summary refs log tree commit diff stats
diff options
context:
space:
mode:
-rw-r--r--MAINTAINERS6
-rw-r--r--default-configs/devices/mips-softmmu-common.mak1
-rw-r--r--docs/system/deprecated.rst12
-rw-r--r--hmp-commands.hx1
-rw-r--r--hw/core/loader-fit.c2
-rw-r--r--hw/intc/loongson_liointc.c4
-rw-r--r--hw/mips/Kconfig13
-rw-r--r--hw/mips/boston.c2
-rw-r--r--hw/mips/cps.c2
-rw-r--r--hw/mips/meson.build1
-rw-r--r--hw/mips/r4k.c318
-rw-r--r--hw/misc/mips_cpc.c2
-rw-r--r--hw/misc/mips_itu.c2
-rw-r--r--hw/pci-host/xilinx-pcie.c2
-rw-r--r--hw/usb/dev-serial.c334
-rw-r--r--hw/usb/trace-events13
-rw-r--r--include/hw/mips/cps.h2
-rw-r--r--include/hw/misc/mips_cpc.h2
-rw-r--r--include/hw/misc/mips_itu.h2
-rw-r--r--include/hw/pci-host/xilinx-pcie.h2
-rw-r--r--monitor/hmp-cmds.c3
-rw-r--r--qapi/ui.json3
-rw-r--r--target/mips/cp0_helper.c2
-rw-r--r--target/mips/dsp_helper.c2
-rw-r--r--target/mips/fpu_helper.c2
-rw-r--r--target/mips/gdbstub.c2
-rw-r--r--target/mips/helper.c2
-rw-r--r--target/mips/lmmi_helper.c2
-rw-r--r--target/mips/mips-semi.c2
-rw-r--r--target/mips/msa_helper.c2
-rw-r--r--target/mips/op_helper.c2
-rw-r--r--target/mips/translate.c6
-rw-r--r--target/mips/translate_init.c.inc2
-rw-r--r--tests/qtest/cdrom-test.c2
-rw-r--r--tests/qtest/endianness-test.c2
-rw-r--r--ui/console.c47
-rw-r--r--ui/trace-events2
-rw-r--r--util/qemu-coroutine-lock.c6
38 files changed, 293 insertions, 521 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index dd16606bcd..63223e1183 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1138,12 +1138,6 @@ S: Orphaned
 F: hw/mips/mipssim.c
 F: hw/net/mipsnet.c
 
-R4000
-R: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>
-S: Obsolete
-F: hw/mips/r4k.c
-
 Fuloong 2E
 M: Huacai Chen <chenhc@lemote.com>
 M: Philippe Mathieu-Daudé <f4bug@amsat.org>
diff --git a/default-configs/devices/mips-softmmu-common.mak b/default-configs/devices/mips-softmmu-common.mak
index da29c6c0b2..ea78fe7275 100644
--- a/default-configs/devices/mips-softmmu-common.mak
+++ b/default-configs/devices/mips-softmmu-common.mak
@@ -33,7 +33,6 @@ CONFIG_MC146818RTC=y
 CONFIG_EMPTY_SLOT=y
 CONFIG_MIPS_CPS=y
 CONFIG_MIPS_ITU=y
-CONFIG_R4K=y
 CONFIG_MALTA=y
 CONFIG_PCNET_PCI=y
 CONFIG_MIPSSIM=y
diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 32a0e620db..8c1dc7645d 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -328,12 +328,6 @@ The 'scsi-disk' device is deprecated. Users should use 'scsi-hd' or
 System emulator machines
 ------------------------
 
-mips ``r4k`` platform (since 5.0)
-'''''''''''''''''''''''''''''''''
-
-This machine type is very old and unmaintained. Users should use the ``malta``
-machine type instead.
-
 mips ``fulong2e`` machine (since 5.1)
 '''''''''''''''''''''''''''''''''''''
 
@@ -576,6 +570,12 @@ The version specific Spike machines have been removed in favour of the
 generic ``spike`` machine. If you need to specify an older version of the RISC-V
 spec you can use the ``-cpu rv64gcsu,priv_spec=v1.10.0`` command line argument.
 
+mips ``r4k`` platform (removed in 5.2)
+''''''''''''''''''''''''''''''''''''''
+
+This machine type was very old and unmaintained. Users should use the ``malta``
+machine type instead.
+
 Related binaries
 ----------------
 
diff --git a/hmp-commands.hx b/hmp-commands.hx
index cd068389de..ff2d7aa8f3 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -254,6 +254,7 @@ ERST
         .help       = "save screen from head 'head' of display device 'device' "
                       "into PPM image 'filename'",
         .cmd        = hmp_screendump,
+        .coroutine  = true,
     },
 
 SRST
diff --git a/hw/core/loader-fit.c b/hw/core/loader-fit.c
index c465921b8f..b7c7b3ba94 100644
--- a/hw/core/loader-fit.c
+++ b/hw/core/loader-fit.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/hw/intc/loongson_liointc.c b/hw/intc/loongson_liointc.c
index 30fb375b72..fbbfb57ee9 100644
--- a/hw/intc/loongson_liointc.c
+++ b/hw/intc/loongson_liointc.c
@@ -130,7 +130,7 @@ liointc_read(void *opaque, hwaddr addr, unsigned int size)
 
     if (addr >= R_PERCORE_ISR(0) &&
         addr < R_PERCORE_ISR(NUM_CORES)) {
-        int core = (addr - R_PERCORE_ISR(0)) / 4;
+        int core = (addr - R_PERCORE_ISR(0)) / 8;
         r = p->per_core_isr[core];
         goto out;
     }
@@ -173,7 +173,7 @@ liointc_write(void *opaque, hwaddr addr,
 
     if (addr >= R_PERCORE_ISR(0) &&
         addr < R_PERCORE_ISR(NUM_CORES)) {
-        int core = (addr - R_PERCORE_ISR(0)) / 4;
+        int core = (addr - R_PERCORE_ISR(0)) / 8;
         p->per_core_isr[core] = value;
         goto out;
     }
diff --git a/hw/mips/Kconfig b/hw/mips/Kconfig
index 67d39c56a4..8be70122f4 100644
--- a/hw/mips/Kconfig
+++ b/hw/mips/Kconfig
@@ -1,16 +1,3 @@
-config R4K
-    bool
-    select ISA_BUS
-    select SERIAL_ISA
-    select I8259
-    select I8254
-    select MC146818RTC
-    imply VGA_ISA
-    imply NE2000_ISA
-    select IDE_ISA
-    select PCKBD
-    select PFLASH_CFI01
-
 config MALTA
     bool
     select ISA_SUPERIO
diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index 74c18edbb3..3356d7a681 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/hw/mips/cps.c b/hw/mips/cps.c
index c624821315..962b1b0b87 100644
--- a/hw/mips/cps.c
+++ b/hw/mips/cps.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/hw/mips/meson.build b/hw/mips/meson.build
index 46294b7382..bcdf96be69 100644
--- a/hw/mips/meson.build
+++ b/hw/mips/meson.build
@@ -6,6 +6,5 @@ mips_ss.add(when: 'CONFIG_MALTA', if_true: files('gt64xxx_pci.c', 'malta.c'))
 mips_ss.add(when: 'CONFIG_MIPSSIM', if_true: files('mipssim.c'))
 mips_ss.add(when: 'CONFIG_MIPS_BOSTON', if_true: [files('boston.c'), fdt])
 mips_ss.add(when: 'CONFIG_MIPS_CPS', if_true: files('cps.c'))
-mips_ss.add(when: 'CONFIG_R4K', if_true: files('r4k.c'))
 
