition_time,
diff --git a/0003-iohandlers-Add-enable-disable_write_fd_handler-funct.patch b/0003-iohandlers-Add-enable-disable_write_fd_handler-funct.patch
deleted file mode 100644
index 7c9c131..0000000
--- a/0003-iohandlers-Add-enable-disable_write_fd_handler-funct.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 64080f1b8983660b707ed8c0d10ace22e9b46f7a Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Mon, 21 Mar 2011 20:32:58 +0100
-Subject: [PATCH] iohandlers: Add enable/disable_write_fd_handler() functions
-
-These will be used to provide a cleaner API for the nonblocking case.
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- include/qemu/main-loop.h |  3 +++
- iohandler.c              | 35 +++++++++++++++++++++++++++++++++++
- 2 files changed, 38 insertions(+)
-
-diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
-index e8059c3..faaf47d 100644
---- a/include/qemu/main-loop.h
-+++ b/include/qemu/main-loop.h
-@@ -166,6 +166,9 @@ void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
- typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
- typedef int IOCanReadHandler(void *opaque);
- 
-+void enable_write_fd_handler(int fd, IOHandler *fd_write);
-+void disable_write_fd_handler(int fd);
-+
- /**
-  * qemu_set_fd_handler2: Register a file descriptor with the main loop
-  *
-diff --git a/iohandler.c b/iohandler.c
-index 2523adc..a49cfd4 100644
---- a/iohandler.c
-+++ b/iohandler.c
-@@ -45,6 +45,41 @@ typedef struct IOHandlerRecord {
- static QLIST_HEAD(, IOHandlerRecord) io_handlers =
-     QLIST_HEAD_INITIALIZER(io_handlers);
- 
-+static IOHandlerRecord *find_iohandler(int fd)
-+{
-+    IOHandlerRecord *ioh;
-+
-+    QLIST_FOREACH(ioh, &io_handlers, next) {
-+        if (ioh->fd == fd) {
-+            return ioh;
-+        }
-+    }
-+    return NULL;
-+}
-+
-+void enable_write_fd_handler(int fd, IOHandler *fd_write)
-+{
-+    IOHandlerRecord *ioh;
-+
-+    ioh = find_iohandler(fd);
-+    if (!ioh) {
-+        return;
-+    }
-+
-+    ioh->fd_write = fd_write;
-+}
-+
-+void disable_write_fd_handler(int fd)
-+{
-+    IOHandlerRecord *ioh;
-+
-+    ioh = find_iohandler(fd);
-+    if (!ioh) {
-+        return;
-+    }
-+
-+    ioh->fd_write = NULL;
-+}
- 
- /* XXX: fd_read_poll should be suppressed, but an API change is
-    necessary in the character devices to suppress fd_can_read(). */
diff --git a/0004-char-Add-framework-for-a-write-unblocked-callback.patch b/0004-char-Add-framework-for-a-write-unblocked-callback.patch
deleted file mode 100644
index 4a41a18..0000000
--- a/0004-char-Add-framework-for-a-write-unblocked-callback.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 84877040f31425a8fecdbee19cb24fcc5a8212df Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Mon, 21 Mar 2011 21:41:42 +0100
-Subject: [PATCH] char: Add framework for a 'write unblocked' callback
-
-The char layer can let users know that the driver will block on further
-input.  For users interested in not blocking, they can assign a function
-pointer that will be called back when the driver becomes writable.  This
-patch just adds the function pointers to the CharDriverState structure,
-future patches will enable the nonblocking and callback functionality.
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- include/char/char.h | 4 ++++
- qemu-char.c         | 3 +++
- 2 files changed, 7 insertions(+)
-
-diff --git a/include/char/char.h b/include/char/char.h
-index 3027cc1..2fee107 100644
---- a/include/char/char.h
-+++ b/include/char/char.h
-@@ -63,6 +63,9 @@ struct CharDriverState {
-     IOEventHandler *chr_event;
-     IOCanReadHandler *chr_can_read;
-     IOReadHandler *chr_read;
-+    IOHandler *chr_write_unblocked;
-+    void (*chr_enable_write_fd_handler)(struct CharDriverState *chr);
-+    void (*chr_disable_write_fd_handler)(struct CharDriverState *chr);
-     void *handler_opaque;
-     void (*chr_close)(struct CharDriverState *chr);
-     void (*chr_accept_input)(struct CharDriverState *chr);
-@@ -76,6 +79,7 @@ struct CharDriverState {
-     int opened;
-     int avail_connections;
-     QemuOpts *opts;
-+    bool write_blocked; /* Are we in a blocked state? */
-     QTAILQ_ENTRY(CharDriverState) next;
- };
- 
-diff --git a/qemu-char.c b/qemu-char.c
-index 0c97bdf..ab0c552 100644
---- a/qemu-char.c
-+++ b/qemu-char.c
-@@ -211,11 +211,14 @@ void qemu_chr_add_handlers(CharDriverState *s,
-     }
-     s->chr_can_read = handlers->fd_can_read;
-     s->chr_read = handlers->fd_read;
-+    s->chr_write_unblocked = handlers->fd_write_unblocked;
-     s->chr_event = handlers->fd_event;
-     s->handler_opaque = opaque;
-     if (s->chr_update_read_handler)
-         s->chr_update_read_handler(s);
- 
-+    s->write_blocked = false;
-+
-     /* We're connecting to an already opened device, so let's make sure we
-        also get the open event */
-     if (s->opened) {
diff --git a/0004-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch b/0004-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch
new file mode 100644
index 0000000..820e99d
--- /dev/null
+++ b/0004-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch
@@ -0,0 +1,81 @@
+From 3e580f65ac69c7a84b672a59de6772dae24b5a8a Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Tue, 19 Feb 2013 15:35:40 -0500
+Subject: [PATCH] pc_piix: Add compat handling for qemu-kvm VGA mem size
+
+Paolo outlines this here:
+
+https://lists.gnu.org/archive/html/qemu-devel/2013-01/msg02540.html
+
+qemu-kvm defaulted to vgamem=16MB since at least 0.15, while qemu used
+8MB. For qemu 1.2, the default was changed to 16MB for all devices
+except cirrus.
+
+If --enable-migration-from-qemu-kvm is specified, make sure cirrus
+uses 16MB for <= pc-1.2 (the qemu-kvm merge), and 16MB always for
+all others. This will break incoming qemu migration for qemu < 1.3.
+---
+ hw/i386/pc_piix.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 43ab480..48fb7b7 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -383,6 +383,13 @@ static QEMUMachine pc_machine_v1_3 = {
+     DEFAULT_MACHINE_OPTIONS,
+ };
+ 
++#ifdef CONFIG_MIGRATE_FROM_QEMU_KVM
++/* qemu-kvm defaulted to 16MB video memory since 0.15 at least. */
++# define OLD_VGA_MEM stringify(16)
++#else
++# define OLD_VGA_MEM stringify(8)
++#endif
++
+ #define PC_COMPAT_1_2 \
+         PC_COMPAT_1_3,\
+         {\
+@@ -406,6 +413,10 @@ static QEMUMachine pc_machine_v1_3 = {
+             .property = "revision",\
+             .value    = stringify(3),\
+         },{\
++            .driver   = "cirrus-vga",\
++            .property = "vgamem_mb",\
++            .value    = OLD_VGA_MEM,\
++        },{\
+             .driver   = "VGA",\
+             .property = "mmio",\
+             .value    = "off",\
+@@ -423,6 +434,7 @@ static QEMUMachine pc_machine_v1_2 = {
+     DEFAULT_MACHINE_OPTIONS,
+ };
+ 
++
+ #define PC_COMPAT_1_1 \
+         PC_COMPAT_1_2,\
+         {\
+@@ -436,19 +448,19 @@ static QEMUMachine pc_machine_v1_2 = {
+         },{\
+             .driver   = "VGA",\
+             .property = "vgamem_mb",\
+-            .value    = stringify(8),\
++            .value    = OLD_VGA_MEM,\
+         },{\
+             .driver   = "vmware-svga",\
+             .property = "vgamem_mb",\
+-            .value    = stringify(8),\
++            .value    = OLD_VGA_MEM,\
+         },{\
+             .driver   = "qxl-vga",\
+             .property = "vgamem_mb",\
+-            .value    = stringify(8),\
++            .value    = OLD_VGA_MEM,\
+         },{\
+             .driver   = "qxl",\
+             .property = "vgamem_mb",\
+-            .value    = stringify(8),\
++            .value    = OLD_VGA_MEM,\
+         },{\
+             .driver   = "virtio-blk-pci",\
+             .property = "config-wce",\
diff --git a/0005-char-Update-send_all-to-handle-nonblocking-chardev-w.patch b/0005-char-Update-send_all-to-handle-nonblocking-chardev-w.patch
deleted file mode 100644
index b8f1f78..0000000
--- a/0005-char-Update-send_all-to-handle-nonblocking-chardev-w.patch
+++ /dev/null
@@ -1,178 +0,0 @@
-From c7e9b2a5b981209f4e77b26562758663cc060900 Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Mon, 21 Mar 2011 22:00:27 +0100
-Subject: [PATCH] char: Update send_all() to handle nonblocking chardev write
- requests
-
-The send_all function is modified to return to the caller in case the
-driver cannot handle any more data.  It returns -EAGAIN or
-WSAEWOULDBLOCK on non-Windows and Windows platforms respectively.  This
-is only done when the caller sets a callback function handler indicating
-it's not interested in blocking till the driver has written out all the
-data.
-
-Currently there's no driver or caller that supports this.  Future
-commits will add such capability.
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- include/qemu/sockets.h |  3 ++-
- qemu-char.c            | 69 +++++++++++++++++++++++++++++++++++++++++++++-----
- 2 files changed, 65 insertions(+), 7 deletions(-)
-
-diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
-index 0ccf32f..42ca690 100644
