updated 2.12.0

8 files changed, 90 insertions, 638 deletions

diff --git a/.SRCINFO b/.SRCINFO
index f02da9070ce2..57076e24219d 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,8 +1,8 @@
 # Generated by mksrcinfo v8
-# Sun Feb 18 17:17:39 UTC 2018
+# Thu May  3 22:59:32 UTC 2018
 pkgbase = qemu-patched
 	pkgdesc = A generic and open source machine emulator and virtualizer - Patched for extra functionality
-	pkgver = 2.11.1
+	pkgver = 2.12.0
 	pkgrel = 1
 	url = http://wiki.qemu.org/
 	arch = x86_64
@@ -33,26 +33,20 @@ pkgbase = qemu-patched
 	depends = spice
 	depends = libcacard
 	depends = usbredir
-	source = http://wiki.qemu.org//download/qemu-2.11.1.tar.xz
-	source = http://wiki.qemu.org//download/qemu-2.11.1.tar.xz.sig
+	source = http://wiki.qemu.org//download/qemu-2.12.0.tar.xz
+	source = http://wiki.qemu.org//download/qemu-2.12.0.tar.xz.sig
 	source = qemu-ga.service
 	source = 65-kvm.rules
 	source = allow_elf64.patch
 	source = cpu-pinning.patch
 	source = audio-improvements.patch
-	source = input-mouse-side-buttons.patch
-	source = v2_qemu_zen_smt_cache.patch
-	source = v4_ivshmem.patch
-	sha256sums = 8a5145d1f8bd2eadc6776f3e13c68cd28d01349e30639bdbcb26ac588d668686
+	sha256sums = e69301f361ff65bf5dabd8a19196aeaa5613c1b5ae1678f0823bdf50e7d5c6fc
 	sha256sums = SKIP
 	sha256sums = c39bcde4a09165e64419fd2033b3532378bba84d509d39e2d51694d44c1f8d88
 	sha256sums = a66f0e791b16b03b91049aac61a25950d93e962e1b2ba64a38c6ad7f609b532c
-	sha256sums = 13a6d9e678bdc9e1f051006cfd0555f5a80582368f54c8a1bb5a78ece3832ac4
-	sha256sums = 8d4a7e35ab1a0a465f737cf60fc0392afc430e22354a40a89505f8766a3a3ee8
-	sha256sums = 23338655345d0ee535f34acc124f1ddd75e5ad4483e2bd87294b7ac4fe3fa859
-	sha256sums = 454edfb0abb76b9149454addbfbf95c9d10ac525b4fcf2c23a8c87b04049a2b4
-	sha256sums = adf3f389849e92c5ea4c4cee0abf1ac5df61a176d296e9263ac773194ba86e57
-	sha256sums = 4acbbd8834dc5782feb86795748f37e1b1aa4f61b54303234ea4f13bd4c0e068
+	sha256sums = 59751f1ed26ea61b2a37ebee4be6979e584a450b611282138a0893aa9173e2e4
+	sha256sums = 5c6baf8d171a75c342ffcc5c4259570b3d8d4f34166d7bc1f694ecf571662f2d
+	sha256sums = f54184f2eedf6e3eb1bf66f8f853df5e18cf62cad072fa4937744524d11a3f2b
 
 pkgname = qemu-patched
 	optdepends = qemu-patched-arch-extra: extra architectures support
diff --git a/PKGBUILD b/PKGBUILD
index 93648ca74c9a..df9d7964e607 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -7,7 +7,7 @@ pkgname=(qemu-patched qemu-patched-headless qemu-patched-arch-extra qemu-patched
          qemu-patched-block-{iscsi,rbd,gluster} qemu-patched-guest-agent)
 _pkgname=qemu
 pkgdesc="A generic and open source machine emulator and virtualizer - Patched for extra functionality"
-pkgver=2.11.1
+pkgver=2.12.0
 pkgrel=1
 arch=(x86_64)
 license=(GPL2 LGPL2.1)
@@ -21,20 +21,14 @@ source=("$url/download/${_pkgname}-${pkgver}.tar.xz"{,.sig}
         65-kvm.rules
         allow_elf64.patch
         cpu-pinning.patch
-        audio-improvements.patch
-        input-mouse-side-buttons.patch
-        v2_qemu_zen_smt_cache.patch
-        v4_ivshmem.patch)
-sha256sums=('8a5145d1f8bd2eadc6776f3e13c68cd28d01349e30639bdbcb26ac588d668686'
+        audio-improvements.patch)
+sha256sums=('e69301f361ff65bf5dabd8a19196aeaa5613c1b5ae1678f0823bdf50e7d5c6fc'
             'SKIP'
             'c39bcde4a09165e64419fd2033b3532378bba84d509d39e2d51694d44c1f8d88'
             'a66f0e791b16b03b91049aac61a25950d93e962e1b2ba64a38c6ad7f609b532c'
-            '13a6d9e678bdc9e1f051006cfd0555f5a80582368f54c8a1bb5a78ece3832ac4'
-            '8d4a7e35ab1a0a465f737cf60fc0392afc430e22354a40a89505f8766a3a3ee8'
-            '23338655345d0ee535f34acc124f1ddd75e5ad4483e2bd87294b7ac4fe3fa859'
-            '454edfb0abb76b9149454addbfbf95c9d10ac525b4fcf2c23a8c87b04049a2b4'
-            'adf3f389849e92c5ea4c4cee0abf1ac5df61a176d296e9263ac773194ba86e57'
-            '4acbbd8834dc5782feb86795748f37e1b1aa4f61b54303234ea4f13bd4c0e068')
+            '59751f1ed26ea61b2a37ebee4be6979e584a450b611282138a0893aa9173e2e4'
+            '5c6baf8d171a75c342ffcc5c4259570b3d8d4f34166d7bc1f694ecf571662f2d'
+            'f54184f2eedf6e3eb1bf66f8f853df5e18cf62cad072fa4937744524d11a3f2b')
 validpgpkeys=('CEACC9E15534EBABB82D3FA03353C9CEF108B584')
 