 hw_arch += {'mips': mips_ss}
diff --git a/hw/mips/r4k.c b/hw/mips/r4k.c
deleted file mode 100644
index 3830854342..0000000000
--- a/hw/mips/r4k.c
+++ /dev/null
@@ -1,318 +0,0 @@
-/*
- * QEMU/MIPS pseudo-board
- *
- * emulates a simple machine with ISA-like bus.
- * ISA IO space mapped to the 0x14000000 (PHYS) and
- * ISA memory at the 0x10000000 (PHYS, 16Mb in size).
- * All peripherial devices are attached to this "bus" with
- * the standard PC ISA addresses.
- */
-
-#include "qemu/osdep.h"
-#include "qemu/units.h"
-#include "qapi/error.h"
-#include "qemu-common.h"
-#include "cpu.h"
-#include "hw/clock.h"
-#include "hw/mips/mips.h"
-#include "hw/mips/cpudevs.h"
-#include "hw/intc/i8259.h"
-#include "hw/char/serial.h"
-#include "hw/isa/isa.h"
-#include "net/net.h"
-#include "hw/net/ne2000-isa.h"
-#include "sysemu/sysemu.h"
-#include "hw/boards.h"
-#include "hw/block/flash.h"
-#include "qemu/log.h"
-#include "hw/mips/bios.h"
-#include "hw/ide.h"
-#include "hw/ide/internal.h"
-#include "hw/loader.h"
-#include "elf.h"
-#include "hw/rtc/mc146818rtc.h"
-#include "hw/input/i8042.h"
-#include "hw/timer/i8254.h"
-#include "exec/address-spaces.h"
-#include "sysemu/qtest.h"
-#include "sysemu/reset.h"
-#include "sysemu/runstate.h"
-#include "qemu/error-report.h"
-
-#define MAX_IDE_BUS 2
-
-static const int ide_iobase[2] = { 0x1f0, 0x170 };
-static const int ide_iobase2[2] = { 0x3f6, 0x376 };
-static const int ide_irq[2] = { 14, 15 };
-
-static ISADevice *pit; /* PIT i8254 */
-
-/* i8254 PIT is attached to the IRQ0 at PIC i8259 */
-
-static struct _loaderparams {
-    int ram_size;
-    const char *kernel_filename;
-    const char *kernel_cmdline;
-    const char *initrd_filename;
-} loaderparams;
-
-static void mips_qemu_write(void *opaque, hwaddr addr,
-                            uint64_t val, unsigned size)
-{
-    if ((addr & 0xffff) == 0 && val == 42) {
-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-    } else if ((addr & 0xffff) == 4 && val == 42) {
-        qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
-    }
-}
-
-static uint64_t mips_qemu_read(void *opaque, hwaddr addr,
-                               unsigned size)
-{
-    return 0;
-}
-
-static const MemoryRegionOps mips_qemu_ops = {
-    .read = mips_qemu_read,
-    .write = mips_qemu_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-};
-
-typedef struct ResetData {
-    MIPSCPU *cpu;
-    uint64_t vector;
-} ResetData;
-
-static int64_t load_kernel(void)
-{
-    const size_t params_size = 264;
-    int64_t entry, kernel_high, initrd_size;
-    long kernel_size;
-    ram_addr_t initrd_offset;
-    uint32_t *params_buf;
-    int big_endian;
-
-#ifdef TARGET_WORDS_BIGENDIAN
-    big_endian = 1;
-#else
-    big_endian = 0;
-#endif
-    kernel_size = load_elf(loaderparams.kernel_filename, NULL,
-                           cpu_mips_kseg0_to_phys, NULL,
-                           (uint64_t *)&entry, NULL,
-                           (uint64_t *)&kernel_high, NULL, big_endian,
-                           EM_MIPS, 1, 0);
-    if (kernel_size < 0) {
-        error_report("could not load kernel '%s': %s",
-                     loaderparams.kernel_filename,
-                     load_elf_strerror(kernel_size));
-        exit(1);
-    }
-
-    /* load initrd */
-    initrd_size = 0;
-    initrd_offset = 0;
-    if (loaderparams.initrd_filename) {
-        initrd_size = get_image_size(loaderparams.initrd_filename);
-        if (initrd_size > 0) {
-            initrd_offset = ROUND_UP(kernel_high, INITRD_PAGE_SIZE);
-            if (initrd_offset + initrd_size > ram_size) {
-                error_report("memory too small for initial ram disk '%s'",
-                             loaderparams.initrd_filename);
-                exit(1);
-            }
-            initrd_size = load_image_targphys(loaderparams.initrd_filename,
-                                              initrd_offset,
-                                              ram_size - initrd_offset);
-        }
-        if (initrd_size == (target_ulong) -1) {
-            error_report("could not load initial ram disk '%s'",
-                         loaderparams.initrd_filename);
-            exit(1);
-        }
-    }
-
-    /* Store command line.  */
-    params_buf = g_malloc(params_size);
-
-    params_buf[0] = tswap32(ram_size);
-    params_buf[1] = tswap32(0x12345678);
-
-    if (initrd_size > 0) {
-        snprintf((char *)params_buf + 8, 256,
-                 "rd_start=0x%" PRIx64 " rd_size=%" PRId64 " %s",
-                 cpu_mips_phys_to_kseg0(NULL, initrd_offset),
-                 initrd_size, loaderparams.kernel_cmdline);
-    } else {
-        snprintf((char *)params_buf + 8, 256,
-        "%s", loaderparams.kernel_cmdline);
-    }
-
-    rom_add_blob_fixed("params", params_buf, params_size,
-                       16 * MiB - params_size);
-
-    g_free(params_buf);
-    return entry;
-}
-
-static void main_cpu_reset(void *opaque)
-{
-    ResetData *s = (ResetData *)opaque;
-    CPUMIPSState *env = &s->cpu->env;
-
-    cpu_reset(CPU(s->cpu));
-    env->active_tc.PC = s->vector;
-}
-
-static const int sector_len = 32 * KiB;
-static
-void mips_r4k_init(MachineState *machine)
-{
-    const char *kernel_filename = machine->kernel_filename;
-    const char *kernel_cmdline = machine->kernel_cmdline;
-    const char *initrd_filename = machine->initrd_filename;
-    char *filename;
-    MemoryRegion *address_space_mem = get_system_memory();
-    MemoryRegion *bios;
-    MemoryRegion *iomem = g_new(MemoryRegion, 1);