---- a/include/qemu/sockets.h
-+++ b/include/qemu/sockets.h
-@@ -29,6 +29,7 @@ int inet_aton(const char *cp, struct in_addr *ia);
- #include "qemu/option.h"
- #include "qapi/error.h"
- #include "qapi/qmp/qerror.h"
-+#include "char/char.h"
- 
- /* misc helpers */
- int qemu_socket(int domain, int type, int protocol);
-@@ -36,7 +37,7 @@ int qemu_accept(int s, struct sockaddr *addr, socklen_t *addrlen);
- int socket_set_cork(int fd, int v);
- void qemu_set_block(int fd);
- void qemu_set_nonblock(int fd);
--int send_all(int fd, const void *buf, int len1);
-+int send_all(CharDriverState *chr, int fd, const void *buf, int len1);
- 
- /* callback function for nonblocking connect
-  * valid fd on success, negative error code on failure
-diff --git a/qemu-char.c b/qemu-char.c
-index ab0c552..96fc54e 100644
---- a/qemu-char.c
-+++ b/qemu-char.c
-@@ -508,7 +508,7 @@ static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
- 
- 
- #ifdef _WIN32
--int send_all(int fd, const void *buf, int len1)
-+static int do_send(int fd, const void *buf, int len1, bool nonblock)
- {
-     int ret, len;
- 
-@@ -516,9 +516,14 @@ int send_all(int fd, const void *buf, int len1)
-     while (len > 0) {
-         ret = send(fd, buf, len, 0);
-         if (ret < 0) {
-+            if (nonblock && len1 - len) {
-+                return len1 - len;
-+            }
-             errno = WSAGetLastError();
-             if (errno != WSAEWOULDBLOCK) {
-                 return -1;
-+            } else if (errno == WSAEWOULDBLOCK && nonblock) {
-+                return WSAEWOULDBLOCK;
-             }
-         } else if (ret == 0) {
-             break;
-@@ -532,7 +537,7 @@ int send_all(int fd, const void *buf, int len1)
- 
- #else
- 
--int send_all(int fd, const void *_buf, int len1)
-+static int do_send(int fd, const void *_buf, int len1, bool nonblock)
- {
-     int ret, len;
-     const uint8_t *buf = _buf;
-@@ -541,8 +546,15 @@ int send_all(int fd, const void *_buf, int len1)
-     while (len > 0) {
-         ret = write(fd, buf, len);
-         if (ret < 0) {
--            if (errno != EINTR && errno != EAGAIN)
-+            if (nonblock && len1 - len) {
-+                return len1 - len;
-+            }
-+            if (errno == EAGAIN && nonblock) {
-+                return -EAGAIN;
-+            }
-+            if (errno != EINTR && errno != EAGAIN) {
-                 return -1;
-+            }
-         } else if (ret == 0) {
-             break;
-         } else {
-@@ -557,6 +569,44 @@ int send_all(int fd, const void *_buf, int len1)
- #define STDIO_MAX_CLIENTS 1
- static int stdio_nb_clients;
- 
-+int send_all(CharDriverState *chr, int fd, const void *_buf, int len1)
-+{
-+    int ret, eagain_errno;
-+    bool nonblock;
-+
-+    if (chr && chr->write_blocked) {
-+        /*
-+         * The caller should not send us data while we're blocked,
-+         * but this can happen when multiple writers are woken at once,
-+         * so simply return -EAGAIN.
-+         */
-+        return -EAGAIN;
-+    }
-+
-+    nonblock = false;
-+    /*
-+     * Ensure the char backend is able to receive and handle the
-+     * 'write unblocked' event before we turn on nonblock support.
-+     */
-+    if (chr && chr->chr_enable_write_fd_handler && chr->chr_write_unblocked) {
-+        nonblock = true;
-+    }
-+    ret = do_send(fd, _buf, len1, nonblock);
-+
-+#ifdef _WIN32
-+    eagain_errno = WSAEWOULDBLOCK;
-+#else
-+    eagain_errno = -EAGAIN;
-+#endif
-+
-+    if (nonblock && (ret == eagain_errno || (ret >= 0 && ret < len1))) {
-+        /* Update fd handler to wake up when chr becomes writable */
-+        chr->chr_enable_write_fd_handler(chr);
-+        chr->write_blocked = true;
-+    }
-+    return ret;
-+}
-+
- #ifndef _WIN32
- 
- typedef struct {
-@@ -568,7 +618,7 @@ typedef struct {
- static int fd_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
- {
-     FDCharDriver *s = chr->opaque;
--    return send_all(s->fd_out, buf, len);
-+    return send_all(chr, s->fd_out, buf, len);
- }
- 
- static int fd_chr_read_poll(void *opaque)
-@@ -893,7 +943,7 @@ static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
-         pty_chr_update_read_handler(chr);
-         return 0;
-     }
--    return send_all(s->fd, buf, len);
-+    return send_all(chr, s->fd, buf, len);
- }
- 
- static int pty_chr_read_poll(void *opaque)
-@@ -2188,8 +2238,15 @@ static void tcp_closed(void *opaque)
- static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
- {
-     TCPCharDriver *s = chr->opaque;
-+
-     if (s->connected) {
--        return send_all(s->fd, buf, len);
-+        int ret;
-+
-+        ret = send_all(chr, s->fd, buf, len);
-+        if (ret == -1 && errno == EPIPE) {
-+            tcp_closed(chr);
-+        }
-+        return ret;
-     } else {
-         /* XXX: indicate an error ? */
-         return len;
diff --git a/0005-qxl-Add-rom_size-compat-property-fix-migration-from-.patch b/0005-qxl-Add-rom_size-compat-property-fix-migration-from-.patch
new file mode 100644
index 0000000..4fa4a8b
--- /dev/null
+++ b/0005-qxl-Add-rom_size-compat-property-fix-migration-from-.patch
@@ -0,0 +1,99 @@
+From ae8d642477d87287b42b0b40c133637dd1cdd8b9 Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Tue, 19 Feb 2013 16:19:02 -0500
+Subject: [PATCH] qxl: Add rom_size compat property, fix migration from 1.2
+
+Commit 038c1879a00153b14bce113315b693e8c2944fa9 changed the qxl rom
+size to 8192, which fixes incoming migration from qemu 1.0. However
+from qemu 1.2 and 1.3 had rom size 16384, so incoming migration
+from those versions is now broken.
+
+Add a rom_size compat property. 1.2 and 1.3 get 16384, everything
+else is 8192.
+
+This isn't actually fool proof, since rom_size can be dependent on
+the version of spice qemu is built against:
+
+https://lists.gnu.org/archive/html/qemu-devel/2013-02/msg03154.html
+
+However these sizes match what native Fedora packages get, so it's
+good enough for now.
+---
+ hw/display/qxl.c  |  9 ++++-----
+ hw/i386/pc_piix.c | 16 ++++++++++++++++
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/hw/display/qxl.c b/hw/display/qxl.c
+index c475cb1..74f07c0 100644
+--- a/hw/display/qxl.c
++++ b/hw/display/qxl.c
+@@ -306,16 +306,14 @@ static inline uint32_t msb_mask(uint32_t val)
+     return mask;
+ }
+ 
+-static ram_addr_t qxl_rom_size(void)
++static void check_qxl_rom_size(PCIQXLDevice *d)
+ {
+     uint32_t required_rom_size = sizeof(QXLRom) + sizeof(QXLModes) +
+                                  sizeof(qxl_modes);
+-    uint32_t rom_size = 8192; /* two pages */
+ 
+     required_rom_size = MAX(required_rom_size, TARGET_PAGE_SIZE);
+     required_rom_size = msb_mask(required_rom_size * 2 - 1);
+-    assert(required_rom_size <= rom_size);
+-    return rom_size;
++    assert(required_rom_size <= d->rom_size);
+ }
+ 
+ static void init_qxl_rom(PCIQXLDevice *d)
+@@ -1979,7 +1977,7 @@ static int qxl_init_common(PCIQXLDevice *qxl)
+     pci_set_byte(&config[PCI_REVISION_ID], pci_device_rev);
+     pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);
+ 
+-    qxl->rom_size = qxl_rom_size();
++    check_qxl_rom_size(qxl);
+     memory_region_init_ram(&qxl->rom_bar, "qxl.vrom", qxl->rom_size);
+     vmstate_register_ram(&qxl->rom_bar, &qxl->pci.qdev);
+     init_qxl_rom(qxl);
+@@ -2302,6 +2300,7 @@ static Property qxl_properties[] = {
+         DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice, vram_size_mb, -1),
+         DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice, vgamem_size_mb, 16),
+         DEFINE_PROP_INT32("surfaces", PCIQXLDevice, ssd.num_surfaces, 1024),
++        DEFINE_PROP_UINT32("rom_size", PCIQXLDevice, rom_size, 8192),
+         DEFINE_PROP_END_OF_LIST(),
+ };
+ 
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 48fb7b7..2307d26 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -369,6 +369,14 @@ static QEMUMachine pc_i440fx_machine_v1_4 = {
+             .driver   = "e1000",\
+             .property = "autonegotiation",\
+             .value    = "off",\
++        },{ \
++            .driver   = "qxl", \
++            .property = "rom_size", \
++            .value    = stringify(16384), \
++        },{\
++            .driver   = "qxl-vga", \
++            .property = "rom_size", \
++            .value    = stringify(16384), \
+         }
+ 
+ static QEMUMachine pc_machine_v1_3 = {
+@@ -465,6 +473,14 @@ static QEMUMachine pc_machine_v1_2 = {
+             .driver   = "virtio-blk-pci",\
+             .property = "config-wce",\
+             .value    = "off",\
++        },{ \
++            .driver   = "qxl", \
++            .property = "rom_size", \
++            .value    = stringify(8192), \
++        },{\
++            .driver   = "qxl-vga", \
++            .property = "rom_size", \
++            .value    = stringify(8192), \
+         }
+ 
+ static QEMUMachine pc_machine_v1_1 = {
diff --git a/0006-char-Equip-the-unix-tcp-backend-to-handle-nonblockin.patch b/0006-char-Equip-the-unix-tcp-backend-to-handle-nonblockin.patch
