Adding qemu as a submodule of KVMFORNFV

This Patch includes the changes to add qemu as a submodule to
kvmfornfv repo and make use of the updated latest qemu for the
execution of all testcase
Change-Id: I1280af507a857675c7f81d30c95255635667bdd7
Signed-off-by:RajithaY<rajithax.yerrumsetty@intel.com>

6 files changed, 0 insertions, 2081 deletions

diff --git a/qemu/hw/nvram/Makefile.objs b/qemu/hw/nvram/Makefile.objs
deleted file mode 100644
index e9a66940e..000000000
--- a/qemu/hw/nvram/Makefile.objs
+++ /dev/null
@@ -1,5 +0,0 @@
-common-obj-$(CONFIG_DS1225Y) += ds1225y.o
-common-obj-y += eeprom93xx.o
-common-obj-y += fw_cfg.o
-common-obj-$(CONFIG_MAC_NVRAM) += mac_nvram.o
-obj-$(CONFIG_PSERIES) += spapr_nvram.o
diff --git a/qemu/hw/nvram/ds1225y.c b/qemu/hw/nvram/ds1225y.c
deleted file mode 100644
index 57d5ab215..000000000
--- a/qemu/hw/nvram/ds1225y.c
+++ /dev/null
@@ -1,170 +0,0 @@
-/*
- * QEMU NVRAM emulation for DS1225Y chip
- *
- * Copyright (c) 2007-2008 Hervé Poussineau
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "hw/sysbus.h"
-#include "trace.h"
-
-typedef struct {
-    MemoryRegion iomem;
-    uint32_t chip_size;
-    char *filename;
-    FILE *file;
-    uint8_t *contents;
-} NvRamState;
-
-static uint64_t nvram_read(void *opaque, hwaddr addr, unsigned size)
-{
-    NvRamState *s = opaque;
-    uint32_t val;
-
-    val = s->contents[addr];
-    trace_nvram_read(addr, val);
-    return val;
-}
-
-static void nvram_write(void *opaque, hwaddr addr, uint64_t val,
-                        unsigned size)
-{
-    NvRamState *s = opaque;
-
-    val &= 0xff;
-    trace_nvram_write(addr, s->contents[addr], val);
-
-    s->contents[addr] = val;
-    if (s->file) {
-        fseek(s->file, addr, SEEK_SET);
-        fputc(val, s->file);
-        fflush(s->file);
-    }
-}
-
-static const MemoryRegionOps nvram_ops = {
-    .read = nvram_read,
-    .write = nvram_write,
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 1,
-    },
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-static int nvram_post_load(void *opaque, int version_id)
-{
-    NvRamState *s = opaque;
-
-    /* Close file, as filename may has changed in load/store process */
-    if (s->file) {
-        fclose(s->file);
-    }
-
-    /* Write back nvram contents */
-    s->file = fopen(s->filename, "wb");
-    if (s->file) {
-        /* Write back contents, as 'wb' mode cleaned the file */
-        if (fwrite(s->contents, s->chip_size, 1, s->file) != 1) {
-            printf("nvram_post_load: short write\n");
-        }
-        fflush(s->file);
-    }
-
-    return 0;
-}
-
-static const VMStateDescription vmstate_nvram = {
-    .name = "nvram",
-    .version_id = 0,
-    .minimum_version_id = 0,
-    .post_load = nvram_post_load,
-    .fields = (VMStateField[]) {
-        VMSTATE_VARRAY_UINT32(contents, NvRamState, chip_size, 0,
-                              vmstate_info_uint8, uint8_t),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-#define TYPE_DS1225Y "ds1225y"
-#define DS1225Y(obj) OBJECT_CHECK(SysBusNvRamState, (obj), TYPE_DS1225Y)
-
-typedef struct {
-    SysBusDevice parent_obj;
-
-    NvRamState nvram;
-} SysBusNvRamState;
-
-static int nvram_sysbus_initfn(SysBusDevice *dev)
-{
-    SysBusNvRamState *sys = DS1225Y(dev);
-    NvRamState *s = &sys->nvram;
-    FILE *file;
-
-    s->contents = g_malloc0(s->chip_size);
-
-    memory_region_init_io(&s->iomem, OBJECT(s), &nvram_ops, s,
-                          "nvram", s->chip_size);
-    sysbus_init_mmio(dev, &s->iomem);
-
-    /* Read current file */
-    file = fopen(s->filename, "rb");
-    if (file) {
-        /* Read nvram contents */
-        if (fread(s->contents, s->chip_size, 1, file) != 1) {
-            printf("nvram_sysbus_initfn: short read\n");
-        }
-        fclose(file);
-    }
-    nvram_post_load(s, 0);
-
-    return 0;
-}
-
-static Property nvram_sysbus_properties[] = {
-    DEFINE_PROP_UINT32("size", SysBusNvRamState, nvram.chip_size, 0x2000),
-    DEFINE_PROP_STRING("filename", SysBusNvRamState, nvram.filename),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void nvram_sysbus_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = nvram_sysbus_initfn;
-    dc->vmsd = &vmstate_nvram;
-    dc->props = nvram_sysbus_properties;
-}
-
-static const TypeInfo nvram_sysbus_info = {
-    .name          = TYPE_DS1225Y,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(SysBusNvRamState),
-    .class_init    = nvram_sysbus_class_init,
-};
-
-static void nvram_register_types(void)
-{
-    type_register_static(&nvram_sysbus_info);
-}
-
-type_init(nvram_register_types)
diff --git a/qemu/hw/nvram/eeprom93xx.c b/qemu/hw/nvram/eeprom93xx.c
deleted file mode 100644
index 2c16fc23d..000000000
--- a/qemu/hw/nvram/eeprom93xx.c
+++ /dev/null
@@ -1,337 +0,0 @@
-/*
- * QEMU EEPROM 93xx emulation
- *
- * Copyright (c) 2006-2007 Stefan Weil
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-/* Emulation for serial EEPROMs:
- * NMC93C06 256-Bit (16 x 16)
- * NMC93C46 1024-Bit (64 x 16)
- * NMC93C56 2028 Bit (128 x 16)
- * NMC93C66 4096 Bit (256 x 16)
- * Compatible devices include FM93C46 and others.
- *
- * Other drivers use these interface functions:
- * eeprom93xx_new   - add a new EEPROM (with 16, 64 or 256 words)
- * eeprom93xx_free  - destroy EEPROM
- * eeprom93xx_read  - read data from the EEPROM
- * eeprom93xx_write - write data to the EEPROM
- * eeprom93xx_data  - get EEPROM data array for external manipulation
- *
- * Todo list:
- * - No emulation of EEPROM timings.
- */
-
-#include "qemu/osdep.h"
-#include "hw/hw.h"
-#include "hw/nvram/eeprom93xx.h"
-
-/* Debug EEPROM emulation. */
-//~ #define DEBUG_EEPROM
-
-#ifdef DEBUG_EEPROM
-#define logout(fmt, ...) fprintf(stderr, "EEPROM\t%-24s" fmt, __func__, ## __VA_ARGS__)
-#else
-#define logout(fmt, ...) ((void)0)
-#endif
-
-#define EEPROM_INSTANCE  0
-#define OLD_EEPROM_VERSION 20061112
-#define EEPROM_VERSION (OLD_EEPROM_VERSION + 1)
-
-#if 0
-typedef enum {
-  eeprom_read  = 0x80,   /* read register xx */
-  eeprom_write = 0x40,   /* write register xx */
-  eeprom_erase = 0xc0,   /* erase register xx */
-  eeprom_ewen  = 0x30,   /* erase / write enable */
-  eeprom_ewds  = 0x00,   /* erase / write disable */
-  eeprom_eral  = 0x20,   /* erase all registers */
-  eeprom_wral  = 0x10,   /* write all registers */
-  eeprom_amask = 0x0f,
-  eeprom_imask = 0xf0
-} eeprom_instruction_t;
-#endif
-
-#ifdef DEBUG_EEPROM
-static const char *opstring[] = {
-  "extended", "write", "read", "erase"
-};
-#endif
-
-struct _eeprom_t {
-    uint8_t  tick;
-    uint8_t  address;
-    uint8_t  command;
-    uint8_t  writable;
-
-    uint8_t eecs;
-    uint8_t eesk;
-    uint8_t eedo;
-
-    uint8_t  addrbits;
-    uint16_t size;
-    uint16_t data;
-    uint16_t contents[0];
-};
-
-/* Code for saving and restoring of EEPROM state. */
-
-/* Restore an uint16_t from an uint8_t
-   This is a Big hack, but it is how the old state did it.
