This is the delta between the qemu and qemu-kvm v0.12.5 versions

Signed-off-by: Bruce Rogers <brogers@suse.com>
Update for 0.12.5 release
2018-01-22 14:00:07 -07:00 · 2010-07-22 14:39:04 +02:00 · 2010-07-22 14:37:23 +02:00 · 2010-07-14 13:09:24 +02:00 · 2010-07-14 13:09:24 +02:00 · 2010-07-14 13:08:45 +02:00
6078 changed files with 470911 additions and 1566591 deletions
--- a/.dir-locals.el
+++ b/.dir-locals.el
@@ -1,2 +0,0 @@
 ((c-mode . ((c-file-style . "stroustrup")
 	    (indent-tabs-mode . nil))))
--- a/.exrc
+++ b/.exrc
@@ -1,7 +0,0 @@
 "VIM settings to match QEMU coding style.  They are activated by adding the
 "following settings (without the " symbol) as last two lines in $HOME/.vimrc:
 "set secure
 "set exrc
 set expandtab
 set shiftwidth=4
 set smarttab
--- a/.gitignore
+++ b/.gitignore
@@ -1,133 +1,52 @@
-/config-devices.*
+config-devices.*
-/config-all-devices.*
+config-all-devices.*
-/config-all-disas.*
+config-host.*
-/config-host.*
+config-target.*
-/config-target.*
+i386
-/config.status
+*-softmmu
-/config-temp
+*-darwin-user
-/trace-events-all
+*-linux-user
-/trace/generated-events.h
+*-bsd-user
-/trace/generated-events.c
+libhw32
-/trace/generated-helpers-wrappers.h
+libhw64
-/trace/generated-helpers.h
+libuser
-/trace/generated-helpers.c
+qemu-doc.html
-/trace/generated-tcg-tracers.h
+qemu-tech.html
-/ui/shader/texture-blit-frag.h
+qemu-doc.info
-/ui/shader/texture-blit-vert.h
+qemu-tech.info
-*-timestamp
+qemu.1
-/*-softmmu
+qemu.pod
-/*-darwin-user
+qemu-img.1
-/*-linux-user
+qemu-img.pod
-/*-bsd-user
+qemu-img
-/ivshmem-client
+qemu-nbd
-/ivshmem-server
+qemu-nbd.8
-/libdis*
+qemu-nbd.pod
-/libuser
+qemu-options.texi
-/linux-headers/asm
+qemu-img-cmds.texi
-/qga/qapi-generated
+qemu-img-cmds.h
-/qapi-generated
+qemu-io
-/qapi-types.[ch]
+qemu-monitor.texi
-/qapi-visit.[ch]
+.gdbinit
 /qapi-event.[ch]
 /qmp-commands.h
 /qmp-introspect.[ch]
 /qmp-marshal.c
 /qemu-doc.html
 /qemu-doc.info
 /qemu-doc.txt
 /qemu-img
 /qemu-nbd
 /qemu-options.def
 /qemu-options.texi
 /qemu-img-cmds.texi
 /qemu-img-cmds.h
 /qemu-io
 /qemu-ga
 /qemu-bridge-helper
 /qemu-monitor.texi
 /qemu-monitor-info.texi
 /qemu-version.h
 /qemu-version.h.tmp
 /module_block.h
 /vscclient
 /fsdev/virtfs-proxy-helper
 *.[1-9]
 *.a
 *.aux
 *.cp
 *.dvi
 *.exe
 *.msi
 *.dll
 *.so
 *.mo
 *.fn
 *.ky
 *.log
 *.pdf
 *.pod
 *.cps
 *.fns
 *.kys
 *.pg
 *.pyc
 *.toc
 *.tp
 *.vr
 *.d
 !/scripts/qemu-guest-agent/fsfreeze-hook.d
 *.o
-.sdk
+.pc
-*.gcda
+patches
-*.gcno
+pc-bios/bios-pq/status
-/pc-bios/bios-pq/status
+pc-bios/vgabios-pq/status
-/pc-bios/vgabios-pq/status
+pc-bios/optionrom/multiboot.bin
-/pc-bios/optionrom/linuxboot.asm
+pc-bios/optionrom/multiboot.raw
-/pc-bios/optionrom/linuxboot.bin
+pc-bios/optionrom/extboot.bin
 /pc-bios/optionrom/linuxboot.raw
 /pc-bios/optionrom/linuxboot.img
 /pc-bios/optionrom/linuxboot_dma.asm
 /pc-bios/optionrom/linuxboot_dma.bin
 /pc-bios/optionrom/linuxboot_dma.raw
 /pc-bios/optionrom/linuxboot_dma.img
 /pc-bios/optionrom/multiboot.asm
 /pc-bios/optionrom/multiboot.bin
 /pc-bios/optionrom/multiboot.raw
 /pc-bios/optionrom/multiboot.img
 /pc-bios/optionrom/kvmvapic.asm
 /pc-bios/optionrom/kvmvapic.bin
 /pc-bios/optionrom/kvmvapic.raw
 /pc-bios/optionrom/kvmvapic.img
 /pc-bios/s390-ccw/s390-ccw.elf
 /pc-bios/s390-ccw/s390-ccw.img
 /docs/qemu-ga-ref.html
 /docs/qemu-ga-ref.txt
 /docs/qemu-qmp-ref.html
 /docs/qemu-qmp-ref.txt
 docs/qemu-ga-ref.info*
 docs/qemu-qmp-ref.info*
 /qemu-ga-qapi.texi
 /qemu-qapi.texi
 /version.texi
 *.tps
 .stgit-*
 cscope.*
 tags
 TAGS
 docker-src.*
 *~
 trace.h
 trace.c
 trace-ust.h
 trace-ust.h
 trace-dtrace.h
 trace-dtrace.dtrace
 trace-root.h
 trace-root.c
 trace-ust-root.h
 trace-ust-root.h
 trace-ust-all.h
 trace-ust-all.c
 trace-dtrace-root.h
 trace-dtrace-root.dtrace
 trace-ust-all.h
 trace-ust-all.c
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,36 +1,6 @@
 [submodule "roms/vgabios"]
 	path = roms/vgabios
-	url = git://git.qemu-project.org/vgabios.git/
+	url = ../vgabios.git
 [submodule "roms/seabios"]
 	path = roms/seabios
-	url = git://git.qemu-project.org/seabios.git/
+	url = ../seabios.git
 [submodule "roms/SLOF"]
 	path = roms/SLOF
 	url = git://git.qemu-project.org/SLOF.git
 [submodule "roms/ipxe"]
 	path = roms/ipxe
 	url = git://git.qemu-project.org/ipxe.git
 [submodule "roms/openbios"]
 	path = roms/openbios
 	url = git://git.qemu-project.org/openbios.git
 [submodule "roms/openhackware"]
 	path = roms/openhackware
 	url = git://git.qemu-project.org/openhackware.git
 [submodule "roms/qemu-palcode"]
 	path = roms/qemu-palcode
 	url = git://github.com/rth7680/qemu-palcode.git
 [submodule "roms/sgabios"]
 	path = roms/sgabios
 	url = git://git.qemu-project.org/sgabios.git
 [submodule "pixman"]
 	path = pixman
 	url = git://anongit.freedesktop.org/pixman
 [submodule "dtc"]
 	path = dtc
 	url = git://git.qemu-project.org/dtc.git
 [submodule "roms/u-boot"]
 	path = roms/u-boot
 	url = git://git.qemu-project.org/u-boot.git
 [submodule "roms/skiboot"]
 	path = roms/skiboot
 	url = git://git.qemu.org/skiboot.git
--- a/.mailmap
+++ b/.mailmap
@@ -1,17 +0,0 @@
 # This mailmap just translates the weird addresses from the original import into git
 # into proper addresses so that they are counted properly in git shortlog output.
 #
 Andrzej Zaborowski <balrogg@gmail.com> balrog <balrog@c046a42c-6fe2-441c-8c8c-71466251a162>
 Anthony Liguori <anthony@codemonkey.ws> aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
 Aurelien Jarno <aurelien@aurel32.net> aurel32 <aurel32@c046a42c-6fe2-441c-8c8c-71466251a162>
 Blue Swirl <blauwirbel@gmail.com> blueswir1 <blueswir1@c046a42c-6fe2-441c-8c8c-71466251a162>
 Edgar E. Iglesias <edgar.iglesias@gmail.com> edgar_igl <edgar_igl@c046a42c-6fe2-441c-8c8c-71466251a162>
 Fabrice Bellard <fabrice@bellard.org> bellard <bellard@c046a42c-6fe2-441c-8c8c-71466251a162>
 Jocelyn Mayer <l_indien@magic.fr> j_mayer <j_mayer@c046a42c-6fe2-441c-8c8c-71466251a162>
 Paul Brook <paul@codesourcery.com> pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162>
 Thiemo Seufer <ths@networkno.de> ths <ths@c046a42c-6fe2-441c-8c8c-71466251a162>
 malc <av1474@comtv.ru> malc <malc@c046a42c-6fe2-441c-8c8c-71466251a162>
 # There is also a:
 #    (no author) <(no author)@c046a42c-6fe2-441c-8c8c-71466251a162>
 # for the cvs2svn initialization commit e63c3dc74bf.
--- a/.shippable.yml
+++ b/.shippable.yml
@@ -1,19 +0,0 @@
 language: c
 env:
  matrix:
    - IMAGE=debian-armhf-cross
      TARGET_LIST=arm-softmmu,arm-linux-user
    - IMAGE=debian-arm64-cross
      TARGET_LIST=aarch64-softmmu,aarch64-linux-user
 build:
  pre_ci:
    - make docker-image-${IMAGE}
  pre_ci_boot:
    image_name: qemu
    image_tag: ${IMAGE}
    pull: false
    options: "-e HOME=/root"
  ci:
    - unset CC
    - ./configure ${QEMU_CONFIGURE_OPTS} --target-list=${TARGET_LIST}
    - make -j2
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,197 +0,0 @@
 sudo: false
 language: c
 python:
  - "2.4"
 compiler:
  - gcc
 cache: ccache
 addons:
  apt:
    packages:
      # Build dependencies
      - libaio-dev
      - libattr1-dev
      - libbrlapi-dev
      - libcap-ng-dev
      - libgnutls-dev
      - libgtk-3-dev
      - libiscsi-dev
      - liblttng-ust-dev
      - libnfs-dev
      - libncurses5-dev
      - libnss3-dev
      - libpixman-1-dev
      - libpng12-dev
      - librados-dev
      - libsdl1.2-dev
      - libseccomp-dev
      - libspice-protocol-dev
      - libspice-server-dev
      - libssh2-1-dev
      - liburcu-dev
      - libusb-1.0-0-dev
      - libvte-2.90-dev
      - sparse
      - uuid-dev
 # The channel name "irc.oftc.net#qemu" is encrypted against qemu/qemu
 # to prevent IRC notifications from forks. This was created using:
 # $ travis encrypt -r "qemu/qemu" "irc.oftc.net#qemu"
 notifications:
  irc:
    channels:
      - secure: "F7GDRgjuOo5IUyRLqSkmDL7kvdU4UcH3Lm/W2db2JnDHTGCqgEdaYEYKciyCLZ57vOTsTsOgesN8iUT7hNHBd1KWKjZe9KDTZWppWRYVwAwQMzVeSOsbbU4tRoJ6Pp+3qhH1Z0eGYR9ZgKYAoTumDFgSAYRp4IscKS8jkoedOqM="
    on_success: change
    on_failure: always
 env:
  global:
    - TEST_CMD="make check"
  matrix:
    - CONFIG=""
    - CONFIG="--enable-debug --enable-debug-tcg --enable-trace-backends=log"
    - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-uuid --disable-libusb"
    - CONFIG="--enable-modules"
    - CONFIG="--with-coroutine=ucontext"
    - CONFIG="--with-coroutine=sigaltstack"
 git:
  # we want to do this ourselves
  submodules: false
 before_install:
  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew update ; fi
  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew install libffi gettext glib pixman ; fi
  - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
  - git submodule update --init --recursive
 before_script:
  - ./configure ${CONFIG}
 script:
  - make -j3 && ${TEST_CMD}
 matrix:
  include:
    # Test with CLang for compile portability
    - env: CONFIG=""
      compiler: clang
    # gprof/gcov are GCC features
    - env: CONFIG="--enable-gprof --enable-gcov --disable-pie"
      compiler: gcc
    # We manually include builds which we disable "make check" for
    - env: CONFIG="--enable-debug --enable-tcg-interpreter"
           TEST_CMD=""
      compiler: gcc
    - env: CONFIG="--enable-trace-backends=simple"
           TEST_CMD=""
      compiler: gcc
    - env: CONFIG="--enable-trace-backends=ftrace"
           TEST_CMD=""
      compiler: gcc
    - env: CONFIG="--enable-trace-backends=ust"
           TEST_CMD=""
      compiler: gcc
    - env: CONFIG="--with-coroutine=gthread"
           TEST_CMD=""
      compiler: gcc
    - env: CONFIG=""
      os: osx
      compiler: clang
    # Plain Trusty System Build
    - env: CONFIG="--disable-linux-user"
      sudo: required
      addons:
      dist: trusty
      compiler: gcc
      before_install:
        - sudo apt-get update -qq
        - sudo apt-get build-dep -qq qemu
        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
        - git submodule update --init --recursive
    # Plain Trusty Linux User Build
    - env: CONFIG="--disable-system"
      sudo: required
      addons:
      dist: trusty
      compiler: gcc
      before_install:
        - sudo apt-get update -qq
        - sudo apt-get build-dep -qq qemu
        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
        - git submodule update --init --recursive
    # Trusty System build with latest stable clang
    - sudo: required
      addons:
      dist: trusty
      language: generic
      compiler: none
      env:
        - COMPILER_NAME=clang CXX=clang++-3.9 CC=clang-3.9
        - CONFIG="--disable-linux-user --cc=clang-3.9 --cxx=clang++-3.9"
      before_install:
        - wget -nv -O - http://llvm.org/apt/llvm-snapshot.gpg.key | sudo apt-key add -
        - sudo apt-add-repository -y 'deb http://llvm.org/apt/trusty llvm-toolchain-trusty-3.9 main'
        - sudo apt-get update -qq
        - sudo apt-get install -qq -y clang-3.9
        - sudo apt-get build-dep -qq qemu
        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
        - git submodule update --init --recursive
      before_script:
        - ./configure ${CONFIG} || cat config.log
    # Trusty Linux User build with latest stable clang
    - sudo: required
      addons:
      dist: trusty
      language: generic
      compiler: none
      env:
        - COMPILER_NAME=clang CXX=clang++-3.9 CC=clang-3.9
        - CONFIG="--disable-system --cc=clang-3.9 --cxx=clang++-3.9"
      before_install:
        - wget -nv -O - http://llvm.org/apt/llvm-snapshot.gpg.key | sudo apt-key add -
        - sudo apt-add-repository -y 'deb http://llvm.org/apt/trusty llvm-toolchain-trusty-3.9 main'
        - sudo apt-get update -qq
        - sudo apt-get install -qq -y clang-3.9
        - sudo apt-get build-dep -qq qemu
        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
        - git submodule update --init --recursive
      before_script:
        - ./configure ${CONFIG} || cat config.log
    # Using newer GCC with sanitizers
    - addons:
        apt:
          sources:
            # PPAs for newer toolchains
            - ubuntu-toolchain-r-test
          packages:
            # Extra toolchains
            - gcc-5
            - g++-5
            # Build dependencies
            - libaio-dev
            - libattr1-dev
            - libbrlapi-dev
            - libcap-ng-dev
            - libgnutls-dev
            - libgtk-3-dev
            - libiscsi-dev
            - liblttng-ust-dev
            - libnfs-dev
            - libncurses5-dev
            - libnss3-dev
            - libpixman-1-dev
            - libpng12-dev
            - librados-dev
            - libsdl1.2-dev
            - libseccomp-dev
            - libspice-protocol-dev
            - libspice-server-dev
            - libssh2-1-dev
            - liburcu-dev
            - libusb-1.0-0-dev
            - libvte-2.90-dev
            - sparse
            - uuid-dev
      language: generic
      compiler: none
      env:
        - COMPILER_NAME=gcc CXX=g++-5 CC=gcc-5
        - CONFIG="--cc=gcc-5 --cxx=g++-5 --disable-pie --disable-linux-user --with-coroutine=gthread"
        - TEST_CMD=""
      before_script:
        - ./configure ${CONFIG} --extra-cflags="-g3 -O0 -fsanitize=thread -fuse-ld=gold" || cat config.log
--- a/59
+++ b/59
@@ -1,15 +1,12 @@
-QEMU Coding Style
+Qemu Coding Style
 =================
 Please use the script checkpatch.pl in the scripts directory to check
 patches before submitting.
 1. Whitespace
 Of course, the most important aspect in any coding style is whitespace.
 Crusty old coders who have trouble spotting the glasses on their noses
 can tell the difference between a tab and eight spaces from a distance
-of approximately fifteen parsecs.  Many a flamewar has been fought and
+of approximately fifteen parsecs.  Many a flamewar have been fought and
 lost on this issue.
 QEMU indents are four spaces.  Tabs are never used, except in Makefiles
@@ -31,11 +28,7 @@ Do not leave whitespace dangling off the ends of lines.
 2. Line width
-Lines should be 80 characters; try not to make them longer.
+Lines are 80 characters; not longer.
 Sometimes it is hard to do, especially when dealing with QEMU subsystems
 that use long function or symbol names.  Even in that case, do not make
 lines much longer than 80 characters.
 Rationale:
 - Some people like to tile their 24" screens with a 6x4 matrix of 80x24
@@ -43,21 +36,18 @@ Rationale:
   let them keep doing it.
 - Code and especially patches is much more readable if limited to a sane
   line length.  Eighty is traditional.
 - The four-space indentation makes the most common excuse ("But look
   at all that white space on the left!") moot.
 - It is the QEMU coding style.
 3. Naming
 Variables are lower_case_with_underscores; easy to type and read.  Structured
-type names are in CamelCase; harder to type but standing out.  Enum type
+type names are in CamelCase; harder to type but standing out.  Scalar type
 names and function type names should also be in CamelCase.  Scalar type
 names are lower_case_with_underscores_ending_with_a_t, like the POSIX
 uint64_t and family.  Note that this last convention contradicts POSIX
 and is therefore likely to be changed.
-When wrapping standard library functions, use the prefix qemu_ to alert
+Typedefs are used to eliminate the redundant 'struct' keyword.  It is the
-readers that they are seeing a wrapped version; otherwise avoid this prefix.
+QEMU coding style.
 4. Block structure
@@ -75,10 +65,6 @@ keyword.  Example:
        printf("a was something else entirely.\n");
    }
 Note that 'else if' is considered a single statement; otherwise a long if/
 else if/else if/.../else sequence would need an indent for every else
 statement.
 An exception is the opening brace for a function; for reasons of tradition
 and clarity it comes on a line by itself:
@@ -90,36 +76,3 @@ and clarity it comes on a line by itself:
 Rationale: a consistent (except for functions...) bracing style reduces
 ambiguity and avoids needless churn when lines are added or removed.
 Furthermore, it is the QEMU coding style.
 5. Declarations
 Mixed declarations (interleaving statements and declarations within
 blocks) are generally not allowed; declarations should be at the beginning
 of blocks.
 Every now and then, an exception is made for declarations inside a
 #ifdef or #ifndef block: if the code looks nicer, such declarations can
 be placed at the top of the block even if there are statements above.
 On the other hand, however, it's often best to move that #ifdef/#ifndef
 block to a separate function altogether.
 6. Conditional statements
 When comparing a variable for (in)equality with a constant, list the
 constant on the right, as in:
 if (a == 1) {
    /* Reads like: "If a equals 1" */
    do_something();
 }
 Rationale: Yoda conditions (as in 'if (1 == a)') are awkward to read.
 Besides, good compilers already warn users when '==' is mis-typed as '=',
 even when the constant is on the right.
 7. Comment style
 We use traditional C-style /* */ comments and avoid // comments.
 Rationale: The // form is valid in C99, so this is purely a matter of
 consistency of style. The checkpatch script will warn you about this.
--- a/197
+++ b/197
@@ -1,8 +1,189 @@
-This file documents changes for QEMU releases 0.12 and earlier.
+version 0.12.5
-For changelog information for later releases, see
+ - audio/alsa: Handle SND_PCM_STATE_SETUP in alsa_poll_handler
-http://wiki.qemu-project.org/ChangeLog or look at the git history for
+ - block: Handle multiwrite errors only when all requests have completed
-more detailed information.
+ - block: Fix early failure in multiwrite
 - vpc: Use bdrv_(p)write_sync for metadata writes
 - vmdk: Use bdrv_(p)write_sync for metadata writes
 - qcow2: Use bdrv_(p)write_sync for metadata writes
 - qcow: Use bdrv_(p)write_sync for metadata writes
 - block: Add bdrv_(p)write_sync
 - qcow2: Restore L1 entry on l2_allocate failure
 - block/vdi: Fix image opening and creation for odd disk sizes
 - block/vpc: Fix conversion from size to disk geometry
 - qcow2: Remove abort on free_clusters failure
 - vmdk: Fix COW
 - qcow2: Fix creation of large images
 - vmdk: fix double free
 - qemu-options: add documentation for stdio signal=on|off
 - target-arm : fix parallel saturated subtraction implementation
 - target-arm : fix thumb2 parallel add/sub opcode decoding
 - target-arm: fix addsub/subadd implementation
 - target-i386: fix xchg rax,r8
 - block/vvfat.c: fix warnings with _FORTIFY_SOURCE
 - audio/alsa: Spelling typo (paramters)
 - target-mips: fix DINSU instruction
 - Correct definitions for FD_CMD_SAVE and FD_CMD_RESTORE
 - qcow2: Fix corruption after error in update_refcount
 - qcow2: Fix corruption after refblock allocation
 - block: Fix multiwrite with overlapping requests
 - qcow2: Fix error handling in l2_allocate
 - qcow2: Clear L2 table cache after write error
 - ide: Fix ide_dma_cancel
 - usb-bus: fix no params
 - Avoid crash on '-usbdevice <device>' without parameters
 - Fix -usbdevice crash
 - Fix multiboot compilation
 - Fix missing symbols in .rel/.rela.plt sections
 - target-ppc: fix RFI by clearing some bits of MSR
 - Fix typo in balloon help
 - arm_timer: fix oneshot mode
 - arm_timer: reload timer when enabled
 - qemu-sockets: avoid strlen of NULL pointer
 - block: fix aio_flush segfaults for read-only protocols (e.g. curl)
 - virtio-blk: fix barrier support
 - block: fix sector comparism in multiwrite_req_compare
 - pci: irq_state vmstate breakage
 - qemu-img: use the heap instead of the huge stack array for win32
 version 0.12.4
 - Workaround for broken OSS_GETVERSION on FreeBSD, part two (Juergen Lock)
 - oss: fix fragment setting (malc)
 - oss: issue OSS_GETVERSION ioctl only when needed (malc)
 - oss: refactor code around policy setting (malc)
 - oss: workaround for cases when OSS_GETVERSION is not defined (malc)
 - block: Free iovec arrays allocated by multiwrite_merge() (Stefan Hajnoczi)
 - lsi: fix segfault in lsi_command_complete (Gerd Hoffmann)
 - lsi: pass lsi_request to lsi_reselect (Gerd Hoffmann)
 - lsi: move dma_len+dma_buf into lsi_request (Gerd Hoffmann)
 - lsi: move current_dev into lsi_request (Gerd Hoffmann)
 - lsi: have lsi_request for the whole life time of the request. (Gerd Hoffmann)
 - lsi: use QTAILQ for lsi_queue (Gerd Hoffmann)
 - tcp/mips: Change TCG_AREG0 (fp -> s0) (Stefan Weil)
 - sh_pci: fix memory and I/O access (Aurelien Jarno)
 - Fix incoming migration with iothread (Marcelo Tosatti)
 - Fix SIGFPE for vnc display of width/height = 1 (Chris Webb)
 - net: remove broken net_set_boot_mask() boot device validation (Eduardo Habkost)
 - qcow2: Remove request from in-flight list after error (Kevin Wolf)
 - qcow2: Don't ignore immediate read/write failures (Kevin Wolf)
 - block: Fix multiwrite memory leak in error case (Kevin Wolf)
 - block: Fix error code in multiwrite for immediate failures (Kevin Wolf)
 - block: Fix multiwrite error handling (Kevin Wolf)
 - scsi-disk: fix buffer overflow (Gerd Hoffmann)
 - qcow2: Rewrite alloc_refcount_block/grow_refcount_table (Kevin Wolf)
 - qcow2: Factor next_refcount_table_size out (Kevin Wolf)
 - block: avoid creating too large iovecs in multiwrite_merge (Christoph Hellwig)
 - json-parser: Fix segfault on malformed input (Kevin Wolf)
 - linux-user: switch default ppc64 CPU to 970fx from 970 (Aurelien Jarno)
 - target-sh4: MMU: fix store queue addresses (Aurelien Jarno)
 - target-sh4: MMU: fix ITLB priviledge check (Aurelien Jarno)
 - target-sh4: MMU: fix mem_idx computation (Aurelien Jarno)
 - sh7750: handle MMUCR TI bit (Aurelien Jarno)
 - UHCI spurious interrut fix (Paul Brook)
 - tcg/mips: fix branch offset during retranslation (Aurelien Jarno)
 - tcg/arm: correctly save/restore registers in prologue/epilogue (Aurelien Jarno)
 - workaround for cmd646 bmdma register access while no dma is active (Igor V. Kovalenko)
 - Fix corner case in chardev udp: parameter (Jan Kiszka)
 - Don't set default monitor when there is a mux'ed one (Jan Kiszka)
 - spelling typo (compatibilty) in hw/fw_cfg.c (Vagrant Cascadian)
 - fdc: fix drive property handling. (Gerd Hoffmann)
 - target-i386: fix commit c22549204a6edc431e8e4358e61bd56386ff6957 (TeLeMan)
 - target-i386: fix SIB decoding with index = 4 (Aurelien Jarno)
 - Fix segfault with ram_size > 4095M without kvm (Ryan Harper)
 - target-i386: Fix long jumps/calls in long mode with REX.W set (malc)
 - target-i386: fix lddqu SSE instruction (Aurelien Jarno)
 - qemu-char.c: drop debug printfs from qemu_chr_parse_compat (Jan Kiszka)
 - fix undefined shifts by >32 (Paolo Bonzini)
 - Fix qemu -net user,hostfwd= example (Aurelien Jarno)
 version 0.12.3
  - kvm: Fix eflags corruption in kvm mode (Jan Kiszka)
  - qcow2: Fix access after end of array (Kevin Wolf)
  - ide save/restore pio/atapi cmd transfer fields and io buffer (Marcelo Tosatti)
  - net: Monitor command set_link finds only VLAN clients, fix (Markus Armbruster)
  - net: info network shows only VLAN clients, fix (Markus Armbruster)
  - net: net_check_clients() checks only VLAN clients, fix (Markus Armbruster)
  - net: Fix bogus "Warning: vlan 0 with no nics" with -device (Markus Armbruster)
  - net: net_check_clients() runs too early to see -device, fix (Markus Armbruster)
  - net: Remove unused net_client_uninit() (Markus Armbruster)
  - don't dereference NULL after failed strdup (Jim Meyering)
  - virtio-net: fix network stall under load (Tom Lendacky)
  - json: fix PRId64 on Win32 (Roy Tam)
  - fix inet_parse typo (Marcelo Tosatti)
  - iothread: fix vcpu stop with smp tcg (Marcelo Tosatti)
  - segfault due to buffer overrun in usb-serial (David S. Ahern)
  - qcow2: Fix signedness bugs (Kevin Wolf)
  - Do not ignore error, if open file failed (-serial /dev/tty) (Evgeniy Dushistov)
  - pc-bios: update to newer version of (stable) seabios (Anthony Liguori)
  - target-mips: fix ROTR and DROTR by zero (Aurelien Jarno)
  - target-mips: fix CpU exception for coprocessor 0 (Nathan Froyd)
  - tcg/mips: fix crash in tcg_out_qemu_ld() (Aurelien Jarno)
  - target-mips: don't call cpu_loop_exit() from helper.c (Aurelien Jarno)
  - virtio-blk: Fix error cases which ignored rerror/werror (Kevin Wolf)
  - virtio-blk: Fix restart after read error (Kevin Wolf)
  - virtio_blk: Factor virtio_blk_handle_request out (Kevin Wolf)
  - cirrus: Properly re-register cirrus_linear_io_addr on vram unmap (Jan Kiszka)
  - qcow2: Don't ignore qcow2_alloc_clusters return value (Kevin Wolf)
  - qcow2: Don't ignore update_refcount return value (Kevin Wolf)
  - qcow2: Allow updating no refcounts (Kevin Wolf)
  - qcow2: Improve error handling in update_refcount (Kevin Wolf)
  - qcow2: Fix error handling in grow_refcount_table (Kevin Wolf)
  - block: Return original error codes in bdrv_pread/write (Kevin Wolf)
  - qcow2: Return 0/-errno in qcow2_alloc_cluster_offset (Kevin Wolf)
  - qcow2: Return 0/-errno in get_cluster_table (Kevin Wolf)
  - qcow2: Fix error handling in qcow_save_vmstate (Kevin Wolf)
  - qcow2: Fix error handling in qcow2_grow_l1_table (Kevin Wolf)
  - win32/sdl: Fix toggle full screen (Herve Poussineau)
  - win32: pair qemu_memalign() with qemu_vfree() (Herve Poussineau)
  - vnc_refresh: calling vnc_update_client might free vs (Stefano Stabellini)
  - Musicpal: Fix descriptor walk in eth_send (Jan Kiszka)
  - Musicpal: Fix wm8750 I2C address (Jan Kiszka)
  - fix savevm command without id or tag (Marcelo Tosatti)
  - reduce number of reinjects on ACK (Gleb Natapov)
  - QMP: Fix asynchronous events delivery (Luiz Capitulino)
  - Documentation: Add missing documentation for qdev related command line options (Stefan Weil)
  - pc: add driver version compat properties (Gerd Hoffmann)
  - scsi: device version property (Gerd Hoffmann)
  - ide: device version property (Gerd Hoffmann)
  - QMP: Emit asynchronous events on all QMP monitors (Adam Litke)
  - Fix QEMU_WARN_UNUSED_RESULT (Kevin Wolf)
 version 0.12.2:
  - Qemu's internal TFTP server breaks lock-step-iness of TFTP (Milan Plzik)
  - osdep.c: Fix accept4 fallback (Kevin Wolf)
  - pc: add rombar to compat properties for pc-0.10 and pc-0.11 (Gerd Hoffmann)
  - pci: allow loading roms via fw_cfg. (Gerd Hoffmann)
  - roms: rework rom loading via fw (Gerd Hoffmann)
  - fw_cfg: rom loader tweaks. (Gerd Hoffmann)
  - roms: minor fixes and cleanups. (Gerd Hoffmann)
  - pc: add machine type for 0.12 (Gerd Hoffmann)
  - loader: more ignores for rom intended to be loaded by the bios (Aurelien Jarno)
  - vnc_refresh: return if vd->timer is NULL (Stefano Stabellini)
  - QMP: Don't free async event's 'data' (Luiz Capitulino)
  - Handle TFTP ERROR from client (Thomas Horsten)
  - dmg: fix ->open failure (Christoph Hellwig)
  - virtio-pci: thinko fix (Michael S. Tsirkin)
  - pc-bios: Update README (SeaBIOS) (Stefan Weil)
  - vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow (Roland Dreier)
  - remove pending exception on vcpu reset. (Gleb Natapov)
  - Fix CPU topology initialization (Jiri Denemark)
  - MCE: Fix bug of IA32_MCG_STATUS after system reset (Huang Ying)
  - linuxboot: fix gdt address calculation (Avi Kivity)
  - QMP: Drop wrong assert() (Luiz Capitulino)
  - vnc: Fix artifacts in hextile decoding (Anthony Liguori)
  - target-i386: Fix "call im" on x86_64 when executing 32-bit code (Aurelien Jarno)
  - Add missing newline at the end of options list (Michael Tokarev)
  - Don't load options roms intended to be loaded by the bios in qemu (Avi Kivity)
  - USB: Improve usbdevice error messages (Scott Tsai)
  - cpu-all.h: fix cpu_get_real_ticks() #ifdef (Aurelien Jarno)
  - alpha: fix compile (Blue Swirl)
  - user_only: compile everything with -fpie (Kirill A. Shutemov)
  - fdc/sparc32: don't hang on detection under OBP (Artyom Tarasenko)
  - scsi-disk: Inquiry with allocation length of CDB < 36 (v4) (Artyom Tarasenko)
  - e1000: fix init values for command register (Michael S. Tsirkin)
 version 0.12.1:
  - loader: fix rom loading at address 0 (fixes target-arm) (Aurelien Jarno)
  - loader: fix rom_copy (fixes multiboot) (Kevin Wolf)
 version 0.12.0:
@@ -78,7 +259,7 @@ version 0.10.2:
  - fix savevm/loadvm (Anthony Liguori)
  - live migration: fix dirty tracking windows (Glauber Costa)
-  - live migration: improve error propagation (Glauber Costa)
+  - live migration: improve error propogation (Glauber Costa)
  - qcow2: fix image creation for > ~2TB images (Chris Wright)
  - hotplug: fix error handling for if= parameter (Eduardo Habkost)
  - qcow2: fix data corruption (Nolan Leake)
@@ -386,7 +567,7 @@ version 0.5.3:
  - support of CD-ROM change
  - multiple network interface support
  - initial x86-64 host support (Gwenole Beauchesne)
-  - lret to outer privilege fix (OS/2 install fix)
+  - lret to outer priviledge fix (OS/2 install fix)
  - task switch fixes (SkyOS boot)
  - VM save/restore commands
  - new timer API
@@ -447,7 +628,7 @@ version 0.5.0:
  - multi-target build
  - fixed: no error code in hardware interrupts
  - fixed: pop ss, mov ss, x and sti disable hardware irqs for the next insn
-  - correct single stepping through string operations
+  - correct single stepping thru string operations
  - preliminary SPARC target support (Thomas M. Ogrisegg)
  - tun-fd option (Rusty Russell)
  - automatic IDE geometry detection
@@ -531,7 +712,7 @@ version 0.1.5:
 - ppc64 support + personality() patch (Rusty Russell)
 - first Alpha CPU patches (Falk Hueffner)
- - removed bfd.h dependency
+ - removed bfd.h dependancy
 - fixed shrd, shld, idivl and divl on PowerPC.
 - fixed buggy glibc PowerPC rint() function (test-i386 passes now on PowerPC).
--- a/2
+++ b/2
@@ -0,0 +1,2 @@
 seabios 9fb3f4d950744e97cc655b7d7b523d8bf101e4a0
 vgabios 6e62666cfc19e7fd45dd0d7c3ad62fd8d0b5f67a
--- a/236
+++ b/236
@@ -1,236 +0,0 @@
 1. Preprocessor
 1.1. Variadic macros
 For variadic macros, stick with this C99-like syntax:
 #define DPRINTF(fmt, ...)                                       \
    do { printf("IRQ: " fmt, ## __VA_ARGS__); } while (0)
 1.2. Include directives
 Order include directives as follows:
 #include "qemu/osdep.h"  /* Always first... */
 #include <...>           /* then system headers... */
 #include "..."           /* and finally QEMU headers. */
 The "qemu/osdep.h" header contains preprocessor macros that affect the behavior
 of core system headers like <stdint.h>.  It must be the first include so that
 core system headers included by external libraries get the preprocessor macros
 that QEMU depends on.
 Do not include "qemu/osdep.h" from header files since the .c file will have
 already included it.
 2. C types
 It should be common sense to use the right type, but we have collected
 a few useful guidelines here.
 2.1. Scalars
 If you're using "int" or "long", odds are good that there's a better type.
 If a variable is counting something, it should be declared with an
 unsigned type.
 If it's host memory-size related, size_t should be a good choice (use
 ssize_t only if required). Guest RAM memory offsets must use ram_addr_t,
 but only for RAM, it may not cover whole guest address space.
 If it's file-size related, use off_t.
 If it's file-offset related (i.e., signed), use off_t.
 If it's just counting small numbers use "unsigned int";
 (on all but oddball embedded systems, you can assume that that
 type is at least four bytes wide).
 In the event that you require a specific width, use a standard type
 like int32_t, uint32_t, uint64_t, etc.  The specific types are
 mandatory for VMState fields.
 Don't use Linux kernel internal types like u32, __u32 or __le32.
 Use hwaddr for guest physical addresses except pcibus_t
 for PCI addresses.  In addition, ram_addr_t is a QEMU internal address
 space that maps guest RAM physical addresses into an intermediate
 address space that can map to host virtual address spaces.  Generally
 speaking, the size of guest memory can always fit into ram_addr_t but
 it would not be correct to store an actual guest physical address in a
 ram_addr_t.
 For CPU virtual addresses there are several possible types.
 vaddr is the best type to use to hold a CPU virtual address in
 target-independent code. It is guaranteed to be large enough to hold a
 virtual address for any target, and it does not change size from target
 to target. It is always unsigned.
 target_ulong is a type the size of a virtual address on the CPU; this means
 it may be 32 or 64 bits depending on which target is being built. It should
 therefore be used only in target-specific code, and in some
 performance-critical built-per-target core code such as the TLB code.
 There is also a signed version, target_long.
 abi_ulong is for the *-user targets, and represents a type the size of
 'void *' in that target's ABI. (This may not be the same as the size of a
 full CPU virtual address in the case of target ABIs which use 32 bit pointers
 on 64 bit CPUs, like sparc32plus.) Definitions of structures that must match
 the target's ABI must use this type for anything that on the target is defined
 to be an 'unsigned long' or a pointer type.
 There is also a signed version, abi_long.
 Of course, take all of the above with a grain of salt.  If you're about
 to use some system interface that requires a type like size_t, pid_t or
 off_t, use matching types for any corresponding variables.
 Also, if you try to use e.g., "unsigned int" as a type, and that
 conflicts with the signedness of a related variable, sometimes
 it's best just to use the *wrong* type, if "pulling the thread"
 and fixing all related variables would be too invasive.
 Finally, while using descriptive types is important, be careful not to
 go overboard.  If whatever you're doing causes warnings, or requires
 casts, then reconsider or ask for help.
 2.2. Pointers
 Ensure that all of your pointers are "const-correct".
 Unless a pointer is used to modify the pointed-to storage,
 give it the "const" attribute.  That way, the reader knows
 up-front that this is a read-only pointer.  Perhaps more
 importantly, if we're diligent about this, when you see a non-const
 pointer, you're guaranteed that it is used to modify the storage
 it points to, or it is aliased to another pointer that is.
 2.3. Typedefs
 Typedefs are used to eliminate the redundant 'struct' keyword.
 2.4. Reserved namespaces in C and POSIX
 Underscore capital, double underscore, and underscore 't' suffixes should be
 avoided.
 3. Low level memory management
 Use of the malloc/free/realloc/calloc/valloc/memalign/posix_memalign
 APIs is not allowed in the QEMU codebase. Instead of these routines,
 use the GLib memory allocation routines g_malloc/g_malloc0/g_new/
 g_new0/g_realloc/g_free or QEMU's qemu_memalign/qemu_blockalign/qemu_vfree
 APIs.
 Please note that g_malloc will exit on allocation failure, so there
 is no need to test for failure (as you would have to with malloc).
 Calling g_malloc with a zero size is valid and will return NULL.
 Memory allocated by qemu_memalign or qemu_blockalign must be freed with
 qemu_vfree, since breaking this will cause problems on Win32.
 4. String manipulation
 Do not use the strncpy function.  As mentioned in the man page, it does *not*
 guarantee a NULL-terminated buffer, which makes it extremely dangerous to use.
 It also zeros trailing destination bytes out to the specified length.  Instead,
 use this similar function when possible, but note its different signature:
 void pstrcpy(char *dest, int dest_buf_size, const char *src)
 Don't use strcat because it can't check for buffer overflows, but:
 char *pstrcat(char *buf, int buf_size, const char *s)
 The same limitation exists with sprintf and vsprintf, so use snprintf and
 vsnprintf.
 QEMU provides other useful string functions:
 int strstart(const char *str, const char *val, const char **ptr)
 int stristart(const char *str, const char *val, const char **ptr)
 int qemu_strnlen(const char *s, int max_len)
 There are also replacement character processing macros for isxyz and toxyz,
 so instead of e.g. isalnum you should use qemu_isalnum.
 Because of the memory management rules, you must use g_strdup/g_strndup
 instead of plain strdup/strndup.
 5. Printf-style functions
 Whenever you add a new printf-style function, i.e., one with a format
 string argument and following "..." in its prototype, be sure to use
 gcc's printf attribute directive in the prototype.
 This makes it so gcc's -Wformat and -Wformat-security options can do
 their jobs and cross-check format strings with the number and types
 of arguments.
 6. C standard, implementation defined and undefined behaviors
 C code in QEMU should be written to the C99 language specification. A copy
 of the final version of the C99 standard with corrigenda TC1, TC2, and TC3
 included, formatted as a draft, can be downloaded from:
 http://www.open-std.org/jtc1/sc22/WG14/www/docs/n1256.pdf
 The C language specification defines regions of undefined behavior and
 implementation defined behavior (to give compiler authors enough leeway to
 produce better code).  In general, code in QEMU should follow the language
 specification and avoid both undefined and implementation defined
 constructs. ("It works fine on the gcc I tested it with" is not a valid
 argument...) However there are a few areas where we allow ourselves to
 assume certain behaviors because in practice all the platforms we care about
 behave in the same way and writing strictly conformant code would be
 painful. These are:
 * you may assume that integers are 2s complement representation
 * you may assume that right shift of a signed integer duplicates
   the sign bit (ie it is an arithmetic shift, not a logical shift)
 In addition, QEMU assumes that the compiler does not use the latitude
 given in C99 and C11 to treat aspects of signed '<<' as undefined, as
 documented in the GNU Compiler Collection manual starting at version 4.0.
 7. Error handling and reporting
 7.1 Reporting errors to the human user
 Do not use printf(), fprintf() or monitor_printf().  Instead, use
 error_report() or error_vreport() from error-report.h.  This ensures the
 error is reported in the right place (current monitor or stderr), and in
 a uniform format.
 Use error_printf() & friends to print additional information.
 error_report() prints the current location.  In certain common cases
 like command line parsing, the current location is tracked
 automatically.  To manipulate it manually, use the loc_*() from
 error-report.h.
 7.2 Propagating errors
 An error can't always be reported to the user right where it's detected,
 but often needs to be propagated up the call chain to a place that can
 handle it.  This can be done in various ways.
 The most flexible one is Error objects.  See error.h for usage
 information.
 Use the simplest suitable method to communicate success / failure to
 callers.  Stick to common methods: non-negative on success / -1 on
 error, non-negative / -errno, non-null / null, or Error objects.
 Example: when a function returns a non-null pointer on success, and it
 can fail only in one way (as far as the caller is concerned), returning
 null on failure is just fine, and certainly simpler and a lot easier on
 the eyes than propagating an Error object through an Error ** parameter.
 Example: when a function's callers need to report details on failure
 only the function really knows, use Error **, and set suitable errors.
 Do not report an error to the user when you're also returning an error
 for somebody else to handle.  Leave the reporting to the place that
 consumes the error returned.
 7.3 Handling errors
 Calling exit() is fine when handling configuration errors during
 startup.  It's problematic during normal operation.  In particular,
 monitor commands should never exit().
 Do not call exit() or abort() to handle an error that can be triggered
 by the guest (e.g., some unimplemented corner case in guest code
 translation or device emulation).  Guests should not be able to
 terminate QEMU.
 Note that &error_fatal is just another way to exit(1), and &error_abort
 is just another way to abort().
--- a/1
+++ b/1
@@ -0,0 +1 @@
 qemu-kvm-0.12.5
--- a/17
+++ b/17
@@ -1,21 +1,18 @@
 The following points clarify the QEMU license:
-1) QEMU as a whole is released under the GNU General Public License,
+1) QEMU as a whole is released under the GNU General Public License
 version 2.
 2) Parts of QEMU have specific licenses which are compatible with the
-GNU General Public License, version 2. Hence each source file contains
+GNU General Public License. Hence each source file contains its own
-its own licensing information.  Source files with no licensing information
+licensing information.
 are released under the GNU General Public License, version 2 or (at your
 option) any later version.
-As of July 2013, contributions under version 2 of the GNU General Public
+In particular, the QEMU virtual CPU core library (libqemu.a) is
-License (and no later version) are only accepted for the following files
+released under the GNU Lesser General Public License. Many hardware
-or directories: bsd-user/, linux-user/, hw/vfio/, hw/xen/xen_pt*.
+device emulation sources are released under the BSD license.
 3) The Tiny Code Generator (TCG) is released under the BSD license
   (see license headers in files).
 4) QEMU is a trademark of Fabrice Bellard.
-Fabrice Bellard and the QEMU team
+Fabrice Bellard.
--- a/1880
+++ b/1880
--- a/1036
+++ b/1036
--- a/Makefile.hw
+++ b/Makefile.hw
@@ -0,0 +1,55 @@
 # Makefile for qemu target independent devices.
 include ../config-host.mak
 include ../config-all-devices.mak
 include config.mak
 include $(SRC_PATH)/rules.mak
 .PHONY: all
 VPATH=$(SRC_PATH):$(SRC_PATH)/hw
 QEMU_CFLAGS+=-I.. -I$(SRC_PATH)/fpu
 obj-y =
 obj-y += loader.o
 obj-y += virtio.o
 obj-y += fw_cfg.o
 obj-y += watchdog.o
 obj-$(CONFIG_ECC) += ecc.o
 obj-$(CONFIG_NAND) += nand.o
 obj-$(CONFIG_M48T59) += m48t59.o
 obj-$(CONFIG_ESCC) += escc.o
 # PCI watchdog devices
 obj-y += wdt_i6300esb.o
 # MSI-X depends on kvm for interrupt injection,
 # so moved it from Makefile.hw to Makefile.target for now
 # obj-y += msix.o
 # PCI network cards
 obj-y += ne2000.o
 obj-$(CONFIG_SMC91C111) += smc91c111.o
 obj-$(CONFIG_LAN9118) += lan9118.o
 # SCSI layer
 obj-y += lsi53c895a.o
 obj-$(CONFIG_ESP) += esp.o
 obj-y += dma-helpers.o sysbus.o isa-bus.o
 obj-$(CONFIG_QDEV_ADDR) += qdev-addr.o
 all: $(HWLIB)
 # Dummy command so that make thinks it has done something
 	@true
 $(HWLIB): $(obj-y)
 clean:
 	rm -f *.o *.d *.a *~
 # Include automatically generated dependency files
 -include $(wildcard *.d */*.d)
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -1,173 +0,0 @@
 #######################################################################
 # Common libraries for tools and emulators
 stub-obj-y = stubs/ crypto/
 util-obj-y = util/ qobject/ qapi/
 util-obj-y += qmp-introspect.o qapi-types.o qapi-visit.o qapi-event.o
 chardev-obj-y = chardev/
 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img
 block-obj-y += nbd/
 block-obj-y += block.o blockjob.o
 block-obj-y += block/
 block-obj-y += qemu-io-cmds.o
 block-obj-$(CONFIG_REPLICATION) += replication.o
 block-obj-m = block/
 #######################################################################
 # crypto-obj-y is code used by both qemu system emulation and qemu-img
 crypto-obj-y = crypto/
 crypto-aes-obj-y = crypto/
 #######################################################################
 # qom-obj-y is code used by both qemu system emulation and qemu-img
 qom-obj-y = qom/
 #######################################################################
 # io-obj-y is code used by both qemu system emulation and qemu-img
 io-obj-y = io/
 ######################################################################
 # Target independent part of system emulation. The long term path is to
 # suppress *all* target specific code in case of system emulation, i.e. a
 # single QEMU executable should support all CPUs and machines.
 ifeq ($(CONFIG_SOFTMMU),y)
 common-obj-y = blockdev.o blockdev-nbd.o block/
 common-obj-y += iothread.o
 common-obj-y += net/
 common-obj-y += qdev-monitor.o device-hotplug.o
 common-obj-$(CONFIG_WIN32) += os-win32.o
 common-obj-$(CONFIG_POSIX) += os-posix.o
 common-obj-$(CONFIG_LINUX) += fsdev/
 common-obj-y += migration/
 common-obj-y += page_cache.o #aio.o
 common-obj-$(CONFIG_SPICE) += spice-qemu-char.o
 common-obj-y += audio/
 common-obj-y += hw/
 common-obj-y += accel.o
 common-obj-y += replay/
 common-obj-y += ui/
 common-obj-y += bt-host.o bt-vhci.o
 bt-host.o-cflags := $(BLUEZ_CFLAGS)
 common-obj-y += dma-helpers.o
 common-obj-y += vl.o
 vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS)
 common-obj-y += tpm.o
 common-obj-$(CONFIG_SLIRP) += slirp/
 common-obj-y += backends/
 common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o
 common-obj-$(CONFIG_FDT) += device_tree.o
 ######################################################################
 # qapi
 common-obj-y += qmp-marshal.o
 common-obj-y += qmp-introspect.o
 common-obj-y += qmp.o hmp.o
 endif
 #######################################################################
 # Target-independent parts used in system and user emulation
 common-obj-y += cpus-common.o
 common-obj-y += hw/
 common-obj-y += qom/
 common-obj-y += disas/
 ######################################################################
 # Resource file for Windows executables
 version-obj-$(CONFIG_WIN32) += $(BUILD_DIR)/version.o
 ######################################################################
 # tracing
 util-obj-y +=  trace/
 target-obj-y += trace/
 ######################################################################
 # guest agent
 # FIXME: a few definitions from qapi-types.o/qapi-visit.o are needed
 # by libqemuutil.a.  These should be moved to a separate .json schema.
 qga-obj-y = qga/
 qga-vss-dll-obj-y = qga/
 ######################################################################
 # contrib
 ivshmem-client-obj-y = contrib/ivshmem-client/
 ivshmem-server-obj-y = contrib/ivshmem-server/
 libvhost-user-obj-y = contrib/libvhost-user/
 ######################################################################
 trace-events-subdirs =
 trace-events-subdirs += util
 trace-events-subdirs += crypto
 trace-events-subdirs += io
 trace-events-subdirs += migration
 trace-events-subdirs += block
 trace-events-subdirs += backends
 trace-events-subdirs += hw/block
 trace-events-subdirs += hw/block/dataplane
 trace-events-subdirs += hw/char
 trace-events-subdirs += hw/intc
 trace-events-subdirs += hw/net
 trace-events-subdirs += hw/virtio
 trace-events-subdirs += hw/audio
 trace-events-subdirs += hw/misc
 trace-events-subdirs += hw/usb
 trace-events-subdirs += hw/scsi
 trace-events-subdirs += hw/nvram
 trace-events-subdirs += hw/display
 trace-events-subdirs += hw/input
 trace-events-subdirs += hw/timer
 trace-events-subdirs += hw/dma
 trace-events-subdirs += hw/sparc
 trace-events-subdirs += hw/sd
 trace-events-subdirs += hw/isa
 trace-events-subdirs += hw/mem
 trace-events-subdirs += hw/i386
 trace-events-subdirs += hw/i386/xen
 trace-events-subdirs += hw/9pfs
 trace-events-subdirs += hw/ppc
 trace-events-subdirs += hw/pci
 trace-events-subdirs += hw/s390x
 trace-events-subdirs += hw/vfio
 trace-events-subdirs += hw/acpi
 trace-events-subdirs += hw/arm
 trace-events-subdirs += hw/alpha
 trace-events-subdirs += hw/xen
 trace-events-subdirs += ui
 trace-events-subdirs += audio
 trace-events-subdirs += net
 trace-events-subdirs += target/arm
 trace-events-subdirs += target/i386
 trace-events-subdirs += target/sparc
 trace-events-subdirs += target/s390x
 trace-events-subdirs += target/ppc
 trace-events-subdirs += qom
 trace-events-subdirs += linux-user
 trace-events-subdirs += qapi
 trace-events-files = $(SRC_PATH)/trace-events $(trace-events-subdirs:%=$(SRC_PATH)/%/trace-events)
 trace-obj-y = trace-root.o
 trace-obj-y += $(trace-events-subdirs:%=%/trace.o)
 trace-obj-$(CONFIG_TRACE_UST) += trace-ust-all.o
 trace-obj-$(CONFIG_TRACE_DTRACE) += trace-dtrace-root.o
 trace-obj-$(CONFIG_TRACE_DTRACE) += $(trace-events-subdirs:%=%/trace-dtrace.o)
--- a/Makefile.target
+++ b/Makefile.target
@@ -1,242 +1,368 @@
 # -*- Mode: makefile -*-
-BUILD_DIR?=$(CURDIR)/..
+# This needs to be defined before rules.mak
 GENERATED_HEADERS = config-target.h
 include ../config-host.mak
 include config-target.mak
 include config-devices.mak
 include config-target.mak
 include $(SRC_PATH)/rules.mak
-$(call set-vpath, $(SRC_PATH):$(BUILD_DIR))
+TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
-ifdef CONFIG_LINUX
+VPATH=$(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw
-QEMU_CFLAGS += -I../linux-headers
+QEMU_CFLAGS+= -I.. -I$(TARGET_PATH) -DNEED_CPU_H
 endif
 QEMU_CFLAGS += -I.. -I$(SRC_PATH)/target/$(TARGET_BASE_ARCH) -DNEED_CPU_H
 QEMU_CFLAGS+=-I$(SRC_PATH)/include
 ifdef CONFIG_USER_ONLY
 # user emulator name
-QEMU_PROG=qemu-$(TARGET_NAME)
+QEMU_PROG=qemu-$(TARGET_ARCH2)
 QEMU_PROG_BUILD = $(QEMU_PROG)
 else
 # system emulator name
-QEMU_PROG=qemu-system-$(TARGET_NAME)$(EXESUF)
+ifeq ($(TARGET_ARCH), i386)
-ifneq (,$(findstring -mwindows,$(libs_softmmu)))
+QEMU_PROG=qemu$(EXESUF)
 # Terminate program name with a 'w' because the linker builds a windows executable.
 QEMU_PROGW=qemu-system-$(TARGET_NAME)w$(EXESUF)
 $(QEMU_PROG): $(QEMU_PROGW)
 	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"GEN","$(TARGET_DIR)$(QEMU_PROG)")
 QEMU_PROG_BUILD = $(QEMU_PROGW)
 else
-QEMU_PROG_BUILD = $(QEMU_PROG)
+QEMU_PROG=qemu-system-$(TARGET_ARCH2)$(EXESUF)
 endif
 endif
-PROGS=$(QEMU_PROG) $(QEMU_PROGW)
+PROGS=$(QEMU_PROG)
-STPFILES=
+
 LIBS+=-lm
 kvm.o kvm-all.o: QEMU_CFLAGS+=$(KVM_CFLAGS)
 CFLAGS += $(KVM_CFLAGS)
 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak
-ifdef CONFIG_TRACE_SYSTEMTAP
+all: $(PROGS)
 stap: $(QEMU_PROG).stp-installed $(QEMU_PROG).stp $(QEMU_PROG)-simpletrace.stp
 ifdef CONFIG_USER_ONLY
 TARGET_TYPE=user
 else
 TARGET_TYPE=system
 endif
 $(QEMU_PROG).stp-installed: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=stap \
 		--backends=$(TRACE_BACKENDS) \
 		--binary=$(bindir)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp-installed")
 $(QEMU_PROG).stp: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=stap \
 		--backends=$(TRACE_BACKENDS) \
 		--binary=$(realpath .)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp")
 $(QEMU_PROG)-simpletrace.stp: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=simpletrace-stap \
 		--backends=$(TRACE_BACKENDS) \
 		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-simpletrace.stp")
 else
 stap:
 endif
 .PHONY: stap
 all: $(PROGS) stap
 # Dummy command so that make thinks it has done something
 	@true
 #########################################################
 # cpu emulator library
-obj-y = exec.o translate-all.o cpu-exec.o
+libobj-y = exec.o cpu-exec.o
-obj-y += translate-common.o
+libobj-$(CONFIG_NO_CPU_EMULATION) += fake-exec.o
-obj-y += cpu-exec-common.o
+libobj-$(CONFIG_CPU_EMULATION) += translate-all.o translate.o
-obj-y += tcg/tcg.o tcg/tcg-op.o tcg/optimize.o
+libobj-$(CONFIG_CPU_EMULATION) += tcg/tcg.o
-obj-$(CONFIG_TCG_INTERPRETER) += tci.o
+libobj-$(CONFIG_SOFTFLOAT) += fpu/softfloat.o
-obj-y += tcg/tcg-common.o
+libobj-$(CONFIG_NOSOFTFLOAT) += fpu/softfloat-native.o
-obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
+libobj-y += op_helper.o helper.o
-obj-y += fpu/softfloat.o
+libobj-$(CONFIG_NEED_MMU) += mmu.o
 obj-y += target/$(TARGET_BASE_ARCH)/
 obj-y += disas.o
 obj-y += tcg-runtime.o
 obj-$(call notempty,$(TARGET_XML_FILES)) += gdbstub-xml.o
 obj-$(call lnot,$(CONFIG_HAX)) += hax-stub.o
 obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decContext.o
+libobj-$(CONFIG_KVM) += kvm-tpr-opt.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decNumber.o
+libobj-$(CONFIG_KVM) += qemu-kvm-helper.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal32.o
+
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal64.o
+libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal128.o
+libobj-$(TARGET_ALPHA) += alpha_palcode.o
 # NOTE: the disassembler code is only needed for debugging
 libobj-y += disas.o
 libobj-$(CONFIG_ALPHA_DIS) += alpha-dis.o
 libobj-$(CONFIG_ARM_DIS) += arm-dis.o
 libobj-$(CONFIG_CRIS_DIS) += cris-dis.o
 libobj-$(CONFIG_HPPA_DIS) += hppa-dis.o
 libobj-$(CONFIG_I386_DIS) += i386-dis.o
 libobj-$(CONFIG_M68K_DIS) += m68k-dis.o
 libobj-$(CONFIG_MICROBLAZE_DIS) += microblaze-dis.o
 libobj-$(CONFIG_MIPS_DIS) += mips-dis.o
 libobj-$(CONFIG_PPC_DIS) += ppc-dis.o
 libobj-$(CONFIG_S390_DIS) += s390-dis.o
 libobj-$(CONFIG_SH4_DIS) += sh4-dis.o
 libobj-$(CONFIG_SPARC_DIS) += sparc-dis.o
 # libqemu
 libqemu.a: $(libobj-y)
 translate.o: translate.c cpu.h
 translate-all.o: translate-all.c cpu.h
 tcg/tcg.o: cpu.h
 # HELPER_CFLAGS is used for all the code compiled with static register
 # variables
 op_helper.o cpu-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
 # Note: this is a workaround. The real fix is to avoid compiling
 # cpu_signal_handler() in cpu-exec.c.
 signal.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
 qemu-kvm-helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
 #########################################################
 # Linux user emulator target
 ifdef CONFIG_LINUX_USER
-QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) \
+VPATH+=:$(SRC_PATH)/linux-user:$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
-             -I$(SRC_PATH)/linux-user/host/$(ARCH) \
+QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
-             -I$(SRC_PATH)/linux-user
+obj-y = main.o syscall.o strace.o mmap.o signal.o thunk.o \
      elfload.o linuxload.o uaccess.o gdbstub.o
-obj-y += linux-user/
+obj-$(TARGET_HAS_BFLT) += flatload.o
-obj-y += gdbstub.o thunk.o user-exec.o user-exec-stub.o
+obj-$(TARGET_HAS_ELFLOAD32) += elfload32.o
 obj-$(TARGET_I386) += vm86.o
 obj-i386-y += ioport-user.o
 nwfpe-obj-y = fpa11.o fpa11_cpdo.o fpa11_cpdt.o fpa11_cprt.o fpopcode.o
 nwfpe-obj-y += single_cpdo.o double_cpdo.o extended_cpdo.o
 obj-arm-y +=  $(addprefix nwfpe/, $(nwfpe-obj-y))
 obj-arm-y += arm-semi.o
 obj-m68k-y += m68k-sim.o m68k-semi.o
 ARLIBS=../libuser/libuser.a libqemu.a
 endif #CONFIG_LINUX_USER
 #########################################################
 # Darwin user emulator target
 ifdef CONFIG_DARWIN_USER
 VPATH+=:$(SRC_PATH)/darwin-user
 QEMU_CFLAGS+=-I$(SRC_PATH)/darwin-user -I$(SRC_PATH)/darwin-user/$(TARGET_ARCH)
 # Leave some space for the regular program loading zone
 LDFLAGS+=-Wl,-segaddr,__STD_PROG_ZONE,0x1000 -image_base 0x0e000000
 LIBS+=-lmx
 obj-y = main.o commpage.o machload.o mmap.o signal.o syscall.o thunk.o \
        gdbstub.o
 obj-i386-y += ioport-user.o
 ARLIBS=../libuser/libuser.a libqemu.a
 endif #CONFIG_DARWIN_USER
 #########################################################
 # BSD user emulator target
 ifdef CONFIG_BSD_USER
-QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ABI_DIR) \
+VPATH+=:$(SRC_PATH)/bsd-user
-			 -I$(SRC_PATH)/bsd-user/$(HOST_VARIANT_DIR)
+QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ARCH)
-obj-y += bsd-user/
+obj-y = main.o bsdload.o elfload.o mmap.o signal.o strace.o syscall.o \
-obj-y += gdbstub.o user-exec.o user-exec-stub.o
+        gdbstub.o uaccess.o
 obj-i386-y += ioport-user.o
 ARLIBS=../libuser/libuser.a libqemu.a
 endif #CONFIG_BSD_USER
 #########################################################
 # System emulator target
 ifdef CONFIG_SOFTMMU
 obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o numa.o
 obj-y += qtest.o bootdevice.o
 obj-y += hw/
 obj-$(CONFIG_KVM) += kvm-all.o
 obj-y += memory.o cputlb.o
 obj-y += memory_mapping.o
 obj-y += dump.o
 obj-y += migration/ram.o migration/savevm.o
 LIBS := $(libs_softmmu) $(LIBS)
-# xen support
+obj-y = vl.o async.o monitor.o pci.o pci_host.o pcie_host.o machine.o gdbstub.o
-obj-$(CONFIG_XEN) += xen-common.o
+# virtio has to be here due to weird dependency between PCI and virtio-net.