-    MemoryRegion *isa_io = g_new(MemoryRegion, 1);
-    MemoryRegion *isa_mem = g_new(MemoryRegion, 1);
-    int bios_size;
-    Clock *cpuclk;
-    MIPSCPU *cpu;
-    CPUMIPSState *env;
-    ResetData *reset_info;
-    int i;
-    qemu_irq *i8259;
-    ISABus *isa_bus;
-    DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
-    DriveInfo *dinfo;
-    int be;
-
-    cpuclk = clock_new(OBJECT(machine), "cpu-refclk");
-    clock_set_hz(cpuclk, 200000000); /* 200 MHz */
-
-    /* init CPUs */
-    cpu = mips_cpu_create_with_clock(machine->cpu_type, cpuclk);
-    env = &cpu->env;
-
-    reset_info = g_malloc0(sizeof(ResetData));
-    reset_info->cpu = cpu;
-    reset_info->vector = env->active_tc.PC;
-    qemu_register_reset(main_cpu_reset, reset_info);
-
-    /* allocate RAM */
-    if (machine->ram_size > 256 * MiB) {
-        error_report("Too much memory for this machine: %" PRId64 "MB,"
-                     " maximum 256MB", ram_size / MiB);
-        exit(1);
-    }
-    memory_region_add_subregion(address_space_mem, 0, machine->ram);
-
-    memory_region_init_io(iomem, NULL, &mips_qemu_ops,
-                          NULL, "mips-qemu", 0x10000);
-
-    memory_region_add_subregion(address_space_mem, 0x1fbf0000, iomem);
-
-    /*
-     * Try to load a BIOS image. If this fails, we continue regardless,
-     * but initialize the hardware ourselves. When a kernel gets
-     * preloaded we also initialize the hardware, since the BIOS wasn't
-     * run.
-     */
-
-    if (bios_name == NULL) {
-        bios_name = BIOS_FILENAME;
-    }
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
-    if (filename) {
-        bios_size = get_image_size(filename);
-    } else {
-        bios_size = -1;
-    }
-#ifdef TARGET_WORDS_BIGENDIAN
-    be = 1;
-#else
-    be = 0;
-#endif
-    dinfo = drive_get(IF_PFLASH, 0, 0);
-    if ((bios_size > 0) && (bios_size <= BIOS_SIZE)) {
-        bios = g_new(MemoryRegion, 1);
-        memory_region_init_rom(bios, NULL, "mips_r4k.bios", BIOS_SIZE,
-                               &error_fatal);
-        memory_region_add_subregion(get_system_memory(), 0x1fc00000, bios);
-
-        load_image_targphys(filename, 0x1fc00000, BIOS_SIZE);
-    } else if (dinfo != NULL) {
-        uint32_t mips_rom = 0x00400000;
-        if (!pflash_cfi01_register(0x1fc00000, "mips_r4k.bios", mips_rom,
-                                   blk_by_legacy_dinfo(dinfo),
-                                   sector_len, 4, 0, 0, 0, 0, be)) {
-            fprintf(stderr, "qemu: Error registering flash memory.\n");
-        }
-    } else if (!qtest_enabled()) {
-        /* not fatal */
-        warn_report("could not load MIPS bios '%s'", bios_name);
-    }
-    g_free(filename);
-
-    if (kernel_filename) {
-        loaderparams.ram_size = machine->ram_size;
-        loaderparams.kernel_filename = kernel_filename;
-        loaderparams.kernel_cmdline = kernel_cmdline;
-        loaderparams.initrd_filename = initrd_filename;
-        reset_info->vector = load_kernel();
-    }
-
-    /* Init CPU internal devices */
-    cpu_mips_irq_init_cpu(cpu);
-    cpu_mips_clock_init(cpu);
-
-    /* ISA bus: IO space at 0x14000000, mem space at 0x10000000 */
-    memory_region_init_alias(isa_io, NULL, "isa-io",
-                             get_system_io(), 0, 0x00010000);
-    memory_region_init(isa_mem, NULL, "isa-mem", 0x01000000);
-    memory_region_add_subregion(get_system_memory(), 0x14000000, isa_io);
-    memory_region_add_subregion(get_system_memory(), 0x10000000, isa_mem);
-    isa_bus = isa_bus_new(NULL, isa_mem, get_system_io(), &error_abort);
-
-    /* The PIC is attached to the MIPS CPU INT0 pin */
-    i8259 = i8259_init(isa_bus, env->irq[2]);
-    isa_bus_irqs(isa_bus, i8259);
-
-    mc146818_rtc_init(isa_bus, 2000, NULL);
-
-    pit = i8254_pit_init(isa_bus, 0x40, 0, NULL);
-
-    serial_hds_isa_init(isa_bus, 0, MAX_ISA_SERIAL_PORTS);
-
-    isa_vga_init(isa_bus);
-
-    if (nd_table[0].used) {
-        isa_ne2000_init(isa_bus, 0x300, 9, &nd_table[0]);
-    }
-
-    ide_drive_get(hd, ARRAY_SIZE(hd));
-    for (i = 0; i < MAX_IDE_BUS; i++)
-        isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i], ide_irq[i],
-                     hd[MAX_IDE_DEVS * i],
-                     hd[MAX_IDE_DEVS * i + 1]);
-
-    isa_create_simple(isa_bus, TYPE_I8042);
-}
-
-static void mips_machine_init(MachineClass *mc)
-{
-    mc->deprecation_reason = "use malta machine type instead";
-    mc->desc = "mips r4k platform";
-    mc->init = mips_r4k_init;
-    mc->block_default_type = IF_IDE;
-#ifdef TARGET_MIPS64
-    mc->default_cpu_type = MIPS_CPU_TYPE_NAME("R4000");
-#else
-    mc->default_cpu_type = MIPS_CPU_TYPE_NAME("24Kf");
-#endif
-    mc->default_ram_id = "mips_r4k.ram";
-}
-
-DEFINE_MACHINE("mips", mips_machine_init)
diff --git a/hw/misc/mips_cpc.c b/hw/misc/mips_cpc.c
index 7c11fb3d44..4a94c87054 100644
--- a/hw/misc/mips_cpc.c
+++ b/hw/misc/mips_cpc.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/hw/misc/mips_itu.c b/hw/misc/mips_itu.c
index 3540985258..133399598f 100644
--- a/hw/misc/mips_itu.c
+++ b/hw/misc/mips_itu.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/hw/pci-host/xilinx-pcie.c b/hw/pci-host/xilinx-pcie.c
index 3b321421b6..38d5901a45 100644
--- a/hw/pci-host/xilinx-pcie.c
+++ b/hw/pci-host/xilinx-pcie.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index b1622b7c7f..19e1933f04 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -20,85 +20,77 @@
 #include "chardev/char-serial.h"
 #include "chardev/char-fe.h"
 #include "qom/object.h"
+#include "trace.h"
 