deleted file mode 100644
index 62bcd1b..0000000
--- a/0006-char-Equip-the-unix-tcp-backend-to-handle-nonblockin.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 6540bebbaa749d405df91516e1ca5a075e354628 Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Mon, 21 Mar 2011 22:02:47 +0100
-Subject: [PATCH] char: Equip the unix/tcp backend to handle nonblocking
- writes#
-
-Now that the infrastructure is in place to return -EAGAIN to callers,
-individual char drivers can set their update_fd_handlers() function to
-set or remove an fd's write handler.  This handler checks if the driver
-became writable.
-
-A generic callback routine is used for unblocking writes and letting
-users of chardevs know that a driver became writable again.
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- qemu-char.c | 27 +++++++++++++++++++++++++++
- 1 file changed, 27 insertions(+)
-
-diff --git a/qemu-char.c b/qemu-char.c
-index 96fc54e..53d2c13 100644
---- a/qemu-char.c
-+++ b/qemu-char.c
-@@ -105,6 +105,19 @@
- static QTAILQ_HEAD(CharDriverStateHead, CharDriverState) chardevs =
-     QTAILQ_HEAD_INITIALIZER(chardevs);
- 
-+/*
-+ * Generic routine that gets called when chardev becomes writable.
-+ * Lets chardev user know it's OK to send more data.
-+ */
-+static void char_write_unblocked(void *opaque)
-+{
-+    CharDriverState *chr = opaque;
-+
-+    chr->write_blocked = false;
-+    chr->chr_disable_write_fd_handler(chr);
-+    chr->chr_write_unblocked(chr->handler_opaque);
-+}
-+
- void qemu_chr_be_event(CharDriverState *s, int event)
- {
-     /* Keep track if the char device is open */
-@@ -126,6 +139,9 @@ static void qemu_chr_fire_open_event(void *opaque)
- {
-     CharDriverState *s = opaque;
-     qemu_chr_be_event(s, CHR_EVENT_OPENED);
-+    if (s->write_blocked) {
-+        char_write_unblocked(s);
-+    }
-     qemu_free_timer(s->open_timer);
-     s->open_timer = NULL;
- }
-@@ -2245,6 +2261,17 @@ static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
-         ret = send_all(chr, s->fd, buf, len);
-         if (ret == -1 && errno == EPIPE) {
-             tcp_closed(chr);
-+
-+            if (chr->chr_enable_write_fd_handler && chr->chr_write_unblocked) {
-+                /*
-+                 * Since we haven't written out anything, let's say
-+                 * we're throttled.  This will prevent any output from
-+                 * the guest getting lost if host-side chardev goes
-+                 * down.  Unthrottle when we re-connect.
-+                 */
-+                chr->write_blocked = true;
-+                return 0;
-+            }
-         }
-         return ret;
-     } else {
diff --git a/0007-virtio-console-Enable-port-throttling-when-chardev-i.patch b/0007-virtio-console-Enable-port-throttling-when-chardev-i.patch
deleted file mode 100644
index 3f57b0b..0000000
--- a/0007-virtio-console-Enable-port-throttling-when-chardev-i.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 33f3874dc760f0960d408be2f916d04373de543b Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Mon, 21 Mar 2011 22:06:41 +0100
-Subject: [PATCH] virtio-console: Enable port throttling when chardev is slow
- to consume data
-
-When a chardev indicates it can't accept more data, we tell the
-virtio-serial code to stop sending us any more data till we tell
-otherwise.  This helps in guests continuing to run normally while the vq
-keeps getting full and eventually the guest stops queueing more data.
-As soon as the chardev indicates it can accept more data, start pushing!
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- hw/virtio-console.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/hw/virtio-console.c b/hw/virtio-console.c
-index dd6f614..0e12514 100644
---- a/hw/virtio-console.c
-+++ b/hw/virtio-console.c
-@@ -20,6 +20,16 @@ typedef struct VirtConsole {
-     CharDriverState *chr;
- } VirtConsole;
- 
-+/*
-+ * Callback function that's called from chardevs when backend becomes
-+ * writable.
-+ */
-+static void chr_write_unblocked(void *opaque)
-+{
-+    VirtConsole *vcon = opaque;
-+
-+    virtio_serial_throttle_port(&vcon->port, false);
-+}
- 
- /* Callback function that's called when the guest sends us data */
- static ssize_t flush_buf(VirtIOSerialPort *port, const uint8_t *buf, size_t len)
-@@ -110,6 +120,7 @@ static const QemuChrHandlers chr_handlers = {
-     .fd_can_read = chr_can_read,
-     .fd_read = chr_read,
-     .fd_event = chr_event,
-+    .fd_write_unblocked = chr_write_unblocked,
- };
- 
- static int virtconsole_initfn(VirtIOSerialPort *port)
diff --git a/0008-spice-qemu-char.c-add-throttling.patch b/0008-spice-qemu-char.c-add-throttling.patch
deleted file mode 100644
index b73b620..0000000
--- a/0008-spice-qemu-char.c-add-throttling.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From aa0a2c94c70ae5ed0fb215328c8ecebbef10cbe9 Mon Sep 17 00:00:00 2001
-From: Alon Levy <alevy@redhat.com>
-Date: Tue, 22 Mar 2011 12:27:59 +0200
-Subject: [PATCH] spice-qemu-char.c: add throttling
-
-BZ: 672191
-
-upstream: not submitted (explained below)
-
-Adds throttling support to spicevmc chardev. Uses a timer to avoid recursing:
-1. spice-server: reds.c:            read_from_vdi_port
-2. qemu:         spice-qemu-char.c: vmc_read
-3.                                  chr_write_unblocked
-                                (calls virtio_serial_throttle_port(port, false))
-4. qemu:         virtio ...
-5. qemu:         spice-qemu-char.c: spice_chr_write
-6. qemu:         spice-qemu-char.c: wakeup (calls into spice-server)
-7. spice-server: ...
-8. qemu:         spice-qemu-char.c: vmc_read
-
-Instead, in vmc_read if we were throttled and we are just about to return
-all the bytes we will set a timer to be triggered immediately to call
-chr_write_unblocked. Then we return after 2 above, and 3 is called from the
-timer callback. This also means we can later remove some ugly recursion protection
-from spice-server.
-
-The other tricky point in this patch is not returning the leftover chunk twice.
-When we throttle, by definition we have data that spice server didn't consume.
-It is being kept by virtio-serial, and by us. The next vmc_read callback needs
-to not return it, but just do unthrottling. Then virtio will give us the remaining
-chunk as usual in spice_chr_write, and we will pass it to spice server in the
-next vmc_read.
-
-This patch relies on Amit's series to expose throttling to chardev's, which
-was not accepted upstream, and will not be accepted upstream until the mainloop
-is reworked to use glib.
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- spice-qemu-char.c | 39 +++++++++++++++++++++++++++++++++++----
- 1 file changed, 35 insertions(+), 4 deletions(-)
-
-diff --git a/spice-qemu-char.c b/spice-qemu-char.c
-index a4d7de8..75bb125 100644
---- a/spice-qemu-char.c
-+++ b/spice-qemu-char.c
-@@ -1,4 +1,6 @@
- #include "config-host.h"
-+#include "qemu-common.h"
-+#include "qemu/timer.h"
- #include "trace.h"
- #include "ui/qemu-spice.h"
- #include "char/char.h"
-@@ -25,6 +27,7 @@ typedef struct SpiceCharDriver {
-     uint8_t               *datapos;
-     ssize_t               bufsize, datalen;
-     uint32_t              debug;
-+    QEMUTimer             *unblock_timer;
-     QLIST_ENTRY(SpiceCharDriver) next;
- } SpiceCharDriver;
- 
-@@ -54,6 +57,17 @@ static int vmc_write(SpiceCharDeviceInstance *sin, const uint8_t *buf, int len)
-     return out;
- }
- 
-+static void spice_chr_unblock(void *opaque)
-+{
-+    SpiceCharDriver *scd = opaque;
-+
-+    if (scd->chr->chr_write_unblocked == NULL) {
-+        dprintf(scd, 1, "%s: backend doesn't support unthrottling.\n", __func__);
-+        return;
-+    }
-+    scd->chr->chr_write_unblocked(scd->chr->handler_opaque);
-+}
-+
- static int vmc_read(SpiceCharDeviceInstance *sin, uint8_t *buf, int len)
- {
-     SpiceCharDriver *scd = container_of(sin, SpiceCharDriver, sin);
-@@ -65,9 +79,16 @@ static int vmc_read(SpiceCharDeviceInstance *sin, uint8_t *buf, int len)
-         scd->datapos += bytes;
-         scd->datalen -= bytes;
-         assert(scd->datalen >= 0);
--        if (scd->datalen == 0) {
--            scd->datapos = 0;
--        }
-+    }
-+    if (scd->datalen == 0 && scd->chr->write_blocked) {
-+        dprintf(scd, 1, "%s: unthrottling (%d)\n", __func__, bytes);
-+        scd->chr->write_blocked = false;
-+        /*
-+         * set a timer instead of calling scd->chr->chr_write_unblocked directly,
-+         * because that will call back into spice_chr_write (see
-+         * virtio-console.c:chr_write_unblocked), which is unwanted.
-+         */
-+        qemu_mod_timer(scd->unblock_timer, 0);
-     }
-     trace_spice_vmc_read(bytes, len);
-     return bytes;
-@@ -163,6 +184,7 @@ static void vmc_unregister_interface(SpiceCharDriver *scd)
- static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
- {
-     SpiceCharDriver *s = chr->opaque;
-+    int read_bytes;
- 
-     dprintf(s, 2, "%s: %d\n", __func__, len);
-     vmc_register_interface(s);