- */
-
-static int get_uint16_from_uint8(QEMUFile *f, void *pv, size_t size)
-{
-    uint16_t *v = pv;
-    *v = qemu_get_ubyte(f);
-    return 0;
-}
-
-static void put_unused(QEMUFile *f, void *pv, size_t size)
-{
-    fprintf(stderr, "uint16_from_uint8 is used only for backwards compatibility.\n");
-    fprintf(stderr, "Never should be used to write a new state.\n");
-    exit(0);
-}
-
-static const VMStateInfo vmstate_hack_uint16_from_uint8 = {
-    .name = "uint16_from_uint8",
-    .get  = get_uint16_from_uint8,
-    .put  = put_unused,
-};
-
-#define VMSTATE_UINT16_HACK_TEST(_f, _s, _t)                           \
-    VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, uint16_t)
-
-static bool is_old_eeprom_version(void *opaque, int version_id)
-{
-    return version_id == OLD_EEPROM_VERSION;
-}
-
-static const VMStateDescription vmstate_eeprom = {
-    .name = "eeprom",
-    .version_id = EEPROM_VERSION,
-    .minimum_version_id = OLD_EEPROM_VERSION,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT8(tick, eeprom_t),
-        VMSTATE_UINT8(address, eeprom_t),
-        VMSTATE_UINT8(command, eeprom_t),
-        VMSTATE_UINT8(writable, eeprom_t),
-
-        VMSTATE_UINT8(eecs, eeprom_t),
-        VMSTATE_UINT8(eesk, eeprom_t),
-        VMSTATE_UINT8(eedo, eeprom_t),
-
-        VMSTATE_UINT8(addrbits, eeprom_t),
-        VMSTATE_UINT16_HACK_TEST(size, eeprom_t, is_old_eeprom_version),
-        VMSTATE_UNUSED_TEST(is_old_eeprom_version, 1),
-        VMSTATE_UINT16_EQUAL_V(size, eeprom_t, EEPROM_VERSION),
-        VMSTATE_UINT16(data, eeprom_t),
-        VMSTATE_VARRAY_UINT16_UNSAFE(contents, eeprom_t, size, 0,
-                                     vmstate_info_uint16, uint16_t),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-void eeprom93xx_write(eeprom_t *eeprom, int eecs, int eesk, int eedi)
-{
-    uint8_t tick = eeprom->tick;
-    uint8_t eedo = eeprom->eedo;
-    uint16_t address = eeprom->address;
-    uint8_t command = eeprom->command;
-
-    logout("CS=%u SK=%u DI=%u DO=%u, tick = %u\n",
-           eecs, eesk, eedi, eedo, tick);
-
-    if (!eeprom->eecs && eecs) {
-        /* Start chip select cycle. */
-        logout("Cycle start, waiting for 1st start bit (0)\n");
-        tick = 0;
-        command = 0x0;
-        address = 0x0;
-    } else if (eeprom->eecs && !eecs) {
-        /* End chip select cycle. This triggers write / erase. */
-        if (eeprom->writable) {
-            uint8_t subcommand = address >> (eeprom->addrbits - 2);
-            if (command == 0 && subcommand == 2) {
-                /* Erase all. */
-                for (address = 0; address < eeprom->size; address++) {
-                    eeprom->contents[address] = 0xffff;
-                }
-            } else if (command == 3) {
-                /* Erase word. */
-                eeprom->contents[address] = 0xffff;
-            } else if (tick >= 2 + 2 + eeprom->addrbits + 16) {
-                if (command == 1) {
-                    /* Write word. */
-                    eeprom->contents[address] &= eeprom->data;
-                } else if (command == 0 && subcommand == 1) {
-                    /* Write all. */
-                    for (address = 0; address < eeprom->size; address++) {
-                        eeprom->contents[address] &= eeprom->data;
-                    }
-                }
-            }
-        }
-        /* Output DO is tristate, read results in 1. */
-        eedo = 1;
-    } else if (eecs && !eeprom->eesk && eesk) {
-        /* Raising edge of clock shifts data in. */
-        if (tick == 0) {
-            /* Wait for 1st start bit. */
-            if (eedi == 0) {
-                logout("Got correct 1st start bit, waiting for 2nd start bit (1)\n");
-                tick++;
-            } else {
-                logout("wrong 1st start bit (is 1, should be 0)\n");
-                tick = 2;
-                //~ assert(!"wrong start bit");
-            }
-        } else if (tick == 1) {
-            /* Wait for 2nd start bit. */
-            if (eedi != 0) {
-                logout("Got correct 2nd start bit, getting command + address\n");
-                tick++;
-            } else {
-                logout("1st start bit is longer than needed\n");
-            }
-        } else if (tick < 2 + 2) {
-            /* Got 2 start bits, transfer 2 opcode bits. */
-            tick++;
-            command <<= 1;
-            if (eedi) {
-                command += 1;
-            }
-        } else if (tick < 2 + 2 + eeprom->addrbits) {
-            /* Got 2 start bits and 2 opcode bits, transfer all address bits. */
-            tick++;
-            address = ((address << 1) | eedi);
-            if (tick == 2 + 2 + eeprom->addrbits) {
-                logout("%s command, address = 0x%02x (value 0x%04x)\n",
-                       opstring[command], address, eeprom->contents[address]);
-                if (command == 2) {
-                    eedo = 0;
-                }
-                address = address % eeprom->size;
-                if (command == 0) {
-                    /* Command code in upper 2 bits of address. */
-                    switch (address >> (eeprom->addrbits - 2)) {
-                    case 0:
-                        logout("write disable command\n");
-                        eeprom->writable = 0;
-                        break;
-                    case 1:
-                        logout("write all command\n");
-                        break;
-                    case 2:
-                        logout("erase all command\n");
-                        break;
-                    case 3:
-                        logout("write enable command\n");
-                        eeprom->writable = 1;
-                        break;
-                    }
-                } else {
-                    /* Read, write or erase word. */
-                    eeprom->data = eeprom->contents[address];
-                }
-            }
-        } else if (tick < 2 + 2 + eeprom->addrbits + 16) {
-            /* Transfer 16 data bits. */
-            tick++;
-            if (command == 2) {
-                /* Read word. */
-                eedo = ((eeprom->data & 0x8000) != 0);
-            }
-            eeprom->data <<= 1;
-            eeprom->data += eedi;
-        } else {
-            logout("additional unneeded tick, not processed\n");
-        }
-    }
-    /* Save status of EEPROM. */
-    eeprom->tick = tick;
-    eeprom->eecs = eecs;
-    eeprom->eesk = eesk;
-    eeprom->eedo = eedo;
-    eeprom->address = address;
-    eeprom->command = command;
-}
-
-uint16_t eeprom93xx_read(eeprom_t *eeprom)
-{
-    /* Return status of pin DO (0 or 1). */
-    logout("CS=%u DO=%u\n", eeprom->eecs, eeprom->eedo);
-    return eeprom->eedo;
-}
-
-#if 0
-void eeprom93xx_reset(eeprom_t *eeprom)
-{
-    /* prepare eeprom */
-    logout("eeprom = 0x%p\n", eeprom);
-    eeprom->tick = 0;
-    eeprom->command = 0;
-}
-#endif
-
-eeprom_t *eeprom93xx_new(DeviceState *dev, uint16_t nwords)
-{
-    /* Add a new EEPROM (with 16, 64 or 256 words). */
-    eeprom_t *eeprom;
-    uint8_t addrbits;
-
-    switch (nwords) {
-    case 16:
-    case 64:
-        addrbits = 6;
-        break;
-    case 128:
-    case 256:
-        addrbits = 8;
-        break;
-    default:
-        assert(!"Unsupported EEPROM size, fallback to 64 words!");
-        nwords = 64;
-        addrbits = 6;
-    }
-
-    eeprom = (eeprom_t *)g_malloc0(sizeof(*eeprom) + nwords * 2);
-    eeprom->size = nwords;
-    eeprom->addrbits = addrbits;
-    /* Output DO is tristate, read results in 1. */
-    eeprom->eedo = 1;
-    logout("eeprom = 0x%p, nwords = %u\n", eeprom, nwords);
-    vmstate_register(dev, 0, &vmstate_eeprom, eeprom);
-    return eeprom;
-}
-
-void eeprom93xx_free(DeviceState *dev, eeprom_t *eeprom)
-{
-    /* Destroy EEPROM. */
-    logout("eeprom = 0x%p\n", eeprom);
-    vmstate_unregister(dev, &vmstate_eeprom, eeprom);
-    g_free(eeprom);
-}
-
-uint16_t *eeprom93xx_data(eeprom_t *eeprom)
-{
-    /* Get EEPROM data array. */
-    return &eeprom->contents[0];
-}
-
-/* eof */