-//#define DEBUG_Serial
-
-#ifdef DEBUG_Serial
-#define DPRINTF(fmt, ...) \
-do { printf("usb-serial: " fmt , ## __VA_ARGS__); } while (0)
-#else
-#define DPRINTF(fmt, ...) do {} while(0)
-#endif
 
 #define RECV_BUF (512 - (2 * 8))
 
 /* Commands */
-#define FTDI_RESET		0
-#define FTDI_SET_MDM_CTRL	1
-#define FTDI_SET_FLOW_CTRL	2
-#define FTDI_SET_BAUD		3
-#define FTDI_SET_DATA		4
-#define FTDI_GET_MDM_ST		5
-#define FTDI_SET_EVENT_CHR	6
-#define FTDI_SET_ERROR_CHR	7
-#define FTDI_SET_LATENCY	9
-#define FTDI_GET_LATENCY	10
-
-#define DeviceOutVendor	((USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_DEVICE)<<8)
-#define DeviceInVendor	((USB_DIR_IN |USB_TYPE_VENDOR|USB_RECIP_DEVICE)<<8)
+#define FTDI_RESET             0
+#define FTDI_SET_MDM_CTRL      1
+#define FTDI_SET_FLOW_CTRL     2
+#define FTDI_SET_BAUD          3
+#define FTDI_SET_DATA          4
+#define FTDI_GET_MDM_ST        5
+#define FTDI_SET_EVENT_CHR     6
+#define FTDI_SET_ERROR_CHR     7
+#define FTDI_SET_LATENCY       9
+#define FTDI_GET_LATENCY       10
 
 /* RESET */
 
-#define FTDI_RESET_SIO	0
-#define FTDI_RESET_RX	1
-#define FTDI_RESET_TX	2
+#define FTDI_RESET_SIO 0
+#define FTDI_RESET_RX  1
+#define FTDI_RESET_TX  2
 
 /* SET_MDM_CTRL */
 
-#define FTDI_DTR	1
-#define FTDI_SET_DTR	(FTDI_DTR << 8)
-#define FTDI_RTS	2
-#define FTDI_SET_RTS	(FTDI_RTS << 8)
+#define FTDI_DTR       1
+#define FTDI_SET_DTR   (FTDI_DTR << 8)
+#define FTDI_RTS       2
+#define FTDI_SET_RTS   (FTDI_RTS << 8)
 
 /* SET_FLOW_CTRL */
 
-#define FTDI_RTS_CTS_HS		1
-#define FTDI_DTR_DSR_HS		2
-#define FTDI_XON_XOFF_HS	4
+#define FTDI_NO_HS         0
+#define FTDI_RTS_CTS_HS    1
+#define FTDI_DTR_DSR_HS    2
+#define FTDI_XON_XOFF_HS   4
 
 /* SET_DATA */
 
-#define FTDI_PARITY	(0x7 << 8)
-#define FTDI_ODD	(0x1 << 8)
-#define FTDI_EVEN	(0x2 << 8)
-#define FTDI_MARK	(0x3 << 8)
-#define FTDI_SPACE	(0x4 << 8)
+#define FTDI_PARITY    (0x7 << 8)
+#define FTDI_ODD       (0x1 << 8)
+#define FTDI_EVEN      (0x2 << 8)
+#define FTDI_MARK      (0x3 << 8)
+#define FTDI_SPACE     (0x4 << 8)
 
-#define FTDI_STOP	(0x3 << 11)
-#define FTDI_STOP1	(0x0 << 11)
-#define FTDI_STOP15	(0x1 << 11)
-#define FTDI_STOP2	(0x2 << 11)
+#define FTDI_STOP      (0x3 << 11)
+#define FTDI_STOP1     (0x0 << 11)
+#define FTDI_STOP15    (0x1 << 11)
+#define FTDI_STOP2     (0x2 << 11)
 
 /* GET_MDM_ST */
 /* TODO: should be sent every 40ms */
-#define FTDI_CTS  (1<<4)        // CTS line status
-#define FTDI_DSR  (1<<5)        // DSR line status
-#define FTDI_RI   (1<<6)        // RI line status
-#define FTDI_RLSD (1<<7)        // Receive Line Signal Detect
+#define FTDI_CTS   (1 << 4)    /* CTS line status */
+#define FTDI_DSR   (1 << 5)    /* DSR line status */
+#define FTDI_RI    (1 << 6)    /* RI line status */
+#define FTDI_RLSD  (1 << 7)    /* Receive Line Signal Detect */
 
 /* Status */
 
-#define FTDI_DR   (1<<0)        // Data Ready
-#define FTDI_OE   (1<<1)        // Overrun Err
-#define FTDI_PE   (1<<2)        // Parity Err
-#define FTDI_FE   (1<<3)        // Framing Err
-#define FTDI_BI   (1<<4)        // Break Interrupt
-#define FTDI_THRE (1<<5)        // Transmitter Holding Register
-#define FTDI_TEMT (1<<6)        // Transmitter Empty
-#define FTDI_FIFO (1<<7)        // Error in FIFO
+#define FTDI_DR    (1 << 0)    /* Data Ready */
+#define FTDI_OE    (1 << 1)    /* Overrun Err */
+#define FTDI_PE    (1 << 2)    /* Parity Err */
+#define FTDI_FE    (1 << 3)    /* Framing Err */
+#define FTDI_BI    (1 << 4)    /* Break Interrupt */
+#define FTDI_THRE  (1 << 5)    /* Transmitter Holding Register */
+#define FTDI_TEMT  (1 << 6)    /* Transmitter Empty */
+#define FTDI_FIFO  (1 << 7)    /* Error in FIFO */
 
 struct USBSerialState {
     USBDevice dev;
+
     USBEndpoint *intr;
     uint8_t recv_buf[RECV_BUF];
     uint16_t recv_ptr;
@@ -106,6 +98,10 @@ struct USBSerialState {
     uint8_t event_chr;
     uint8_t error_chr;
     uint8_t event_trigger;
+    bool always_plugged;
+    uint8_t flow_control;
+    uint8_t xon;
+    uint8_t xoff;
     QEMUSerialSetParams params;
     int latency;        /* ms */
     CharBackend cs;
@@ -189,21 +185,44 @@ static const USBDesc desc_braille = {
     .str  = desc_strings,
 };
 
+static void usb_serial_set_flow_control(USBSerialState *s,
+                                        uint8_t flow_control)
+{
+    USBDevice *dev = USB_DEVICE(s);
+    USBBus *bus = usb_bus_from_device(dev);
+
+    /* TODO: ioctl */
+    s->flow_control = flow_control;
+    trace_usb_serial_set_flow_control(bus->busnr, dev->addr, flow_control);
+}
+
+static void usb_serial_set_xonxoff(USBSerialState *s, int xonxoff)
+{
+    USBDevice *dev = USB_DEVICE(s);
+    USBBus *bus = usb_bus_from_device(dev);
+
+    s->xon = xonxoff & 0xff;
+    s->xoff = (xonxoff >> 8) & 0xff;
+
+    trace_usb_serial_set_xonxoff(bus->busnr, dev->addr, s->xon, s->xoff);
+}
+
 static void usb_serial_reset(USBSerialState *s)
 {
-    /* TODO: Set flow control to none */
     s->event_chr = 0x0d;
     s->event_trigger = 0;
     s->recv_ptr = 0;
     s->recv_used = 0;
     /* TODO: purge in char driver */
+    usb_serial_set_flow_control(s, FTDI_NO_HS);
 }
 
 static void usb_serial_handle_reset(USBDevice *dev)
 {
-    USBSerialState *s = (USBSerialState *)dev;
+    USBSerialState *s = USB_SERIAL(dev);
+    USBBus *bus = usb_bus_from_device(dev);
 
