Merge remote-tracking branch 'stefanha/tracing' into staging

* stefanha/tracing:
  vga: add trace event for ppm_save
  console: add some trace events
  maintainers: Add docs/tracing.txt to Tracing
  docs: correct ./configure line in tracing.txt
  trace: make trace_thread_create() use its function arg
  tracetool: Omit useless QEMU_*_ENABLED() check
  trace: Provide a per-event status define for conditional compilation
diff --git a/cpu-all.h b/cpu-all.h
index 80e6d42..a174532 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -197,7 +197,7 @@
 #endif
 
 /* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
-#define g2h(x) ((void *)((unsigned long)(x) + GUEST_BASE))
+#define g2h(x) ((void *)((unsigned long)(target_ulong)(x) + GUEST_BASE))
 
 #if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS
 #define h2g_valid(x) 1
diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c
index 0423af1..bff9152 100644
--- a/hw/qdev-properties.c
+++ b/hw/qdev-properties.c
@@ -421,10 +421,6 @@
         error_propagate(errp, local_err);
         return;
     }
-    if (!*str) {
-        g_free(str);
-        str = NULL;
-    }
     if (*ptr) {
         g_free(*ptr);
     }
diff --git a/qapi-schema.json b/qapi-schema.json
index 5f293c4..dd9e0e5 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -616,11 +616,12 @@
 # @connection-id: SPICE connection id number.  All channels with the same id
 #                 belong to the same SPICE session.
 #
-# @connection-type: SPICE channel type number.  "1" is the main control channel,
-#                   filter for this one if you want track spice sessions only
+# @connection-type: SPICE channel type number.  "1" is the main control
+#                   channel, filter for this one if you want to track spice
+#                   sessions only
 #
-# @channel-id: SPICE channel ID number.  Usually "0", might be different needed
-#              when multiple channels of the same type exist, such as multiple
+# @channel-id: SPICE channel ID number.  Usually "0", might be different when
+#              multiple channels of the same type exist, such as multiple
 #              display channels in a multihead setup
 #
 # @tls: true if the channel is encrypted, false otherwise.
@@ -649,8 +650,9 @@
 # @tls-port: #optional The SPICE server's TLS port number.
 #
 # @auth: #optional the current authentication type used by the server
-#        'none' if no authentication is being used
-#        'spice' (TODO: describe)
+#        'none'  if no authentication is being used
+#        'spice' uses SASL or direct TLS authentication, depending on command
+#                line options
 #
 # @channels: a list of @SpiceChannel for each active spice channel
 #
@@ -1254,7 +1256,7 @@
 { 'command': 'migrate_set_speed', 'data': {'value': 'int'} }
 
 ##
-# @DevicePropertyInfo:
+# @ObjectPropertyInfo:
 #
 # @name: the name of the property
 #
diff --git a/qjson.h b/qjson.h
index 65b10ea..1190d8a 100644
--- a/qjson.h
+++ b/qjson.h
@@ -15,6 +15,7 @@
 #define QJSON_H
 
 #include <stdarg.h>
+#include "compiler.h"
 #include "qobject.h"
 #include "qstring.h"
 
diff --git a/qom/object.c b/qom/object.c
index aa037d2..39cbcb9 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -304,12 +304,9 @@
     ObjectProperty *prop;
 
     QTAILQ_FOREACH(prop, &obj->properties, node) {
-        if (!strstart(prop->type, "child<", NULL)) {
-            continue;
-        }
-
-        if (prop->opaque == child) {
+        if (strstart(prop->type, "child<", NULL) && prop->opaque == child) {
             object_property_del(obj, prop->name, errp);
+            break;
         }
     }
 }
diff --git a/sysconfigs/target/target-x86_64.conf b/sysconfigs/target/target-x86_64.conf
index d050380..cee0ea9 100644
--- a/sysconfigs/target/target-x86_64.conf
+++ b/sysconfigs/target/target-x86_64.conf
@@ -57,6 +57,20 @@
    model_id = "Westmere E56xx/L56xx/X56xx (Nehalem-C)"
 