-obj-$(CONFIG_XEN_I386) += xen-hvm.o xen-mapcache.o
+# need to fix this properly
-obj-$(call lnot,$(CONFIG_XEN)) += xen-common-stub.o
+obj-y += virtio-blk.o virtio-balloon.o virtio-net.o virtio-console.o virtio-pci.o
-obj-$(call lnot,$(CONFIG_XEN_I386)) += xen-hvm-stub.o
+obj-$(CONFIG_KVM) += kvm.o kvm-all.o
 # MSI-X depends on kvm for interrupt injection,
 # so moved it from Makefile.hw to Makefile.target for now
 obj-y += msix.o
 obj-$(CONFIG_ISA_MMIO) += isa_mmio.o
 LIBS+=-lz
 sound-obj-y =
 sound-obj-$(CONFIG_SB16) += sb16.o
 sound-obj-$(CONFIG_ES1370) += es1370.o
 sound-obj-$(CONFIG_AC97) += ac97.o
 sound-obj-$(CONFIG_ADLIB) += fmopl.o adlib.o
 sound-obj-$(CONFIG_GUS) += gus.o gusemu_hal.o gusemu_mixer.o
 sound-obj-$(CONFIG_CS4231A) += cs4231a.o
 adlib.o fmopl.o: QEMU_CFLAGS += -DBUILD_Y8950=0
 QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
 QEMU_CFLAGS += $(VNC_SASL_CFLAGS)
 # xen backend driver support
 obj-$(CONFIG_XEN) += xen_machine_pv.o xen_domainbuild.o
 # USB layer
 obj-$(CONFIG_USB_OHCI) += usb-ohci.o
 # PCI network cards
 obj-y += eepro100.o
 obj-y += pcnet.o
 obj-y += rtl8139.o
 obj-y += e1000.o
 # Hardware support
-ifeq ($(TARGET_NAME), sparc64)
+obj-i386-y = ide/core.o ide/qdev.o ide/isa.o ide/pci.o ide/piix.o
-obj-y += hw/sparc64/
+obj-i386-y += pckbd.o $(sound-obj-y) dma.o
 obj-i386-y += vga.o vga-pci.o vga-isa.o
 obj-i386-y += fdc.o mc146818rtc.o serial.o i8259.o i8254.o pcspk.o pc.o
 obj-i386-y += cirrus_vga.o apic.o ioapic.o parallel.o acpi.o piix_pci.o
 obj-i386-y += usb-uhci.o vmmouse.o vmport.o vmware_vga.o hpet.o
 obj-i386-y += device-hotplug.o pci-hotplug.o smbios.o wdt_ib700.o
 obj-i386-y += extboot.o
 obj-i386-y += ne2000-isa.o
 obj-i386-y += testdev.o
 obj-i386-$(CONFIG_KVM_PIT) += i8254-kvm.o
 obj-i386-$(CONFIG_KVM_DEVICE_ASSIGNMENT) += device-assignment.o
 # Hardware support
 obj-ia64-y += ide.o pckbd.o vga.o $(SOUND_HW) dma.o $(AUDIODRV)
 obj-ia64-y += fdc.o mc146818rtc.o serial.o i8259.o ipf.o
 obj-ia64-y += cirrus_vga.o parallel.o acpi.o piix_pci.o
 obj-ia64-y += usb-uhci.o
 obj-ia64-$(CONFIG_KVM_DEVICE_ASSIGNMENT) += device-assignment.o
 # shared objects
 obj-ppc-y = ppc.o ide/core.o ide/qdev.o ide/isa.o ide/pci.o ide/macio.o
 obj-ppc-y += ide/cmd646.o
 obj-ppc-y += vga.o vga-pci.o $(sound-obj-y) dma.o openpic.o
 obj-ppc-y += cirrus_vga.o
 # PREP target
 obj-ppc-y += pckbd.o serial.o i8259.o i8254.o fdc.o mc146818rtc.o
 obj-ppc-y += prep_pci.o ppc_prep.o ne2000-isa.o
 # Mac shared devices
 obj-ppc-y += macio.o cuda.o adb.o mac_nvram.o mac_dbdma.o
 # OldWorld PowerMac
 obj-ppc-y += heathrow_pic.o grackle_pci.o ppc_oldworld.o
 # NewWorld PowerMac
 obj-ppc-y += unin_pci.o ppc_newworld.o
 # PowerPC 4xx boards
 obj-ppc-y += pflash_cfi02.o ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
 obj-ppc-y += ppc440.o ppc440_bamboo.o
 # PowerPC E500 boards
 obj-ppc-y += ppce500_pci.o ppce500_mpc8544ds.o
 obj-ppc-$(CONFIG_KVM) += kvm_ppc.o
 obj-ppc-$(CONFIG_FDT) += device_tree.o
 obj-mips-y = mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
 obj-mips-y += mips_timer.o mips_int.o dma.o vga.o serial.o i8254.o i8259.o rc4030.o
 obj-mips-y += vga-pci.o vga-isa.o vga-isa-mm.o
 obj-mips-y += g364fb.o jazz_led.o dp8393x.o
 obj-mips-y += ide/core.o ide/qdev.o ide/isa.o ide/pci.o ide/piix.o
 obj-mips-y += gt64xxx.o pckbd.o fdc.o mc146818rtc.o usb-uhci.o acpi.o ds1225y.o
 obj-mips-y += piix4.o parallel.o cirrus_vga.o pcspk.o $(sound-obj-y)
 obj-mips-y += mipsnet.o ne2000-isa.o
 obj-mips-y += pflash_cfi01.o
 obj-mips-y += vmware_vga.o
 obj-microblaze-y = petalogix_s3adsp1800_mmu.o
 obj-microblaze-y += microblaze_pic_cpu.o
 obj-microblaze-y += xilinx_intc.o
 obj-microblaze-y += xilinx_timer.o
 obj-microblaze-y += xilinx_uartlite.o
 obj-microblaze-y += xilinx_ethlite.o
 obj-microblaze-y += pflash_cfi02.o
 obj-microblaze-$(CONFIG_FDT) += device_tree.o
 # Boards
 obj-cris-y = cris_pic_cpu.o etraxfs.o axis_dev88.o
 # IO blocks
 obj-cris-y += etraxfs_dma.o
 obj-cris-y += etraxfs_pic.o
 obj-cris-y += etraxfs_eth.o
 obj-cris-y += etraxfs_timer.o
 obj-cris-y += etraxfs_ser.o
 obj-cris-y += pflash_cfi02.o
 ifeq ($(TARGET_ARCH), sparc64)
 obj-sparc-y = sun4u.o pckbd.o apb_pci.o
 obj-sparc-y += ide/core.o ide/qdev.o ide/pci.o ide/cmd646.o
 obj-sparc-y += vga.o vga-pci.o
 obj-sparc-y += fdc.o mc146818rtc.o serial.o
 obj-sparc-y += cirrus_vga.o parallel.o
 else
-obj-y += hw/$(TARGET_BASE_ARCH)/
+obj-sparc-y = sun4m.o lance.o tcx.o iommu.o slavio_intctl.o
 obj-sparc-y += slavio_timer.o slavio_misc.o fdc.o sparc32_dma.o
 obj-sparc-y += cs4231.o eccmemctl.o sbi.o sun4c_intctl.o
 endif
-GENERATED_HEADERS += hmp-commands.h hmp-commands-info.h
+obj-arm-y = integratorcp.o versatilepb.o arm_pic.o arm_timer.o
 obj-arm-y += arm_boot.o pl011.o pl031.o pl050.o pl080.o pl110.o pl181.o pl190.o
 obj-arm-y += versatile_pci.o
 obj-arm-y += realview_gic.o realview.o arm_sysctl.o arm11mpcore.o a9mpcore.o
 obj-arm-y += armv7m.o armv7m_nvic.o stellaris.o pl022.o stellaris_enet.o
 obj-arm-y += pl061.o
 obj-arm-y += arm-semi.o
 obj-arm-y += pxa2xx.o pxa2xx_pic.o pxa2xx_gpio.o pxa2xx_timer.o pxa2xx_dma.o
 obj-arm-y += pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o pxa2xx_keypad.o
 obj-arm-y += pflash_cfi01.o gumstix.o
 obj-arm-y += zaurus.o ide/core.o ide/microdrive.o serial.o spitz.o tosa.o tc6393xb.o
 obj-arm-y += omap1.o omap_lcdc.o omap_dma.o omap_clk.o omap_mmc.o omap_i2c.o
 obj-arm-y += omap2.o omap_dss.o soc_dma.o
 obj-arm-y += omap_sx1.o palm.o tsc210x.o
 obj-arm-y += nseries.o blizzard.o onenand.o vga.o cbus.o tusb6010.o usb-musb.o
 obj-arm-y += mst_fpga.o mainstone.o
 obj-arm-y += musicpal.o pflash_cfi02.o bitbang_i2c.o marvell_88w8618_audio.o
 obj-arm-y += framebuffer.o
 obj-arm-y += syborg.o syborg_fb.o syborg_interrupt.o syborg_keyboard.o
 obj-arm-y += syborg_serial.o syborg_timer.o syborg_pointer.o syborg_rtc.o
 obj-arm-y += syborg_virtio.o
 obj-sh4-y = shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
 obj-sh4-y += sh_timer.o sh_serial.o sh_intc.o sh_pci.o sm501.o serial.o
 obj-sh4-y += ide/core.o ide/mmio.o
 obj-m68k-y = an5206.o mcf5206.o mcf_uart.o mcf_intc.o mcf5208.o mcf_fec.o
 obj-m68k-y += m68k-semi.o dummy_m68k.o
 obj-s390x-y = s390-virtio-bus.o s390-virtio.o
 ifeq ($(TARGET_ARCH), ia64)
 firmware.o: firmware.c
 	$(CC) $(HELPER_CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
 endif
 main.o vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)
 vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)
 vl.o: qemu-options.h
 monitor.o: qemu-monitor.h
 ARLIBS=../libqemu_common.a libqemu.a $(HWLIB)
 endif # CONFIG_SOFTMMU
-# Workaround for http://gcc.gnu.org/PR55489, see configure.
+obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o
 %/translate.o: QEMU_CFLAGS += $(TRANSLATE_OPT_CFLAGS)
-dummy := $(call unnest-vars,,obj-y)
+$(QEMU_PROG): $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y) $(ARLIBS)
-all-obj-y := $(obj-y)
+	$(call LINK,$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y))
 target-obj-y :=
 block-obj-y :=
 common-obj-y :=
 chardev-obj-y :=
 include $(SRC_PATH)/Makefile.objs
 dummy := $(call unnest-vars,,target-obj-y)
 target-obj-y-save := $(target-obj-y)
 dummy := $(call unnest-vars,.., \
               block-obj-y \
               block-obj-m \
               chardev-obj-y \
               crypto-obj-y \
               crypto-aes-obj-y \
               qom-obj-y \
               io-obj-y \
               common-obj-y \
               common-obj-m \
               trace-obj-y)
 target-obj-y := $(target-obj-y-save)
 all-obj-y += $(common-obj-y)
 all-obj-y += $(target-obj-y)
 all-obj-y += $(qom-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y) $(chardev-obj-y)
 all-obj-$(CONFIG_USER_ONLY) += $(crypto-aes-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(crypto-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(io-obj-y)
-$(QEMU_PROG_BUILD): config-devices.mak
+gdbstub-xml.c: $(TARGET_XML_FILES) feature_to_c.sh
 	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/feature_to_c.sh $@ $(TARGET_XML_FILES),"  GEN   $(TARGET_DIR)$@")
-COMMON_LDADDS = $(trace-obj-y) ../libqemuutil.a ../libqemustub.a
+qemu-options.h: $(SRC_PATH)/qemu-options.hx
 	$(call quiet-command,sh $(SRC_PATH)/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
-# build either PROG or PROGW
+qemu-monitor.h: $(SRC_PATH)/qemu-monitor.hx
-$(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS)
+	$(call quiet-command,sh $(SRC_PATH)/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
 	$(call LINK, $(filter-out %.mak, $^))
 ifdef CONFIG_DARWIN
 	$(call quiet-command,Rez -append $(SRC_PATH)/pc-bios/qemu.rsrc -o $@,"REZ","$(TARGET_DIR)$@")
 	$(call quiet-command,SetFile -a C $@,"SETFILE","$(TARGET_DIR)$@")
 endif
-gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
+clean:
-	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/scripts/feature_to_c.sh $@ $(TARGET_XML_FILES),"GEN","$(TARGET_DIR)$@")
+	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
-
+	rm -f *.d */*.d tcg/*.o ide/*.o
-hmp-commands.h: $(SRC_PATH)/hmp-commands.hx $(SRC_PATH)/scripts/hxtool
+	rm -f qemu-options.h qemu-monitor.h gdbstub-xml.c
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$(TARGET_DIR)$@")
 hmp-commands-info.h: $(SRC_PATH)/hmp-commands-info.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$(TARGET_DIR)$@")
 clean: clean-target
 	rm -f *.a *~ $(PROGS)
 	rm -f $(shell find . -name '*.[od]')
 	rm -f hmp-commands.h gdbstub-xml.c
 ifdef CONFIG_TRACE_SYSTEMTAP
 	rm -f *.stp
 endif
 install: all
 ifneq ($(PROGS),)
-	$(call install-prog,$(PROGS),$(DESTDIR)$(bindir))
+	$(INSTALL) -m 755 $(STRIP_OPT) $(PROGS) "$(DESTDIR)$(bindir)"
 endif
 ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
 	$(INSTALL_DATA) $(QEMU_PROG).stp-installed "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG).stp"
 	$(INSTALL_DATA) $(QEMU_PROG)-simpletrace.stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG)-simpletrace.stp"
 endif
-GENERATED_HEADERS += config-target.h
+# Include automatically generated dependency files
-Makefile: $(GENERATED_HEADERS)
+-include $(wildcard *.d */*.d)
--- a/Makefile.user
+++ b/Makefile.user
@@ -0,0 +1,32 @@
 # Makefile for qemu target independent user files.
 include ../config-host.mak
 include $(SRC_PATH)/rules.mak
 -include config.mak
 .PHONY: all
 # Do not take %.o from $(SRC_PATH), only %.c and %.h
 # All %.o for user targets should be built with -fpie, when
 # configured with --enable-user-pie, so we don't want to
 # take %.o from $(SRC_PATH), since they built without -fpie
 vpath %.c %.h $(SRC_PATH)
 QEMU_CFLAGS+=-I..
 obj-y =
 obj-y += envlist.o path.o
 obj-y += tcg-runtime.o host-utils.o
 obj-y += cutils.o cache-utils.o
 all: libuser.a
 # Dummy command so that make thinks it has done something
 	@true
 libuser.a: $(obj-y)
 clean:
 	rm -f *.o *.d *.a *~
 # Include automatically generated dependency files
 -include $(wildcard *.d */*.d)
--- a/QMP/README
+++ b/QMP/README
@@ -0,0 +1,63 @@
                          QEMU Monitor Protocol
                          =====================
 Introduction
 -------------
 The QEMU Monitor Protocol (QMP) allows applications to communicate with
 QEMU's Monitor.
 QMP is JSON[1] based and has the following features:
 - Lightweight, text-based, easy to parse data format
 - Asynchronous events support 
 - Stability
 For more information, please, refer to the following files:
 o qmp-spec.txt    QEMU Monitor Protocol current specification
 o qmp-events.txt  List of available asynchronous events
 There are also two simple Python scripts available:
 o qmp-shell       A shell
 o vm-info         Show some information about the Virtual Machine
 [1] http://www.json.org
 Usage
 -----
 To enable QMP, QEMU has to be started in "control mode". There are
 two ways of doing this, the simplest one is using the the '-qmp'
 command-line option.
 For example:
 $ qemu [...] -qmp tcp:localhost:4444,server
 Will start QEMU in control mode, waiting for a client TCP connection
 on localhost port 4444.
 It is also possible to use the '-mon' command-line option to have
 more complex combinations. Please, refer to the QEMU's manpage for
 more information.
 Simple Testing
 --------------
 To manually test QMP one can connect with telnet and issue commands:
 $ telnet localhost 4444
 Trying 127.0.0.1...
 Connected to localhost.
 Escape character is '^]'.
 {"QMP": {"capabilities": []}}
 { "execute": "query-version" }
 {"return": {"qemu": "0.11.50", "package": ""}}
 Contact
 -------
 http://www.linux-kvm.org/page/MonitorProtocol
 Luiz Fernando N. Capitulino <lcapitulino@redhat.com>
--- a/QMP/qmp-events.txt
+++ b/QMP/qmp-events.txt
@@ -0,0 +1,26 @@
                   QEMU Monitor Protocol: Events
                   =============================
 1 SHUTDOWN
 -----------
 Description: Issued when the Virtual Machine is powered down.
 Data: None.
 2 RESET
 -------
 Description: Issued when the Virtual Machine is reseted.
 Data: None.
 3 STOP
 ------
 Description: Issued when the Virtual Machine is stopped.
 Data: None.
 4 DEBUG
 -------
 Description: Issued when the Virtual Machine enters debug mode.
 Data: None.
--- a/QMP/qmp-shell
+++ b/QMP/qmp-shell
@@ -0,0 +1,72 @@
 #!/usr/bin/python
 #
 # Simple QEMU shell on top of QMP
 #
 # Copyright (C) 2009 Red Hat Inc.
 #
 # Authors:
 #  Luiz Capitulino <lcapitulino@redhat.com>
 #
 # This work is licensed under the terms of the GNU GPL, version 2.  See
 # the COPYING file in the top-level directory.
 #
 # Usage:
 #
 # Start QEMU with:
 #
 # $ qemu [...] -monitor control,unix:./qmp,server
 #
 # Run the shell:
 #
 # $ qmp-shell ./qmp
 #
 # Commands have the following format:
 #
 # < command-name > [ arg-name1=arg1 ] ... [ arg-nameN=argN ]
 #
 # For example:
 #
 # (QEMU) info item=network
 import qmp
 import readline
 from sys import argv,exit
 def shell_help():
    print 'bye  exit from the shell'
 def main():
    if len(argv) != 2:
        print 'qemu-shell <unix-socket>'
        exit(1)
    qemu = qmp.QEMUMonitorProtocol(argv[1])
    qemu.connect()
    print 'Connected!'
    while True:
        try:
            cmd = raw_input('(QEMU) ')
        except EOFError:
            print
            break
        if cmd == '':
            continue
        elif cmd == 'bye':
            break
        elif cmd == 'help':
            shell_help()
        else:
            try:
                resp = qemu.send(cmd)
                if resp == None:
                    print 'Disconnected'
                    break
                print resp
            except IndexError:
                print '-> command format: <command-name> ',
                print '[arg-name1=arg1] ... [arg-nameN=argN]'
 if __name__ == '__main__':
    main()
--- a/QMP/qmp-spec.txt
+++ b/QMP/qmp-spec.txt
@@ -0,0 +1,203 @@
           QEMU Monitor Protocol Specification - Version 0.1
 1. Introduction
 ===============
 This document specifies the QEMU Monitor Protocol (QMP), a JSON-based protocol
 which is available for applications to control QEMU at the machine-level.
 To enable QMP support, QEMU has to be run in "control mode". This is done by
 starting QEMU with the appropriate command-line options. Please, refer to the
 QEMU manual page for more information.
 2. Protocol Specification
 =========================
 This section details the protocol format. For the purpose of this document
 "Client" is any application which is communicating with QEMU in control mode,
 and "Server" is QEMU itself.
 JSON data structures, when mentioned in this document, are always in the
 following format:
    json-DATA-STRUCTURE-NAME
 Where DATA-STRUCTURE-NAME is any valid JSON data structure, as defined by
 the JSON standard:
 http://www.ietf.org/rfc/rfc4627.txt
 For convenience, json-object members and json-array elements mentioned in
 this document will be in a certain order. However, in real protocol usage
 they can be in ANY order, thus no particular order should be assumed.
 2.1 General Definitions
 -----------------------
 2.1.1 All interactions transmitted by the Server are json-objects, always
      terminating with CRLF
 2.1.2 All json-objects members are mandatory when not specified otherwise
 2.2 Server Greeting
 -------------------
 Right when connected the Server will issue a greeting message, which signals
 that the connection has been successfully established and that the Server is
 waiting for commands.
 The format is:
 { "QMP": { "capabilities": json-array } }
 Where,
 - The "capabilities" member specify the availability of features beyond the
  baseline specification
 2.3 Issuing Commands
 --------------------
 The format for command execution is:
 { "execute": json-string, "arguments": json-object, "id": json-value }
 Where,
 - The "execute" member identifies the command to be executed by the Server
 - The "arguments" member is used to pass any arguments required for the
  execution of the command, it is optional when no arguments are required
 - The "id" member is a transaction identification associated with the
  command execution, it is optional and will be part of the response if
  provided
 2.4 Commands Responses
 ----------------------
 There are two possible responses which the Server will issue as the result
 of a command execution: success or error.
 2.4.1 success
 -------------
 The success response is issued when the command execution has finished
 without errors.
 The format is:
 { "return": json-object, "id": json-value }
 Where,
 - The "return" member contains the command returned data, which is defined
  in a per-command basis or an empty json-object if the command does not
  return data
 - The "id" member contains the transaction identification associated
  with the command execution (if issued by the Client)
 2.4.2 error
 -----------
 The error response is issued when the command execution could not be
 completed because of an error condition.
 The format is:
 { "error": { "class": json-string, "data": json-object, "desc": json-string },
  "id": json-value }
 Where,
 - The "class" member contains the error class name (eg. "ServiceUnavailable")
 - The "data" member contains specific error data and is defined in a
  per-command basis, it will be an empty json-object if the error has no data
 - The "desc" member is a human-readable error message. Clients should
  not attempt to parse this message.
 - The "id" member contains the transaction identification associated with
  the command execution (if issued by the Client)
 NOTE: Some errors can occur before the Server is able to read the "id" member,
 in these cases the "id" member will not be part of the error response, even
 if provided by the client.
 2.5 Asynchronous events
 -----------------------
 As a result of state changes, the Server may send messages unilaterally
 to the Client at any time. They are called 'asynchronous events'.
 The format is:
 { "event": json-string, "data": json-object,
  "timestamp": { "seconds": json-number, "microseconds": json-number } }
 Where,
 - The "event" member contains the event's name
 - The "data" member contains event specific data, which is defined in a
  per-event basis, it is optional
 - The "timestamp" member contains the exact time of when the event occurred
  in the Server. It is a fixed json-object with time in seconds and
  microseconds
 For a listing of supported asynchronous events, please, refer to the
 qmp-events.txt file.
 3. QMP Examples
 ===============
 This section provides some examples of real QMP usage, in all of them
 'C' stands for 'Client' and 'S' stands for 'Server'.
 3.1 Server greeting
 -------------------
 S: {"QMP": {"capabilities": []}}
 3.2 Simple 'stop' execution
 ---------------------------
 C: { "execute": "stop" }
 S: {"return": {}}
 3.3 KVM information
 -------------------
 C: { "execute": "query-kvm", "id": "example" }
 S: {"return": {"enabled": true, "present": true}, "id": "example"}
 3.4 Parsing error
 ------------------
 C: { "execute": }
 S: {"error": {"class": "JSONParsing", "desc": "Invalid JSON syntax", "data":
 {}}}
 3.5 Powerdown event
 -------------------
 S: {"timestamp": {"seconds": 1258551470, "microseconds": 802384}, "event":
 "POWERDOWN"}
 4. Compatibility Considerations
 --------------------------------
 In order to achieve maximum compatibility between versions, Clients must not 
 assume any particular:
 - Size of json-objects or length of json-arrays
 - Order of json-object members or json-array elements
 - Amount of errors generated by a command, that is, new errors can be added
  to any existing command in newer versions of the Server
 Additionally, Clients should always:
 - Check the capabilities json-array at connection time
 - Check the availability of commands with 'query-commands' before issuing them
 5. Recommendations to Client implementors
 -----------------------------------------
 5.1 The Server should be always started in pause mode, thus the Client is
    able to perform any setup procedure without the risk of race conditions
    and related problems
--- a/QMP/qmp.py
+++ b/QMP/qmp.py
@@ -0,0 +1,72 @@
 # QEMU Monitor Protocol Python class
 # 
 # Copyright (C) 2009 Red Hat Inc.
 #
 # Authors:
 #  Luiz Capitulino <lcapitulino@redhat.com>
 #
 # This work is licensed under the terms of the GNU GPL, version 2.  See
 # the COPYING file in the top-level directory.
 import socket, json
 class QMPError(Exception):
    pass
 class QMPConnectError(QMPError):
    pass
 class QEMUMonitorProtocol:
    def connect(self):
        self.sock.connect(self.filename)
        data = self.__json_read()
        if data == None:
            raise QMPConnectError
        if not data.has_key('QMP'):
            raise QMPConnectError
        return data['QMP']['capabilities']
    def close(self):
        self.sock.close()
    def send_raw(self, line):
        self.sock.send(str(line))
        return self.__json_read()
    def send(self, cmdline):
        cmd = self.__build_cmd(cmdline)
        self.__json_send(cmd)
        resp = self.__json_read()
        if resp == None:
            return
        elif resp.has_key('error'):
            return resp['error']
        else:
            return resp['return']
    def __build_cmd(self, cmdline):
        cmdargs = cmdline.split()
        qmpcmd = { 'execute': cmdargs[0], 'arguments': {} }
        for arg in cmdargs[1:]:
            opt = arg.split('=')
            try:
                value = int(opt[1])
            except ValueError:
                value = opt[1]
            qmpcmd['arguments'][opt[0]] = value
        return qmpcmd
    def __json_send(self, cmd):
        # XXX: We have to send any additional char, otherwise
        # the Server won't read our input
        self.sock.send(json.dumps(cmd) + ' ')
    def __json_read(self):
        try:
            return json.loads(self.sock.recv(1024))
        except ValueError:
            return
    def __init__(self, filename):
        self.filename = filename
        self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
--- a/QMP/vm-info
+++ b/QMP/vm-info
@@ -0,0 +1,32 @@
 #!/usr/bin/python
 #
 # Print Virtual Machine information
 #
 # Usage:
 #
 # Start QEMU with:
 #
 # $ qemu [...] -monitor control,unix:./qmp,server
 #
 # Run vm-info:
 #
 # $ vm-info ./qmp
 #
 # Luiz Capitulino <lcapitulino@redhat.com>
 import qmp
 from sys import argv,exit
 def main():
    if len(argv) != 2:
        print 'vm-info <unix-socket>'
        exit(1)
    qemu = qmp.QEMUMonitorProtocol(argv[1])
    qemu.connect()
    for cmd in [ 'version', 'hpet', 'kvm', 'status', 'uuid', 'balloon' ]:
        print cmd + ': ' + str(qemu.send('query-' + cmd))
 if __name__ == '__main__':
    main()
--- a/107
+++ b/107
@@ -1,106 +1,3 @@
-         QEMU README
+Read the documentation in qemu-doc.html.
         ===========
-QEMU is a generic and open source machine & userspace emulator and
+Fabrice Bellard.
 virtualizer.
 QEMU is capable of emulating a complete machine in software without any
 need for hardware virtualization support. By using dynamic translation,
 it achieves very good performance. QEMU can also integrate with the Xen
 and KVM hypervisors to provide emulated hardware while allowing the
 hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
 near native performance for CPUs. When QEMU emulates CPUs directly it is
 capable of running operating systems made for one machine (e.g. an ARMv7
 board) on a different machine (e.g. an x86_64 PC board).
 QEMU is also capable of providing userspace API virtualization for Linux
 and BSD kernel interfaces. This allows binaries compiled against one
 architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
 different architecture ABI (e.g. the Linux x86_64 ABI). This does not
 involve any hardware emulation, simply CPU and syscall emulation.
 QEMU aims to fit into a variety of use cases. It can be invoked directly
 by users wishing to have full control over its behaviour and settings.
 It also aims to facilitate integration into higher level management
 layers, by providing a stable command line interface and monitor API.
 It is commonly invoked indirectly via the libvirt library when using
 open source applications such as oVirt, OpenStack and virt-manager.
 QEMU as a whole is released under the GNU General Public License,
 version 2. For full licensing details, consult the LICENSE file.
 Building
 ========
 QEMU is multi-platform software intended to be buildable on all modern
 Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
 of other UNIX targets. The simple steps to build QEMU are:
  mkdir build
  cd build
  ../configure
  make
 Additional information can also be found online via the QEMU website:
  http://qemu-project.org/Hosts/Linux
  http://qemu-project.org/Hosts/Mac
  http://qemu-project.org/Hosts/W32
 Submitting patches
 ==================
 The QEMU source code is maintained under the GIT version control system.
   git clone git://git.qemu-project.org/qemu.git
 When submitting patches, the preferred approach is to use 'git
 format-patch' and/or 'git send-email' to format & send the mail to the
 qemu-devel@nongnu.org mailing list. All patches submitted must contain
 a 'Signed-off-by' line from the author. Patches should follow the
 guidelines set out in the HACKING and CODING_STYLE files.
 Additional information on submitting patches can be found online via
 the QEMU website
  http://qemu-project.org/Contribute/SubmitAPatch
  http://qemu-project.org/Contribute/TrivialPatches
 Bug reporting
 =============
 The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
 found when running code built from QEMU git or upstream released sources
 should be reported via:
  https://bugs.launchpad.net/qemu/
 If using QEMU via an operating system vendor pre-built binary package, it
 is preferable to report bugs to the vendor's own bug tracker first. If
 the bug is also known to affect latest upstream code, it can also be
 reported via launchpad.
 For additional information on bug reporting consult:
  http://qemu-project.org/Contribute/ReportABug
 Contact
 =======
 The QEMU community can be contacted in a number of ways, with the two
 main methods being email and IRC
 - qemu-devel@nongnu.org
   http://lists.nongnu.org/mailman/listinfo/qemu-devel
 - #qemu on irc.oftc.net
 Information on additional methods of contacting the community can be
 found online via the QEMU website:
  http://qemu-project.org/Contribute/StartHere
 -- End
--- a/37
+++ b/37
@@ -0,0 +1,37 @@
 General:
 -------
 - cycle counter for all archs
 - cpu_interrupt() win32/SMP fix
 - merge PIC spurious interrupt patch
 - warning for OS/2: must not use 128 MB memory (merge bochs cmos patch ?)
 - config file (at least for windows/Mac OS X)
 - update doc: PCI infos.
 - basic VGA optimizations
 - better code fetch
 - do not resize vga if invalid size.
 - TLB code protection support for PPC
 - disable SMC handling for ARM/SPARC/PPC (not finished)
 - see undefined flags for BTx insn
 - keyboard output buffer filling timing emulation
 - tests for each target CPU
 - fix all remaining thread lock issues (must put TBs in a specific invalid
  state, find a solution for tb_flush()).
 ppc specific:
 ------------
 - TLB invalidate not needed if msr_pr changes
 - enable shift optimizations ?
 linux-user specific:
 -------------------
 - remove threading support as it cannot work at this point
 - improve IPC syscalls
 - more syscalls (in particular all 64 bit ones, IPCs, fix 64 bit
  issues, fix 16 bit uid issues)
 - use kernel traps for unaligned accesses on ARM ?
 lower priority:
 --------------
 - int15 ah=86: use better timing
 - use -msoft-float on ARM
--- a/2
+++ b/2
@@ -1 +1 @@
-2.8.50
+0.12.5
--- a/a.out.h
+++ b/a.out.h
@@ -0,0 +1,430 @@
 /* a.out.h
   Copyright 1997, 1998, 1999, 2001 Red Hat, Inc.
 This file is part of Cygwin.
 This software is a copyrighted work licensed under the terms of the
 Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
 details. */
 #ifndef _A_OUT_H_
 #define _A_OUT_H_
 #ifdef __cplusplus
 extern "C" {
 #endif
 #define COFF_IMAGE_WITH_PE
 #define COFF_LONG_SECTION_NAMES
 /*** coff information for Intel 386/486.  */
 /********************** FILE HEADER **********************/
 struct external_filehdr {
  short f_magic;	/* magic number			*/
  short f_nscns;	/* number of sections		*/
  host_ulong f_timdat;	/* time & date stamp		*/
  host_ulong f_symptr;	/* file pointer to symtab	*/
  host_ulong f_nsyms;	/* number of symtab entries	*/
  short f_opthdr;	/* sizeof(optional hdr)		*/
  short f_flags;	/* flags			*/
 };
 /* Bits for f_flags:
 *	F_RELFLG	relocation info stripped from file
 *	F_EXEC		file is executable (no unresolved external references)
 *	F_LNNO		line numbers stripped from file
 *	F_LSYMS		local symbols stripped from file
 *	F_AR32WR	file has byte ordering of an AR32WR machine (e.g. vax)
 */
 #define F_RELFLG	(0x0001)
 #define F_EXEC		(0x0002)
 #define F_LNNO		(0x0004)
 #define F_LSYMS		(0x0008)
 #define	I386MAGIC	0x14c
 #define I386PTXMAGIC	0x154
 #define I386AIXMAGIC	0x175
 /* This is Lynx's all-platform magic number for executables. */
 #define LYNXCOFFMAGIC	0415
 #define I386BADMAG(x) (((x).f_magic != I386MAGIC) \
 		       && (x).f_magic != I386AIXMAGIC \
 		       && (x).f_magic != I386PTXMAGIC \
 		       && (x).f_magic != LYNXCOFFMAGIC)
 #define	FILHDR	struct external_filehdr
 #define	FILHSZ	20
 /********************** AOUT "OPTIONAL HEADER"=
 **********************/
 typedef struct
 {
  unsigned short magic;		/* type of file				*/
  unsigned short vstamp;	/* version stamp			*/
  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
  host_ulong	dsize;		/* initialized data "  "		*/
  host_ulong	bsize;		/* uninitialized data "   "		*/
  host_ulong	entry;		/* entry pt.				*/
  host_ulong text_start;	/* base of text used for this file */
  host_ulong data_start;	/* base of data used for this file=
 */
 }
 AOUTHDR;
 #define AOUTSZ 28
 #define AOUTHDRSZ 28
 #define OMAGIC          0404    /* object files, eg as output */
 #define ZMAGIC          0413    /* demand load format, eg normal ld output */
 #define STMAGIC		0401	/* target shlib */
 #define SHMAGIC		0443	/* host   shlib */
 /* define some NT default values */
 /*  #define NT_IMAGE_BASE        0x400000 moved to internal.h */
 #define NT_SECTION_ALIGNMENT 0x1000
 #define NT_FILE_ALIGNMENT    0x200
 #define NT_DEF_RESERVE       0x100000
 #define NT_DEF_COMMIT        0x1000
 /********************** SECTION HEADER **********************/
 struct external_scnhdr {
  char		s_name[8];	/* section name			*/
  host_ulong	s_paddr;	/* physical address, offset
 				   of last addr in scn */
  host_ulong	s_vaddr;	/* virtual address		*/
  host_ulong	s_size;		/* section size			*/
  host_ulong	s_scnptr;	/* file ptr to raw data for section */
  host_ulong	s_relptr;	/* file ptr to relocation	*/
  host_ulong	s_lnnoptr;	/* file ptr to line numbers	*/
  unsigned short s_nreloc;	/* number of relocation entries	*/
  unsigned short s_nlnno;	/* number of line number entries*/
  host_ulong	s_flags;	/* flags			*/
 };
 #define	SCNHDR	struct external_scnhdr
 #define	SCNHSZ	40
 /*
 * names of "special" sections
 */
 #define _TEXT	".text"
 #define _DATA	".data"
 #define _BSS	".bss"
 #define _COMMENT ".comment"
 #define _LIB ".lib"
 /********************** LINE NUMBERS **********************/
 /* 1 line number entry for every "breakpointable" source line in a section.
 * Line numbers are grouped on a per function basis; first entry in a function
 * grouping will have l_lnno = 0 and in place of physical address will be the
 * symbol table index of the function name.
 */
 struct external_lineno {
  union {
    host_ulong l_symndx; /* function name symbol index, iff l_lnno 0 */
    host_ulong l_paddr;	/* (physical) address of line number	*/
  } l_addr;
  unsigned short l_lnno;	/* line number		*/
 };
 #define	LINENO	struct external_lineno
 #define	LINESZ	6
 /********************** SYMBOLS **********************/
 #define E_SYMNMLEN	8	/* # characters in a symbol name	*/
 #define E_FILNMLEN	14	/* # characters in a file name		*/
 #define E_DIMNUM	4	/* # array dimensions in auxiliary entry */
 struct __attribute__((packed)) external_syment
 {
  union {
    char e_name[E_SYMNMLEN];
    struct {
      host_ulong e_zeroes;
      host_ulong e_offset;
    } e;
  } e;
  host_ulong e_value;
  unsigned short e_scnum;
  unsigned short e_type;
  char e_sclass[1];
  char e_numaux[1];
 };
 #define N_BTMASK	(0xf)
 #define N_TMASK		(0x30)
 #define N_BTSHFT	(4)
 #define N_TSHIFT	(2)
 union external_auxent {
  struct {
    host_ulong x_tagndx;	/* str, un, or enum tag indx */
    union {
      struct {
 	unsigned short  x_lnno; /* declaration line number */
 	unsigned short  x_size; /* str/union/array size */
      } x_lnsz;
      host_ulong x_fsize;	/* size of function */
    } x_misc;
    union {
      struct {			/* if ISFCN, tag, or .bb */
 	host_ulong x_lnnoptr;/* ptr to fcn line # */
 	host_ulong x_endndx;	/* entry ndx past block end */
      } x_fcn;
      struct {			/* if ISARY, up to 4 dimen. */
 	char x_dimen[E_DIMNUM][2];
      } x_ary;
    } x_fcnary;
    unsigned short x_tvndx;	/* tv index */
  } x_sym;
  union {
    char x_fname[E_FILNMLEN];
    struct {
      host_ulong x_zeroes;
      host_ulong x_offset;
    } x_n;
  } x_file;
  struct {
    host_ulong x_scnlen;	/* section length */
    unsigned short x_nreloc;	/* # relocation entries */
    unsigned short x_nlinno;	/* # line numbers */
    host_ulong x_checksum;	/* section COMDAT checksum */
    unsigned short x_associated;/* COMDAT associated section index */
    char x_comdat[1];		/* COMDAT selection number */
  } x_scn;
  struct {
    host_ulong x_tvfill;	/* tv fill value */
    unsigned short x_tvlen;	/* length of .tv */
    char x_tvran[2][2];		/* tv range */
  } x_tv;	/* info about .tv section (in auxent of symbol .tv)) */
 };
 #define	SYMENT	struct external_syment
 #define	SYMESZ	18
 #define	AUXENT	union external_auxent
 #define	AUXESZ	18
 #define _ETEXT	"etext"
 /********************** RELOCATION DIRECTIVES **********************/
 struct external_reloc {
  char r_vaddr[4];
  char r_symndx[4];
  char r_type[2];
 };
 #define RELOC struct external_reloc
 #define RELSZ 10
 /* end of coff/i386.h */
 /* PE COFF header information */
 #ifndef _PE_H
 #define _PE_H
 /* NT specific file attributes */
 #define IMAGE_FILE_RELOCS_STRIPPED           0x0001
 #define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002
 #define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004
 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008
 #define IMAGE_FILE_BYTES_REVERSED_LO         0x0080
 #define IMAGE_FILE_32BIT_MACHINE             0x0100
 #define IMAGE_FILE_DEBUG_STRIPPED            0x0200
 #define IMAGE_FILE_SYSTEM                    0x1000
 #define IMAGE_FILE_DLL                       0x2000
 #define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
 /* additional flags to be set for section headers to allow the NT loader to
   read and write to the section data (to replace the addresses of data in
   dlls for one thing); also to execute the section in .text's case=
 */
 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
 #define IMAGE_SCN_MEM_EXECUTE     0x20000000
 #define IMAGE_SCN_MEM_READ        0x40000000
 #define IMAGE_SCN_MEM_WRITE       0x80000000
 /*
 * Section characteristics added for ppc-nt
 */
 #define IMAGE_SCN_TYPE_NO_PAD                0x00000008  /* Reserved.  */
 #define IMAGE_SCN_CNT_CODE                   0x00000020  /* Section contains code. */
 #define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  /* Section contains initialized data. */
 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  /* Section contains uninitialized data. */
 #define IMAGE_SCN_LNK_OTHER                  0x00000100  /* Reserved.  */
 #define IMAGE_SCN_LNK_INFO                   0x00000200  /* Section contains comments or some other type of information. */
 #define IMAGE_SCN_LNK_REMOVE                 0x00000800  /* Section contents will not become part of image. */
 #define IMAGE_SCN_LNK_COMDAT                 0x00001000  /* Section contents comdat. */
 #define IMAGE_SCN_MEM_FARDATA                0x00008000
 #define IMAGE_SCN_MEM_PURGEABLE              0x00020000
 #define IMAGE_SCN_MEM_16BIT                  0x00020000
 #define IMAGE_SCN_MEM_LOCKED                 0x00040000
 #define IMAGE_SCN_MEM_PRELOAD                0x00080000
 #define IMAGE_SCN_ALIGN_1BYTES               0x00100000
 #define IMAGE_SCN_ALIGN_2BYTES               0x00200000
 #define IMAGE_SCN_ALIGN_4BYTES               0x00300000
 #define IMAGE_SCN_ALIGN_8BYTES               0x00400000
 #define IMAGE_SCN_ALIGN_16BYTES              0x00500000  /* Default alignment if no others are specified. */
 #define IMAGE_SCN_ALIGN_32BYTES              0x00600000
 #define IMAGE_SCN_ALIGN_64BYTES              0x00700000
 #define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000  /* Section contains extended relocations. */
 #define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  /* Section is not cachable.               */
 #define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  /* Section is not pageable.               */
 #define IMAGE_SCN_MEM_SHARED                 0x10000000  /* Section is shareable.                  */
 /* COMDAT selection codes.  */
 #define IMAGE_COMDAT_SELECT_NODUPLICATES     (1) /* Warn if duplicates.  */
 #define IMAGE_COMDAT_SELECT_ANY		     (2) /* No warning.  */
 #define IMAGE_COMDAT_SELECT_SAME_SIZE	     (3) /* Warn if different size.  */
 #define IMAGE_COMDAT_SELECT_EXACT_MATCH	     (4) /* Warn if different.  */
 #define IMAGE_COMDAT_SELECT_ASSOCIATIVE	     (5) /* Base on other section.  */
 /* Magic values that are true for all dos/nt implementations */
 #define DOSMAGIC       0x5a4d
 #define NT_SIGNATURE   0x00004550
 /* NT allows long filenames, we want to accommodate this.  This may break
     some of the bfd functions */
 #undef  FILNMLEN
 #define FILNMLEN	18	/* # characters in a file name		*/
 #ifdef COFF_IMAGE_WITH_PE
 /* The filehdr is only weired in images */
 #undef FILHDR
 struct external_PE_filehdr
 {
  /* DOS header fields */
  unsigned short e_magic;	/* Magic number, 0x5a4d */
  unsigned short e_cblp;	/* Bytes on last page of file, 0x90 */
  unsigned short e_cp;		/* Pages in file, 0x3 */
  unsigned short e_crlc;	/* Relocations, 0x0 */
  unsigned short e_cparhdr;	/* Size of header in paragraphs, 0x4 */
  unsigned short e_minalloc;	/* Minimum extra paragraphs needed, 0x0 */
  unsigned short e_maxalloc;	/* Maximum extra paragraphs needed, 0xFFFF */
  unsigned short e_ss;		/* Initial (relative) SS value, 0x0 */
  unsigned short e_sp;		/* Initial SP value, 0xb8 */
  unsigned short e_csum;	/* Checksum, 0x0 */
  unsigned short e_ip;		/* Initial IP value, 0x0 */
  unsigned short e_cs;		/* Initial (relative) CS value, 0x0 */
  unsigned short e_lfarlc;	/* File address of relocation table, 0x40 */
  unsigned short e_ovno;	/* Overlay number, 0x0 */
  char e_res[4][2];		/* Reserved words, all 0x0 */
  unsigned short e_oemid;	/* OEM identifier (for e_oeminfo), 0x0 */
  unsigned short e_oeminfo;	/* OEM information; e_oemid specific, 0x0 */
  char e_res2[10][2];		/* Reserved words, all 0x0 */
  host_ulong e_lfanew;	/* File address of new exe header, 0x80 */
  char dos_message[16][4];	/* other stuff, always follow DOS header */
  unsigned int nt_signature;	/* required NT signature, 0x4550 */
  /* From standard header */
  unsigned short f_magic;	/* magic number			*/
  unsigned short f_nscns;	/* number of sections		*/
  host_ulong f_timdat;	/* time & date stamp		*/
  host_ulong f_symptr;	/* file pointer to symtab	*/
  host_ulong f_nsyms;	/* number of symtab entries	*/
  unsigned short f_opthdr;	/* sizeof(optional hdr)		*/
  unsigned short f_flags;	/* flags			*/
 };
 #define FILHDR struct external_PE_filehdr
 #undef FILHSZ
 #define FILHSZ 152
 #endif
 typedef struct
 {
  unsigned short magic;		/* type of file				*/
  unsigned short vstamp;	/* version stamp			*/
  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
  host_ulong	dsize;		/* initialized data "  "		*/
  host_ulong	bsize;		/* uninitialized data "   "		*/
  host_ulong	entry;		/* entry pt.				*/
  host_ulong text_start;	/* base of text used for this file */
  host_ulong data_start;	/* base of all data used for this file */
  /* NT extra fields; see internal.h for descriptions */
  host_ulong  ImageBase;
  host_ulong  SectionAlignment;
  host_ulong  FileAlignment;
  unsigned short  MajorOperatingSystemVersion;
  unsigned short  MinorOperatingSystemVersion;
  unsigned short  MajorImageVersion;
  unsigned short  MinorImageVersion;
  unsigned short  MajorSubsystemVersion;
  unsigned short  MinorSubsystemVersion;
  char  Reserved1[4];
  host_ulong  SizeOfImage;
  host_ulong  SizeOfHeaders;
  host_ulong  CheckSum;
  unsigned short Subsystem;
  unsigned short DllCharacteristics;
  host_ulong  SizeOfStackReserve;
  host_ulong  SizeOfStackCommit;
  host_ulong  SizeOfHeapReserve;
  host_ulong  SizeOfHeapCommit;
  host_ulong  LoaderFlags;
  host_ulong  NumberOfRvaAndSizes;
  /* IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; */
  char  DataDirectory[16][2][4]; /* 16 entries, 2 elements/entry, 4 chars */
 } PEAOUTHDR;
 #undef AOUTSZ
 #define AOUTSZ (AOUTHDRSZ + 196)
 #undef  E_FILNMLEN
 #define E_FILNMLEN	18	/* # characters in a file name		*/
 #endif
 /* end of coff/pe.h */
 #define DT_NON		(0)	/* no derived type */
 #define DT_PTR		(1)	/* pointer */
 #define DT_FCN		(2)	/* function */
 #define DT_ARY		(3)	/* array */
 #define ISPTR(x)	(((x) & N_TMASK) == (DT_PTR << N_BTSHFT))
 #define ISFCN(x)	(((x) & N_TMASK) == (DT_FCN << N_BTSHFT))
 #define ISARY(x)	(((x) & N_TMASK) == (DT_ARY << N_BTSHFT))
 #ifdef __cplusplus
 }
 #endif
 #endif /* _A_OUT_H_ */
--- a/accel.c
+++ b/accel.c
@@ -1,155 +0,0 @@
 /*
 * QEMU System Emulator, accelerator interfaces
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
 * Copyright (c) 2014 Red Hat Inc.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "sysemu/accel.h"
 #include "hw/boards.h"
 #include "qemu-common.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "sysemu/qtest.h"
 #include "hw/xen/xen.h"
 #include "qom/object.h"
 int tcg_tb_size;
 static bool tcg_allowed = true;
 static int tcg_init(MachineState *ms)
 {
    tcg_exec_init(tcg_tb_size * 1024 * 1024);
    return 0;
 }
 static const TypeInfo accel_type = {
    .name = TYPE_ACCEL,
    .parent = TYPE_OBJECT,
    .class_size = sizeof(AccelClass),
    .instance_size = sizeof(AccelState),
 };
 /* Lookup AccelClass from opt_name. Returns NULL if not found */
 static AccelClass *accel_find(const char *opt_name)
 {
    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
    g_free(class_name);
    return ac;
 }
 static int accel_init_machine(AccelClass *acc, MachineState *ms)
 {
    ObjectClass *oc = OBJECT_CLASS(acc);
    const char *cname = object_class_get_name(oc);
    AccelState *accel = ACCEL(object_new(cname));
    int ret;
    ms->accelerator = accel;
    *(acc->allowed) = true;
    ret = acc->init_machine(ms);
    if (ret < 0) {
        ms->accelerator = NULL;
        *(acc->allowed) = false;
        object_unref(OBJECT(accel));
    }
    return ret;
 }
 void configure_accelerator(MachineState *ms)
 {
    const char *p;
    char buf[10];
    int ret;
    bool accel_initialised = false;
    bool init_failed = false;
    AccelClass *acc = NULL;
    p = qemu_opt_get(qemu_get_machine_opts(), "accel");
    if (p == NULL) {
        /* Use the default "accelerator", tcg */
        p = "tcg";
    }
    while (!accel_initialised && *p != '\0') {
        if (*p == ':') {
            p++;
        }
        p = get_opt_name(buf, sizeof(buf), p, ':');
        acc = accel_find(buf);
        if (!acc) {
            fprintf(stderr, "\"%s\" accelerator not found.\n", buf);
            continue;
        }
        if (acc->available && !acc->available()) {
            printf("%s not supported for this target\n",
                   acc->name);
            continue;
        }
        ret = accel_init_machine(acc, ms);
        if (ret < 0) {
            init_failed = true;
            fprintf(stderr, "failed to initialize %s: %s\n",
                    acc->name,
                    strerror(-ret));
        } else {
            accel_initialised = true;
        }
    }
    if (!accel_initialised) {
        if (!init_failed) {
            fprintf(stderr, "No accelerator found!\n");
        }
        exit(1);
    }
    if (init_failed) {
        fprintf(stderr, "Back to %s accelerator.\n", acc->name);
    }
 }
 static void tcg_accel_class_init(ObjectClass *oc, void *data)
 {
    AccelClass *ac = ACCEL_CLASS(oc);
    ac->name = "tcg";
    ac->init_machine = tcg_init;
    ac->allowed = &tcg_allowed;
 }
 #define TYPE_TCG_ACCEL ACCEL_CLASS_NAME("tcg")
 static const TypeInfo tcg_accel_type = {
    .name = TYPE_TCG_ACCEL,
    .parent = TYPE_ACCEL,
    .class_init = tcg_accel_class_init,
 };
 static void register_accel_types(void)
 {
    type_register_static(&accel_type);
    type_register_static(&tcg_accel_type);
 }
 type_init(register_accel_types);
--- a/util/acl.c
+++ b/util/acl.c
@@ -23,9 +23,9 @@
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "qemu/acl.h"
+#include "sysemu.h"
 #include "acl.h"
 #ifdef CONFIG_FNMATCH
 #include <fnmatch.h>
@@ -56,8 +56,8 @@ qemu_acl *qemu_acl_init(const char *aclname)
    if (acl)
        return acl;
-    acl = g_malloc(sizeof(*acl));
+    acl = qemu_malloc(sizeof(*acl));
-    acl->aclname = g_strdup(aclname);
+    acl->aclname = qemu_strdup(aclname);
    /* Deny by default, so there is no window of "open
     * access" between QEMU starting, and the user setting
     * up ACLs in the monitor */
@@ -66,7 +66,7 @@ qemu_acl *qemu_acl_init(const char *aclname)
    acl->nentries = 0;
    QTAILQ_INIT(&acl->entries);
-    acls = g_realloc(acls, sizeof(*acls) * (nacls +1));
+    acls = qemu_realloc(acls, sizeof(*acls) * (nacls +1));
    acls[nacls] = acl;
    nacls++;
@@ -96,16 +96,16 @@ int qemu_acl_party_is_allowed(qemu_acl *acl,
 void qemu_acl_reset(qemu_acl *acl)
 {
-    qemu_acl_entry *entry, *next_entry;
+    qemu_acl_entry *entry;
    /* Put back to deny by default, so there is no window
     * of "open access" while the user re-initializes the
     * access control list */
    acl->defaultDeny = 1;
-    QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) {
+    QTAILQ_FOREACH(entry, &acl->entries, next) {
        QTAILQ_REMOVE(&acl->entries, entry, next);
-        g_free(entry->match);
+        free(entry->match);
-        g_free(entry);
+        free(entry);
    }
    acl->nentries = 0;
 }
@@ -117,8 +117,8 @@ int qemu_acl_append(qemu_acl *acl,
 {
    qemu_acl_entry *entry;
-    entry = g_malloc(sizeof(*entry));
+    entry = qemu_malloc(sizeof(*entry));
-    entry->match = g_strdup(match);
+    entry->match = qemu_strdup(match);
    entry->deny = deny;
    QTAILQ_INSERT_TAIL(&acl->entries, entry, next);
@@ -133,23 +133,23 @@ int qemu_acl_insert(qemu_acl *acl,
                    const char *match,
                    int index)
 {
    qemu_acl_entry *entry;
    qemu_acl_entry *tmp;
    int i = 0;
    if (index <= 0)
        return -1;
-    if (index > acl->nentries) {
+    if (index >= acl->nentries)
        return qemu_acl_append(acl, deny, match);
-    }
+
    entry = qemu_malloc(sizeof(*entry));
    entry->match = qemu_strdup(match);
    entry->deny = deny;
    QTAILQ_FOREACH(tmp, &acl->entries, next) {
        i++;
        if (i == index) {
            qemu_acl_entry *entry;
            entry = g_malloc(sizeof(*entry));
            entry->match = g_strdup(match);
            entry->deny = deny;
            QTAILQ_INSERT_BEFORE(tmp, entry, next);
            acl->nentries++;
            break;
@@ -169,11 +169,17 @@ int qemu_acl_remove(qemu_acl *acl,
        i++;
        if (strcmp(entry->match, match) == 0) {
            QTAILQ_REMOVE(&acl->entries, entry, next);
            acl->nentries--;
            g_free(entry->match);
            g_free(entry);
            return i;
        }
    }
    return -1;
 }
 /*
 * Local variables:
 *  c-indent-level: 4
 *  c-basic-offset: 4
 *  tab-width: 8
 * End:
 */
--- a/include/qemu/acl.h
+++ b/include/qemu/acl.h
@@ -22,10 +22,10 @@
 * THE SOFTWARE.
 */
-#ifndef QEMU_ACL_H
+#ifndef __QEMU_ACL_H__
-#define QEMU_ACL_H
+#define __QEMU_ACL_H__
-#include "qemu/queue.h"
+#include "qemu-queue.h"
 typedef struct qemu_acl_entry qemu_acl_entry;
 typedef struct qemu_acl qemu_acl;
@@ -63,4 +63,12 @@ int qemu_acl_insert(qemu_acl *acl,
 int qemu_acl_remove(qemu_acl *acl,
 		    const char *match);
-#endif /* QEMU_ACL_H */
+#endif /* __QEMU_ACL_H__ */
 /*
 * Local variables:
 *  c-indent-level: 4
 *  c-basic-offset: 4
 *  tab-width: 8
 * End:
 */
--- a/aes.c
+++ b/aes.c
--- a/aes.h
+++ b/aes.h
@@ -0,0 +1,26 @@
 #ifndef QEMU_AES_H
 #define QEMU_AES_H
 #define AES_MAXNR 14
 #define AES_BLOCK_SIZE 16
 struct aes_key_st {
    uint32_t rd_key[4 *(AES_MAXNR + 1)];
    int rounds;
 };
 typedef struct aes_key_st AES_KEY;
 int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 	AES_KEY *key);
 int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
 	AES_KEY *key);
 void AES_encrypt(const unsigned char *in, unsigned char *out,
 	const AES_KEY *key);
 void AES_decrypt(const unsigned char *in, unsigned char *out,
 	const AES_KEY *key);
 void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
 		     const unsigned long length, const AES_KEY *key,
 		     unsigned char *ivec, const int enc);
 #endif
--- a/aio.c
+++ b/aio.c
@@ -0,0 +1,230 @@
 /*
 * QEMU aio implementation
 *
 * Copyright IBM, Corp. 2008
 *
 * Authors:
 *  Anthony Liguori   <aliguori@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
 #include "qemu-common.h"
 #include "block.h"
 #include "qemu-queue.h"
 #include "qemu_socket.h"
 typedef struct AioHandler AioHandler;
 /* The list of registered AIO handlers */
 static QLIST_HEAD(, AioHandler) aio_handlers;
 /* This is a simple lock used to protect the aio_handlers list.  Specifically,
 * it's used to ensure that no callbacks are removed while we're walking and
 * dispatching callbacks.