-    DPRINTF("Reset\n");
+    trace_usb_serial_reset(bus->busnr, dev->addr);
 
     usb_serial_reset(s);
     /* TODO: Reset char device, send BREAK? */
@@ -216,29 +235,36 @@ static uint8_t usb_get_modem_lines(USBSerialState *s)
 
     if (qemu_chr_fe_ioctl(&s->cs,
                           CHR_IOCTL_SERIAL_GET_TIOCM, &flags) == -ENOTSUP) {
-        return FTDI_CTS|FTDI_DSR|FTDI_RLSD;
+        return FTDI_CTS | FTDI_DSR | FTDI_RLSD;
     }
 
     ret = 0;
-    if (flags & CHR_TIOCM_CTS)
+    if (flags & CHR_TIOCM_CTS) {
         ret |= FTDI_CTS;
-    if (flags & CHR_TIOCM_DSR)
+    }
+    if (flags & CHR_TIOCM_DSR) {
         ret |= FTDI_DSR;
-    if (flags & CHR_TIOCM_RI)
+    }
+    if (flags & CHR_TIOCM_RI) {
         ret |= FTDI_RI;
-    if (flags & CHR_TIOCM_CAR)
+    }
+    if (flags & CHR_TIOCM_CAR) {
         ret |= FTDI_RLSD;
+    }
 
     return ret;
 }
 
 static void usb_serial_handle_control(USBDevice *dev, USBPacket *p,
-               int request, int value, int index, int length, uint8_t *data)
+                                      int request, int value, int index,
+                                      int length, uint8_t *data)
 {
-    USBSerialState *s = (USBSerialState *)dev;
+    USBSerialState *s = USB_SERIAL(dev);
+    USBBus *bus = usb_bus_from_device(dev);
     int ret;
 
-    DPRINTF("got control %x, value %x\n",request, value);
+    trace_usb_serial_handle_control(bus->busnr, dev->addr, request, value);
+
     ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
     if (ret >= 0) {
         return;
@@ -248,8 +274,8 @@ static void usb_serial_handle_control(USBDevice *dev, USBPacket *p,
     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
         break;
 
-        /* Class specific requests.  */
-    case DeviceOutVendor | FTDI_RESET:
+    /* Class specific requests.  */
+    case VendorDeviceOutRequest | FTDI_RESET:
         switch (value) {
         case FTDI_RESET_SIO:
             usb_serial_reset(s);
@@ -264,96 +290,131 @@ static void usb_serial_handle_control(USBDevice *dev, USBPacket *p,
             break;
         }
         break;
-    case DeviceOutVendor | FTDI_SET_MDM_CTRL:
+    case VendorDeviceOutRequest | FTDI_SET_MDM_CTRL:
     {
         static int flags;
         qemu_chr_fe_ioctl(&s->cs, CHR_IOCTL_SERIAL_GET_TIOCM, &flags);
         if (value & FTDI_SET_RTS) {
-            if (value & FTDI_RTS)
+            if (value & FTDI_RTS) {
                 flags |= CHR_TIOCM_RTS;
-            else
+            } else {
                 flags &= ~CHR_TIOCM_RTS;
+            }
         }
         if (value & FTDI_SET_DTR) {
-            if (value & FTDI_DTR)
+            if (value & FTDI_DTR) {
                 flags |= CHR_TIOCM_DTR;
-            else
+            } else {
                 flags &= ~CHR_TIOCM_DTR;
+            }
         }
         qemu_chr_fe_ioctl(&s->cs, CHR_IOCTL_SERIAL_SET_TIOCM, &flags);
         break;
     }
-    case DeviceOutVendor | FTDI_SET_FLOW_CTRL:
-        /* TODO: ioctl */
+    case VendorDeviceOutRequest | FTDI_SET_FLOW_CTRL: {
+        uint8_t flow_control = index >> 8;
+
+        usb_serial_set_flow_control(s, flow_control);
+        if (flow_control & FTDI_XON_XOFF_HS) {
+            usb_serial_set_xonxoff(s, value);
+        }
         break;
-    case DeviceOutVendor | FTDI_SET_BAUD: {
+    }
+    case VendorDeviceOutRequest | FTDI_SET_BAUD: {
         static const int subdivisors8[8] = { 0, 4, 2, 1, 3, 5, 6, 7 };
         int subdivisor8 = subdivisors8[((value & 0xc000) >> 14)
                                      | ((index & 1) << 2)];
         int divisor = value & 0x3fff;
 
         /* chip special cases */
-        if (divisor == 1 && subdivisor8 == 0)
+        if (divisor == 1 && subdivisor8 == 0) {
             subdivisor8 = 4;
-        if (divisor == 0 && subdivisor8 == 0)
+        }
+        if (divisor == 0 && subdivisor8 == 0) {
             divisor = 1;
+        }
 