-@@ -175,7 +197,15 @@ static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
-     s->datapos = s->buffer;
-     s->datalen = len;
-     spice_server_char_device_wakeup(&s->sin);
--    return len;
-+    read_bytes = len - s->datalen;
-+    if (read_bytes != len) {
-+        dprintf(s, 1, "%s: throttling: %d < %d (%zd)\n", __func__,
-+                read_bytes, len, s->bufsize);
-+        s->chr->write_blocked = true;
-+        /* We'll get passed in the unconsumed data with the next call */
-+        s->datalen = 0;
-+    }
-+    return read_bytes;
- }
- 
- static void spice_chr_close(struct CharDriverState *chr)
-@@ -234,6 +264,7 @@ static CharDriverState *chr_open(QemuOpts *opts, const char *subtype)
-     chr->chr_close = spice_chr_close;
-     chr->chr_guest_open = spice_chr_guest_open;
-     chr->chr_guest_close = spice_chr_guest_close;
-+    s->unblock_timer = qemu_new_timer_ms(vm_clock, spice_chr_unblock, s);
- 
-     QLIST_INSERT_HEAD(&spice_chars, s, next);
- 
diff --git a/0009-spice-qemu-char.c-remove-intermediate-buffer.patch b/0009-spice-qemu-char.c-remove-intermediate-buffer.patch
deleted file mode 100644
index a5ded75..0000000
--- a/0009-spice-qemu-char.c-remove-intermediate-buffer.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From de979c48aa4b5e7f3f8658f9ac69030f3de3c99c Mon Sep 17 00:00:00 2001
-From: Alon Levy <alevy@redhat.com>
-Date: Tue, 22 Mar 2011 12:28:00 +0200
-Subject: [PATCH] spice-qemu-char.c: remove intermediate buffer
-
-BZ: 672191
-upstream: not submitted (explained below)
-
-virtio-serial's buffer is valid when it calls us, and we don't
-access it otherwise: vmc_read is only called in response to wakeup,
-or else we set datalen=0 and throttle. Then vmc_read is called back,
-we return 0 (not accessing the buffer) and set the timer to unthrottle.
-
-Also make datalen int and not ssize_t (to fit spice_chr_write signature).
-
-This relied on the previous patch that introduces throttling, which
-can't go upstream right now as explained in that patch.
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- spice-qemu-char.c | 18 ++++++------------
- 1 file changed, 6 insertions(+), 12 deletions(-)
-
-diff --git a/spice-qemu-char.c b/spice-qemu-char.c
-index 75bb125..5065240 100644
---- a/spice-qemu-char.c
-+++ b/spice-qemu-char.c
-@@ -23,9 +23,8 @@ typedef struct SpiceCharDriver {
-     SpiceCharDeviceInstance     sin;
-     char                  *subtype;
-     bool                  active;
--    uint8_t               *buffer;
--    uint8_t               *datapos;
--    ssize_t               bufsize, datalen;
-+    const uint8_t         *datapos;
-+    int                   datalen;
-     uint32_t              debug;
-     QEMUTimer             *unblock_timer;
-     QLIST_ENTRY(SpiceCharDriver) next;
-@@ -73,7 +72,7 @@ static int vmc_read(SpiceCharDeviceInstance *sin, uint8_t *buf, int len)
-     SpiceCharDriver *scd = container_of(sin, SpiceCharDriver, sin);
-     int bytes = MIN(len, scd->datalen);
- 
--    dprintf(scd, 2, "%s: %p %d/%d/%zd\n", __func__, scd->datapos, len, bytes, scd->datalen);
-+    dprintf(scd, 2, "%s: %p %d/%d/%d\n", __func__, scd->datapos, len, bytes, scd->datalen);
-     if (bytes > 0) {
-         memcpy(buf, scd->datapos, bytes);
-         scd->datapos += bytes;
-@@ -189,18 +188,13 @@ static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
-     dprintf(s, 2, "%s: %d\n", __func__, len);
-     vmc_register_interface(s);
-     assert(s->datalen == 0);
--    if (s->bufsize < len) {
--        s->bufsize = len;
--        s->buffer = g_realloc(s->buffer, s->bufsize);
--    }
--    memcpy(s->buffer, buf, len);
--    s->datapos = s->buffer;
-+    s->datapos = buf;
-     s->datalen = len;
-     spice_server_char_device_wakeup(&s->sin);
-     read_bytes = len - s->datalen;
-     if (read_bytes != len) {
--        dprintf(s, 1, "%s: throttling: %d < %d (%zd)\n", __func__,
--                read_bytes, len, s->bufsize);
-+        dprintf(s, 1, "%s: throttling: %d < %d\n", __func__,
-+                read_bytes, len);
-         s->chr->write_blocked = true;
-         /* We'll get passed in the unconsumed data with the next call */
-         s->datalen = 0;
diff --git a/0010-usb-redir-Add-flow-control-support.patch b/0010-usb-redir-Add-flow-control-support.patch
deleted file mode 100644
index 5ff7b70..0000000
--- a/0010-usb-redir-Add-flow-control-support.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 1e87b85766f9c18a2f9dffd289c0e56d640637c4 Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Tue, 19 Jul 2011 10:56:19 +0200
-Subject: [PATCH] usb-redir: Add flow control support
-
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
----
- hw/usb/redirect.c | 22 ++++++++++++++++++++--
- 1 file changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
-index bb07c62..4d23b66 100644
---- a/hw/usb/redirect.c
-+++ b/hw/usb/redirect.c
-@@ -257,8 +257,9 @@ static int usbredir_read(void *priv, uint8_t *data, int count)
- static int usbredir_write(void *priv, uint8_t *data, int count)
- {
-     USBRedirDevice *dev = priv;
-+    int r;
- 
--    if (!dev->cs->opened) {
-+    if (!dev->cs->opened || dev->cs->write_blocked) {
-         return 0;
-     }
- 
-@@ -267,7 +268,16 @@ static int usbredir_write(void *priv, uint8_t *data, int count)
-         return 0;
-     }
- 
--    return qemu_chr_fe_write(dev->cs, data, count);
-+    r = qemu_chr_fe_write(dev->cs, data, count);
-+
-+    if (r < 0) {
-+        if (dev->cs->write_blocked) {
-+           return 0;
-+        }
-+        return -1;
-+    }
-+
-+    return r;
- }
- 
- /*
-@@ -1227,10 +1237,18 @@ static void usbredir_chardev_event(void *opaque, int event)
-     }
- }
- 
-+static void usbredir_chardev_write_unblocked(void *opaque)
-+{
-+    USBRedirDevice *dev = opaque;
-+
-+    usbredirparser_do_write(dev->parser);
-+}
-+
- static const QemuChrHandlers usbredir_chr_handlers = {
-     .fd_can_read = usbredir_chardev_can_read,
-     .fd_read = usbredir_chardev_read,
-     .fd_event = usbredir_chardev_event,
-+    .fd_write_unblocked = usbredir_chardev_write_unblocked,
- };
- 
- /*
diff --git a/0011-char-Disable-write-callback-if-throttled-chardev-is-.patch b/0011-char-Disable-write-callback-if-throttled-chardev-is-.patch
deleted file mode 100644
index b686ccd..0000000
--- a/0011-char-Disable-write-callback-if-throttled-chardev-is-.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 42931bebb2856307dcdc9babc5dd9954b60c8094 Mon Sep 17 00:00:00 2001
-From: Amit Shah <amit.shah@redhat.com>
-Date: Fri, 2 Dec 2011 15:42:55 +0530
-Subject: [PATCH] char: Disable write callback if throttled chardev is detached
-
-If a throttled chardev is detached from the frontend device, all future
-callbacks should be suppressed.  Not doing this results in a segfault.
-
-Bugzilla: 745758
-Upstream: Not applicable, since throttling is a RHEL6-only feature.
-
-Signed-off-by: Amit Shah <amit.shah@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- qemu-char.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/qemu-char.c b/qemu-char.c
-index 53d2c13..fde72ff 100644
---- a/qemu-char.c
-+++ b/qemu-char.c
-@@ -223,6 +223,11 @@ void qemu_chr_add_handlers(CharDriverState *s,
-         ++s->avail_connections;
-     }
-     if (!handlers) {
-+        if (s->write_blocked) {
-+            /* Ensure we disable the callback if we were throttled */
-+            s->chr_disable_write_fd_handler(s);
-+            /* s->write_blocked is cleared below */
-+        }
-         handlers = &null_handlers;
-     }
-     s->chr_can_read = handlers->fd_can_read;
diff --git a/0012-hw-virtio-serial-bus-replay-guest-open-on-destinatio.patch b/0012-hw-virtio-serial-bus-replay-guest-open-on-destinatio.patch
deleted file mode 100644
index 078cf15..0000000
--- a/0012-hw-virtio-serial-bus-replay-guest-open-on-destinatio.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 81ab56732f4990c288c88a545925dc4431c313d2 Mon Sep 17 00:00:00 2001
-From: Alon Levy <alevy@redhat.com>
-Date: Fri, 16 Nov 2012 16:24:47 +0200
-Subject: [PATCH] hw/virtio-serial-bus: replay guest open on destination
-
-This is rewrite of a patch carried in Fedora previously based
-on new code upstream, here is the original message, it still applies:
-(the original fedora patch was commit id
-a9bc20afc1f0604ee81c23b7c67d627e51d2e8d4, this is useful for grepping in
-logs, it isn't in upstream)
-
-When migrating a host with with a spice agent running the mouse becomes
-non operational after the migration. This is rhbz #725965.
-
-The problem is that after migration spice doesn't know the guest agent
-is open.  Spice is just a char dev here. And a chardev cannot query it's
-device, the device has to let the chardev know when it is open. Right
-now after migration the chardev which is recreated is in it's default
-state, which assumes the guest is disconnected.
-
-Char devices carry no information across migration, but the
-virtio-serial does already carry the guest_connected state. This patch
-passes that bit to the chardev.
----