diff --git a/qemu/hw/nvram/fw_cfg.c b/qemu/hw/nvram/fw_cfg.c
deleted file mode 100644
index 999f48028..000000000
--- a/qemu/hw/nvram/fw_cfg.c
+++ /dev/null
@@ -1,1099 +0,0 @@
-/*
- * QEMU Firmware configuration device emulation
- *
- * Copyright (c) 2008 Gleb Natapov
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu/osdep.h"
-#include "hw/hw.h"
-#include "sysemu/sysemu.h"
-#include "sysemu/dma.h"
-#include "hw/isa/isa.h"
-#include "hw/nvram/fw_cfg.h"
-#include "hw/sysbus.h"
-#include "hw/boards.h"
-#include "trace.h"
-#include "qemu/error-report.h"
-#include "qemu/config-file.h"
-#include "qemu/cutils.h"
-
-#define FW_CFG_NAME "fw_cfg"
-#define FW_CFG_PATH "/machine/" FW_CFG_NAME
-
-#define TYPE_FW_CFG     "fw_cfg"
-#define TYPE_FW_CFG_IO  "fw_cfg_io"
-#define TYPE_FW_CFG_MEM "fw_cfg_mem"
-
-#define FW_CFG(obj)     OBJECT_CHECK(FWCfgState,    (obj), TYPE_FW_CFG)
-#define FW_CFG_IO(obj)  OBJECT_CHECK(FWCfgIoState,  (obj), TYPE_FW_CFG_IO)
-#define FW_CFG_MEM(obj) OBJECT_CHECK(FWCfgMemState, (obj), TYPE_FW_CFG_MEM)
-
-/* FW_CFG_VERSION bits */
-#define FW_CFG_VERSION      0x01
-#define FW_CFG_VERSION_DMA  0x02
-
-/* FW_CFG_DMA_CONTROL bits */
-#define FW_CFG_DMA_CTL_ERROR   0x01
-#define FW_CFG_DMA_CTL_READ    0x02
-#define FW_CFG_DMA_CTL_SKIP    0x04
-#define FW_CFG_DMA_CTL_SELECT  0x08
-
-#define FW_CFG_DMA_SIGNATURE 0x51454d5520434647ULL /* "QEMU CFG" */
-
-typedef struct FWCfgEntry {
-    uint32_t len;
-    uint8_t *data;
-    void *callback_opaque;
-    FWCfgReadCallback read_callback;
-} FWCfgEntry;
-
-struct FWCfgState {
-    /*< private >*/
-    SysBusDevice parent_obj;
-    /*< public >*/
-
-    FWCfgEntry entries[2][FW_CFG_MAX_ENTRY];
-    int entry_order[FW_CFG_MAX_ENTRY];
-    FWCfgFiles *files;
-    uint16_t cur_entry;
-    uint32_t cur_offset;
-    Notifier machine_ready;
-
-    int fw_cfg_order_override;
-
-    bool dma_enabled;
-    dma_addr_t dma_addr;
-    AddressSpace *dma_as;
-    MemoryRegion dma_iomem;
-};
-
-struct FWCfgIoState {
-    /*< private >*/
-    FWCfgState parent_obj;
-    /*< public >*/
-
-    MemoryRegion comb_iomem;
-    uint32_t iobase, dma_iobase;
-};
-
-struct FWCfgMemState {
-    /*< private >*/
-    FWCfgState parent_obj;
-    /*< public >*/
-
-    MemoryRegion ctl_iomem, data_iomem;
-    uint32_t data_width;
-    MemoryRegionOps wide_data_ops;
-};
-
-#define JPG_FILE 0
-#define BMP_FILE 1
-
-static char *read_splashfile(char *filename, gsize *file_sizep,
-                             int *file_typep)
-{
-    GError *err = NULL;
-    gboolean res;
-    gchar *content;
-    int file_type;
-    unsigned int filehead;
-    int bmp_bpp;
-
-    res = g_file_get_contents(filename, &content, file_sizep, &err);
-    if (res == FALSE) {
-        error_report("failed to read splash file '%s'", filename);
-        g_error_free(err);
-        return NULL;
-    }
-
-    /* check file size */
-    if (*file_sizep < 30) {
-        goto error;
-    }
-
-    /* check magic ID */
-    filehead = ((content[0] & 0xff) + (content[1] << 8)) & 0xffff;
-    if (filehead == 0xd8ff) {
-        file_type = JPG_FILE;
-    } else if (filehead == 0x4d42) {
-        file_type = BMP_FILE;
-    } else {
-        goto error;
-    }
-
-    /* check BMP bpp */
-    if (file_type == BMP_FILE) {
-        bmp_bpp = (content[28] + (content[29] << 8)) & 0xffff;
-        if (bmp_bpp != 24) {
-            goto error;
-        }
-    }
-
-    /* return values */
-    *file_typep = file_type;
-
-    return content;
-
-error:
-    error_report("splash file '%s' format not recognized; must be JPEG "
-                 "or 24 bit BMP", filename);
-    g_free(content);
-    return NULL;
-}
-
-static void fw_cfg_bootsplash(FWCfgState *s)
-{
-    int boot_splash_time = -1;
-    const char *boot_splash_filename = NULL;
-    char *p;
-    char *filename, *file_data;
-    gsize file_size;
-    int file_type;
-    const char *temp;
-
-    /* get user configuration */
-    QemuOptsList *plist = qemu_find_opts("boot-opts");
-    QemuOpts *opts = QTAILQ_FIRST(&plist->head);
-    if (opts != NULL) {
-        temp = qemu_opt_get(opts, "splash");
-        if (temp != NULL) {
-            boot_splash_filename = temp;
-        }
-        temp = qemu_opt_get(opts, "splash-time");
-        if (temp != NULL) {
-            p = (char *)temp;
-            boot_splash_time = strtol(p, (char **)&p, 10);
-        }
-    }
-
-    /* insert splash time if user configurated */
-    if (boot_splash_time >= 0) {
-        /* validate the input */
-        if (boot_splash_time > 0xffff) {
-            error_report("splash time is big than 65535, force it to 65535.");
-            boot_splash_time = 0xffff;
-        }
-        /* use little endian format */
-        qemu_extra_params_fw[0] = (uint8_t)(boot_splash_time & 0xff);
-        qemu_extra_params_fw[1] = (uint8_t)((boot_splash_time >> 8) & 0xff);
-        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw, 2);
-    }
-
-    /* insert splash file if user configurated */
-    if (boot_splash_filename != NULL) {
-        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, boot_splash_filename);
-        if (filename == NULL) {
-            error_report("failed to find file '%s'.", boot_splash_filename);
-            return;
-        }
-
-        /* loading file data */
-        file_data = read_splashfile(filename, &file_size, &file_type);
-        if (file_data == NULL) {
-            g_free(filename);
-            return;
-        }
-        g_free(boot_splash_filedata);
-        boot_splash_filedata = (uint8_t *)file_data;
-        boot_splash_filedata_size = file_size;
-
-        /* insert data */
-        if (file_type == JPG_FILE) {
-            fw_cfg_add_file(s, "bootsplash.jpg",
-                    boot_splash_filedata, boot_splash_filedata_size);
-        } else {
-            fw_cfg_add_file(s, "bootsplash.bmp",
-                    boot_splash_filedata, boot_splash_filedata_size);
-        }
-        g_free(filename);
-    }
-}
-
-static void fw_cfg_reboot(FWCfgState *s)
-{
-    int reboot_timeout = -1;
-    char *p;
-    const char *temp;
-
-    /* get user configuration */
-    QemuOptsList *plist = qemu_find_opts("boot-opts");
-    QemuOpts *opts = QTAILQ_FIRST(&plist->head);
-    if (opts != NULL) {
-        temp = qemu_opt_get(opts, "reboot-timeout");
-        if (temp != NULL) {
-            p = (char *)temp;
-            reboot_timeout = strtol(p, (char **)&p, 10);
-        }
-    }
-    /* validate the input */
-    if (reboot_timeout > 0xffff) {
-        error_report("reboot timeout is larger than 65535, force it to 65535.");
-        reboot_timeout = 0xffff;
-    }
-    fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&reboot_timeout, 4), 4);
-}
-
-static void fw_cfg_write(FWCfgState *s, uint8_t value)
-{
-    /* nothing, write support removed in QEMU v2.4+ */
-}
-
-static int fw_cfg_select(FWCfgState *s, uint16_t key)
-{
-    int arch, ret;
-    FWCfgEntry *e;
-
-    s->cur_offset = 0;
-    if ((key & FW_CFG_ENTRY_MASK) >= FW_CFG_MAX_ENTRY) {
-        s->cur_entry = FW_CFG_INVALID;
-        ret = 0;
-    } else {
-        s->cur_entry = key;
-        ret = 1;
-        /* entry successfully selected, now run callback if present */
-        arch = !!(key & FW_CFG_ARCH_LOCAL);
-        e = &s->entries[arch][key & FW_CFG_ENTRY_MASK];
-        if (e->read_callback) {
-            e->read_callback(e->callback_opaque);
-        }
-    }
-
-    trace_fw_cfg_select(s, key, ret);
-    return ret;
-}
-
-static uint64_t fw_cfg_data_read(void *opaque, hwaddr addr, unsigned size)
-{
-    FWCfgState *s = opaque;
-    int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
-    FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
-                    &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
-    uint64_t value = 0;
-
-    assert(size > 0 && size <= sizeof(value));
-    if (s->cur_entry != FW_CFG_INVALID && e->data && s->cur_offset < e->len) {
-        /* The least significant 'size' bytes of the return value are
-         * expected to contain a string preserving portion of the item
-         * data, padded with zeros on the right in case we run out early.