         s->params.speed = (48000000 / 2) / (8 * divisor + subdivisor8);
+        trace_usb_serial_set_baud(bus->busnr, dev->addr, s->params.speed);
         qemu_chr_fe_ioctl(&s->cs, CHR_IOCTL_SERIAL_SET_PARAMS, &s->params);
         break;
     }
-    case DeviceOutVendor | FTDI_SET_DATA:
+    case VendorDeviceOutRequest | FTDI_SET_DATA:
+        switch (value & 0xff) {
+        case 7:
+            s->params.data_bits = 7;
+            break;
+        case 8:
+            s->params.data_bits = 8;
+            break;
+        default:
+            /*
+             * According to a comment in Linux's ftdi_sio.c original FTDI
+             * chips fall back to 8 data bits for unsupported data_bits
+             */
+            trace_usb_serial_unsupported_data_bits(bus->busnr, dev->addr,
+                                                   value & 0xff);
+            s->params.data_bits = 8;
+        }
+
         switch (value & FTDI_PARITY) {
-            case 0:
-                s->params.parity = 'N';
-                break;
-            case FTDI_ODD:
-                s->params.parity = 'O';
-                break;
-            case FTDI_EVEN:
-                s->params.parity = 'E';
-                break;
-            default:
-                DPRINTF("unsupported parity %d\n", value & FTDI_PARITY);
-                goto fail;
+        case 0:
+            s->params.parity = 'N';
+            break;
+        case FTDI_ODD:
+            s->params.parity = 'O';
+            break;
+        case FTDI_EVEN:
+            s->params.parity = 'E';
+            break;
+        default:
+            trace_usb_serial_unsupported_parity(bus->busnr, dev->addr,
+                                                value & FTDI_PARITY);
+            goto fail;
         }
+
         switch (value & FTDI_STOP) {
-            case FTDI_STOP1:
-                s->params.stop_bits = 1;
-                break;
-            case FTDI_STOP2:
-                s->params.stop_bits = 2;
-                break;
-            default:
-                DPRINTF("unsupported stop bits %d\n", value & FTDI_STOP);
-                goto fail;
+        case FTDI_STOP1:
+            s->params.stop_bits = 1;
+            break;
+        case FTDI_STOP2:
+            s->params.stop_bits = 2;
+            break;
+        default:
+            trace_usb_serial_unsupported_stopbits(bus->busnr, dev->addr,
+                                                  value & FTDI_STOP);
+            goto fail;
         }
+
+        trace_usb_serial_set_data(bus->busnr, dev->addr, s->params.parity,
+                                  s->params.data_bits, s->params.stop_bits);
         qemu_chr_fe_ioctl(&s->cs, CHR_IOCTL_SERIAL_SET_PARAMS, &s->params);
         /* TODO: TX ON/OFF */
         break;
-    case DeviceInVendor | FTDI_GET_MDM_ST:
+    case VendorDeviceRequest | FTDI_GET_MDM_ST:
         data[0] = usb_get_modem_lines(s) | 1;
         data[1] = FTDI_THRE | FTDI_TEMT;
         p->actual_length = 2;
         break;
-    case DeviceOutVendor | FTDI_SET_EVENT_CHR:
+    case VendorDeviceOutRequest | FTDI_SET_EVENT_CHR:
         /* TODO: handle it */
         s->event_chr = value;
         break;
-    case DeviceOutVendor | FTDI_SET_ERROR_CHR:
+    case VendorDeviceOutRequest | FTDI_SET_ERROR_CHR:
         /* TODO: handle it */
         s->error_chr = value;
         break;
-    case DeviceOutVendor | FTDI_SET_LATENCY:
+    case VendorDeviceOutRequest | FTDI_SET_LATENCY:
         s->latency = value;
         break;
-    case DeviceInVendor | FTDI_GET_LATENCY:
+    case VendorDeviceRequest | FTDI_GET_LATENCY:
         data[0] = s->latency;
         p->actual_length = 1;
         break;
     default:
     fail:
-        DPRINTF("got unsupported/bogus control %x, value %x\n", request, value);
+        trace_usb_serial_unsupported_control(bus->busnr, dev->addr, request,
+                                             value);
         p->status = USB_RET_STALL;
         break;
     }
@@ -416,32 +477,37 @@ static void usb_serial_token_in(USBSerialState *s, USBPacket *p)
 
 static void usb_serial_handle_data(USBDevice *dev, USBPacket *p)
 {
-    USBSerialState *s = (USBSerialState *)dev;
+    USBSerialState *s = USB_SERIAL(dev);
+    USBBus *bus = usb_bus_from_device(dev);
     uint8_t devep = p->ep->nr;
     struct iovec *iov;
     int i;
 
     switch (p->pid) {
     case USB_TOKEN_OUT:
-        if (devep != 2)
+        if (devep != 2) {
             goto fail;
+        }
         for (i = 0; i < p->iov.niov; i++) {
             iov = p->iov.iov + i;
-            /* XXX this blocks entire thread. Rewrite to use
-             * qemu_chr_fe_write and background I/O callbacks */
+            /*
+             * XXX this blocks entire thread. Rewrite to use
+             * qemu_chr_fe_write and background I/O callbacks
+             */
             qemu_chr_fe_write_all(&s->cs, iov->iov_base, iov->iov_len);
         }
         p->actual_length = p->iov.size;
         break;
 
     case USB_TOKEN_IN:
-        if (devep != 1)
+        if (devep != 1) {
             goto fail;
+        }
         usb_serial_token_in(s, p);
         break;
 
     default:
-        DPRINTF("Bad token\n");
+        trace_usb_serial_bad_token(bus->busnr, dev->addr);
     fail:
         p->status = USB_RET_STALL;
         break;
@@ -464,21 +530,24 @@ static void usb_serial_read(void *opaque, const uint8_t *buf, int size)
     int first_size, start;
 
     /* room in the buffer? */
-    if (size > (RECV_BUF - s->recv_used))
+    if (size > (RECV_BUF - s->recv_used)) {
         size = RECV_BUF - s->recv_used;
+    }
 
     start = s->recv_ptr + s->recv_used;
     if (start < RECV_BUF) {
         /* copy data to end of buffer */
         first_size = RECV_BUF - start;
-        if (first_size > size)
+        if (first_size > size) {
             first_size = size;
+        }
 
         memcpy(s->recv_buf + start, buf, first_size);
 
         /* wrap around to front if needed */
-        if (size > first_size)
+        if (size > first_size) {
             memcpy(s->recv_buf, buf + first_size, size - first_size);
+        }
     } else {
         start -= RECV_BUF;
         memcpy(s->recv_buf + start, buf, size);
@@ -493,23 +562,23 @@ static void usb_serial_event(void *opaque, QEMUChrEvent event)
     USBSerialState *s = opaque;
 
     switch (event) {
-        case CHR_EVENT_BREAK:
-            s->event_trigger |= FTDI_BI;
-            break;
-        case CHR_EVENT_OPENED:
-            if (!s->dev.attached) {
-                usb_device_attach(&s->dev, &error_abort);
-            }
-            break;
-        case CHR_EVENT_CLOSED:
-            if (s->dev.attached) {
-                usb_device_detach(&s->dev);
-            }
-            break;
-        case CHR_EVENT_MUX_IN:
-        case CHR_EVENT_MUX_OUT:
-            /* Ignore */
-            break;
+    case CHR_EVENT_BREAK:
+        s->event_trigger |= FTDI_BI;
+        break;
+    case CHR_EVENT_OPENED:
+        if (!s->always_plugged && !s->dev.attached) {
+            usb_device_attach(&s->dev, &error_abort);
+        }
+        break;
+    case CHR_EVENT_CLOSED:
+        if (!s->always_plugged && s->dev.attached) {
+            usb_device_detach(&s->dev);
+        }
+        break;
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
@@ -537,7 +606,8 @@ static void usb_serial_realize(USBDevice *dev, Error **errp)
                              usb_serial_event, NULL, s, NULL, true);
     usb_serial_handle_reset(dev);
 
-    if (qemu_chr_fe_backend_open(&s->cs) && !dev->attached) {
+    if ((s->always_plugged || qemu_chr_fe_backend_open(&s->cs)) &&
+        !dev->attached) {
         usb_device_attach(dev, &error_abort);
     }
     s->intr = usb_ep_get(dev, USB_TOKEN_IN, 1);
@@ -549,8 +619,9 @@ static USBDevice *usb_braille_init(const char *unused)
     Chardev *cdrv;
 
     cdrv = qemu_chr_new("braille", "braille", NULL);
-    if (!cdrv)
+    if (!cdrv) {
         return NULL;
+    }
 
     dev = usb_new("usb-braille");
     qdev_prop_set_chr(&dev->qdev, "chardev", cdrv);
@@ -564,6 +635,7 @@ static const VMStateDescription vmstate_usb_serial = {
 