 */
 static int walking_handlers;
 struct AioHandler
 {
    int fd;
    IOHandler *io_read;
    IOHandler *io_write;
    AioFlushHandler *io_flush;
    AioProcessQueue *io_process_queue;
    int deleted;
    void *opaque;
    QLIST_ENTRY(AioHandler) node;
 };
 static AioHandler *find_aio_handler(int fd)
 {
    AioHandler *node;
    QLIST_FOREACH(node, &aio_handlers, node) {
        if (node->fd == fd)
            if (!node->deleted)
                return node;
    }
    return NULL;
 }
 int qemu_aio_set_fd_handler(int fd,
                            IOHandler *io_read,
                            IOHandler *io_write,
                            AioFlushHandler *io_flush,
                            AioProcessQueue *io_process_queue,
                            void *opaque)
 {
    AioHandler *node;
    node = find_aio_handler(fd);
    /* Are we deleting the fd handler? */
    if (!io_read && !io_write) {
        if (node) {
            /* If the lock is held, just mark the node as deleted */
            if (walking_handlers)
                node->deleted = 1;
            else {
                /* Otherwise, delete it for real.  We can't just mark it as
                 * deleted because deleted nodes are only cleaned up after
                 * releasing the walking_handlers lock.
                 */
                QLIST_REMOVE(node, node);
                qemu_free(node);
            }
        }
    } else {
        if (node == NULL) {
            /* Alloc and insert if it's not already there */
            node = qemu_mallocz(sizeof(AioHandler));
            node->fd = fd;
            QLIST_INSERT_HEAD(&aio_handlers, node, node);
        }
        /* Update handler with latest information */
        node->io_read = io_read;
        node->io_write = io_write;
        node->io_flush = io_flush;
        node->io_process_queue = io_process_queue;
        node->opaque = opaque;
    }
    qemu_set_fd_handler2(fd, NULL, io_read, io_write, opaque);
    return 0;
 }
 void qemu_aio_flush(void)
 {
    AioHandler *node;
    int ret;
    do {
        ret = 0;
 	/*
 	 * If there are pending emulated aio start them now so flush
 	 * will be able to return 1.
 	 */
        qemu_aio_wait();
        QLIST_FOREACH(node, &aio_handlers, node) {
            if (node->io_flush) {
                ret |= node->io_flush(node->opaque);
            }
        }
    } while (qemu_bh_poll() || ret > 0);
 }
 int qemu_aio_process_queue(void)
 {
    AioHandler *node;
    int ret = 0;
    walking_handlers = 1;
    QLIST_FOREACH(node, &aio_handlers, node) {
        if (node->io_process_queue) {
            if (node->io_process_queue(node->opaque)) {
                ret = 1;
            }
        }
    }
    walking_handlers = 0;
    return ret;
 }
 void qemu_aio_wait(void)
 {
    int ret;
    if (qemu_bh_poll())
        return;
    /*
     * If there are callbacks left that have been queued, we need to call then.
     * Return afterwards to avoid waiting needlessly in select().
     */
    if (qemu_aio_process_queue())
        return;
    do {
        AioHandler *node;
        fd_set rdfds, wrfds;
        int max_fd = -1;
        walking_handlers = 1;
        FD_ZERO(&rdfds);
        FD_ZERO(&wrfds);
        /* fill fd sets */
        QLIST_FOREACH(node, &aio_handlers, node) {
            /* If there aren't pending AIO operations, don't invoke callbacks.
             * Otherwise, if there are no AIO requests, qemu_aio_wait() would
             * wait indefinitely.
             */
            if (node->io_flush && node->io_flush(node->opaque) == 0)
                continue;
            if (!node->deleted && node->io_read) {
                FD_SET(node->fd, &rdfds);
                max_fd = MAX(max_fd, node->fd + 1);
            }
            if (!node->deleted && node->io_write) {
                FD_SET(node->fd, &wrfds);
                max_fd = MAX(max_fd, node->fd + 1);
            }
        }
        walking_handlers = 0;
        /* No AIO operations?  Get us out of here */
        if (max_fd == -1)
            break;
        /* wait until next event */
        ret = select(max_fd, &rdfds, &wrfds, NULL, NULL);
        if (ret == -1 && errno == EINTR)
            continue;
        /* if we have any readable fds, dispatch event */
        if (ret > 0) {
            walking_handlers = 1;
            /* we have to walk very carefully in case
             * qemu_aio_set_fd_handler is called while we're walking */
            node = QLIST_FIRST(&aio_handlers);
            while (node) {
                AioHandler *tmp;
                if (!node->deleted &&
                    FD_ISSET(node->fd, &rdfds) &&
                    node->io_read) {
                    node->io_read(node->opaque);
                }
                if (!node->deleted &&
                    FD_ISSET(node->fd, &wrfds) &&
                    node->io_write) {
                    node->io_write(node->opaque);
                }
                tmp = node;
                node = QLIST_NEXT(node, node);
                if (tmp->deleted) {
                    QLIST_REMOVE(tmp, node);
                    qemu_free(tmp);
                }
            }
            walking_handlers = 0;
        }
    } while (ret == 0);
 }
--- a/alpha-dis.c
+++ b/alpha-dis.c
--- a/alpha.ld
+++ b/alpha.ld
@@ -0,0 +1,127 @@
 OUTPUT_FORMAT("elf64-alpha", "elf64-alpha",
 	      "elf64-alpha")
 OUTPUT_ARCH(alpha)
 ENTRY(__start)
 SECTIONS
 {
  /* Read-only sections, merged into text segment: */
  . = 0x60000000 + SIZEOF_HEADERS;
  .interp     : { *(.interp) 	}
  .hash          : { *(.hash)		}
  .dynsym        : { *(.dynsym)		}
  .dynstr        : { *(.dynstr)		}
  .gnu.version   : { *(.gnu.version)	}
  .gnu.version_d   : { *(.gnu.version_d)	}
  .gnu.version_r   : { *(.gnu.version_r)	}
  .rel.text      :
    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
  .rela.text     :
    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
  .rel.data      :
    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
  .rela.data     :
    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
  .rel.rodata    :
    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
  .rela.rodata   :
    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
  .rel.got       : { *(.rel.got)		}
  .rela.got      : { *(.rela.got)		}
  .rel.ctors     : { *(.rel.ctors)	}
  .rela.ctors    : { *(.rela.ctors)	}
  .rel.dtors     : { *(.rel.dtors)	}
  .rela.dtors    : { *(.rela.dtors)	}
  .rel.init      : { *(.rel.init)	}
  .rela.init     : { *(.rela.init)	}
  .rel.fini      : { *(.rel.fini)	}
  .rela.fini     : { *(.rela.fini)	}
  .rel.bss       : { *(.rel.bss)		}
  .rela.bss      : { *(.rela.bss)		}
  .rel.plt       : { *(.rel.plt)		}
  .rela.plt      : { *(.rela.plt)		}
  .init          : { *(.init)	} =0x47ff041f
  .text      :
  {
    *(.text)
    /* .gnu.warning sections are handled specially by elf32.em.  */
    *(.gnu.warning)
    *(.gnu.linkonce.t*)
  } =0x47ff041f
  _etext = .;
  PROVIDE (etext = .);
  .fini      : { *(.fini)    } =0x47ff041f
  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
  .rodata1   : { *(.rodata1) }
  .reginfo : { *(.reginfo) }
  /* Adjust the address for the data segment.  We want to adjust up to
     the same address within the page on the next page up.  */
  . = ALIGN(0x100000) + (. & (0x100000 - 1));
  .data    :
  {
    *(.data)
    *(.gnu.linkonce.d*)
    CONSTRUCTORS
  }
  .data1   : { *(.data1) }
  .ctors         :
  {
    *(.ctors)
  }
  .dtors         :
  {
    *(.dtors)
  }
  .plt      : { *(.plt)	}
  .got           : { *(.got.plt) *(.got) }
  .dynamic       : { *(.dynamic) }
  /* We want the small data sections together, so single-instruction offsets
     can access them all, and initialized data all before uninitialized, so
     we can shorten the on-disk segment size.  */
  .sdata     : { *(.sdata) }
  _edata  =  .;
  PROVIDE (edata = .);
  __bss_start = .;
  .sbss      : { *(.sbss) *(.scommon) }
  .bss       :
  {
   *(.dynbss)
   *(.bss)
   *(COMMON)
  }
  _end = . ;
  PROVIDE (end = .);
  /* Stabs debugging sections.  */
  .stab 0 : { *(.stab) }
  .stabstr 0 : { *(.stabstr) }
  .stab.excl 0 : { *(.stab.excl) }
  .stab.exclstr 0 : { *(.stab.exclstr) }
  .stab.index 0 : { *(.stab.index) }
  .stab.indexstr 0 : { *(.stab.indexstr) }
  .comment 0 : { *(.comment) }
  /* DWARF debug sections.
     Symbols in the DWARF debugging sections are relative to the beginning
     of the section so we begin them at 0.  */
  /* DWARF 1 */
  .debug          0 : { *(.debug) }
  .line           0 : { *(.line) }
  /* GNU DWARF 1 extensions */
  .debug_srcinfo  0 : { *(.debug_srcinfo) }
  .debug_sfnames  0 : { *(.debug_sfnames) }
  /* DWARF 1.1 and DWARF 2 */
  .debug_aranges  0 : { *(.debug_aranges) }
  .debug_pubnames 0 : { *(.debug_pubnames) }
  /* DWARF 2 */
  .debug_info     0 : { *(.debug_info) }
  .debug_abbrev   0 : { *(.debug_abbrev) }
  .debug_line     0 : { *(.debug_line) }
  .debug_frame    0 : { *(.debug_frame) }
  .debug_str      0 : { *(.debug_str) }
  .debug_loc      0 : { *(.debug_loc) }
  .debug_macinfo  0 : { *(.debug_macinfo) }
  /* SGI/MIPS DWARF 2 extensions */
  .debug_weaknames 0 : { *(.debug_weaknames) }
  .debug_funcnames 0 : { *(.debug_funcnames) }
  .debug_typenames 0 : { *(.debug_typenames) }
  .debug_varnames  0 : { *(.debug_varnames) }
  /* These must appear regardless of  .  */
 }
--- a/arch_init.c
+++ b/arch_init.c
@@ -1,238 +0,0 @@
 /*
 * QEMU System Emulator
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/arch_init.h"
 #include "hw/pci/pci.h"
 #include "hw/audio/audio.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
 #include "qmp-commands.h"
 #include "hw/acpi/acpi.h"
 #include "qemu/help_option.h"
 #ifdef TARGET_SPARC
 int graphic_width = 1024;
 int graphic_height = 768;
 int graphic_depth = 8;
 #else
 int graphic_width = 800;
 int graphic_height = 600;
 int graphic_depth = 32;
 #endif
 #if defined(TARGET_ALPHA)
 #define QEMU_ARCH QEMU_ARCH_ALPHA
 #elif defined(TARGET_ARM)
 #define QEMU_ARCH QEMU_ARCH_ARM
 #elif defined(TARGET_CRIS)
 #define QEMU_ARCH QEMU_ARCH_CRIS
 #elif defined(TARGET_I386)
 #define QEMU_ARCH QEMU_ARCH_I386
 #elif defined(TARGET_M68K)
 #define QEMU_ARCH QEMU_ARCH_M68K
 #elif defined(TARGET_LM32)
 #define QEMU_ARCH QEMU_ARCH_LM32
 #elif defined(TARGET_MICROBLAZE)
 #define QEMU_ARCH QEMU_ARCH_MICROBLAZE
 #elif defined(TARGET_MIPS)
 #define QEMU_ARCH QEMU_ARCH_MIPS
 #elif defined(TARGET_MOXIE)
 #define QEMU_ARCH QEMU_ARCH_MOXIE
 #elif defined(TARGET_NIOS2)
 #define QEMU_ARCH QEMU_ARCH_NIOS2
 #elif defined(TARGET_OPENRISC)
 #define QEMU_ARCH QEMU_ARCH_OPENRISC
 #elif defined(TARGET_PPC)
 #define QEMU_ARCH QEMU_ARCH_PPC
 #elif defined(TARGET_S390X)
 #define QEMU_ARCH QEMU_ARCH_S390X
 #elif defined(TARGET_SH4)
 #define QEMU_ARCH QEMU_ARCH_SH4
 #elif defined(TARGET_SPARC)
 #define QEMU_ARCH QEMU_ARCH_SPARC
 #elif defined(TARGET_XTENSA)
 #define QEMU_ARCH QEMU_ARCH_XTENSA
 #elif defined(TARGET_UNICORE32)
 #define QEMU_ARCH QEMU_ARCH_UNICORE32
 #elif defined(TARGET_TRICORE)
 #define QEMU_ARCH QEMU_ARCH_TRICORE
 #endif
 const uint32_t arch_type = QEMU_ARCH;
 struct soundhw {
    const char *name;
    const char *descr;
    int enabled;
    int isa;
    union {
        int (*init_isa) (ISABus *bus);
        int (*init_pci) (PCIBus *bus);
    } init;
 };
 static struct soundhw soundhw[9];
 static int soundhw_count;
 void isa_register_soundhw(const char *name, const char *descr,
                          int (*init_isa)(ISABus *bus))
 {
    assert(soundhw_count < ARRAY_SIZE(soundhw) - 1);
    soundhw[soundhw_count].name = name;
    soundhw[soundhw_count].descr = descr;
    soundhw[soundhw_count].isa = 1;
    soundhw[soundhw_count].init.init_isa = init_isa;
    soundhw_count++;
 }
 void pci_register_soundhw(const char *name, const char *descr,
                          int (*init_pci)(PCIBus *bus))
 {
    assert(soundhw_count < ARRAY_SIZE(soundhw) - 1);
    soundhw[soundhw_count].name = name;
    soundhw[soundhw_count].descr = descr;
    soundhw[soundhw_count].isa = 0;
    soundhw[soundhw_count].init.init_pci = init_pci;
    soundhw_count++;
 }
 void select_soundhw(const char *optarg)
 {
    struct soundhw *c;
    if (is_help_option(optarg)) {
    show_valid_cards:
        if (soundhw_count) {
             printf("Valid sound card names (comma separated):\n");
             for (c = soundhw; c->name; ++c) {
                 printf ("%-11s %s\n", c->name, c->descr);
             }
             printf("\n-soundhw all will enable all of the above\n");
        } else {
             printf("Machine has no user-selectable audio hardware "
                    "(it may or may not have always-present audio hardware).\n");
        }
        exit(!is_help_option(optarg));
    }
    else {
        size_t l;
        const char *p;
        char *e;
        int bad_card = 0;
        if (!strcmp(optarg, "all")) {
            for (c = soundhw; c->name; ++c) {
                c->enabled = 1;
            }
            return;
        }
        p = optarg;
        while (*p) {
            e = strchr(p, ',');
            l = !e ? strlen(p) : (size_t) (e - p);
            for (c = soundhw; c->name; ++c) {
                if (!strncmp(c->name, p, l) && !c->name[l]) {
                    c->enabled = 1;
                    break;
                }
            }
            if (!c->name) {
                if (l > 80) {
                    error_report("Unknown sound card name (too big to show)");
                }
                else {
                    error_report("Unknown sound card name `%.*s'",
                                 (int) l, p);
                }
                bad_card = 1;
            }
            p += l + (e != NULL);
        }
        if (bad_card) {
            goto show_valid_cards;
        }
    }
 }
 void audio_init(void)
 {
    struct soundhw *c;
    ISABus *isa_bus = (ISABus *) object_resolve_path_type("", TYPE_ISA_BUS, NULL);
    PCIBus *pci_bus = (PCIBus *) object_resolve_path_type("", TYPE_PCI_BUS, NULL);
    for (c = soundhw; c->name; ++c) {
        if (c->enabled) {
            if (c->isa) {
                if (!isa_bus) {
                    error_report("ISA bus not available for %s", c->name);
                    exit(1);
                }
                c->init.init_isa(isa_bus);
            } else {
                if (!pci_bus) {
                    error_report("PCI bus not available for %s", c->name);
                    exit(1);
                }
                c->init.init_pci(pci_bus);
            }
        }
    }
 }
 int kvm_available(void)
 {
 #ifdef CONFIG_KVM
    return 1;
 #else
    return 0;
 #endif
 }
 int xen_available(void)
 {
 #ifdef CONFIG_XEN
    return 1;
 #else
    return 0;
 #endif
 }
 TargetInfo *qmp_query_target(Error **errp)
 {
    TargetInfo *info = g_malloc0(sizeof(*info));
    info->arch = g_strdup(TARGET_NAME);
    return info;
 }
--- a/arm-dis.c
+++ b/arm-dis.c
--- a/arm-semi.c
+++ b/arm-semi.c
@@ -0,0 +1,468 @@
 /*
 *  Arm "Angel" semihosting syscalls
 *
 *  Copyright (c) 2005, 2007 CodeSourcery.
 *  Written by Paul Brook.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 */
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <time.h>
 #include "cpu.h"
 #ifdef CONFIG_USER_ONLY
 #include "qemu.h"
 #define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
 #else
 #include "qemu-common.h"
 #include "sysemu.h"
 #include "gdbstub.h"
 #endif
 #define SYS_OPEN        0x01
 #define SYS_CLOSE       0x02
 #define SYS_WRITEC      0x03
 #define SYS_WRITE0      0x04
 #define SYS_WRITE       0x05
 #define SYS_READ        0x06
 #define SYS_READC       0x07
 #define SYS_ISTTY       0x09
 #define SYS_SEEK        0x0a
 #define SYS_FLEN        0x0c
 #define SYS_TMPNAM      0x0d
 #define SYS_REMOVE      0x0e
 #define SYS_RENAME      0x0f
 #define SYS_CLOCK       0x10
 #define SYS_TIME        0x11
 #define SYS_SYSTEM      0x12
 #define SYS_ERRNO       0x13
 #define SYS_GET_CMDLINE 0x15
 #define SYS_HEAPINFO    0x16
 #define SYS_EXIT        0x18
 #ifndef O_BINARY
 #define O_BINARY 0
 #endif
 #define GDB_O_RDONLY  0x000
 #define GDB_O_WRONLY  0x001
 #define GDB_O_RDWR    0x002
 #define GDB_O_APPEND  0x008
 #define GDB_O_CREAT   0x200
 #define GDB_O_TRUNC   0x400
 #define GDB_O_BINARY  0
 static int gdb_open_modeflags[12] = {
    GDB_O_RDONLY,
    GDB_O_RDONLY | GDB_O_BINARY,
    GDB_O_RDWR,
    GDB_O_RDWR | GDB_O_BINARY,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY
 };
 static int open_modeflags[12] = {
    O_RDONLY,
    O_RDONLY | O_BINARY,
    O_RDWR,
    O_RDWR | O_BINARY,
    O_WRONLY | O_CREAT | O_TRUNC,
    O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
    O_RDWR | O_CREAT | O_TRUNC,
    O_RDWR | O_CREAT | O_TRUNC | O_BINARY,
    O_WRONLY | O_CREAT | O_APPEND,
    O_WRONLY | O_CREAT | O_APPEND | O_BINARY,
    O_RDWR | O_CREAT | O_APPEND,
    O_RDWR | O_CREAT | O_APPEND | O_BINARY
 };
 #ifdef CONFIG_USER_ONLY
 static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
 {
    if (code == (uint32_t)-1)
        ts->swi_errno = errno;
    return code;
 }
 #else
 static inline uint32_t set_swi_errno(CPUState *env, uint32_t code)
 {
    return code;
 }
 #include "softmmu-semi.h"
 #endif
 static target_ulong arm_semi_syscall_len;
 #if !defined(CONFIG_USER_ONLY)
 static target_ulong syscall_err;
 #endif
 static void arm_semi_cb(CPUState *env, target_ulong ret, target_ulong err)
 {
 #ifdef CONFIG_USER_ONLY
    TaskState *ts = env->opaque;
 #endif
    if (ret == (target_ulong)-1) {
 #ifdef CONFIG_USER_ONLY
        ts->swi_errno = err;
 #else
 	syscall_err = err;
 #endif
        env->regs[0] = ret;
    } else {
        /* Fixup syscalls that use nonstardard return conventions.  */
        switch (env->regs[0]) {
        case SYS_WRITE:
        case SYS_READ:
            env->regs[0] = arm_semi_syscall_len - ret;
            break;
        case SYS_SEEK:
            env->regs[0] = 0;
            break;
        default:
            env->regs[0] = ret;
            break;
        }
    }
 }
 static void arm_semi_flen_cb(CPUState *env, target_ulong ret, target_ulong err)
 {
    /* The size is always stored in big-endian order, extract
       the value. We assume the size always fit in 32 bits.  */
    uint32_t size;
    cpu_memory_rw_debug(env, env->regs[13]-64+32, (uint8_t *)&size, 4, 0);
    env->regs[0] = be32_to_cpu(size);
 #ifdef CONFIG_USER_ONLY
    ((TaskState *)env->opaque)->swi_errno = err;
 #else
    syscall_err = err;
 #endif
 }
 #define ARG(n)					\
 ({						\
    target_ulong __arg;				\
    /* FIXME - handle get_user() failure */	\
    get_user_ual(__arg, args + (n) * 4);	\
    __arg;					\
 })
 #define SET_ARG(n, val) put_user_ual(val, args + (n) * 4)
 uint32_t do_arm_semihosting(CPUState *env)
 {
    target_ulong args;
    char * s;
    int nr;
    uint32_t ret;
    uint32_t len;
 #ifdef CONFIG_USER_ONLY
    TaskState *ts = env->opaque;
 #else
    CPUState *ts = env;
 #endif
    nr = env->regs[0];
    args = env->regs[1];
    switch (nr) {
    case SYS_OPEN:
        if (!(s = lock_user_string(ARG(0))))
            /* FIXME - should this error code be -TARGET_EFAULT ? */
            return (uint32_t)-1;
        if (ARG(1) >= 12)
            return (uint32_t)-1;
        if (strcmp(s, ":tt") == 0) {
            if (ARG(1) < 4)
                return STDIN_FILENO;
            else
                return STDOUT_FILENO;
        }
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0),
 			   (int)ARG(2)+1, gdb_open_modeflags[ARG(1)]);
            return env->regs[0];
        } else {
            ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644));
        }
        unlock_user(s, ARG(0), 0);
        return ret;
    case SYS_CLOSE:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "close,%x", ARG(0));
            return env->regs[0];
        } else {
            return set_swi_errno(ts, close(ARG(0)));
        }
    case SYS_WRITEC:
        {
          char c;
          if (get_user_u8(c, args))
              /* FIXME - should this error code be -TARGET_EFAULT ? */
              return (uint32_t)-1;
          /* Write to debug console.  stderr is near enough.  */
          if (use_gdb_syscalls()) {
                gdb_do_syscall(arm_semi_cb, "write,2,%x,1", args);
                return env->regs[0];
          } else {
                return write(STDERR_FILENO, &c, 1);
          }
        }
    case SYS_WRITE0:
        if (!(s = lock_user_string(args)))
            /* FIXME - should this error code be -TARGET_EFAULT ? */
            return (uint32_t)-1;
        len = strlen(s);
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "write,2,%x,%x\n", args, len);
            ret = env->regs[0];
        } else {
            ret = write(STDERR_FILENO, s, len);
        }
        unlock_user(s, args, 0);
        return ret;
    case SYS_WRITE:
        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
            gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
            if (!(s = lock_user(VERIFY_READ, ARG(1), len, 1)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ret = set_swi_errno(ts, write(ARG(0), s, len));
            unlock_user(s, ARG(1), 0);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
    case SYS_READ:
        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
            gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
            if (!(s = lock_user(VERIFY_WRITE, ARG(1), len, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            do
              ret = set_swi_errno(ts, read(ARG(0), s, len));
            while (ret == -1 && errno == EINTR);
            unlock_user(s, ARG(1), len);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
    case SYS_READC:
       /* XXX: Read from debug cosole. Not implemented.  */
        return 0;
    case SYS_ISTTY:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "isatty,%x", ARG(0));
            return env->regs[0];
        } else {
            return isatty(ARG(0));
        }
    case SYS_SEEK:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "lseek,%x,%x,0", ARG(0), ARG(1));
            return env->regs[0];
        } else {
            ret = set_swi_errno(ts, lseek(ARG(0), ARG(1), SEEK_SET));
            if (ret == (uint32_t)-1)
              return -1;
            return 0;
        }
    case SYS_FLEN:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_flen_cb, "fstat,%x,%x",
 			   ARG(0), env->regs[13]-64);
            return env->regs[0];
        } else {
            struct stat buf;
            ret = set_swi_errno(ts, fstat(ARG(0), &buf));
            if (ret == (uint32_t)-1)
                return -1;
            return buf.st_size;
        }
    case SYS_TMPNAM:
        /* XXX: Not implemented.  */
        return -1;
    case SYS_REMOVE:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "unlink,%s", ARG(0), (int)ARG(1)+1);
            ret = env->regs[0];
        } else {
            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ret =  set_swi_errno(ts, remove(s));
            unlock_user(s, ARG(0), 0);
        }
        return ret;
    case SYS_RENAME:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "rename,%s,%s",
                           ARG(0), (int)ARG(1)+1, ARG(2), (int)ARG(3)+1);
            return env->regs[0];
        } else {
            char *s2;
            s = lock_user_string(ARG(0));
            s2 = lock_user_string(ARG(2));
            if (!s || !s2)
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                ret = (uint32_t)-1;
            else
                ret = set_swi_errno(ts, rename(s, s2));
            if (s2)
                unlock_user(s2, ARG(2), 0);
            if (s)
                unlock_user(s, ARG(0), 0);
            return ret;
        }
    case SYS_CLOCK:
        return clock() / (CLOCKS_PER_SEC / 100);
    case SYS_TIME:
        return set_swi_errno(ts, time(NULL));
    case SYS_SYSTEM:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "system,%s", ARG(0), (int)ARG(1)+1);
            return env->regs[0];
        } else {
            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ret = set_swi_errno(ts, system(s));
            unlock_user(s, ARG(0), 0);
            return ret;
        }
    case SYS_ERRNO:
 #ifdef CONFIG_USER_ONLY
        return ts->swi_errno;
 #else
        return syscall_err;
 #endif
    case SYS_GET_CMDLINE:
 #ifdef CONFIG_USER_ONLY
        /* Build a commandline from the original argv.  */
        {
            char **arg = ts->info->host_argv;
            int len = ARG(1);
            /* lock the buffer on the ARM side */
            char *cmdline_buffer = (char*)lock_user(VERIFY_WRITE, ARG(0), len, 0);
            if (!cmdline_buffer)
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            s = cmdline_buffer;
            while (*arg && len > 2) {
                int n = strlen(*arg);
                if (s != cmdline_buffer) {
                    *(s++) = ' ';
                    len--;
                }
                if (n >= len)
                    n = len - 1;
                memcpy(s, *arg, n);
                s += n;
                len -= n;
                arg++;
            }
            /* Null terminate the string.  */
            *s = 0;
            len = s - cmdline_buffer;
            /* Unlock the buffer on the ARM side.  */
            unlock_user(cmdline_buffer, ARG(0), len);
            /* Adjust the commandline length argument.  */
            SET_ARG(1, len);
            /* Return success if commandline fit into buffer.  */
            return *arg ? -1 : 0;
        }
 #else
      return -1;
 #endif
    case SYS_HEAPINFO:
        {
            uint32_t *ptr;
            uint32_t limit;
 #ifdef CONFIG_USER_ONLY
            /* Some C libraries assume the heap immediately follows .bss, so
               allocate it using sbrk.  */
            if (!ts->heap_limit) {
                long ret;
                ts->heap_base = do_brk(0);
                limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE;
                /* Try a big heap, and reduce the size if that fails.  */
                for (;;) {
                    ret = do_brk(limit);
                    if (ret != -1)
                        break;
                    limit = (ts->heap_base >> 1) + (limit >> 1);
                }
                ts->heap_limit = limit;
            }
            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ptr[0] = tswap32(ts->heap_base);
            ptr[1] = tswap32(ts->heap_limit);
            ptr[2] = tswap32(ts->stack_base);
            ptr[3] = tswap32(0); /* Stack limit.  */
            unlock_user(ptr, ARG(0), 16);
 #else
            limit = ram_size;
            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            /* TODO: Make this use the limit of the loaded application.  */
            ptr[0] = tswap32(limit / 2);
            ptr[1] = tswap32(limit);
            ptr[2] = tswap32(limit); /* Stack base */
            ptr[3] = tswap32(0); /* Stack limit.  */
            unlock_user(ptr, ARG(0), 16);
 #endif
            return 0;
        }
    case SYS_EXIT:
        exit(0);
    default:
        fprintf(stderr, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr);
        cpu_dump_state(env, stderr, fprintf, 0);
        abort();
    }
 }
--- a/arm.ld
+++ b/arm.ld
@@ -0,0 +1,153 @@
 OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm",
 	      "elf32-littlearm")
 OUTPUT_ARCH(arm)
 ENTRY(_start)
 SECTIONS
 {
  /* Read-only sections, merged into text segment: */
  . = 0x60000000 + SIZEOF_HEADERS;
  .interp     : { *(.interp) 	}
  .hash          : { *(.hash)		}
  .dynsym        : { *(.dynsym)		}
  .dynstr        : { *(.dynstr)		}
  .gnu.version   : { *(.gnu.version)	}
  .gnu.version_d   : { *(.gnu.version_d)	}
  .gnu.version_r   : { *(.gnu.version_r)	}
  .rel.text      :
    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
  .rela.text     :
    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
  .rel.data      :
    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
  .rela.data     :
    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
  .rel.rodata    :
    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
  .rela.rodata   :
    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
  .rel.got       : { *(.rel.got)		}
  .rela.got      : { *(.rela.got)		}
  .rel.ctors     : { *(.rel.ctors)	}
  .rela.ctors    : { *(.rela.ctors)	}
  .rel.dtors     : { *(.rel.dtors)	}
  .rela.dtors    : { *(.rela.dtors)	}
  .rel.init      : { *(.rel.init)	}
  .rela.init     : { *(.rela.init)	}
  .rel.fini      : { *(.rel.fini)	}
  .rela.fini     : { *(.rela.fini)	}
  .rel.bss       : { *(.rel.bss)		}
  .rela.bss      : { *(.rela.bss)		}
  .rel.plt       : { *(.rel.plt)		}
  .rela.plt      : { *(.rela.plt)		}
  .init          : { *(.init)	} =0x47ff041f
  .text      :
  {
    *(.text)
    /* .gnu.warning sections are handled specially by elf32.em.  */
    *(.gnu.warning)
    *(.gnu.linkonce.t*)
  } =0x47ff041f
  _etext = .;
  PROVIDE (etext = .);
  .fini      : { *(.fini)    } =0x47ff041f
  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
  .rodata1   : { *(.rodata1) }
  .ARM.extab   : { *(.ARM.extab* .gnu.linkonce.armextab.*) }
   __exidx_start = .;
  .ARM.exidx   : { *(.ARM.exidx* .gnu.linkonce.armexidx.*) }
   __exidx_end = .;
  .reginfo : { *(.reginfo) }
  /* Adjust the address for the data segment.  We want to adjust up to
     the same address within the page on the next page up.  */
  . = ALIGN(0x100000) + (. & (0x100000 - 1));
  .data    :
  {
    *(.gen_code)
    *(.data)
    *(.gnu.linkonce.d*)
    CONSTRUCTORS
  }
  .tbss           : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
  .data1   : { *(.data1) }
  .preinit_array     :
  {
    PROVIDE_HIDDEN (__preinit_array_start = .);
    KEEP (*(.preinit_array))
    PROVIDE_HIDDEN (__preinit_array_end = .);
  }
  .init_array     :
  {
     PROVIDE_HIDDEN (__init_array_start = .);
     KEEP (*(SORT(.init_array.*)))
     KEEP (*(.init_array))
     PROVIDE_HIDDEN (__init_array_end = .);
  }
  .fini_array     :
  {
    PROVIDE_HIDDEN (__fini_array_start = .);
    KEEP (*(.fini_array))
    KEEP (*(SORT(.fini_array.*)))
    PROVIDE_HIDDEN (__fini_array_end = .);
  }
  .ctors         :
  {
    *(.ctors)
  }
  .dtors         :
  {
    *(.dtors)
  }
  .plt      : { *(.plt)	}
  .got           : { *(.got.plt) *(.got) }
  .dynamic       : { *(.dynamic) }
  /* We want the small data sections together, so single-instruction offsets
     can access them all, and initialized data all before uninitialized, so
     we can shorten the on-disk segment size.  */
  .sdata     : { *(.sdata) }
  _edata  =  .;
  PROVIDE (edata = .);
  __bss_start = .;
  .sbss      : { *(.sbss) *(.scommon) }
  .bss       :
  {
   *(.dynbss)
   *(.bss)
   *(COMMON)
  }
  _end = . ;
  PROVIDE (end = .);
  /* Stabs debugging sections.  */
  .stab 0 : { *(.stab) }
  .stabstr 0 : { *(.stabstr) }
  .stab.excl 0 : { *(.stab.excl) }
  .stab.exclstr 0 : { *(.stab.exclstr) }
  .stab.index 0 : { *(.stab.index) }
  .stab.indexstr 0 : { *(.stab.indexstr) }
  .comment 0 : { *(.comment) }
  /* DWARF debug sections.
     Symbols in the DWARF debugging sections are relative to the beginning
     of the section so we begin them at 0.  */
  /* DWARF 1 */
  .debug          0 : { *(.debug) }
  .line           0 : { *(.line) }
  /* GNU DWARF 1 extensions */
  .debug_srcinfo  0 : { *(.debug_srcinfo) }
  .debug_sfnames  0 : { *(.debug_sfnames) }
  /* DWARF 1.1 and DWARF 2 */
  .debug_aranges  0 : { *(.debug_aranges) }
  .debug_pubnames 0 : { *(.debug_pubnames) }
  /* DWARF 2 */
  .debug_info     0 : { *(.debug_info) }
  .debug_abbrev   0 : { *(.debug_abbrev) }
  .debug_line     0 : { *(.debug_line) }
  .debug_frame    0 : { *(.debug_frame) }
  .debug_str      0 : { *(.debug_str) }
  .debug_loc      0 : { *(.debug_loc) }
  .debug_macinfo  0 : { *(.debug_macinfo) }
  /* SGI/MIPS DWARF 2 extensions */
  .debug_weaknames 0 : { *(.debug_weaknames) }
  .debug_funcnames 0 : { *(.debug_funcnames) }
  .debug_typenames 0 : { *(.debug_typenames) }
  .debug_varnames  0 : { *(.debug_varnames) }
  /* These must appear regardless of  .  */
 }
--- a/async.c
+++ b/async.c
@@ -0,0 +1,216 @@
 /*
 * QEMU System Emulator
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
 #include "qemu-aio.h"
 /*
 * An AsyncContext protects the callbacks of AIO requests and Bottom Halves
 * against interfering with each other. A typical example is qcow2 that accepts
 * asynchronous requests, but relies for manipulation of its metadata on
 * synchronous bdrv_read/write that doesn't trigger any callbacks.
 *
 * However, these functions are often emulated using AIO which means that AIO
 * callbacks must be run - but at the same time we must not run callbacks of
 * other requests as they might start to modify metadata and corrupt the
 * internal state of the caller of bdrv_read/write.
 *
 * To achieve the desired semantics we switch into a new AsyncContext.
 * Callbacks must only be run if they belong to the current AsyncContext.
 * Otherwise they need to be queued until their own context is active again.
 * This is how you can make qemu_aio_wait() wait only for your own callbacks.
 *
 * The AsyncContexts form a stack. When you leave a AsyncContexts, you always
 * return to the old ("parent") context.
 */
 struct AsyncContext {
    /* Consecutive number of the AsyncContext (position in the stack) */
    int id;
    /* Anchor of the list of Bottom Halves belonging to the context */
    struct QEMUBH *first_bh;
    /* Link to parent context */
    struct AsyncContext *parent;
 };
 /* The currently active AsyncContext */
 static struct AsyncContext *async_context = &(struct AsyncContext) { 0 };
 /*
 * Enter a new AsyncContext. Already scheduled Bottom Halves and AIO callbacks
 * won't be called until this context is left again.
 */
 void async_context_push(void)
 {
    struct AsyncContext *new = qemu_mallocz(sizeof(*new));
    new->parent = async_context;
    new->id = async_context->id + 1;
    async_context = new;
 }
 /* Run queued AIO completions and destroy Bottom Half */
 static void bh_run_aio_completions(void *opaque)
 {
    QEMUBH **bh = opaque;
    qemu_bh_delete(*bh);
    qemu_free(bh);
    qemu_aio_process_queue();
 }
 /*
 * Leave the currently active AsyncContext. All Bottom Halves belonging to the
 * old context are executed before changing the context.
 */
 void async_context_pop(void)
 {
    struct AsyncContext *old = async_context;
    QEMUBH **bh;
    /* Flush the bottom halves, we don't want to lose them */
    while (qemu_bh_poll());
    /* Switch back to the parent context */
    async_context = async_context->parent;
    qemu_free(old);
    if (async_context == NULL) {
        abort();
    }
    /* Schedule BH to run any queued AIO completions as soon as possible */
    bh = qemu_malloc(sizeof(*bh));
    *bh = qemu_bh_new(bh_run_aio_completions, bh);
    qemu_bh_schedule(*bh);
 }
 /*
 * Returns the ID of the currently active AsyncContext
 */
 int get_async_context_id(void)
 {
    return async_context->id;
 }
 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */
 struct QEMUBH {
    QEMUBHFunc *cb;
    void *opaque;
    int scheduled;
    int idle;
    int deleted;
    QEMUBH *next;
 };
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
    QEMUBH *bh;
    bh = qemu_mallocz(sizeof(QEMUBH));
    bh->cb = cb;
    bh->opaque = opaque;
    bh->next = async_context->first_bh;
    async_context->first_bh = bh;
    return bh;
 }
 int qemu_bh_poll(void)
 {
    QEMUBH *bh, **bhp;
    int ret;
    ret = 0;
    for (bh = async_context->first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            bh->scheduled = 0;
            if (!bh->idle)
                ret = 1;
            bh->idle = 0;
            bh->cb(bh->opaque);
        }
    }
    /* remove deleted bhs */
    bhp = &async_context->first_bh;
    while (*bhp) {
        bh = *bhp;
        if (bh->deleted) {
            *bhp = bh->next;
            qemu_free(bh);
        } else
            bhp = &bh->next;
    }
    return ret;
 }
 void qemu_bh_schedule_idle(QEMUBH *bh)
 {
    if (bh->scheduled)
        return;
    bh->scheduled = 1;
    bh->idle = 1;
 }
 void qemu_bh_schedule(QEMUBH *bh)
 {
    if (bh->scheduled)
        return;
    bh->scheduled = 1;
    bh->idle = 0;
    /* stop the currently executing CPU to execute the BH ASAP */
    qemu_notify_event();
 }
 void qemu_bh_cancel(QEMUBH *bh)
 {
    bh->scheduled = 0;
 }
 void qemu_bh_delete(QEMUBH *bh)
 {
    bh->scheduled = 0;
    bh->deleted = 1;
 }
 void qemu_bh_update_timeout(int *timeout)
 {
    QEMUBH *bh;
    for (bh = async_context->first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            if (bh->idle) {
                /* idle bottom halves will be polled at least
                 * every 10ms */
                *timeout = MIN(10, *timeout);
            } else {
                /* non-idle bottom halves will be executed
                 * immediately */
                *timeout = 0;
                break;
            }
        }
    }
 }
--- a/atomic_template.h
+++ b/atomic_template.h
@@ -1,215 +0,0 @@
 /*
 * Atomic helper templates
 * Included from tcg-runtime.c and cputlb.c.
 *
 * Copyright (c) 2016 Red Hat, Inc
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
 #if DATA_SIZE == 16
 # define SUFFIX     o
 # define DATA_TYPE  Int128
 # define BSWAP      bswap128
 #elif DATA_SIZE == 8
 # define SUFFIX     q
 # define DATA_TYPE  uint64_t
 # define BSWAP      bswap64
 #elif DATA_SIZE == 4
 # define SUFFIX     l
 # define DATA_TYPE  uint32_t
 # define BSWAP      bswap32
 #elif DATA_SIZE == 2
 # define SUFFIX     w
 # define DATA_TYPE  uint16_t
 # define BSWAP      bswap16
 #elif DATA_SIZE == 1
 # define SUFFIX     b
 # define DATA_TYPE  uint8_t
 # define BSWAP
 #else
 # error unsupported data size
 #endif
 #if DATA_SIZE >= 4
 # define ABI_TYPE  DATA_TYPE
 #else
 # define ABI_TYPE  uint32_t
 #endif
 /* Define host-endian atomic operations.  Note that END is used within
   the ATOMIC_NAME macro, and redefined below.  */
 #if DATA_SIZE == 1
 # define END
 #elif defined(HOST_WORDS_BIGENDIAN)
 # define END  _be
 #else
 # define END  _le
 #endif
 ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    return atomic_cmpxchg__nocheck(haddr, cmpv, newv);
 }
 #if DATA_SIZE >= 16
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
    __atomic_load(haddr, &val, __ATOMIC_RELAXED);
    return val;
 }
 void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
                     ABI_TYPE val EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    __atomic_store(haddr, &val, __ATOMIC_RELAXED);
 }
 #else
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
                           ABI_TYPE val EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    return atomic_xchg__nocheck(haddr, val);
 }
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                 ABI_TYPE val EXTRA_ARGS)                           \
 {                                                                   \
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
    return atomic_##X(haddr, val);                                  \
 }                                                                   \
 GEN_ATOMIC_HELPER(fetch_add)
 GEN_ATOMIC_HELPER(fetch_and)
 GEN_ATOMIC_HELPER(fetch_or)
 GEN_ATOMIC_HELPER(fetch_xor)
 GEN_ATOMIC_HELPER(add_fetch)
 GEN_ATOMIC_HELPER(and_fetch)
 GEN_ATOMIC_HELPER(or_fetch)
 GEN_ATOMIC_HELPER(xor_fetch)
 #undef GEN_ATOMIC_HELPER
 #endif /* DATA SIZE >= 16 */
 #undef END
 #if DATA_SIZE > 1
 /* Define reverse-host-endian atomic operations.  Note that END is used
   within the ATOMIC_NAME macro.  */
 #ifdef HOST_WORDS_BIGENDIAN
 # define END  _le
 #else
 # define END  _be
 #endif
 ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    return BSWAP(atomic_cmpxchg__nocheck(haddr, BSWAP(cmpv), BSWAP(newv)));
 }
 #if DATA_SIZE >= 16
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
    __atomic_load(haddr, &val, __ATOMIC_RELAXED);
    return BSWAP(val);
 }
 void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
                     ABI_TYPE val EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    val = BSWAP(val);
    __atomic_store(haddr, &val, __ATOMIC_RELAXED);
 }
 #else
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
                           ABI_TYPE val EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    return BSWAP(atomic_xchg__nocheck(haddr, BSWAP(val)));
 }
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                 ABI_TYPE val EXTRA_ARGS)                           \
 {                                                                   \
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
    return BSWAP(atomic_##X(haddr, BSWAP(val)));                    \
 }
 GEN_ATOMIC_HELPER(fetch_and)
 GEN_ATOMIC_HELPER(fetch_or)
 GEN_ATOMIC_HELPER(fetch_xor)
 GEN_ATOMIC_HELPER(and_fetch)
 GEN_ATOMIC_HELPER(or_fetch)
 GEN_ATOMIC_HELPER(xor_fetch)
 #undef GEN_ATOMIC_HELPER
 /* Note that for addition, we need to use a separate cmpxchg loop instead
   of bswaps for the reverse-host-endian helpers.  */
 ABI_TYPE ATOMIC_NAME(fetch_add)(CPUArchState *env, target_ulong addr,
                         ABI_TYPE val EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    DATA_TYPE ldo, ldn, ret, sto;
    ldo = atomic_read__nocheck(haddr);
    while (1) {
        ret = BSWAP(ldo);
        sto = BSWAP(ret + val);
        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
        if (ldn == ldo) {
            return ret;
        }
        ldo = ldn;
    }
 }
 ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
                         ABI_TYPE val EXTRA_ARGS)
 {
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    DATA_TYPE ldo, ldn, ret, sto;
    ldo = atomic_read__nocheck(haddr);
    while (1) {
        ret = BSWAP(ldo) + val;
        sto = BSWAP(ret);
        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
        if (ldn == ldo) {
            return ret;
        }
        ldo = ldn;
    }
 }
 #endif /* DATA_SIZE >= 16 */
 #undef END
 #endif /* DATA_SIZE > 1 */
 #undef BSWAP
 #undef ABI_TYPE
 #undef DATA_TYPE
 #undef SUFFIX
 #undef DATA_SIZE
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -1,13 +0,0 @@
 common-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
 common-obj-$(CONFIG_SDL) += sdlaudio.o
 common-obj-$(CONFIG_OSS) += ossaudio.o
 common-obj-$(CONFIG_SPICE) += spiceaudio.o
 common-obj-$(CONFIG_COREAUDIO) += coreaudio.o
 common-obj-$(CONFIG_ALSA) += alsaaudio.o
 common-obj-$(CONFIG_DSOUND) += dsoundaudio.o
 common-obj-$(CONFIG_PA) += paaudio.o
 common-obj-$(CONFIG_AUDIO_PT_INT) += audio_pt_int.o
 common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
 common-obj-y += wavcapture.o
 sdlaudio.o-cflags := $(SDL_CFLAGS)
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -21,12 +21,10 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include <alsa/asoundlib.h>
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
+#include "qemu-char.h"
 #include "audio.h"
 #include "trace.h"
 #if QEMU_GNUC_PREREQ(4, 3)
 #pragma GCC diagnostic ignored "-Waddress"
@@ -35,28 +33,9 @@
 #define AUDIO_CAP "alsa"
 #include "audio_int.h"
 typedef struct ALSAConf {
    int size_in_usec_in;
    int size_in_usec_out;
    const char *pcm_name_in;
    const char *pcm_name_out;
    unsigned int buffer_size_in;
    unsigned int period_size_in;
    unsigned int buffer_size_out;
    unsigned int period_size_out;
    unsigned int threshold;
    int buffer_size_in_overridden;
    int period_size_in_overridden;
    int buffer_size_out_overridden;
    int period_size_out_overridden;
 } ALSAConf;
 struct pollhlp {
    snd_pcm_t *handle;
    struct pollfd *pfds;
    ALSAConf *conf;
    int count;
    int mask;
 };
@@ -77,6 +56,30 @@ typedef struct ALSAVoiceIn {
    struct pollhlp pollhlp;
 } ALSAVoiceIn;
 static struct {
    int size_in_usec_in;
    int size_in_usec_out;
    const char *pcm_name_in;
    const char *pcm_name_out;
    unsigned int buffer_size_in;
    unsigned int period_size_in;
    unsigned int buffer_size_out;
    unsigned int period_size_out;
    unsigned int threshold;
    int buffer_size_in_overridden;
    int period_size_in_overridden;
    int buffer_size_out_overridden;
    int period_size_out_overridden;
    int verbose;
 } conf = {
    .buffer_size_out = 4096,
    .period_size_out = 1024,
    .pcm_name_out = "default",
    .pcm_name_in = "default",
 };
 struct alsa_params_req {
    int freq;
    snd_pcm_format_t fmt;
@@ -133,7 +136,7 @@ static void alsa_fini_poll (struct pollhlp *hlp)
        for (i = 0; i < hlp->count; ++i) {
            qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
        }
-        g_free (pfds);
+        qemu_free (pfds);
    }
    hlp->pfds = NULL;
    hlp->count = 0;
@@ -202,7 +205,9 @@ static void alsa_poll_handler (void *opaque)
    }
    if (!(revents & hlp->mask)) {
-        trace_alsa_revents(revents);
+        if (conf.verbose) {
            dolog ("revents = %d\n", revents);
        }
        return;
    }
@@ -255,20 +260,37 @@ static int alsa_poll_helper (snd_pcm_t *handle, struct pollhlp *hlp, int mask)
    if (err < 0) {
        alsa_logerr (err, "Could not initialize poll mode\n"
                     "Could not obtain poll descriptors\n");
-        g_free (pfds);
+        qemu_free (pfds);
        return -1;
    }
    for (i = 0; i < count; ++i) {
        if (pfds[i].events & POLLIN) {
-            qemu_set_fd_handler (pfds[i].fd, alsa_poll_handler, NULL, hlp);
+            err = qemu_set_fd_handler (pfds[i].fd, alsa_poll_handler,
                                       NULL, hlp);
        }
        if (pfds[i].events & POLLOUT) {
-            trace_alsa_pollout(i, pfds[i].fd);
+            if (conf.verbose) {
-            qemu_set_fd_handler (pfds[i].fd, NULL, alsa_poll_handler, hlp);
+                dolog ("POLLOUT %d %d\n", i, pfds[i].fd);
            }
            err = qemu_set_fd_handler (pfds[i].fd, NULL,
                                       alsa_poll_handler, hlp);
        }
        if (conf.verbose) {
            dolog ("Set handler events=%#x index=%d fd=%d err=%d\n",
                   pfds[i].events, i, pfds[i].fd, err);
        }
        trace_alsa_set_handler(pfds[i].events, i, pfds[i].fd, err);
        if (err) {
            dolog ("Failed to set handler events=%#x index=%d fd=%d err=%d\n",
                   pfds[i].events, i, pfds[i].fd, err);
            while (i--) {
                qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
            }
            qemu_free (pfds);
            return -1;
        }
    }
    hlp->pfds = pfds;
    hlp->count = count;
@@ -296,7 +318,7 @@ static int alsa_write (SWVoiceOut *sw, void *buf, int len)
    return audio_pcm_sw_write (sw, buf, len);
 }
-static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int endianness)
+static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt)
 {
    switch (fmt) {
    case AUD_FMT_S8:
@@ -306,36 +328,16 @@ static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int endianness)
        return SND_PCM_FORMAT_U8;
    case AUD_FMT_S16:
-        if (endianness) {
+        return SND_PCM_FORMAT_S16_LE;
            return SND_PCM_FORMAT_S16_BE;
        }
        else {
            return SND_PCM_FORMAT_S16_LE;
        }
    case AUD_FMT_U16:
-        if (endianness) {
+        return SND_PCM_FORMAT_U16_LE;
            return SND_PCM_FORMAT_U16_BE;
        }
        else {
            return SND_PCM_FORMAT_U16_LE;
        }
    case AUD_FMT_S32:
-        if (endianness) {
+        return SND_PCM_FORMAT_S32_LE;
            return SND_PCM_FORMAT_S32_BE;
        }
        else {
            return SND_PCM_FORMAT_S32_LE;
        }
    case AUD_FMT_U32:
-        if (endianness) {
+        return SND_PCM_FORMAT_U32_LE;
            return SND_PCM_FORMAT_U32_BE;
        }
        else {
            return SND_PCM_FORMAT_U32_LE;
        }
    default:
        dolog ("Internal logic error: Bad audio format %d\n", fmt);
@@ -409,11 +411,10 @@ static int alsa_to_audfmt (snd_pcm_format_t alsafmt, audfmt_e *fmt,
 }
 static void alsa_dump_info (struct alsa_params_req *req,
-                            struct alsa_params_obt *obt,
+                            struct alsa_params_obt *obt)
                            snd_pcm_format_t obtfmt)
 {
    dolog ("parameter | requested value | obtained value\n");
-    dolog ("format    |      %10d |     %10d\n", req->fmt, obtfmt);
+    dolog ("format    |      %10d |     %10d\n", req->fmt, obt->fmt);
    dolog ("channels  |      %10d |     %10d\n",
           req->nchannels, obt->nchannels);
    dolog ("frequency |      %10d |     %10d\n", req->freq, obt->freq);
@@ -454,15 +455,14 @@ static void alsa_set_threshold (snd_pcm_t *handle, snd_pcm_uframes_t threshold)
 }
 static int alsa_open (int in, struct alsa_params_req *req,
-                      struct alsa_params_obt *obt, snd_pcm_t **handlep,
+                      struct alsa_params_obt *obt, snd_pcm_t **handlep)
                      ALSAConf *conf)
 {
    snd_pcm_t *handle;
    snd_pcm_hw_params_t *hw_params;
    int err;
    int size_in_usec;
    unsigned int freq, nchannels;
-    const char *pcm_name = in ? conf->pcm_name_in : conf->pcm_name_out;
+    const char *pcm_name = in ? conf.pcm_name_in : conf.pcm_name_out;
    snd_pcm_uframes_t obt_buffer_size;
    const char *typ = in ? "ADC" : "DAC";
    snd_pcm_format_t obtfmt;
@@ -501,7 +501,7 @@ static int alsa_open (int in, struct alsa_params_req *req,
    }
    err = snd_pcm_hw_params_set_format (handle, hw_params, req->fmt);
-    if (err < 0) {
+    if (err < 0 && conf.verbose) {
        alsa_logerr2 (err, typ, "Failed to set format %d\n", req->fmt);
    }
@@ -633,7 +633,7 @@ static int alsa_open (int in, struct alsa_params_req *req,
        goto err;
    }
-    if (!in && conf->threshold) {
+    if (!in && conf.threshold) {
        snd_pcm_uframes_t threshold;
        int bytes_per_sec;
@@ -655,7 +655,7 @@ static int alsa_open (int in, struct alsa_params_req *req,
            break;
        }
-        threshold = (conf->threshold * bytes_per_sec) / 1000;
+        threshold = (conf.threshold * bytes_per_sec) / 1000;
        alsa_set_threshold (handle, threshold);
    }
@@ -665,15 +665,16 @@ static int alsa_open (int in, struct alsa_params_req *req,
    *handlep = handle;
-    if (obtfmt != req->fmt ||
+    if (conf.verbose &&
        (obt->fmt != req->fmt ||
         obt->nchannels != req->nchannels ||
-         obt->freq != req->freq) {
+         obt->freq != req->freq)) {
        dolog ("Audio parameters for %s\n", typ);
-        alsa_dump_info (req, obt, obtfmt);
+        alsa_dump_info (req, obt);
    }
 #ifdef DEBUG
-    alsa_dump_info (req, obt, obtfmt);
+    alsa_dump_info (req, obt);
 #endif
    return 0;
@@ -721,7 +722,9 @@ static void alsa_write_pending (ALSAVoiceOut *alsa)
            if (written <= 0) {
                switch (written) {
                case 0:
-                    trace_alsa_wrote_zero(len);
+                    if (conf.verbose) {
                        dolog ("Failed to write %d frames (wrote zero)\n", len);
                    }
                    return;
                case -EPIPE:
@@ -730,7 +733,9 @@ static void alsa_write_pending (ALSAVoiceOut *alsa)
                                     len);
                        return;
                    }
-                    trace_alsa_xrun_out();
+                    if (conf.verbose) {
                        dolog ("Recovering from playback xrun\n");
                    }
                    continue;
                case -ESTRPIPE:
@@ -741,7 +746,9 @@ static void alsa_write_pending (ALSAVoiceOut *alsa)
                                     len);
                        return;
                    }
-                    trace_alsa_resume_out();
+                    if (conf.verbose) {
                        dolog ("Resuming suspended output stream\n");
                    }
                    continue;
                case -EAGAIN:
@@ -787,31 +794,31 @@ static void alsa_fini_out (HWVoiceOut *hw)
    ldebug ("alsa_fini\n");
    alsa_anal_close (&alsa->handle, &alsa->pollhlp);
-    g_free(alsa->pcm_buf);
+    if (alsa->pcm_buf) {
-    alsa->pcm_buf = NULL;
+        qemu_free (alsa->pcm_buf);
        alsa->pcm_buf = NULL;
    }
 }
-static int alsa_init_out(HWVoiceOut *hw, struct audsettings *as,
+static int alsa_init_out (HWVoiceOut *hw, struct audsettings *as)
                         void *drv_opaque)
 {
    ALSAVoiceOut *alsa = (ALSAVoiceOut *) hw;
    struct alsa_params_req req;
    struct alsa_params_obt obt;
    snd_pcm_t *handle;
    struct audsettings obt_as;
    ALSAConf *conf = drv_opaque;
-    req.fmt = aud_to_alsafmt (as->fmt, as->endianness);
+    req.fmt = aud_to_alsafmt (as->fmt);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
-    req.period_size = conf->period_size_out;
+    req.period_size = conf.period_size_out;
-    req.buffer_size = conf->buffer_size_out;
+    req.buffer_size = conf.buffer_size_out;
-    req.size_in_usec = conf->size_in_usec_out;
+    req.size_in_usec = conf.size_in_usec_out;
    req.override_mask =
-        (conf->period_size_out_overridden ? 1 : 0) |
+        (conf.period_size_out_overridden ? 1 : 0) |
-        (conf->buffer_size_out_overridden ? 2 : 0);
+        (conf.buffer_size_out_overridden ? 2 : 0);
-    if (alsa_open (0, &req, &obt, &handle, conf)) {
+    if (alsa_open (0, &req, &obt, &handle)) {
        return -1;
    }
@@ -832,19 +839,14 @@ static int alsa_init_out(HWVoiceOut *hw, struct audsettings *as,
    }
    alsa->handle = handle;
    alsa->pollhlp.conf = conf;
    return 0;
 }
-#define VOICE_CTL_PAUSE 0
+static int alsa_voice_ctl (snd_pcm_t *handle, const char *typ, int pause)
 #define VOICE_CTL_PREPARE 1
 #define VOICE_CTL_START 2
 static int alsa_voice_ctl (snd_pcm_t *handle, const char *typ, int ctl)
 {
    int err;
-    if (ctl == VOICE_CTL_PAUSE) {
+    if (pause) {
        err = snd_pcm_drop (handle);
        if (err < 0) {
            alsa_logerr (err, "Could not stop %s\n", typ);
@@ -857,13 +859,6 @@ static int alsa_voice_ctl (snd_pcm_t *handle, const char *typ, int ctl)
            alsa_logerr (err, "Could not prepare handle for %s\n", typ);
            return -1;
        }
        if (ctl == VOICE_CTL_START) {
            err = snd_pcm_start(handle);
            if (err < 0) {
                alsa_logerr (err, "Could not start handle for %s\n", typ);
                return -1;
            }
        }
    }
    return 0;
@@ -888,41 +883,36 @@ static int alsa_ctl_out (HWVoiceOut *hw, int cmd, ...)
                poll_mode = 0;
            }
            hw->poll_mode = poll_mode;
-            return alsa_voice_ctl (alsa->handle, "playback", VOICE_CTL_PREPARE);
+            return alsa_voice_ctl (alsa->handle, "playback", 0);
        }
    case VOICE_DISABLE:
        ldebug ("disabling voice\n");
-        if (hw->poll_mode) {
+        return alsa_voice_ctl (alsa->handle, "playback", 1);
            hw->poll_mode = 0;
            alsa_fini_poll (&alsa->pollhlp);
        }
        return alsa_voice_ctl (alsa->handle, "playback", VOICE_CTL_PAUSE);
    }
    return -1;
 }
-static int alsa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
+static int alsa_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
    ALSAVoiceIn *alsa = (ALSAVoiceIn *) hw;
    struct alsa_params_req req;
    struct alsa_params_obt obt;
    snd_pcm_t *handle;
    struct audsettings obt_as;
    ALSAConf *conf = drv_opaque;
-    req.fmt = aud_to_alsafmt (as->fmt, as->endianness);
+    req.fmt = aud_to_alsafmt (as->fmt);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
-    req.period_size = conf->period_size_in;
+    req.period_size = conf.period_size_in;
-    req.buffer_size = conf->buffer_size_in;
+    req.buffer_size = conf.buffer_size_in;
-    req.size_in_usec = conf->size_in_usec_in;
+    req.size_in_usec = conf.size_in_usec_in;
    req.override_mask =
-        (conf->period_size_in_overridden ? 1 : 0) |
+        (conf.period_size_in_overridden ? 1 : 0) |
-        (conf->buffer_size_in_overridden ? 2 : 0);
+        (conf.buffer_size_in_overridden ? 2 : 0);
-    if (alsa_open (1, &req, &obt, &handle, conf)) {
+    if (alsa_open (1, &req, &obt, &handle)) {
        return -1;
    }
@@ -943,7 +933,6 @@ static int alsa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    }
    alsa->handle = handle;
    alsa->pollhlp.conf = conf;
    return 0;
 }
@@ -953,8 +942,10 @@ static void alsa_fini_in (HWVoiceIn *hw)
    alsa_anal_close (&alsa->handle, &alsa->pollhlp);
-    g_free(alsa->pcm_buf);
+    if (alsa->pcm_buf) {
-    alsa->pcm_buf = NULL;
+        qemu_free (alsa->pcm_buf);
        alsa->pcm_buf = NULL;
    }
 }
 static int alsa_run_in (HWVoiceIn *hw)
@@ -999,10 +990,14 @@ static int alsa_run_in (HWVoiceIn *hw)
                dolog ("Failed to resume suspended input stream\n");
                return 0;
            }
-            trace_alsa_resume_in();
+            if (conf.verbose) {
                dolog ("Resuming suspended input stream\n");
            }
            break;
        default:
-            trace_alsa_no_frames(state);
+            if (conf.verbose) {
                dolog ("No frames available and ALSA state is %d\n", state);
            }
            return 0;
        }
    }
@@ -1037,7 +1032,9 @@ static int alsa_run_in (HWVoiceIn *hw)
            if (nread <= 0) {
                switch (nread) {
                case 0:
-                    trace_alsa_read_zero(len);
+                    if (conf.verbose) {
                        dolog ("Failed to read %ld frames (read zero)\n", len);
                    }
                    goto exit;
                case -EPIPE:
@@ -1045,7 +1042,9 @@ static int alsa_run_in (HWVoiceIn *hw)
                        alsa_logerr (nread, "Failed to read %ld frames\n", len);
                        goto exit;
                    }
-                    trace_alsa_xrun_in();
+                    if (conf.verbose) {
                        dolog ("Recovering from capture xrun\n");
                    }
                    continue;
                case -EAGAIN:
@@ -1062,7 +1061,7 @@ static int alsa_run_in (HWVoiceIn *hw)
                }
            }
-            hw->conv (dst, src, nread);
+            hw->conv (dst, src, nread, &nominal_volume);
            src = advance (src, nread << hwshift);
            dst += nread;
@@ -1102,7 +1101,7 @@ static int alsa_ctl_in (HWVoiceIn *hw, int cmd, ...)