 case $CARCH in
@@ -51,10 +45,7 @@ prepare() {
 
   patch -p1 < ../allow_elf64.patch
   patch -p1 < ../cpu-pinning.patch
-  patch -p0 < ../audio-improvements.patch
-  patch -p1 < ../input-mouse-side-buttons.patch
-  patch -p1 < ../v2_qemu_zen_smt_cache.patch
-  patch -p1 < ../v4_ivshmem.patch
+  patch -p1 < ../audio-improvements.patch
 }
 
 build() {
diff --git a/allow_elf64.patch b/allow_elf64.patch
index 07f27a038b1b..0c5f6917c6ba 100644
--- a/allow_elf64.patch
+++ b/allow_elf64.patch
@@ -1,24 +1,22 @@
-commit 3c72765ec760a51f0e879dc792be82c93141e318
+commit cb61bc8a42da1a971079767e63df4503b6ab2efb
 Author: Anatol Pomozov <anatol.pomozov@gmail.com>
-Date:   Tue Jun 6 20:07:03 2017 -0700
+Date:   Mon Jan 29 10:08:53 2018 -0800
 
-    Remove restriction that prevents bootimg elf64 images
+    multiboot: Make elf64 loading functionality compatible with GRUB
     
-    It is possible to create a 64 bit elf image that has valid multiboot header.
-    qemu should be able to boot such images.
-    
-    Signed-off-by: Anatol Pomozov <anatol.pomozov@gmail.com>
+    GRUB is a reference multiboot implementation and supports loading elf64
+    binaries. Make QEMU to work similar was as GRUB.
 
 diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
-index 663f35a658..cf1b4f5fb3 100644
+index 5bc0a2cddb..0907e42a39 100644
 --- a/hw/i386/multiboot.c
 +++ b/hw/i386/multiboot.c
-@@ -192,11 +192,6 @@ int load_multiboot(FWCfgState *fw_cfg,
+@@ -193,11 +193,6 @@ int load_multiboot(FWCfgState *fw_cfg,
          int kernel_size;
          fclose(f);
  
 -        if (((struct elf64_hdr*)header)->e_machine == EM_X86_64) {
--            fprintf(stderr, "Cannot load x86-64 image, give a 32bit one.\n");
+-            error_report("Cannot load x86-64 image, give a 32bit one.");
 -            exit(1);
 -        }
 -
diff --git a/audio-improvements.patch b/audio-improvements.patch
index 47ae53e8d7b1..c00ab868897e 100644..100755
--- a/audio-improvements.patch
+++ b/audio-improvements.patch
@@ -1,7 +1,7 @@
-diff --git audio/audio.c audio/audio.c
-index beafed209b..6f42a019b0 100644
---- audio/audio.c
-+++ audio/audio.c
+diff --git a/audio/audio.c b/audio/audio.c
+index 7658d2af667..67585fc1a43 100644
+--- a/audio/audio.c
++++ b/audio/audio.c
 @@ -2066,3 +2066,8 @@ void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol)
          }
      }
@@ -11,10 +11,10 @@ index beafed209b..6f42a019b0 100644
 +{
 +    return conf.period.ticks;
 +}
-diff --git audio/audio_int.h audio/audio_int.h
-index 5bcb1c60e1..2f7fc4f8ac 100644
---- audio/audio_int.h
-+++ audio/audio_int.h
+diff --git a/audio/audio_int.h b/audio/audio_int.h
+index 5b25da0a373..dee9e22e4ec 100644
+--- a/audio/audio_int.h
++++ b/audio/audio_int.h
 @@ -214,6 +214,8 @@ extern struct audio_driver pa_audio_driver;
  extern struct audio_driver spice_audio_driver;
  extern const struct mixeng_volume nominal_volume;
@@ -24,10 +24,10 @@ index 5bcb1c60e1..2f7fc4f8ac 100644
  void audio_pcm_init_info (struct audio_pcm_info *info, struct audsettings *as);
  void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len);
  
-diff --git audio/paaudio.c audio/paaudio.c
-index 65beb6f010..b46beeea92 100644
---- audio/paaudio.c
-+++ audio/paaudio.c
+diff --git a/audio/paaudio.c b/audio/paaudio.c
+index aa0a7477d3b..e175018f3cc 100644
+--- a/audio/paaudio.c
++++ b/audio/paaudio.c
 @@ -1,16 +1,22 @@
  /* public domain */
  #include "qemu/osdep.h"
@@ -89,7 +89,7 @@ index 65beb6f010..b46beeea92 100644
  static void qpa_audio_fini(void *opaque);
 @@ -109,182 +105,59 @@ static inline int PA_STREAM_IS_GOOD(pa_stream_state_t x)
          }                                                               \
-     } while (0);
+     } while (0)
  
 -static int qpa_simple_read (PAVoiceIn *p, void *data, size_t length, int *rerror)
 -{
@@ -189,7 +189,7 @@ index 65beb6f010..b46beeea92 100644
 -    PAVoiceOut *pa = arg;
 -    HWVoiceOut *hw = &pa->hw;
 -
--    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
+-    if (audio_pt_lock(&pa->pt, __func__)) {
 -        return NULL;
 -    }
 +    PAVoiceOut *pa = (PAVoiceOut *) hw;
@@ -218,7 +218,7 @@ index 65beb6f010..b46beeea92 100644
 -            }
 +    avail_bytes = (size_t) live << hw->info.shift;
  
--            if (audio_pt_wait (&pa->pt, AUDIO_FUNC)) {
+-            if (audio_pt_wait(&pa->pt, __func__)) {
 -                goto exit;
 -            }
 -        }
@@ -233,7 +233,7 @@ index 65beb6f010..b46beeea92 100644
 +        size_t b_wanted = (size_t) convert_samples << hw->info.shift;
 +        size_t b_effective = b_wanted;
  
--        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
+-        if (audio_pt_unlock(&pa->pt, __func__)) {
 -            return NULL;
 -        }
 +        r = pa_stream_begin_write(pa->stream, &pa_dst, &b_effective);
@@ -262,7 +262,7 @@ index 65beb6f010..b46beeea92 100644
 -            to_mix -= chunk;
 -        }
 -
--        if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
+-        if (audio_pt_lock(&pa->pt, __func__)) {
 -            return NULL;
 -        }
 -
@@ -275,7 +275,7 @@ index 65beb6f010..b46beeea92 100644
      }
  