 static Property serial_properties[] = {
     DEFINE_PROP_CHR("chardev", USBSerialState, cs),
+    DEFINE_PROP_BOOL("always-plugged", USBSerialState, always_plugged, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 72e4298780..a3292d4624 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -320,3 +320,16 @@ usb_host_parse_interface(int bus, int addr, int num, int alt, int active) "dev %
 usb_host_parse_endpoint(int bus, int addr, int ep, const char *dir, const char *type, int active) "dev %d:%d, ep %d, %s, %s, active %d"
 usb_host_parse_error(int bus, int addr, const char *errmsg) "dev %d:%d, msg %s"
 usb_host_remote_wakeup_removed(int bus, int addr) "dev %d:%d"
+
+# dev-serial.c
+usb_serial_reset(int bus, int addr) "dev %d:%u reset"
+usb_serial_handle_control(int bus, int addr, int request, int value) "dev %d:%u got control 0x%x, value 0x%x"
+usb_serial_unsupported_parity(int bus, int addr, int value) "dev %d:%u unsupported parity %d"
+usb_serial_unsupported_stopbits(int bus, int addr, int value) "dev %d:%u unsupported stop bits %d"
+usb_serial_unsupported_control(int bus, int addr, int request, int value) "dev %d:%u got unsupported/bogus control 0x%x, value 0x%x"
+usb_serial_unsupported_data_bits(int bus, int addr, int value) "dev %d:%u unsupported data bits %d, falling back to 8"
+usb_serial_bad_token(int bus, int addr) "dev %d:%u bad token"
+usb_serial_set_baud(int bus, int addr, int baud) "dev %d:%u baud rate %d"
+usb_serial_set_data(int bus, int addr, int parity, int data, int stop) "dev %d:%u parity %c, data bits %d, stop bits %d"
+usb_serial_set_flow_control(int bus, int addr, int index) "dev %d:%u flow control %d"
+usb_serial_set_xonxoff(int bus, int addr, uint8_t xon, uint8_t xoff) "dev %d:%u xon 0x%x xoff 0x%x"
diff --git a/include/hw/mips/cps.h b/include/hw/mips/cps.h
index 859a8d4a67..04d636246a 100644
--- a/include/hw/mips/cps.h
+++ b/include/hw/mips/cps.h
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/include/hw/misc/mips_cpc.h b/include/hw/misc/mips_cpc.h
index e5dccea151..fcafbd5e00 100644
--- a/include/hw/misc/mips_cpc.h
+++ b/include/hw/misc/mips_cpc.h
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/include/hw/misc/mips_itu.h b/include/hw/misc/mips_itu.h
index 96347dbf65..50d961106d 100644
--- a/include/hw/misc/mips_itu.h
+++ b/include/hw/misc/mips_itu.h
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/include/hw/pci-host/xilinx-pcie.h b/include/hw/pci-host/xilinx-pcie.h
index f079e50db4..89be88d87f 100644
--- a/include/hw/pci-host/xilinx-pcie.h
+++ b/include/hw/pci-host/xilinx-pcie.h
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index 56e9bad33d..a6a6684df1 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -1762,7 +1762,8 @@ err_out:
     goto out;
 }
 
-void hmp_screendump(Monitor *mon, const QDict *qdict)
+void coroutine_fn
+hmp_screendump(Monitor *mon, const QDict *qdict)
 {
     const char *filename = qdict_get_str(qdict, "filename");
     const char *id = qdict_get_try_str(qdict, "device");
diff --git a/qapi/ui.json b/qapi/ui.json
index 9d6721037f..6c7b33cb72 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -98,7 +98,8 @@
 #
 ##
 { 'command': 'screendump',
-  'data': {'filename': 'str', '*device': 'str', '*head': 'int'} }
+  'data': {'filename': 'str', '*device': 'str', '*head': 'int'},
+  'coroutine': true }
 
 ##
 # == Spice
diff --git a/target/mips/cp0_helper.c b/target/mips/cp0_helper.c
index 12143ac55b..709cc9a7e3 100644
--- a/target/mips/cp0_helper.c
+++ b/target/mips/cp0_helper.c
@@ -8,7 +8,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/dsp_helper.c b/target/mips/dsp_helper.c
index 8c58eeb0bf..09b6e5fb15 100644
--- a/target/mips/dsp_helper.c
+++ b/target/mips/dsp_helper.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 6cc956c023..020b768e87 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -8,7 +8,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/gdbstub.c b/target/mips/gdbstub.c
index 98f56e660d..e39f8d75cf 100644
--- a/target/mips/gdbstub.c
+++ b/target/mips/gdbstub.c
@@ -7,7 +7,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/helper.c b/target/mips/helper.c
index afd78b1990..063b65c052 100644
--- a/target/mips/helper.c
+++ b/target/mips/helper.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/lmmi_helper.c b/target/mips/lmmi_helper.c
index 6c645cf679..abeb7736ae 100644
--- a/target/mips/lmmi_helper.c
+++ b/target/mips/lmmi_helper.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/mips-semi.c b/target/mips/mips-semi.c
index 10a710c1e8..898251aa02 100644
--- a/target/mips/mips-semi.c
+++ b/target/mips/mips-semi.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/msa_helper.c b/target/mips/msa_helper.c
index 6865addaf6..249f0fdad8 100644
--- a/target/mips/msa_helper.c
+++ b/target/mips/msa_helper.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index 0050d0616b..5184a1838b 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -6,7 +6,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/target/mips/translate.c b/target/mips/translate.c
index f449758606..c64a1bc42e 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -10,7 +10,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -31442,8 +31442,8 @@ static void mips_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 #else
         ctx->mem_idx = hflags_mmu_index(ctx->hflags);
 #endif
-    ctx->default_tcg_memop_mask = (ctx->insn_flags & ISA_MIPS32R6) ?
-                                  MO_UNALN : MO_ALIGN;
+    ctx->default_tcg_memop_mask = (ctx->insn_flags & (ISA_MIPS32R6 | ISA_MIPS64R6 |
+                                  INSN_LOONGSON3A)) ? MO_UNALN : MO_ALIGN;
 
     LOG_DISAS("\ntb %p idx %d hflags %04x\n", ctx->base.tb, ctx->mem_idx,
               ctx->hflags);
diff --git a/target/mips/translate_init.c.inc b/target/mips/translate_init.c.inc
index fb5a9b38e5..ea85d5c6a7 100644
--- a/target/mips/translate_init.c.inc
+++ b/target/mips/translate_init.c.inc
@@ -7,7 +7,7 @@
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * version 2.1 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
index eef242dc80..5af944a5fb 100644
--- a/tests/qtest/cdrom-test.c
+++ b/tests/qtest/cdrom-test.c
@@ -217,7 +217,7 @@ int main(int argc, char **argv)
         add_cdrom_param_tests(sparc64machines);
     } else if (!strncmp(arch, "mips64", 6)) {
         const char *mips64machines[] = {
-            "magnum", "malta", "mips", "pica61", NULL
+            "magnum", "malta", "pica61", NULL
         };
         add_cdrom_param_tests(mips64machines);
     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
diff --git a/tests/qtest/endianness-test.c b/tests/qtest/endianness-test.c
index 4e79e22c28..09ecb531f1 100644
--- a/tests/qtest/endianness-test.c
+++ b/tests/qtest/endianness-test.c
@@ -27,11 +27,9 @@ struct TestCase {
 
 static const TestCase test_cases[] = {
     { "i386", "pc", -1 },
-    { "mips", "mips", 0x14000000, .bswap = true },
     { "mips", "malta", 0x10000000, .bswap = true },
     { "mips64", "magnum", 0x90000000, .bswap = true },
     { "mips64", "pica61", 0x90000000, .bswap = true },
-    { "mips64", "mips", 0x14000000, .bswap = true },
     { "mips64", "malta", 0x10000000, .bswap = true },
     { "mips64el", "fuloong2e", 0x1fd00000 },
     { "ppc", "g3beige", 0xfe000000, .bswap = true, .superio = "i82378" },
diff --git a/ui/console.c b/ui/console.c
index 820e408170..e8e59707d3 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -168,6 +168,7 @@ struct QemuConsole {
     QEMUFIFO out_fifo;
     uint8_t out_fifo_buf[16];
     QEMUTimer *kbd_timer;
+    CoQueue dump_queue;
 