            }
            hw->poll_mode = poll_mode;
-            return alsa_voice_ctl (alsa->handle, "capture", VOICE_CTL_START);
+            return alsa_voice_ctl (alsa->handle, "capture", 0);
        }
    case VOICE_DISABLE:
@@ -1111,91 +1110,88 @@ static int alsa_ctl_in (HWVoiceIn *hw, int cmd, ...)
            hw->poll_mode = 0;
            alsa_fini_poll (&alsa->pollhlp);
        }
-        return alsa_voice_ctl (alsa->handle, "capture", VOICE_CTL_PAUSE);
+        return alsa_voice_ctl (alsa->handle, "capture", 1);
    }
    return -1;
 }
 static ALSAConf glob_conf = {
    .buffer_size_out = 4096,
    .period_size_out = 1024,
    .pcm_name_out = "default",
    .pcm_name_in = "default",
 };
 static void *alsa_audio_init (void)
 {
-    ALSAConf *conf = g_malloc(sizeof(ALSAConf));
+    return &conf;
    *conf = glob_conf;
    return conf;
 }
 static void alsa_audio_fini (void *opaque)
 {
-    g_free(opaque);
+    (void) opaque;
 }
 static struct audio_option alsa_options[] = {
    {
        .name        = "DAC_SIZE_IN_USEC",
        .tag         = AUD_OPT_BOOL,
-        .valp        = &glob_conf.size_in_usec_out,
+        .valp        = &conf.size_in_usec_out,
        .descr       = "DAC period/buffer size in microseconds (otherwise in frames)"
    },
    {
        .name        = "DAC_PERIOD_SIZE",
        .tag         = AUD_OPT_INT,
-        .valp        = &glob_conf.period_size_out,
+        .valp        = &conf.period_size_out,
        .descr       = "DAC period size (0 to go with system default)",
-        .overriddenp = &glob_conf.period_size_out_overridden
+        .overriddenp = &conf.period_size_out_overridden
    },
    {
        .name        = "DAC_BUFFER_SIZE",
        .tag         = AUD_OPT_INT,
-        .valp        = &glob_conf.buffer_size_out,
+        .valp        = &conf.buffer_size_out,
        .descr       = "DAC buffer size (0 to go with system default)",
-        .overriddenp = &glob_conf.buffer_size_out_overridden
+        .overriddenp = &conf.buffer_size_out_overridden
    },
    {
        .name        = "ADC_SIZE_IN_USEC",
        .tag         = AUD_OPT_BOOL,
-        .valp        = &glob_conf.size_in_usec_in,
+        .valp        = &conf.size_in_usec_in,
        .descr       =
        "ADC period/buffer size in microseconds (otherwise in frames)"
    },
    {
        .name        = "ADC_PERIOD_SIZE",
        .tag         = AUD_OPT_INT,
-        .valp        = &glob_conf.period_size_in,
+        .valp        = &conf.period_size_in,
        .descr       = "ADC period size (0 to go with system default)",
-        .overriddenp = &glob_conf.period_size_in_overridden
+        .overriddenp = &conf.period_size_in_overridden
    },
    {
        .name        = "ADC_BUFFER_SIZE",
        .tag         = AUD_OPT_INT,
-        .valp        = &glob_conf.buffer_size_in,
+        .valp        = &conf.buffer_size_in,
        .descr       = "ADC buffer size (0 to go with system default)",
-        .overriddenp = &glob_conf.buffer_size_in_overridden
+        .overriddenp = &conf.buffer_size_in_overridden
    },
    {
        .name        = "THRESHOLD",
        .tag         = AUD_OPT_INT,
-        .valp        = &glob_conf.threshold,
+        .valp        = &conf.threshold,
        .descr       = "(undocumented)"
    },
    {
        .name        = "DAC_DEV",
        .tag         = AUD_OPT_STR,
-        .valp        = &glob_conf.pcm_name_out,
+        .valp        = &conf.pcm_name_out,
        .descr       = "DAC device name (for instance dmix)"
    },
    {
        .name        = "ADC_DEV",
        .tag         = AUD_OPT_STR,
-        .valp        = &glob_conf.pcm_name_in,
+        .valp        = &conf.pcm_name_in,
        .descr       = "ADC device name"
    },
    {
        .name        = "VERBOSE",
        .tag         = AUD_OPT_BOOL,
        .valp        = &conf.verbose,
        .descr       = "Behave in a more verbose way"
    },
    { /* End of list */ }
 };
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -21,17 +21,16 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "audio.h"
-#include "monitor/monitor.h"
+#include "monitor.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
-#include "sysemu/sysemu.h"
+#include "sysemu.h"
 #include "qemu/cutils.h"
 #define AUDIO_CAP "audio"
 #include "audio_int.h"
 /* #define DEBUG_PLIVE */
 /* #define DEBUG_LIVE */
 /* #define DEBUG_OUT */
 /* #define DEBUG_CAPTURE */
@@ -45,9 +44,6 @@
    that we generate the list.
 */
 static struct audio_driver *drvtab[] = {
 #ifdef CONFIG_SPICE
    &spice_audio_driver,
 #endif
    CONFIG_AUDIO_DRIVERS
    &no_audio_driver,
    &wav_audio_driver
@@ -67,6 +63,8 @@ static struct {
        int hertz;
        int64_t ticks;
    } period;
    int plive;
    int log_to_monitor;
    int try_poll_in;
    int try_poll_out;
 } conf = {
@@ -94,14 +92,16 @@ static struct {
        }
    },
-    .period = { .hertz = 100 },
+    .period = { .hertz = 250 },
    .plive = 0,
    .log_to_monitor = 0,
    .try_poll_in = 1,
    .try_poll_out = 1,
 };
 static AudioState glob_audio_state;
-const struct mixeng_volume nominal_volume = {
+struct mixeng_volume nominal_volume = {
    .mute = 0,
 #ifdef FLOAT_MIXENG
    .r = 1.0,
@@ -115,9 +115,6 @@ const struct mixeng_volume nominal_volume = {
 #ifdef AUDIO_IS_FLAWLESS_AND_NO_CHECKS_ARE_REQURIED
 #error No its not
 #else
 static void audio_print_options (const char *prefix,
                                 struct audio_option *opt);
 int audio_bug (const char *funcname, int cond)
 {
    if (cond) {
@@ -125,16 +122,10 @@ int audio_bug (const char *funcname, int cond)
        AUD_log (NULL, "A bug was just triggered in %s\n", funcname);
        if (!shown) {
            struct audio_driver *d;
            shown = 1;
            AUD_log (NULL, "Save all your work and restart without audio\n");
            AUD_log (NULL, "Please send bug report to av1474@comtv.ru\n");
            AUD_log (NULL, "I am sorry\n");
            d = glob_audio_state.drv;
            if (d) {
                audio_print_options (d->name, d->options);
            }
        }
        AUD_log (NULL, "Context:\n");
@@ -193,7 +184,7 @@ void *audio_calloc (const char *funcname, int nmemb, size_t size)
        return NULL;
    }
-    return g_malloc0 (len);
+    return qemu_mallocz (len);
 }
 static char *audio_alloc_prefix (const char *s)
@@ -207,7 +198,7 @@ static char *audio_alloc_prefix (const char *s)
    }
    len = strlen (s);
-    r = g_malloc (len + sizeof (qemu_prefix));
+    r = qemu_malloc (len + sizeof (qemu_prefix));
    u = r + sizeof (qemu_prefix) - 1;
@@ -328,11 +319,20 @@ static const char *audio_get_conf_str (const char *key,
 void AUD_vlog (const char *cap, const char *fmt, va_list ap)
 {
-    if (cap) {
+    if (conf.log_to_monitor) {
-        fprintf(stderr, "%s: ", cap);
+        if (cap) {
-    }
+            monitor_printf(cur_mon, "%s: ", cap);
        }
-    vfprintf(stderr, fmt, ap);
+        monitor_vprintf(cur_mon, fmt, ap);
    }
    else {
        if (cap) {
            fprintf (stderr, "%s: ", cap);
        }
        vfprintf (stderr, fmt, ap);
    }
 }
 void AUD_log (const char *cap, const char *fmt, ...)
@@ -413,7 +413,7 @@ static void audio_print_options (const char *prefix,
        printf ("    %s\n", opt->descr);
    }
-    g_free (uprefix);
+    qemu_free (uprefix);
 }
 static void audio_process_options (const char *prefix,
@@ -450,7 +450,7 @@ static void audio_process_options (const char *prefix,
         * (includes trailing zero) + zero + underscore (on behalf of
         * sizeof) */
        optlen = len + preflen + sizeof (qemu_prefix) + 1;
-        optname = g_malloc (optlen);
+        optname = qemu_malloc (optlen);
        pstrcpy (optname, optlen, qemu_prefix);
@@ -495,7 +495,7 @@ static void audio_process_options (const char *prefix,
            opt->overriddenp = &opt->overridden;
        }
        *opt->overriddenp = !def;
-        g_free (optname);
+        qemu_free (optname);
    }
 }
@@ -573,20 +573,17 @@ static int audio_pcm_info_eq (struct audio_pcm_info *info, struct audsettings *a
    switch (as->fmt) {
    case AUD_FMT_S8:
        sign = 1;
        /* fall through */
    case AUD_FMT_U8:
        break;
    case AUD_FMT_S16:
        sign = 1;
        /* fall through */
    case AUD_FMT_U16:
        bits = 16;
        break;
    case AUD_FMT_S32:
        sign = 1;
        /* fall through */
    case AUD_FMT_U32:
        bits = 32;
        break;
@@ -693,11 +690,13 @@ void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len)
 /*
 * Capture
 */
-static void noop_conv (struct st_sample *dst, const void *src, int samples)
+static void noop_conv (struct st_sample *dst, const void *src,
                       int samples, struct mixeng_volume *vol)
 {
    (void) src;
    (void) dst;
    (void) samples;
    (void) vol;
 }
 static CaptureVoiceOut *audio_pcm_capture_find_specific (
@@ -769,7 +768,7 @@ static void audio_detach_capture (HWVoiceOut *hw)
        QLIST_REMOVE (sw, entries);
        QLIST_REMOVE (sc, entries);
-        g_free (sc);
+        qemu_free (sc);
        if (was_active) {
            /* We have removed soft voice from the capture:
               this might have changed the overall status of the capture
@@ -806,19 +805,17 @@ static int audio_attach_capture (HWVoiceOut *hw)
        sw->active = hw->enabled;
        sw->conv = noop_conv;
        sw->ratio = ((int64_t) hw_cap->info.freq << 32) / sw->info.freq;
        sw->vol = nominal_volume;
        sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
        if (!sw->rate) {
            dolog ("Could not start rate conversion for `%s'\n", SW_NAME (sw));
-            g_free (sw);
+            qemu_free (sw);
            return -1;
        }
        QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
        QLIST_INSERT_HEAD (&hw->cap_head, sc, entries);
 #ifdef DEBUG_CAPTURE
-        sw->name = g_strdup_printf ("for %p %d,%d,%d",
+        asprintf (&sw->name, "for %p %d,%d,%d",
-                                    hw, sw->info.freq, sw->info.bits,
+                  hw, sw->info.freq, sw->info.bits, sw->info.nchannels);
                                    sw->info.nchannels);
        dolog ("Added %s active = %d\n", sw->name, sw->active);
 #endif
        if (sw->active) {
@@ -947,10 +944,6 @@ int audio_pcm_sw_read (SWVoiceIn *sw, void *buf, int size)
        total += isamp;
    }
    if (!(hw->ctl_caps & VOICE_VOLUME_CAP)) {
        mixeng_volume (sw->buf, ret, &sw->vol);
    }
    sw->clip (buf, sw->buf, ret);
    sw->total_hw_samples_acquired += total;
    return ret << sw->info.shift;
@@ -1032,11 +1025,7 @@ int audio_pcm_sw_write (SWVoiceOut *sw, void *buf, int size)
    swlim = ((int64_t) dead << 32) / sw->ratio;
    swlim = audio_MIN (swlim, samples);
    if (swlim) {
-        sw->conv (sw->buf, buf, swlim);
+        sw->conv (sw->buf, buf, swlim, &sw->vol);
        if (!(sw->hw->ctl_caps & VOICE_VOLUME_CAP)) {
            mixeng_volume (sw->buf, swlim, &sw->vol);
        }
    }
    while (swlim) {
@@ -1095,6 +1084,15 @@ static void audio_pcm_print_info (const char *cap, struct audio_pcm_info *info)
 /*
 * Timer
 */
 static void audio_timer (void *opaque)
 {
    AudioState *s = opaque;
    audio_run ("timer");
    qemu_mod_timer (s->ts, qemu_get_clock (vm_clock) + conf.period.ticks);
 }
 static int audio_is_timer_needed (void)
 {
    HWVoiceIn *hwi = NULL;
@@ -1109,28 +1107,25 @@ static int audio_is_timer_needed (void)
    return 0;
 }
-static void audio_reset_timer (AudioState *s)
+static void audio_reset_timer (void)
 {
    AudioState *s = &glob_audio_state;
    if (audio_is_timer_needed ()) {
-        timer_mod (s->ts,
+        qemu_mod_timer (s->ts, qemu_get_clock (vm_clock) + 1);
            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + conf.period.ticks);
    }
    else {
-        timer_del (s->ts);
+        qemu_del_timer (s->ts);
    }
 }
 static void audio_timer (void *opaque)
 {
    audio_run ("timer");
    audio_reset_timer (opaque);
 }
 /*
 * Public API
 */
 int AUD_write (SWVoiceOut *sw, void *buf, int size)
 {
    int bytes;
    if (!sw) {
        /* XXX: Consider options */
        return size;
@@ -1141,11 +1136,14 @@ int AUD_write (SWVoiceOut *sw, void *buf, int size)
        return 0;
    }
-    return sw->hw->pcm_ops->write(sw, buf, size);
+    bytes = sw->hw->pcm_ops->write (sw, buf, size);
    return bytes;
 }
 int AUD_read (SWVoiceIn *sw, void *buf, int size)
 {
    int bytes;
    if (!sw) {
        /* XXX: Consider options */
        return size;
@@ -1156,7 +1154,8 @@ int AUD_read (SWVoiceIn *sw, void *buf, int size)
        return 0;
    }
-    return sw->hw->pcm_ops->read(sw, buf, size);
+    bytes = sw->hw->pcm_ops->read (sw, buf, size);
    return bytes;
 }
 int AUD_get_buffer_size_out (SWVoiceOut *sw)
@@ -1184,7 +1183,7 @@ void AUD_set_active_out (SWVoiceOut *sw, int on)
                hw->enabled = 1;
                if (s->vm_running) {
                    hw->pcm_ops->ctl_out (hw, VOICE_ENABLE, conf.try_poll_out);
-                    audio_reset_timer (s);
+                    audio_reset_timer ();
                }
            }
        }
@@ -1229,7 +1228,6 @@ void AUD_set_active_in (SWVoiceIn *sw, int on)
                hw->enabled = 1;
                if (s->vm_running) {
                    hw->pcm_ops->ctl_in (hw, VOICE_ENABLE, conf.try_poll_in);
                    audio_reset_timer (s);
                }
            }
            sw->total_hw_samples_acquired = hw->total_samples_captured;
@@ -1436,6 +1434,9 @@ static void audio_run_out (AudioState *s)
            while (sw) {
                sw1 = sw->entries.le_next;
                if (!sw->active && !sw->callback.fn) {
 #ifdef DEBUG_PLIVE
                    dolog ("Finishing with old voice\n");
 #endif
                    audio_close_out (sw);
                }
                sw = sw1;
@@ -1627,6 +1628,18 @@ static struct audio_option audio_options[] = {
        .valp  = &conf.period.hertz,
        .descr = "Timer period in HZ (0 - use lowest possible)"
    },
    {
        .name  = "PLIVE",
        .tag   = AUD_OPT_BOOL,
        .valp  = &conf.plive,
        .descr = "(undocumented)"
    },
    {
        .name  = "LOG_TO_MONITOR",
        .tag   = AUD_OPT_BOOL,
        .valp  = &conf.log_to_monitor,
        .descr = "Print logging messages to monitor instead of stderr"
    },
    { /* End of list */ }
 };
@@ -1643,7 +1656,7 @@ static void audio_pp_nb_voices (const char *typ, int nb)
        printf ("Theoretically supports many %s voices\n", typ);
        break;
    default:
-        printf ("Theoretically supports up to %d %s voices\n", nb, typ);
+        printf ("Theoretically supports upto %d %s voices\n", nb, typ);
        break;
    }
@@ -1721,7 +1734,7 @@ static int audio_driver_init (AudioState *s, struct audio_driver *drv)
 }
 static void audio_vm_change_state_handler (void *opaque, int running,
-                                           RunState state)
+                                           int reason)
 {
    AudioState *s = opaque;
    HWVoiceOut *hwo = NULL;
@@ -1736,29 +1749,19 @@ static void audio_vm_change_state_handler (void *opaque, int running,
    while ((hwi = audio_pcm_hw_find_any_enabled_in (hwi))) {
        hwi->pcm_ops->ctl_in (hwi, op, conf.try_poll_in);
    }
-    audio_reset_timer (s);
+    audio_reset_timer ();
 }
-static bool is_cleaning_up;
+static void audio_atexit (void)
 bool audio_is_cleaning_up(void)
 {
    return is_cleaning_up;
 }
 void audio_cleanup(void)
 {
    AudioState *s = &glob_audio_state;
-    HWVoiceOut *hwo, *hwon;
+    HWVoiceOut *hwo = NULL;
-    HWVoiceIn *hwi, *hwin;
+    HWVoiceIn *hwi = NULL;
-    is_cleaning_up = true;
+    while ((hwo = audio_pcm_hw_find_any_enabled_out (hwo))) {
    QLIST_FOREACH_SAFE(hwo, &glob_audio_state.hw_head_out, entries, hwon) {
        SWVoiceCap *sc;
-        if (hwo->enabled) {
+        hwo->pcm_ops->ctl_out (hwo, VOICE_DISABLE);
            hwo->pcm_ops->ctl_out (hwo, VOICE_DISABLE);
        }
        hwo->pcm_ops->fini_out (hwo);
        for (sc = hwo->cap_head.lh_first; sc; sc = sc->entries.le_next) {
@@ -1769,20 +1772,15 @@ void audio_cleanup(void)
                cb->ops.destroy (cb->opaque);
            }
        }
        QLIST_REMOVE(hwo, entries);
    }
-    QLIST_FOREACH_SAFE(hwi, &glob_audio_state.hw_head_in, entries, hwin) {
+    while ((hwi = audio_pcm_hw_find_any_enabled_in (hwi))) {
-        if (hwi->enabled) {
+        hwi->pcm_ops->ctl_in (hwi, VOICE_DISABLE);
            hwi->pcm_ops->ctl_in (hwi, VOICE_DISABLE);
        }
        hwi->pcm_ops->fini_in (hwi);
        QLIST_REMOVE(hwi, entries);
    }
    if (s->drv) {
        s->drv->fini (s->drv_opaque);
        s->drv = NULL;
    }
 }
@@ -1790,7 +1788,8 @@ static const VMStateDescription vmstate_audio = {
    .name = "audio",
    .version_id = 1,
    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
+    .minimum_version_id_old = 1,
    .fields      = (VMStateField []) {
        VMSTATE_END_OF_LIST()
    }
 };
@@ -1810,9 +1809,12 @@ static void audio_init (void)
    QLIST_INIT (&s->hw_head_out);
    QLIST_INIT (&s->hw_head_in);
    QLIST_INIT (&s->cap_head);
-    atexit(audio_cleanup);
+    atexit (audio_atexit);
-    s->ts = timer_new_ns(QEMU_CLOCK_VIRTUAL, audio_timer, s);
+    s->ts = qemu_new_timer (vm_clock, audio_timer, s);
    if (!s->ts) {
        hw_error("Could not create audio timer\n");
    }
    audio_process_options ("AUDIO", audio_options);
@@ -1863,8 +1865,12 @@ static void audio_init (void)
    if (!done) {
        done = !audio_driver_init (s, &no_audio_driver);
-        assert(done);
+        if (!done) {
-        dolog("warning: Using timer based audio emulation\n");
+            hw_error("Could not initialize audio subsystem\n");
        }
        else {
            dolog ("warning: Using timer based audio emulation\n");
        }
    }
    if (conf.period.hertz <= 0) {
@@ -1875,7 +1881,8 @@ static void audio_init (void)
        }
        conf.period.ticks = 1;
    } else {
-        conf.period.ticks = NANOSECONDS_PER_SECOND / conf.period.hertz;
+        conf.period.ticks =
            muldiv64 (1, get_ticks_per_sec (), conf.period.hertz);
    }
    e = qemu_add_vm_change_state_handler (audio_vm_change_state_handler, s);
@@ -1885,13 +1892,13 @@ static void audio_init (void)
    }
    QLIST_INIT (&s->card_head);
-    vmstate_register (NULL, 0, &vmstate_audio, s);
+    vmstate_register (0, &vmstate_audio, s);
 }
 void AUD_register_card (const char *name, QEMUSoundCard *card)
 {
    audio_init ();
-    card->name = g_strdup (name);
+    card->name = qemu_strdup (name);
    memset (&card->entries, 0, sizeof (card->entries));
    QLIST_INSERT_HEAD (&glob_audio_state.card_head, card, entries);
 }
@@ -1899,7 +1906,7 @@ void AUD_register_card (const char *name, QEMUSoundCard *card)
 void AUD_remove_card (QEMUSoundCard *card)
 {
    QLIST_REMOVE (card, entries);
-    g_free (card->name);
+    qemu_free (card->name);
 }
@@ -1977,17 +1984,18 @@ CaptureVoiceOut *AUD_add_capture (
        QLIST_INSERT_HEAD (&s->cap_head, cap, entries);
        QLIST_INSERT_HEAD (&cap->cb_head, cb, entries);
-        QLIST_FOREACH(hw, &glob_audio_state.hw_head_out, entries) {
+        hw = NULL;
        while ((hw = audio_pcm_hw_find_any_out (hw))) {
            audio_attach_capture (hw);
        }
        return cap;
    err3:
-        g_free (cap->hw.mix_buf);
+        qemu_free (cap->hw.mix_buf);
    err2:
-        g_free (cap);
+        qemu_free (cap);
    err1:
-        g_free (cb);
+        qemu_free (cb);
    err0:
        return NULL;
    }
@@ -2001,7 +2009,7 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
        if (cb->opaque == cb_opaque) {
            cb->ops.destroy (cb_opaque);
            QLIST_REMOVE (cb, entries);
-            g_free (cb);
+            qemu_free (cb);
            if (!cap->cb_head.lh_first) {
                SWVoiceOut *sw = cap->hw.sw_head.lh_first, *sw1;
@@ -2019,11 +2027,11 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
                    }
                    QLIST_REMOVE (sw, entries);
                    QLIST_REMOVE (sc, entries);
-                    g_free (sc);
+                    qemu_free (sc);
                    sw = sw1;
                }
                QLIST_REMOVE (cap, entries);
-                g_free (cap);
+                qemu_free (cap);
            }
            return;
        }
@@ -2033,29 +2041,17 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
 void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t rvol)
 {
    if (sw) {
        HWVoiceOut *hw = sw->hw;
        sw->vol.mute = mute;
        sw->vol.l = nominal_volume.l * lvol / 255;
        sw->vol.r = nominal_volume.r * rvol / 255;
        if (hw->pcm_ops->ctl_out) {
            hw->pcm_ops->ctl_out (hw, VOICE_VOLUME, sw);
        }
    }
 }
 void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol)
 {
    if (sw) {
        HWVoiceIn *hw = sw->hw;
        sw->vol.mute = mute;
        sw->vol.l = nominal_volume.l * lvol / 255;
        sw->vol.r = nominal_volume.r * rvol / 255;
        if (hw->pcm_ops->ctl_in) {
            hw->pcm_ops->ctl_in (hw, VOICE_VOLUME, sw);
        }
    }
 }
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -21,11 +21,11 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #ifndef QEMU_AUDIO_H
 #define QEMU_AUDIO_H
-#include "qemu/queue.h"
+#include "config-host.h"
 #include "qemu-queue.h"
 typedef void (*audio_callback_fn) (void *opaque, int avail);
@@ -86,8 +86,12 @@ typedef struct QEMUAudioTimeStamp {
    uint64_t old_ts;
 } QEMUAudioTimeStamp;
-void AUD_vlog (const char *cap, const char *fmt, va_list ap) GCC_FMT_ATTR(2, 0);
+void AUD_vlog (const char *cap, const char *fmt, va_list ap);
-void AUD_log (const char *cap, const char *fmt, ...) GCC_FMT_ATTR(2, 3);
+void AUD_log (const char *cap, const char *fmt, ...)
 #ifdef __GNUC__
    __attribute__ ((__format__ (__printf__, 2, 3)))
 #endif
    ;
 void AUD_help (void);
 void AUD_register_card (const char *name, QEMUSoundCard *card);
@@ -163,7 +167,4 @@ static inline void *advance (void *p, int incr)
 int wav_start_capture (CaptureState *s, const char *path, int freq,
                       int bits, int nchannels);
-bool audio_is_cleaning_up(void);
+#endif  /* audio.h */
 void audio_cleanup(void);
 #endif /* QEMU_AUDIO_H */
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -21,7 +21,6 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #ifndef QEMU_AUDIO_INT_H
 #define QEMU_AUDIO_INT_H
@@ -83,7 +82,6 @@ typedef struct HWVoiceOut {
    int samples;
    QLIST_HEAD (sw_out_listhead, SWVoiceOut) sw_head;
    QLIST_HEAD (sw_cap_listhead, SWVoiceCap) cap_head;
    int ctl_caps;
    struct audio_pcm_ops *pcm_ops;
    QLIST_ENTRY (HWVoiceOut) entries;
 } HWVoiceOut;
@@ -103,7 +101,6 @@ typedef struct HWVoiceIn {
    int samples;
    QLIST_HEAD (sw_in_listhead, SWVoiceIn) sw_head;
    int ctl_caps;
    struct audio_pcm_ops *pcm_ops;
    QLIST_ENTRY (HWVoiceIn) entries;
 } HWVoiceIn;
@@ -153,17 +150,16 @@ struct audio_driver {
    int max_voices_in;
    int voice_size_out;
    int voice_size_in;
    int ctl_caps;
 };
 struct audio_pcm_ops {
-    int  (*init_out)(HWVoiceOut *hw, struct audsettings *as, void *drv_opaque);
+    int  (*init_out)(HWVoiceOut *hw, struct audsettings *as);
    void (*fini_out)(HWVoiceOut *hw);
    int  (*run_out) (HWVoiceOut *hw, int live);
    int  (*write)   (SWVoiceOut *sw, void *buf, int size);
    int  (*ctl_out) (HWVoiceOut *hw, int cmd, ...);
-    int  (*init_in) (HWVoiceIn *hw, struct audsettings *as, void *drv_opaque);
+    int  (*init_in) (HWVoiceIn *hw, struct audsettings *as);
    void (*fini_in) (HWVoiceIn *hw);
    int  (*run_in)  (HWVoiceIn *hw);
    int  (*read)    (SWVoiceIn *sw, void *buf, int size);
@@ -207,12 +203,14 @@ extern struct audio_driver no_audio_driver;
 extern struct audio_driver oss_audio_driver;
 extern struct audio_driver sdl_audio_driver;
 extern struct audio_driver wav_audio_driver;
 extern struct audio_driver fmod_audio_driver;
 extern struct audio_driver alsa_audio_driver;
 extern struct audio_driver coreaudio_audio_driver;
 extern struct audio_driver dsound_audio_driver;
 extern struct audio_driver esd_audio_driver;
 extern struct audio_driver pa_audio_driver;
-extern struct audio_driver spice_audio_driver;
+extern struct audio_driver winwave_audio_driver;
-extern const struct mixeng_volume nominal_volume;
+extern struct mixeng_volume nominal_volume;
 void audio_pcm_init_info (struct audio_pcm_info *info, struct audsettings *as);
 void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len);
@@ -232,22 +230,52 @@ void audio_run (const char *msg);
 #define VOICE_ENABLE 1
 #define VOICE_DISABLE 2
 #define VOICE_VOLUME 3
 #define VOICE_VOLUME_CAP (1 << VOICE_VOLUME)
 static inline int audio_ring_dist (int dst, int src, int len)
 {
    return (dst >= src) ? (dst - src) : (len - src + dst);
 }
-#define dolog(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
+#if defined __GNUC__
 #define GCC_ATTR __attribute__ ((__unused__, __format__ (__printf__, 1, 2)))
 #define GCC_FMT_ATTR(n, m) __attribute__ ((__format__ (__printf__, n, m)))
 #else
 #define GCC_ATTR /**/
 #define GCC_FMT_ATTR(n, m)
 #endif
 static void GCC_ATTR dolog (const char *fmt, ...)
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
 }
 #ifdef DEBUG
-#define ldebug(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
+static void GCC_ATTR ldebug (const char *fmt, ...)
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
 }
 #else
-#define ldebug(fmt, ...) (void)0
+#if defined NDEBUG && defined __GNUC__
 #define ldebug(...)
 #elif defined NDEBUG && defined _MSC_VER
 #define ldebug __noop
 #else
 static void GCC_ATTR ldebug (const char *fmt, ...)
 {
    (void) fmt;
 }
 #endif
 #endif
 #undef GCC_ATTR
 #define AUDIO_STRINGIFY_(n) #n
 #define AUDIO_STRINGIFY(n) AUDIO_STRINGIFY_(n)
@@ -258,4 +286,4 @@ static inline int audio_ring_dist (int dst, int src, int len)
 #define AUDIO_FUNC __FILE__ ":" AUDIO_STRINGIFY (__LINE__)
 #endif
-#endif /* QEMU_AUDIO_INT_H */
+#endif /* audio_int.h */
--- a/audio/audio_pt_int.c
+++ b/audio/audio_pt_int.c
@@ -1,4 +1,3 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "audio.h"
@@ -7,8 +6,7 @@
 #include "audio_int.h"
 #include "audio_pt_int.h"
-static void GCC_FMT_ATTR(3, 4) logerr (struct audio_pt *pt, int err,
+static void logerr (struct audio_pt *pt, int err, const char *fmt, ...)
                                       const char *fmt, ...)
 {
    va_list ap;
@@ -25,16 +23,9 @@ int audio_pt_init (struct audio_pt *p, void *(*func) (void *),
 {
    int err, err2;
    const char *efunc;
    sigset_t set, old_set;
    p->drv = drv;
    err = sigfillset (&set);
    if (err) {
        logerr (p, errno, "%s(%s): sigfillset failed", cap, AUDIO_FUNC);
        return -1;
    }
    err = pthread_mutex_init (&p->mutex, NULL);
    if (err) {
        efunc = "pthread_mutex_init";
@@ -47,23 +38,7 @@ int audio_pt_init (struct audio_pt *p, void *(*func) (void *),
        goto err1;
    }
    err = pthread_sigmask (SIG_BLOCK, &set, &old_set);
    if (err) {
        efunc = "pthread_sigmask";
        goto err2;
    }
    err = pthread_create (&p->thread, NULL, func, opaque);
    err2 = pthread_sigmask (SIG_SETMASK, &old_set, NULL);
    if (err2) {
        logerr (p, err2, "%s(%s): pthread_sigmask (restore) failed",
                cap, AUDIO_FUNC);
        /* We have failed to restore original signal mask, all bets are off,
           so terminate the process */
        exit (EXIT_FAILURE);
    }
    if (err) {
        efunc = "pthread_create";
        goto err2;
--- a/audio/audio_pt_int.h
+++ b/audio/audio_pt_int.h
@@ -19,4 +19,4 @@ int audio_pt_wait (struct audio_pt *, const char *);
 int audio_pt_unlock_and_signal (struct audio_pt *, const char *);
 int audio_pt_join (struct audio_pt *, void **, const char *);
-#endif /* QEMU_AUDIO_PT_INT_H */
+#endif /* audio_pt_int.h */
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -71,7 +71,10 @@ static void glue (audio_init_nb_voices_, TYPE) (struct audio_driver *drv)
 static void glue (audio_pcm_hw_free_resources_, TYPE) (HW *hw)
 {
-    g_free (HWBUF);
+    if (HWBUF) {
        qemu_free (HWBUF);
    }
    HWBUF = NULL;
 }
@@ -89,7 +92,9 @@ static int glue (audio_pcm_hw_alloc_resources_, TYPE) (HW *hw)
 static void glue (audio_pcm_sw_free_resources_, TYPE) (SW *sw)
 {
-    g_free (sw->buf);
+    if (sw->buf) {
        qemu_free (sw->buf);
    }
    if (sw->rate) {
        st_rate_stop (sw->rate);
@@ -103,7 +108,11 @@ static int glue (audio_pcm_sw_alloc_resources_, TYPE) (SW *sw)
 {
    int samples;
 #ifdef DAC
    samples = sw->hw->samples;
 #else
    samples = ((int64_t) sw->hw->samples << 32) / sw->ratio;
 #endif
    sw->buf = audio_calloc (AUDIO_FUNC, samples, sizeof (struct st_sample));
    if (!sw->buf) {
@@ -118,7 +127,7 @@ static int glue (audio_pcm_sw_alloc_resources_, TYPE) (SW *sw)
    sw->rate = st_rate_start (sw->hw->info.freq, sw->info.freq);
 #endif
    if (!sw->rate) {
-        g_free (sw->buf);
+        qemu_free (sw->buf);
        sw->buf = NULL;
        return -1;
    }
@@ -155,10 +164,10 @@ static int glue (audio_pcm_sw_init_, TYPE) (
        [sw->info.swap_endianness]
        [audio_bits_to_index (sw->info.bits)];
-    sw->name = g_strdup (name);
+    sw->name = qemu_strdup (name);
    err = glue (audio_pcm_sw_alloc_resources_, TYPE) (sw);
    if (err) {
-        g_free (sw->name);
+        qemu_free (sw->name);
        sw->name = NULL;
    }
    return err;
@@ -167,8 +176,10 @@ static int glue (audio_pcm_sw_init_, TYPE) (
 static void glue (audio_pcm_sw_fini_, TYPE) (SW *sw)
 {
    glue (audio_pcm_sw_free_resources_, TYPE) (sw);
-    g_free (sw->name);
+    if (sw->name) {
-    sw->name = NULL;
+        qemu_free (sw->name);
        sw->name = NULL;
    }
 }
 static void glue (audio_pcm_hw_add_sw_, TYPE) (HW *hw, SW *sw)
@@ -191,10 +202,10 @@ static void glue (audio_pcm_hw_gc_, TYPE) (HW **hwp)
        audio_detach_capture (hw);
 #endif
        QLIST_REMOVE (hw, entries);
        glue (hw->pcm_ops->fini_, TYPE) (hw);
        glue (s->nb_hw_voices_, TYPE) += 1;
        glue (audio_pcm_hw_free_resources_ ,TYPE) (hw);
-        g_free (hw);
+        glue (hw->pcm_ops->fini_, TYPE) (hw);
        qemu_free (hw);
        *hwp = NULL;
    }
 }
@@ -256,13 +267,11 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
    }
    hw->pcm_ops = drv->pcm_ops;
    hw->ctl_caps = drv->ctl_caps;
    QLIST_INIT (&hw->sw_head);
 #ifdef DAC
    QLIST_INIT (&hw->cap_head);
 #endif
-    if (glue (hw->pcm_ops->init_, TYPE) (hw, as, s->drv_opaque)) {
+    if (glue (hw->pcm_ops->init_, TYPE) (hw, as)) {
        goto err0;
    }
@@ -295,7 +304,7 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
 err1:
    glue (hw->pcm_ops->fini_, TYPE) (hw);
 err0:
-    g_free (hw);
+    qemu_free (hw);
    return NULL;
 }
@@ -363,7 +372,7 @@ err3:
    glue (audio_pcm_hw_del_sw_, TYPE) (sw);
    glue (audio_pcm_hw_gc_, TYPE) (&hw);
 err2:
-    g_free (sw);
+    qemu_free (sw);
 err1:
    return NULL;
 }
@@ -373,7 +382,7 @@ static void glue (audio_close_, TYPE) (SW *sw)
    glue (audio_pcm_sw_fini_, TYPE) (sw);
    glue (audio_pcm_hw_del_sw_, TYPE) (sw);
    glue (audio_pcm_hw_gc_, TYPE) (&sw->hw);
-    g_free (sw);
+    qemu_free (sw);
 }
 void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
@@ -398,6 +407,13 @@ SW *glue (AUD_open_, TYPE) (
    )
 {
    AudioState *s = &glob_audio_state;
 #ifdef DAC
    int live = 0;
    SW *old_sw = NULL;
 #endif
    ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
            name, as->freq, as->nchannels, as->fmt);
    if (audio_bug (AUDIO_FUNC, !card || !name || !callback_fn || !as)) {
        dolog ("card=%p name=%p callback_fn=%p as=%p\n",
@@ -405,9 +421,6 @@ SW *glue (AUD_open_, TYPE) (
        goto fail;
    }
    ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
            name, as->freq, as->nchannels, as->fmt);
    if (audio_bug (AUDIO_FUNC, audio_validate_settings (as))) {
        audio_print_settings (as);
        goto fail;
@@ -422,6 +435,29 @@ SW *glue (AUD_open_, TYPE) (
        return sw;
    }
 #ifdef DAC
    if (conf.plive && sw && (!sw->active && !sw->empty)) {
        live = sw->total_hw_samples_mixed;
 #ifdef DEBUG_PLIVE
        dolog ("Replacing voice %s with %d live samples\n", SW_NAME (sw), live);
        dolog ("Old %s freq %d, bits %d, channels %d\n",
               SW_NAME (sw), sw->info.freq, sw->info.bits, sw->info.nchannels);
        dolog ("New %s freq %d, bits %d, channels %d\n",
               name,
               as->freq,
               (as->fmt == AUD_FMT_S16 || as->fmt == AUD_FMT_U16) ? 16 : 8,
               as->nchannels);
 #endif
        if (live) {
            old_sw = sw;
            old_sw->callback.fn = NULL;
            sw = NULL;
        }
    }
 #endif
    if (!glue (conf.fixed_, TYPE).enabled && sw) {
        glue (AUD_close_, TYPE) (card, sw);
        sw = NULL;
@@ -454,6 +490,20 @@ SW *glue (AUD_open_, TYPE) (
    sw->callback.fn = callback_fn;
    sw->callback.opaque = callback_opaque;
 #ifdef DAC
    if (live) {
        int mixed =
            (live << old_sw->info.shift)
            * old_sw->info.bytes_per_second
            / sw->info.bytes_per_second;
 #ifdef DEBUG_PLIVE
        dolog ("Silence will be mixed %d\n", mixed);
 #endif
        sw->total_hw_samples_mixed += mixed;
    }
 #endif
 #ifdef DEBUG_AUDIO
    dolog ("%s\n", name);
    audio_pcm_print_info ("hw", &sw->hw->info);
@@ -491,7 +541,7 @@ uint64_t glue (AUD_get_elapsed_usec_, TYPE) (SW *sw, QEMUAudioTimeStamp *ts)
    cur_ts = sw->hw->ts_helper;
    old_ts = ts->old_ts;
-    /* dolog ("cur %" PRId64 " old %" PRId64 "\n", cur_ts, old_ts); */
+    /* dolog ("cur %lld old %lld\n", cur_ts, old_ts); */
    if (cur_ts >= old_ts) {
        delta = cur_ts - old_ts;
--- a/audio/audio_win_int.c
+++ b/audio/audio_win_int.c
@@ -1,7 +1,7 @@
 /* public domain */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "audio.h"
 #define AUDIO_CAP "win-int"
 #include <windows.h>
--- a/audio/coreaudio.c
+++ b/audio/coreaudio.c
@@ -22,8 +22,8 @@
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include <CoreAudio/CoreAudio.h>
 #include <string.h>             /* strerror */
 #include <pthread.h>            /* pthread_X */
 #include "qemu-common.h"
@@ -32,251 +32,31 @@
 #define AUDIO_CAP "coreaudio"
 #include "audio_int.h"
-#ifndef MAC_OS_X_VERSION_10_6
+struct {
 #define MAC_OS_X_VERSION_10_6 1060
 #endif
 typedef struct {
    int buffer_frames;
    int nbuffers;
-} CoreaudioConf;
+    int isAtexit;
 } conf = {
    .buffer_frames = 512,
    .nbuffers = 4,
    .isAtexit = 0
 };
 typedef struct coreaudioVoiceOut {
    HWVoiceOut hw;
    pthread_mutex_t mutex;
    int isAtexit;
    AudioDeviceID outputDeviceID;
    UInt32 audioDevicePropertyBufferFrameSize;
    AudioStreamBasicDescription outputStreamBasicDescription;
    AudioDeviceIOProcID ioprocid;
    int live;
    int decr;
    int rpos;
 } coreaudioVoiceOut;
 #if MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
 /* The APIs used here only become available from 10.6 */
 static OSStatus coreaudio_get_voice(AudioDeviceID *id)
 {
    UInt32 size = sizeof(*id);
    AudioObjectPropertyAddress addr = {
        kAudioHardwarePropertyDefaultOutputDevice,
        kAudioObjectPropertyScopeGlobal,
        kAudioObjectPropertyElementMaster
    };
    return AudioObjectGetPropertyData(kAudioObjectSystemObject,
                                      &addr,
                                      0,
                                      NULL,
                                      &size,
                                      id);
 }
 static OSStatus coreaudio_get_framesizerange(AudioDeviceID id,
                                             AudioValueRange *framerange)
 {
    UInt32 size = sizeof(*framerange);
    AudioObjectPropertyAddress addr = {
        kAudioDevicePropertyBufferFrameSizeRange,
        kAudioDevicePropertyScopeOutput,
        kAudioObjectPropertyElementMaster
    };
    return AudioObjectGetPropertyData(id,
                                      &addr,
                                      0,
                                      NULL,
                                      &size,
                                      framerange);
 }
 static OSStatus coreaudio_get_framesize(AudioDeviceID id, UInt32 *framesize)
 {
    UInt32 size = sizeof(*framesize);
    AudioObjectPropertyAddress addr = {
        kAudioDevicePropertyBufferFrameSize,
        kAudioDevicePropertyScopeOutput,
        kAudioObjectPropertyElementMaster
    };
    return AudioObjectGetPropertyData(id,
                                      &addr,
                                      0,
                                      NULL,
                                      &size,
                                      framesize);
 }
 static OSStatus coreaudio_set_framesize(AudioDeviceID id, UInt32 *framesize)
 {
    UInt32 size = sizeof(*framesize);
    AudioObjectPropertyAddress addr = {
        kAudioDevicePropertyBufferFrameSize,
        kAudioDevicePropertyScopeOutput,
        kAudioObjectPropertyElementMaster
    };
    return AudioObjectSetPropertyData(id,
                                      &addr,
                                      0,
                                      NULL,
                                      size,
                                      framesize);
 }
 static OSStatus coreaudio_get_streamformat(AudioDeviceID id,
                                           AudioStreamBasicDescription *d)
 {
    UInt32 size = sizeof(*d);
    AudioObjectPropertyAddress addr = {
        kAudioDevicePropertyStreamFormat,
        kAudioDevicePropertyScopeOutput,
        kAudioObjectPropertyElementMaster
    };
    return AudioObjectGetPropertyData(id,
                                      &addr,
                                      0,
                                      NULL,
                                      &size,
                                      d);
 }
 static OSStatus coreaudio_set_streamformat(AudioDeviceID id,
                                           AudioStreamBasicDescription *d)
 {
    UInt32 size = sizeof(*d);
    AudioObjectPropertyAddress addr = {
        kAudioDevicePropertyStreamFormat,
        kAudioDevicePropertyScopeOutput,
        kAudioObjectPropertyElementMaster
    };
    return AudioObjectSetPropertyData(id,
                                      &addr,
                                      0,
                                      NULL,
                                      size,
                                      d);
 }
 static OSStatus coreaudio_get_isrunning(AudioDeviceID id, UInt32 *result)
 {
    UInt32 size = sizeof(*result);
    AudioObjectPropertyAddress addr = {
        kAudioDevicePropertyDeviceIsRunning,
        kAudioDevicePropertyScopeOutput,
        kAudioObjectPropertyElementMaster
    };
    return AudioObjectGetPropertyData(id,
                                      &addr,
                                      0,
                                      NULL,
                                      &size,
                                      result);
 }
 #else
 /* Legacy versions of functions using deprecated APIs */
 static OSStatus coreaudio_get_voice(AudioDeviceID *id)
 {
    UInt32 size = sizeof(*id);
    return AudioHardwareGetProperty(
        kAudioHardwarePropertyDefaultOutputDevice,
        &size,
        id);
 }
 static OSStatus coreaudio_get_framesizerange(AudioDeviceID id,
                                             AudioValueRange *framerange)
 {
    UInt32 size = sizeof(*framerange);
    return AudioDeviceGetProperty(
        id,
        0,
        0,
        kAudioDevicePropertyBufferFrameSizeRange,
        &size,
        framerange);
 }
 static OSStatus coreaudio_get_framesize(AudioDeviceID id, UInt32 *framesize)
 {
    UInt32 size = sizeof(*framesize);
    return AudioDeviceGetProperty(
        id,
        0,
        false,
        kAudioDevicePropertyBufferFrameSize,
        &size,
        framesize);
 }
 static OSStatus coreaudio_set_framesize(AudioDeviceID id, UInt32 *framesize)
 {
    UInt32 size = sizeof(*framesize);
    return AudioDeviceSetProperty(
        id,
        NULL,
        0,
        false,
        kAudioDevicePropertyBufferFrameSize,
        size,
        framesize);
 }
 static OSStatus coreaudio_get_streamformat(AudioDeviceID id,
                                           AudioStreamBasicDescription *d)
 {
    UInt32 size = sizeof(*d);
    return AudioDeviceGetProperty(
        id,
        0,
        false,
        kAudioDevicePropertyStreamFormat,
        &size,
        d);
 }
 static OSStatus coreaudio_set_streamformat(AudioDeviceID id,
                                           AudioStreamBasicDescription *d)
 {
    UInt32 size = sizeof(*d);
    return AudioDeviceSetProperty(
        id,
        0,
        0,
        0,
        kAudioDevicePropertyStreamFormat,
        size,
        d);
 }
 static OSStatus coreaudio_get_isrunning(AudioDeviceID id, UInt32 *result)
 {
    UInt32 size = sizeof(*result);
    return AudioDeviceGetProperty(
        id,
        0,
        0,
        kAudioDevicePropertyDeviceIsRunning,
        &size,
        result);
 }
 #endif
 static void coreaudio_logstatus (OSStatus status)
 {
-    const char *str = "BUG";
+    char *str = "BUG";
    switch(status) {
    case kAudioHardwareNoError:
@@ -324,7 +104,7 @@ static void coreaudio_logstatus (OSStatus status)
        break;
    default:
-        AUD_log (AUDIO_CAP, "Reason: status code %" PRId32 "\n", (int32_t)status);
+        AUD_log (AUDIO_CAP, "Reason: status code %ld\n", status);
        return;
    }
@@ -368,7 +148,10 @@ static inline UInt32 isPlaying (AudioDeviceID outputDeviceID)
 {
    OSStatus status;
    UInt32 result = 0;
-    status = coreaudio_get_isrunning(outputDeviceID, &result);
+    UInt32 propertySize = sizeof(outputDeviceID);
    status = AudioDeviceGetProperty(
        outputDeviceID, 0, 0,
        kAudioDevicePropertyDeviceIsRunning, &propertySize, &result);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr(status,
                         "Could not determine whether Device is playing\n");
@@ -376,6 +159,11 @@ static inline UInt32 isPlaying (AudioDeviceID outputDeviceID)
    return result;
 }
 static void coreaudio_atexit (void)
 {
    conf.isAtexit = 1;
 }
 static int coreaudio_lock (coreaudioVoiceOut *core, const char *fn_name)
 {
    int err;
@@ -499,15 +287,14 @@ static int coreaudio_write (SWVoiceOut *sw, void *buf, int len)
    return audio_pcm_sw_write (sw, buf, len);
 }
-static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
+static int coreaudio_init_out (HWVoiceOut *hw, struct audsettings *as)
                              void *drv_opaque)
 {
    OSStatus status;
    coreaudioVoiceOut *core = (coreaudioVoiceOut *) hw;
    UInt32 propertySize;
    int err;
    const char *typ = "playback";
    AudioValueRange frameRange;
    CoreaudioConf *conf = drv_opaque;
    /* create mutex */
    err = pthread_mutex_init(&core->mutex, NULL);
@@ -518,7 +305,12 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
    audio_pcm_init_info (&hw->info, as);
-    status = coreaudio_get_voice(&core->outputDeviceID);
+    /* open default output device */
    propertySize = sizeof(core->outputDeviceID);
    status = AudioHardwareGetProperty(
        kAudioHardwarePropertyDefaultOutputDevice,
        &propertySize,
        &core->outputDeviceID);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr2 (status, typ,
                           "Could not get default output Device\n");
@@ -530,49 +322,74 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
    }
    /* get minimum and maximum buffer frame sizes */
-    status = coreaudio_get_framesizerange(core->outputDeviceID,
+    propertySize = sizeof(frameRange);
-                                          &frameRange);
+    status = AudioDeviceGetProperty(
        core->outputDeviceID,
        0,
        0,
        kAudioDevicePropertyBufferFrameSizeRange,
        &propertySize,
        &frameRange);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr2 (status, typ,
                           "Could not get device buffer frame range\n");
        return -1;
    }
-    if (frameRange.mMinimum > conf->buffer_frames) {
+    if (frameRange.mMinimum > conf.buffer_frames) {
        core->audioDevicePropertyBufferFrameSize = (UInt32) frameRange.mMinimum;
        dolog ("warning: Upsizing Buffer Frames to %f\n", frameRange.mMinimum);
    }
-    else if (frameRange.mMaximum < conf->buffer_frames) {
+    else if (frameRange.mMaximum < conf.buffer_frames) {
        core->audioDevicePropertyBufferFrameSize = (UInt32) frameRange.mMaximum;
        dolog ("warning: Downsizing Buffer Frames to %f\n", frameRange.mMaximum);
    }
    else {
-        core->audioDevicePropertyBufferFrameSize = conf->buffer_frames;
+        core->audioDevicePropertyBufferFrameSize = conf.buffer_frames;
    }
    /* set Buffer Frame Size */
-    status = coreaudio_set_framesize(core->outputDeviceID,
+    propertySize = sizeof(core->audioDevicePropertyBufferFrameSize);
-                                     &core->audioDevicePropertyBufferFrameSize);
+    status = AudioDeviceSetProperty(
        core->outputDeviceID,
        NULL,
        0,
        false,
        kAudioDevicePropertyBufferFrameSize,
        propertySize,
        &core->audioDevicePropertyBufferFrameSize);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr2 (status, typ,
-                           "Could not set device buffer frame size %" PRIu32 "\n",
+                           "Could not set device buffer frame size %ld\n",
-                           (uint32_t)core->audioDevicePropertyBufferFrameSize);
+                           core->audioDevicePropertyBufferFrameSize);
        return -1;
    }
    /* get Buffer Frame Size */
-    status = coreaudio_get_framesize(core->outputDeviceID,
+    propertySize = sizeof(core->audioDevicePropertyBufferFrameSize);
-                                     &core->audioDevicePropertyBufferFrameSize);
+    status = AudioDeviceGetProperty(
        core->outputDeviceID,
        0,
        false,
        kAudioDevicePropertyBufferFrameSize,
        &propertySize,
        &core->audioDevicePropertyBufferFrameSize);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr2 (status, typ,
                           "Could not get device buffer frame size\n");
        return -1;
    }
-    hw->samples = conf->nbuffers * core->audioDevicePropertyBufferFrameSize;
+    hw->samples = conf.nbuffers * core->audioDevicePropertyBufferFrameSize;
    /* get StreamFormat */
-    status = coreaudio_get_streamformat(core->outputDeviceID,
+    propertySize = sizeof(core->outputStreamBasicDescription);
-                                        &core->outputStreamBasicDescription);
+    status = AudioDeviceGetProperty(
        core->outputDeviceID,
        0,
        false,
        kAudioDevicePropertyStreamFormat,
        &propertySize,
        &core->outputStreamBasicDescription);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr2 (status, typ,
                           "Could not get Device Stream properties\n");
@@ -582,8 +399,15 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
    /* set Samplerate */
    core->outputStreamBasicDescription.mSampleRate = (Float64) as->freq;
-    status = coreaudio_set_streamformat(core->outputDeviceID,
+    propertySize = sizeof(core->outputStreamBasicDescription);
-                                        &core->outputStreamBasicDescription);
+    status = AudioDeviceSetProperty(
        core->outputDeviceID,
        0,
        0,
        0,
        kAudioDevicePropertyStreamFormat,
        propertySize,
        &core->outputStreamBasicDescription);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr2 (status, typ, "Could not set samplerate %d\n",
                           as->freq);
@@ -592,12 +416,8 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
    }
    /* set Callback */
-    core->ioprocid = NULL;
+    status = AudioDeviceAddIOProc(core->outputDeviceID, audioDeviceIOProc, hw);
-    status = AudioDeviceCreateIOProcID(core->outputDeviceID,
+    if (status != kAudioHardwareNoError) {
                                       audioDeviceIOProc,
                                       hw,
                                       &core->ioprocid);
    if (status != kAudioHardwareNoError || core->ioprocid == NULL) {
        coreaudio_logerr2 (status, typ, "Could not set IOProc\n");
        core->outputDeviceID = kAudioDeviceUnknown;
        return -1;
@@ -605,10 +425,10 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
    /* start Playback */
    if (!isPlaying(core->outputDeviceID)) {
-        status = AudioDeviceStart(core->outputDeviceID, core->ioprocid);
+        status = AudioDeviceStart(core->outputDeviceID, audioDeviceIOProc);
        if (status != kAudioHardwareNoError) {
            coreaudio_logerr2 (status, typ, "Could not start playback\n");
-            AudioDeviceDestroyIOProcID(core->outputDeviceID, core->ioprocid);
+            AudioDeviceRemoveIOProc(core->outputDeviceID, audioDeviceIOProc);
            core->outputDeviceID = kAudioDeviceUnknown;
            return -1;
        }
@@ -623,18 +443,18 @@ static void coreaudio_fini_out (HWVoiceOut *hw)
    int err;
    coreaudioVoiceOut *core = (coreaudioVoiceOut *) hw;
-    if (!audio_is_cleaning_up()) {
+    if (!conf.isAtexit) {
        /* stop playback */
        if (isPlaying(core->outputDeviceID)) {
-            status = AudioDeviceStop(core->outputDeviceID, core->ioprocid);
+            status = AudioDeviceStop(core->outputDeviceID, audioDeviceIOProc);
            if (status != kAudioHardwareNoError) {
                coreaudio_logerr (status, "Could not stop playback\n");
            }
        }
        /* remove callback */
-        status = AudioDeviceDestroyIOProcID(core->outputDeviceID,
+        status = AudioDeviceRemoveIOProc(core->outputDeviceID,
-                                            core->ioprocid);
+                                         audioDeviceIOProc);
        if (status != kAudioHardwareNoError) {
            coreaudio_logerr (status, "Could not remove IOProc\n");
        }
@@ -657,7 +477,7 @@ static int coreaudio_ctl_out (HWVoiceOut *hw, int cmd, ...)