 - exit:
--    audio_pt_unlock (&pa->pt, AUDIO_FUNC);
+-    audio_pt_unlock(&pa->pt, __func__);
 -    return NULL;
 -}
 -
@@ -284,7 +284,7 @@ index 65beb6f010..b46beeea92 100644
 -    int decr;
 -    PAVoiceOut *pa = (PAVoiceOut *) hw;
 -
--    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
+-    if (audio_pt_lock(&pa->pt, __func__)) {
 -        return 0;
 -    }
 +    bail:
@@ -295,10 +295,10 @@ index 65beb6f010..b46beeea92 100644
 -    pa->live = live - decr;
 -    hw->rpos = pa->rpos;
 -    if (pa->live > 0) {
--        audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
+-        audio_pt_unlock_and_signal(&pa->pt, __func__);
 -    }
 -    else {
--        audio_pt_unlock (&pa->pt, AUDIO_FUNC);
+-        audio_pt_unlock(&pa->pt, __func__);
 -    }
 +    hw->rpos = rpos;
      return decr;
@@ -329,7 +329,7 @@ index 65beb6f010..b46beeea92 100644
 +    incr = 0;
 +    wpos = hw->wpos;
  
--    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
+-    if (audio_pt_lock(&pa->pt, __func__)) {
 -        return NULL;
 -    }
 +    pa_threaded_mainloop_lock(pa->g->mainloop);
@@ -354,7 +354,7 @@ index 65beb6f010..b46beeea92 100644
 -            }
 +    size_t bytes_avail = pa_stream_readable_size(pa->stream);
  
--            if (audio_pt_wait (&pa->pt, AUDIO_FUNC)) {
+-            if (audio_pt_wait(&pa->pt, __func__)) {
 -                goto exit;
 -            }
 -        }
@@ -368,7 +368,7 @@ index 65beb6f010..b46beeea92 100644
 +        r = pa_stream_peek(pa->stream, (const void **)&pa_src, &pa_avail);
 +        CHECK_SUCCESS_GOTO(pa->g, rerror, r == 0, fail);
  
--        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
+-        if (audio_pt_unlock(&pa->pt, __func__)) {
 -            return NULL;
 +        if (pa_avail == 0 || pa_avail > bytes_wanted) {
 +            break;
@@ -395,7 +395,7 @@ index 65beb6f010..b46beeea92 100644
 -            to_grab -= chunk;
 -        }
 -
--        if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
+-        if (audio_pt_lock(&pa->pt, __func__)) {
 -            return NULL;
 +            pa_src += chunk << hw->info.shift;
 +            pa_avail -= chunk << hw->info.shift;
@@ -410,7 +410,7 @@ index 65beb6f010..b46beeea92 100644
      }
  
 - exit:
--    audio_pt_unlock (&pa->pt, AUDIO_FUNC);
+-    audio_pt_unlock(&pa->pt, __func__);
 -    return NULL;
 -}
 -
@@ -419,7 +419,7 @@ index 65beb6f010..b46beeea92 100644
 -    int live, incr, dead;
 -    PAVoiceIn *pa = (PAVoiceIn *) hw;
 -
--    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
+-    if (audio_pt_lock(&pa->pt, __func__)) {
 -        return 0;
 -    }
 +bail:
@@ -432,10 +432,10 @@ index 65beb6f010..b46beeea92 100644
 -    pa->dead = dead - incr;
 -    hw->wpos = pa->wpos;
 -    if (pa->dead > 0) {
--        audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
+-        audio_pt_unlock_and_signal(&pa->pt, __func__);
 -    }
 -    else {
--        audio_pt_unlock (&pa->pt, AUDIO_FUNC);
+-        audio_pt_unlock(&pa->pt, __func__);
 -    }
 +    hw->wpos = wpos;
      return incr;
@@ -584,7 +584,7 @@ index 65beb6f010..b46beeea92 100644
  
 -    audio_pcm_init_info (&hw->info, &obt_as);
 -    hw->samples = g->conf.samples;
--    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
+-    pa->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
 -    pa->rpos = hw->rpos;
 -    if (!pa->pcm_buf) {
 -        dolog ("Could not allocate buffer (%d bytes)\n",
@@ -592,7 +592,7 @@ index 65beb6f010..b46beeea92 100644
 -        goto fail2;
 -    }
 -
--    if (audio_pt_init (&pa->pt, qpa_thread_out, hw, AUDIO_CAP, AUDIO_FUNC)) {
+-    if (audio_pt_init(&pa->pt, qpa_thread_out, hw, AUDIO_CAP, __func__)) {
 -        goto fail3;
 -    }
 +    audio_pcm_init_info(&hw->info, &obt_as);
@@ -698,7 +698,7 @@ index 65beb6f010..b46beeea92 100644
  
 -    audio_pcm_init_info (&hw->info, &obt_as);
 -    hw->samples = g->conf.samples;
--    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
+-    pa->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
 -    pa->wpos = hw->wpos;
 -    if (!pa->pcm_buf) {
 -        dolog ("Could not allocate buffer (%d bytes)\n",
@@ -706,7 +706,7 @@ index 65beb6f010..b46beeea92 100644
 -        goto fail2;
 -    }
 -
--    if (audio_pt_init (&pa->pt, qpa_thread_in, hw, AUDIO_CAP, AUDIO_FUNC)) {
+-    if (audio_pt_init(&pa->pt, qpa_thread_in, hw, AUDIO_CAP, __func__)) {
 -        goto fail3;
 -    }
 +    audio_pcm_init_info(&hw->info, &obt_as);
@@ -732,17 +732,17 @@ index 65beb6f010..b46beeea92 100644
 -    void *ret;
      PAVoiceOut *pa = (PAVoiceOut *) hw;
  