-         * In technical terms, we're composing the host-endian representation
-         * of the big endian interpretation of the fw_cfg string.
-         */
-        do {
-            value = (value << 8) | e->data[s->cur_offset++];
-        } while (--size && s->cur_offset < e->len);
-        /* If size is still not zero, we *did* run out early, so continue
-         * left-shifting, to add the appropriate number of padding zeros
-         * on the right.
-         */
-        value <<= 8 * size;
-    }
-
-    trace_fw_cfg_read(s, value);
-    return value;
-}
-
-static void fw_cfg_data_mem_write(void *opaque, hwaddr addr,
-                                  uint64_t value, unsigned size)
-{
-    FWCfgState *s = opaque;
-    unsigned i = size;
-
-    do {
-        fw_cfg_write(s, value >> (8 * --i));
-    } while (i);
-}
-
-static void fw_cfg_dma_transfer(FWCfgState *s)
-{
-    dma_addr_t len;
-    FWCfgDmaAccess dma;
-    int arch;
-    FWCfgEntry *e;
-    int read;
-    dma_addr_t dma_addr;
-
-    /* Reset the address before the next access */
-    dma_addr = s->dma_addr;
-    s->dma_addr = 0;
-
-    if (dma_memory_read(s->dma_as, dma_addr, &dma, sizeof(dma))) {
-        stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
-                   FW_CFG_DMA_CTL_ERROR);
-        return;
-    }
-
-    dma.address = be64_to_cpu(dma.address);
-    dma.length = be32_to_cpu(dma.length);
-    dma.control = be32_to_cpu(dma.control);
-
-    if (dma.control & FW_CFG_DMA_CTL_SELECT) {
-        fw_cfg_select(s, dma.control >> 16);
-    }
-
-    arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
-    e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
-        &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
-
-    if (dma.control & FW_CFG_DMA_CTL_READ) {
-        read = 1;
-    } else if (dma.control & FW_CFG_DMA_CTL_SKIP) {
-        read = 0;
-    } else {
-        dma.length = 0;
-    }
-
-    dma.control = 0;
-
-    while (dma.length > 0 && !(dma.control & FW_CFG_DMA_CTL_ERROR)) {
-        if (s->cur_entry == FW_CFG_INVALID || !e->data ||
-                                s->cur_offset >= e->len) {
-            len = dma.length;
-
-            /* If the access is not a read access, it will be a skip access,
-             * tested before.
-             */
-            if (read) {
-                if (dma_memory_set(s->dma_as, dma.address, 0, len)) {
-                    dma.control |= FW_CFG_DMA_CTL_ERROR;
-                }
-            }
-
-        } else {
-            if (dma.length <= (e->len - s->cur_offset)) {
-                len = dma.length;
-            } else {
-                len = (e->len - s->cur_offset);
-            }
-
-            /* If the access is not a read access, it will be a skip access,
-             * tested before.
-             */
-            if (read) {
-                if (dma_memory_write(s->dma_as, dma.address,
-                                    &e->data[s->cur_offset], len)) {
-                    dma.control |= FW_CFG_DMA_CTL_ERROR;
-                }
-            }
-
-            s->cur_offset += len;
-        }
-
-        dma.address += len;
-        dma.length  -= len;
-
-    }
-
-    stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
-                dma.control);
-
-    trace_fw_cfg_read(s, 0);
-}
-
-static uint64_t fw_cfg_dma_mem_read(void *opaque, hwaddr addr,
-                                    unsigned size)
-{
-    /* Return a signature value (and handle various read sizes) */
-    return extract64(FW_CFG_DMA_SIGNATURE, (8 - addr - size) * 8, size * 8);
-}
-
-static void fw_cfg_dma_mem_write(void *opaque, hwaddr addr,
-                                 uint64_t value, unsigned size)
-{
-    FWCfgState *s = opaque;
-
-    if (size == 4) {
-        if (addr == 0) {
-            /* FWCfgDmaAccess high address */
-            s->dma_addr = value << 32;
-        } else if (addr == 4) {
-            /* FWCfgDmaAccess low address */
-            s->dma_addr |= value;
-            fw_cfg_dma_transfer(s);
-        }
-    } else if (size == 8 && addr == 0) {
-        s->dma_addr = value;
-        fw_cfg_dma_transfer(s);
-    }
-}
-
-static bool fw_cfg_dma_mem_valid(void *opaque, hwaddr addr,
-                                  unsigned size, bool is_write)
-{
-    return !is_write || ((size == 4 && (addr == 0 || addr == 4)) ||
-                         (size == 8 && addr == 0));
-}
-
-static bool fw_cfg_data_mem_valid(void *opaque, hwaddr addr,
-                                  unsigned size, bool is_write)
-{
-    return addr == 0;
-}
-
-static void fw_cfg_ctl_mem_write(void *opaque, hwaddr addr,
-                                 uint64_t value, unsigned size)
-{
-    fw_cfg_select(opaque, (uint16_t)value);
-}
-
-static bool fw_cfg_ctl_mem_valid(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write)
-{
-    return is_write && size == 2;
-}
-
-static void fw_cfg_comb_write(void *opaque, hwaddr addr,
-                              uint64_t value, unsigned size)
-{
-    switch (size) {
-    case 1:
-        fw_cfg_write(opaque, (uint8_t)value);
-        break;
-    case 2:
-        fw_cfg_select(opaque, (uint16_t)value);
-        break;
-    }
-}
-
-static bool fw_cfg_comb_valid(void *opaque, hwaddr addr,
-                                  unsigned size, bool is_write)
-{
-    return (size == 1) || (is_write && size == 2);
-}
-
-static const MemoryRegionOps fw_cfg_ctl_mem_ops = {
-    .write = fw_cfg_ctl_mem_write,
-    .endianness = DEVICE_BIG_ENDIAN,
-    .valid.accepts = fw_cfg_ctl_mem_valid,
-};
-
-static const MemoryRegionOps fw_cfg_data_mem_ops = {
-    .read = fw_cfg_data_read,
-    .write = fw_cfg_data_mem_write,
-    .endianness = DEVICE_BIG_ENDIAN,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 1,
-        .accepts = fw_cfg_data_mem_valid,
-    },
-};
-
-static const MemoryRegionOps fw_cfg_comb_mem_ops = {
-    .read = fw_cfg_data_read,
-    .write = fw_cfg_comb_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-    .valid.accepts = fw_cfg_comb_valid,
-};
-
-static const MemoryRegionOps fw_cfg_dma_mem_ops = {
-    .read = fw_cfg_dma_mem_read,
-    .write = fw_cfg_dma_mem_write,
-    .endianness = DEVICE_BIG_ENDIAN,
-    .valid.accepts = fw_cfg_dma_mem_valid,
-    .valid.max_access_size = 8,
-    .impl.max_access_size = 8,
-};
-
-static void fw_cfg_reset(DeviceState *d)
-{
-    FWCfgState *s = FW_CFG(d);
-
-    /* we never register a read callback for FW_CFG_SIGNATURE */
-    fw_cfg_select(s, FW_CFG_SIGNATURE);
-}
-
-/* Save restore 32 bit int as uint16_t
-   This is a Big hack, but it is how the old state did it.