- hw/virtio-serial-bus.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
-index aa7d0d7..5078129 100644
---- a/hw/virtio-serial-bus.c
-+++ b/hw/virtio-serial-bus.c
-@@ -642,6 +642,7 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
-     VirtIOSerial *s = opaque;
-     VirtIOSerialPort *port;
-     uint8_t host_connected;
-+    VirtIOSerialPortClass *vsc;
- 
-     if (!s->post_load) {
-         return;
-@@ -657,6 +658,11 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
-             send_control_event(s, port->id, VIRTIO_CONSOLE_PORT_OPEN,
-                                port->host_connected);
-         }
-+        vsc = VIRTIO_SERIAL_PORT_GET_CLASS(port);
-+        if (port->guest_connected && vsc->guest_open) {
-+            /* replay guest open */
-+            vsc->guest_open(port);
-+        }
-     }
-     g_free(s->post_load->connected);
-     qemu_free_timer(s->post_load->timer);
diff --git a/0101-configure-Add-enable-migration-from-qemu-kvm.patch b/0101-configure-Add-enable-migration-from-qemu-kvm.patch
deleted file mode 100644
index 695a659..0000000
--- a/0101-configure-Add-enable-migration-from-qemu-kvm.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From c6c153bfd7f9da48eb541d78bf09bc03bcc337e5 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 19 Feb 2013 14:39:05 -0500
-Subject: [PATCH] configure: Add --enable-migration-from-qemu-kvm
-
-This switch will turn on all the migration compat bits needed to
-perform migration from qemu-kvm to qemu. It's just a stub for now.
-
-This compat will break incoming migration from qemu < 1.3, but for
-distros where qemu-kvm was the only shipped package for years it's
-not a big loss (and I don't know any way to avoid it).
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- configure | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/configure b/configure
-index e7468a9..719e348 100755
---- a/configure
-+++ b/configure
-@@ -170,6 +170,7 @@ xfs=""
- 
- vhost_net="no"
- kvm="no"
-+migrate_from_kvm="no"
- gprof="no"
- debug_tcg="no"
- debug="no"
-@@ -759,6 +760,8 @@ for opt do
-   ;;
-   --enable-kvm) kvm="yes"
-   ;;
-+  --enable-migration-from-qemu-kvm) migrate_from_kvm="yes"
-+  ;;
-   --disable-tcg-interpreter) tcg_interpreter="no"
-   ;;
-   --enable-tcg-interpreter) tcg_interpreter="yes"
-@@ -1087,6 +1090,9 @@ echo "  --enable-bluez           enable bluez stack connectivity"
- echo "  --disable-slirp          disable SLIRP userspace network connectivity"
- echo "  --disable-kvm            disable KVM acceleration support"
- echo "  --enable-kvm             enable KVM acceleration support"
-+echo "  --enable-migration-from-qemu-kvm  Allow migration from qemu-kvm."
-+echo "                                    This will break migration from "
-+echo "                                    qemu < 1.3 in most cases"
- echo "  --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)"
- echo "  --disable-nptl           disable usermode NPTL support"
- echo "  --enable-nptl            enable usermode NPTL support"
-@@ -3324,6 +3330,7 @@ echo "Linux AIO support $linux_aio"
- echo "ATTR/XATTR support $attr"
- echo "Install blobs     $blobs"
- echo "KVM support       $kvm"
-+echo "Migrate from qemu-kvm $migrate_from_kvm"
- echo "TCG interpreter   $tcg_interpreter"
- echo "fdt support       $fdt"
- echo "preadv support    $preadv"
-@@ -3612,6 +3619,9 @@ fi
- if test "$signalfd" = "yes" ; then
-   echo "CONFIG_SIGNALFD=y" >> $config_host_mak
- fi
-+if test "$migrate_from_kvm" = "yes"; then
-+  echo "CONFIG_MIGRATE_FROM_QEMU_KVM=y" >> $config_host_mak
-+fi
- if test "$tcg_interpreter" = "yes" ; then
-   echo "CONFIG_TCG_INTERPRETER=y" >> $config_host_mak
- fi
diff --git a/0102-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch b/0102-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch
deleted file mode 100644
index 9514db4..0000000
--- a/0102-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 75e3acce2d9302a2344b3de381a49f6cd0fa04ad Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 19 Feb 2013 14:44:49 -0500
-Subject: [PATCH] acpi_piix4: Drop minimum_version_id to handle qemu-kvm
- migration
-
-qemu-kvm 1.2 advertised version_id=2, but it was not the same
-format as qemu.git version_id=2.
-
-commit b0b873a07872f7ab7f66f259c73fb9dd42aa66a9 added the qemu-kvm
-format to qemu.git, but was forced to call it version_id=3, and
-bumped minimum_version_id to 3. This breaks incoming migration from
-qemu-kvm.
-
-If --enable-migration-from-qemu-kvm is enabled, drop minimum_version_id
-to 2. Migration from qemu-kvm version_id=2 and qemu 1.3+ version_id=3
-works, but migration from qemu < 1.3 is broken.
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- hw/acpi_piix4.c | 15 +++++++++------
- 1 file changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/hw/acpi_piix4.c b/hw/acpi_piix4.c
-index 1beac21..2abcc9d 100644
---- a/hw/acpi_piix4.c
-+++ b/hw/acpi_piix4.c
-@@ -257,16 +257,19 @@ static int acpi_load_old(QEMUFile *f, void *opaque, int version_id)
-     return ret;
- }
- 
--/* qemu-kvm 1.2 uses version 3 but advertised as 2
-- * To support incoming qemu-kvm 1.2 migration, change version_id
-- * and minimum_version_id to 2 below (which breaks migration from
-- * qemu 1.2).
-- *
-- */
- static const VMStateDescription vmstate_acpi = {
-     .name = "piix4_pm",
-     .version_id = 3,
-+#ifdef CONFIG_MIGRATE_FROM_QEMU_KVM
-+    /*
-+     * qemu-kvm 1.2 uses qemu.git version 3 format, but advertised as 2.
-+     * This allows incoming migration from qemu-kvm, but breaks incoming
-+     * migration from qemu < 1.3.
-+     */
-+    .minimum_version_id = 2,
-+#else
-     .minimum_version_id = 3,
-+#endif
-     .minimum_version_id_old = 1,
-     .load_state_old = acpi_load_old,
-     .post_load = vmstate_acpi_post_load,
diff --git a/0103-i8254-Fix-migration-from-qemu-kvm-1.1.patch b/0103-i8254-Fix-migration-from-qemu-kvm-1.1.patch
deleted file mode 100644
index 317f6ea..0000000
--- a/0103-i8254-Fix-migration-from-qemu-kvm-1.1.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From c50ed212c0b0814a0edefb2d2a2fc7abc6aed2af Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 19 Feb 2013 15:04:59 -0500
-Subject: [PATCH] i8254: Fix migration from qemu-kvm < 1.1
-
-qemu-kvm commit 81bdec908fb2be0ccaff1d4ee67956c509e440ad did this,
-but the logic can't be carried unconditionally in qemu.git without
-breaking migration from qemu < 1.1.
-
-Conditionalize it with --enable-migrate-from-qemu-kvm
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- hw/i8254_common.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/hw/i8254_common.c b/hw/i8254_common.c
-index 8c2e45a..072fa09 100644
---- a/hw/i8254_common.c
-+++ b/hw/i8254_common.c
-@@ -275,7 +275,15 @@ static const VMStateDescription vmstate_pit_common = {
-     .pre_save = pit_dispatch_pre_save,
-     .post_load = pit_dispatch_post_load,
-     .fields = (VMStateField[]) {
-+#ifdef CONFIG_MIGRATE_FROM_QEMU_KVM
-+        /* qemu-kvm version_id=2 had 'flags' here which is equivalent
-+         * This fixes incoming migration from qemu-kvm 1.0, but breaks
-+         * incoming migration from qemu < 1.1
-+         */
-+        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState),
-+#else
-         VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
-+#endif
-         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
-                              vmstate_pit_channel, PITChannelState),
-         VMSTATE_INT64(channels[0].next_transition_time,
diff --git a/0104-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch b/0104-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch
deleted file mode 100644
index 1d39ec0..0000000
--- a/0104-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 271e4d924c39efd716cc3ad86a5f615660b13f22 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 19 Feb 2013 15:35:40 -0500
-Subject: [PATCH] pc_piix: Add compat handling for qemu-kvm VGA mem size
-
-Paolo outlines this here:
-
-https://lists.gnu.org/archive/html/qemu-devel/2013-01/msg02540.html
-
-qemu-kvm defaulted to vgamem=16MB since at least 0.15, while qemu used
-8MB. For qemu 1.2, the default was changed to 16MB for all devices
-except cirrus.
-
-If --enable-migration-from-qemu-kvm is specified, make sure cirrus
-uses 16MB for <= pc-1.2 (the qemu-kvm merge), and 16MB always for
-all others. This will break incoming qemu migration for qemu < 1.3.
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- hw/pc_piix.c | 20 ++++++++++++++++----
- 1 file changed, 16 insertions(+), 4 deletions(-)
-
-diff --git a/hw/pc_piix.c b/hw/pc_piix.c
-index 0af436c..e3f8e96 100644
---- a/hw/pc_piix.c
-+++ b/hw/pc_piix.c
-@@ -331,6 +331,13 @@ static QEMUMachine pc_machine_v1_3 = {
-     DEFAULT_MACHINE_OPTIONS,
- };
- 
-+#ifdef CONFIG_MIGRATE_FROM_QEMU_KVM
-+/* qemu-kvm defaulted to 16MB video memory since 0.15 at least. */
-+# define OLD_VGA_MEM stringify(16)
-+#else
-+# define OLD_VGA_MEM stringify(8)
-+#endif
-+
- #define PC_COMPAT_1_2 \
-         PC_COMPAT_1_3,\
-         {\