--    audio_pt_lock (&pa->pt, AUDIO_FUNC);
+-    audio_pt_lock(&pa->pt, __func__);
 -    pa->done = 1;
--    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
--    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);
+-    audio_pt_unlock_and_signal(&pa->pt, __func__);
+-    audio_pt_join(&pa->pt, &ret, __func__);
 -
      if (pa->stream) {
          pa_stream_unref (pa->stream);
          pa->stream = NULL;
      }
 -
--    audio_pt_fini (&pa->pt, AUDIO_FUNC);
+-    audio_pt_fini(&pa->pt, __func__);
 -    g_free (pa->pcm_buf);
 -    pa->pcm_buf = NULL;
  }
@@ -752,17 +752,17 @@ index 65beb6f010..b46beeea92 100644
 -    void *ret;
      PAVoiceIn *pa = (PAVoiceIn *) hw;
  
--    audio_pt_lock (&pa->pt, AUDIO_FUNC);
+-    audio_pt_lock(&pa->pt, __func__);
 -    pa->done = 1;
--    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
--    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);
+-    audio_pt_unlock_and_signal(&pa->pt, __func__);
+-    audio_pt_join(&pa->pt, &ret, __func__);
 -
      if (pa->stream) {
          pa_stream_unref (pa->stream);
          pa->stream = NULL;
      }
 -
--    audio_pt_fini (&pa->pt, AUDIO_FUNC);
+-    audio_pt_fini(&pa->pt, __func__);
 -    g_free (pa->pcm_buf);
 -    pa->pcm_buf = NULL;
  }
@@ -828,10 +828,10 @@ index 65beb6f010..b46beeea92 100644
      },
      {
          .name  = "SERVER",
-diff --git hw/audio/hda-codec.c hw/audio/hda-codec.c
-index 5402cd196c..ab89158bfc 100644
---- hw/audio/hda-codec.c
-+++ hw/audio/hda-codec.c
+diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
+index e8aa7842e67..e68830490f3 100644
+--- a/hw/audio/hda-codec.c
++++ b/hw/audio/hda-codec.c
 @@ -18,6 +18,7 @@
   */
  
@@ -1105,10 +1105,10 @@ index 5402cd196c..ab89158bfc 100644
          VMSTATE_END_OF_LIST()
      }
  };
-diff --git hw/audio/intel-hda.c hw/audio/intel-hda.c
-index 18a50a8f83..721eba792d 100644
---- hw/audio/intel-hda.c
-+++ hw/audio/intel-hda.c
+diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
+index 948268afd81..23a2cf6484c 100644
+--- a/hw/audio/intel-hda.c
++++ b/hw/audio/intel-hda.c
 @@ -407,13 +407,6 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
      if (st->bpl == NULL) {
          return false;
diff --git a/cpu-pinning.patch b/cpu-pinning.patch
index 46efee5d88a5..f3c520c1ed54 100644
--- a/cpu-pinning.patch
+++ b/cpu-pinning.patch
@@ -1,4 +1,4 @@
-From e392e5516e6ae66db0f05775a22c0abf39f033f0 Mon Sep 17 00:00:00 2001
+From 420f81563a6ff3e695f7643a1bcbbc332b9f7132 Mon Sep 17 00:00:00 2001
 From: Saverio Miroddi <saverio.pub2@gmail.com>
 Date: Tue, 31 Oct 2017 20:59:05 +0100
 Subject: [PATCH] Current pinning patch
@@ -16,10 +16,10 @@ Changes 2017/10/31:
  3 files changed, 84 insertions(+)
 
 diff --git a/cpus.c b/cpus.c
-index 9bed61eefcc..7437e3a00c7 100644
+index 38eba8bff33..1ff63e0d847 100644
 --- a/cpus.c
 +++ b/cpus.c
-@@ -55,6 +55,9 @@
+@@ -57,6 +57,9 @@
  #ifdef CONFIG_LINUX
  
  #include <sys/prctl.h>
@@ -29,8 +29,8 @@ index 9bed61eefcc..7437e3a00c7 100644
  
  #ifndef PR_MCE_KILL
  #define PR_MCE_KILL 33
-@@ -1722,9 +1725,11 @@ static void qemu_hax_start_vcpu(CPUState *cpu)
-     }
+@@ -1919,9 +1922,11 @@ static void qemu_hax_start_vcpu(CPUState *cpu)
+ #endif
  }
  
 +extern int vcpu_affinity[];
@@ -41,7 +41,7 @@ index 9bed61eefcc..7437e3a00c7 100644
  
      cpu->thread = g_malloc0(sizeof(QemuThread));
      cpu->halt_cond = g_malloc0(sizeof(QemuCond));
-@@ -1733,6 +1738,13 @@ static void qemu_kvm_start_vcpu(CPUState *cpu)
+@@ -1930,6 +1935,13 @@ static void qemu_kvm_start_vcpu(CPUState *cpu)
               cpu->cpu_index);
      qemu_thread_create(cpu->thread, thread_name, qemu_kvm_cpu_thread_fn,
                         cpu, QEMU_THREAD_JOINABLE);
@@ -52,14 +52,14 @@ index 9bed61eefcc..7437e3a00c7 100644
 +      pthread_setaffinity_np((cpu->thread)->thread, sizeof(cpu_set_t), &cpuset);
 +    }
 +
-     while (!cpu->created) {
-         qemu_cond_wait(&qemu_cpu_cond, &qemu_global_mutex);
-     }
+ }
+ 
+ static void qemu_hvf_start_vcpu(CPUState *cpu)
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 9f6e2adfffb..1d38fc86c81 100644
+index ca4e412f2f8..9dd6dcd93cf 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -160,6 +160,16 @@ given, the total number of CPUs @var{n} can be omitted. @var{maxcpus}
+@@ -169,6 +169,16 @@ given, the total number of CPUs @var{n} can be omitted. @var{maxcpus}
  specifies the maximum number of hotpluggable CPUs.
  ETEXI
  