    case VOICE_ENABLE:
        /* start playback */
        if (!isPlaying(core->outputDeviceID)) {
-            status = AudioDeviceStart(core->outputDeviceID, core->ioprocid);
+            status = AudioDeviceStart(core->outputDeviceID, audioDeviceIOProc);
            if (status != kAudioHardwareNoError) {
                coreaudio_logerr (status, "Could not resume playback\n");
            }
@@ -666,10 +486,9 @@ static int coreaudio_ctl_out (HWVoiceOut *hw, int cmd, ...)
    case VOICE_DISABLE:
        /* stop playback */
-        if (!audio_is_cleaning_up()) {
+        if (!conf.isAtexit) {
            if (isPlaying(core->outputDeviceID)) {
-                status = AudioDeviceStop(core->outputDeviceID,
+                status = AudioDeviceStop(core->outputDeviceID, audioDeviceIOProc);
                                         core->ioprocid);
                if (status != kAudioHardwareNoError) {
                    coreaudio_logerr (status, "Could not pause playback\n");
                }
@@ -680,35 +499,28 @@ static int coreaudio_ctl_out (HWVoiceOut *hw, int cmd, ...)
    return 0;
 }
 static CoreaudioConf glob_conf = {
    .buffer_frames = 512,
    .nbuffers = 4,
 };
 static void *coreaudio_audio_init (void)
 {
-    CoreaudioConf *conf = g_malloc(sizeof(CoreaudioConf));
+    atexit(coreaudio_atexit);
-    *conf = glob_conf;
+    return &coreaudio_audio_init;
    return conf;
 }
 static void coreaudio_audio_fini (void *opaque)
 {
-    g_free(opaque);
+    (void) opaque;
 }
 static struct audio_option coreaudio_options[] = {
    {
        .name  = "BUFFER_SIZE",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.buffer_frames,
+        .valp  = &conf.buffer_frames,
        .descr = "Size of the buffer in frames"
    },
    {
        .name  = "BUFFER_COUNT",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.nbuffers,
+        .valp  = &conf.nbuffers,
        .descr = "Number of buffers"
    },
    { /* End of list */ }
--- a/audio/dsound_template.h
+++ b/audio/dsound_template.h
@@ -67,11 +67,11 @@ static int glue (dsound_lock_, TYPE) (
    LPVOID *p2p,
    DWORD *blen1p,
    DWORD *blen2p,
-    int entire,
+    int entire
    dsound *s
    )
 {
    HRESULT hr;
    int i;
    LPVOID p1 = NULL, p2 = NULL;
    DWORD blen1 = 0, blen2 = 0;
    DWORD flag;
@@ -81,18 +81,37 @@ static int glue (dsound_lock_, TYPE) (
 #else
    flag = entire ? DSBLOCK_ENTIREBUFFER : 0;
 #endif
-    hr = glue(IFACE, _Lock)(buf, pos, len, &p1, &blen1, &p2, &blen2, flag);
+    for (i = 0; i < conf.lock_retries; ++i) {
        hr = glue (IFACE, _Lock) (
            buf,
            pos,
            len,
            &p1,
            &blen1,
            &p2,
            &blen2,
            flag
            );
-    if (FAILED (hr)) {
+        if (FAILED (hr)) {
 #ifndef DSBTYPE_IN
-        if (hr == DSERR_BUFFERLOST) {
+            if (hr == DSERR_BUFFERLOST) {
-            if (glue (dsound_restore_, TYPE) (buf, s)) {
+                if (glue (dsound_restore_, TYPE) (buf)) {
-                dsound_logerr (hr, "Could not lock " NAME "\n");
+                    dsound_logerr (hr, "Could not lock " NAME "\n");
                    goto fail;
                }
                continue;
            }
 #endif
            dsound_logerr (hr, "Could not lock " NAME "\n");
            goto fail;
        }
-#endif
+
-        dsound_logerr (hr, "Could not lock " NAME "\n");
+        break;
    }
    if (i == conf.lock_retries) {
        dolog ("%d attempts to lock " NAME " failed\n", i);
        goto fail;
    }
@@ -155,19 +174,16 @@ static void dsound_fini_out (HWVoiceOut *hw)
 }
 #ifdef DSBTYPE_IN
-static int dsound_init_in(HWVoiceIn *hw, struct audsettings *as,
+static int dsound_init_in (HWVoiceIn *hw, struct audsettings *as)
                          void *drv_opaque)
 #else
-static int dsound_init_out(HWVoiceOut *hw, struct audsettings *as,
+static int dsound_init_out (HWVoiceOut *hw, struct audsettings *as)
                           void *drv_opaque)
 #endif
 {
    int err;
    HRESULT hr;
-    dsound *s = drv_opaque;
+    dsound *s = &glob_dsound;
    WAVEFORMATEX wfx;
    struct audsettings obt_as;
    DSoundConf *conf = &s->conf;
 #ifdef DSBTYPE_IN
    const char *typ = "ADC";
    DSoundVoiceIn *ds = (DSoundVoiceIn *) hw;
@@ -194,7 +210,7 @@ static int dsound_init_out(HWVoiceOut *hw, struct audsettings *as,
    bd.dwSize = sizeof (bd);
    bd.lpwfxFormat = &wfx;
 #ifdef DSBTYPE_IN
-    bd.dwBufferBytes = conf->bufsize_in;
+    bd.dwBufferBytes = conf.bufsize_in;
    hr = IDirectSoundCapture_CreateCaptureBuffer (
        s->dsound_capture,
        &bd,
@@ -203,7 +219,7 @@ static int dsound_init_out(HWVoiceOut *hw, struct audsettings *as,
        );
 #else
    bd.dwFlags = DSBCAPS_STICKYFOCUS | DSBCAPS_GETCURRENTPOSITION2;
-    bd.dwBufferBytes = conf->bufsize_out;
+    bd.dwBufferBytes = conf.bufsize_out;
    hr = IDirectSound_CreateSoundBuffer (
        s->dsound,
        &bd,
@@ -253,7 +269,6 @@ static int dsound_init_out(HWVoiceOut *hw, struct audsettings *as,
            );
    }
    hw->samples = bc.dwBufferBytes >> hw->info.shift;
    ds->s = s;
 #ifdef DEBUG_DSOUND
    dolog ("caps %ld, desc %ld\n",
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -26,7 +26,6 @@
 * SEAL 1.07 by Carlos 'pel' Hasan was used as documentation
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "audio.h"
@@ -42,25 +41,42 @@
 /* #define DEBUG_DSOUND */
-typedef struct {
+static struct {
    int lock_retries;
    int restore_retries;
    int getstatus_retries;
    int set_primary;
    int bufsize_in;
    int bufsize_out;
    struct audsettings settings;
    int latency_millis;
-} DSoundConf;
+} conf = {
    .lock_retries       = 1,
    .restore_retries    = 1,
    .getstatus_retries  = 1,
    .set_primary        = 0,
    .bufsize_in         = 16384,
    .bufsize_out        = 16384,
    .settings.freq      = 44100,
    .settings.nchannels = 2,
    .settings.fmt       = AUD_FMT_S16,
    .latency_millis     = 10
 };
 typedef struct {
    LPDIRECTSOUND dsound;
    LPDIRECTSOUNDCAPTURE dsound_capture;
    LPDIRECTSOUNDBUFFER dsound_primary_buffer;
    struct audsettings settings;
    DSoundConf conf;
 } dsound;
 static dsound glob_dsound;
 typedef struct {
    HWVoiceOut hw;
    LPDIRECTSOUNDBUFFER dsound_buffer;
    DWORD old_pos;
    int first_time;
    dsound *s;
 #ifdef DEBUG_DSOUND
    DWORD old_ppos;
    DWORD played;
@@ -72,7 +88,6 @@ typedef struct {
    HWVoiceIn hw;
    int first_time;
    LPDIRECTSOUNDCAPTUREBUFFER dsound_capture_buffer;
    dsound *s;
 } DSoundVoiceIn;
 static void dsound_log_hresult (HRESULT hr)
@@ -266,17 +281,29 @@ static void print_wave_format (WAVEFORMATEX *wfx)
 }
 #endif
-static int dsound_restore_out (LPDIRECTSOUNDBUFFER dsb, dsound *s)
+static int dsound_restore_out (LPDIRECTSOUNDBUFFER dsb)
 {
    HRESULT hr;
    int i;
-    hr = IDirectSoundBuffer_Restore (dsb);
+    for (i = 0; i < conf.restore_retries; ++i) {
        hr = IDirectSoundBuffer_Restore (dsb);
-    if (hr != DS_OK) {
+        switch (hr) {
-        dsound_logerr (hr, "Could not restore playback buffer\n");
+        case DS_OK:
-        return -1;
+            return 0;
        case DSERR_BUFFERLOST:
            continue;
        default:
            dsound_logerr (hr, "Could not restore playback buffer\n");
            return -1;
        }
    }
-    return 0;
+
    dolog ("%d attempts to restore playback buffer failed\n", i);
    return -1;
 }
 #include "dsound_template.h"
@@ -284,20 +311,25 @@ static int dsound_restore_out (LPDIRECTSOUNDBUFFER dsb, dsound *s)
 #include "dsound_template.h"
 #undef DSBTYPE_IN
-static int dsound_get_status_out (LPDIRECTSOUNDBUFFER dsb, DWORD *statusp,
+static int dsound_get_status_out (LPDIRECTSOUNDBUFFER dsb, DWORD *statusp)
                                  dsound *s)
 {
    HRESULT hr;
    int i;
-    hr = IDirectSoundBuffer_GetStatus (dsb, statusp);
+    for (i = 0; i < conf.getstatus_retries; ++i) {
-    if (FAILED (hr)) {
+        hr = IDirectSoundBuffer_GetStatus (dsb, statusp);
-        dsound_logerr (hr, "Could not get playback buffer status\n");
+        if (FAILED (hr)) {
-        return -1;
+            dsound_logerr (hr, "Could not get playback buffer status\n");
-    }
+            return -1;
        }
-    if (*statusp & DSERR_BUFFERLOST) {
+        if (*statusp & DSERR_BUFFERLOST) {
-        dsound_restore_out(dsb, s);
+            if (dsound_restore_out (dsb)) {
-        return -1;
+                return -1;
            }
            continue;
        }
        break;
    }
    return 0;
@@ -344,8 +376,7 @@ static void dsound_write_sample (HWVoiceOut *hw, uint8_t *dst, int dst_len)
    hw->rpos = pos % hw->samples;
 }
-static void dsound_clear_sample (HWVoiceOut *hw, LPDIRECTSOUNDBUFFER dsb,
+static void dsound_clear_sample (HWVoiceOut *hw, LPDIRECTSOUNDBUFFER dsb)
                                 dsound *s)
 {
    int err;
    LPVOID p1, p2;
@@ -358,8 +389,7 @@ static void dsound_clear_sample (HWVoiceOut *hw, LPDIRECTSOUNDBUFFER dsb,
        hw->samples << hw->info.shift,
        &p1, &p2,
        &blen1, &blen2,
-        1,
+        1
        s
        );
    if (err) {
        return;
@@ -385,9 +415,25 @@ static void dsound_clear_sample (HWVoiceOut *hw, LPDIRECTSOUNDBUFFER dsb,
    dsound_unlock_out (dsb, p1, p2, blen1, blen2);
 }
-static int dsound_open (dsound *s)
+static void dsound_close (dsound *s)
 {
    HRESULT hr;
    if (s->dsound_primary_buffer) {
        hr = IDirectSoundBuffer_Release (s->dsound_primary_buffer);
        if (FAILED (hr)) {
            dsound_logerr (hr, "Could not release primary buffer\n");
        }
        s->dsound_primary_buffer = NULL;
    }
 }
 static int dsound_open (dsound *s)
 {
    int err;
    HRESULT hr;
    WAVEFORMATEX wfx;
    DSBUFFERDESC dsbd;
    HWND hwnd;
    hwnd = GetForegroundWindow ();
@@ -403,7 +449,63 @@ static int dsound_open (dsound *s)
        return -1;
    }
    if (!conf.set_primary) {
        return 0;
    }
    err = waveformat_from_audio_settings (&wfx, &conf.settings);
    if (err) {
        return -1;
    }
    memset (&dsbd, 0, sizeof (dsbd));
    dsbd.dwSize = sizeof (dsbd);
    dsbd.dwFlags = DSBCAPS_PRIMARYBUFFER;
    dsbd.dwBufferBytes = 0;
    dsbd.lpwfxFormat = NULL;
    hr = IDirectSound_CreateSoundBuffer (
        s->dsound,
        &dsbd,
        &s->dsound_primary_buffer,
        NULL
        );
    if (FAILED (hr)) {
        dsound_logerr (hr, "Could not create primary playback buffer\n");
        return -1;
    }
    hr = IDirectSoundBuffer_SetFormat (s->dsound_primary_buffer, &wfx);
    if (FAILED (hr)) {
        dsound_logerr (hr, "Could not set primary playback buffer format\n");
    }
    hr = IDirectSoundBuffer_GetFormat (
        s->dsound_primary_buffer,
        &wfx,
        sizeof (wfx),
        NULL
        );
    if (FAILED (hr)) {
        dsound_logerr (hr, "Could not get primary playback buffer format\n");
        goto fail0;
    }
 #ifdef DEBUG_DSOUND
    dolog ("Primary\n");
    print_wave_format (&wfx);
 #endif
    err = waveformat_to_audio_settings (&wfx, &s->settings);
    if (err) {
        goto fail0;
    }
    return 0;
 fail0:
    dsound_close (s);
    return -1;
 }
 static int dsound_ctl_out (HWVoiceOut *hw, int cmd, ...)
@@ -412,7 +514,6 @@ static int dsound_ctl_out (HWVoiceOut *hw, int cmd, ...)
    DWORD status;
    DSoundVoiceOut *ds = (DSoundVoiceOut *) hw;
    LPDIRECTSOUNDBUFFER dsb = ds->dsound_buffer;
    dsound *s = ds->s;
    if (!dsb) {
        dolog ("Attempt to control voice without a buffer\n");
@@ -421,7 +522,7 @@ static int dsound_ctl_out (HWVoiceOut *hw, int cmd, ...)
    switch (cmd) {
    case VOICE_ENABLE:
-        if (dsound_get_status_out (dsb, &status, s)) {
+        if (dsound_get_status_out (dsb, &status)) {
            return -1;
        }
@@ -430,7 +531,7 @@ static int dsound_ctl_out (HWVoiceOut *hw, int cmd, ...)
            return 0;
        }
-        dsound_clear_sample (hw, dsb, s);
+        dsound_clear_sample (hw, dsb);
        hr = IDirectSoundBuffer_Play (dsb, 0, 0, DSBPLAY_LOOPING);
        if (FAILED (hr)) {
@@ -440,7 +541,7 @@ static int dsound_ctl_out (HWVoiceOut *hw, int cmd, ...)
        break;
    case VOICE_DISABLE:
-        if (dsound_get_status_out (dsb, &status, s)) {
+        if (dsound_get_status_out (dsb, &status)) {
            return -1;
        }
@@ -477,8 +578,6 @@ static int dsound_run_out (HWVoiceOut *hw, int live)
    DWORD wpos, ppos, old_pos;
    LPVOID p1, p2;
    int bufsize;
    dsound *s = ds->s;
    DSoundConf *conf = &s->conf;
    if (!dsb) {
        dolog ("Attempt to run empty with playback buffer\n");
@@ -501,14 +600,14 @@ static int dsound_run_out (HWVoiceOut *hw, int live)
    len = live << hwshift;
    if (ds->first_time) {
-        if (conf->latency_millis) {
+        if (conf.latency_millis) {
            DWORD cur_blat;
            cur_blat = audio_ring_dist (wpos, ppos, bufsize);
            ds->first_time = 0;
            old_pos = wpos;
            old_pos +=
-                millis_to_bytes (&hw->info, conf->latency_millis) - cur_blat;
+                millis_to_bytes (&hw->info, conf.latency_millis) - cur_blat;
            old_pos %= bufsize;
            old_pos &= ~hw->info.align;
        }
@@ -564,8 +663,7 @@ static int dsound_run_out (HWVoiceOut *hw, int live)
        len,
        &p1, &p2,
        &blen1, &blen2,
-        0,
+        0
        s
        );
    if (err) {
        return 0;
@@ -668,7 +766,6 @@ static int dsound_run_in (HWVoiceIn *hw)
    DWORD cpos, rpos;
    LPVOID p1, p2;
    int hwshift;
    dsound *s = ds->s;
    if (!dscb) {
        dolog ("Attempt to run without capture buffer\n");
@@ -723,8 +820,7 @@ static int dsound_run_in (HWVoiceIn *hw)
        &p2,
        &blen1,
        &blen2,
-        0,
+        0
        s
        );
    if (err) {
        return 0;
@@ -735,11 +831,11 @@ static int dsound_run_in (HWVoiceIn *hw)
    decr = len1 + len2;
    if (p1 && len1) {
-        hw->conv (hw->conv_buf + hw->wpos, p1, len1);
+        hw->conv (hw->conv_buf + hw->wpos, p1, len1, &nominal_volume);
    }
    if (p2 && len2) {
-        hw->conv (hw->conv_buf, p2, len2);
+        hw->conv (hw->conv_buf, p2, len2, &nominal_volume);
    }
    dsound_unlock_in (dscb, p1, p2, blen1, blen2);
@@ -747,19 +843,12 @@ static int dsound_run_in (HWVoiceIn *hw)
    return decr;
 }
 static DSoundConf glob_conf = {
    .bufsize_in         = 16384,
    .bufsize_out        = 16384,
    .latency_millis     = 10
 };
 static void dsound_audio_fini (void *opaque)
 {
    HRESULT hr;
    dsound *s = opaque;
    if (!s->dsound) {
        g_free(s);
        return;
    }
@@ -770,7 +859,6 @@ static void dsound_audio_fini (void *opaque)
    s->dsound = NULL;
    if (!s->dsound_capture) {
        g_free(s);
        return;
    }
@@ -779,21 +867,17 @@ static void dsound_audio_fini (void *opaque)
        dsound_logerr (hr, "Could not release DirectSoundCapture\n");
    }
    s->dsound_capture = NULL;
    g_free(s);
 }
 static void *dsound_audio_init (void)
 {
    int err;
    HRESULT hr;
-    dsound *s = g_malloc0(sizeof(dsound));
+    dsound *s = &glob_dsound;
    s->conf = glob_conf;
    hr = CoInitialize (NULL);
    if (FAILED (hr)) {
        dsound_logerr (hr, "Could not initialize COM\n");
        g_free(s);
        return NULL;
    }
@@ -806,7 +890,6 @@ static void *dsound_audio_init (void)
        );
    if (FAILED (hr)) {
        dsound_logerr (hr, "Could not create DirectSound instance\n");
        g_free(s);
        return NULL;
    }
@@ -818,7 +901,7 @@ static void *dsound_audio_init (void)
        if (FAILED (hr)) {
            dsound_logerr (hr, "Could not release DirectSound\n");
        }
-        g_free(s);
+        s->dsound = NULL;
        return NULL;
    }
@@ -855,22 +938,64 @@ static void *dsound_audio_init (void)
 }
 static struct audio_option dsound_options[] = {
    {
        .name  = "LOCK_RETRIES",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.lock_retries,
        .descr = "Number of times to attempt locking the buffer"
    },
    {
        .name  = "RESTOURE_RETRIES",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.restore_retries,
        .descr = "Number of times to attempt restoring the buffer"
    },
    {
        .name  = "GETSTATUS_RETRIES",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.getstatus_retries,
        .descr = "Number of times to attempt getting status of the buffer"
    },
    {
        .name  = "SET_PRIMARY",
        .tag   = AUD_OPT_BOOL,
        .valp  = &conf.set_primary,
        .descr = "Set the parameters of primary buffer"
    },
    {
        .name  = "LATENCY_MILLIS",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.latency_millis,
+        .valp  = &conf.latency_millis,
        .descr = "(undocumented)"
    },
    {
        .name  = "PRIMARY_FREQ",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.settings.freq,
        .descr = "Primary buffer frequency"
    },
    {
        .name  = "PRIMARY_CHANNELS",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.settings.nchannels,
        .descr = "Primary buffer number of channels (1 - mono, 2 - stereo)"
    },
    {
        .name  = "PRIMARY_FMT",
        .tag   = AUD_OPT_FMT,
        .valp  = &conf.settings.fmt,
        .descr = "Primary buffer format"
    },
    {
        .name  = "BUFSIZE_OUT",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.bufsize_out,
+        .valp  = &conf.bufsize_out,
        .descr = "(undocumented)"
    },
    {
        .name  = "BUFSIZE_IN",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.bufsize_in,
+        .valp  = &conf.bufsize_in,
        .descr = "(undocumented)"
    },
    { /* End of list */ }
--- a/audio/esdaudio.c
+++ b/audio/esdaudio.c
@@ -0,0 +1,604 @@
 /*
 * QEMU ESD audio driver
 *
 * Copyright (c) 2006 Frederick Reeve (brushed up by malc)
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include <esd.h>
 #include "qemu-common.h"
 #include "audio.h"
 #include <signal.h>
 #define AUDIO_CAP "esd"
 #include "audio_int.h"
 #include "audio_pt_int.h"
 typedef struct {
    HWVoiceOut hw;
    int done;
    int live;
    int decr;
    int rpos;
    void *pcm_buf;
    int fd;
    struct audio_pt pt;
 } ESDVoiceOut;
 typedef struct {
    HWVoiceIn hw;
    int done;
    int dead;
    int incr;
    int wpos;
    void *pcm_buf;
    int fd;
    struct audio_pt pt;
 } ESDVoiceIn;
 static struct {
    int samples;
    int divisor;
    char *dac_host;
    char *adc_host;
 } conf = {
    .samples = 1024,
    .divisor = 2,
 };
 static void GCC_FMT_ATTR (2, 3) qesd_logerr (int err, const char *fmt, ...)
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
    AUD_log (AUDIO_CAP, "Reason: %s\n", strerror (err));
 }
 /* playback */
 static void *qesd_thread_out (void *arg)
 {
    ESDVoiceOut *esd = arg;
    HWVoiceOut *hw = &esd->hw;
    int threshold;
    threshold = conf.divisor ? hw->samples / conf.divisor : 0;
    if (audio_pt_lock (&esd->pt, AUDIO_FUNC)) {
        return NULL;
    }
    for (;;) {
        int decr, to_mix, rpos;
        for (;;) {
            if (esd->done) {
                goto exit;
            }
            if (esd->live > threshold) {
                break;
            }
            if (audio_pt_wait (&esd->pt, AUDIO_FUNC)) {
                goto exit;
            }
        }
        decr = to_mix = esd->live;
        rpos = hw->rpos;
        if (audio_pt_unlock (&esd->pt, AUDIO_FUNC)) {
            return NULL;
        }
        while (to_mix) {
            ssize_t written;
            int chunk = audio_MIN (to_mix, hw->samples - rpos);
            struct st_sample *src = hw->mix_buf + rpos;
            hw->clip (esd->pcm_buf, src, chunk);
        again:
            written = write (esd->fd, esd->pcm_buf, chunk << hw->info.shift);
            if (written == -1) {
                if (errno == EINTR || errno == EAGAIN) {
                    goto again;
                }
                qesd_logerr (errno, "write failed\n");
                return NULL;
            }
            if (written != chunk << hw->info.shift) {
                int wsamples = written >> hw->info.shift;
                int wbytes = wsamples << hw->info.shift;
                if (wbytes != written) {
                    dolog ("warning: Misaligned write %d (requested %zd), "
                           "alignment %d\n",
                           wbytes, written, hw->info.align + 1);
                }
                to_mix -= wsamples;
                rpos = (rpos + wsamples) % hw->samples;
                break;
            }
            rpos = (rpos + chunk) % hw->samples;
            to_mix -= chunk;
        }
        if (audio_pt_lock (&esd->pt, AUDIO_FUNC)) {
            return NULL;
        }
        esd->rpos = rpos;
        esd->live -= decr;
        esd->decr += decr;
    }
 exit:
    audio_pt_unlock (&esd->pt, AUDIO_FUNC);
    return NULL;
 }
 static int qesd_run_out (HWVoiceOut *hw, int live)
 {
    int decr;
    ESDVoiceOut *esd = (ESDVoiceOut *) hw;
    if (audio_pt_lock (&esd->pt, AUDIO_FUNC)) {
        return 0;
    }
    decr = audio_MIN (live, esd->decr);
    esd->decr -= decr;
    esd->live = live - decr;
    hw->rpos = esd->rpos;
    if (esd->live > 0) {
        audio_pt_unlock_and_signal (&esd->pt, AUDIO_FUNC);
    }
    else {
        audio_pt_unlock (&esd->pt, AUDIO_FUNC);
    }
    return decr;
 }
 static int qesd_write (SWVoiceOut *sw, void *buf, int len)
 {
    return audio_pcm_sw_write (sw, buf, len);
 }
 static int qesd_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
    ESDVoiceOut *esd = (ESDVoiceOut *) hw;
    struct audsettings obt_as = *as;
    int esdfmt = ESD_STREAM | ESD_PLAY;
    int err;
    sigset_t set, old_set;
    sigfillset (&set);
    esdfmt |= (as->nchannels == 2) ? ESD_STEREO : ESD_MONO;
    switch (as->fmt) {
    case AUD_FMT_S8:
    case AUD_FMT_U8:
        esdfmt |= ESD_BITS8;
        obt_as.fmt = AUD_FMT_U8;
        break;
    case AUD_FMT_S32:
    case AUD_FMT_U32:
        dolog ("Will use 16 instead of 32 bit samples\n");
    case AUD_FMT_S16:
    case AUD_FMT_U16:
    deffmt:
        esdfmt |= ESD_BITS16;
        obt_as.fmt = AUD_FMT_S16;
        break;
    default:
        dolog ("Internal logic error: Bad audio format %d\n", as->fmt);
        goto deffmt;
    }
    obt_as.endianness = AUDIO_HOST_ENDIANNESS;
    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = conf.samples;
    esd->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    if (!esd->pcm_buf) {
        dolog ("Could not allocate buffer (%d bytes)\n",
               hw->samples << hw->info.shift);
        return -1;
    }
    esd->fd = -1;
    err = pthread_sigmask (SIG_BLOCK, &set, &old_set);
    if (err) {
        qesd_logerr (err, "pthread_sigmask failed\n");
        goto fail1;
    }
    esd->fd = esd_play_stream (esdfmt, as->freq, conf.dac_host, NULL);
    if (esd->fd < 0) {
        qesd_logerr (errno, "esd_play_stream failed\n");
        goto fail2;
    }
    if (audio_pt_init (&esd->pt, qesd_thread_out, esd, AUDIO_CAP, AUDIO_FUNC)) {
        goto fail3;
    }
    err = pthread_sigmask (SIG_SETMASK, &old_set, NULL);
    if (err) {
        qesd_logerr (err, "pthread_sigmask(restore) failed\n");
    }
    return 0;
 fail3:
    if (close (esd->fd)) {
        qesd_logerr (errno, "%s: close on esd socket(%d) failed\n",
                     AUDIO_FUNC, esd->fd);
    }
    esd->fd = -1;
 fail2:
    err = pthread_sigmask (SIG_SETMASK, &old_set, NULL);
    if (err) {
        qesd_logerr (err, "pthread_sigmask(restore) failed\n");
    }
 fail1:
    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
    return -1;
 }
 static void qesd_fini_out (HWVoiceOut *hw)
 {
    void *ret;
    ESDVoiceOut *esd = (ESDVoiceOut *) hw;
    audio_pt_lock (&esd->pt, AUDIO_FUNC);
    esd->done = 1;
    audio_pt_unlock_and_signal (&esd->pt, AUDIO_FUNC);
    audio_pt_join (&esd->pt, &ret, AUDIO_FUNC);
    if (esd->fd >= 0) {
        if (close (esd->fd)) {
            qesd_logerr (errno, "failed to close esd socket\n");
        }
        esd->fd = -1;
    }
    audio_pt_fini (&esd->pt, AUDIO_FUNC);
    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
 }
 static int qesd_ctl_out (HWVoiceOut *hw, int cmd, ...)
 {
    (void) hw;
    (void) cmd;
    return 0;
 }
 /* capture */
 static void *qesd_thread_in (void *arg)
 {
    ESDVoiceIn *esd = arg;
    HWVoiceIn *hw = &esd->hw;
    int threshold;
    threshold = conf.divisor ? hw->samples / conf.divisor : 0;
    if (audio_pt_lock (&esd->pt, AUDIO_FUNC)) {
        return NULL;
    }
    for (;;) {
        int incr, to_grab, wpos;
        for (;;) {
            if (esd->done) {
                goto exit;
            }
            if (esd->dead > threshold) {
                break;
            }
            if (audio_pt_wait (&esd->pt, AUDIO_FUNC)) {
                goto exit;
            }
        }
        incr = to_grab = esd->dead;
        wpos = hw->wpos;
        if (audio_pt_unlock (&esd->pt, AUDIO_FUNC)) {
            return NULL;
        }
        while (to_grab) {
            ssize_t nread;
            int chunk = audio_MIN (to_grab, hw->samples - wpos);
            void *buf = advance (esd->pcm_buf, wpos);
        again:
            nread = read (esd->fd, buf, chunk << hw->info.shift);
            if (nread == -1) {
                if (errno == EINTR || errno == EAGAIN) {
                    goto again;
                }
                qesd_logerr (errno, "read failed\n");
                return NULL;
            }
            if (nread != chunk << hw->info.shift) {
                int rsamples = nread >> hw->info.shift;
                int rbytes = rsamples << hw->info.shift;
                if (rbytes != nread) {
                    dolog ("warning: Misaligned write %d (requested %zd), "
                           "alignment %d\n",
                           rbytes, nread, hw->info.align + 1);
                }
                to_grab -= rsamples;
                wpos = (wpos + rsamples) % hw->samples;
                break;
            }
            hw->conv (hw->conv_buf + wpos, buf, nread >> hw->info.shift,
                      &nominal_volume);
            wpos = (wpos + chunk) % hw->samples;
            to_grab -= chunk;
        }
        if (audio_pt_lock (&esd->pt, AUDIO_FUNC)) {
            return NULL;
        }
        esd->wpos = wpos;
        esd->dead -= incr;
        esd->incr += incr;
    }
 exit:
    audio_pt_unlock (&esd->pt, AUDIO_FUNC);
    return NULL;
 }
 static int qesd_run_in (HWVoiceIn *hw)
 {
    int live, incr, dead;
    ESDVoiceIn *esd = (ESDVoiceIn *) hw;
    if (audio_pt_lock (&esd->pt, AUDIO_FUNC)) {
        return 0;
    }
    live = audio_pcm_hw_get_live_in (hw);
    dead = hw->samples - live;
    incr = audio_MIN (dead, esd->incr);
    esd->incr -= incr;
    esd->dead = dead - incr;
    hw->wpos = esd->wpos;
    if (esd->dead > 0) {
        audio_pt_unlock_and_signal (&esd->pt, AUDIO_FUNC);
    }
    else {
        audio_pt_unlock (&esd->pt, AUDIO_FUNC);
    }
    return incr;
 }
 static int qesd_read (SWVoiceIn *sw, void *buf, int len)
 {
    return audio_pcm_sw_read (sw, buf, len);
 }
 static int qesd_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
    ESDVoiceIn *esd = (ESDVoiceIn *) hw;
    struct audsettings obt_as = *as;
    int esdfmt = ESD_STREAM | ESD_RECORD;
    int err;
    sigset_t set, old_set;
    sigfillset (&set);
    esdfmt |= (as->nchannels == 2) ? ESD_STEREO : ESD_MONO;
    switch (as->fmt) {
    case AUD_FMT_S8:
    case AUD_FMT_U8:
        esdfmt |= ESD_BITS8;
        obt_as.fmt = AUD_FMT_U8;
        break;
    case AUD_FMT_S16:
    case AUD_FMT_U16:
        esdfmt |= ESD_BITS16;
        obt_as.fmt = AUD_FMT_S16;
        break;
    case AUD_FMT_S32:
    case AUD_FMT_U32:
        dolog ("Will use 16 instead of 32 bit samples\n");
        esdfmt |= ESD_BITS16;
        obt_as.fmt = AUD_FMT_S16;
        break;
    }
    obt_as.endianness = AUDIO_HOST_ENDIANNESS;
    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = conf.samples;
    esd->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    if (!esd->pcm_buf) {
        dolog ("Could not allocate buffer (%d bytes)\n",
               hw->samples << hw->info.shift);
        return -1;
    }
    esd->fd = -1;
    err = pthread_sigmask (SIG_BLOCK, &set, &old_set);
    if (err) {
        qesd_logerr (err, "pthread_sigmask failed\n");
        goto fail1;
    }
    esd->fd = esd_record_stream (esdfmt, as->freq, conf.adc_host, NULL);
    if (esd->fd < 0) {
        qesd_logerr (errno, "esd_record_stream failed\n");
        goto fail2;
    }
    if (audio_pt_init (&esd->pt, qesd_thread_in, esd, AUDIO_CAP, AUDIO_FUNC)) {
        goto fail3;
    }
    err = pthread_sigmask (SIG_SETMASK, &old_set, NULL);
    if (err) {
        qesd_logerr (err, "pthread_sigmask(restore) failed\n");
    }
    return 0;
 fail3:
    if (close (esd->fd)) {
        qesd_logerr (errno, "%s: close on esd socket(%d) failed\n",
                     AUDIO_FUNC, esd->fd);
    }
    esd->fd = -1;
 fail2:
    err = pthread_sigmask (SIG_SETMASK, &old_set, NULL);
    if (err) {
        qesd_logerr (err, "pthread_sigmask(restore) failed\n");
    }
 fail1:
    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
    return -1;
 }
 static void qesd_fini_in (HWVoiceIn *hw)
 {
    void *ret;
    ESDVoiceIn *esd = (ESDVoiceIn *) hw;
    audio_pt_lock (&esd->pt, AUDIO_FUNC);
    esd->done = 1;
    audio_pt_unlock_and_signal (&esd->pt, AUDIO_FUNC);
    audio_pt_join (&esd->pt, &ret, AUDIO_FUNC);
    if (esd->fd >= 0) {
        if (close (esd->fd)) {
            qesd_logerr (errno, "failed to close esd socket\n");
        }
        esd->fd = -1;
    }
    audio_pt_fini (&esd->pt, AUDIO_FUNC);
    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
 }
 static int qesd_ctl_in (HWVoiceIn *hw, int cmd, ...)
 {
    (void) hw;
    (void) cmd;
    return 0;
 }
 /* common */
 static void *qesd_audio_init (void)
 {
    return &conf;
 }
 static void qesd_audio_fini (void *opaque)
 {
    (void) opaque;
    ldebug ("esd_fini");
 }
 struct audio_option qesd_options[] = {
    {
        .name  = "SAMPLES",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.samples,
        .descr = "buffer size in samples"
    },
    {
        .name  = "DIVISOR",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.divisor,
        .descr = "threshold divisor"
    },
    {
        .name  = "DAC_HOST",
        .tag   = AUD_OPT_STR,
        .valp  = &conf.dac_host,
        .descr = "playback host"
    },
    {
        .name  = "ADC_HOST",
        .tag   = AUD_OPT_STR,
        .valp  = &conf.adc_host,
        .descr = "capture host"
    },
    { /* End of list */ }
 };
 static struct audio_pcm_ops qesd_pcm_ops = {
    .init_out = qesd_init_out,
    .fini_out = qesd_fini_out,
    .run_out  = qesd_run_out,
    .write    = qesd_write,
    .ctl_out  = qesd_ctl_out,
    .init_in  = qesd_init_in,
    .fini_in  = qesd_fini_in,
    .run_in   = qesd_run_in,
    .read     = qesd_read,
    .ctl_in   = qesd_ctl_in,
 };
 struct audio_driver esd_audio_driver = {
    .name           = "esd",
    .descr          = "http://en.wikipedia.org/wiki/Esound",
    .options        = qesd_options,
    .init           = qesd_audio_init,
    .fini           = qesd_audio_fini,
    .pcm_ops        = &qesd_pcm_ops,
    .can_be_default = 0,
    .max_voices_out = INT_MAX,
    .max_voices_in  = INT_MAX,
    .voice_size_out = sizeof (ESDVoiceOut),
    .voice_size_in  = sizeof (ESDVoiceIn)
 };
--- a/audio/fmodaudio.c
+++ b/audio/fmodaudio.c
@@ -0,0 +1,687 @@
 /*
 * QEMU FMOD audio driver
 *
 * Copyright (c) 2004-2005 Vassili Karpov (malc)
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include <fmod.h>
 #include <fmod_errors.h>
 #include "qemu-common.h"
 #include "audio.h"
 #define AUDIO_CAP "fmod"
 #include "audio_int.h"
 typedef struct FMODVoiceOut {
    HWVoiceOut hw;
    unsigned int old_pos;
    FSOUND_SAMPLE *fmod_sample;
    int channel;
 } FMODVoiceOut;
 typedef struct FMODVoiceIn {
    HWVoiceIn hw;
    FSOUND_SAMPLE *fmod_sample;
 } FMODVoiceIn;
 static struct {
    const char *drvname;
    int nb_samples;
    int freq;
    int nb_channels;
    int bufsize;
    int broken_adc;
 } conf = {
    .nb_samples  = 2048 * 2,
    .freq        = 44100,
    .nb_channels = 2,
 };
 static void GCC_FMT_ATTR (1, 2) fmod_logerr (const char *fmt, ...)
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
    AUD_log (AUDIO_CAP, "Reason: %s\n",
             FMOD_ErrorString (FSOUND_GetError ()));
 }
 static void GCC_FMT_ATTR (2, 3) fmod_logerr2 (
    const char *typ,
    const char *fmt,
    ...
    )
 {
    va_list ap;
    AUD_log (AUDIO_CAP, "Could not initialize %s\n", typ);
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
    AUD_log (AUDIO_CAP, "Reason: %s\n",
             FMOD_ErrorString (FSOUND_GetError ()));
 }
 static int fmod_write (SWVoiceOut *sw, void *buf, int len)
 {
    return audio_pcm_sw_write (sw, buf, len);
 }
 static void fmod_clear_sample (FMODVoiceOut *fmd)
 {
    HWVoiceOut *hw = &fmd->hw;
    int status;
    void *p1 = 0, *p2 = 0;
    unsigned int len1 = 0, len2 = 0;
    status = FSOUND_Sample_Lock (
        fmd->fmod_sample,
        0,
        hw->samples << hw->info.shift,
        &p1,
        &p2,
        &len1,
        &len2
        );
    if (!status) {
        fmod_logerr ("Failed to lock sample\n");
        return;
    }
    if ((len1 & hw->info.align) || (len2 & hw->info.align)) {
        dolog ("Lock returned misaligned length %d, %d, alignment %d\n",
               len1, len2, hw->info.align + 1);
        goto fail;
    }
    if ((len1 + len2) - (hw->samples << hw->info.shift)) {
        dolog ("Lock returned incomplete length %d, %d\n",
               len1 + len2, hw->samples << hw->info.shift);
        goto fail;
    }
    audio_pcm_info_clear_buf (&hw->info, p1, hw->samples);
 fail:
    status = FSOUND_Sample_Unlock (fmd->fmod_sample, p1, p2, len1, len2);
    if (!status) {
        fmod_logerr ("Failed to unlock sample\n");
    }
 }
 static void fmod_write_sample (HWVoiceOut *hw, uint8_t *dst, int dst_len)
 {
    int src_len1 = dst_len;
    int src_len2 = 0;
    int pos = hw->rpos + dst_len;
    struct st_sample *src1 = hw->mix_buf + hw->rpos;
    struct st_sample *src2 = NULL;
    if (pos > hw->samples) {
        src_len1 = hw->samples - hw->rpos;
        src2 = hw->mix_buf;
        src_len2 = dst_len - src_len1;
        pos = src_len2;
    }
    if (src_len1) {
        hw->clip (dst, src1, src_len1);
    }
    if (src_len2) {
        dst = advance (dst, src_len1 << hw->info.shift);
        hw->clip (dst, src2, src_len2);
    }
    hw->rpos = pos % hw->samples;
 }
 static int fmod_unlock_sample (FSOUND_SAMPLE *sample, void *p1, void *p2,
                               unsigned int blen1, unsigned int blen2)
 {
    int status = FSOUND_Sample_Unlock (sample, p1, p2, blen1, blen2);
    if (!status) {
        fmod_logerr ("Failed to unlock sample\n");
        return -1;
    }
    return 0;
 }
 static int fmod_lock_sample (
    FSOUND_SAMPLE *sample,
    struct audio_pcm_info *info,
    int pos,
    int len,
    void **p1,
    void **p2,
    unsigned int *blen1,
    unsigned int *blen2
    )
 {
    int status;
    status = FSOUND_Sample_Lock (
        sample,
        pos << info->shift,
        len << info->shift,
        p1,
        p2,
        blen1,
        blen2
        );
    if (!status) {
        fmod_logerr ("Failed to lock sample\n");
        return -1;
    }
    if ((*blen1 & info->align) || (*blen2 & info->align)) {
        dolog ("Lock returned misaligned length %d, %d, alignment %d\n",
               *blen1, *blen2, info->align + 1);
        fmod_unlock_sample (sample, *p1, *p2, *blen1, *blen2);
        *p1 = NULL - 1;
        *p2 = NULL - 1;
        *blen1 = ~0U;
        *blen2 = ~0U;
        return -1;
    }
    if (!*p1 && *blen1) {
        dolog ("warning: !p1 && blen1=%d\n", *blen1);
        *blen1 = 0;
    }
    if (!p2 && *blen2) {
        dolog ("warning: !p2 && blen2=%d\n", *blen2);
        *blen2 = 0;
    }
    return 0;
 }
 static int fmod_run_out (HWVoiceOut *hw, int live)
 {
    FMODVoiceOut *fmd = (FMODVoiceOut *) hw;
    int decr;
    void *p1 = 0, *p2 = 0;
    unsigned int blen1 = 0, blen2 = 0;
    unsigned int len1 = 0, len2 = 0;
    if (!hw->pending_disable) {
        return 0;
    }
    decr = live;
    if (fmd->channel >= 0) {
        int len = decr;
        int old_pos = fmd->old_pos;
        int ppos = FSOUND_GetCurrentPosition (fmd->channel);
        if (ppos == old_pos || !ppos) {
            return 0;
        }
        if ((old_pos < ppos) && ((old_pos + len) > ppos)) {
            len = ppos - old_pos;
        }
        else {
            if ((old_pos > ppos) && ((old_pos + len) > (ppos + hw->samples))) {
                len = hw->samples - old_pos + ppos;
            }
        }
        decr = len;
        if (audio_bug (AUDIO_FUNC, decr < 0)) {
            dolog ("decr=%d live=%d ppos=%d old_pos=%d len=%d\n",
                   decr, live, ppos, old_pos, len);
            return 0;
        }
    }
    if (!decr) {
        return 0;
    }
    if (fmod_lock_sample (fmd->fmod_sample, &fmd->hw.info,
                          fmd->old_pos, decr,
                          &p1, &p2,
                          &blen1, &blen2)) {
        return 0;
    }
    len1 = blen1 >> hw->info.shift;
    len2 = blen2 >> hw->info.shift;
    ldebug ("%p %p %d %d %d %d\n", p1, p2, len1, len2, blen1, blen2);
    decr = len1 + len2;
    if (p1 && len1) {
        fmod_write_sample (hw, p1, len1);
    }
    if (p2 && len2) {
        fmod_write_sample (hw, p2, len2);
    }
    fmod_unlock_sample (fmd->fmod_sample, p1, p2, blen1, blen2);
    fmd->old_pos = (fmd->old_pos + decr) % hw->samples;
    return decr;
 }
 static int aud_to_fmodfmt (audfmt_e fmt, int stereo)
 {
    int mode = FSOUND_LOOP_NORMAL;
    switch (fmt) {
    case AUD_FMT_S8:
        mode |= FSOUND_SIGNED | FSOUND_8BITS;
        break;
    case AUD_FMT_U8:
        mode |= FSOUND_UNSIGNED | FSOUND_8BITS;
        break;
    case AUD_FMT_S16:
        mode |= FSOUND_SIGNED | FSOUND_16BITS;
        break;
    case AUD_FMT_U16:
        mode |= FSOUND_UNSIGNED | FSOUND_16BITS;
        break;
    default:
        dolog ("Internal logic error: Bad audio format %d\n", fmt);
 #ifdef DEBUG_FMOD
        abort ();
 #endif
        mode |= FSOUND_8BITS;
    }
    mode |= stereo ? FSOUND_STEREO : FSOUND_MONO;
    return mode;
 }
 static void fmod_fini_out (HWVoiceOut *hw)
 {
    FMODVoiceOut *fmd = (FMODVoiceOut *) hw;
    if (fmd->fmod_sample) {
        FSOUND_Sample_Free (fmd->fmod_sample);
        fmd->fmod_sample = 0;
        if (fmd->channel >= 0) {
            FSOUND_StopSound (fmd->channel);
        }
    }
 }
 static int fmod_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
    int bits16, mode, channel;
    FMODVoiceOut *fmd = (FMODVoiceOut *) hw;
    struct audsettings obt_as = *as;
    mode = aud_to_fmodfmt (as->fmt, as->nchannels == 2 ? 1 : 0);
    fmd->fmod_sample = FSOUND_Sample_Alloc (
        FSOUND_FREE,            /* index */
        conf.nb_samples,        /* length */
        mode,                   /* mode */
        as->freq,               /* freq */
        255,                    /* volume */
        128,                    /* pan */
        255                     /* priority */
        );
    if (!fmd->fmod_sample) {
        fmod_logerr2 ("DAC", "Failed to allocate FMOD sample\n");
        return -1;
    }
    channel = FSOUND_PlaySoundEx (FSOUND_FREE, fmd->fmod_sample, 0, 1);
    if (channel < 0) {
        fmod_logerr2 ("DAC", "Failed to start playing sound\n");
        FSOUND_Sample_Free (fmd->fmod_sample);
        return -1;
    }
    fmd->channel = channel;
    /* FMOD always operates on little endian frames? */
    obt_as.endianness = 0;
    audio_pcm_init_info (&hw->info, &obt_as);
    bits16 = (mode & FSOUND_16BITS) != 0;
    hw->samples = conf.nb_samples;
    return 0;
 }
 static int fmod_ctl_out (HWVoiceOut *hw, int cmd, ...)
 {
    int status;
    FMODVoiceOut *fmd = (FMODVoiceOut *) hw;
    switch (cmd) {
    case VOICE_ENABLE:
        fmod_clear_sample (fmd);
        status = FSOUND_SetPaused (fmd->channel, 0);
        if (!status) {
            fmod_logerr ("Failed to resume channel %d\n", fmd->channel);
        }
        break;
    case VOICE_DISABLE:
        status = FSOUND_SetPaused (fmd->channel, 1);
        if (!status) {
            fmod_logerr ("Failed to pause channel %d\n", fmd->channel);
        }
        break;
    }
    return 0;
 }
 static int fmod_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
    int bits16, mode;
    FMODVoiceIn *fmd = (FMODVoiceIn *) hw;
    struct audsettings obt_as = *as;
    if (conf.broken_adc) {
        return -1;
    }
    mode = aud_to_fmodfmt (as->fmt, as->nchannels == 2 ? 1 : 0);
    fmd->fmod_sample = FSOUND_Sample_Alloc (
        FSOUND_FREE,            /* index */
        conf.nb_samples,        /* length */
        mode,                   /* mode */
        as->freq,               /* freq */
        255,                    /* volume */
        128,                    /* pan */
        255                     /* priority */
        );
    if (!fmd->fmod_sample) {
        fmod_logerr2 ("ADC", "Failed to allocate FMOD sample\n");
        return -1;
    }
    /* FMOD always operates on little endian frames? */
    obt_as.endianness = 0;
    audio_pcm_init_info (&hw->info, &obt_as);
    bits16 = (mode & FSOUND_16BITS) != 0;
    hw->samples = conf.nb_samples;
    return 0;
 }
 static void fmod_fini_in (HWVoiceIn *hw)
 {
    FMODVoiceIn *fmd = (FMODVoiceIn *) hw;
    if (fmd->fmod_sample) {
        FSOUND_Record_Stop ();
        FSOUND_Sample_Free (fmd->fmod_sample);
        fmd->fmod_sample = 0;
    }
 }
 static int fmod_run_in (HWVoiceIn *hw)
 {
    FMODVoiceIn *fmd = (FMODVoiceIn *) hw;
    int hwshift = hw->info.shift;
    int live, dead, new_pos, len;
    unsigned int blen1 = 0, blen2 = 0;
    unsigned int len1, len2;
    unsigned int decr;
    void *p1, *p2;
    live = audio_pcm_hw_get_live_in (hw);
    dead = hw->samples - live;
    if (!dead) {
        return 0;
    }
    new_pos = FSOUND_Record_GetPosition ();
    if (new_pos < 0) {
        fmod_logerr ("Could not get recording position\n");
        return 0;
    }
    len = audio_ring_dist (new_pos,  hw->wpos, hw->samples);
    if (!len) {
        return 0;
    }
    len = audio_MIN (len, dead);
    if (fmod_lock_sample (fmd->fmod_sample, &fmd->hw.info,
                          hw->wpos, len,
                          &p1, &p2,
                          &blen1, &blen2)) {
        return 0;
    }
    len1 = blen1 >> hwshift;
    len2 = blen2 >> hwshift;
    decr = len1 + len2;
    if (p1 && blen1) {
        hw->conv (hw->conv_buf + hw->wpos, p1, len1, &nominal_volume);
    }
    if (p2 && len2) {
        hw->conv (hw->conv_buf, p2, len2, &nominal_volume);
    }
    fmod_unlock_sample (fmd->fmod_sample, p1, p2, blen1, blen2);
    hw->wpos = (hw->wpos + decr) % hw->samples;
    return decr;
 }
 static struct {
    const char *name;
    int type;
 } drvtab[] = {
    { .name = "none",   .type = FSOUND_OUTPUT_NOSOUND },
 #ifdef _WIN32
    { .name = "winmm",  .type = FSOUND_OUTPUT_WINMM   },
    { .name = "dsound", .type = FSOUND_OUTPUT_DSOUND  },
    { .name = "a3d",    .type = FSOUND_OUTPUT_A3D     },
    { .name = "asio",   .type = FSOUND_OUTPUT_ASIO    },
 #endif
 #ifdef __linux__
    { .name = "oss",    .type = FSOUND_OUTPUT_OSS     },
    { .name = "alsa",   .type = FSOUND_OUTPUT_ALSA    },
    { .name = "esd",    .type = FSOUND_OUTPUT_ESD     },
 #endif
 #ifdef __APPLE__
    { .name = "mac",    .type = FSOUND_OUTPUT_MAC     },
 #endif
 #if 0
    { .name = "xbox",   .type = FSOUND_OUTPUT_XBOX    },
    { .name = "ps2",    .type = FSOUND_OUTPUT_PS2     },
    { .name = "gcube",  .type = FSOUND_OUTPUT_GC      },
 #endif
    { .name = "none-realtime", .type = FSOUND_OUTPUT_NOSOUND_NONREALTIME }
 };
 static void *fmod_audio_init (void)
 {
    size_t i;
    double ver;
    int status;
    int output_type = -1;
    const char *drv = conf.drvname;
    ver = FSOUND_GetVersion ();
    if (ver < FMOD_VERSION) {
        dolog ("Wrong FMOD version %f, need at least %f\n", ver, FMOD_VERSION);
        return NULL;
    }
 #ifdef __linux__
    if (ver < 3.75) {
        dolog ("FMOD before 3.75 has bug preventing ADC from working\n"
               "ADC will be disabled.\n");
        conf.broken_adc = 1;
    }
 #endif
    if (drv) {
        int found = 0;
        for (i = 0; i < ARRAY_SIZE (drvtab); i++) {
            if (!strcmp (drv, drvtab[i].name)) {
                output_type = drvtab[i].type;
                found = 1;
                break;
            }
        }
        if (!found) {
            dolog ("Unknown FMOD driver `%s'\n", drv);
            dolog ("Valid drivers:\n");
            for (i = 0; i < ARRAY_SIZE (drvtab); i++) {
                dolog ("  %s\n", drvtab[i].name);
            }
        }
    }
    if (output_type != -1) {
        status = FSOUND_SetOutput (output_type);
        if (!status) {
            fmod_logerr ("FSOUND_SetOutput(%d) failed\n", output_type);
            return NULL;
        }
    }
    if (conf.bufsize) {
        status = FSOUND_SetBufferSize (conf.bufsize);
        if (!status) {
            fmod_logerr ("FSOUND_SetBufferSize (%d) failed\n", conf.bufsize);
        }
    }
    status = FSOUND_Init (conf.freq, conf.nb_channels, 0);
    if (!status) {
        fmod_logerr ("FSOUND_Init failed\n");
        return NULL;
    }
    return &conf;
 }
 static int fmod_read (SWVoiceIn *sw, void *buf, int size)
 {
    return audio_pcm_sw_read (sw, buf, size);
 }
 static int fmod_ctl_in (HWVoiceIn *hw, int cmd, ...)
 {
    int status;
    FMODVoiceIn *fmd = (FMODVoiceIn *) hw;
    switch (cmd) {
    case VOICE_ENABLE:
        status = FSOUND_Record_StartSample (fmd->fmod_sample, 1);
        if (!status) {
            fmod_logerr ("Failed to start recording\n");
        }
        break;
    case VOICE_DISABLE:
        status = FSOUND_Record_Stop ();
        if (!status) {
            fmod_logerr ("Failed to stop recording\n");
        }
        break;
    }
    return 0;
 }
 static void fmod_audio_fini (void *opaque)
 {
    (void) opaque;
    FSOUND_Close ();
 }
 static struct audio_option fmod_options[] = {
    {
        .name  = "DRV",
        .tag   = AUD_OPT_STR,
        .valp  = &conf.drvname,
        .descr = "FMOD driver"
    },
    {
        .name  = "FREQ",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.freq,
        .descr = "Default frequency"
    },
    {
        .name  = "SAMPLES",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.nb_samples,
        .descr = "Buffer size in samples"
    },
    {
        .name  = "CHANNELS",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.nb_channels,
        .descr = "Number of default channels (1 - mono, 2 - stereo)"
    },
    {
        .name  = "BUFSIZE",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.bufsize,
        .descr = "(undocumented)"
    },
    { /* End of list */ }
 };
 static struct audio_pcm_ops fmod_pcm_ops = {
    .init_out = fmod_init_out,
    .fini_out = fmod_fini_out,
    .run_out  = fmod_run_out,
    .write    = fmod_write,
    .ctl_out  = fmod_ctl_out,
    .init_in  = fmod_init_in,
    .fini_in  = fmod_fini_in,
    .run_in   = fmod_run_in,
    .read     = fmod_read,
    .ctl_in   = fmod_ctl_in
 };
 struct audio_driver fmod_audio_driver = {
    .name           = "fmod",
    .descr          = "FMOD 3.xx http://www.fmod.org",
    .options        = fmod_options,
    .init           = fmod_audio_init,
    .fini           = fmod_audio_fini,
    .pcm_ops        = &fmod_pcm_ops,
    .can_be_default = 1,
    .max_voices_out = INT_MAX,
    .max_voices_in  = INT_MAX,
    .voice_size_out = sizeof (FMODVoiceOut),
    .voice_size_in  = sizeof (FMODVoiceIn)
 };
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -22,9 +22,7 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/bswap.h"
 #include "audio.h"
 #define AUDIO_CAP "mixeng"
@@ -35,8 +33,7 @@
 #define ENDIAN_CONVERT(v) (v)
 /* Signed 8 bit */
-#define BSIZE 8
+#define IN_T int8_t
 #define ITYPE int
 #define IN_MIN SCHAR_MIN
 #define IN_MAX SCHAR_MAX
 #define SIGNED
@@ -45,29 +42,25 @@
 #undef SIGNED
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
+#undef IN_T
 #undef ITYPE
 #undef SHIFT
 /* Unsigned 8 bit */
-#define BSIZE 8
+#define IN_T uint8_t
 #define ITYPE uint
 #define IN_MIN 0
 #define IN_MAX UCHAR_MAX
 #define SHIFT 8
 #include "mixeng_template.h"
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
+#undef IN_T
 #undef ITYPE
 #undef SHIFT
 #undef ENDIAN_CONVERT
 #undef ENDIAN_CONVERSION
 /* Signed 16 bit */
-#define BSIZE 16
+#define IN_T int16_t
 #define ITYPE int
 #define IN_MIN SHRT_MIN
 #define IN_MAX SHRT_MAX
 #define SIGNED
@@ -85,13 +78,11 @@
 #undef SIGNED
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
+#undef IN_T
 #undef ITYPE
 #undef SHIFT
 /* Unsigned 16 bit */
-#define BSIZE 16
+#define IN_T uint16_t
 #define ITYPE uint
 #define IN_MIN 0
 #define IN_MAX USHRT_MAX
 #define SHIFT 16
@@ -107,13 +98,11 @@
 #undef ENDIAN_CONVERSION
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
+#undef IN_T
 #undef ITYPE
 #undef SHIFT
 /* Signed 32 bit */
-#define BSIZE 32
+#define IN_T int32_t
 #define ITYPE int
 #define IN_MIN INT32_MIN
 #define IN_MAX INT32_MAX
 #define SIGNED
@@ -131,13 +120,11 @@
 #undef SIGNED
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
+#undef IN_T
 #undef ITYPE
 #undef SHIFT
-/* Unsigned 32 bit */
+/* Unsigned 16 bit */
-#define BSIZE 32
+#define IN_T uint32_t
 #define ITYPE uint
 #define IN_MIN 0
 #define IN_MAX UINT32_MAX
 #define SHIFT 32
@@ -153,8 +140,7 @@
 #undef ENDIAN_CONVERSION
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
+#undef IN_T
 #undef ITYPE
 #undef SHIFT
 t_sample *mixeng_conv[2][2][2][3] = {
@@ -271,7 +257,7 @@ f_sample *mixeng_clip[2][2][2][3] = {
 * August 21, 1998
 * Copyright 1998 Fabrice Bellard.
 *
- * [Rewrote completely the code of Lance Norskog And Sundry
+ * [Rewrote completly the code of Lance Norskog And Sundry
 * Contributors with a more efficient algorithm.]