-@@ -354,6 +361,10 @@ static QEMUMachine pc_machine_v1_3 = {
-             .property = "revision",\
-             .value    = stringify(3),\
-         },{\
-+            .driver   = "cirrus-vga",\
-+            .property = "vgamem_mb",\
-+            .value    = OLD_VGA_MEM,\
-+        },{\
-             .driver   = "VGA",\
-             .property = "mmio",\
-             .value    = "off",\
-@@ -371,6 +382,7 @@ static QEMUMachine pc_machine_v1_2 = {
-     DEFAULT_MACHINE_OPTIONS,
- };
- 
-+
- #define PC_COMPAT_1_1 \
-         PC_COMPAT_1_2,\
-         {\
-@@ -384,19 +396,19 @@ static QEMUMachine pc_machine_v1_2 = {
-         },{\
-             .driver   = "VGA",\
-             .property = "vgamem_mb",\
--            .value    = stringify(8),\
-+            .value    = OLD_VGA_MEM,\
-         },{\
-             .driver   = "vmware-svga",\
-             .property = "vgamem_mb",\
--            .value    = stringify(8),\
-+            .value    = OLD_VGA_MEM,\
-         },{\
-             .driver   = "qxl-vga",\
-             .property = "vgamem_mb",\
--            .value    = stringify(8),\
-+            .value    = OLD_VGA_MEM,\
-         },{\
-             .driver   = "qxl",\
-             .property = "vgamem_mb",\
--            .value    = stringify(8),\
-+            .value    = OLD_VGA_MEM,\
-         },{\
-             .driver   = "virtio-blk-pci",\
-             .property = "config-wce",\
diff --git a/0105-qxl-Add-rom_size-compat-property-fix-migration-from-.patch b/0105-qxl-Add-rom_size-compat-property-fix-migration-from-.patch
deleted file mode 100644
index e98bba9..0000000
--- a/0105-qxl-Add-rom_size-compat-property-fix-migration-from-.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From 66cc6383d6b1d934d22e9a16b432cacacd58c315 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 19 Feb 2013 16:19:02 -0500
-Subject: [PATCH] qxl: Add rom_size compat property, fix migration from 1.2
-
-Commit 038c1879a00153b14bce113315b693e8c2944fa9 changed the qxl rom
-size to 8192, which fixes incoming migration from qemu 1.0. However
-from qemu 1.2 and 1.3 had rom size 16384, so incoming migration
-from those versions is now broken.
-
-Add a rom_size compat property. 1.2 and 1.3 get 16384, everything
-else is 8192.
-
-This isn't actually fool proof, since rom_size can be dependent on
-the version of spice qemu is built against:
-
-https://lists.gnu.org/archive/html/qemu-devel/2013-02/msg03154.html
-
-However these sizes match what native Fedora packages get, so it's
-good enough for now.
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- hw/pc_piix.c | 16 ++++++++++++++++
- hw/qxl.c     |  9 ++++-----
- 2 files changed, 20 insertions(+), 5 deletions(-)
-
-diff --git a/hw/pc_piix.c b/hw/pc_piix.c
-index e3f8e96..a1a6794 100644
---- a/hw/pc_piix.c
-+++ b/hw/pc_piix.c
-@@ -317,6 +317,14 @@ static QEMUMachine pc_i440fx_machine_v1_4 = {
-             .driver   = "virtio-net-pci", \
-             .property = "mq", \
-             .value    = "off", \
-+        },{ \
-+            .driver   = "qxl", \
-+            .property = "rom_size", \
-+            .value    = stringify(16384), \
-+        },{\
-+            .driver   = "qxl-vga", \
-+            .property = "rom_size", \
-+            .value    = stringify(16384), \
-         }
- 
- static QEMUMachine pc_machine_v1_3 = {
-@@ -413,6 +421,14 @@ static QEMUMachine pc_machine_v1_2 = {
-             .driver   = "virtio-blk-pci",\
-             .property = "config-wce",\
-             .value    = "off",\
-+        },{ \
-+            .driver   = "qxl", \
-+            .property = "rom_size", \
-+            .value    = stringify(8192), \
-+        },{\
-+            .driver   = "qxl-vga", \
-+            .property = "rom_size", \
-+            .value    = stringify(8192), \
-         }
- 
- static QEMUMachine pc_machine_v1_1 = {
-diff --git a/hw/qxl.c b/hw/qxl.c
-index ca094e6..80bd92a 100644
---- a/hw/qxl.c
-+++ b/hw/qxl.c
-@@ -302,16 +302,14 @@ static inline uint32_t msb_mask(uint32_t val)
-     return mask;
- }
- 
--static ram_addr_t qxl_rom_size(void)
-+static void check_qxl_rom_size(PCIQXLDevice *d)
- {
-     uint32_t required_rom_size = sizeof(QXLRom) + sizeof(QXLModes) +
-                                  sizeof(qxl_modes);
--    uint32_t rom_size = 8192; /* two pages */
- 
-     required_rom_size = MAX(required_rom_size, TARGET_PAGE_SIZE);
-     required_rom_size = msb_mask(required_rom_size * 2 - 1);
--    assert(required_rom_size <= rom_size);
--    return rom_size;
-+    assert(required_rom_size <= d->rom_size);
- }
- 
- static void init_qxl_rom(PCIQXLDevice *d)
-@@ -1979,7 +1977,7 @@ static int qxl_init_common(PCIQXLDevice *qxl)
-     pci_set_byte(&config[PCI_REVISION_ID], pci_device_rev);
-     pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);
- 
--    qxl->rom_size = qxl_rom_size();
-+    check_qxl_rom_size(qxl);
-     memory_region_init_ram(&qxl->rom_bar, "qxl.vrom", qxl->rom_size);
-     vmstate_register_ram(&qxl->rom_bar, &qxl->pci.qdev);
-     init_qxl_rom(qxl);
-@@ -2296,6 +2294,7 @@ static Property qxl_properties[] = {
-         DEFINE_PROP_UINT32("vram64_size_mb", PCIQXLDevice, vram_size_mb, -1),
-         DEFINE_PROP_UINT32("vgamem_mb", PCIQXLDevice, vgamem_size_mb, 16),
-         DEFINE_PROP_INT32("surfaces", PCIQXLDevice, ssd.num_surfaces, 1024),
-+        DEFINE_PROP_UINT32("rom_size", PCIQXLDevice, rom_size, 8192),
-         DEFINE_PROP_END_OF_LIST(),
- };
- 
diff --git a/0106-docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch b/0106-docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch
deleted file mode 100644
index 22b31bf..0000000
--- a/0106-docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From f76e7a03ac948a7649878d7ddbb02ace0f6e3625 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Wed, 20 Feb 2013 11:14:45 -0500
-Subject: [PATCH] docs: Fix generating qemu-doc.html with texinfo 5
-
-LC_ALL=C makeinfo --no-headers --no-split --number-sections --html qemu-doc.texi -o qemu-doc.html
-./qemu-options.texi:1521: unknown command `list'
-./qemu-options.texi:1521: table requires an argument: the formatter for @item
-./qemu-options.texi:1521: warning: @table has text but no @item
-
-CC: qemu-stable@nongnu.org
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- qemu-options.hx | 19 +++++++------------
- 1 file changed, 7 insertions(+), 12 deletions(-)
-
-diff --git a/qemu-options.hx b/qemu-options.hx
-index 15dc29e..470c2b4 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -2092,18 +2092,13 @@ QEMU supports using either local sheepdog devices or remote networked
- devices.
- 
- Syntax for specifying a sheepdog device
--@table @list
--``sheepdog:<vdiname>''
--
--``sheepdog:<vdiname>:<snapid>''
--
--``sheepdog:<vdiname>:<tag>''
--
--``sheepdog:<host>:<port>:<vdiname>''
--
--``sheepdog:<host>:<port>:<vdiname>:<snapid>''
--
--``sheepdog:<host>:<port>:<vdiname>:<tag>''
-+@table @code
-+@item sheepdog:<vdiname>
-+@item sheepdog:<vdiname>:<snapid>
-+@item sheepdog:<vdiname>:<tag>
-+@item sheepdog:<host>:<port>:<vdiname>
-+@item sheepdog:<host>:<port>:<vdiname>:<snapid>
-+@item sheepdog:<host>:<port>:<vdiname>:<tag>
- @end table
- 
- Example
diff --git a/0107-usb-redir-Fix-crash-on-migration-with-no-client-conn.patch b/0107-usb-redir-Fix-crash-on-migration-with-no-client-conn.patch
deleted file mode 100644
index c8b87a0..0000000
--- a/0107-usb-redir-Fix-crash-on-migration-with-no-client-conn.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 106a39c50211b7c7e96ffb47ad9deae5d9be6d84 Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Fri, 15 Mar 2013 11:52:37 +0100
-Subject: [PATCH] usb-redir: Fix crash on migration with no client connected
-
-If no client is connected on the src side, then we won't receive a
-parser during migrate, in this case usbredir_post_load() should be a nop,
-rather then to try to derefefence the NULL dev->parser pointer.
-
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 3713e1485e6eace7d48b9c790602cfd92c616e5f)
----
- hw/usb/redirect.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
-index 4d23b66..bf6aaf0 100644
---- a/hw/usb/redirect.c
-+++ b/hw/usb/redirect.c
-@@ -2008,6 +2008,10 @@ static int usbredir_post_load(void *priv, int version_id)
- {
-     USBRedirDevice *dev = priv;
- 
-+    if (dev->parser == NULL) {
-+        return 0;
-+    }
-+
-     switch (dev->device_info.speed) {
-     case usb_redir_speed_low:
-         dev->dev.speed = USB_SPEED_LOW;
diff --git a/qemu.spec b/qemu.spec
index c58ae55..515a669 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -29,6 +29,7 @@
 %bcond_without seccomp          # enabled
 %bcond_with    xfsprogs         # disabled
 %bcond_with    separate_kvm     # disabled - for EPEL
+%bcond_with    gtk              # disabled
 %else
 # General defaults:
 %bcond_with    kvmonly          # disabled
@@ -38,9 +39,10 @@
 %bcond_without seccomp          # enabled
 %bcond_without xfsprogs         # enabled
 %bcond_with    separate_kvm     # disabled
+%bcond_without gtk              # enabled
 %endif
 