@@ -77,7 +77,7 @@ index 9f6e2adfffb..1d38fc86c81 100644
      "-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node]\n"
      "-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node]\n"
 diff --git a/vl.c b/vl.c
-index d63269332fe..754a03c9a5f 100644
+index fce1fd12d8b..4e6110c5a71 100644
 --- a/vl.c
 +++ b/vl.c
 @@ -135,6 +135,7 @@ int main(int argc, char **argv)
@@ -88,8 +88,8 @@ index d63269332fe..754a03c9a5f 100644
  static const char *data_dir[16];
  static int data_dir_idx;
  const char *bios_name = NULL;
-@@ -167,6 +168,8 @@ int smp_cpus = 1;
- int max_cpus = 1;
+@@ -164,6 +165,8 @@ int smp_cpus;
+ unsigned int max_cpus;
  int smp_cores = 1;
  int smp_threads = 1;
 +int vcpu_affinity[MAX_VCPUS];
@@ -97,7 +97,7 @@ index d63269332fe..754a03c9a5f 100644
  int acpi_enabled = 1;
  int no_hpet = 0;
  int fd_bootchk = 1;
-@@ -1212,6 +1215,57 @@ static QemuOptsList qemu_smp_opts = {
+@@ -1290,6 +1293,57 @@ static QemuOptsList qemu_smp_opts = {
      },
  };
  
@@ -155,7 +155,7 @@ index d63269332fe..754a03c9a5f 100644
  static void smp_parse(QemuOpts *opts)
  {
      if (opts) {
-@@ -3067,6 +3121,7 @@ int main(int argc, char **argv, char **envp)
+@@ -3092,6 +3146,7 @@ int main(int argc, char **argv, char **envp)
      qemu_add_opts(&qemu_accel_opts);
      qemu_add_opts(&qemu_mem_opts);
      qemu_add_opts(&qemu_smp_opts);
@@ -163,7 +163,7 @@ index d63269332fe..754a03c9a5f 100644
      qemu_add_opts(&qemu_boot_opts);
      qemu_add_opts(&qemu_sandbox_opts);
      qemu_add_opts(&qemu_add_fd_opts);
-@@ -3818,6 +3873,12 @@ int main(int argc, char **argv, char **envp)
+@@ -3771,6 +3826,12 @@ int main(int argc, char **argv, char **envp)
                      exit(1);
                  }
                  break;
@@ -176,7 +176,7 @@ index d63269332fe..754a03c9a5f 100644
              case QEMU_OPTION_vnc:
                  vnc_parse(optarg, &error_fatal);
                  break;
-@@ -4243,6 +4304,7 @@ int main(int argc, char **argv, char **envp)
+@@ -4211,6 +4272,7 @@ int main(int argc, char **argv, char **envp)
          exit(1);
      }
  