     QTAILQ_ENTRY(QemuConsole) next;
 };
@@ -195,7 +196,6 @@ static void dpy_refresh(DisplayState *s);
 static DisplayState *get_alloc_displaystate(void);
 static void text_console_update_cursor_timer(void);
 static void text_console_update_cursor(void *opaque);
-static bool ppm_save(int fd, DisplaySurface *ds, Error **errp);
 
 static void gui_update(void *opaque)
 {
@@ -264,6 +264,7 @@ static void gui_setup_refresh(DisplayState *ds)
 
 void graphic_hw_update_done(QemuConsole *con)
 {
+    qemu_co_queue_restart_all(&con->dump_queue);
 }
 
 void graphic_hw_update(QemuConsole *con)
@@ -311,16 +312,16 @@ void graphic_hw_invalidate(QemuConsole *con)
     }
 }
 
-static bool ppm_save(int fd, DisplaySurface *ds, Error **errp)
+static bool ppm_save(int fd, pixman_image_t *image, Error **errp)
 {
-    int width = pixman_image_get_width(ds->image);
-    int height = pixman_image_get_height(ds->image);
+    int width = pixman_image_get_width(image);
+    int height = pixman_image_get_height(image);
     g_autoptr(Object) ioc = OBJECT(qio_channel_file_new_fd(fd));
     g_autofree char *header = NULL;
     g_autoptr(pixman_image_t) linebuf = NULL;
     int y;
 
-    trace_ppm_save(fd, ds);
+    trace_ppm_save(fd, image);
 
     header = g_strdup_printf("P6\n%d %d\n%d\n", width, height, 255);
     if (qio_channel_write_all(QIO_CHANNEL(ioc),
@@ -330,7 +331,7 @@ static bool ppm_save(int fd, DisplaySurface *ds, Error **errp)
 
     linebuf = qemu_pixman_linebuf_create(PIXMAN_BE_r8g8b8, width);
     for (y = 0; y < height; y++) {
-        qemu_pixman_linebuf_fill(linebuf, ds->image, width, 0, y);
+        qemu_pixman_linebuf_fill(linebuf, image, width, 0, y);
         if (qio_channel_write_all(QIO_CHANNEL(ioc),
                                   (char *)pixman_image_get_data(linebuf),
                                   pixman_image_get_stride(linebuf), errp) < 0) {
@@ -341,9 +342,17 @@ static bool ppm_save(int fd, DisplaySurface *ds, Error **errp)
     return true;
 }
 
-void qmp_screendump(const char *filename, bool has_device, const char *device,
-                    bool has_head, int64_t head, Error **errp)
+static void graphic_hw_update_bh(void *con)
 {
+    graphic_hw_update(con);
+}
+
+/* Safety: coroutine-only, concurrent-coroutine safe, main thread only */
+void coroutine_fn
+qmp_screendump(const char *filename, bool has_device, const char *device,
+               bool has_head, int64_t head, Error **errp)
+{
+    g_autoptr(pixman_image_t) image = NULL;
     QemuConsole *con;
     DisplaySurface *surface;
     int fd;
@@ -366,12 +375,24 @@ void qmp_screendump(const char *filename, bool has_device, const char *device,
         }
     }
 
-    graphic_hw_update(con);
+    if (qemu_co_queue_empty(&con->dump_queue)) {
+        /* Defer the update, it will restart the pending coroutines */
+        aio_bh_schedule_oneshot(qemu_get_aio_context(),
+                                graphic_hw_update_bh, con);
+    }
+    qemu_co_queue_wait(&con->dump_queue, NULL);
+
+    /*
+     * All pending coroutines are woken up, while the BQL is held.  No
+     * further graphic update are possible until it is released.  Take
+     * an image ref before that.
+     */
     surface = qemu_console_surface(con);
     if (!surface) {
         error_setg(errp, "no surface");
         return;
     }
+    image = pixman_image_ref(surface->image);
 
     fd = qemu_open_old(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0666);
     if (fd == -1) {
@@ -380,7 +401,12 @@ void qmp_screendump(const char *filename, bool has_device, const char *device,
         return;
     }
 
-    if (!ppm_save(fd, surface, errp)) {
+    /*
+     * The image content could potentially be updated as the coroutine
+     * yields and releases the BQL. It could produce corrupted dump, but
+     * it should be otherwise safe.
+     */
+    if (!ppm_save(fd, image, errp)) {
         qemu_unlink(filename);
     }
 }
@@ -1296,6 +1322,7 @@ static QemuConsole *new_console(DisplayState *ds, console_type_t console_type,
 
     obj = object_new(TYPE_QEMU_CONSOLE);
     s = QEMU_CONSOLE(obj);
+    qemu_co_queue_init(&s->dump_queue);
     s->head = head;
     object_property_add_link(obj, "device", TYPE_DEVICE,
                              (Object **)&s->device,
diff --git a/ui/trace-events b/ui/trace-events
index b7d7270c02..0ffcdb4408 100644
--- a/ui/trace-events
+++ b/ui/trace-events
@@ -15,7 +15,7 @@ displaysurface_create_pixman(void *display_surface) "surface=%p"
 displaysurface_free(void *display_surface) "surface=%p"
 displaychangelistener_register(void *dcl, const char *name) "%p [ %s ]"
 displaychangelistener_unregister(void *dcl, const char *name) "%p [ %s ]"
-ppm_save(int fd, void *display_surface) "fd=%d surface=%p"
+ppm_save(int fd, void *image) "fd=%d image=%p"
 
 # gtk-egl.c
 # gtk-gl-area.c
diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
index 36927b5f88..5816bf8900 100644
--- a/util/qemu-coroutine-lock.c
+++ b/util/qemu-coroutine-lock.c
@@ -85,15 +85,13 @@ static bool qemu_co_queue_do_restart(CoQueue *queue, bool single)
     return true;
 }
 
-bool coroutine_fn qemu_co_queue_next(CoQueue *queue)
+bool qemu_co_queue_next(CoQueue *queue)
 {
-    assert(qemu_in_coroutine());
     return qemu_co_queue_do_restart(queue, true);
 }
 
-void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue)
+void qemu_co_queue_restart_all(CoQueue *queue)
 {
-    assert(qemu_in_coroutine());
     qemu_co_queue_do_restart(queue, false);
 }