-   Or we broke compatibility in the state, or we can't use struct tm
- */
-
-static int get_uint32_as_uint16(QEMUFile *f, void *pv, size_t size)
-{
-    uint32_t *v = pv;
-    *v = qemu_get_be16(f);
-    return 0;
-}
-
-static void put_unused(QEMUFile *f, void *pv, size_t size)
-{
-    fprintf(stderr, "uint32_as_uint16 is only used for backward compatibility.\n");
-    fprintf(stderr, "This functions shouldn't be called.\n");
-}
-
-static const VMStateInfo vmstate_hack_uint32_as_uint16 = {
-    .name = "int32_as_uint16",
-    .get  = get_uint32_as_uint16,
-    .put  = put_unused,
-};
-
-#define VMSTATE_UINT16_HACK(_f, _s, _t)                                    \
-    VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint32_as_uint16, uint32_t)
-
-
-static bool is_version_1(void *opaque, int version_id)
-{
-    return version_id == 1;
-}
-
-static bool fw_cfg_dma_enabled(void *opaque)
-{
-    FWCfgState *s = opaque;
-
-    return s->dma_enabled;
-}
-
-static const VMStateDescription vmstate_fw_cfg_dma = {
-    .name = "fw_cfg/dma",
-    .needed = fw_cfg_dma_enabled,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT64(dma_addr, FWCfgState),
-        VMSTATE_END_OF_LIST()
-    },
-};
-
-static const VMStateDescription vmstate_fw_cfg = {
-    .name = "fw_cfg",
-    .version_id = 2,
-    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT16(cur_entry, FWCfgState),
-        VMSTATE_UINT16_HACK(cur_offset, FWCfgState, is_version_1),
-        VMSTATE_UINT32_V(cur_offset, FWCfgState, 2),
-        VMSTATE_END_OF_LIST()
-    },
-    .subsections = (const VMStateDescription*[]) {
-        &vmstate_fw_cfg_dma,
-        NULL,
-    }
-};
-
-static void fw_cfg_add_bytes_read_callback(FWCfgState *s, uint16_t key,
-                                           FWCfgReadCallback callback,
-                                           void *callback_opaque,
-                                           void *data, size_t len)
-{
-    int arch = !!(key & FW_CFG_ARCH_LOCAL);
-
-    key &= FW_CFG_ENTRY_MASK;
-
-    assert(key < FW_CFG_MAX_ENTRY && len < UINT32_MAX);
-    assert(s->entries[arch][key].data == NULL); /* avoid key conflict */
-
-    s->entries[arch][key].data = data;
-    s->entries[arch][key].len = (uint32_t)len;
-    s->entries[arch][key].read_callback = callback;
-    s->entries[arch][key].callback_opaque = callback_opaque;
-}
-
-static void *fw_cfg_modify_bytes_read(FWCfgState *s, uint16_t key,
-                                              void *data, size_t len)
-{
-    void *ptr;
-    int arch = !!(key & FW_CFG_ARCH_LOCAL);
-
-    key &= FW_CFG_ENTRY_MASK;
-
-    assert(key < FW_CFG_MAX_ENTRY && len < UINT32_MAX);
-
-    /* return the old data to the function caller, avoid memory leak */
-    ptr = s->entries[arch][key].data;
-    s->entries[arch][key].data = data;
-    s->entries[arch][key].len = len;
-    s->entries[arch][key].callback_opaque = NULL;
-
-    return ptr;
-}
-
-void fw_cfg_add_bytes(FWCfgState *s, uint16_t key, void *data, size_t len)
-{
-    fw_cfg_add_bytes_read_callback(s, key, NULL, NULL, data, len);
-}
-
-void fw_cfg_add_string(FWCfgState *s, uint16_t key, const char *value)
-{
-    size_t sz = strlen(value) + 1;
-
-    fw_cfg_add_bytes(s, key, g_memdup(value, sz), sz);
-}
-
-void fw_cfg_add_i16(FWCfgState *s, uint16_t key, uint16_t value)
-{
-    uint16_t *copy;
-
-    copy = g_malloc(sizeof(value));
-    *copy = cpu_to_le16(value);
-    fw_cfg_add_bytes(s, key, copy, sizeof(value));
-}
-
-void fw_cfg_modify_i16(FWCfgState *s, uint16_t key, uint16_t value)
-{
-    uint16_t *copy, *old;
-
-    copy = g_malloc(sizeof(value));
-    *copy = cpu_to_le16(value);
-    old = fw_cfg_modify_bytes_read(s, key, copy, sizeof(value));
-    g_free(old);
-}
-
-void fw_cfg_add_i32(FWCfgState *s, uint16_t key, uint32_t value)
-{
-    uint32_t *copy;
-
-    copy = g_malloc(sizeof(value));
-    *copy = cpu_to_le32(value);
-    fw_cfg_add_bytes(s, key, copy, sizeof(value));
-}
-
-void fw_cfg_add_i64(FWCfgState *s, uint16_t key, uint64_t value)
-{
-    uint64_t *copy;
-
-    copy = g_malloc(sizeof(value));
-    *copy = cpu_to_le64(value);
-    fw_cfg_add_bytes(s, key, copy, sizeof(value));
-}
-
-void fw_cfg_set_order_override(FWCfgState *s, int order)
-{
-    assert(s->fw_cfg_order_override == 0);
-    s->fw_cfg_order_override = order;
-}
-
-void fw_cfg_reset_order_override(FWCfgState *s)
-{
-    assert(s->fw_cfg_order_override != 0);
-    s->fw_cfg_order_override = 0;
-}
-
-/*
- * This is the legacy order list.  For legacy systems, files are in
- * the fw_cfg in the order defined below, by the "order" value.  Note
- * that some entries (VGA ROMs, NIC option ROMS, etc.) go into a
- * specific area, but there may be more than one and they occur in the
- * order that the user specifies them on the command line.  Those are
- * handled in a special manner, using the order override above.
- *
- * For non-legacy, the files are sorted by filename to avoid this kind
- * of complexity in the future.
- *
- * This is only for x86, other arches don't implement versioning so
- * they won't set legacy mode.
- */
-static struct {
-    const char *name;
-    int order;
-} fw_cfg_order[] = {
-    { "etc/boot-menu-wait", 10 },
-    { "bootsplash.jpg", 11 },
-    { "bootsplash.bmp", 12 },
-    { "etc/boot-fail-wait", 15 },
-    { "etc/smbios/smbios-tables", 20 },
-    { "etc/smbios/smbios-anchor", 30 },
-    { "etc/e820", 40 },
-    { "etc/reserved-memory-end", 50 },
-    { "genroms/kvmvapic.bin", 55 },
-    { "genroms/linuxboot.bin", 60 },
-    { }, /* VGA ROMs from pc_vga_init come here, 70. */
-    { }, /* NIC option ROMs from pc_nic_init come here, 80. */
-    { "etc/system-states", 90 },
-    { }, /* User ROMs come here, 100. */
-    { }, /* Device FW comes here, 110. */
-    { "etc/extra-pci-roots", 120 },
-    { "etc/acpi/tables", 130 },
-    { "etc/table-loader", 140 },
-    { "etc/tpm/log", 150 },
-    { "etc/acpi/rsdp", 160 },
-    { "bootorder", 170 },
-
-#define FW_CFG_ORDER_OVERRIDE_LAST 200
-};
-
-static int get_fw_cfg_order(FWCfgState *s, const char *name)
-{
-    int i;
-
-    if (s->fw_cfg_order_override > 0)
-	return s->fw_cfg_order_override;
-
-    for (i = 0; i < ARRAY_SIZE(fw_cfg_order); i++) {
-	if (fw_cfg_order[i].name == NULL)
-	    continue;
-	if (strcmp(name, fw_cfg_order[i].name) == 0)
-	    return fw_cfg_order[i].order;
-    }
-    /* Stick unknown stuff at the end. */
-    error_report("warning: Unknown firmware file in legacy mode: %s\n", name);
-    return FW_CFG_ORDER_OVERRIDE_LAST;
-}
-
-void fw_cfg_add_file_callback(FWCfgState *s,  const char *filename,
-                              FWCfgReadCallback callback, void *callback_opaque,
-                              void *data, size_t len)
-{
-    int i, index, count;
-    size_t dsize;
-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
-    int order = 0;
-
-    if (!s->files) {
-        dsize = sizeof(uint32_t) + sizeof(FWCfgFile) * FW_CFG_FILE_SLOTS;
-        s->files = g_malloc0(dsize);
-        fw_cfg_add_bytes(s, FW_CFG_FILE_DIR, s->files, dsize);
-    }
-
-    count = be32_to_cpu(s->files->count);
-    assert(count < FW_CFG_FILE_SLOTS);
-
-    /* Find the insertion point. */
-    if (mc->legacy_fw_cfg_order) {
-        /*
-         * Sort by order. For files with the same order, we keep them
-         * in the sequence in which they were added.
-         */
-        order = get_fw_cfg_order(s, filename);
-        for (index = count;
-             index > 0 && order < s->entry_order[index - 1];
-             index--);
-    } else {
-        /* Sort by file name. */
-        for (index = count;
-             index > 0 && strcmp(filename, s->files->f[index - 1].name) < 0;
-             index--);
-    }
-
-    /*
-     * Move all the entries from the index point and after down one
-     * to create a slot for the new entry.  Because calculations are
-     * being done with the index, make it so that "i" is the current
-     * index and "i - 1" is the one being copied from, thus the
-     * unusual start and end in the for statement.