diff --git a/input-mouse-side-buttons.patch b/input-mouse-side-buttons.patch
deleted file mode 100644
index 5a04f35341eb..000000000000
--- a/input-mouse-side-buttons.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 2416760fa6728813e1446736e9be55e07b5030b0 Mon Sep 17 00:00:00 2001
-From: Miika S <miika9764@gmail.com>
-Date: Fri, 22 Dec 2017 17:25:30 +0200
-Subject: [PATCH] input: add mouse side buttons to virtio input
-
-Signed-off-by: Miika S <miika9764@gmail.com>
-Message-Id: <20171222152531.1849-3-miika9764@gmail.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/input/virtio-input-hid.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/input/virtio-input-hid.c b/hw/input/virtio-input-hid.c
-index e78faec..a5917c2 100644
---- a/hw/input/virtio-input-hid.c
-+++ b/hw/input/virtio-input-hid.c
-@@ -147,6 +147,8 @@ static const unsigned int keymap_button[INPUT_BUTTON__MAX] = {
-     [INPUT_BUTTON_MIDDLE]            = BTN_MIDDLE,
-     [INPUT_BUTTON_WHEEL_UP]          = BTN_GEAR_UP,
-     [INPUT_BUTTON_WHEEL_DOWN]        = BTN_GEAR_DOWN,
-+    [INPUT_BUTTON_SIDE]              = BTN_SIDE,
-+    [INPUT_BUTTON_EXTRA]             = BTN_EXTRA,
- };
- 
- static const unsigned int axismap_rel[INPUT_AXIS__MAX] = {
--- 
-1.8.3.1
-
diff --git a/v2_qemu_zen_smt_cache.patch b/v2_qemu_zen_smt_cache.patch
deleted file mode 100644
index e5d0a6e7652c..000000000000
--- a/v2_qemu_zen_smt_cache.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index ddc45abd70..ebf27ba7e9 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -113,7 +113,9 @@
- /* L1 instruction cache: */
- #define L1I_LINE_SIZE         64
- #define L1I_ASSOCIATIVITY      8
-+#define L1I_ASSOC_AMD_ZEN      4
- #define L1I_SETS              64
-+#define L1I_SETS_AMD_ZEN     256
- #define L1I_PARTITIONS         1
- /* Size = LINE_SIZE*ASSOCIATIVITY*SETS*PARTITIONS = 32KiB */
- #define L1I_DESCRIPTOR CPUID_2_L1I_32KB_8WAY_64B
-@@ -125,7 +127,9 @@
- /* Level 2 unified cache: */
- #define L2_LINE_SIZE          64
- #define L2_ASSOCIATIVITY      16
-+#define L2_ASSOC_AMD_ZEN       8
- #define L2_SETS             4096
-+#define L2_SETS_AMD_ZEN     1024
- #define L2_PARTITIONS          1
- /* Size = LINE_SIZE*ASSOCIATIVITY*SETS*PARTITIONS = 4MiB */
- /*FIXME: CPUID leaf 2 descriptor is inconsistent with CPUID leaf 4 */
-@@ -142,6 +146,7 @@
- #define L3_N_LINE_SIZE         64
- #define L3_N_ASSOCIATIVITY     16
- #define L3_N_SETS           16384
-+#define L3_N_SETS_AMD_ZEN    4096
- #define L3_N_PARTITIONS         1
- #define L3_N_DESCRIPTOR CPUID_2_L3_16MB_16WAY_64B
- #define L3_N_LINES_PER_TAG      1
-@@ -3072,6 +3077,91 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-             *edx = 0;
-         }
-         break;
-+    case 0x8000001D: /* AMD TOPOEXT cache info for ZEN */
-+        if (cpu->cache_info_passthrough) {
-+            host_cpuid(index, count, eax, ebx, ecx, edx);
-+            break;
-+        } else if ((env->cpuid_version & 0xFF00F00) == 0x800F00) {
-+            *eax = 0;
-+            switch (count) {
-+            case 0: /* L1 dcache info */
-+                *eax |= CPUID_4_TYPE_DCACHE | \
-+                        CPUID_4_LEVEL(1) | \
-+                        CPUID_4_SELF_INIT_LEVEL | \
-+                        ((cs->nr_threads - 1) << 14);
-+                *ebx = (L1D_LINE_SIZE - 1) | \
-+                       ((L1D_PARTITIONS - 1) << 12) | \
-+                       ((L1D_ASSOCIATIVITY - 1) << 22);
-+                *ecx = L1D_SETS - 1;
-+                *edx = 0;
-+                break;
-+            case 1: /* L1 icache info */
-+                *eax |= CPUID_4_TYPE_ICACHE | \
-+                        CPUID_4_LEVEL(1) | \
-+                        CPUID_4_SELF_INIT_LEVEL | \
-+                        ((cs->nr_threads - 1) << 14);
-+                *ebx = (L1I_LINE_SIZE - 1) | \
-+                       ((L1I_PARTITIONS - 1) << 12) | \
-+                       ((L1I_ASSOC_AMD_ZEN - 1) << 22);
-+                *ecx = L1I_SETS_AMD_ZEN - 1;
-+                *edx = 0;
-+                break;
-+            case 2: /* L2 cache info */
-+                *eax |= CPUID_4_TYPE_UNIFIED | \
-+                        CPUID_4_LEVEL(2) | \
-+                        CPUID_4_SELF_INIT_LEVEL | \
-+                        ((cs->nr_threads - 1) << 14);
-+                *ebx = (L2_LINE_SIZE - 1) | \
-+                       ((L2_PARTITIONS - 1) << 12) | \
-+                       ((L2_ASSOC_AMD_ZEN - 1) << 22);
-+                *ecx = L2_SETS_AMD_ZEN - 1;
-+                *edx = CPUID_4_INCLUSIVE;
-+                break;
-+            case 3: /* L3 cache info */
-+                if (!cpu->enable_l3_cache) {
-+                    *eax = 0;
-+                    *ebx = 0;
-+                    *ecx = 0;
-+                    *edx = 0;
-+                    break;
-+                }
-+                *eax |= CPUID_4_TYPE_UNIFIED | \
-+                        CPUID_4_LEVEL(3) | \
-+                        CPUID_4_SELF_INIT_LEVEL | \
-+                        ((cs->nr_cores * cs->nr_threads - 1) << 14);
-+                *ebx = (L3_N_LINE_SIZE - 1) | \
-+                       ((L3_N_PARTITIONS - 1) << 12) | \
-+                       ((L3_N_ASSOCIATIVITY - 1) << 22);
-+                *ecx = L3_N_SETS_AMD_ZEN - 1;
-+                *edx = CPUID_4_NO_INVD_SHARING;
-+                break;
-+            default: /* end of info */
-+                *eax = 0;
-+                *ebx = 0;
-+                *ecx = 0;
-+                *edx = 0;
-+                break;
-+            }
-+        } else {
-+            *eax = 0;
-+            *ebx = 0;
-+            *ecx = 0;
-+            *edx = 0;
-+        }
-+        break;
-+    case 0x8000001E: /* AMD TOPOEXT cpu topology info for ZEN */
-+        if ((env->cpuid_version & 0xFF00F00) == 0x800F00) {
-+            *eax = cpu->apic_id;
-+            *ebx = (cs->nr_threads - 1) << 8 | cpu->core_id;
-+            *ecx = cpu->socket_id;
-+            *edx = 0;
-+        } else {
-+            *eax = 0;
-+            *ebx = 0;
-+            *ecx = 0;
-+            *edx = 0;
-+        }
-+        break;
-     case 0xC0000000:
-         *eax = env->cpuid_xlevel2;
-         *ebx = 0;
-@@ -3742,7 +3832,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