-%global SLOF_gittagdate 20121018
+%global SLOF_gittagdate 20130430
 
 %if %{without separate_kvm}
 %global kvm_archs %{ix86} x86_64 ppc64 s390x
@@ -121,6 +123,7 @@
 %global system_x86    system-x86
 %global system_xtensa   system-xtensa
 %global system_unicore32   system-unicore32
+%global system_moxie   system-moxie
 %endif
 
 # libfdt is only needed to build ARM, Microblaze or PPC emulators
@@ -130,9 +133,8 @@
 
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
-Version: 1.4.1
-Release: 3%{?dist}
-# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
+Version: 1.5.0
+Release: 1%{?dist}
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
 Group: Development/Tools
@@ -173,31 +175,13 @@ Source12: bridge.conf
 # qemu-kvm back compat wrapper
 Source13: qemu-kvm.sh
 
-# Flow control series
-Patch0001: 0001-char-Split-out-tcp-socket-close-code-in-a-separate-f.patch
-Patch0002: 0002-char-Add-a-QemuChrHandlers-struct-to-initialise-char.patch
-Patch0003: 0003-iohandlers-Add-enable-disable_write_fd_handler-funct.patch
-Patch0004: 0004-char-Add-framework-for-a-write-unblocked-callback.patch
-Patch0005: 0005-char-Update-send_all-to-handle-nonblocking-chardev-w.patch
-Patch0006: 0006-char-Equip-the-unix-tcp-backend-to-handle-nonblockin.patch
-Patch0007: 0007-virtio-console-Enable-port-throttling-when-chardev-i.patch
-Patch0008: 0008-spice-qemu-char.c-add-throttling.patch
-Patch0009: 0009-spice-qemu-char.c-remove-intermediate-buffer.patch
-Patch0010: 0010-usb-redir-Add-flow-control-support.patch
-Patch0011: 0011-char-Disable-write-callback-if-throttled-chardev-is-.patch
-Patch0012: 0012-hw-virtio-serial-bus-replay-guest-open-on-destinatio.patch
-
 # qemu-kvm migration compat (posted upstream)
-Patch0101: 0101-configure-Add-enable-migration-from-qemu-kvm.patch
-Patch0102: 0102-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch
-Patch0103: 0103-i8254-Fix-migration-from-qemu-kvm-1.1.patch
-Patch0104: 0104-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch
+Patch0001: 0001-configure-Add-enable-migration-from-qemu-kvm.patch
+Patch0002: 0002-acpi_piix4-Drop-minimum_version_id-to-handle-qemu-kv.patch
+Patch0003: 0003-i8254-Fix-migration-from-qemu-kvm-1.1.patch
+Patch0004: 0004-pc_piix-Add-compat-handling-for-qemu-kvm-VGA-mem-siz.patch
 # Fix migration w/ qxl from qemu-kvm 1.2 (solution pending upstream)
-Patch0105: 0105-qxl-Add-rom_size-compat-property-fix-migration-from-.patch
-# Fix generating docs with texinfo 5 (posted upstream)
-Patch0106: 0106-docs-Fix-generating-qemu-doc.html-with-texinfo-5.patch
-# Fix crash with usbredir (bz #962826)
-Patch0107: 0107-usb-redir-Fix-crash-on-migration-with-no-client-conn.patch
+Patch0005: 0005-qxl-Add-rom_size-compat-property-fix-migration-from-.patch
 
 BuildRequires: SDL-devel
 BuildRequires: zlib-devel
@@ -268,6 +252,16 @@ BuildRequires: pixman-devel
 BuildRequires: glusterfs-devel >= 3.4.0
 BuildRequires: glusterfs-api-devel >= 3.4.0
 %endif
+# Needed for usb passthrough for qemu >= 1.5
+BuildRequires: libusbx-devel
+# SSH block driver
+BuildRequires: libssh2-devel
+%if %{with gtk}
+# GTK frontend
+BuildRequires: gtk3-devel
+BuildRequires: vte3-devel
+%endif
+
 
 %if 0%{?user:1}
 Requires: %{name}-%{user} = %{epoch}:%{version}-%{release}
@@ -317,6 +311,9 @@ Requires: %{name}-%{system_x86} = %{epoch}:%{version}-%{release}
 %if 0%{?system_xtensa:1}
 Requires: %{name}-%{system_xtensa} = %{epoch}:%{version}-%{release}
 %endif
+%if 0%{?system_moxie:1}
+Requires: %{name}-%{system_moxie} = %{epoch}:%{version}-%{release}
+%endif
 %if %{without separate_kvm}
 Requires: %{name}-img = %{epoch}:%{version}-%{release}
 %else
@@ -424,7 +421,7 @@ Obsoletes: kvm < 85
 Requires: seavgabios-bin
 Requires: seabios-bin >= 0.6.0-2
 Requires: sgabios-bin
-Requires: ipxe-roms-qemu
+Requires: ipxe-roms-qemu >= 20130517-2.gitc4bce43
 %if 0%{?have_seccomp:1}
 Requires: libseccomp >= 1.0.0
 %endif
@@ -577,7 +574,7 @@ Summary: QEMU system emulator for PPC
 Group: Development/Tools
 Requires: %{name}-common = %{epoch}:%{version}-%{release}
 Requires: openbios
-Requires: SLOF = 0.1.git%{SLOF_gittagdate}
+Requires: SLOF >= 0.1.git%{SLOF_gittagdate}
 %description %{system_ppc}
 QEMU is a generic and open source processor emulator which achieves a good
 emulation speed by using dynamic translation.
@@ -609,6 +606,18 @@ emulation speed by using dynamic translation.
 This package provides the system emulator for Unicore32 boards.
 %endif
 
+%if 0%{?system_moxie:1}
+%package %{system_moxie}
+Summary: QEMU system emulator for Moxie
+Group: Development/Tools
+Requires: %{name}-common = %{epoch}:%{version}-%{release}
+%description %{system_moxie}
+QEMU is a generic and open source processor emulator which achieves a good
+emulation speed by using dynamic translation.
+
+This package provides the system emulator for Moxie boards.
+%endif
+
 %ifarch %{kvm_archs}
 %package kvm-tools
 Summary: KVM debugging and diagnostics tools
@@ -647,31 +656,13 @@ CAC emulation development files.
 %prep
 %setup -q
 