 *
 * This source code is freely redistributable and may be used for
@@ -340,29 +326,10 @@ void *st_rate_start (int inrate, int outrate)
 void st_rate_stop (void *opaque)
 {
-    g_free (opaque);
+    qemu_free (opaque);
 }
 void mixeng_clear (struct st_sample *buf, int len)
 {
    memset (buf, 0, len * sizeof (struct st_sample));
 }
 void mixeng_volume (struct st_sample *buf, int len, struct mixeng_volume *vol)
 {
    if (vol->mute) {
        mixeng_clear (buf, len);
        return;
    }
    while (len--) {
 #ifdef FLOAT_MIXENG
        buf->l = buf->l * vol->l;
        buf->r = buf->r * vol->r;
 #else
        buf->l = (buf->l * vol->l) >> 32;
        buf->r = (buf->r * vol->r) >> 32;
 #endif
        buf += 1;
    }
 }
--- a/audio/mixeng.h
+++ b/audio/mixeng.h
@@ -21,7 +21,6 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #ifndef QEMU_MIXENG_H
 #define QEMU_MIXENG_H
@@ -34,7 +33,8 @@ struct mixeng_volume { int mute; int64_t r; int64_t l; };
 struct st_sample { int64_t l; int64_t r; };
 #endif
-typedef void (t_sample) (struct st_sample *dst, const void *src, int samples);
+typedef void (t_sample) (struct st_sample *dst, const void *src,
                         int samples, struct mixeng_volume *vol);
 typedef void (f_sample) (void *dst, const struct st_sample *src, int samples);
 extern t_sample *mixeng_conv[2][2][2][3];
@@ -47,6 +47,5 @@ void st_rate_flow_mix (void *opaque, struct st_sample *ibuf, struct st_sample *o
                       int *isamp, int *osamp);
 void st_rate_stop (void *opaque);
 void mixeng_clear (struct st_sample *buf, int len);
 void mixeng_volume (struct st_sample *buf, int len, struct mixeng_volume *vol);
-#endif /* QEMU_MIXENG_H */
+#endif  /* mixeng.h */
--- a/audio/mixeng_template.h
+++ b/audio/mixeng_template.h
@@ -31,11 +31,20 @@
 #define HALF (IN_MAX >> 1)
 #endif
-#define ET glue (ENDIAN_CONVERSION, glue (glue (glue (_, ITYPE), BSIZE), _t))
+#ifdef CONFIG_MIXEMU
-#define IN_T glue (glue (ITYPE, BSIZE), _t)
+#ifdef FLOAT_MIXENG
 #define VOL(a, b) ((a) * (b))
 #else
 #define VOL(a, b) ((a) * (b)) >> 32
 #endif
 #else
 #define VOL(a, b) a
 #endif
 #define ET glue (ENDIAN_CONVERSION, glue (_, IN_T))
 #ifdef FLOAT_MIXENG
-static inline mixeng_real glue (conv_, ET) (IN_T v)
+static mixeng_real inline glue (conv_, ET) (IN_T v)
 {
    IN_T nv = ENDIAN_CONVERT (v);
@@ -47,14 +56,14 @@ static inline mixeng_real glue (conv_, ET) (IN_T v)
 #endif
 #else  /* !RECIPROCAL */
 #ifdef SIGNED
-    return nv / (mixeng_real) ((mixeng_real) IN_MAX - IN_MIN);
+    return nv / (mixeng_real) (IN_MAX - IN_MIN);
 #else
    return (nv - HALF) / (mixeng_real) IN_MAX;
 #endif
 #endif
 }
-static inline IN_T glue (clip_, ET) (mixeng_real v)
+static IN_T inline glue (clip_, ET) (mixeng_real v)
 {
    if (v >= 0.5) {
        return IN_MAX;
@@ -64,7 +73,7 @@ static inline IN_T glue (clip_, ET) (mixeng_real v)
    }
 #ifdef SIGNED
-    return ENDIAN_CONVERT ((IN_T) (v * ((mixeng_real) IN_MAX - IN_MIN)));
+    return ENDIAN_CONVERT ((IN_T) (v * (IN_MAX - IN_MIN)));
 #else
    return ENDIAN_CONVERT ((IN_T) ((v * IN_MAX) + HALF));
 #endif
@@ -100,26 +109,40 @@ static inline IN_T glue (clip_, ET) (int64_t v)
 #endif
 static void glue (glue (conv_, ET), _to_stereo)
-    (struct st_sample *dst, const void *src, int samples)
+    (struct st_sample *dst, const void *src, int samples, struct mixeng_volume *vol)
 {
    struct st_sample *out = dst;
    IN_T *in = (IN_T *) src;
-
+#ifdef CONFIG_MIXEMU
    if (vol->mute) {
        mixeng_clear (dst, samples);
        return;
    }
 #else
    (void) vol;
 #endif
    while (samples--) {
-        out->l = glue (conv_, ET) (*in++);
+        out->l = VOL (glue (conv_, ET) (*in++), vol->l);
-        out->r = glue (conv_, ET) (*in++);
+        out->r = VOL (glue (conv_, ET) (*in++), vol->r);
        out += 1;
    }
 }
 static void glue (glue (conv_, ET), _to_mono)
-    (struct st_sample *dst, const void *src, int samples)
+    (struct st_sample *dst, const void *src, int samples, struct mixeng_volume *vol)
 {
    struct st_sample *out = dst;
    IN_T *in = (IN_T *) src;
-
+#ifdef CONFIG_MIXEMU
    if (vol->mute) {
        mixeng_clear (dst, samples);
        return;
    }
 #else
    (void) vol;
 #endif
    while (samples--) {
-        out->l = glue (conv_, ET) (in[0]);
+        out->l = VOL (glue (conv_, ET) (in[0]), vol->l);
        out->r = out->l;
        out += 1;
        in += 1;
@@ -151,4 +174,4 @@ static void glue (glue (clip_, ET), _from_mono)
 #undef ET
 #undef HALF
-#undef IN_T
+#undef VOL
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -21,11 +21,9 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/host-utils.h"
 #include "audio.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
@@ -48,10 +46,10 @@ static int no_run_out (HWVoiceOut *hw, int live)
    int64_t ticks;
    int64_t bytes;
-    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    now = qemu_get_clock (vm_clock);
    ticks = now - no->old_ticks;
-    bytes = muldiv64(ticks, hw->info.bytes_per_second, NANOSECONDS_PER_SECOND);
+    bytes = muldiv64 (ticks, hw->info.bytes_per_second, get_ticks_per_sec ());
-    bytes = audio_MIN(bytes, INT_MAX);
+    bytes = audio_MIN (bytes, INT_MAX);
    samples = bytes >> hw->info.shift;
    no->old_ticks = now;
@@ -62,10 +60,10 @@ static int no_run_out (HWVoiceOut *hw, int live)
 static int no_write (SWVoiceOut *sw, void *buf, int len)
 {
-    return audio_pcm_sw_write(sw, buf, len);
+    return audio_pcm_sw_write (sw, buf, len);
 }
-static int no_init_out(HWVoiceOut *hw, struct audsettings *as, void *drv_opaque)
+static int no_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
    audio_pcm_init_info (&hw->info, as);
    hw->samples = 1024;
@@ -84,7 +82,7 @@ static int no_ctl_out (HWVoiceOut *hw, int cmd, ...)
    return 0;
 }
-static int no_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
+static int no_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
    audio_pcm_init_info (&hw->info, as);
    hw->samples = 1024;
@@ -104,10 +102,10 @@ static int no_run_in (HWVoiceIn *hw)
    int samples = 0;
    if (dead) {
-        int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        int64_t now = qemu_get_clock (vm_clock);
        int64_t ticks = now - no->old_ticks;
        int64_t bytes =
-            muldiv64(ticks, hw->info.bytes_per_second, NANOSECONDS_PER_SECOND);
+            muldiv64 (ticks, hw->info.bytes_per_second, get_ticks_per_sec ());
        no->old_ticks = now;
        bytes = audio_MIN (bytes, INT_MAX);
@@ -119,14 +117,11 @@ static int no_run_in (HWVoiceIn *hw)
 static int no_read (SWVoiceIn *sw, void *buf, int size)
 {
    /* use custom code here instead of audio_pcm_sw_read() to avoid
     * useless resampling/mixing */
    int samples = size >> sw->info.shift;
    int total = sw->hw->total_samples_captured - sw->total_hw_samples_acquired;
    int to_clear = audio_MIN (samples, total);
    sw->total_hw_samples_acquired += total;
    audio_pcm_info_clear_buf (&sw->info, buf, to_clear);
-    return to_clear << sw->info.shift;
+    return to_clear;
 }
 static int no_ctl_in (HWVoiceIn *hw, int cmd, ...)
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -21,14 +21,19 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
-#include "qemu/osdep.h"
+#include <stdlib.h>
 #include <sys/mman.h>
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #ifdef __OpenBSD__
 #include <soundcard.h>
 #else
 #include <sys/soundcard.h>
 #endif
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
+#include "host-utils.h"
-#include "qemu/host-utils.h"
+#include "qemu-char.h"
 #include "audio.h"
 #include "trace.h"
 #define AUDIO_CAP "oss"
 #include "audio_int.h"
@@ -37,16 +42,6 @@
 #define USE_DSP_POLICY
 #endif
 typedef struct OSSConf {
    int try_mmap;
    int nfrags;
    int fragsize;
    const char *devpath_out;
    const char *devpath_in;
    int exclusive;
    int policy;
 } OSSConf;
 typedef struct OSSVoiceOut {
    HWVoiceOut hw;
    void *pcm_buf;
@@ -56,7 +51,6 @@ typedef struct OSSVoiceOut {
    int fragsize;
    int mmapped;
    int pending;
    OSSConf *conf;
 } OSSVoiceOut;
 typedef struct OSSVoiceIn {
@@ -65,9 +59,28 @@ typedef struct OSSVoiceIn {
    int fd;
    int nfrags;
    int fragsize;
    OSSConf *conf;
 } OSSVoiceIn;
 static struct {
    int try_mmap;
    int nfrags;
    int fragsize;
    const char *devpath_out;
    const char *devpath_in;
    int debug;
    int exclusive;
    int policy;
 } conf = {
    .try_mmap = 0,
    .nfrags = 4,
    .fragsize = 4096,
    .devpath_out = "/dev/dsp",
    .devpath_in = "/dev/dsp",
    .debug = 0,
    .exclusive = 0,
    .policy = 5
 };
 struct oss_params {
    int freq;
    audfmt_e fmt;
@@ -129,18 +142,18 @@ static void oss_helper_poll_in (void *opaque)
    audio_run ("oss_poll_in");
 }
-static void oss_poll_out (HWVoiceOut *hw)
+static int oss_poll_out (HWVoiceOut *hw)
 {
    OSSVoiceOut *oss = (OSSVoiceOut *) hw;
-    qemu_set_fd_handler (oss->fd, NULL, oss_helper_poll_out, NULL);
+    return qemu_set_fd_handler (oss->fd, NULL, oss_helper_poll_out, NULL);
 }
-static void oss_poll_in (HWVoiceIn *hw)
+static int oss_poll_in (HWVoiceIn *hw)
 {
    OSSVoiceIn *oss = (OSSVoiceIn *) hw;
-    qemu_set_fd_handler (oss->fd, oss_helper_poll_in, NULL, NULL);
+    return qemu_set_fd_handler (oss->fd, oss_helper_poll_in, NULL, NULL);
 }
 static int oss_write (SWVoiceOut *sw, void *buf, int len)
@@ -148,7 +161,7 @@ static int oss_write (SWVoiceOut *sw, void *buf, int len)
    return audio_pcm_sw_write (sw, buf, len);
 }
-static int aud_to_ossfmt (audfmt_e fmt, int endianness)
+static int aud_to_ossfmt (audfmt_e fmt)
 {
    switch (fmt) {
    case AUD_FMT_S8:
@@ -158,20 +171,10 @@ static int aud_to_ossfmt (audfmt_e fmt, int endianness)
        return AFMT_U8;
    case AUD_FMT_S16:
-        if (endianness) {
+        return AFMT_S16_LE;
            return AFMT_S16_BE;
        }
        else {
            return AFMT_S16_LE;
        }
    case AUD_FMT_U16:
-        if (endianness) {
+        return AFMT_U16_LE;
            return AFMT_U16_BE;
        }
        else {
            return AFMT_U16_LE;
        }
    default:
        dolog ("Internal logic error: Bad audio format %d\n", fmt);
@@ -263,18 +266,18 @@ static int oss_get_version (int fd, int *version, const char *typ)
 #endif
 static int oss_open (int in, struct oss_params *req,
-                     struct oss_params *obt, int *pfd, OSSConf* conf)
+                     struct oss_params *obt, int *pfd)
 {
    int fd;
-    int oflags = conf->exclusive ? O_EXCL : 0;
+    int oflags = conf.exclusive ? O_EXCL : 0;
    audio_buf_info abinfo;
    int fmt, freq, nchannels;
    int setfragment = 1;
-    const char *dspname = in ? conf->devpath_in : conf->devpath_out;
+    const char *dspname = in ? conf.devpath_in : conf.devpath_out;
    const char *typ = in ? "ADC" : "DAC";
    /* Kludge needed to have working mmap on Linux */
-    oflags |= conf->try_mmap ? O_RDWR : (in ? O_RDONLY : O_WRONLY);
+    oflags |= conf.try_mmap ? O_RDWR : (in ? O_RDONLY : O_WRONLY);
    fd = open (dspname, oflags | O_NONBLOCK);
    if (-1 == fd) {
@@ -308,18 +311,20 @@ static int oss_open (int in, struct oss_params *req,
    }
 #ifdef USE_DSP_POLICY
-    if (conf->policy >= 0) {
+    if (conf.policy >= 0) {
        int version;
        if (!oss_get_version (fd, &version, typ)) {
-            trace_oss_version(version);
+            if (conf.debug) {
                dolog ("OSS version = %#x\n", version);
            }
            if (version >= 0x040000) {
-                int policy = conf->policy;
+                int policy = conf.policy;
                if (ioctl (fd, SNDCTL_DSP_POLICY, &policy)) {
                    oss_logerr2 (errno, typ,
                                 "Failed to set timing policy to %d\n",
-                                 conf->policy);
+                                 conf.policy);
                    goto err;
                }
                setfragment = 0;
@@ -447,12 +452,19 @@ static int oss_run_out (HWVoiceOut *hw, int live)
        }
        if (abinfo.bytes > bufsize) {
-            trace_oss_invalid_available_size(abinfo.bytes, bufsize);
+            if (conf.debug) {
                dolog ("warning: Invalid available size, size=%d bufsize=%d\n"
                       "please report your OS/audio hw to av1474@comtv.ru\n",
                       abinfo.bytes, bufsize);
            }
            abinfo.bytes = bufsize;
        }
        if (abinfo.bytes < 0) {
-            trace_oss_invalid_available_size(abinfo.bytes, bufsize);
+            if (conf.debug) {
                dolog ("warning: Invalid available size, size=%d bufsize=%d\n",
                       abinfo.bytes, bufsize);
            }
            return 0;
        }
@@ -486,14 +498,13 @@ static void oss_fini_out (HWVoiceOut *hw)
            }
        }
        else {
-            g_free (oss->pcm_buf);
+            qemu_free (oss->pcm_buf);
        }
        oss->pcm_buf = NULL;
    }
 }
-static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
+static int oss_init_out (HWVoiceOut *hw, struct audsettings *as)
                        void *drv_opaque)
 {
    OSSVoiceOut *oss = (OSSVoiceOut *) hw;
    struct oss_params req, obt;
@@ -502,17 +513,16 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
    int fd;
    audfmt_e effective_fmt;
    struct audsettings obt_as;
    OSSConf *conf = drv_opaque;
    oss->fd = -1;
-    req.fmt = aud_to_ossfmt (as->fmt, as->endianness);
+    req.fmt = aud_to_ossfmt (as->fmt);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
-    req.fragsize = conf->fragsize;
+    req.fragsize = conf.fragsize;
-    req.nfrags = conf->nfrags;
+    req.nfrags = conf.nfrags;
-    if (oss_open (0, &req, &obt, &fd, conf)) {
+    if (oss_open (0, &req, &obt, &fd)) {
        return -1;
    }
@@ -539,7 +549,7 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
    hw->samples = (obt.nfrags * obt.fragsize) >> hw->info.shift;
    oss->mmapped = 0;
-    if (conf->try_mmap) {
+    if (conf.try_mmap) {
        oss->pcm_buf = mmap (
            NULL,
            hw->samples << hw->info.shift,
@@ -599,7 +609,6 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
    }
    oss->fd = fd;
    oss->conf = conf;
    return 0;
 }
@@ -619,8 +628,7 @@ static int oss_ctl_out (HWVoiceOut *hw, int cmd, ...)
            va_end (ap);
            ldebug ("enabling voice\n");
-            if (poll_mode) {
+            if (poll_mode && oss_poll_out (hw)) {
                oss_poll_out (hw);
                poll_mode = 0;
            }
            hw->poll_mode = poll_mode;
@@ -662,7 +670,7 @@ static int oss_ctl_out (HWVoiceOut *hw, int cmd, ...)
    return 0;
 }
-static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
+static int oss_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
    OSSVoiceIn *oss = (OSSVoiceIn *) hw;
    struct oss_params req, obt;
@@ -671,16 +679,15 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    int fd;
    audfmt_e effective_fmt;
    struct audsettings obt_as;
    OSSConf *conf = drv_opaque;
    oss->fd = -1;
-    req.fmt = aud_to_ossfmt (as->fmt, as->endianness);
+    req.fmt = aud_to_ossfmt (as->fmt);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
-    req.fragsize = conf->fragsize;
+    req.fragsize = conf.fragsize;
-    req.nfrags = conf->nfrags;
+    req.nfrags = conf.nfrags;
-    if (oss_open (1, &req, &obt, &fd, conf)) {
+    if (oss_open (1, &req, &obt, &fd)) {
        return -1;
    }
@@ -714,7 +721,6 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    }
    oss->fd = fd;
    oss->conf = conf;
    return 0;
 }
@@ -724,8 +730,10 @@ static void oss_fini_in (HWVoiceIn *hw)
    oss_anal_close (&oss->fd);
-    g_free(oss->pcm_buf);
+    if (oss->pcm_buf) {
-    oss->pcm_buf = NULL;
+        qemu_free (oss->pcm_buf);
        oss->pcm_buf = NULL;
    }
 }
 static int oss_run_in (HWVoiceIn *hw)
@@ -770,7 +778,8 @@ static int oss_run_in (HWVoiceIn *hw)
                           hw->info.align + 1);
                }
                read_samples += nread >> hwshift;
-                hw->conv (hw->conv_buf + bufs[i].add, p, nread >> hwshift);
+                hw->conv (hw->conv_buf + bufs[i].add, p, nread >> hwshift,
                          &nominal_volume);
            }
            if (bufs[i].len - nread) {
@@ -816,8 +825,7 @@ static int oss_ctl_in (HWVoiceIn *hw, int cmd, ...)
            poll_mode = va_arg (ap, int);
            va_end (ap);
-            if (poll_mode) {
+            if (poll_mode && oss_poll_in (hw)) {
                oss_poll_in (hw);
                poll_mode = 0;
            }
            hw->poll_mode = poll_mode;
@@ -834,79 +842,67 @@ static int oss_ctl_in (HWVoiceIn *hw, int cmd, ...)
    return 0;
 }
 static OSSConf glob_conf = {
    .try_mmap = 0,
    .nfrags = 4,
    .fragsize = 4096,
    .devpath_out = "/dev/dsp",
    .devpath_in = "/dev/dsp",
    .exclusive = 0,
    .policy = 5
 };
 static void *oss_audio_init (void)
 {
-    OSSConf *conf = g_malloc(sizeof(OSSConf));
+    return &conf;
    *conf = glob_conf;
    if (access(conf->devpath_in, R_OK | W_OK) < 0 ||
        access(conf->devpath_out, R_OK | W_OK) < 0) {
        g_free(conf);
        return NULL;
    }
    return conf;
 }
 static void oss_audio_fini (void *opaque)
 {
-    g_free(opaque);
+    (void) opaque;
 }
 static struct audio_option oss_options[] = {
    {
        .name  = "FRAGSIZE",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.fragsize,
+        .valp  = &conf.fragsize,
        .descr = "Fragment size in bytes"
    },
    {
        .name  = "NFRAGS",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.nfrags,
+        .valp  = &conf.nfrags,
        .descr = "Number of fragments"
    },
    {
        .name  = "MMAP",
        .tag   = AUD_OPT_BOOL,
-        .valp  = &glob_conf.try_mmap,
+        .valp  = &conf.try_mmap,
        .descr = "Try using memory mapped access"
    },
    {
        .name  = "DAC_DEV",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_conf.devpath_out,
+        .valp  = &conf.devpath_out,
        .descr = "Path to DAC device"
    },
    {
        .name  = "ADC_DEV",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_conf.devpath_in,
+        .valp  = &conf.devpath_in,
        .descr = "Path to ADC device"
    },
    {
        .name  = "EXCLUSIVE",
        .tag   = AUD_OPT_BOOL,
-        .valp  = &glob_conf.exclusive,
+        .valp  = &conf.exclusive,
-        .descr = "Open device in exclusive mode (vmix won't work)"
+        .descr = "Open device in exclusive mode (vmix wont work)"
    },
 #ifdef USE_DSP_POLICY
    {
        .name  = "POLICY",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.policy,
+        .valp  = &conf.policy,
        .descr = "Set the timing policy of the device, -1 to use fragment mode",
    },
 #endif
    {
        .name  = "DEBUG",
        .tag   = AUD_OPT_BOOL,
        .valp  = &conf.debug,
        .descr = "Turn on some debugging messages"
    },
    { /* End of list */ }
 };
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -1,37 +1,23 @@
 /* public domain */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "audio.h"
-#include <pulse/pulseaudio.h>
+#include <pulse/simple.h>
 #include <pulse/error.h>
 #define AUDIO_CAP "pulseaudio"
 #include "audio_int.h"
 #include "audio_pt_int.h"
 typedef struct {
    int samples;
    char *server;
    char *sink;
    char *source;
 } PAConf;
 typedef struct {
    PAConf conf;
    pa_threaded_mainloop *mainloop;
    pa_context *context;
 } paaudio;
 typedef struct {
    HWVoiceOut hw;
    int done;
    int live;
    int decr;
    int rpos;
-    pa_stream *stream;
+    pa_simple *s;
    void *pcm_buf;
    struct audio_pt pt;
    paaudio *g;
 } PAVoiceOut;
 typedef struct {
@@ -40,15 +26,21 @@ typedef struct {
    int dead;
    int incr;
    int wpos;
-    pa_stream *stream;
+    pa_simple *s;
    void *pcm_buf;
    struct audio_pt pt;
    const void *read_data;
    size_t read_index, read_length;
    paaudio *g;
 } PAVoiceIn;
-static void qpa_audio_fini(void *opaque);
+static struct {
    int samples;
    int divisor;
    char *server;
    char *sink;
    char *source;
 } conf = {
    .samples = 1024,
    .divisor = 2,
 };
 static void GCC_FMT_ATTR (2, 3) qpa_logerr (int err, const char *fmt, ...)
 {
@@ -61,150 +53,13 @@ static void GCC_FMT_ATTR (2, 3) qpa_logerr (int err, const char *fmt, ...)
    AUD_log (AUDIO_CAP, "Reason: %s\n", pa_strerror (err));
 }
 #ifndef PA_CONTEXT_IS_GOOD
 static inline int PA_CONTEXT_IS_GOOD(pa_context_state_t x)
 {
    return
        x == PA_CONTEXT_CONNECTING ||
        x == PA_CONTEXT_AUTHORIZING ||
        x == PA_CONTEXT_SETTING_NAME ||
        x == PA_CONTEXT_READY;
 }
 #endif
 #ifndef PA_STREAM_IS_GOOD
 static inline int PA_STREAM_IS_GOOD(pa_stream_state_t x)
 {
    return
        x == PA_STREAM_CREATING ||
        x == PA_STREAM_READY;
 }
 #endif
 #define CHECK_SUCCESS_GOTO(c, rerror, expression, label)        \
    do {                                                        \
        if (!(expression)) {                                    \
            if (rerror) {                                       \
                *(rerror) = pa_context_errno ((c)->context);    \
            }                                                   \
            goto label;                                         \
        }                                                       \
    } while (0);
 #define CHECK_DEAD_GOTO(c, stream, rerror, label)                       \
    do {                                                                \
        if (!(c)->context || !PA_CONTEXT_IS_GOOD (pa_context_get_state((c)->context)) || \
            !(stream) || !PA_STREAM_IS_GOOD (pa_stream_get_state ((stream)))) { \
            if (((c)->context && pa_context_get_state ((c)->context) == PA_CONTEXT_FAILED) || \
                ((stream) && pa_stream_get_state ((stream)) == PA_STREAM_FAILED)) { \
                if (rerror) {                                           \
                    *(rerror) = pa_context_errno ((c)->context);        \
                }                                                       \
            } else {                                                    \
                if (rerror) {                                           \
                    *(rerror) = PA_ERR_BADSTATE;                        \
                }                                                       \
            }                                                           \
            goto label;                                                 \
        }                                                               \
    } while (0);
 static int qpa_simple_read (PAVoiceIn *p, void *data, size_t length, int *rerror)
 {
    paaudio *g = p->g;
    pa_threaded_mainloop_lock (g->mainloop);
    CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
    while (length > 0) {
        size_t l;
        while (!p->read_data) {
            int r;
            r = pa_stream_peek (p->stream, &p->read_data, &p->read_length);
            CHECK_SUCCESS_GOTO (g, rerror, r == 0, unlock_and_fail);
            if (!p->read_data) {
                pa_threaded_mainloop_wait (g->mainloop);
                CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
            } else {
                p->read_index = 0;
            }
        }
        l = p->read_length < length ? p->read_length : length;
        memcpy (data, (const uint8_t *) p->read_data+p->read_index, l);
        data = (uint8_t *) data + l;
        length -= l;
        p->read_index += l;
        p->read_length -= l;
        if (!p->read_length) {
            int r;
            r = pa_stream_drop (p->stream);
            p->read_data = NULL;
            p->read_length = 0;
            p->read_index = 0;
            CHECK_SUCCESS_GOTO (g, rerror, r == 0, unlock_and_fail);
        }
    }
    pa_threaded_mainloop_unlock (g->mainloop);
    return 0;
 unlock_and_fail:
    pa_threaded_mainloop_unlock (g->mainloop);
    return -1;
 }
 static int qpa_simple_write (PAVoiceOut *p, const void *data, size_t length, int *rerror)
 {
    paaudio *g = p->g;
    pa_threaded_mainloop_lock (g->mainloop);
    CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
    while (length > 0) {
        size_t l;
        int r;
        while (!(l = pa_stream_writable_size (p->stream))) {
            pa_threaded_mainloop_wait (g->mainloop);
            CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
        }
        CHECK_SUCCESS_GOTO (g, rerror, l != (size_t) -1, unlock_and_fail);
        if (l > length) {
            l = length;
        }
        r = pa_stream_write (p->stream, data, l, NULL, 0LL, PA_SEEK_RELATIVE);
        CHECK_SUCCESS_GOTO (g, rerror, r >= 0, unlock_and_fail);
        data = (const uint8_t *) data + l;
        length -= l;
    }
    pa_threaded_mainloop_unlock (g->mainloop);
    return 0;
 unlock_and_fail:
    pa_threaded_mainloop_unlock (g->mainloop);
    return -1;
 }
 static void *qpa_thread_out (void *arg)
 {
    PAVoiceOut *pa = arg;
    HWVoiceOut *hw = &pa->hw;
    int threshold;
    threshold = conf.divisor ? hw->samples / conf.divisor : 0;
    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
        return NULL;
@@ -218,7 +73,7 @@ static void *qpa_thread_out (void *arg)
                goto exit;
            }
-            if (pa->live > 0) {
+            if (pa->live > threshold) {
                break;
            }
@@ -227,8 +82,8 @@ static void *qpa_thread_out (void *arg)
            }
        }
-        decr = to_mix = audio_MIN (pa->live, pa->g->conf.samples >> 2);
+        decr = to_mix = pa->live;
-        rpos = pa->rpos;
+        rpos = hw->rpos;
        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
            return NULL;
@@ -241,8 +96,8 @@ static void *qpa_thread_out (void *arg)
            hw->clip (pa->pcm_buf, src, chunk);
-            if (qpa_simple_write (pa, pa->pcm_buf,
+            if (pa_simple_write (pa->s, pa->pcm_buf,
-                                  chunk << hw->info.shift, &error) < 0) {
+                                 chunk << hw->info.shift, &error) < 0) {
                qpa_logerr (error, "pa_simple_write failed\n");
                return NULL;
            }
@@ -297,6 +152,9 @@ static void *qpa_thread_in (void *arg)
 {
    PAVoiceIn *pa = arg;
    HWVoiceIn *hw = &pa->hw;
    int threshold;
    threshold = conf.divisor ? hw->samples / conf.divisor : 0;
    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
        return NULL;
@@ -310,7 +168,7 @@ static void *qpa_thread_in (void *arg)
                goto exit;
            }
-            if (pa->dead > 0) {
+            if (pa->dead > threshold) {
                break;
            }
@@ -319,8 +177,8 @@ static void *qpa_thread_in (void *arg)
            }
        }
-        incr = to_grab = audio_MIN (pa->dead, pa->g->conf.samples >> 2);
+        incr = to_grab = pa->dead;
-        wpos = pa->wpos;
+        wpos = hw->wpos;
        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
            return NULL;
@@ -331,13 +189,13 @@ static void *qpa_thread_in (void *arg)
            int chunk = audio_MIN (to_grab, hw->samples - wpos);
            void *buf = advance (pa->pcm_buf, wpos);
-            if (qpa_simple_read (pa, buf,
+            if (pa_simple_read (pa->s, buf,
-                                 chunk << hw->info.shift, &error) < 0) {
+                                chunk << hw->info.shift, &error) < 0) {
                qpa_logerr (error, "pa_simple_read failed\n");
                return NULL;
            }
-            hw->conv (hw->conv_buf + wpos, buf, chunk);
+            hw->conv (hw->conv_buf + wpos, buf, chunk, &nominal_volume);
            wpos = (wpos + chunk) % hw->samples;
            to_grab -= chunk;
        }
@@ -433,154 +291,38 @@ static audfmt_e pa_to_audfmt (pa_sample_format_t fmt, int *endianness)
    }
 }
-static void context_state_cb (pa_context *c, void *userdata)
+static int qpa_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
    paaudio *g = userdata;
    switch (pa_context_get_state(c)) {
    case PA_CONTEXT_READY:
    case PA_CONTEXT_TERMINATED:
    case PA_CONTEXT_FAILED:
        pa_threaded_mainloop_signal (g->mainloop, 0);
        break;
    case PA_CONTEXT_UNCONNECTED:
    case PA_CONTEXT_CONNECTING:
    case PA_CONTEXT_AUTHORIZING:
    case PA_CONTEXT_SETTING_NAME:
        break;
    }
 }
 static void stream_state_cb (pa_stream *s, void * userdata)
 {
    paaudio *g = userdata;
    switch (pa_stream_get_state (s)) {
    case PA_STREAM_READY:
    case PA_STREAM_FAILED:
    case PA_STREAM_TERMINATED:
        pa_threaded_mainloop_signal (g->mainloop, 0);
        break;
    case PA_STREAM_UNCONNECTED:
    case PA_STREAM_CREATING:
        break;
    }
 }
 static void stream_request_cb (pa_stream *s, size_t length, void *userdata)
 {
    paaudio *g = userdata;
    pa_threaded_mainloop_signal (g->mainloop, 0);
 }
 static pa_stream *qpa_simple_new (
        paaudio *g,
        const char *name,
        pa_stream_direction_t dir,
        const char *dev,
        const pa_sample_spec *ss,
        const pa_channel_map *map,
        const pa_buffer_attr *attr,
        int *rerror)
 {
    int r;
    pa_stream *stream;
    pa_threaded_mainloop_lock (g->mainloop);
    stream = pa_stream_new (g->context, name, ss, map);
    if (!stream) {
        goto fail;
    }
    pa_stream_set_state_callback (stream, stream_state_cb, g);
    pa_stream_set_read_callback (stream, stream_request_cb, g);
    pa_stream_set_write_callback (stream, stream_request_cb, g);
    if (dir == PA_STREAM_PLAYBACK) {
        r = pa_stream_connect_playback (stream, dev, attr,
                                        PA_STREAM_INTERPOLATE_TIMING
 #ifdef PA_STREAM_ADJUST_LATENCY
                                        |PA_STREAM_ADJUST_LATENCY
 #endif
                                        |PA_STREAM_AUTO_TIMING_UPDATE, NULL, NULL);
    } else {
        r = pa_stream_connect_record (stream, dev, attr,
                                      PA_STREAM_INTERPOLATE_TIMING
 #ifdef PA_STREAM_ADJUST_LATENCY
                                      |PA_STREAM_ADJUST_LATENCY
 #endif
                                      |PA_STREAM_AUTO_TIMING_UPDATE);
    }
    if (r < 0) {
      goto fail;
    }
    pa_threaded_mainloop_unlock (g->mainloop);
    return stream;
 fail:
    pa_threaded_mainloop_unlock (g->mainloop);
    if (stream) {
        pa_stream_unref (stream);
    }
    *rerror = pa_context_errno (g->context);
    return NULL;
 }
 static int qpa_init_out(HWVoiceOut *hw, struct audsettings *as,
                        void *drv_opaque)
 {
    int error;
-    pa_sample_spec ss;
+    static pa_sample_spec ss;
    pa_buffer_attr ba;
    struct audsettings obt_as = *as;
    PAVoiceOut *pa = (PAVoiceOut *) hw;
    paaudio *g = pa->g = drv_opaque;
    ss.format = audfmt_to_pa (as->fmt, as->endianness);
    ss.channels = as->nchannels;
    ss.rate = as->freq;
    /*
     * qemu audio tick runs at 100 Hz (by default), so processing
     * data chunks worth 10 ms of sound should be a good fit.
     */
    ba.tlength = pa_usec_to_bytes (10 * 1000, &ss);
    ba.minreq = pa_usec_to_bytes (5 * 1000, &ss);
    ba.maxlength = -1;
    ba.prebuf = -1;
    obt_as.fmt = pa_to_audfmt (ss.format, &obt_as.endianness);
-    pa->stream = qpa_simple_new (
+    pa->s = pa_simple_new (
-        g,
+        conf.server,
        "qemu",
        PA_STREAM_PLAYBACK,
-        g->conf.sink,
+        conf.sink,
        "pcm.playback",
        &ss,
        NULL,                   /* channel map */
-        &ba,                    /* buffering attributes */
+        NULL,                   /* buffering attributes */
        &error
        );
-    if (!pa->stream) {
+    if (!pa->s) {
        qpa_logerr (error, "pa_simple_new for playback failed\n");
        goto fail1;
    }
    audio_pcm_init_info (&hw->info, &obt_as);
-    hw->samples = g->conf.samples;
+    hw->samples = conf.samples;
    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    pa->rpos = hw->rpos;
    if (!pa->pcm_buf) {
        dolog ("Could not allocate buffer (%d bytes)\n",
               hw->samples << hw->info.shift);
@@ -594,24 +336,21 @@ static int qpa_init_out(HWVoiceOut *hw, struct audsettings *as,
    return 0;
 fail3:
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
-    if (pa->stream) {
+    pa_simple_free (pa->s);
-        pa_stream_unref (pa->stream);
+    pa->s = NULL;
        pa->stream = NULL;
    }
 fail1:
    return -1;
 }
-static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
+static int qpa_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
    int error;
-    pa_sample_spec ss;
+    static pa_sample_spec ss;
    struct audsettings obt_as = *as;
    PAVoiceIn *pa = (PAVoiceIn *) hw;
    paaudio *g = pa->g = drv_opaque;
    ss.format = audfmt_to_pa (as->fmt, as->endianness);
    ss.channels = as->nchannels;
@@ -619,25 +358,25 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    obt_as.fmt = pa_to_audfmt (ss.format, &obt_as.endianness);
-    pa->stream = qpa_simple_new (
+    pa->s = pa_simple_new (
-        g,
+        conf.server,
        "qemu",
        PA_STREAM_RECORD,
-        g->conf.source,
+        conf.source,
        "pcm.capture",
        &ss,
        NULL,                   /* channel map */
        NULL,                   /* buffering attributes */
        &error
        );
-    if (!pa->stream) {
+    if (!pa->s) {
        qpa_logerr (error, "pa_simple_new for capture failed\n");
        goto fail1;
    }
    audio_pcm_init_info (&hw->info, &obt_as);
-    hw->samples = g->conf.samples;
+    hw->samples = conf.samples;
    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    pa->wpos = hw->wpos;
    if (!pa->pcm_buf) {
        dolog ("Could not allocate buffer (%d bytes)\n",
               hw->samples << hw->info.shift);
@@ -651,13 +390,11 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    return 0;
 fail3:
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
-    if (pa->stream) {
+    pa_simple_free (pa->s);
-        pa_stream_unref (pa->stream);
+    pa->s = NULL;
        pa->stream = NULL;
    }
 fail1:
    return -1;
 }
@@ -672,13 +409,13 @@ static void qpa_fini_out (HWVoiceOut *hw)
    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);
-    if (pa->stream) {
+    if (pa->s) {
-        pa_stream_unref (pa->stream);
+        pa_simple_free (pa->s);
-        pa->stream = NULL;
+        pa->s = NULL;
    }
    audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }
@@ -692,232 +429,70 @@ static void qpa_fini_in (HWVoiceIn *hw)
    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);
-    if (pa->stream) {
+    if (pa->s) {
-        pa_stream_unref (pa->stream);
+        pa_simple_free (pa->s);
-        pa->stream = NULL;
+        pa->s = NULL;
    }
    audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }
 static int qpa_ctl_out (HWVoiceOut *hw, int cmd, ...)
 {
-    PAVoiceOut *pa = (PAVoiceOut *) hw;
+    (void) hw;
-    pa_operation *op;
+    (void) cmd;
    pa_cvolume v;
    paaudio *g = pa->g;
 #ifdef PA_CHECK_VERSION    /* macro is present in 0.9.16+ */
    pa_cvolume_init (&v);  /* function is present in 0.9.13+ */
 #endif
    switch (cmd) {
    case VOICE_VOLUME:
        {
            SWVoiceOut *sw;
            va_list ap;
            va_start (ap, cmd);
            sw = va_arg (ap, SWVoiceOut *);
            va_end (ap);
            v.channels = 2;
            v.values[0] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.l) / UINT32_MAX;
            v.values[1] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.r) / UINT32_MAX;
            pa_threaded_mainloop_lock (g->mainloop);
            op = pa_context_set_sink_input_volume (g->context,
                pa_stream_get_index (pa->stream),
                &v, NULL, NULL);
            if (!op)
                qpa_logerr (pa_context_errno (g->context),
                            "set_sink_input_volume() failed\n");
            else
                pa_operation_unref (op);
            op = pa_context_set_sink_input_mute (g->context,
                pa_stream_get_index (pa->stream),
               sw->vol.mute, NULL, NULL);
            if (!op) {
                qpa_logerr (pa_context_errno (g->context),
                            "set_sink_input_mute() failed\n");
            } else {
                pa_operation_unref (op);
            }
            pa_threaded_mainloop_unlock (g->mainloop);
        }
    }
    return 0;
 }
 static int qpa_ctl_in (HWVoiceIn *hw, int cmd, ...)
 {
-    PAVoiceIn *pa = (PAVoiceIn *) hw;
+    (void) hw;
-    pa_operation *op;
+    (void) cmd;
    pa_cvolume v;
    paaudio *g = pa->g;
 #ifdef PA_CHECK_VERSION
    pa_cvolume_init (&v);
 #endif
    switch (cmd) {
    case VOICE_VOLUME:
        {
            SWVoiceIn *sw;
            va_list ap;
            va_start (ap, cmd);
            sw = va_arg (ap, SWVoiceIn *);
            va_end (ap);
            v.channels = 2;
            v.values[0] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.l) / UINT32_MAX;
            v.values[1] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.r) / UINT32_MAX;
            pa_threaded_mainloop_lock (g->mainloop);
            op = pa_context_set_source_output_volume (g->context,
                pa_stream_get_index (pa->stream),
                &v, NULL, NULL);
            if (!op) {
                qpa_logerr (pa_context_errno (g->context),
                            "set_source_output_volume() failed\n");
            } else {
                pa_operation_unref(op);
            }
            op = pa_context_set_source_output_mute (g->context,
                pa_stream_get_index (pa->stream),
                sw->vol.mute, NULL, NULL);
            if (!op) {
                qpa_logerr (pa_context_errno (g->context),
                            "set_source_output_mute() failed\n");
            } else {
                pa_operation_unref (op);
            }
            pa_threaded_mainloop_unlock (g->mainloop);
        }
    }
    return 0;
 }
 /* common */
 static PAConf glob_conf = {
    .samples = 4096,
 };
 static void *qpa_audio_init (void)
 {
-    paaudio *g = g_malloc(sizeof(paaudio));
+    return &conf;
    g->conf = glob_conf;
    g->mainloop = NULL;
    g->context = NULL;
    g->mainloop = pa_threaded_mainloop_new ();
    if (!g->mainloop) {
        goto fail;
    }
    g->context = pa_context_new (pa_threaded_mainloop_get_api (g->mainloop),
                                 g->conf.server);
    if (!g->context) {
        goto fail;
    }
    pa_context_set_state_callback (g->context, context_state_cb, g);
    if (pa_context_connect (g->context, g->conf.server, 0, NULL) < 0) {
        qpa_logerr (pa_context_errno (g->context),
                    "pa_context_connect() failed\n");
        goto fail;
    }
    pa_threaded_mainloop_lock (g->mainloop);
    if (pa_threaded_mainloop_start (g->mainloop) < 0) {
        goto unlock_and_fail;
    }
    for (;;) {
        pa_context_state_t state;
        state = pa_context_get_state (g->context);
        if (state == PA_CONTEXT_READY) {
            break;
        }
        if (!PA_CONTEXT_IS_GOOD (state)) {
            qpa_logerr (pa_context_errno (g->context),
                        "Wrong context state\n");
            goto unlock_and_fail;
        }
        /* Wait until the context is ready */
        pa_threaded_mainloop_wait (g->mainloop);
    }
    pa_threaded_mainloop_unlock (g->mainloop);
    return g;
 unlock_and_fail:
    pa_threaded_mainloop_unlock (g->mainloop);
 fail:
    AUD_log (AUDIO_CAP, "Failed to initialize PA context");
    qpa_audio_fini(g);
    return NULL;
 }
 static void qpa_audio_fini (void *opaque)
 {
-    paaudio *g = opaque;
+    (void) opaque;
    if (g->mainloop) {
        pa_threaded_mainloop_stop (g->mainloop);
    }
    if (g->context) {
        pa_context_disconnect (g->context);
        pa_context_unref (g->context);
    }
    if (g->mainloop) {
        pa_threaded_mainloop_free (g->mainloop);
    }
    g_free(g);
 }
 struct audio_option qpa_options[] = {
    {
        .name  = "SAMPLES",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.samples,
+        .valp  = &conf.samples,
        .descr = "buffer size in samples"
    },
    {
        .name  = "DIVISOR",
        .tag   = AUD_OPT_INT,
        .valp  = &conf.divisor,
        .descr = "threshold divisor"
    },
    {
        .name  = "SERVER",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_conf.server,
+        .valp  = &conf.server,
        .descr = "server address"
    },
    {
        .name  = "SINK",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_conf.sink,
+        .valp  = &conf.sink,
        .descr = "sink device name"
    },
    {
        .name  = "SOURCE",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_conf.source,
+        .valp  = &conf.source,
        .descr = "source device name"
    },
    { /* End of list */ }
@@ -948,6 +523,5 @@ struct audio_driver pa_audio_driver = {
    .max_voices_out = INT_MAX,
    .max_voices_in  = INT_MAX,
    .voice_size_out = sizeof (PAVoiceOut),
-    .voice_size_in  = sizeof (PAVoiceIn),
+    .voice_size_in  = sizeof (PAVoiceIn)
    .ctl_caps       = VOICE_VOLUME_CAP
 };
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -21,7 +21,6 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include <SDL.h>
 #include <SDL_thread.h>
 #include "qemu-common.h"
@@ -33,6 +32,7 @@
 #elif defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)
 #include <pthread.h>
 #endif
 #include <signal.h>
 #endif
 #define AUDIO_CAP "sdl"
@@ -41,8 +41,8 @@
 typedef struct SDLVoiceOut {
    HWVoiceOut hw;
    int live;
    int rpos;
    int decr;
    int pending;
 } SDLVoiceOut;
 static struct {
@@ -56,7 +56,6 @@ static struct SDLAudioState {
    SDL_mutex *mutex;
    SDL_sem *sem;
    int initialized;
    bool driver_created;
 } glob_sdl;
 typedef struct SDLAudioState SDLAudioState;
@@ -116,19 +115,23 @@ static int sdl_unlock_and_post (SDLAudioState *s, const char *forfn)
    return sdl_post (s, forfn);
 }
-static int aud_to_sdlfmt (audfmt_e fmt)
+static int aud_to_sdlfmt (audfmt_e fmt, int *shift)
 {
    switch (fmt) {
    case AUD_FMT_S8:
        *shift = 0;
        return AUDIO_S8;
    case AUD_FMT_U8:
        *shift = 0;
        return AUDIO_U8;
    case AUD_FMT_S16:
        *shift = 1;
        return AUDIO_S16LSB;
    case AUD_FMT_U16:
        *shift = 1;
        return AUDIO_U16LSB;
    default:
@@ -140,36 +143,36 @@ static int aud_to_sdlfmt (audfmt_e fmt)
    }
 }
-static int sdl_to_audfmt(int sdlfmt, audfmt_e *fmt, int *endianness)
+static int sdl_to_audfmt (int sdlfmt, audfmt_e *fmt, int *endianess)
 {
    switch (sdlfmt) {
    case AUDIO_S8:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_S8;
        break;
    case AUDIO_U8:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_U8;
        break;
    case AUDIO_S16LSB:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_S16;
        break;
    case AUDIO_U16LSB:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_U16;
        break;
    case AUDIO_S16MSB:
-        *endianness = 1;
+        *endianess = 1;
        *fmt = AUD_FMT_S16;
        break;
    case AUDIO_U16MSB:
-        *endianness = 1;
+        *endianess = 1;
        *fmt = AUD_FMT_U16;
        break;
@@ -185,20 +188,11 @@ static int sdl_open (SDL_AudioSpec *req, SDL_AudioSpec *obt)
 {
    int status;
 #ifndef _WIN32
    int err;
    sigset_t new, old;
    /* Make sure potential threads created by SDL don't hog signals.  */
-    err = sigfillset (&new);
+    sigfillset (&new);
-    if (err) {
+    pthread_sigmask (SIG_BLOCK, &new, &old);
        dolog ("sdl_open: sigfillset failed: %s\n", strerror (errno));
        return -1;
    }
    err = pthread_sigmask (SIG_BLOCK, &new, &old);
    if (err) {
        dolog ("sdl_open: pthread_sigmask failed: %s\n", strerror (err));
        return -1;
    }
 #endif
    status = SDL_OpenAudio (req, obt);
@@ -207,14 +201,7 @@ static int sdl_open (SDL_AudioSpec *req, SDL_AudioSpec *obt)
    }
 #ifndef _WIN32
-    err = pthread_sigmask (SIG_SETMASK, &old, NULL);
+    pthread_sigmask (SIG_SETMASK, &old, NULL);
    if (err) {
        dolog ("sdl_open: pthread_sigmask (restore) failed: %s\n",
               strerror (errno));
        /* We have failed to restore original signal mask, all bets are off,
           so exit the process */
        exit (EXIT_FAILURE);
    }
 #endif
    return status;
 }
@@ -238,6 +225,10 @@ static void sdl_callback (void *opaque, Uint8 *buf, int len)
    HWVoiceOut *hw = &sdl->hw;
    int samples = len >> hw->info.shift;
    if (sdl_lock (s, "sdl_callback")) {
        return;
    }
    if (s->exit) {
        return;
    }
@@ -245,49 +236,34 @@ static void sdl_callback (void *opaque, Uint8 *buf, int len)
    while (samples) {
        int to_mix, decr;
-        /* dolog ("in callback samples=%d\n", samples); */
+        while (!sdl->pending) {
-        sdl_wait (s, "sdl_callback");
+            if (sdl_unlock (s, "sdl_callback")) {
-        if (s->exit) {
+                return;
-            return;
+            }
            sdl_wait (s, "sdl_callback");
            if (s->exit) {
                return;
            }
            if (sdl_lock (s, "sdl_callback")) {
                return;
            }
            sdl->pending += sdl->live;
            sdl->live = 0;
        }
-        if (sdl_lock (s, "sdl_callback")) {
+        to_mix = audio_MIN (samples, sdl->pending);
-            return;
+        decr = audio_pcm_hw_clip_out (hw, buf, to_mix, 0);
-        }
+        buf += decr << hw->info.shift;
        if (audio_bug (AUDIO_FUNC, sdl->live < 0 || sdl->live > hw->samples)) {
            dolog ("sdl->live=%d hw->samples=%d\n",
                   sdl->live, hw->samples);
            return;
        }
        if (!sdl->live) {
            goto again;
        }
        /* dolog ("in callback live=%d\n", live); */
        to_mix = audio_MIN (samples, sdl->live);
        decr = to_mix;
        while (to_mix) {
            int chunk = audio_MIN (to_mix, hw->samples - hw->rpos);
            struct st_sample *src = hw->mix_buf + hw->rpos;
            /* dolog ("in callback to_mix %d, chunk %d\n", to_mix, chunk); */
            hw->clip (buf, src, chunk);
            sdl->rpos = (sdl->rpos + chunk) % hw->samples;
            to_mix -= chunk;
            buf += chunk << hw->info.shift;
        }
        samples -= decr;
        sdl->live -= decr;
        sdl->decr += decr;
-
+        sdl->pending -= decr;
-    again:
+    }
-        if (sdl_unlock (s, "sdl_callback")) {
+
-            return;
+    if (sdl_unlock (s, "sdl_callback")) {
-        }
+        return;
    }
    /* dolog ("done len=%d\n", len); */
 }
 static int sdl_write_out (SWVoiceOut *sw, void *buf, int len)
@@ -305,18 +281,9 @@ static int sdl_run_out (HWVoiceOut *hw, int live)
        return 0;
    }
-    if (sdl->decr > live) {
+    sdl->live = live;
-        ldebug ("sdl->decr %d live %d sdl->live %d\n",
+    decr = sdl->decr;
-                sdl->decr,
+    sdl->decr = 0;
                live,
                sdl->live);
    }
    decr = audio_MIN (sdl->decr, live);
    sdl->decr -= decr;
    sdl->live = live - decr;
    hw->rpos = sdl->rpos;
    if (sdl->live > 0) {
        sdl_unlock_and_post (s, "sdl_run_out");
@@ -334,19 +301,21 @@ static void sdl_fini_out (HWVoiceOut *hw)
    sdl_close (&glob_sdl);
 }
-static int sdl_init_out(HWVoiceOut *hw, struct audsettings *as,
+static int sdl_init_out (HWVoiceOut *hw, struct audsettings *as)
                        void *drv_opaque)
 {
    SDLVoiceOut *sdl = (SDLVoiceOut *) hw;
    SDLAudioState *s = &glob_sdl;
    SDL_AudioSpec req, obt;
-    int endianness;
+    int shift;
    int endianess;
    int err;
    audfmt_e effective_fmt;
    struct audsettings obt_as;
    shift <<= as->nchannels == 2;
    req.freq = as->freq;
-    req.format = aud_to_sdlfmt (as->fmt);
+    req.format = aud_to_sdlfmt (as->fmt, &shift);
    req.channels = as->nchannels;
    req.samples = conf.nb_samples;
    req.callback = sdl_callback;
@@ -356,7 +325,7 @@ static int sdl_init_out(HWVoiceOut *hw, struct audsettings *as,
        return -1;
    }
-    err = sdl_to_audfmt(obt.format, &effective_fmt, &endianness);
+    err = sdl_to_audfmt (obt.format, &effective_fmt, &endianess);
    if (err) {
        sdl_close (s);
        return -1;
@@ -365,7 +334,7 @@ static int sdl_init_out(HWVoiceOut *hw, struct audsettings *as,
    obt_as.freq = obt.freq;
    obt_as.nchannels = obt.channels;
    obt_as.fmt = effective_fmt;
-    obt_as.endianness = endianness;
+    obt_as.endianness = endianess;
    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = obt.samples;
@@ -395,10 +364,6 @@ static int sdl_ctl_out (HWVoiceOut *hw, int cmd, ...)
 static void *sdl_audio_init (void)
 {
    SDLAudioState *s = &glob_sdl;
    if (s->driver_created) {
        sdl_logerr("Can't create multiple sdl backends\n");
        return NULL;
    }
    if (SDL_InitSubSystem (SDL_INIT_AUDIO)) {
        sdl_logerr ("SDL failed to initialize audio subsystem\n");
@@ -420,7 +385,6 @@ static void *sdl_audio_init (void)
        return NULL;
    }
    s->driver_created = true;
    return s;
 }
@@ -431,7 +395,6 @@ static void sdl_audio_fini (void *opaque)
    SDL_DestroySemaphore (s->sem);
    SDL_DestroyMutex (s->mutex);
    SDL_QuitSubSystem (SDL_INIT_AUDIO);
    s->driver_created = false;
 }
 static struct audio_option sdl_options[] = {
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -1,413 +0,0 @@
 /*
 * Copyright (C) 2010 Red Hat, Inc.
 *
 * maintained by Gerd Hoffmann <kraxel@redhat.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 or
 * (at your option) version 3 of the License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 */
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "qemu/host-utils.h"
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
 #include "ui/qemu-spice.h"
 #define AUDIO_CAP "spice"
 #include "audio.h"
 #include "audio_int.h"
 #if SPICE_INTERFACE_PLAYBACK_MAJOR > 1 || SPICE_INTERFACE_PLAYBACK_MINOR >= 3
 #define LINE_OUT_SAMPLES (480 * 4)
 #else
 #define LINE_OUT_SAMPLES (256 * 4)
 #endif
 #if SPICE_INTERFACE_RECORD_MAJOR > 2 || SPICE_INTERFACE_RECORD_MINOR >= 3
 #define LINE_IN_SAMPLES (480 * 4)
 #else
 #define LINE_IN_SAMPLES (256 * 4)
 #endif
 typedef struct SpiceRateCtl {
    int64_t               start_ticks;
    int64_t               bytes_sent;
 } SpiceRateCtl;
 typedef struct SpiceVoiceOut {
    HWVoiceOut            hw;
    SpicePlaybackInstance sin;
    SpiceRateCtl          rate;
    int                   active;
    uint32_t              *frame;
    uint32_t              *fpos;
    uint32_t              fsize;
 } SpiceVoiceOut;
 typedef struct SpiceVoiceIn {
    HWVoiceIn             hw;
    SpiceRecordInstance   sin;
    SpiceRateCtl          rate;
    int                   active;
    uint32_t              samples[LINE_IN_SAMPLES];
 } SpiceVoiceIn;
 static const SpicePlaybackInterface playback_sif = {
    .base.type          = SPICE_INTERFACE_PLAYBACK,
    .base.description   = "playback",
    .base.major_version = SPICE_INTERFACE_PLAYBACK_MAJOR,
    .base.minor_version = SPICE_INTERFACE_PLAYBACK_MINOR,
 };
 static const SpiceRecordInterface record_sif = {
    .base.type          = SPICE_INTERFACE_RECORD,
    .base.description   = "record",
    .base.major_version = SPICE_INTERFACE_RECORD_MAJOR,
    .base.minor_version = SPICE_INTERFACE_RECORD_MINOR,
 };
 static void *spice_audio_init (void)
 {
    if (!using_spice) {
        return NULL;
    }
    return &spice_audio_init;
 }
 static void spice_audio_fini (void *opaque)
 {
    /* nothing */
 }
 static void rate_start (SpiceRateCtl *rate)
 {
    memset (rate, 0, sizeof (*rate));
    rate->start_ticks = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 }
 static int rate_get_samples (struct audio_pcm_info *info, SpiceRateCtl *rate)
 {
    int64_t now;
    int64_t ticks;
    int64_t bytes;
    int64_t samples;
    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    ticks = now - rate->start_ticks;
    bytes = muldiv64(ticks, info->bytes_per_second, NANOSECONDS_PER_SECOND);
    samples = (bytes - rate->bytes_sent) >> info->shift;
    if (samples < 0 || samples > 65536) {
        error_report("Resetting rate control (%" PRId64 " samples)", samples);
        rate_start(rate);
        samples = 0;
    }
    rate->bytes_sent += samples << info->shift;
    return samples;
 }
 /* playback */
 static int line_out_init(HWVoiceOut *hw, struct audsettings *as,
                         void *drv_opaque)
 {
    SpiceVoiceOut *out = container_of (hw, SpiceVoiceOut, hw);
    struct audsettings settings;
 #if SPICE_INTERFACE_PLAYBACK_MAJOR > 1 || SPICE_INTERFACE_PLAYBACK_MINOR >= 3
    settings.freq       = spice_server_get_best_playback_rate(NULL);
 #else
    settings.freq       = SPICE_INTERFACE_PLAYBACK_FREQ;
 #endif
    settings.nchannels  = SPICE_INTERFACE_PLAYBACK_CHAN;
    settings.fmt        = AUD_FMT_S16;
    settings.endianness = AUDIO_HOST_ENDIANNESS;
    audio_pcm_init_info (&hw->info, &settings);
    hw->samples = LINE_OUT_SAMPLES;
    out->active = 0;
    out->sin.base.sif = &playback_sif.base;
    qemu_spice_add_interface (&out->sin.base);
 #if SPICE_INTERFACE_PLAYBACK_MAJOR > 1 || SPICE_INTERFACE_PLAYBACK_MINOR >= 3
    spice_server_set_playback_rate(&out->sin, settings.freq);
 #endif
    return 0;
 }
 static void line_out_fini (HWVoiceOut *hw)
 {
    SpiceVoiceOut *out = container_of (hw, SpiceVoiceOut, hw);
    spice_server_remove_interface (&out->sin.base);
 }
 static int line_out_run (HWVoiceOut *hw, int live)
 {
    SpiceVoiceOut *out = container_of (hw, SpiceVoiceOut, hw);
    int rpos, decr;
    int samples;
    if (!live) {
        return 0;
    }
    decr = rate_get_samples (&hw->info, &out->rate);
    decr = audio_MIN (live, decr);
    samples = decr;
    rpos = hw->rpos;
    while (samples) {
        int left_till_end_samples = hw->samples - rpos;
        int len = audio_MIN (samples, left_till_end_samples);
        if (!out->frame) {
            spice_server_playback_get_buffer (&out->sin, &out->frame, &out->fsize);
            out->fpos = out->frame;
        }
        if (out->frame) {
            len = audio_MIN (len, out->fsize);
            hw->clip (out->fpos, hw->mix_buf + rpos, len);
            out->fsize -= len;
            out->fpos  += len;
            if (out->fsize == 0) {
                spice_server_playback_put_samples (&out->sin, out->frame);
                out->frame = out->fpos = NULL;
            }
        }
        rpos = (rpos + len) % hw->samples;
        samples -= len;
    }
    hw->rpos = rpos;
    return decr;
 }
 static int line_out_write (SWVoiceOut *sw, void *buf, int len)
 {
    return audio_pcm_sw_write (sw, buf, len);
 }
 static int line_out_ctl (HWVoiceOut *hw, int cmd, ...)