-      * NOTE: the following code has to follow qemu_init_vcpu(). Otherwise
-      * cs->nr_threads hasn't be populated yet and the checking is incorrect.
-      */
--    if (!IS_INTEL_CPU(env) && cs->nr_threads > 1 && !ht_warned) {
-+    if (!IS_INTEL_CPU(env) && cs->nr_threads > 1 && !ht_warned && (env->cpuid_version & 0xFF00F00) != 0x800F00) {
-         error_report("AMD CPU doesn't support hyperthreading. Please configure"
-                      " -smp options properly.");
-         ht_warned = true;
-diff --git a/target/i386/kvm.c b/target/i386/kvm.c
-index 6db7783edc..d6b4e1ae74 100644
---- a/target/i386/kvm.c
-+++ b/target/i386/kvm.c
-@@ -869,9 +869,31 @@ int kvm_arch_init_vcpu(CPUState *cs)
-         }
-         c = &cpuid_data.entries[cpuid_i++];
- 
--        c->function = i;
--        c->flags = 0;
--        cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
-+        switch (i) {
-+        case 0x8000001d:
-+            for (j = 0; ; j++) {
-+                c->function = i;
-+                c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
-+                c->index = j;
-+                cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
-+
-+                if (c->eax == 0) {
-+                    break;
-+                }
-+                if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
-+                    fprintf(stderr, "cpuid_data is full, no space for "
-+                            "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
-+                    abort();
-+                }
-+                c = &cpuid_data.entries[cpuid_i++];
-+            }
-+            break;
-+        default:
-+            c->function = i;
-+            c->flags = 0;
-+            cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
-+            break;
-+        }
-     }
- 
-     /* Call Centaur's CPUID instructions they are supported. */
diff --git a/v4_ivshmem.patch b/v4_ivshmem.patch
deleted file mode 100644
index 65065b6807a2..000000000000
--- a/v4_ivshmem.patch
+++ /dev/null
@@ -1,331 +0,0 @@
-As of commit 660c97eef6f8 ("ivshmem: use kvm irqfd for msi notifications"),
-QEMU crashes with:
-
-  kvm_irqchip_commit_routes: Assertion `ret == 0' failed.
-
-if the ivshmem device is configured with more vectors than what the server
-supports. This is caused by the ivshmem_vector_unmask() being called on
-vectors that have not been initialized by ivshmem_add_kvm_msi_virq().
-
-This commit fixes it by adding a simple check to the mask and unmask
-callbacks.
-
-Note that the opposite mismatch, if the server supplies more vectors than
-what the device is configured for, is already handled and leads to output
-like:
-
-  Too many eventfd received, device has 1 vectors
-
-To reproduce the assert, run:
-
-  ivshmem-server -n 0
-
-and QEMU with:
-
-  -device ivshmem-doorbell,chardev=iv
-  -chardev socket,path=/tmp/ivshmem_socket,id=iv
-
-then load the Windows driver, at the time of writing available at:
-
-https://github.com/virtio-win/kvm-guest-drivers-windows/tree/master/ivshmem
-
-The issue is believed to have been masked by other guest drivers, notably
-Linux ones, not enabling MSI-X on the device.
-
-Fixes: 660c97eef6f8 ("ivshmem: use kvm irqfd for msi notifications")
-Signed-off-by: Ladi Prosek <address@hidden>
-Reviewed-by: Marc-André Lureau <address@hidden>
-Reviewed-by: Markus Armbruster <address@hidden>
----
- hw/misc/ivshmem.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
-index a5a46827fe..6e46669744 100644
---- a/hw/misc/ivshmem.c
-+++ b/hw/misc/ivshmem.c
-@@ -317,6 +317,10 @@ static int ivshmem_vector_unmask(PCIDevice *dev, unsigned vector,
-     int ret;
- 
-     IVSHMEM_DPRINTF("vector unmask %p %d\n", dev, vector);
-+    if (!v->pdev) {
-+        error_report("ivshmem: vector %d route does not exist", vector);
-+        return -EINVAL;
-+    }
- 
-     ret = kvm_irqchip_update_msi_route(kvm_state, v->virq, msg, dev);
-     if (ret < 0) {
-@@ -331,12 +335,16 @@ static void ivshmem_vector_mask(PCIDevice *dev, unsigned vector)
- {
-     IVShmemState *s = IVSHMEM_COMMON(dev);
-     EventNotifier *n = &s->peers[s->vm_id].eventfds[vector];
-+    MSIVector *v = &s->msi_vectors[vector];
-     int ret;
- 
-     IVSHMEM_DPRINTF("vector mask %p %d\n", dev, vector);
-+    if (!v->pdev) {
-+        error_report("ivshmem: vector %d route does not exist", vector);
-+        return;
-+    }
- 
--    ret = kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, n,
--                                                s->msi_vectors[vector].virq);
-+    ret = kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, n, v->virq);
-     if (ret != 0) {
-         error_report("remove_irqfd_notifier_gsi failed");
-     }
--- 
-2.13.6
-As of commit 660c97eef6f8 ("ivshmem: use kvm irqfd for msi notifications"),
-QEMU crashes with:
-
-ivshmem: msix_set_vector_notifiers failed
-msix_unset_vector_notifiers: Assertion `dev->msix_vector_use_notifier && 
-dev->msix_vector_release_notifier' failed.
-
-if MSI-X is repeatedly enabled and disabled on the ivshmem device, for example
-by loading and unloading the Windows ivshmem driver. This is because
-msix_unset_vector_notifiers() doesn't call any of the release notifier callbacks
-since MSI-X is already disabled at that point (msix_enabled() returning false
-is how this transition is detected in the first place). Thus 
-ivshmem_vector_mask()
-doesn't run and when MSI-X is subsequently enabled again ivshmem_vector_unmask()
-fails.
-
-This is fixed by keeping track of unmasked vectors and making sure that
-ivshmem_vector_mask() always runs on MSI-X disable.
-
-Fixes: 660c97eef6f8 ("ivshmem: use kvm irqfd for msi notifications")
-Signed-off-by: Ladi Prosek <address@hidden>
-Reviewed-by: Markus Armbruster <address@hidden>
----
- hw/misc/ivshmem.c | 32 ++++++++++++++++++++++++++------
- 1 file changed, 26 insertions(+), 6 deletions(-)
-
-diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
-index 6e46669744..91364d8364 100644
---- a/hw/misc/ivshmem.c
-+++ b/hw/misc/ivshmem.c
-@@ -77,6 +77,7 @@ typedef struct Peer {
- typedef struct MSIVector {
-     PCIDevice *pdev;
-     int virq;
-+    bool unmasked;
- } MSIVector;
- 
- typedef struct IVShmemState {
-@@ -321,6 +322,7 @@ static int ivshmem_vector_unmask(PCIDevice *dev, unsigned vector,