-# Flow control series
+# qemu-kvm migration compat (posted upstream)
 %patch0001 -p1
 %patch0002 -p1
 %patch0003 -p1
 %patch0004 -p1
-%patch0005 -p1
-%patch0006 -p1
-%patch0007 -p1
-%patch0008 -p1
-%patch0009 -p1
-%patch0010 -p1
-%patch0011 -p1
-%patch0012 -p1
-
-# qemu-kvm migration compat (posted upstream)
-%patch0101 -p1
-%patch0102 -p1
-%patch0103 -p1
-%patch0104 -p1
 # Fix migration w/ qxl from qemu-kvm 1.2 (solution pending upstream)
-%patch0105 -p1
-# Fix generating docs with texinfo 5 (posted upstream)
-%patch0106 -p1
-# Fix crash with usbredir (bz #962826)
-%patch0107 -p1
+%patch0005 -p1
 
 
 %build
@@ -683,11 +674,13 @@ CAC emulation development files.
     microblazeel-softmmu mips-softmmu mipsel-softmmu mips64-softmmu \
     mips64el-softmmu or32-softmmu ppc-softmmu ppcemb-softmmu ppc64-softmmu \
     s390x-softmmu sh4-softmmu sh4eb-softmmu sparc-softmmu sparc64-softmmu \
-    xtensa-softmmu xtensaeb-softmmu unicore32-softmmu \
+    xtensa-softmmu xtensaeb-softmmu unicore32-softmmu moxie-softmmu \
     i386-linux-user x86_64-linux-user alpha-linux-user arm-linux-user \
     armeb-linux-user cris-linux-user m68k-linux-user \
     microblaze-linux-user microblazeel-linux-user mips-linux-user \
-    mipsel-linux-user or32-linux-user ppc-linux-user ppc64-linux-user \
+    mipsel-linux-user mips64-linux-user mips64el-linux-user \
+    mipsn32-linux-user mipsn32el-linux-user \
+    or32-linux-user ppc-linux-user ppc64-linux-user \
     ppc64abi32-linux-user s390x-linux-user sh4-linux-user sh4eb-linux-user \
     sparc-linux-user sparc64-linux-user sparc32plus-linux-user \
     unicore32-linux-user"
@@ -736,6 +729,10 @@ dobuild() {
 %else
         --disable-fdt \
 %endif
+%if %{with gtk}
+        --with-gtkabi="3.0" \
+%endif
+        --enable-tpm \
         "$@"
 
     echo "config-host.mak contents:"
@@ -778,6 +775,8 @@ install -m 0644 %{SOURCE3} $RPM_BUILD_ROOT%{_udevdir}
 
 make DESTDIR=$RPM_BUILD_ROOT install
 
+%find_lang %{name}
+
 %if 0%{?need_qemu_kvm}
 install -m 0755 %{SOURCE13} $RPM_BUILD_ROOT%{_bindir}/qemu-kvm
 %endif
@@ -788,7 +787,7 @@ rm $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/qemu-system-%{kvm_target}.stp
 %endif
 
 chmod -x ${RPM_BUILD_ROOT}%{_mandir}/man1/*
-install -D -p -m 0644 -t ${RPM_BUILD_ROOT}%{qemudocdir} Changelog README TODO COPYING COPYING.LIB LICENSE
+install -D -p -m 0644 -t ${RPM_BUILD_ROOT}%{qemudocdir} Changelog README COPYING COPYING.LIB LICENSE
 
 install -D -p -m 0644 qemu.sasl $RPM_BUILD_ROOT%{_sysconfdir}/sasl2/qemu.conf
 
@@ -817,10 +816,12 @@ rm -f ${RPM_BUILD_ROOT}%{_datadir}/%{name}/spapr-rtas.bin
 %endif
 %if 0%{!?system_s390x:1}
 rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/s390-zipl.rom
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/s390-ccw.img
 %endif
 
 # Provided by package ipxe
 rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/pxe*rom
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/efi*rom
 # Provided by package seavgabios
 rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/vgabios*bin
 # Provided by package seabios
@@ -834,6 +835,7 @@ rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/sgabios.bin
 # for other paths, yet.
 pxe_link() {
   ln -s ../ipxe/$2.rom %{buildroot}%{_datadir}/%{name}/pxe-$1.rom
+  ln -s ../ipxe.efi/$2.rom %{buildroot}%{_datadir}/%{name}/efi-$1.rom
 }
 
 pxe_link e1000 8086100e
@@ -999,12 +1001,11 @@ getent passwd qemu >/dev/null || \
 %defattr(-,root,root)
 %endif
 
-%files common
+%files common -f %{name}.lang
 %defattr(-,root,root)
 %dir %{qemudocdir}
 %doc %{qemudocdir}/Changelog
 %doc %{qemudocdir}/README
-%doc %{qemudocdir}/TODO
 %doc %{qemudocdir}/qemu-doc.html
 %doc %{qemudocdir}/qemu-tech.html
 %doc %{qemudocdir}/qmp-commands.txt
@@ -1012,6 +1013,7 @@ getent passwd qemu >/dev/null || \
 %doc %{qemudocdir}/COPYING.LIB
 %doc %{qemudocdir}/LICENSE
 %dir %{_datadir}/%{name}/
+%{_datadir}/%{name}/qemu-icon.bmp
 %{_datadir}/%{name}/keymaps/
 %{_mandir}/man1/qemu.1*
 %{_mandir}/man1/virtfs-proxy-helper.1*
@@ -1053,6 +1055,10 @@ getent passwd qemu >/dev/null || \
 %{_bindir}/qemu-microblazeel
 %{_bindir}/qemu-mips
 %{_bindir}/qemu-mipsel
+%{_bindir}/qemu-mips64
+%{_bindir}/qemu-mips64el
+%{_bindir}/qemu-mipsn32
+%{_bindir}/qemu-mipsn32el
 %{_bindir}/qemu-or32
 %{_bindir}/qemu-ppc
 %{_bindir}/qemu-ppc64
@@ -1075,6 +1081,10 @@ getent passwd qemu >/dev/null || \
 %{_datadir}/systemtap/tapset/qemu-microblazeel.stp
 %{_datadir}/systemtap/tapset/qemu-mips.stp
 %{_datadir}/systemtap/tapset/qemu-mipsel.stp
+%{_datadir}/systemtap/tapset/qemu-mips64.stp
+%{_datadir}/systemtap/tapset/qemu-mips64el.stp
+%{_datadir}/systemtap/tapset/qemu-mipsn32.stp
+%{_datadir}/systemtap/tapset/qemu-mipsn32el.stp
 %{_datadir}/systemtap/tapset/qemu-or32.stp
 %{_datadir}/systemtap/tapset/qemu-ppc.stp
 %{_datadir}/systemtap/tapset/qemu-ppc64.stp
@@ -1110,11 +1120,15 @@ getent passwd qemu >/dev/null || \
 %{_datadir}/%{name}/vgabios-stdvga.bin
 %{_datadir}/%{name}/vgabios-vmware.bin
 %{_datadir}/%{name}/pxe-e1000.rom
+%{_datadir}/%{name}/efi-e1000.rom
 %{_datadir}/%{name}/pxe-virtio.rom
+%{_datadir}/%{name}/efi-virtio.rom
 %{_datadir}/%{name}/pxe-pcnet.rom
+%{_datadir}/%{name}/efi-pcnet.rom
 %{_datadir}/%{name}/pxe-rtl8139.rom
+%{_datadir}/%{name}/efi-rtl8139.rom
 %{_datadir}/%{name}/pxe-ne2k_pci.rom
-%{_datadir}/%{name}/qemu-icon.bmp
+%{_datadir}/%{name}/efi-ne2k_pci.rom
 %config(noreplace) %{_sysconfdir}/qemu/target-x86_64.conf
 %if %{without separate_kvm}
 %ifarch %{ix86} x86_64
@@ -1202,6 +1216,7 @@ getent passwd qemu >/dev/null || \
 %{_bindir}/qemu-system-s390x
 %{_datadir}/systemtap/tapset/qemu-system-s390x.stp
 %{_datadir}/%{name}/s390-zipl.rom
+%{_datadir}/%{name}/s390-ccw.img
 %ifarch s390x
 %{?kvm_files:}
 %{?qemu_kvm_files:}
@@ -1262,6 +1277,13 @@ getent passwd qemu >/dev/null || \
 %{_datadir}/systemtap/tapset/qemu-system-xtensaeb.stp
 %endif
 
+%if 0%{?system_moxie:1}
+%files %{system_moxie}
+%defattr(-,root,root)
+%{_bindir}/qemu-system-moxie
+%{_datadir}/systemtap/tapset/qemu-system-moxie.stp
+%endif
+
 %if %{without separate_kvm}
 %files img
 %defattr(-,root,root)
@@ -1288,6 +1310,14 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Tue May 21 2013 Cole Robinson <crobinso@redhat.com> - 2:1.5.0-1
+- Update to qemu 1.5
+- KVM for ARM support
+- A native GTK+ UI with internationalization support
+- Experimental VFIO support for VGA passthrough
+- Support for VMware PVSCSI and VMXNET3 device emulation
+- CPU hot-add support
+
 * Thu May 16 2013 Paolo Bonzini <pbonzini@redhat.com> - 2:1.4.1-3
 - Drop loading of vhost-net module (bz #963198)
 
diff --git a/sources b/sources
index fc2703b..56d3af3 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-eb2d696956324722b5ecfa46e41f9a75  qemu-1.4.1.tar.bz2
+b6f3265b8ed39d77e8f354f35cc26e16  qemu-1.5.0.tar.bz2