 {
    SpiceVoiceOut *out = container_of (hw, SpiceVoiceOut, hw);
    switch (cmd) {
    case VOICE_ENABLE:
        if (out->active) {
            break;
        }
        out->active = 1;
        rate_start (&out->rate);
        spice_server_playback_start (&out->sin);
        break;
    case VOICE_DISABLE:
        if (!out->active) {
            break;
        }
        out->active = 0;
        if (out->frame) {
            memset (out->fpos, 0, out->fsize << 2);
            spice_server_playback_put_samples (&out->sin, out->frame);
            out->frame = out->fpos = NULL;
        }
        spice_server_playback_stop (&out->sin);
        break;
    case VOICE_VOLUME:
        {
 #if ((SPICE_INTERFACE_PLAYBACK_MAJOR >= 1) && (SPICE_INTERFACE_PLAYBACK_MINOR >= 2))
            SWVoiceOut *sw;
            va_list ap;
            uint16_t vol[2];
            va_start (ap, cmd);
            sw = va_arg (ap, SWVoiceOut *);
            va_end (ap);
            vol[0] = sw->vol.l / ((1ULL << 16) + 1);
            vol[1] = sw->vol.r / ((1ULL << 16) + 1);
            spice_server_playback_set_volume (&out->sin, 2, vol);
            spice_server_playback_set_mute (&out->sin, sw->vol.mute);
 #endif
            break;
        }
    }
    return 0;
 }
 /* record */
 static int line_in_init(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
 {
    SpiceVoiceIn *in = container_of (hw, SpiceVoiceIn, hw);
    struct audsettings settings;
 #if SPICE_INTERFACE_RECORD_MAJOR > 2 || SPICE_INTERFACE_RECORD_MINOR >= 3
    settings.freq       = spice_server_get_best_record_rate(NULL);
 #else
    settings.freq       = SPICE_INTERFACE_RECORD_FREQ;
 #endif
    settings.nchannels  = SPICE_INTERFACE_RECORD_CHAN;
    settings.fmt        = AUD_FMT_S16;
    settings.endianness = AUDIO_HOST_ENDIANNESS;
    audio_pcm_init_info (&hw->info, &settings);
    hw->samples = LINE_IN_SAMPLES;
    in->active = 0;
    in->sin.base.sif = &record_sif.base;
    qemu_spice_add_interface (&in->sin.base);
 #if SPICE_INTERFACE_RECORD_MAJOR > 2 || SPICE_INTERFACE_RECORD_MINOR >= 3
    spice_server_set_record_rate(&in->sin, settings.freq);
 #endif
    return 0;
 }
 static void line_in_fini (HWVoiceIn *hw)
 {
    SpiceVoiceIn *in = container_of (hw, SpiceVoiceIn, hw);
    spice_server_remove_interface (&in->sin.base);
 }
 static int line_in_run (HWVoiceIn *hw)
 {
    SpiceVoiceIn *in = container_of (hw, SpiceVoiceIn, hw);
    int num_samples;
    int ready;
    int len[2];
    uint64_t delta_samp;
    const uint32_t *samples;
    if (!(num_samples = hw->samples - audio_pcm_hw_get_live_in (hw))) {
        return 0;
    }
    delta_samp = rate_get_samples (&hw->info, &in->rate);
    num_samples = audio_MIN (num_samples, delta_samp);
    ready = spice_server_record_get_samples (&in->sin, in->samples, num_samples);
    samples = in->samples;
    if (ready == 0) {
        static const uint32_t silence[LINE_IN_SAMPLES];
        samples = silence;
        ready = LINE_IN_SAMPLES;
    }
    num_samples = audio_MIN (ready, num_samples);
    if (hw->wpos + num_samples > hw->samples) {
        len[0] = hw->samples - hw->wpos;
        len[1] = num_samples - len[0];
    } else {
        len[0] = num_samples;
        len[1] = 0;
    }
    hw->conv (hw->conv_buf + hw->wpos, samples, len[0]);
    if (len[1]) {
        hw->conv (hw->conv_buf, samples + len[0], len[1]);
    }
    hw->wpos = (hw->wpos + num_samples) % hw->samples;
    return num_samples;
 }
 static int line_in_read (SWVoiceIn *sw, void *buf, int size)
 {
    return audio_pcm_sw_read (sw, buf, size);
 }
 static int line_in_ctl (HWVoiceIn *hw, int cmd, ...)
 {
    SpiceVoiceIn *in = container_of (hw, SpiceVoiceIn, hw);
    switch (cmd) {
    case VOICE_ENABLE:
        if (in->active) {
            break;
        }
        in->active = 1;
        rate_start (&in->rate);
        spice_server_record_start (&in->sin);
        break;
    case VOICE_DISABLE:
        if (!in->active) {
            break;
        }
        in->active = 0;
        spice_server_record_stop (&in->sin);
        break;
    case VOICE_VOLUME:
        {
 #if ((SPICE_INTERFACE_RECORD_MAJOR >= 2) && (SPICE_INTERFACE_RECORD_MINOR >= 2))
            SWVoiceIn *sw;
            va_list ap;
            uint16_t vol[2];
            va_start (ap, cmd);
            sw = va_arg (ap, SWVoiceIn *);
            va_end (ap);
            vol[0] = sw->vol.l / ((1ULL << 16) + 1);
            vol[1] = sw->vol.r / ((1ULL << 16) + 1);
            spice_server_record_set_volume (&in->sin, 2, vol);
            spice_server_record_set_mute (&in->sin, sw->vol.mute);
 #endif
            break;
        }
    }
    return 0;
 }
 static struct audio_option audio_options[] = {
    { /* end of list */ },
 };
 static struct audio_pcm_ops audio_callbacks = {
    .init_out = line_out_init,
    .fini_out = line_out_fini,
    .run_out  = line_out_run,
    .write    = line_out_write,
    .ctl_out  = line_out_ctl,
    .init_in  = line_in_init,
    .fini_in  = line_in_fini,
    .run_in   = line_in_run,
    .read     = line_in_read,
    .ctl_in   = line_in_ctl,
 };
 struct audio_driver spice_audio_driver = {
    .name           = "spice",
    .descr          = "spice audio driver",
    .options        = audio_options,
    .init           = spice_audio_init,
    .fini           = spice_audio_fini,
    .pcm_ops        = &audio_callbacks,
    .max_voices_out = 1,
    .max_voices_in  = 1,
    .voice_size_out = sizeof (SpiceVoiceOut),
    .voice_size_in  = sizeof (SpiceVoiceIn),
 #if ((SPICE_INTERFACE_PLAYBACK_MAJOR >= 1) && (SPICE_INTERFACE_PLAYBACK_MINOR >= 2))
    .ctl_caps       = VOICE_VOLUME_CAP
 #endif
 };
 void qemu_spice_audio_init (void)
 {
    spice_audio_driver.can_be_default = 1;
 }
--- a/audio/trace-events
+++ b/audio/trace-events
@@ -1,17 +0,0 @@
 # See docs/tracing.txt for syntax documentation.
 # audio/alsaaudio.c
 alsa_revents(int revents) "revents = %d"
 alsa_pollout(int i, int fd) "i = %d fd = %d"
 alsa_set_handler(int events, int index, int fd, int err) "events=%#x index=%d fd=%d err=%d"
 alsa_wrote_zero(int len) "Failed to write %d frames (wrote zero)"
 alsa_read_zero(long len) "Failed to read %ld frames (read zero)"
 alsa_xrun_out(void) "Recovering from playback xrun"
 alsa_xrun_in(void) "Recovering from capture xrun"
 alsa_resume_out(void) "Resuming suspended output stream"
 alsa_resume_in(void) "Resuming suspended input stream"
 alsa_no_frames(int state) "No frames available and ALSA state is %d"
 # audio/ossaudio.c
 oss_version(int version) "OSS version = %#x"
 oss_invalid_available_size(int size, int bufsize) "Invalid available size, size=%d bufsize=%d"
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -21,9 +21,8 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
-#include "qemu/osdep.h"
+#include "hw/hw.h"
-#include "qemu/host-utils.h"
+#include "qemu-timer.h"
 #include "qemu/timer.h"
 #include "audio.h"
 #define AUDIO_CAP "wav"
@@ -31,16 +30,21 @@
 typedef struct WAVVoiceOut {
    HWVoiceOut hw;
-    FILE *f;
+    QEMUFile *f;
    int64_t old_ticks;
    void *pcm_buf;
    int total_samples;
 } WAVVoiceOut;
-typedef struct {
+static struct {
    struct audsettings settings;
    const char *wav_path;
-} WAVConf;
+} conf = {
    .settings.freq      = 44100,
    .settings.nchannels = 2,
    .settings.fmt       = AUD_FMT_S16,
    .wav_path           = "qemu.wav"
 };
 static int wav_run_out (HWVoiceOut *hw, int live)
 {
@@ -48,10 +52,10 @@ static int wav_run_out (HWVoiceOut *hw, int live)
    int rpos, decr, samples;
    uint8_t *dst;
    struct st_sample *src;
-    int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    int64_t now = qemu_get_clock (vm_clock);
    int64_t ticks = now - wav->old_ticks;
    int64_t bytes =
-        muldiv64(ticks, hw->info.bytes_per_second, NANOSECONDS_PER_SECOND);
+        muldiv64 (ticks, hw->info.bytes_per_second, get_ticks_per_sec ());
    if (bytes > INT_MAX) {
        samples = INT_MAX >> hw->info.shift;
@@ -72,10 +76,7 @@ static int wav_run_out (HWVoiceOut *hw, int live)
        dst = advance (wav->pcm_buf, rpos << hw->info.shift);
        hw->clip (dst, src, convert_samples);
-        if (fwrite (dst, convert_samples << hw->info.shift, 1, wav->f) != 1) {
+        qemu_put_buffer (wav->f, dst, convert_samples << hw->info.shift);
            dolog ("wav_run_out: fwrite of %d bytes failed\nReaons: %s\n",
                   convert_samples << hw->info.shift, strerror (errno));
        }
        rpos = (rpos + convert_samples) % hw->samples;
        samples -= convert_samples;
@@ -101,8 +102,7 @@ static void le_store (uint8_t *buf, uint32_t val, int len)
    }
 }
-static int wav_init_out(HWVoiceOut *hw, struct audsettings *as,
+static int wav_init_out (HWVoiceOut *hw, struct audsettings *as)
                        void *drv_opaque)
 {
    WAVVoiceOut *wav = (WAVVoiceOut *) hw;
    int bits16 = 0, stereo = 0;
@@ -112,8 +112,9 @@ static int wav_init_out(HWVoiceOut *hw, struct audsettings *as,
        0x02, 0x00, 0x44, 0xac, 0x00, 0x00, 0x10, 0xb1, 0x02, 0x00, 0x04,
        0x00, 0x10, 0x00, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0x00, 0x00
    };
-    WAVConf *conf = drv_opaque;
+    struct audsettings wav_as = conf.settings;
-    struct audsettings wav_as = conf->settings;
+
    (void) as;
    stereo = wav_as.nchannels == 2;
    switch (wav_as.fmt) {
@@ -151,20 +152,16 @@ static int wav_init_out(HWVoiceOut *hw, struct audsettings *as,
    le_store (hdr + 28, hw->info.freq << (bits16 + stereo), 4);
    le_store (hdr + 32, 1 << (bits16 + stereo), 2);
-    wav->f = fopen (conf->wav_path, "wb");
+    wav->f = qemu_fopen (conf.wav_path, "wb");
    if (!wav->f) {
        dolog ("Failed to open wave file `%s'\nReason: %s\n",
-               conf->wav_path, strerror (errno));
+               conf.wav_path, strerror (errno));
-        g_free (wav->pcm_buf);
+        qemu_free (wav->pcm_buf);
        wav->pcm_buf = NULL;
        return -1;
    }
-    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
+    qemu_put_buffer (wav->f, hdr, sizeof (hdr));
        dolog ("wav_init_out: failed to write header\nReason: %s\n",
               strerror(errno));
        return -1;
    }
    return 0;
 }
@@ -183,35 +180,16 @@ static void wav_fini_out (HWVoiceOut *hw)
    le_store (rlen, rifflen, 4);
    le_store (dlen, datalen, 4);
-    if (fseek (wav->f, 4, SEEK_SET)) {
+    qemu_fseek (wav->f, 4, SEEK_SET);
-        dolog ("wav_fini_out: fseek to rlen failed\nReason: %s\n",
+    qemu_put_buffer (wav->f, rlen, 4);
               strerror(errno));
        goto doclose;
    }
    if (fwrite (rlen, 4, 1, wav->f) != 1) {
        dolog ("wav_fini_out: failed to write rlen\nReason: %s\n",
               strerror (errno));
        goto doclose;
    }
    if (fseek (wav->f, 32, SEEK_CUR)) {
        dolog ("wav_fini_out: fseek to dlen failed\nReason: %s\n",
               strerror (errno));
        goto doclose;
    }
    if (fwrite (dlen, 4, 1, wav->f) != 1) {
        dolog ("wav_fini_out: failed to write dlen\nReaons: %s\n",
               strerror (errno));
        goto doclose;
    }
- doclose:
+    qemu_fseek (wav->f, 32, SEEK_CUR);
-    if (fclose (wav->f))  {
+    qemu_put_buffer (wav->f, dlen, 4);
-        dolog ("wav_fini_out: fclose %p failed\nReason: %s\n",
+
-               wav->f, strerror (errno));
+    qemu_fclose (wav->f);
    }
    wav->f = NULL;
-    g_free (wav->pcm_buf);
+    qemu_free (wav->pcm_buf);
    wav->pcm_buf = NULL;
 }
@@ -222,49 +200,40 @@ static int wav_ctl_out (HWVoiceOut *hw, int cmd, ...)
    return 0;
 }
 static WAVConf glob_conf = {
    .settings.freq      = 44100,
    .settings.nchannels = 2,
    .settings.fmt       = AUD_FMT_S16,
    .wav_path           = "qemu.wav"
 };
 static void *wav_audio_init (void)
 {
-    WAVConf *conf = g_malloc(sizeof(WAVConf));
+    return &conf;
    *conf = glob_conf;
    return conf;
 }
 static void wav_audio_fini (void *opaque)
 {
    (void) opaque;
    ldebug ("wav_fini");
    g_free(opaque);
 }
 static struct audio_option wav_options[] = {
    {
        .name  = "FREQUENCY",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.settings.freq,
+        .valp  = &conf.settings.freq,
        .descr = "Frequency"
    },
    {
        .name  = "FORMAT",
        .tag   = AUD_OPT_FMT,
-        .valp  = &glob_conf.settings.fmt,
+        .valp  = &conf.settings.fmt,
        .descr = "Format"
    },
    {
        .name  = "DAC_FIXED_CHANNELS",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_conf.settings.nchannels,
+        .valp  = &conf.settings.nchannels,
        .descr = "Number of channels (1 - mono, 2 - stereo)"
    },
    {
        .name  = "PATH",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_conf.wav_path,
+        .valp  = &conf.wav_path,
        .descr = "Path to wave file"
    },
    { /* End of list */ }
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,11 +1,9 @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
-#include "monitor/monitor.h"
+#include "monitor.h"
 #include "qemu/error-report.h"
 #include "audio.h"
 typedef struct {
-    FILE *f;
+    QEMUFile *f;
    int bytes;
    char *path;
    int freq;
@@ -37,49 +35,27 @@ static void wav_destroy (void *opaque)
    uint8_t dlen[4];
    uint32_t datalen = wav->bytes;
    uint32_t rifflen = datalen + 36;
    Monitor *mon = cur_mon;
    if (wav->f) {
        le_store (rlen, rifflen, 4);
        le_store (dlen, datalen, 4);
-        if (fseek (wav->f, 4, SEEK_SET)) {
+        qemu_fseek (wav->f, 4, SEEK_SET);
-            monitor_printf (mon, "wav_destroy: rlen fseek failed\nReason: %s\n",
+        qemu_put_buffer (wav->f, rlen, 4);
-                            strerror (errno));
+
-            goto doclose;
+        qemu_fseek (wav->f, 32, SEEK_CUR);
-        }
+        qemu_put_buffer (wav->f, dlen, 4);
-        if (fwrite (rlen, 4, 1, wav->f) != 1) {
+        qemu_fclose (wav->f);
            monitor_printf (mon, "wav_destroy: rlen fwrite failed\nReason %s\n",
                            strerror (errno));
            goto doclose;
        }
        if (fseek (wav->f, 32, SEEK_CUR)) {
            monitor_printf (mon, "wav_destroy: dlen fseek failed\nReason %s\n",
                            strerror (errno));
            goto doclose;
        }
        if (fwrite (dlen, 1, 4, wav->f) != 4) {
            monitor_printf (mon, "wav_destroy: dlen fwrite failed\nReason %s\n",
                            strerror (errno));
            goto doclose;
        }
    doclose:
        if (fclose (wav->f)) {
            error_report("wav_destroy: fclose failed: %s", strerror(errno));
        }
    }
-    g_free (wav->path);
+    qemu_free (wav->path);
 }
 static void wav_capture (void *opaque, void *buf, int size)
 {
    WAVState *wav = opaque;
-    if (fwrite (buf, size, 1, wav->f) != 1) {
+    qemu_put_buffer (wav->f, buf, size);
        monitor_printf (cur_mon, "wav_capture: fwrite error\nReason: %s",
                        strerror (errno));
    }
    wav->bytes += size;
 }
@@ -95,9 +71,9 @@ static void wav_capture_info (void *opaque)
    WAVState *wav = opaque;
    char *path = wav->path;
-    monitor_printf (cur_mon, "Capturing audio(%d,%d,%d) to %s: %d bytes\n",
+    monitor_printf(cur_mon, "Capturing audio(%d,%d,%d) to %s: %d bytes\n",
-                    wav->freq, wav->bits, wav->nchannels,
+                   wav->freq, wav->bits, wav->nchannels,
-                    path ? path : "<not available>", wav->bytes);
+                   path ? path : "<not available>", wav->bytes);
 }
 static struct capture_ops wav_capture_ops = {
@@ -122,13 +98,13 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    CaptureVoiceOut *cap;
    if (bits != 8 && bits != 16) {
-        monitor_printf (mon, "incorrect bit count %d, must be 8 or 16\n", bits);
+        monitor_printf(mon, "incorrect bit count %d, must be 8 or 16\n", bits);
        return -1;
    }
    if (nchannels != 1 && nchannels != 2) {
-        monitor_printf (mon, "incorrect channel count %d, must be 1 or 2\n",
+        monitor_printf(mon, "incorrect channel count %d, must be 1 or 2\n",
-                        nchannels);
+                       nchannels);
        return -1;
    }
@@ -144,7 +120,7 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    ops.capture = wav_capture;
    ops.destroy = wav_destroy;
-    wav = g_malloc0 (sizeof (*wav));
+    wav = qemu_mallocz (sizeof (*wav));
    shift = bits16 + stereo;
    hdr[34] = bits16 ? 0x10 : 0x08;
@@ -154,42 +130,32 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    le_store (hdr + 28, freq << shift, 4);
    le_store (hdr + 32, 1 << shift, 2);
-    wav->f = fopen (path, "wb");
+    wav->f = qemu_fopen (path, "wb");
    if (!wav->f) {
-        monitor_printf (mon, "Failed to open wave file `%s'\nReason: %s\n",
+        monitor_printf(mon, "Failed to open wave file `%s'\nReason: %s\n",
-                        path, strerror (errno));
+                       path, strerror (errno));
-        g_free (wav);
+        qemu_free (wav);
        return -1;
    }
-    wav->path = g_strdup (path);
+    wav->path = qemu_strdup (path);
    wav->bits = bits;
    wav->nchannels = nchannels;
    wav->freq = freq;
-    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
+    qemu_put_buffer (wav->f, hdr, sizeof (hdr));
        monitor_printf (mon, "Failed to write header\nReason: %s\n",
                        strerror (errno));
        goto error_free;
    }
    cap = AUD_add_capture (&as, &ops, wav);
    if (!cap) {
-        monitor_printf (mon, "Failed to add audio capture\n");
+        monitor_printf(mon, "Failed to add audio capture\n");
-        goto error_free;
+        qemu_free (wav->path);
        qemu_fclose (wav->f);
        qemu_free (wav);
        return -1;
    }
    wav->cap = cap;
    s->opaque = wav;
    s->ops = wav_capture_ops;
    return 0;
 error_free:
    g_free (wav->path);
    if (fclose (wav->f)) {
        monitor_printf (mon, "Failed to close wave file\nReason: %s\n",
                        strerror (errno));
    }
    g_free (wav);
    return -1;
 }
--- a/audio/winwaveaudio.c
+++ b/audio/winwaveaudio.c
@@ -0,0 +1,724 @@
 /* public domain */
 #include "qemu-common.h"
 #include "sysemu.h"
 #include "audio.h"
 #define AUDIO_CAP "winwave"
 #include "audio_int.h"
 #include <windows.h>
 #include <mmsystem.h>
 #include "audio_win_int.h"
 static struct {
    int dac_headers;
    int dac_samples;
    int adc_headers;
    int adc_samples;
 } conf = {
    .dac_headers = 4,
    .dac_samples = 1024,
    .adc_headers = 4,
    .adc_samples = 1024
 };
 typedef struct {
    HWVoiceOut hw;
    HWAVEOUT hwo;
    WAVEHDR *hdrs;
    HANDLE event;
    void *pcm_buf;
    int avail;
    int pending;
    int curhdr;
    int paused;
    CRITICAL_SECTION crit_sect;
 } WaveVoiceOut;
 typedef struct {
    HWVoiceIn hw;
    HWAVEIN hwi;
    WAVEHDR *hdrs;
    HANDLE event;
    void *pcm_buf;
    int curhdr;
    int paused;
    int rpos;
    int avail;
    CRITICAL_SECTION crit_sect;
 } WaveVoiceIn;
 static void winwave_log_mmresult (MMRESULT mr)
 {
    const char *str = "BUG";
    switch (mr) {
    case MMSYSERR_NOERROR:
        str = "Success";
        break;
    case MMSYSERR_INVALHANDLE:
        str = "Specified device handle is invalid";
        break;
    case MMSYSERR_BADDEVICEID:
        str = "Specified device id is out of range";
        break;
    case MMSYSERR_NODRIVER:
        str = "No device driver is present";
        break;
    case MMSYSERR_NOMEM:
        str = "Unable to allocate or locl memory";
        break;
    case WAVERR_SYNC:
        str = "Device is synchronous but waveOutOpen was called "
            "without using the WINWAVE_ALLOWSYNC flag";
        break;
    case WAVERR_UNPREPARED:
        str = "The data block pointed to by the pwh parameter "
            "hasn't been prepared";
        break;
    case WAVERR_STILLPLAYING:
        str = "There are still buffers in the queue";
        break;
    default:
        dolog ("Reason: Unknown (MMRESULT %#x)\n", mr);
        return;
    }
    dolog ("Reason: %s\n", str);
 }
 static void GCC_FMT_ATTR (2, 3) winwave_logerr (
    MMRESULT mr,
    const char *fmt,
    ...
    )
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
    AUD_log (NULL, " failed\n");
    winwave_log_mmresult (mr);
 }
 static void winwave_anal_close_out (WaveVoiceOut *wave)
 {
    MMRESULT mr;
    mr = waveOutClose (wave->hwo);
    if (mr != MMSYSERR_NOERROR) {
        winwave_logerr (mr, "waveOutClose");
    }
    wave->hwo = NULL;
 }
 static void CALLBACK winwave_callback_out (
    HWAVEOUT hwo,
    UINT msg,
    DWORD_PTR dwInstance,
    DWORD_PTR dwParam1,
    DWORD_PTR dwParam2
    )
 {
    WaveVoiceOut *wave = (WaveVoiceOut *) dwInstance;
    switch (msg) {
    case WOM_DONE:
        {
            WAVEHDR *h = (WAVEHDR *) dwParam1;
            if (!h->dwUser) {
                h->dwUser = 1;
                EnterCriticalSection (&wave->crit_sect);
                {
                    wave->avail += conf.dac_samples;
                }
                LeaveCriticalSection (&wave->crit_sect);
                if (wave->hw.poll_mode) {
                    if (!SetEvent (wave->event)) {
                        dolog ("DAC SetEvent failed %lx\n", GetLastError ());
                    }
                }
            }
        }
        break;
    case WOM_CLOSE:
    case WOM_OPEN:
        break;
    default:
        dolog ("unknown wave out callback msg %x\n", msg);
    }
 }
 static int winwave_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
    int i;
    int err;
    MMRESULT mr;
    WAVEFORMATEX wfx;
    WaveVoiceOut *wave;
    wave = (WaveVoiceOut *) hw;
    InitializeCriticalSection (&wave->crit_sect);
    err = waveformat_from_audio_settings (&wfx, as);
    if (err) {
        goto err0;
    }
    mr = waveOutOpen (&wave->hwo, WAVE_MAPPER, &wfx,
                      (DWORD_PTR) winwave_callback_out,
                      (DWORD_PTR) wave, CALLBACK_FUNCTION);
    if (mr != MMSYSERR_NOERROR) {
        winwave_logerr (mr, "waveOutOpen");
        goto err1;
    }
    wave->hdrs = audio_calloc (AUDIO_FUNC, conf.dac_headers,
                               sizeof (*wave->hdrs));
    if (!wave->hdrs) {
        goto err2;
    }
    audio_pcm_init_info (&hw->info, as);
    hw->samples = conf.dac_samples * conf.dac_headers;
    wave->avail = hw->samples;
    wave->pcm_buf = audio_calloc (AUDIO_FUNC, conf.dac_samples,
                                  conf.dac_headers << hw->info.shift);
    if (!wave->pcm_buf) {
        goto err3;
    }
    for (i = 0; i < conf.dac_headers; ++i) {
        WAVEHDR *h = &wave->hdrs[i];
        h->dwUser = 0;
        h->dwBufferLength = conf.dac_samples << hw->info.shift;
        h->lpData = advance (wave->pcm_buf, i * h->dwBufferLength);
        h->dwFlags = 0;
        mr = waveOutPrepareHeader (wave->hwo, h, sizeof (*h));
        if (mr != MMSYSERR_NOERROR) {
            winwave_logerr (mr, "waveOutPrepareHeader(%d)", i);
            goto err4;
        }
    }
    return 0;
 err4:
    qemu_free (wave->pcm_buf);
 err3:
    qemu_free (wave->hdrs);
 err2:
    winwave_anal_close_out (wave);
 err1:
 err0:
    return -1;
 }
 static int winwave_write (SWVoiceOut *sw, void *buf, int len)
 {
    return audio_pcm_sw_write (sw, buf, len);
 }
 static int winwave_run_out (HWVoiceOut *hw, int live)
 {
    WaveVoiceOut *wave = (WaveVoiceOut *) hw;
    int decr;
    int doreset;
    EnterCriticalSection (&wave->crit_sect);
    {
        decr = audio_MIN (live, wave->avail);
        decr = audio_pcm_hw_clip_out (hw, wave->pcm_buf, decr, wave->pending);
        wave->pending += decr;
        wave->avail -= decr;
    }
    LeaveCriticalSection (&wave->crit_sect);
    doreset = hw->poll_mode && (wave->pending >= conf.dac_samples);
    if (doreset && !ResetEvent (wave->event)) {
        dolog ("DAC ResetEvent failed %lx\n", GetLastError ());
    }
    while (wave->pending >= conf.dac_samples) {
        MMRESULT mr;
        WAVEHDR *h = &wave->hdrs[wave->curhdr];
        h->dwUser = 0;
        mr = waveOutWrite (wave->hwo, h, sizeof (*h));
        if (mr != MMSYSERR_NOERROR) {
            winwave_logerr (mr, "waveOutWrite(%d)", wave->curhdr);
            break;
        }
        wave->pending -= conf.dac_samples;
        wave->curhdr = (wave->curhdr + 1) % conf.dac_headers;
    }
    return decr;
 }
 static void winwave_poll (void *opaque)
 {
    (void) opaque;
    audio_run ("winwave_poll");
 }
 static void winwave_fini_out (HWVoiceOut *hw)
 {
    int i;
    MMRESULT mr;
    WaveVoiceOut *wave = (WaveVoiceOut *) hw;
    mr = waveOutReset (wave->hwo);
    if (mr != MMSYSERR_NOERROR) {
        winwave_logerr (mr, "waveOutReset");
    }
    for (i = 0; i < conf.dac_headers; ++i) {
        mr = waveOutUnprepareHeader (wave->hwo, &wave->hdrs[i],
                                     sizeof (wave->hdrs[i]));
        if (mr != MMSYSERR_NOERROR) {
            winwave_logerr (mr, "waveOutUnprepareHeader(%d)", i);
        }
    }
    winwave_anal_close_out (wave);
    if (wave->event) {
        qemu_del_wait_object (wave->event, winwave_poll, wave);
        if (!CloseHandle (wave->event)) {
            dolog ("DAC CloseHandle failed %lx\n", GetLastError ());
        }
        wave->event = NULL;
    }
    qemu_free (wave->pcm_buf);
    wave->pcm_buf = NULL;
    qemu_free (wave->hdrs);
    wave->hdrs = NULL;
 }
 static int winwave_ctl_out (HWVoiceOut *hw, int cmd, ...)
 {
    MMRESULT mr;
    WaveVoiceOut *wave = (WaveVoiceOut *) hw;
    switch (cmd) {
    case VOICE_ENABLE:
        {
            va_list ap;
            int poll_mode;
            va_start (ap, cmd);
            poll_mode = va_arg (ap, int);
            va_end (ap);
            if (poll_mode && !wave->event) {
                wave->event = CreateEvent (NULL, TRUE, TRUE, NULL);
                if (!wave->event) {
                    dolog ("DAC CreateEvent: %lx, poll mode will be disabled\n",
                           GetLastError ());
                }
            }
            if (wave->event) {
                int ret;
                ret = qemu_add_wait_object (wave->event, winwave_poll, wave);
                hw->poll_mode = (ret == 0);
            }
            else {
                hw->poll_mode = 0;
            }
            if (wave->paused) {
                mr = waveOutRestart (wave->hwo);
                if (mr != MMSYSERR_NOERROR) {
                    winwave_logerr (mr, "waveOutRestart");
                }
                wave->paused = 0;
            }
        }
        return 0;
    case VOICE_DISABLE:
        if (!wave->paused) {
            mr = waveOutPause (wave->hwo);
            if (mr != MMSYSERR_NOERROR) {
                winwave_logerr (mr, "waveOutPause");
            }
            else {
                wave->paused = 1;
            }
        }
        if (wave->event) {
            qemu_del_wait_object (wave->event, winwave_poll, wave);
        }
        return 0;
    }
    return -1;
 }
 static void winwave_anal_close_in (WaveVoiceIn *wave)
 {
    MMRESULT mr;
    mr = waveInClose (wave->hwi);
    if (mr != MMSYSERR_NOERROR) {
        winwave_logerr (mr, "waveInClose");
    }
    wave->hwi = NULL;
 }
 static void CALLBACK winwave_callback_in (
    HWAVEIN *hwi,
    UINT msg,
    DWORD_PTR dwInstance,
    DWORD_PTR dwParam1,
    DWORD_PTR dwParam2
    )
 {
    WaveVoiceIn *wave = (WaveVoiceIn *) dwInstance;
    switch (msg) {
    case WIM_DATA:
        {
            WAVEHDR *h = (WAVEHDR *) dwParam1;
            if (!h->dwUser) {
                h->dwUser = 1;
                EnterCriticalSection (&wave->crit_sect);
                {
                    wave->avail += conf.adc_samples;
                }
                LeaveCriticalSection (&wave->crit_sect);
                if (wave->hw.poll_mode) {
                    if (!SetEvent (wave->event)) {
                        dolog ("ADC SetEvent failed %lx\n", GetLastError ());
                    }
                }
            }
        }
        break;
    case WIM_CLOSE:
    case WIM_OPEN:
        break;
    default:
        dolog ("unknown wave in callback msg %x\n", msg);
    }
 }
 static void winwave_add_buffers (WaveVoiceIn *wave, int samples)
 {
    int doreset;
    doreset = wave->hw.poll_mode && (samples >= conf.adc_samples);
    if (doreset && !ResetEvent (wave->event)) {
        dolog ("ADC ResetEvent failed %lx\n", GetLastError ());
    }
    while (samples >= conf.adc_samples) {
        MMRESULT mr;
        WAVEHDR *h = &wave->hdrs[wave->curhdr];
        h->dwUser = 0;
        mr = waveInAddBuffer (wave->hwi, h, sizeof (*h));
        if (mr != MMSYSERR_NOERROR) {
            winwave_logerr (mr, "waveInAddBuffer(%d)", wave->curhdr);
        }
        wave->curhdr = (wave->curhdr + 1) % conf.adc_headers;
        samples -= conf.adc_samples;
    }
 }
 static int winwave_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
    int i;
    int err;
    MMRESULT mr;
    WAVEFORMATEX wfx;
    WaveVoiceIn *wave;
    wave = (WaveVoiceIn *) hw;
    InitializeCriticalSection (&wave->crit_sect);
    err = waveformat_from_audio_settings (&wfx, as);
    if (err) {
        goto err0;
    }
    mr = waveInOpen (&wave->hwi, WAVE_MAPPER, &wfx,
                     (DWORD_PTR) winwave_callback_in,
                     (DWORD_PTR) wave, CALLBACK_FUNCTION);
    if (mr != MMSYSERR_NOERROR) {
        winwave_logerr (mr, "waveInOpen");
        goto err1;
    }
    wave->hdrs = audio_calloc (AUDIO_FUNC, conf.dac_headers,
                               sizeof (*wave->hdrs));
    if (!wave->hdrs) {
        goto err2;
    }
    audio_pcm_init_info (&hw->info, as);
    hw->samples = conf.adc_samples * conf.adc_headers;
    wave->avail = 0;
    wave->pcm_buf = audio_calloc (AUDIO_FUNC, conf.adc_samples,
                                  conf.adc_headers << hw->info.shift);
    if (!wave->pcm_buf) {
        goto err3;
    }
    for (i = 0; i < conf.adc_headers; ++i) {
        WAVEHDR *h = &wave->hdrs[i];
        h->dwUser = 0;
        h->dwBufferLength = conf.adc_samples << hw->info.shift;
        h->lpData = advance (wave->pcm_buf, i * h->dwBufferLength);
        h->dwFlags = 0;
        mr = waveInPrepareHeader (wave->hwi, h, sizeof (*h));
        if (mr != MMSYSERR_NOERROR) {
            winwave_logerr (mr, "waveInPrepareHeader(%d)", i);
            goto err4;
        }
    }
    wave->paused = 1;
    winwave_add_buffers (wave, hw->samples);
    return 0;
 err4:
    qemu_free (wave->pcm_buf);
 err3:
    qemu_free (wave->hdrs);
 err2:
    winwave_anal_close_in (wave);
 err1:
 err0:
    return -1;
 }
 static void winwave_fini_in (HWVoiceIn *hw)
 {
    int i;
    MMRESULT mr;
    WaveVoiceIn *wave = (WaveVoiceIn *) hw;
    mr = waveInReset (wave->hwi);
    if (mr != MMSYSERR_NOERROR) {
        winwave_logerr (mr, "waveInReset");
    }
    for (i = 0; i < conf.adc_headers; ++i) {
        mr = waveInUnprepareHeader (wave->hwi, &wave->hdrs[i],
                                     sizeof (wave->hdrs[i]));
        if (mr != MMSYSERR_NOERROR) {
            winwave_logerr (mr, "waveInUnprepareHeader(%d)", i);
        }
    }
    winwave_anal_close_in (wave);
    if (wave->event) {
        qemu_del_wait_object (wave->event, winwave_poll, wave);
        if (!CloseHandle (wave->event)) {
            dolog ("ADC CloseHandle failed %lx\n", GetLastError ());
        }
        wave->event = NULL;
    }
    qemu_free (wave->pcm_buf);
    wave->pcm_buf = NULL;
    qemu_free (wave->hdrs);
    wave->hdrs = NULL;
 }
 static int winwave_run_in (HWVoiceIn *hw)
 {
    WaveVoiceIn *wave = (WaveVoiceIn *) hw;
    int live = audio_pcm_hw_get_live_in (hw);
    int dead = hw->samples - live;
    int decr, ret;
    if (!dead) {
        return 0;
    }
    EnterCriticalSection (&wave->crit_sect);
    {
        decr = audio_MIN (dead, wave->avail);
        wave->avail -= decr;
    }
    LeaveCriticalSection (&wave->crit_sect);
    ret = decr;
    while (decr) {
        int left = hw->samples - hw->wpos;
        int conv = audio_MIN (left, decr);
        hw->conv (hw->conv_buf + hw->wpos,
                  advance (wave->pcm_buf, wave->rpos << hw->info.shift),
                  conv,
                  &nominal_volume);
        wave->rpos = (wave->rpos + conv) % hw->samples;
        hw->wpos = (hw->wpos + conv) % hw->samples;
        decr -= conv;
    }
    winwave_add_buffers (wave, ret);
    return ret;
 }
 static int winwave_read (SWVoiceIn *sw, void *buf, int size)
 {
    return audio_pcm_sw_read (sw, buf, size);
 }
 static int winwave_ctl_in (HWVoiceIn *hw, int cmd, ...)
 {
    MMRESULT mr;
    WaveVoiceIn *wave = (WaveVoiceIn *) hw;
    switch (cmd) {
    case VOICE_ENABLE:
        {
            va_list ap;
            int poll_mode;
            va_start (ap, cmd);
            poll_mode = va_arg (ap, int);
            va_end (ap);
            if (poll_mode && !wave->event) {
                wave->event = CreateEvent (NULL, TRUE, TRUE, NULL);
                if (!wave->event) {
                    dolog ("ADC CreateEvent: %lx, poll mode will be disabled\n",
                           GetLastError ());
                }
            }
            if (wave->event) {
                int ret;
                ret = qemu_add_wait_object (wave->event, winwave_poll, wave);
                hw->poll_mode = (ret == 0);
            }
            else {
                hw->poll_mode = 0;
            }
            if (wave->paused) {
                mr = waveInStart (wave->hwi);
                if (mr != MMSYSERR_NOERROR) {
                    winwave_logerr (mr, "waveInStart");
                }
                wave->paused = 0;
            }
        }
        return 0;
    case VOICE_DISABLE:
        if (!wave->paused) {
            mr = waveInStop (wave->hwi);
            if (mr != MMSYSERR_NOERROR) {
                winwave_logerr (mr, "waveInStop");
            }
            else {
                wave->paused = 1;
            }
        }
        if (wave->event) {
            qemu_del_wait_object (wave->event, winwave_poll, wave);
        }
        return 0;
    }
    return 0;
 }
 static void *winwave_audio_init (void)
 {
    return &conf;
 }
 static void winwave_audio_fini (void *opaque)
 {
    (void) opaque;
 }
 static struct audio_option winwave_options[] = {
    {
        .name        = "DAC_HEADERS",
        .tag         = AUD_OPT_INT,
        .valp        = &conf.dac_headers,
        .descr       = "DAC number of headers",
    },
    {
        .name        = "DAC_SAMPLES",
        .tag         = AUD_OPT_INT,
        .valp        = &conf.dac_samples,
        .descr       = "DAC number of samples per header",
    },
    {
        .name        = "ADC_HEADERS",
        .tag         = AUD_OPT_INT,
        .valp        = &conf.adc_headers,
        .descr       = "ADC number of headers",
    },
    {
        .name        = "ADC_SAMPLES",
        .tag         = AUD_OPT_INT,
        .valp        = &conf.adc_samples,
        .descr       = "ADC number of samples per header",
    },
    { /* End of list */ }
 };
 static struct audio_pcm_ops winwave_pcm_ops = {
    .init_out = winwave_init_out,
    .fini_out = winwave_fini_out,
    .run_out  = winwave_run_out,
    .write    = winwave_write,
    .ctl_out  = winwave_ctl_out,
    .init_in  = winwave_init_in,
    .fini_in  = winwave_fini_in,
    .run_in   = winwave_run_in,
    .read     = winwave_read,
    .ctl_in   = winwave_ctl_in
 };
 struct audio_driver winwave_audio_driver = {
    .name           = "winwave",
    .descr          = "Windows Waveform Audio http://msdn.microsoft.com",
    .options        = winwave_options,
    .init           = winwave_audio_init,
    .fini           = winwave_audio_fini,
    .pcm_ops        = &winwave_pcm_ops,
    .can_be_default = 1,
    .max_voices_out = INT_MAX,
    .max_voices_in  = INT_MAX,
    .voice_size_out = sizeof (WaveVoiceOut),
    .voice_size_in  = sizeof (WaveVoiceIn)
 };
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -1,14 +0,0 @@
 common-obj-y += rng.o rng-egd.o
 common-obj-$(CONFIG_POSIX) += rng-random.o
 common-obj-y += msmouse.o wctablet.o testdev.o
 common-obj-$(CONFIG_BRLAPI) += baum.o
 baum.o-cflags := $(SDL_CFLAGS)
 common-obj-$(CONFIG_TPM) += tpm.o
 common-obj-y += hostmem.o hostmem-ram.o
 common-obj-$(CONFIG_LINUX) += hostmem-file.o
 common-obj-y += cryptodev.o
 common-obj-y += cryptodev-builtin.o
--- a/backends/baum.c
+++ b/backends/baum.c
@@ -1,677 +0,0 @@
 /*
 * QEMU Baum Braille Device
 *
 * Copyright (c) 2008, 2010-2011, 2016 Samuel Thibault
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
 #include "sysemu/char.h"
 #include "qemu/timer.h"
 #include "hw/usb.h"
 #include "ui/console.h"
 #include <brlapi.h>
 #include <brlapi_constants.h>
 #include <brlapi_keycodes.h>
 #if 0
 #define DPRINTF(fmt, ...) \
        printf(fmt, ## __VA_ARGS__)
 #else
 #define DPRINTF(fmt, ...)
 #endif
 #define ESC 0x1B
 #define BAUM_REQ_DisplayData		0x01
 #define BAUM_REQ_GetVersionNumber	0x05
 #define BAUM_REQ_GetKeys		0x08
 #define BAUM_REQ_SetMode		0x12
 #define BAUM_REQ_SetProtocol		0x15
 #define BAUM_REQ_GetDeviceIdentity	0x84
 #define BAUM_REQ_GetSerialNumber	0x8A
 #define BAUM_RSP_CellCount		0x01
 #define BAUM_RSP_VersionNumber		0x05
 #define BAUM_RSP_ModeSetting		0x11
 #define BAUM_RSP_CommunicationChannel	0x16
 #define BAUM_RSP_PowerdownSignal	0x17
 #define BAUM_RSP_HorizontalSensors	0x20
 #define BAUM_RSP_VerticalSensors	0x21
 #define BAUM_RSP_RoutingKeys		0x22
 #define BAUM_RSP_Switches		0x23
 #define BAUM_RSP_TopKeys		0x24
 #define BAUM_RSP_HorizontalSensor	0x25
 #define BAUM_RSP_VerticalSensor		0x26
 #define BAUM_RSP_RoutingKey		0x27
 #define BAUM_RSP_FrontKeys6		0x28
 #define BAUM_RSP_BackKeys6		0x29
 #define BAUM_RSP_CommandKeys		0x2B
 #define BAUM_RSP_FrontKeys10		0x2C
 #define BAUM_RSP_BackKeys10		0x2D
 #define BAUM_RSP_EntryKeys		0x33
 #define BAUM_RSP_JoyStick		0x34
 #define BAUM_RSP_ErrorCode		0x40
 #define BAUM_RSP_InfoBlock		0x42
 #define BAUM_RSP_DeviceIdentity		0x84
 #define BAUM_RSP_SerialNumber		0x8A
 #define BAUM_RSP_BluetoothName		0x8C
 #define BAUM_TL1 0x01
 #define BAUM_TL2 0x02
 #define BAUM_TL3 0x04
 #define BAUM_TR1 0x08
 #define BAUM_TR2 0x10
 #define BAUM_TR3 0x20
 #define BUF_SIZE 256
 typedef struct {
    Chardev parent;
    brlapi_handle_t *brlapi;
    int brlapi_fd;
    unsigned int x, y;
    bool deferred_init;
    uint8_t in_buf[BUF_SIZE];
    uint8_t in_buf_used;
    uint8_t out_buf[BUF_SIZE];
    uint8_t out_buf_used, out_buf_ptr;
    QEMUTimer *cellCount_timer;
 } BaumChardev;
 #define TYPE_CHARDEV_BRAILLE "chardev-braille"
 #define BAUM_CHARDEV(obj) OBJECT_CHECK(BaumChardev, (obj), TYPE_CHARDEV_BRAILLE)
 /* Let's assume NABCC by default */
 enum way {
    DOTS2ASCII,
    ASCII2DOTS
 };
 static const uint8_t nabcc_translation[2][256] = {
 #ifndef BRLAPI_DOTS
 #define BRLAPI_DOTS(d1,d2,d3,d4,d5,d6,d7,d8) \
    ((d1?BRLAPI_DOT1:0)|\
     (d2?BRLAPI_DOT2:0)|\
     (d3?BRLAPI_DOT3:0)|\
     (d4?BRLAPI_DOT4:0)|\
     (d5?BRLAPI_DOT5:0)|\
     (d6?BRLAPI_DOT6:0)|\
     (d7?BRLAPI_DOT7:0)|\
     (d8?BRLAPI_DOT8:0))
 #endif
 #define DO(dots, ascii) \
    [DOTS2ASCII][dots] = ascii, \
    [ASCII2DOTS][ascii] = dots
    DO(0, ' '),
    DO(BRLAPI_DOTS(1, 0, 0, 0, 0, 0, 0, 0), 'a'),
    DO(BRLAPI_DOTS(1, 1, 0, 0, 0, 0, 0, 0), 'b'),
    DO(BRLAPI_DOTS(1, 0, 0, 1, 0, 0, 0, 0), 'c'),
    DO(BRLAPI_DOTS(1, 0, 0, 1, 1, 0, 0, 0), 'd'),
    DO(BRLAPI_DOTS(1, 0, 0, 0, 1, 0, 0, 0), 'e'),
    DO(BRLAPI_DOTS(1, 1, 0, 1, 0, 0, 0, 0), 'f'),
    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 0, 0, 0), 'g'),
    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 0, 0, 0), 'h'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 0, 0, 0), 'i'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 0, 0, 0), 'j'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 0, 0, 0), 'k'),
    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 0, 0, 0), 'l'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 0, 0, 0), 'm'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 0, 0, 0), 'n'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 0, 0, 0), 'o'),
    DO(BRLAPI_DOTS(1, 1, 1, 1, 0, 0, 0, 0), 'p'),
    DO(BRLAPI_DOTS(1, 1, 1, 1, 1, 0, 0, 0), 'q'),
    DO(BRLAPI_DOTS(1, 1, 1, 0, 1, 0, 0, 0), 'r'),
    DO(BRLAPI_DOTS(0, 1, 1, 1, 0, 0, 0, 0), 's'),
    DO(BRLAPI_DOTS(0, 1, 1, 1, 1, 0, 0, 0), 't'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 1, 0, 0), 'u'),
    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 1, 0, 0), 'v'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 1, 0, 0), 'w'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 1, 0, 0), 'x'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 1, 0, 0), 'y'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 1, 0, 0), 'z'),
    DO(BRLAPI_DOTS(1, 0, 0, 0, 0, 0, 1, 0), 'A'),
    DO(BRLAPI_DOTS(1, 1, 0, 0, 0, 0, 1, 0), 'B'),
    DO(BRLAPI_DOTS(1, 0, 0, 1, 0, 0, 1, 0), 'C'),
    DO(BRLAPI_DOTS(1, 0, 0, 1, 1, 0, 1, 0), 'D'),
    DO(BRLAPI_DOTS(1, 0, 0, 0, 1, 0, 1, 0), 'E'),
    DO(BRLAPI_DOTS(1, 1, 0, 1, 0, 0, 1, 0), 'F'),
    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 0, 1, 0), 'G'),
    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 0, 1, 0), 'H'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 0, 1, 0), 'I'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 0, 1, 0), 'J'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 0, 1, 0), 'K'),
    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 0, 1, 0), 'L'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 0, 1, 0), 'M'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 0, 1, 0), 'N'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 0, 1, 0), 'O'),
    DO(BRLAPI_DOTS(1, 1, 1, 1, 0, 0, 1, 0), 'P'),
    DO(BRLAPI_DOTS(1, 1, 1, 1, 1, 0, 1, 0), 'Q'),
    DO(BRLAPI_DOTS(1, 1, 1, 0, 1, 0, 1, 0), 'R'),
    DO(BRLAPI_DOTS(0, 1, 1, 1, 0, 0, 1, 0), 'S'),
    DO(BRLAPI_DOTS(0, 1, 1, 1, 1, 0, 1, 0), 'T'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 1, 1, 0), 'U'),
    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 1, 1, 0), 'V'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 1, 1, 0), 'W'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 1, 1, 0), 'X'),
    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 1, 1, 0), 'Y'),
    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 1, 1, 0), 'Z'),
    DO(BRLAPI_DOTS(0, 0, 1, 0, 1, 1, 0, 0), '0'),
    DO(BRLAPI_DOTS(0, 1, 0, 0, 0, 0, 0, 0), '1'),
    DO(BRLAPI_DOTS(0, 1, 1, 0, 0, 0, 0, 0), '2'),
    DO(BRLAPI_DOTS(0, 1, 0, 0, 1, 0, 0, 0), '3'),
    DO(BRLAPI_DOTS(0, 1, 0, 0, 1, 1, 0, 0), '4'),
    DO(BRLAPI_DOTS(0, 1, 0, 0, 0, 1, 0, 0), '5'),
    DO(BRLAPI_DOTS(0, 1, 1, 0, 1, 0, 0, 0), '6'),
    DO(BRLAPI_DOTS(0, 1, 1, 0, 1, 1, 0, 0), '7'),
    DO(BRLAPI_DOTS(0, 1, 1, 0, 0, 1, 0, 0), '8'),
    DO(BRLAPI_DOTS(0, 0, 1, 0, 1, 0, 0, 0), '9'),
    DO(BRLAPI_DOTS(0, 0, 0, 1, 0, 1, 0, 0), '.'),
    DO(BRLAPI_DOTS(0, 0, 1, 1, 0, 1, 0, 0), '+'),
    DO(BRLAPI_DOTS(0, 0, 1, 0, 0, 1, 0, 0), '-'),
    DO(BRLAPI_DOTS(1, 0, 0, 0, 0, 1, 0, 0), '*'),
    DO(BRLAPI_DOTS(0, 0, 1, 1, 0, 0, 0, 0), '/'),
    DO(BRLAPI_DOTS(1, 1, 1, 0, 1, 1, 0, 0), '('),
    DO(BRLAPI_DOTS(0, 1, 1, 1, 1, 1, 0, 0), ')'),
    DO(BRLAPI_DOTS(1, 1, 1, 1, 0, 1, 0, 0), '&'),
    DO(BRLAPI_DOTS(0, 0, 1, 1, 1, 1, 0, 0), '#'),
    DO(BRLAPI_DOTS(0, 0, 0, 0, 0, 1, 0, 0), ','),
    DO(BRLAPI_DOTS(0, 0, 0, 0, 1, 1, 0, 0), ';'),
    DO(BRLAPI_DOTS(1, 0, 0, 0, 1, 1, 0, 0), ':'),
    DO(BRLAPI_DOTS(0, 1, 1, 1, 0, 1, 0, 0), '!'),
    DO(BRLAPI_DOTS(1, 0, 0, 1, 1, 1, 0, 0), '?'),
    DO(BRLAPI_DOTS(0, 0, 0, 0, 1, 0, 0, 0), '"'),
    DO(BRLAPI_DOTS(0, 0, 1, 0, 0, 0, 0, 0), '\''),
    DO(BRLAPI_DOTS(0, 0, 0, 1, 0, 0, 0, 0), '`'),
    DO(BRLAPI_DOTS(0, 0, 0, 1, 1, 0, 1, 0), '^'),
    DO(BRLAPI_DOTS(0, 0, 0, 1, 1, 0, 0, 0), '~'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 1, 1, 0), '['),
    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 1, 1, 0), ']'),
    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 1, 0, 0), '{'),
    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 1, 0, 0), '}'),
    DO(BRLAPI_DOTS(1, 1, 1, 1, 1, 1, 0, 0), '='),
    DO(BRLAPI_DOTS(1, 1, 0, 0, 0, 1, 0, 0), '<'),
    DO(BRLAPI_DOTS(0, 0, 1, 1, 1, 0, 0, 0), '>'),
    DO(BRLAPI_DOTS(1, 1, 0, 1, 0, 1, 0, 0), '$'),
    DO(BRLAPI_DOTS(1, 0, 0, 1, 0, 1, 0, 0), '%'),
    DO(BRLAPI_DOTS(0, 0, 0, 1, 0, 0, 1, 0), '@'),
    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 1, 0, 0), '|'),
    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 1, 1, 0), '\\'),
    DO(BRLAPI_DOTS(0, 0, 0, 1, 1, 1, 0, 0), '_'),
 };
 /* The guest OS has started discussing with us, finish initializing BrlAPI */
 static int baum_deferred_init(BaumChardev *baum)
 {
    int tty = BRLAPI_TTY_DEFAULT;
    QemuConsole *con;
    if (baum->deferred_init) {
        return 1;
    }
    if (brlapi__getDisplaySize(baum->brlapi, &baum->x, &baum->y) == -1) {
        brlapi_perror("baum: brlapi__getDisplaySize");
        return 0;
    }
    con = qemu_console_lookup_by_index(0);
    if (con && qemu_console_is_graphic(con)) {
        tty = qemu_console_get_window_id(con);
        if (tty == -1)
            tty = BRLAPI_TTY_DEFAULT;
    }
    if (brlapi__enterTtyMode(baum->brlapi, tty, NULL) == -1) {
        brlapi_perror("baum: brlapi__enterTtyMode");
        return 0;
    }
    baum->deferred_init = 1;
    return 1;
 }
 /* The serial port can receive more of our data */
 static void baum_chr_accept_input(struct Chardev *chr)
 {
    BaumChardev *baum = BAUM_CHARDEV(chr);
    int room, first;
    if (!baum->out_buf_used)
        return;
    room = qemu_chr_be_can_write(chr);
    if (!room)
        return;
    if (room > baum->out_buf_used)
        room = baum->out_buf_used;
    first = BUF_SIZE - baum->out_buf_ptr;
    if (room > first) {
        qemu_chr_be_write(chr, baum->out_buf + baum->out_buf_ptr, first);
        baum->out_buf_ptr = 0;
        baum->out_buf_used -= first;
        room -= first;
    }
    qemu_chr_be_write(chr, baum->out_buf + baum->out_buf_ptr, room);
    baum->out_buf_ptr += room;
    baum->out_buf_used -= room;
 }
 /* We want to send a packet */
 static void baum_write_packet(BaumChardev *baum, const uint8_t *buf, int len)
 {
    Chardev *chr = CHARDEV(baum);
    uint8_t io_buf[1 + 2 * len], *cur = io_buf;
    int room;
    *cur++ = ESC;
    while (len--)
        if ((*cur++ = *buf++) == ESC)
            *cur++ = ESC;
    room = qemu_chr_be_can_write(chr);
    len = cur - io_buf;
    if (len <= room) {
        /* Fits */
        qemu_chr_be_write(chr, io_buf, len);
    } else {
        int first;
        uint8_t out;
        /* Can't fit all, send what can be, and store the rest. */
        qemu_chr_be_write(chr, io_buf, room);
        len -= room;
        cur = io_buf + room;
        if (len > BUF_SIZE - baum->out_buf_used) {
            /* Can't even store it, drop the previous data... */
            assert(len <= BUF_SIZE);
            baum->out_buf_used = 0;
            baum->out_buf_ptr = 0;
        }
        out = baum->out_buf_ptr;
        baum->out_buf_used += len;
        first = BUF_SIZE - baum->out_buf_ptr;
        if (len > first) {
            memcpy(baum->out_buf + out, cur, first);
            out = 0;
            len -= first;
            cur += first;
        }
        memcpy(baum->out_buf + out, cur, len);
    }
 }
 /* Called when the other end seems to have a wrong idea of our display size */
 static void baum_cellCount_timer_cb(void *opaque)
 {
    BaumChardev *baum = BAUM_CHARDEV(opaque);
    uint8_t cell_count[] = { BAUM_RSP_CellCount, baum->x * baum->y };
    DPRINTF("Timeout waiting for DisplayData, sending cell count\n");
    baum_write_packet(baum, cell_count, sizeof(cell_count));
 }
 /* Try to interpret a whole incoming packet */
 static int baum_eat_packet(BaumChardev *baum, const uint8_t *buf, int len)
 {
    const uint8_t *cur = buf;
    uint8_t req = 0;
    if (!len--)
        return 0;
    if (*cur++ != ESC) {
        while (*cur != ESC) {
            if (!len--)
                return 0;
            cur++;
        }
        DPRINTF("Dropped %td bytes!\n", cur - buf);
    }
 #define EAT(c) do {\
    if (!len--) \
        return 0; \
    if ((c = *cur++) == ESC) { \
        if (!len--) \
            return 0; \
        if (*cur++ != ESC) { \
            DPRINTF("Broken packet %#2x, tossing\n", req); \
            if (timer_pending(baum->cellCount_timer)) {    \
                timer_del(baum->cellCount_timer);     \
                baum_cellCount_timer_cb(baum);             \
            } \
            return (cur - 2 - buf); \
        } \
    } \
 } while (0)
    EAT(req);
    switch (req) {
    case BAUM_REQ_DisplayData:
    {
        uint8_t cells[baum->x * baum->y], c;
        uint8_t text[baum->x * baum->y];
        uint8_t zero[baum->x * baum->y];
        int cursor = BRLAPI_CURSOR_OFF;
        int i;
        /* Allow 100ms to complete the DisplayData packet */
        timer_mod(baum->cellCount_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
                       NANOSECONDS_PER_SECOND / 10);
        for (i = 0; i < baum->x * baum->y ; i++) {
            EAT(c);
            cells[i] = c;
            if ((c & (BRLAPI_DOT7|BRLAPI_DOT8))
                    == (BRLAPI_DOT7|BRLAPI_DOT8)) {
                cursor = i + 1;
                c &= ~(BRLAPI_DOT7|BRLAPI_DOT8);
            }
            c = nabcc_translation[DOTS2ASCII][c];
            if (!c) {
                c = '?';
            }
            text[i] = c;
        }
        timer_del(baum->cellCount_timer);
        memset(zero, 0, sizeof(zero));
        brlapi_writeArguments_t wa = {
            .displayNumber = BRLAPI_DISPLAY_DEFAULT,
            .regionBegin = 1,
            .regionSize = baum->x * baum->y,
            .text = (char *)text,
            .textSize = baum->x * baum->y,
            .andMask = zero,
            .orMask = cells,
            .cursor = cursor,
            .charset = (char *)"ISO-8859-1",
        };
        if (brlapi__write(baum->brlapi, &wa) == -1)
            brlapi_perror("baum brlapi_write");
        break;
    }
    case BAUM_REQ_SetMode:
    {
        uint8_t mode, setting;
        DPRINTF("SetMode\n");
        EAT(mode);
        EAT(setting);
        /* ignore */
        break;
    }
    case BAUM_REQ_SetProtocol:
    {
        uint8_t protocol;
        DPRINTF("SetProtocol\n");
        EAT(protocol);
        /* ignore */
        break;
    }
    case BAUM_REQ_GetDeviceIdentity:
    {
        uint8_t identity[17] = { BAUM_RSP_DeviceIdentity,
            'B','a','u','m',' ','V','a','r','i','o' };
        DPRINTF("GetDeviceIdentity\n");
        identity[11] = '0' + baum->x / 10;
        identity[12] = '0' + baum->x % 10;
        baum_write_packet(baum, identity, sizeof(identity));
        break;
    }
    case BAUM_REQ_GetVersionNumber:
    {
        uint8_t version[] = { BAUM_RSP_VersionNumber, 1 }; /* ? */
        DPRINTF("GetVersionNumber\n");
        baum_write_packet(baum, version, sizeof(version));
        break;
    }
    case BAUM_REQ_GetSerialNumber:
    {
        uint8_t serial[] = { BAUM_RSP_SerialNumber,
            '0','0','0','0','0','0','0','0' };
        DPRINTF("GetSerialNumber\n");
        baum_write_packet(baum, serial, sizeof(serial));
        break;
    }
    case BAUM_REQ_GetKeys:
    {
        DPRINTF("Get%0#2x\n", req);
        /* ignore */
        break;
    }
    default:
        DPRINTF("unrecognized request %0#2x\n", req);
        do
            if (!len--)
                return 0;
        while (*cur++ != ESC);
        cur--;
        break;
    }
    return cur - buf;
 }
 /* The other end is writing some data.  Store it and try to interpret */
 static int baum_chr_write(Chardev *chr, const uint8_t *buf, int len)
 {
    BaumChardev *baum = BAUM_CHARDEV(chr);
    int tocopy, cur, eaten, orig_len = len;
    if (!len)
        return 0;
    if (!baum->brlapi)
        return len;
    if (!baum_deferred_init(baum))
        return len;
    while (len) {
        /* Complete our buffer as much as possible */
        tocopy = len;
        if (tocopy > BUF_SIZE - baum->in_buf_used)
            tocopy = BUF_SIZE - baum->in_buf_used;
        memcpy(baum->in_buf + baum->in_buf_used, buf, tocopy);
        baum->in_buf_used += tocopy;
        buf += tocopy;
        len -= tocopy;
        /* Interpret it as much as possible */
        cur = 0;
        while (cur < baum->in_buf_used &&
                (eaten = baum_eat_packet(baum, baum->in_buf + cur, baum->in_buf_used - cur)))
            cur += eaten;
        /* Shift the remainder */
        if (cur) {
            memmove(baum->in_buf, baum->in_buf + cur, baum->in_buf_used - cur);
            baum->in_buf_used -= cur;
        }
        /* And continue if any data left */
    }
    return orig_len;
 }
 /* Send the key code to the other end */
 static void baum_send_key(BaumChardev *baum, uint8_t type, uint8_t value)
 {
    uint8_t packet[] = { type, value };
    DPRINTF("writing key %x %x\n", type, value);
    baum_write_packet(baum, packet, sizeof(packet));
 }
 static void baum_send_key2(BaumChardev *baum, uint8_t type, uint8_t value,
                           uint8_t value2)
 {
    uint8_t packet[] = { type, value, value2 };
    DPRINTF("writing key %x %x\n", type, value);
    baum_write_packet(baum, packet, sizeof(packet));
 }
 /* We got some data on the BrlAPI socket */
 static void baum_chr_read(void *opaque)
 {
    BaumChardev *baum = BAUM_CHARDEV(opaque);
    brlapi_keyCode_t code;
    int ret;
    if (!baum->brlapi)
        return;
    if (!baum_deferred_init(baum))
        return;
    while ((ret = brlapi__readKey(baum->brlapi, 0, &code)) == 1) {
        DPRINTF("got key %"BRLAPI_PRIxKEYCODE"\n", code);
        /* Emulate */
        switch (code & BRLAPI_KEY_TYPE_MASK) {
        case BRLAPI_KEY_TYPE_CMD:
            switch (code & BRLAPI_KEY_CMD_BLK_MASK) {
            case BRLAPI_KEY_CMD_ROUTE:
                baum_send_key(baum, BAUM_RSP_RoutingKey, (code & BRLAPI_KEY_CMD_ARG_MASK)+1);
                baum_send_key(baum, BAUM_RSP_RoutingKey, 0);
                break;
            case 0:
                switch (code & BRLAPI_KEY_CMD_ARG_MASK) {
                case BRLAPI_KEY_CMD_FWINLT:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TL2);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_FWINRT:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TR2);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_LNUP:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TR1);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_LNDN:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TR3);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_TOP:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TL1|BAUM_TR1);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_BOT:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TL3|BAUM_TR3);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_TOP_LEFT:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TL2|BAUM_TR1);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_BOT_LEFT:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TL2|BAUM_TR3);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_HOME:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TL2|BAUM_TR1|BAUM_TR3);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                case BRLAPI_KEY_CMD_PREFMENU:
                    baum_send_key(baum, BAUM_RSP_TopKeys, BAUM_TL1|BAUM_TL3|BAUM_TR1);
                    baum_send_key(baum, BAUM_RSP_TopKeys, 0);
                    break;
                }
            }
            break;
        case BRLAPI_KEY_TYPE_SYM:
            {
                brlapi_keyCode_t keysym = code & BRLAPI_KEY_CODE_MASK;
                if (keysym < 0x100) {
                    uint8_t dots = nabcc_translation[ASCII2DOTS][keysym];
                    if (dots) {
                        baum_send_key2(baum, BAUM_RSP_EntryKeys, 0, dots);
                        baum_send_key2(baum, BAUM_RSP_EntryKeys, 0, 0);
                    }
                }
                break;
            }
        }
    }
    if (ret == -1 && (brlapi_errno != BRLAPI_ERROR_LIBCERR || errno != EINTR)) {
        brlapi_perror("baum: brlapi_readKey");
        brlapi__closeConnection(baum->brlapi);
        g_free(baum->brlapi);
        baum->brlapi = NULL;
    }
 }
 static void char_braille_finalize(Object *obj)
 {
    BaumChardev *baum = BAUM_CHARDEV(obj);
    timer_free(baum->cellCount_timer);
    if (baum->brlapi) {
        brlapi__closeConnection(baum->brlapi);
        g_free(baum->brlapi);
    }
 }
 static void baum_chr_open(Chardev *chr,
                          ChardevBackend *backend,
                          bool *be_opened,
                          Error **errp)
 {
    BaumChardev *baum = BAUM_CHARDEV(chr);
    brlapi_handle_t *handle;
    handle = g_malloc0(brlapi_getHandleSize());
    baum->brlapi = handle;
    baum->brlapi_fd = brlapi__openConnection(handle, NULL, NULL);
    if (baum->brlapi_fd == -1) {
        error_setg(errp, "brlapi__openConnection: %s",
                   brlapi_strerror(brlapi_error_location()));
        g_free(handle);
        return;
    }
    baum->deferred_init = 0;
    baum->cellCount_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, baum_cellCount_timer_cb, baum);
    qemu_set_fd_handler(baum->brlapi_fd, baum_chr_read, NULL, baum);
 }
 static void char_braille_class_init(ObjectClass *oc, void *data)
 {
    ChardevClass *cc = CHARDEV_CLASS(oc);
    cc->open = baum_chr_open;
    cc->chr_write = baum_chr_write;
    cc->chr_accept_input = baum_chr_accept_input;
 }
 static const TypeInfo char_braille_type_info = {
    .name = TYPE_CHARDEV_BRAILLE,
    .parent = TYPE_CHARDEV,
    .instance_size = sizeof(BaumChardev),
    .instance_finalize = char_braille_finalize,
    .class_init = char_braille_class_init,
 };
 static void register_types(void)
 {
    type_register_static(&char_braille_type_info);
 }
 type_init(register_types);
--- a/backends/cryptodev-builtin.c
+++ b/backends/cryptodev-builtin.c
@@ -1,400 +0,0 @@
 /*
 * QEMU Cryptodev backend for QEMU cipher APIs
 *
 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
 *
 * Authors:
 *    Gonglei <arei.gonglei@huawei.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 *
 */
 #include "qemu/osdep.h"
 #include "sysemu/cryptodev.h"
 #include "hw/boards.h"
 #include "qapi/error.h"
 #include "standard-headers/linux/virtio_crypto.h"
 #include "crypto/cipher.h"
 /**
 * @TYPE_CRYPTODEV_BACKEND_BUILTIN:
 * name of backend that uses QEMU cipher API
 */
 #define TYPE_CRYPTODEV_BACKEND_BUILTIN "cryptodev-backend-builtin"
 #define CRYPTODEV_BACKEND_BUILTIN(obj) \
    OBJECT_CHECK(CryptoDevBackendBuiltin, \
                 (obj), TYPE_CRYPTODEV_BACKEND_BUILTIN)
 typedef struct CryptoDevBackendBuiltin
                         CryptoDevBackendBuiltin;
 typedef struct CryptoDevBackendBuiltinSession {
    QCryptoCipher *cipher;
    uint8_t direction; /* encryption or decryption */
    uint8_t type; /* cipher? hash? aead? */
    QTAILQ_ENTRY(CryptoDevBackendBuiltinSession) next;
 } CryptoDevBackendBuiltinSession;
 /* Max number of symmetric sessions */
 #define MAX_NUM_SESSIONS 256
 #define CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN    512
 #define CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN  64
 struct CryptoDevBackendBuiltin {
    CryptoDevBackend parent_obj;
    CryptoDevBackendBuiltinSession *sessions[MAX_NUM_SESSIONS];
 };
 static void cryptodev_builtin_init(
             CryptoDevBackend *backend, Error **errp)
 {
    /* Only support one queue */
    int queues = backend->conf.peers.queues;
    CryptoDevBackendClient *cc;
    if (queues != 1) {
        error_setg(errp,
                  "Only support one queue in cryptdov-builtin backend");
        return;
    }
    cc = cryptodev_backend_new_client(
              "cryptodev-builtin", NULL);
    cc->info_str = g_strdup_printf("cryptodev-builtin0");
    cc->queue_index = 0;
    backend->conf.peers.ccs[0] = cc;
    backend->conf.crypto_services =
                         1u << VIRTIO_CRYPTO_SERVICE_CIPHER |
                         1u << VIRTIO_CRYPTO_SERVICE_HASH |
                         1u << VIRTIO_CRYPTO_SERVICE_MAC;
    backend->conf.cipher_algo_l = 1u << VIRTIO_CRYPTO_CIPHER_AES_CBC;
    backend->conf.hash_algo = 1u << VIRTIO_CRYPTO_HASH_SHA1;
    /*
     * Set the Maximum length of crypto request.