 [cpudef]
+   name = "SandyBridge"
+   level = "0xd"
+   vendor = "GenuineIntel"
+   family = "6"
+   model = "42"
+   stepping = "1"
+   feature_edx = " sse2 sse fxsr mmx clflush pse36 pat cmov mca pge mtrr sep apic cx8 mce pae msr tsc pse de fpu"
+   feature_ecx = "avx xsave aes tsc-deadline popcnt x2apic sse4.2 sse4.1 cx16 ssse3 pclmulqdq sse3"
+   extfeature_edx = "i64 rdtscp nx syscall "
+   extfeature_ecx = "lahf_lm"
+   xlevel = "0x8000000A"
+   model_id = "Intel Xeon E312xx (Sandy Bridge)"
+
+[cpudef]
    name = "Opteron_G1"
    level = "5"
    vendor = "AuthenticAMD"
@@ -98,3 +112,17 @@
    xlevel = "0x80000008"
    model_id = "AMD Opteron 23xx (Gen 3 Class Opteron)"
 
+[cpudef]
+   name = "Opteron_G4"
+   level = "0xd"
+   vendor = "AuthenticAMD"
+   family = "21"
+   model = "1"
+   stepping = "2"
+   feature_edx = "sse2 sse fxsr mmx clflush pse36 pat cmov mca pge mtrr sep apic cx8 mce pae msr tsc pse de fpu"
+   feature_ecx = "avx xsave aes popcnt sse4.2 sse4.1 cx16 ssse3 pclmulqdq sse3"
+   extfeature_edx = "lm rdtscp pdpe1gb fxsr mmx nx pse36 pat cmov mca pge mtrr syscall apic cx8 mce pae msr tsc pse de fpu"
+   extfeature_ecx = " fma4 xop 3dnowprefetch misalignsse sse4a abm svm lahf_lm"
+   xlevel = "0x8000001A"
+   model_id = "AMD Opteron 62xx class CPU"
+
diff --git a/target-i386/cpuid.c b/target-i386/cpuid.c
index c2edb64..465ea15 100644
--- a/target-i386/cpuid.c
+++ b/target-i386/cpuid.c
@@ -50,7 +50,7 @@
     "fma", "cx16", "xtpr", "pdcm",
     NULL, NULL, "dca", "sse4.1|sse4_1",
     "sse4.2|sse4_2", "x2apic", "movbe", "popcnt",
-    NULL, "aes", "xsave", "osxsave",
+    "tsc-deadline", "aes", "xsave", "osxsave",
     "avx", NULL, NULL, "hypervisor",
 };
 static const char *ext2_feature_name[] = {
diff --git a/ui/vnc.c b/ui/vnc.c
index 8ee39bc..bdec33a 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1936,7 +1936,10 @@
 
 static void vnc_dpy_setdata(DisplayState *ds)
 {
-    /* We don't have to do anything */
+    VncDisplay *vd = ds->opaque;
+
+    *(vd->guest.ds) = *(ds->surface);
+    vnc_dpy_update(ds, 0, 0, ds_get_width(ds), ds_get_height(ds));
 }
 
 static void vnc_colordepth(VncState *vs)
diff --git a/vl.c b/vl.c
index 97ab2b9..65f11f2 100644
--- a/vl.c
+++ b/vl.c
@@ -2359,7 +2359,6 @@
             exit(1);
         }
     }
-    cpudef_init();
 
     /* second pass of option parsing */
     optind = 1;
@@ -2382,12 +2381,7 @@
                 break;
             case QEMU_OPTION_cpu:
                 /* hw initialization will check this */
-                if (*optarg == '?') {
-                    list_cpus(stdout, &fprintf, optarg);
-                    exit(0);
-                } else {
-                    cpu_model = optarg;
-                }
+                cpu_model = optarg;
                 break;
             case QEMU_OPTION_hda:
                 {
@@ -3191,6 +3185,18 @@
     }
     loc_set_none();
 
+    /* Init CPU def lists, based on config
+     * - Must be called after all the qemu_read_config_file() calls
+     * - Must be called before list_cpus()
+     * - Must be called before machine->init()
+     */
+    cpudef_init();
+
+    if (cpu_model && *cpu_model == '?') {
+        list_cpus(stdout, &fprintf, optarg);
+        exit(0);
+    }
+
     /* Open the logfile at this point, if necessary. We can't open the logfile
      * when encountering either of the logging options (-d or -D) because the
      * other one may be encountered later on the command line, changing the