-     */
-    for (i = count + 1; i > index; i--) {
-        s->files->f[i] = s->files->f[i - 1];
-        s->files->f[i].select = cpu_to_be16(FW_CFG_FILE_FIRST + i);
-        s->entries[0][FW_CFG_FILE_FIRST + i] =
-            s->entries[0][FW_CFG_FILE_FIRST + i - 1];
-        s->entry_order[i] = s->entry_order[i - 1];
-    }
-
-    memset(&s->files->f[index], 0, sizeof(FWCfgFile));
-    memset(&s->entries[0][FW_CFG_FILE_FIRST + index], 0, sizeof(FWCfgEntry));
-
-    pstrcpy(s->files->f[index].name, sizeof(s->files->f[index].name), filename);
-    for (i = 0; i <= count; i++) {
-        if (i != index &&
-            strcmp(s->files->f[index].name, s->files->f[i].name) == 0) {
-            error_report("duplicate fw_cfg file name: %s",
-                         s->files->f[index].name);
-            exit(1);
-        }
-    }
-
-    fw_cfg_add_bytes_read_callback(s, FW_CFG_FILE_FIRST + index,
-                                   callback, callback_opaque, data, len);
-
-    s->files->f[index].size   = cpu_to_be32(len);
-    s->files->f[index].select = cpu_to_be16(FW_CFG_FILE_FIRST + index);
-    s->entry_order[index] = order;
-    trace_fw_cfg_add_file(s, index, s->files->f[index].name, len);
-
-    s->files->count = cpu_to_be32(count+1);
-}
-
-void fw_cfg_add_file(FWCfgState *s,  const char *filename,
-                     void *data, size_t len)
-{
-    fw_cfg_add_file_callback(s, filename, NULL, NULL, data, len);
-}
-
-void *fw_cfg_modify_file(FWCfgState *s, const char *filename,
-                        void *data, size_t len)
-{
-    int i, index;
-    void *ptr = NULL;
-
-    assert(s->files);
-
-    index = be32_to_cpu(s->files->count);
-    assert(index < FW_CFG_FILE_SLOTS);
-
-    for (i = 0; i < index; i++) {
-        if (strcmp(filename, s->files->f[i].name) == 0) {
-            ptr = fw_cfg_modify_bytes_read(s, FW_CFG_FILE_FIRST + i,
-                                           data, len);
-            s->files->f[i].size   = cpu_to_be32(len);
-            return ptr;
-        }
-    }
-    /* add new one */
-    fw_cfg_add_file_callback(s, filename, NULL, NULL, data, len);
-    return NULL;
-}
-
-static void fw_cfg_machine_reset(void *opaque)
-{
-    void *ptr;
-    size_t len;
-    FWCfgState *s = opaque;
-    char *bootindex = get_boot_devices_list(&len, false);
-
-    ptr = fw_cfg_modify_file(s, "bootorder", (uint8_t *)bootindex, len);
-    g_free(ptr);
-}
-
-static void fw_cfg_machine_ready(struct Notifier *n, void *data)
-{
-    FWCfgState *s = container_of(n, FWCfgState, machine_ready);
-    qemu_register_reset(fw_cfg_machine_reset, s);
-}
-
-
-
-static void fw_cfg_init1(DeviceState *dev)
-{
-    FWCfgState *s = FW_CFG(dev);
-
-    assert(!object_resolve_path(FW_CFG_PATH, NULL));
-
-    object_property_add_child(qdev_get_machine(), FW_CFG_NAME, OBJECT(s), NULL);
-
-    qdev_init_nofail(dev);
-
-    fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)"QEMU", 4);
-    fw_cfg_add_bytes(s, FW_CFG_UUID, qemu_uuid, 16);
-    fw_cfg_add_i16(s, FW_CFG_NOGRAPHIC, (uint16_t)(display_type == DT_NOGRAPHIC));
-    fw_cfg_add_i16(s, FW_CFG_NB_CPUS, (uint16_t)smp_cpus);
-    fw_cfg_add_i16(s, FW_CFG_BOOT_MENU, (uint16_t)boot_menu);
-    fw_cfg_bootsplash(s);
-    fw_cfg_reboot(s);
-
-    s->machine_ready.notify = fw_cfg_machine_ready;
-    qemu_add_machine_init_done_notifier(&s->machine_ready);
-}
-
-FWCfgState *fw_cfg_init_io_dma(uint32_t iobase, uint32_t dma_iobase,
-                                AddressSpace *dma_as)
-{
-    DeviceState *dev;
-    FWCfgState *s;
-    uint32_t version = FW_CFG_VERSION;
-    bool dma_requested = dma_iobase && dma_as;
-
-    dev = qdev_create(NULL, TYPE_FW_CFG_IO);
-    qdev_prop_set_uint32(dev, "iobase", iobase);
-    qdev_prop_set_uint32(dev, "dma_iobase", dma_iobase);
-    if (!dma_requested) {
-        qdev_prop_set_bit(dev, "dma_enabled", false);
-    }
-
-    fw_cfg_init1(dev);
-    s = FW_CFG(dev);
-
-    if (s->dma_enabled) {
-        /* 64 bits for the address field */
-        s->dma_as = dma_as;
-        s->dma_addr = 0;
-
-        version |= FW_CFG_VERSION_DMA;
-    }
-
-    fw_cfg_add_i32(s, FW_CFG_ID, version);
-
-    return s;
-}
-
-FWCfgState *fw_cfg_init_io(uint32_t iobase)
-{
-    return fw_cfg_init_io_dma(iobase, 0, NULL);
-}
-
-FWCfgState *fw_cfg_init_mem_wide(hwaddr ctl_addr,
-                                 hwaddr data_addr, uint32_t data_width,
-                                 hwaddr dma_addr, AddressSpace *dma_as)
-{
-    DeviceState *dev;
-    SysBusDevice *sbd;
-    FWCfgState *s;
-    uint32_t version = FW_CFG_VERSION;
-    bool dma_requested = dma_addr && dma_as;
-
-    dev = qdev_create(NULL, TYPE_FW_CFG_MEM);
-    qdev_prop_set_uint32(dev, "data_width", data_width);
-    if (!dma_requested) {
-        qdev_prop_set_bit(dev, "dma_enabled", false);
-    }
-
-    fw_cfg_init1(dev);
-
-    sbd = SYS_BUS_DEVICE(dev);
-    sysbus_mmio_map(sbd, 0, ctl_addr);
-    sysbus_mmio_map(sbd, 1, data_addr);
-
-    s = FW_CFG(dev);
-
-    if (s->dma_enabled) {
-        s->dma_as = dma_as;
-        s->dma_addr = 0;
-        sysbus_mmio_map(sbd, 2, dma_addr);
-        version |= FW_CFG_VERSION_DMA;
-    }
-
-    fw_cfg_add_i32(s, FW_CFG_ID, version);
-
-    return s;
-}
-
-FWCfgState *fw_cfg_init_mem(hwaddr ctl_addr, hwaddr data_addr)
-{
-    return fw_cfg_init_mem_wide(ctl_addr, data_addr,
-                                fw_cfg_data_mem_ops.valid.max_access_size,
-                                0, NULL);
-}
-
-
-FWCfgState *fw_cfg_find(void)
-{
-    return FW_CFG(object_resolve_path(FW_CFG_PATH, NULL));
-}
-
-static void fw_cfg_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->reset = fw_cfg_reset;
-    dc->vmsd = &vmstate_fw_cfg;
-}
-
-static const TypeInfo fw_cfg_info = {
-    .name          = TYPE_FW_CFG,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(FWCfgState),
-    .class_init    = fw_cfg_class_init,
-};
-
-
-static Property fw_cfg_io_properties[] = {
-    DEFINE_PROP_UINT32("iobase", FWCfgIoState, iobase, -1),
-    DEFINE_PROP_UINT32("dma_iobase", FWCfgIoState, dma_iobase, -1),
-    DEFINE_PROP_BOOL("dma_enabled", FWCfgIoState, parent_obj.dma_enabled,
-                     true),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void fw_cfg_io_realize(DeviceState *dev, Error **errp)
-{
-    FWCfgIoState *s = FW_CFG_IO(dev);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-
-    /* when using port i/o, the 8-bit data register ALWAYS overlaps
-     * with half of the 16-bit control register. Hence, the total size
-     * of the i/o region used is FW_CFG_CTL_SIZE */
-    memory_region_init_io(&s->comb_iomem, OBJECT(s), &fw_cfg_comb_mem_ops,
-                          FW_CFG(s), "fwcfg", FW_CFG_CTL_SIZE);
-    sysbus_add_io(sbd, s->iobase, &s->comb_iomem);
-
-    if (FW_CFG(s)->dma_enabled) {
-        memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
-                              &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
-                              sizeof(dma_addr_t));
-        sysbus_add_io(sbd, s->dma_iobase, &FW_CFG(s)->dma_iomem);
-    }
-}
-
-static void fw_cfg_io_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->realize = fw_cfg_io_realize;
-    dc->props = fw_cfg_io_properties;
-}
-
-static const TypeInfo fw_cfg_io_info = {
-    .name          = TYPE_FW_CFG_IO,
-    .parent        = TYPE_FW_CFG,
-    .instance_size = sizeof(FWCfgIoState),
-    .class_init    = fw_cfg_io_class_init,
-};
-
-
-static Property fw_cfg_mem_properties[] = {
-    DEFINE_PROP_UINT32("data_width", FWCfgMemState, data_width, -1),
-    DEFINE_PROP_BOOL("dma_enabled", FWCfgMemState, parent_obj.dma_enabled,
-                     true),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void fw_cfg_mem_realize(DeviceState *dev, Error **errp)
-{
-    FWCfgMemState *s = FW_CFG_MEM(dev);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    const MemoryRegionOps *data_ops = &fw_cfg_data_mem_ops;