-         error_report("ivshmem: vector %d route does not exist", vector);
-         return -EINVAL;
-     }
-+    assert(!v->unmasked);
- 
-     ret = kvm_irqchip_update_msi_route(kvm_state, v->virq, msg, dev);
-     if (ret < 0) {
-@@ -328,7 +330,13 @@ static int ivshmem_vector_unmask(PCIDevice *dev, unsigned vector,
-     }
-     kvm_irqchip_commit_routes(kvm_state);
- 
--    return kvm_irqchip_add_irqfd_notifier_gsi(kvm_state, n, NULL, v->virq);
-+    ret = kvm_irqchip_add_irqfd_notifier_gsi(kvm_state, n, NULL, v->virq);
-+    if (ret < 0) {
-+        return ret;
-+    }
-+    v->unmasked = true;
-+
-+    return 0;
- }
- 
- static void ivshmem_vector_mask(PCIDevice *dev, unsigned vector)
-@@ -343,11 +351,14 @@ static void ivshmem_vector_mask(PCIDevice *dev, unsigned vector)
-         error_report("ivshmem: vector %d route does not exist", vector);
-         return;
-     }
-+    assert(v->unmasked);
- 
-     ret = kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, n, v->virq);
--    if (ret != 0) {
-+    if (ret < 0) {
-         error_report("remove_irqfd_notifier_gsi failed");
-+        return;
-     }
-+    v->unmasked = false;
- }
- 
- static void ivshmem_vector_poll(PCIDevice *dev,
-@@ -817,11 +828,20 @@ static void ivshmem_disable_irqfd(IVShmemState *s)
-     PCIDevice *pdev = PCI_DEVICE(s);
-     int i;
- 
--    for (i = 0; i < s->peers[s->vm_id].nb_eventfds; i++) {
--        ivshmem_remove_kvm_msi_virq(s, i);
--    }
--
-     msix_unset_vector_notifiers(pdev);
-+
-+    for (i = 0; i < s->peers[s->vm_id].nb_eventfds; i++) {
-+        /*
-+         * MSI-X is already disabled here so msix_unset_vector_notifiers()
-+         * didn't call our release notifier.  Do it now to keep our masks and
-+         * unmasks balanced.
-+         */
-+        if (s->msi_vectors[i].unmasked) {
-+            ivshmem_vector_mask(pdev, i);
-+        }
-+        ivshmem_remove_kvm_msi_virq(s, i);
-+    }
-+
- }
- 
- static void ivshmem_write_config(PCIDevice *pdev, uint32_t address,
--- 
-2.13.6
-Adds a rollback path to ivshmem_enable_irqfd() and fixes
-ivshmem_disable_irqfd() to bail if irqfd has not been enabled.
-
-To reproduce, run:
-
-  ivshmem-server -n 0
-
-and QEMU with:
-
-  -device ivshmem-doorbell,chardev=iv
-  -chardev socket,path=/tmp/ivshmem_socket,id=iv
-
-then load, unload, and load again the Windows driver, at the time of writing
-available at:
-
-https://github.com/virtio-win/kvm-guest-drivers-windows/tree/master/ivshmem
-
-The issue is believed to have been masked by other guest drivers, notably
-Linux ones, not enabling MSI-X on the device.
-
-Signed-off-by: Ladi Prosek <address@hidden>
-Reviewed-by: Markus Armbruster <address@hidden>
----
- hw/misc/ivshmem.c | 37 ++++++++++++++++++++++++-------------
- 1 file changed, 24 insertions(+), 13 deletions(-)
-
-diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
-index 91364d8364..d1bb246d12 100644
---- a/hw/misc/ivshmem.c
-+++ b/hw/misc/ivshmem.c
-@@ -786,6 +786,20 @@ static int ivshmem_setup_interrupts(IVShmemState *s, Error **errp)
-     return 0;
- }
- 
-+static void ivshmem_remove_kvm_msi_virq(IVShmemState *s, int vector)
-+{
-+    IVSHMEM_DPRINTF("ivshmem_remove_kvm_msi_virq vector:%d\n", vector);
-+
-+    if (s->msi_vectors[vector].pdev == NULL) {
-+        return;
-+    }
-+
-+    /* it was cleaned when masked in the frontend. */
-+    kvm_irqchip_release_virq(kvm_state, s->msi_vectors[vector].virq);
-+
-+    s->msi_vectors[vector].pdev = NULL;
-+}
-+
- static void ivshmem_enable_irqfd(IVShmemState *s)
- {
-     PCIDevice *pdev = PCI_DEVICE(s);
-@@ -797,7 +811,7 @@ static void ivshmem_enable_irqfd(IVShmemState *s)
-         ivshmem_add_kvm_msi_virq(s, i, &err);
-         if (err) {
-             error_report_err(err);
--            /* TODO do we need to handle the error? */
-+            goto undo;
-         }
-     }
- 
-@@ -806,21 +820,14 @@ static void ivshmem_enable_irqfd(IVShmemState *s)
-                                   ivshmem_vector_mask,
-                                   ivshmem_vector_poll)) {
-         error_report("ivshmem: msix_set_vector_notifiers failed");
-+        goto undo;
-     }
--}
-+    return;
- 
--static void ivshmem_remove_kvm_msi_virq(IVShmemState *s, int vector)
--{
--    IVSHMEM_DPRINTF("ivshmem_remove_kvm_msi_virq vector:%d\n", vector);
--
--    if (s->msi_vectors[vector].pdev == NULL) {
--        return;
-+undo:
-+    while (--i >= 0) {
-+        ivshmem_remove_kvm_msi_virq(s, i);
-     }
--
--    /* it was cleaned when masked in the frontend. */
--    kvm_irqchip_release_virq(kvm_state, s->msi_vectors[vector].virq);
--
--    s->msi_vectors[vector].pdev = NULL;
- }
- 
- static void ivshmem_disable_irqfd(IVShmemState *s)
-@@ -828,6 +835,10 @@ static void ivshmem_disable_irqfd(IVShmemState *s)
-     PCIDevice *pdev = PCI_DEVICE(s);
-     int i;
- 
-+    if (!pdev->msix_vector_use_notifier) {
-+        return;
-+    }
-+
-     msix_unset_vector_notifiers(pdev);
- 
-     for (i = 0; i < s->peers[s->vm_id].nb_eventfds; i++) {
--- 
-2.13.6
-The effects of ivshmem_enable_irqfd() was not undone on device reset.
-
-This manifested as:
-ivshmem_add_kvm_msi_virq: Assertion `!s->msi_vectors[vector].pdev' failed.
-
-when irqfd was enabled before reset and then enabled again after reset, making
-ivshmem_enable_irqfd() run for the second time.
-
-To reproduce, run:
-
-  ivshmem-server
-
-and QEMU with:
-
-  -device ivshmem-doorbell,chardev=iv
-  -chardev socket,path=/tmp/ivshmem_socket,id=iv
-
-then install the Windows driver, at the time of writing available at:
-
-https://github.com/virtio-win/kvm-guest-drivers-windows/tree/master/ivshmem
-
-and crash-reboot the guest by inducing a BSOD.
-
-Signed-off-by: Ladi Prosek <address@hidden>
----
- hw/misc/ivshmem.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
-index d1bb246d12..9c7e74ef12 100644
---- a/hw/misc/ivshmem.c
-+++ b/hw/misc/ivshmem.c
-@@ -758,10 +758,14 @@ static void ivshmem_msix_vector_use(IVShmemState *s)
-     }
- }
- 
-+static void ivshmem_disable_irqfd(IVShmemState *s);
-+
- static void ivshmem_reset(DeviceState *d)
- {
-     IVShmemState *s = IVSHMEM_COMMON(d);
- 
-+    ivshmem_disable_irqfd(s);
-+
-     s->intrstatus = 0;
-     s->intrmask = 0;
-     if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
--- 
-2.13.6