-
-    memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops,
-                          FW_CFG(s), "fwcfg.ctl", FW_CFG_CTL_SIZE);
-    sysbus_init_mmio(sbd, &s->ctl_iomem);
-
-    if (s->data_width > data_ops->valid.max_access_size) {
-        /* memberwise copy because the "old_mmio" member is const */
-        s->wide_data_ops.read       = data_ops->read;
-        s->wide_data_ops.write      = data_ops->write;
-        s->wide_data_ops.endianness = data_ops->endianness;
-        s->wide_data_ops.valid      = data_ops->valid;
-        s->wide_data_ops.impl       = data_ops->impl;
-
-        s->wide_data_ops.valid.max_access_size = s->data_width;
-        s->wide_data_ops.impl.max_access_size  = s->data_width;
-        data_ops = &s->wide_data_ops;
-    }
-    memory_region_init_io(&s->data_iomem, OBJECT(s), data_ops, FW_CFG(s),
-                          "fwcfg.data", data_ops->valid.max_access_size);
-    sysbus_init_mmio(sbd, &s->data_iomem);
-
-    if (FW_CFG(s)->dma_enabled) {
-        memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
-                              &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
-                              sizeof(dma_addr_t));
-        sysbus_init_mmio(sbd, &FW_CFG(s)->dma_iomem);
-    }
-}
-
-static void fw_cfg_mem_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->realize = fw_cfg_mem_realize;
-    dc->props = fw_cfg_mem_properties;
-}
-
-static const TypeInfo fw_cfg_mem_info = {
-    .name          = TYPE_FW_CFG_MEM,
-    .parent        = TYPE_FW_CFG,
-    .instance_size = sizeof(FWCfgMemState),
-    .class_init    = fw_cfg_mem_class_init,
-};
-
-
-static void fw_cfg_register_types(void)
-{
-    type_register_static(&fw_cfg_info);
-    type_register_static(&fw_cfg_io_info);
-    type_register_static(&fw_cfg_mem_info);
-}
-
-type_init(fw_cfg_register_types)
diff --git a/qemu/hw/nvram/mac_nvram.c b/qemu/hw/nvram/mac_nvram.c
deleted file mode 100644
index 24f61212b..000000000
--- a/qemu/hw/nvram/mac_nvram.c
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * PowerMac NVRAM emulation
- *
- * Copyright (c) 2005-2007 Fabrice Bellard
- * Copyright (c) 2007 Jocelyn Mayer
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu/osdep.h"
-#include "hw/hw.h"
-#include "hw/nvram/openbios_firmware_abi.h"
-#include "sysemu/sysemu.h"
-#include "hw/ppc/mac.h"
-#include "qemu/cutils.h"
-#include <zlib.h>
-
-/* debug NVR */
-//#define DEBUG_NVR
-
-#ifdef DEBUG_NVR
-#define NVR_DPRINTF(fmt, ...)                                   \
-    do { printf("NVR: " fmt , ## __VA_ARGS__); } while (0)
-#else
-#define NVR_DPRINTF(fmt, ...)
-#endif
-
-#define DEF_SYSTEM_SIZE 0xc10
-
-/* macio style NVRAM device */
-static void macio_nvram_writeb(void *opaque, hwaddr addr,
-                               uint64_t value, unsigned size)
-{
-    MacIONVRAMState *s = opaque;
-
-    addr = (addr >> s->it_shift) & (s->size - 1);
-    s->data[addr] = value;
-    NVR_DPRINTF("writeb addr %04" HWADDR_PRIx " val %" PRIx64 "\n",
-                addr, value);
-}
-
-static uint64_t macio_nvram_readb(void *opaque, hwaddr addr,
-                                  unsigned size)
-{
-    MacIONVRAMState *s = opaque;
-    uint32_t value;
-
-    addr = (addr >> s->it_shift) & (s->size - 1);
-    value = s->data[addr];
-    NVR_DPRINTF("readb addr %04" HWADDR_PRIx " val %" PRIx32 "\n",
-                addr, value);
-
-    return value;
-}
-
-static const MemoryRegionOps macio_nvram_ops = {
-    .read = macio_nvram_readb,
-    .write = macio_nvram_writeb,
-    .valid.min_access_size = 1,
-    .valid.max_access_size = 4,
-    .impl.min_access_size = 1,
-    .impl.max_access_size = 1,
-    .endianness = DEVICE_BIG_ENDIAN,
-};
-
-static const VMStateDescription vmstate_macio_nvram = {
-    .name = "macio_nvram",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
-        VMSTATE_VBUFFER_UINT32(data, MacIONVRAMState, 0, NULL, 0, size),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-
-static void macio_nvram_reset(DeviceState *dev)
-{
-}
-
-static void macio_nvram_realizefn(DeviceState *dev, Error **errp)
-{
-    SysBusDevice *d = SYS_BUS_DEVICE(dev);
-    MacIONVRAMState *s = MACIO_NVRAM(dev);
-
-    s->data = g_malloc0(s->size);
-
-    memory_region_init_io(&s->mem, OBJECT(s), &macio_nvram_ops, s,
-                          "macio-nvram", s->size << s->it_shift);
-    sysbus_init_mmio(d, &s->mem);
-}
-
-static void macio_nvram_unrealizefn(DeviceState *dev, Error **errp)
-{
-    MacIONVRAMState *s = MACIO_NVRAM(dev);
-
-    g_free(s->data);
-}
-
-static Property macio_nvram_properties[] = {
-    DEFINE_PROP_UINT32("size", MacIONVRAMState, size, 0),
-    DEFINE_PROP_UINT32("it_shift", MacIONVRAMState, it_shift, 0),
-    DEFINE_PROP_END_OF_LIST()
-};
-
-static void macio_nvram_class_init(ObjectClass *oc, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(oc);
-
-    dc->realize = macio_nvram_realizefn;
-    dc->unrealize = macio_nvram_unrealizefn;
-    dc->reset = macio_nvram_reset;
-    dc->vmsd = &vmstate_macio_nvram;
-    dc->props = macio_nvram_properties;
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-}
-
-static const TypeInfo macio_nvram_type_info = {
-    .name = TYPE_MACIO_NVRAM,
-    .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(MacIONVRAMState),
-    .class_init = macio_nvram_class_init,
-};
-
-static void macio_nvram_register_types(void)
-{
-    type_register_static(&macio_nvram_type_info);
-}
-
-/* Set up a system OpenBIOS NVRAM partition */
-static void pmac_format_nvram_partition_of(MacIONVRAMState *nvr, int off,
-                                           int len)
-{
-    unsigned int i;
-    uint32_t start = off, end;
-    struct OpenBIOS_nvpart_v1 *part_header;
-
-    // OpenBIOS nvram variables
-    // Variable partition
-    part_header = (struct OpenBIOS_nvpart_v1 *)&nvr->data[start];
-    part_header->signature = OPENBIOS_PART_SYSTEM;
-    pstrcpy(part_header->name, sizeof(part_header->name), "system");
-
-    end = start + sizeof(struct OpenBIOS_nvpart_v1);
-    for (i = 0; i < nb_prom_envs; i++)
-        end = OpenBIOS_set_var(nvr->data, end, prom_envs[i]);
-
-    // End marker
-    nvr->data[end++] = '\0';
-
-    end = start + ((end - start + 15) & ~15);
-    /* XXX: OpenBIOS is not able to grow up a partition. Leave some space for
-       new variables. */
-    if (end < DEF_SYSTEM_SIZE)
-        end = DEF_SYSTEM_SIZE;
-    OpenBIOS_finish_partition(part_header, end - start);
-
-    // free partition
-    start = end;
-    part_header = (struct OpenBIOS_nvpart_v1 *)&nvr->data[start];
-    part_header->signature = OPENBIOS_PART_FREE;
-    pstrcpy(part_header->name, sizeof(part_header->name), "free");
-
-    end = len;
-    OpenBIOS_finish_partition(part_header, end - start);
-}
-
-#define OSX_NVRAM_SIGNATURE     (0x5A)
-
-/* Set up a Mac OS X NVRAM partition */
-static void pmac_format_nvram_partition_osx(MacIONVRAMState *nvr, int off,
-                                            int len)
-{
-    uint32_t start = off;
-    struct OpenBIOS_nvpart_v1 *part_header;
-    unsigned char *data = &nvr->data[start];
-
-    /* empty partition */
-    part_header = (struct OpenBIOS_nvpart_v1 *)data;
-    part_header->signature = OSX_NVRAM_SIGNATURE;
-    pstrcpy(part_header->name, sizeof(part_header->name), "wwwwwwwwwwww");
-
-    OpenBIOS_finish_partition(part_header, len);
-
-    /* Generation */
-    stl_be_p(&data[20], 2);
-
-    /* Adler32 checksum */
-    stl_be_p(&data[16], adler32(0, &data[20], len - 20));
-}
-
-/* Set up NVRAM with OF and OSX partitions */
-void pmac_format_nvram_partition(MacIONVRAMState *nvr, int len)
-{
-    /*
-     * Mac OS X expects side "B" of the flash at the second half of NVRAM,
-     * so we use half of the chip for OF and the other half for a free OSX
-     * partition.
-     */
-    pmac_format_nvram_partition_of(nvr, 0, len / 2);
-    pmac_format_nvram_partition_osx(nvr, len / 2, len / 2);
-}
-type_init(macio_nvram_register_types)
diff --git a/qemu/hw/nvram/spapr_nvram.c b/qemu/hw/nvram/spapr_nvram.c
deleted file mode 100644
index 802636ef3..000000000
--- a/qemu/hw/nvram/spapr_nvram.c
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * QEMU sPAPR NVRAM emulation
- *
- * Copyright (C) 2012 David Gibson, IBM Corporation.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "qemu-common.h"
-#include "cpu.h"
-#include <libfdt.h>
-
-#include "sysemu/block-backend.h"
-#include "sysemu/device_tree.h"
-#include "hw/sysbus.h"
-#include "hw/ppc/spapr.h"
-#include "hw/ppc/spapr_vio.h"
-
-typedef struct sPAPRNVRAM {
-    VIOsPAPRDevice sdev;
-    uint32_t size;
-    uint8_t *buf;
-    BlockBackend *blk;
-} sPAPRNVRAM;
-
-#define TYPE_VIO_SPAPR_NVRAM "spapr-nvram"
-#define VIO_SPAPR_NVRAM(obj) \
-     OBJECT_CHECK(sPAPRNVRAM, (obj), TYPE_VIO_SPAPR_NVRAM)
-
-#define MIN_NVRAM_SIZE 8192
-#define DEFAULT_NVRAM_SIZE 65536
-#define MAX_NVRAM_SIZE 1048576
-
-static void rtas_nvram_fetch(PowerPCCPU *cpu, sPAPRMachineState *spapr,
-                             uint32_t token, uint32_t nargs,
-                             target_ulong args,
-                             uint32_t nret, target_ulong rets)
-{
-    sPAPRNVRAM *nvram = spapr->nvram;
-    hwaddr offset, buffer, len;
-    void *membuf;
-
-    if ((nargs != 3) || (nret != 2)) {
-        rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
-        return;
-    }
-
-    if (!nvram) {
-        rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
-        rtas_st(rets, 1, 0);
-        return;
-    }
-
-    offset = rtas_ld(args, 0);
-    buffer = rtas_ld(args, 1);
-    len = rtas_ld(args, 2);
-
-    if (((offset + len) < offset)
-        || ((offset + len) > nvram->size)) {
-        rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
-        rtas_st(rets, 1, 0);
-        return;
-    }
-
-    assert(nvram->buf);
-
-    membuf = cpu_physical_memory_map(buffer, &len, 1);
-    memcpy(membuf, nvram->buf + offset, len);
-    cpu_physical_memory_unmap(membuf, len, 1, len);
-
-    rtas_st(rets, 0, RTAS_OUT_SUCCESS);
-    rtas_st(rets, 1, len);
-}
-
-static void rtas_nvram_store(PowerPCCPU *cpu, sPAPRMachineState *spapr,
-                             uint32_t token, uint32_t nargs,
-                             target_ulong args,
-                             uint32_t nret, target_ulong rets)
-{
-    sPAPRNVRAM *nvram = spapr->nvram;
-    hwaddr offset, buffer, len;
-    int alen;
-    void *membuf;
-
-    if ((nargs != 3) || (nret != 2)) {
-        rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
-        return;
-    }
-
-    if (!nvram) {
-        rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
-        return;
-    }
-
-    offset = rtas_ld(args, 0);
-    buffer = rtas_ld(args, 1);
-    len = rtas_ld(args, 2);
-
-    if (((offset + len) < offset)
-        || ((offset + len) > nvram->size)) {
-        rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
-        return;
-    }
-
-    membuf = cpu_physical_memory_map(buffer, &len, 0);
-
-    alen = len;
-    if (nvram->blk) {
-        alen = blk_pwrite(nvram->blk, offset, membuf, len);
-    }
-
-    assert(nvram->buf);
-    memcpy(nvram->buf + offset, membuf, len);
-
-    cpu_physical_memory_unmap(membuf, len, 0, len);
-
-    rtas_st(rets, 0, (alen < len) ? RTAS_OUT_HW_ERROR : RTAS_OUT_SUCCESS);
-    rtas_st(rets, 1, (alen < 0) ? 0 : alen);
-}
-
-static void spapr_nvram_realize(VIOsPAPRDevice *dev, Error **errp)
-{
-    sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(dev);
-
-    if (nvram->blk) {
-        nvram->size = blk_getlength(nvram->blk);
-    } else {
-        nvram->size = DEFAULT_NVRAM_SIZE;
-    }
-
-    nvram->buf = g_malloc0(nvram->size);
-
-    if ((nvram->size < MIN_NVRAM_SIZE) || (nvram->size > MAX_NVRAM_SIZE)) {
-        error_setg(errp, "spapr-nvram must be between %d and %d bytes in size",
-                   MIN_NVRAM_SIZE, MAX_NVRAM_SIZE);
-        return;
-    }
-
-    if (nvram->blk) {
-        int alen = blk_pread(nvram->blk, 0, nvram->buf, nvram->size);
-
-        if (alen != nvram->size) {
-            error_setg(errp, "can't read spapr-nvram contents");
-            return;
-        }
-    }
-
-    spapr_rtas_register(RTAS_NVRAM_FETCH, "nvram-fetch", rtas_nvram_fetch);
-    spapr_rtas_register(RTAS_NVRAM_STORE, "nvram-store", rtas_nvram_store);
-}
-
-static int spapr_nvram_devnode(VIOsPAPRDevice *dev, void *fdt, int node_off)
-{
-    sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(dev);
-
-    return fdt_setprop_cell(fdt, node_off, "#bytes", nvram->size);
-}
-
-static int spapr_nvram_pre_load(void *opaque)
-{
-    sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(opaque);
-
-    g_free(nvram->buf);
-    nvram->buf = NULL;
-    nvram->size = 0;
-
-    return 0;
-}
-
-static int spapr_nvram_post_load(void *opaque, int version_id)
-{
-    sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(opaque);
-
-    if (nvram->blk) {
-        int alen = blk_pwrite(nvram->blk, 0, nvram->buf, nvram->size);
-
-        if (alen < 0) {
-            return alen;
-        }
-        if (alen != nvram->size) {
-            return -1;
-        }
-    }
-
-    return 0;
-}
-
-static const VMStateDescription vmstate_spapr_nvram = {
-    .name = "spapr_nvram",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .pre_load = spapr_nvram_pre_load,
-    .post_load = spapr_nvram_post_load,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT32(size, sPAPRNVRAM),
-        VMSTATE_VBUFFER_ALLOC_UINT32(buf, sPAPRNVRAM, 1, NULL, 0, size),
-        VMSTATE_END_OF_LIST()
-    },
-};
-
-static Property spapr_nvram_properties[] = {
-    DEFINE_SPAPR_PROPERTIES(sPAPRNVRAM, sdev),
-    DEFINE_PROP_DRIVE("drive", sPAPRNVRAM, blk),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void spapr_nvram_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    VIOsPAPRDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
-
-    k->realize = spapr_nvram_realize;
-    k->devnode = spapr_nvram_devnode;
-    k->dt_name = "nvram";
-    k->dt_type = "nvram";
-    k->dt_compatible = "qemu,spapr-nvram";
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-    dc->props = spapr_nvram_properties;
-    dc->vmsd = &vmstate_spapr_nvram;
-}
-
-static const TypeInfo spapr_nvram_type_info = {
-    .name          = TYPE_VIO_SPAPR_NVRAM,
-    .parent        = TYPE_VIO_SPAPR_DEVICE,
-    .instance_size = sizeof(sPAPRNVRAM),
-    .class_init    = spapr_nvram_class_init,
-};
-
-static void spapr_nvram_register_types(void)
-{
-    type_register_static(&spapr_nvram_type_info);
-}
-
-type_init(spapr_nvram_register_types)