     * Why this value? Just avoid to overflow when
     * memory allocation for each crypto request.
     */
    backend->conf.max_size = LONG_MAX - sizeof(CryptoDevBackendSymOpInfo);
    backend->conf.max_cipher_key_len = CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN;
    backend->conf.max_auth_key_len = CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN;
    cryptodev_backend_set_ready(backend, true);
 }
 static int
 cryptodev_builtin_get_unused_session_index(
                 CryptoDevBackendBuiltin *builtin)
 {
    size_t i;
    for (i = 0; i < MAX_NUM_SESSIONS; i++) {
        if (builtin->sessions[i] == NULL) {
            return i;
        }
    }
    return -1;
 }
 #define AES_KEYSIZE_128 16
 #define AES_KEYSIZE_192 24
 #define AES_KEYSIZE_256 32
 #define AES_KEYSIZE_128_XTS AES_KEYSIZE_256
 #define AES_KEYSIZE_256_XTS 64
 static int
 cryptodev_builtin_get_aes_algo(uint32_t key_len, int mode, Error **errp)
 {
    int algo;
    if (key_len == AES_KEYSIZE_128) {
        algo = QCRYPTO_CIPHER_ALG_AES_128;
    } else if (key_len == AES_KEYSIZE_192) {
        algo = QCRYPTO_CIPHER_ALG_AES_192;
    } else if (key_len == AES_KEYSIZE_256) { /* equals AES_KEYSIZE_128_XTS */
        if (mode == QCRYPTO_CIPHER_MODE_XTS) {
            algo = QCRYPTO_CIPHER_ALG_AES_128;
        } else {
            algo = QCRYPTO_CIPHER_ALG_AES_256;
        }
    } else if (key_len == AES_KEYSIZE_256_XTS) {
        if (mode == QCRYPTO_CIPHER_MODE_XTS) {
            algo = QCRYPTO_CIPHER_ALG_AES_256;
        } else {
            goto err;
        }
    } else {
        goto err;
    }
    return algo;
 err:
   error_setg(errp, "Unsupported key length :%u", key_len);
   return -1;
 }
 static int cryptodev_builtin_create_cipher_session(
                    CryptoDevBackendBuiltin *builtin,
                    CryptoDevBackendSymSessionInfo *sess_info,
                    Error **errp)
 {
    int algo;
    int mode;
    QCryptoCipher *cipher;
    int index;
    CryptoDevBackendBuiltinSession *sess;
    if (sess_info->op_type != VIRTIO_CRYPTO_SYM_OP_CIPHER) {
        error_setg(errp, "Unsupported optype :%u", sess_info->op_type);
        return -1;
    }
    index = cryptodev_builtin_get_unused_session_index(builtin);
    if (index < 0) {
        error_setg(errp, "Total number of sessions created exceeds %u",
                  MAX_NUM_SESSIONS);
        return -1;
    }
    switch (sess_info->cipher_alg) {
    case VIRTIO_CRYPTO_CIPHER_AES_ECB:
        mode = QCRYPTO_CIPHER_MODE_ECB;
        algo = cryptodev_builtin_get_aes_algo(sess_info->key_len,
                                                    mode, errp);
        if (algo < 0)  {
            return -1;
        }
        break;
    case VIRTIO_CRYPTO_CIPHER_AES_CBC:
        mode = QCRYPTO_CIPHER_MODE_CBC;
        algo = cryptodev_builtin_get_aes_algo(sess_info->key_len,
                                                    mode, errp);
        if (algo < 0)  {
            return -1;
        }
        break;
    case VIRTIO_CRYPTO_CIPHER_AES_CTR:
        mode = QCRYPTO_CIPHER_MODE_CTR;
        algo = cryptodev_builtin_get_aes_algo(sess_info->key_len,
                                                    mode, errp);
        if (algo < 0)  {
            return -1;
        }
        break;
    case VIRTIO_CRYPTO_CIPHER_AES_XTS:
        mode = QCRYPTO_CIPHER_MODE_XTS;
        algo = cryptodev_builtin_get_aes_algo(sess_info->key_len,
                                                    mode, errp);
        if (algo < 0)  {
            return -1;
        }
        break;
    case VIRTIO_CRYPTO_CIPHER_3DES_ECB:
        mode = QCRYPTO_CIPHER_MODE_ECB;
        algo = QCRYPTO_CIPHER_ALG_3DES;
        break;
    case VIRTIO_CRYPTO_CIPHER_3DES_CBC:
        mode = QCRYPTO_CIPHER_MODE_CBC;
        algo = QCRYPTO_CIPHER_ALG_3DES;
        break;
    case VIRTIO_CRYPTO_CIPHER_3DES_CTR:
        mode = QCRYPTO_CIPHER_MODE_CTR;
        algo = QCRYPTO_CIPHER_ALG_3DES;
        break;
    default:
        error_setg(errp, "Unsupported cipher alg :%u",
                   sess_info->cipher_alg);
        return -1;
    }
    cipher = qcrypto_cipher_new(algo, mode,
                               sess_info->cipher_key,
                               sess_info->key_len,
                               errp);
    if (!cipher) {
        return -1;
    }
    sess = g_new0(CryptoDevBackendBuiltinSession, 1);
    sess->cipher = cipher;
    sess->direction = sess_info->direction;
    sess->type = sess_info->op_type;
    builtin->sessions[index] = sess;
    return index;
 }
 static int64_t cryptodev_builtin_sym_create_session(
           CryptoDevBackend *backend,
           CryptoDevBackendSymSessionInfo *sess_info,
           uint32_t queue_index, Error **errp)
 {
    CryptoDevBackendBuiltin *builtin =
                      CRYPTODEV_BACKEND_BUILTIN(backend);
    int64_t session_id = -1;
    int ret;
    switch (sess_info->op_code) {
    case VIRTIO_CRYPTO_CIPHER_CREATE_SESSION:
        ret = cryptodev_builtin_create_cipher_session(
                           builtin, sess_info, errp);
        if (ret < 0) {
            return ret;
        } else {
            session_id = ret;
        }
        break;
    case VIRTIO_CRYPTO_HASH_CREATE_SESSION:
    case VIRTIO_CRYPTO_MAC_CREATE_SESSION:
    default:
        error_setg(errp, "Unsupported opcode :%" PRIu32 "",
                   sess_info->op_code);
        return -1;
    }
    return session_id;
 }
 static int cryptodev_builtin_sym_close_session(
           CryptoDevBackend *backend,
           uint64_t session_id,
           uint32_t queue_index, Error **errp)
 {
    CryptoDevBackendBuiltin *builtin =
                      CRYPTODEV_BACKEND_BUILTIN(backend);
    if (session_id >= MAX_NUM_SESSIONS ||
              builtin->sessions[session_id] == NULL) {
        error_setg(errp, "Cannot find a valid session id: %" PRIu64 "",
                      session_id);
        return -1;
    }
    qcrypto_cipher_free(builtin->sessions[session_id]->cipher);
    g_free(builtin->sessions[session_id]);
    builtin->sessions[session_id] = NULL;
    return 0;
 }
 static int cryptodev_builtin_sym_operation(
                 CryptoDevBackend *backend,
                 CryptoDevBackendSymOpInfo *op_info,
                 uint32_t queue_index, Error **errp)
 {
    CryptoDevBackendBuiltin *builtin =
                      CRYPTODEV_BACKEND_BUILTIN(backend);
    CryptoDevBackendBuiltinSession *sess;
    int ret;
    if (op_info->session_id >= MAX_NUM_SESSIONS ||
              builtin->sessions[op_info->session_id] == NULL) {
        error_setg(errp, "Cannot find a valid session id: %" PRIu64 "",
                   op_info->session_id);
        return -VIRTIO_CRYPTO_INVSESS;
    }
    if (op_info->op_type == VIRTIO_CRYPTO_SYM_OP_ALGORITHM_CHAINING) {
        error_setg(errp,
               "Algorithm chain is unsupported for cryptdoev-builtin");
        return -VIRTIO_CRYPTO_NOTSUPP;
    }
    sess = builtin->sessions[op_info->session_id];
    ret = qcrypto_cipher_setiv(sess->cipher, op_info->iv,
                               op_info->iv_len, errp);
    if (ret < 0) {
        return -VIRTIO_CRYPTO_ERR;
    }
    if (sess->direction == VIRTIO_CRYPTO_OP_ENCRYPT) {
        ret = qcrypto_cipher_encrypt(sess->cipher, op_info->src,
                                     op_info->dst, op_info->src_len, errp);
        if (ret < 0) {
            return -VIRTIO_CRYPTO_ERR;
        }
    } else {
        ret = qcrypto_cipher_decrypt(sess->cipher, op_info->src,
                                     op_info->dst, op_info->src_len, errp);
        if (ret < 0) {
            return -VIRTIO_CRYPTO_ERR;
        }
    }
    return VIRTIO_CRYPTO_OK;
 }
 static void cryptodev_builtin_cleanup(
             CryptoDevBackend *backend,
             Error **errp)
 {
    CryptoDevBackendBuiltin *builtin =
                      CRYPTODEV_BACKEND_BUILTIN(backend);
    size_t i;
    int queues = backend->conf.peers.queues;
    CryptoDevBackendClient *cc;
    for (i = 0; i < MAX_NUM_SESSIONS; i++) {
        if (builtin->sessions[i] != NULL) {
            cryptodev_builtin_sym_close_session(
                    backend, i, 0, errp);
        }
    }
    assert(queues == 1);
    for (i = 0; i < queues; i++) {
        cc = backend->conf.peers.ccs[i];
        if (cc) {
            cryptodev_backend_free_client(cc);
            backend->conf.peers.ccs[i] = NULL;
        }
    }
    cryptodev_backend_set_ready(backend, false);
 }
 static void
 cryptodev_builtin_class_init(ObjectClass *oc, void *data)
 {
    CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_CLASS(oc);
    bc->init = cryptodev_builtin_init;
    bc->cleanup = cryptodev_builtin_cleanup;
    bc->create_session = cryptodev_builtin_sym_create_session;
    bc->close_session = cryptodev_builtin_sym_close_session;
    bc->do_sym_op = cryptodev_builtin_sym_operation;
 }
 static const TypeInfo cryptodev_builtin_info = {
    .name = TYPE_CRYPTODEV_BACKEND_BUILTIN,
    .parent = TYPE_CRYPTODEV_BACKEND,
    .class_init = cryptodev_builtin_class_init,
    .instance_size = sizeof(CryptoDevBackendBuiltin),
 };
 static void
 cryptodev_builtin_register_types(void)
 {
    type_register_static(&cryptodev_builtin_info);
 }
 type_init(cryptodev_builtin_register_types);
--- a/backends/cryptodev.c
+++ b/backends/cryptodev.c
@@ -1,271 +0,0 @@
 /*
 * QEMU Crypto Device Implementation
 *
 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
 *
 * Authors:
 *    Gonglei <arei.gonglei@huawei.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 *
 */
 #include "qemu/osdep.h"
 #include "sysemu/cryptodev.h"
 #include "hw/boards.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "qapi-types.h"
 #include "qapi-visit.h"
 #include "qemu/config-file.h"
 #include "qom/object_interfaces.h"
 #include "hw/virtio/virtio-crypto.h"
 static QTAILQ_HEAD(, CryptoDevBackendClient) crypto_clients;
 CryptoDevBackendClient *
 cryptodev_backend_new_client(const char *model,
                                    const char *name)
 {
    CryptoDevBackendClient *cc;
    cc = g_malloc0(sizeof(CryptoDevBackendClient));
    cc->model = g_strdup(model);
    if (name) {
        cc->name = g_strdup(name);
    }
    QTAILQ_INSERT_TAIL(&crypto_clients, cc, next);
    return cc;
 }
 void cryptodev_backend_free_client(
                  CryptoDevBackendClient *cc)
 {
    QTAILQ_REMOVE(&crypto_clients, cc, next);
    g_free(cc->name);
    g_free(cc->model);
    g_free(cc->info_str);
    g_free(cc);
 }
 void cryptodev_backend_cleanup(
             CryptoDevBackend *backend,
             Error **errp)
 {
    CryptoDevBackendClass *bc =
                  CRYPTODEV_BACKEND_GET_CLASS(backend);
    if (bc->cleanup) {
        bc->cleanup(backend, errp);
    }
 }
 int64_t cryptodev_backend_sym_create_session(
           CryptoDevBackend *backend,
           CryptoDevBackendSymSessionInfo *sess_info,
           uint32_t queue_index, Error **errp)
 {
    CryptoDevBackendClass *bc =
                      CRYPTODEV_BACKEND_GET_CLASS(backend);
    if (bc->create_session) {
        return bc->create_session(backend, sess_info, queue_index, errp);
    }
    return -1;
 }
 int cryptodev_backend_sym_close_session(
           CryptoDevBackend *backend,
           uint64_t session_id,
           uint32_t queue_index, Error **errp)
 {
    CryptoDevBackendClass *bc =
                      CRYPTODEV_BACKEND_GET_CLASS(backend);
    if (bc->close_session) {
        return bc->close_session(backend, session_id, queue_index, errp);
    }
    return -1;
 }
 static int cryptodev_backend_sym_operation(
                 CryptoDevBackend *backend,
                 CryptoDevBackendSymOpInfo *op_info,
                 uint32_t queue_index, Error **errp)
 {
    CryptoDevBackendClass *bc =
                      CRYPTODEV_BACKEND_GET_CLASS(backend);
    if (bc->do_sym_op) {
        return bc->do_sym_op(backend, op_info, queue_index, errp);
    }
    return -VIRTIO_CRYPTO_ERR;
 }
 int cryptodev_backend_crypto_operation(
                 CryptoDevBackend *backend,
                 void *opaque,
                 uint32_t queue_index, Error **errp)
 {
    VirtIOCryptoReq *req = opaque;
    if (req->flags == CRYPTODEV_BACKEND_ALG_SYM) {
        CryptoDevBackendSymOpInfo *op_info;
        op_info = req->u.sym_op_info;
        return cryptodev_backend_sym_operation(backend,
                         op_info, queue_index, errp);
    } else {
        error_setg(errp, "Unsupported cryptodev alg type: %" PRIu32 "",
                   req->flags);
       return -VIRTIO_CRYPTO_NOTSUPP;
    }
    return -VIRTIO_CRYPTO_ERR;
 }
 static void
 cryptodev_backend_get_queues(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
 {
    CryptoDevBackend *backend = CRYPTODEV_BACKEND(obj);
    uint32_t value = backend->conf.peers.queues;
    visit_type_uint32(v, name, &value, errp);
 }
 static void
 cryptodev_backend_set_queues(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
 {
    CryptoDevBackend *backend = CRYPTODEV_BACKEND(obj);
    Error *local_err = NULL;
    uint32_t value;
    visit_type_uint32(v, name, &value, &local_err);
    if (local_err) {
        goto out;
    }
    if (!value) {
        error_setg(&local_err, "Property '%s.%s' doesn't take value '%"
                   PRIu32 "'", object_get_typename(obj), name, value);
        goto out;
    }
    backend->conf.peers.queues = value;
 out:
    error_propagate(errp, local_err);
 }
 static void
 cryptodev_backend_complete(UserCreatable *uc, Error **errp)
 {
    CryptoDevBackend *backend = CRYPTODEV_BACKEND(uc);
    CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_GET_CLASS(uc);
    Error *local_err = NULL;
    if (bc->init) {
        bc->init(backend, &local_err);
        if (local_err) {
            goto out;
        }
    }
    return;
 out:
    error_propagate(errp, local_err);
 }
 void cryptodev_backend_set_used(CryptoDevBackend *backend, bool used)
 {
    backend->is_used = used;
 }
 bool cryptodev_backend_is_used(CryptoDevBackend *backend)
 {
    return backend->is_used;
 }
 void cryptodev_backend_set_ready(CryptoDevBackend *backend, bool ready)
 {
    backend->ready = ready;
 }
 bool cryptodev_backend_is_ready(CryptoDevBackend *backend)
 {
    return backend->ready;
 }
 static bool
 cryptodev_backend_can_be_deleted(UserCreatable *uc, Error **errp)
 {
    return !cryptodev_backend_is_used(CRYPTODEV_BACKEND(uc));
 }
 static void cryptodev_backend_instance_init(Object *obj)
 {
    object_property_add(obj, "queues", "int",
                          cryptodev_backend_get_queues,
                          cryptodev_backend_set_queues,
                          NULL, NULL, NULL);
    /* Initialize devices' queues property to 1 */
    object_property_set_int(obj, 1, "queues", NULL);
 }
 static void cryptodev_backend_finalize(Object *obj)
 {
    CryptoDevBackend *backend = CRYPTODEV_BACKEND(obj);
    cryptodev_backend_cleanup(backend, NULL);
 }
 static void
 cryptodev_backend_class_init(ObjectClass *oc, void *data)
 {
    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
    ucc->complete = cryptodev_backend_complete;
    ucc->can_be_deleted = cryptodev_backend_can_be_deleted;
    QTAILQ_INIT(&crypto_clients);
 }
 static const TypeInfo cryptodev_backend_info = {
    .name = TYPE_CRYPTODEV_BACKEND,
    .parent = TYPE_OBJECT,
    .instance_size = sizeof(CryptoDevBackend),
    .instance_init = cryptodev_backend_instance_init,
    .instance_finalize = cryptodev_backend_finalize,
    .class_size = sizeof(CryptoDevBackendClass),
    .class_init = cryptodev_backend_class_init,
    .interfaces = (InterfaceInfo[]) {
        { TYPE_USER_CREATABLE },
        { }
    }
 };
 static void
 cryptodev_backend_register_types(void)
 {
    type_register_static(&cryptodev_backend_info);
 }
 type_init(cryptodev_backend_register_types);
--- a/backends/hostmem-file.c
+++ b/backends/hostmem-file.c
@@ -1,141 +0,0 @@
 /*
 * QEMU Host Memory Backend for hugetlbfs
 *
 * Copyright (C) 2013-2014 Red Hat Inc
 *
 * Authors:
 *   Paolo Bonzini <pbonzini@redhat.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
 #include "sysemu/hostmem.h"
 #include "sysemu/sysemu.h"
 #include "qom/object_interfaces.h"
 /* hostmem-file.c */
 /**
 * @TYPE_MEMORY_BACKEND_FILE:
 * name of backend that uses mmap on a file descriptor
 */
 #define TYPE_MEMORY_BACKEND_FILE "memory-backend-file"
 #define MEMORY_BACKEND_FILE(obj) \
    OBJECT_CHECK(HostMemoryBackendFile, (obj), TYPE_MEMORY_BACKEND_FILE)
 typedef struct HostMemoryBackendFile HostMemoryBackendFile;
 struct HostMemoryBackendFile {
    HostMemoryBackend parent_obj;
    bool share;
    char *mem_path;
 };
 static void
 file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(backend);
    if (!backend->size) {
        error_setg(errp, "can't create backend with size 0");
        return;
    }
    if (!fb->mem_path) {
        error_setg(errp, "mem-path property not set");
        return;
    }
 #ifndef CONFIG_LINUX
    error_setg(errp, "-mem-path not supported on this host");
 #else
    if (!memory_region_size(&backend->mr)) {
        gchar *path;
        backend->force_prealloc = mem_prealloc;
        path = object_get_canonical_path(OBJECT(backend));
        memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),
                                 path,
                                 backend->size, fb->share,
                                 fb->mem_path, errp);
        g_free(path);
    }
 #endif
 }
 static char *get_mem_path(Object *o, Error **errp)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
    return g_strdup(fb->mem_path);
 }
 static void set_mem_path(Object *o, const char *str, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
    if (memory_region_size(&backend->mr)) {
        error_setg(errp, "cannot change property value");
        return;
    }
    g_free(fb->mem_path);
    fb->mem_path = g_strdup(str);
 }
 static bool file_memory_backend_get_share(Object *o, Error **errp)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
    return fb->share;
 }
 static void file_memory_backend_set_share(Object *o, bool value, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
    if (memory_region_size(&backend->mr)) {
        error_setg(errp, "cannot change property value");
        return;
    }
    fb->share = value;
 }
 static void
 file_backend_class_init(ObjectClass *oc, void *data)
 {
    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
    bc->alloc = file_backend_memory_alloc;
    object_class_property_add_bool(oc, "share",
        file_memory_backend_get_share, file_memory_backend_set_share,
        &error_abort);
    object_class_property_add_str(oc, "mem-path",
        get_mem_path, set_mem_path,
        &error_abort);
 }
 static void file_backend_instance_finalize(Object *o)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
    g_free(fb->mem_path);
 }
 static const TypeInfo file_backend_info = {
    .name = TYPE_MEMORY_BACKEND_FILE,
    .parent = TYPE_MEMORY_BACKEND,
    .class_init = file_backend_class_init,
    .instance_finalize = file_backend_instance_finalize,
    .instance_size = sizeof(HostMemoryBackendFile),
 };
 static void register_types(void)
 {
    type_register_static(&file_backend_info);
 }
 type_init(register_types);
--- a/backends/hostmem-ram.c
+++ b/backends/hostmem-ram.c
@@ -1,55 +0,0 @@
 /*
 * QEMU Host Memory Backend
 *
 * Copyright (C) 2013-2014 Red Hat Inc
 *
 * Authors:
 *   Igor Mammedov <imammedo@redhat.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "sysemu/hostmem.h"
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
 #define TYPE_MEMORY_BACKEND_RAM "memory-backend-ram"
 static void
 ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 {
    char *path;
    if (!backend->size) {
        error_setg(errp, "can't create backend with size 0");
        return;
    }
    path = object_get_canonical_path_component(OBJECT(backend));
    memory_region_init_ram(&backend->mr, OBJECT(backend), path,
                           backend->size, errp);
    g_free(path);
 }
 static void
 ram_backend_class_init(ObjectClass *oc, void *data)
 {
    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
    bc->alloc = ram_backend_memory_alloc;
 }
 static const TypeInfo ram_backend_info = {
    .name = TYPE_MEMORY_BACKEND_RAM,
    .parent = TYPE_MEMORY_BACKEND,
    .class_init = ram_backend_class_init,
 };
 static void register_types(void)
 {
    type_register_static(&ram_backend_info);
 }
 type_init(register_types);
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -1,427 +0,0 @@
 /*
 * QEMU Host Memory Backend
 *
 * Copyright (C) 2013-2014 Red Hat Inc
 *
 * Authors:
 *   Igor Mammedov <imammedo@redhat.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "sysemu/hostmem.h"
 #include "hw/boards.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "qapi-types.h"
 #include "qapi-visit.h"
 #include "qemu/config-file.h"
 #include "qom/object_interfaces.h"
 #ifdef CONFIG_NUMA
 #include <numaif.h>
 QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_DEFAULT != MPOL_DEFAULT);
 QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_PREFERRED != MPOL_PREFERRED);
 QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_BIND != MPOL_BIND);
 QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_INTERLEAVE != MPOL_INTERLEAVE);
 #endif
 static void
 host_memory_backend_get_size(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    uint64_t value = backend->size;
    visit_type_size(v, name, &value, errp);
 }
 static void
 host_memory_backend_set_size(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    Error *local_err = NULL;
    uint64_t value;
    if (memory_region_size(&backend->mr)) {
        error_setg(&local_err, "cannot change property value");
        goto out;
    }
    visit_type_size(v, name, &value, &local_err);
    if (local_err) {
        goto out;
    }
    if (!value) {
        error_setg(&local_err, "Property '%s.%s' doesn't take value '%"
                   PRIu64 "'", object_get_typename(obj), name, value);
        goto out;
    }
    backend->size = value;
 out:
    error_propagate(errp, local_err);
 }
 static uint16List **host_memory_append_node(uint16List **node,
                                            unsigned long value)
 {
     *node = g_malloc0(sizeof(**node));
     (*node)->value = value;
     return &(*node)->next;
 }
 static void
 host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
                                   void *opaque, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    uint16List *host_nodes = NULL;
    uint16List **node = &host_nodes;
    unsigned long value;
    value = find_first_bit(backend->host_nodes, MAX_NODES);
    node = host_memory_append_node(node, value);
    if (value == MAX_NODES) {
        goto out;
    }
    do {
        value = find_next_bit(backend->host_nodes, MAX_NODES, value + 1);
        if (value == MAX_NODES) {
            break;
        }
        node = host_memory_append_node(node, value);
    } while (true);
 out:
    visit_type_uint16List(v, name, &host_nodes, errp);
 }
 static void
 host_memory_backend_set_host_nodes(Object *obj, Visitor *v, const char *name,
                                   void *opaque, Error **errp)
 {
 #ifdef CONFIG_NUMA
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    uint16List *l = NULL;
    visit_type_uint16List(v, name, &l, errp);
    while (l) {
        bitmap_set(backend->host_nodes, l->value, 1);
        l = l->next;
    }
 #else
    error_setg(errp, "NUMA node binding are not supported by this QEMU");
 #endif
 }
 static int
 host_memory_backend_get_policy(Object *obj, Error **errp G_GNUC_UNUSED)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    return backend->policy;
 }
 static void
 host_memory_backend_set_policy(Object *obj, int policy, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    backend->policy = policy;
 #ifndef CONFIG_NUMA
    if (policy != HOST_MEM_POLICY_DEFAULT) {
        error_setg(errp, "NUMA policies are not supported by this QEMU");
    }
 #endif
 }
 static bool host_memory_backend_get_merge(Object *obj, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    return backend->merge;
 }
 static void host_memory_backend_set_merge(Object *obj, bool value, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    if (!memory_region_size(&backend->mr)) {
        backend->merge = value;
        return;
    }
    if (value != backend->merge) {
        void *ptr = memory_region_get_ram_ptr(&backend->mr);
        uint64_t sz = memory_region_size(&backend->mr);
        qemu_madvise(ptr, sz,
                     value ? QEMU_MADV_MERGEABLE : QEMU_MADV_UNMERGEABLE);
        backend->merge = value;
    }
 }
 static bool host_memory_backend_get_dump(Object *obj, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    return backend->dump;
 }
 static void host_memory_backend_set_dump(Object *obj, bool value, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    if (!memory_region_size(&backend->mr)) {
        backend->dump = value;
        return;
    }
    if (value != backend->dump) {
        void *ptr = memory_region_get_ram_ptr(&backend->mr);
        uint64_t sz = memory_region_size(&backend->mr);
        qemu_madvise(ptr, sz,
                     value ? QEMU_MADV_DODUMP : QEMU_MADV_DONTDUMP);
        backend->dump = value;
    }
 }
 static bool host_memory_backend_get_prealloc(Object *obj, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    return backend->prealloc || backend->force_prealloc;
 }
 static void host_memory_backend_set_prealloc(Object *obj, bool value,
                                             Error **errp)
 {
    Error *local_err = NULL;
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    if (backend->force_prealloc) {
        if (value) {
            error_setg(errp,
                       "remove -mem-prealloc to use the prealloc property");
            return;
        }
    }
    if (!memory_region_size(&backend->mr)) {
        backend->prealloc = value;
        return;
    }
    if (value && !backend->prealloc) {
        int fd = memory_region_get_fd(&backend->mr);
        void *ptr = memory_region_get_ram_ptr(&backend->mr);
        uint64_t sz = memory_region_size(&backend->mr);
        os_mem_prealloc(fd, ptr, sz, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
        backend->prealloc = true;
    }
 }
 static void host_memory_backend_init(Object *obj)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
    MachineState *machine = MACHINE(qdev_get_machine());
    backend->merge = machine_mem_merge(machine);
    backend->dump = machine_dump_guest_core(machine);
    backend->prealloc = mem_prealloc;
 }
 MemoryRegion *
 host_memory_backend_get_memory(HostMemoryBackend *backend, Error **errp)
 {
    return memory_region_size(&backend->mr) ? &backend->mr : NULL;
 }
 void host_memory_backend_set_mapped(HostMemoryBackend *backend, bool mapped)
 {
    backend->is_mapped = mapped;
 }
 bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
 {
    return backend->is_mapped;
 }
 static void
 host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(uc);
    HostMemoryBackendClass *bc = MEMORY_BACKEND_GET_CLASS(uc);
    Error *local_err = NULL;
    void *ptr;
    uint64_t sz;
    if (bc->alloc) {
        bc->alloc(backend, &local_err);
        if (local_err) {
            goto out;
        }
        ptr = memory_region_get_ram_ptr(&backend->mr);
        sz = memory_region_size(&backend->mr);
        if (backend->merge) {
            qemu_madvise(ptr, sz, QEMU_MADV_MERGEABLE);
        }
        if (!backend->dump) {
            qemu_madvise(ptr, sz, QEMU_MADV_DONTDUMP);
        }
 #ifdef CONFIG_NUMA
        unsigned long lastbit = find_last_bit(backend->host_nodes, MAX_NODES);
        /* lastbit == MAX_NODES means maxnode = 0 */
        unsigned long maxnode = (lastbit + 1) % (MAX_NODES + 1);
        /* ensure policy won't be ignored in case memory is preallocated
         * before mbind(). note: MPOL_MF_STRICT is ignored on hugepages so
         * this doesn't catch hugepage case. */
        unsigned flags = MPOL_MF_STRICT | MPOL_MF_MOVE;
        /* check for invalid host-nodes and policies and give more verbose
         * error messages than mbind(). */
        if (maxnode && backend->policy == MPOL_DEFAULT) {
            error_setg(errp, "host-nodes must be empty for policy default,"
                       " or you should explicitly specify a policy other"
                       " than default");
            return;
        } else if (maxnode == 0 && backend->policy != MPOL_DEFAULT) {
            error_setg(errp, "host-nodes must be set for policy %s",
                       HostMemPolicy_lookup[backend->policy]);
            return;
        }
        /* We can have up to MAX_NODES nodes, but we need to pass maxnode+1
         * as argument to mbind() due to an old Linux bug (feature?) which
         * cuts off the last specified node. This means backend->host_nodes
         * must have MAX_NODES+1 bits available.
         */
        assert(sizeof(backend->host_nodes) >=
               BITS_TO_LONGS(MAX_NODES + 1) * sizeof(unsigned long));
        assert(maxnode <= MAX_NODES);
        if (mbind(ptr, sz, backend->policy,
                  maxnode ? backend->host_nodes : NULL, maxnode + 1, flags)) {
            if (backend->policy != MPOL_DEFAULT || errno != ENOSYS) {
                error_setg_errno(errp, errno,
                                 "cannot bind memory to host NUMA nodes");
                return;
            }
        }
 #endif
        /* Preallocate memory after the NUMA policy has been instantiated.
         * This is necessary to guarantee memory is allocated with
         * specified NUMA policy in place.
         */
        if (backend->prealloc) {
            os_mem_prealloc(memory_region_get_fd(&backend->mr), ptr, sz,
                            &local_err);
            if (local_err) {
                goto out;
            }
        }
    }
 out:
    error_propagate(errp, local_err);
 }
 static bool
 host_memory_backend_can_be_deleted(UserCreatable *uc, Error **errp)
 {
    if (host_memory_backend_is_mapped(MEMORY_BACKEND(uc))) {
        return false;
    } else {
        return true;
    }
 }
 static char *get_id(Object *o, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    return g_strdup(backend->id);
 }
 static void set_id(Object *o, const char *str, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    if (backend->id) {
        error_setg(errp, "cannot change property value");
        return;
    }
    backend->id = g_strdup(str);
 }
 static void
 host_memory_backend_class_init(ObjectClass *oc, void *data)
 {
    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
    ucc->complete = host_memory_backend_memory_complete;
    ucc->can_be_deleted = host_memory_backend_can_be_deleted;
    object_class_property_add_bool(oc, "merge",
        host_memory_backend_get_merge,
        host_memory_backend_set_merge, &error_abort);
    object_class_property_add_bool(oc, "dump",
        host_memory_backend_get_dump,
        host_memory_backend_set_dump, &error_abort);
    object_class_property_add_bool(oc, "prealloc",
        host_memory_backend_get_prealloc,
        host_memory_backend_set_prealloc, &error_abort);
    object_class_property_add(oc, "size", "int",
        host_memory_backend_get_size,
        host_memory_backend_set_size,
        NULL, NULL, &error_abort);
    object_class_property_add(oc, "host-nodes", "int",
        host_memory_backend_get_host_nodes,
        host_memory_backend_set_host_nodes,
        NULL, NULL, &error_abort);
    object_class_property_add_enum(oc, "policy", "HostMemPolicy",
        HostMemPolicy_lookup,
        host_memory_backend_get_policy,
        host_memory_backend_set_policy, &error_abort);
    object_class_property_add_str(oc, "id", get_id, set_id, &error_abort);
 }
 static void host_memory_backend_finalize(Object *o)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    g_free(backend->id);
 }
 static const TypeInfo host_memory_backend_info = {
    .name = TYPE_MEMORY_BACKEND,
    .parent = TYPE_OBJECT,
    .abstract = true,
    .class_size = sizeof(HostMemoryBackendClass),
    .class_init = host_memory_backend_class_init,
    .instance_size = sizeof(HostMemoryBackend),
    .instance_init = host_memory_backend_init,
    .instance_finalize = host_memory_backend_finalize,
    .interfaces = (InterfaceInfo[]) {
        { TYPE_USER_CREATABLE },
        { }
    }
 };
 static void register_types(void)
 {
    type_register_static(&host_memory_backend_info);
 }
 type_init(register_types);
--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -1,190 +0,0 @@
 /*
 * QEMU Microsoft serial mouse emulation
 *
 * Copyright (c) 2008 Lubomir Rintel
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "sysemu/char.h"
 #include "ui/console.h"
 #include "ui/input.h"
 #define MSMOUSE_LO6(n) ((n) & 0x3f)
 #define MSMOUSE_HI2(n) (((n) & 0xc0) >> 6)
 typedef struct {
    Chardev parent;
    QemuInputHandlerState *hs;
    int axis[INPUT_AXIS__MAX];
    bool btns[INPUT_BUTTON__MAX];
    bool btnc[INPUT_BUTTON__MAX];
    uint8_t outbuf[32];
    int outlen;
 } MouseChardev;
 #define TYPE_CHARDEV_MSMOUSE "chardev-msmouse"
 #define MOUSE_CHARDEV(obj)                                      \
    OBJECT_CHECK(MouseChardev, (obj), TYPE_CHARDEV_MSMOUSE)
 static void msmouse_chr_accept_input(Chardev *chr)
 {
    MouseChardev *mouse = MOUSE_CHARDEV(chr);
    int len;
    len = qemu_chr_be_can_write(chr);
    if (len > mouse->outlen) {
        len = mouse->outlen;
    }
    if (!len) {
        return;
    }
    qemu_chr_be_write(chr, mouse->outbuf, len);
    mouse->outlen -= len;
    if (mouse->outlen) {
        memmove(mouse->outbuf, mouse->outbuf + len, mouse->outlen);
    }
 }
 static void msmouse_queue_event(MouseChardev *mouse)
 {
    unsigned char bytes[4] = { 0x40, 0x00, 0x00, 0x00 };
    int dx, dy, count = 3;
    dx = mouse->axis[INPUT_AXIS_X];
    mouse->axis[INPUT_AXIS_X] = 0;
    dy = mouse->axis[INPUT_AXIS_Y];
    mouse->axis[INPUT_AXIS_Y] = 0;
    /* Movement deltas */
    bytes[0] |= (MSMOUSE_HI2(dy) << 2) | MSMOUSE_HI2(dx);
    bytes[1] |= MSMOUSE_LO6(dx);
    bytes[2] |= MSMOUSE_LO6(dy);
    /* Buttons */
    bytes[0] |= (mouse->btns[INPUT_BUTTON_LEFT]   ? 0x20 : 0x00);
    bytes[0] |= (mouse->btns[INPUT_BUTTON_RIGHT]  ? 0x10 : 0x00);
    if (mouse->btns[INPUT_BUTTON_MIDDLE] ||
        mouse->btnc[INPUT_BUTTON_MIDDLE]) {
        bytes[3] |= (mouse->btns[INPUT_BUTTON_MIDDLE] ? 0x20 : 0x00);
        mouse->btnc[INPUT_BUTTON_MIDDLE] = false;
        count = 4;
    }
    if (mouse->outlen <= sizeof(mouse->outbuf) - count) {
        memcpy(mouse->outbuf + mouse->outlen, bytes, count);
        mouse->outlen += count;
    } else {
        /* queue full -> drop event */
    }
 }
 static void msmouse_input_event(DeviceState *dev, QemuConsole *src,
                                InputEvent *evt)
 {
    MouseChardev *mouse = MOUSE_CHARDEV(dev);
    InputMoveEvent *move;
    InputBtnEvent *btn;
    switch (evt->type) {
    case INPUT_EVENT_KIND_REL:
        move = evt->u.rel.data;
        mouse->axis[move->axis] += move->value;
        break;
    case INPUT_EVENT_KIND_BTN:
        btn = evt->u.btn.data;
        mouse->btns[btn->button] = btn->down;
        mouse->btnc[btn->button] = true;
        break;
    default:
        /* keep gcc happy */
        break;
    }
 }
 static void msmouse_input_sync(DeviceState *dev)
 {
    MouseChardev *mouse = MOUSE_CHARDEV(dev);
    Chardev *chr = CHARDEV(dev);
    msmouse_queue_event(mouse);
    msmouse_chr_accept_input(chr);
 }
 static int msmouse_chr_write(struct Chardev *s, const uint8_t *buf, int len)
 {
    /* Ignore writes to mouse port */
    return len;
 }
 static void char_msmouse_finalize(Object *obj)
 {
    MouseChardev *mouse = MOUSE_CHARDEV(obj);
    qemu_input_handler_unregister(mouse->hs);
 }
 static QemuInputHandler msmouse_handler = {
    .name  = "QEMU Microsoft Mouse",
    .mask  = INPUT_EVENT_MASK_BTN | INPUT_EVENT_MASK_REL,
    .event = msmouse_input_event,
    .sync  = msmouse_input_sync,
 };
 static void msmouse_chr_open(Chardev *chr,
                             ChardevBackend *backend,
                             bool *be_opened,
                             Error **errp)
 {
    MouseChardev *mouse = MOUSE_CHARDEV(chr);
    *be_opened = false;
    mouse->hs = qemu_input_handler_register((DeviceState *)mouse,
                                            &msmouse_handler);
 }
 static void char_msmouse_class_init(ObjectClass *oc, void *data)
 {
    ChardevClass *cc = CHARDEV_CLASS(oc);
    cc->open = msmouse_chr_open;
    cc->chr_write = msmouse_chr_write;
    cc->chr_accept_input = msmouse_chr_accept_input;
 }
 static const TypeInfo char_msmouse_type_info = {
    .name = TYPE_CHARDEV_MSMOUSE,
    .parent = TYPE_CHARDEV,
    .instance_size = sizeof(MouseChardev),
    .instance_finalize = char_msmouse_finalize,
    .class_init = char_msmouse_class_init,
 };
 static void register_types(void)
 {
    type_register_static(&char_msmouse_type_info);
 }
 type_init(register_types);
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -1,174 +0,0 @@
 /*
 * QEMU Random Number Generator Backend
 *
 * Copyright IBM, Corp. 2012
 *
 * Authors:
 *  Anthony Liguori   <aliguori@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "sysemu/rng.h"
 #include "sysemu/char.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #define TYPE_RNG_EGD "rng-egd"
 #define RNG_EGD(obj) OBJECT_CHECK(RngEgd, (obj), TYPE_RNG_EGD)
 typedef struct RngEgd
 {
    RngBackend parent;
    CharBackend chr;
    char *chr_name;
 } RngEgd;
 static void rng_egd_request_entropy(RngBackend *b, RngRequest *req)
 {
    RngEgd *s = RNG_EGD(b);
    size_t size = req->size;
    while (size > 0) {
        uint8_t header[2];
        uint8_t len = MIN(size, 255);
        /* synchronous entropy request */
        header[0] = 0x02;
        header[1] = len;
        /* XXX this blocks entire thread. Rewrite to use
         * qemu_chr_fe_write and background I/O callbacks */
        qemu_chr_fe_write_all(&s->chr, header, sizeof(header));
        size -= len;
    }
 }
 static int rng_egd_chr_can_read(void *opaque)
 {
    RngEgd *s = RNG_EGD(opaque);
    RngRequest *req;
    int size = 0;
    QSIMPLEQ_FOREACH(req, &s->parent.requests, next) {
        size += req->size - req->offset;
    }
    return size;
 }
 static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
 {
    RngEgd *s = RNG_EGD(opaque);
    size_t buf_offset = 0;
    while (size > 0 && !QSIMPLEQ_EMPTY(&s->parent.requests)) {
        RngRequest *req = QSIMPLEQ_FIRST(&s->parent.requests);
        int len = MIN(size, req->size - req->offset);
        memcpy(req->data + req->offset, buf + buf_offset, len);
        buf_offset += len;
        req->offset += len;
        size -= len;
        if (req->offset == req->size) {
            req->receive_entropy(req->opaque, req->data, req->size);
            rng_backend_finalize_request(&s->parent, req);
        }
    }
 }
 static void rng_egd_opened(RngBackend *b, Error **errp)
 {
    RngEgd *s = RNG_EGD(b);
    Chardev *chr;
    if (s->chr_name == NULL) {
        error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
                   "chardev", "a valid character device");
        return;
    }
    chr = qemu_chr_find(s->chr_name);
    if (chr == NULL) {
        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
                  "Device '%s' not found", s->chr_name);
        return;
    }
    if (!qemu_chr_fe_init(&s->chr, chr, errp)) {
        return;
    }
    /* FIXME we should resubmit pending requests when the CDS reconnects. */
    qemu_chr_fe_set_handlers(&s->chr, rng_egd_chr_can_read,
                             rng_egd_chr_read, NULL, s, NULL, true);
 }
 static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
 {
    RngBackend *b = RNG_BACKEND(obj);
    RngEgd *s = RNG_EGD(b);
    if (b->opened) {
        error_setg(errp, QERR_PERMISSION_DENIED);
    } else {
        g_free(s->chr_name);
        s->chr_name = g_strdup(value);
    }
 }
 static char *rng_egd_get_chardev(Object *obj, Error **errp)
 {
    RngEgd *s = RNG_EGD(obj);
    Chardev *chr = qemu_chr_fe_get_driver(&s->chr);
    if (chr && chr->label) {
        return g_strdup(chr->label);
    }
    return NULL;
 }
 static void rng_egd_init(Object *obj)
 {
    object_property_add_str(obj, "chardev",
                            rng_egd_get_chardev, rng_egd_set_chardev,
                            NULL);
 }
 static void rng_egd_finalize(Object *obj)
 {
    RngEgd *s = RNG_EGD(obj);
    qemu_chr_fe_deinit(&s->chr);
    g_free(s->chr_name);
 }
 static void rng_egd_class_init(ObjectClass *klass, void *data)
 {
    RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
    rbc->request_entropy = rng_egd_request_entropy;
    rbc->opened = rng_egd_opened;
 }
 static const TypeInfo rng_egd_info = {
    .name = TYPE_RNG_EGD,
    .parent = TYPE_RNG_BACKEND,
    .instance_size = sizeof(RngEgd),
    .class_init = rng_egd_class_init,
    .instance_init = rng_egd_init,
    .instance_finalize = rng_egd_finalize,
 };
 static void register_types(void)
 {
    type_register_static(&rng_egd_info);
 }
 type_init(register_types);
--- a/backends/rng-random.c
+++ b/backends/rng-random.c
@@ -1,153 +0,0 @@
 /*
 * QEMU Random Number Generator Backend
 *
 * Copyright IBM, Corp. 2012
 *
 * Authors:
 *  Anthony Liguori   <aliguori@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "sysemu/rng-random.h"
 #include "sysemu/rng.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/main-loop.h"
 struct RngRandom
 {
    RngBackend parent;
    int fd;
    char *filename;
 };
 /**
 * A simple and incomplete backend to request entropy from /dev/random.
 *
 * This backend exposes an additional "filename" property that can be used to
 * set the filename to use to open the backend.
 */
 static void entropy_available(void *opaque)
 {
    RngRandom *s = RNG_RANDOM(opaque);
    while (!QSIMPLEQ_EMPTY(&s->parent.requests)) {
        RngRequest *req = QSIMPLEQ_FIRST(&s->parent.requests);
        ssize_t len;
        len = read(s->fd, req->data, req->size);
        if (len < 0 && errno == EAGAIN) {
            return;
        }
        g_assert(len != -1);
        req->receive_entropy(req->opaque, req->data, len);
        rng_backend_finalize_request(&s->parent, req);
    }
    /* We've drained all requests, the fd handler can be reset. */
    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
 }
 static void rng_random_request_entropy(RngBackend *b, RngRequest *req)
 {
    RngRandom *s = RNG_RANDOM(b);
    if (QSIMPLEQ_EMPTY(&s->parent.requests)) {
        /* If there are no pending requests yet, we need to
         * install our fd handler. */
        qemu_set_fd_handler(s->fd, entropy_available, NULL, s);
    }
 }
 static void rng_random_opened(RngBackend *b, Error **errp)
 {
    RngRandom *s = RNG_RANDOM(b);
    if (s->filename == NULL) {
        error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
                   "filename", "a valid filename");
    } else {
        s->fd = qemu_open(s->filename, O_RDONLY | O_NONBLOCK);
        if (s->fd == -1) {
            error_setg_file_open(errp, errno, s->filename);
        }
    }
 }
 static char *rng_random_get_filename(Object *obj, Error **errp)
 {
    RngRandom *s = RNG_RANDOM(obj);
    return g_strdup(s->filename);
 }
 static void rng_random_set_filename(Object *obj, const char *filename,
                                 Error **errp)
 {
    RngBackend *b = RNG_BACKEND(obj);
    RngRandom *s = RNG_RANDOM(obj);
    if (b->opened) {
        error_setg(errp, QERR_PERMISSION_DENIED);
        return;
    }
    g_free(s->filename);
    s->filename = g_strdup(filename);
 }
 static void rng_random_init(Object *obj)
 {
    RngRandom *s = RNG_RANDOM(obj);
    object_property_add_str(obj, "filename",
                            rng_random_get_filename,
                            rng_random_set_filename,
                            NULL);
    s->filename = g_strdup("/dev/random");
    s->fd = -1;
 }
 static void rng_random_finalize(Object *obj)
 {
    RngRandom *s = RNG_RANDOM(obj);
    if (s->fd != -1) {
        qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
        qemu_close(s->fd);
    }
    g_free(s->filename);
 }
 static void rng_random_class_init(ObjectClass *klass, void *data)
 {
    RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
    rbc->request_entropy = rng_random_request_entropy;
    rbc->opened = rng_random_opened;
 }
 static const TypeInfo rng_random_info = {
    .name = TYPE_RNG_RANDOM,
    .parent = TYPE_RNG_BACKEND,
    .instance_size = sizeof(RngRandom),
    .class_init = rng_random_class_init,
    .instance_init = rng_random_init,
    .instance_finalize = rng_random_finalize,
 };
 static void register_types(void)
 {
    type_register_static(&rng_random_info);
 }
 type_init(register_types);
--- a/backends/rng.c
+++ b/backends/rng.c
@@ -1,148 +0,0 @@
 /*
 * QEMU Random Number Generator Backend
 *
 * Copyright IBM, Corp. 2012
 *
 * Authors:
 *  Anthony Liguori   <aliguori@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "sysemu/rng.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "qom/object_interfaces.h"
 void rng_backend_request_entropy(RngBackend *s, size_t size,
                                 EntropyReceiveFunc *receive_entropy,
                                 void *opaque)
 {
    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
    RngRequest *req;
    if (k->request_entropy) {
        req = g_malloc(sizeof(*req));
        req->offset = 0;
        req->size = size;
        req->receive_entropy = receive_entropy;
        req->opaque = opaque;
        req->data = g_malloc(req->size);
        k->request_entropy(s, req);
        QSIMPLEQ_INSERT_TAIL(&s->requests, req, next);
    }
 }
 static bool rng_backend_prop_get_opened(Object *obj, Error **errp)
 {
    RngBackend *s = RNG_BACKEND(obj);
    return s->opened;
 }
 static void rng_backend_complete(UserCreatable *uc, Error **errp)
 {
    object_property_set_bool(OBJECT(uc), true, "opened", errp);
 }
 static void rng_backend_prop_set_opened(Object *obj, bool value, Error **errp)
 {
    RngBackend *s = RNG_BACKEND(obj);
    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
    Error *local_err = NULL;
    if (value == s->opened) {
        return;
    }
    if (!value && s->opened) {
        error_setg(errp, QERR_PERMISSION_DENIED);
        return;
    }
    if (k->opened) {
        k->opened(s, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
    }
    s->opened = true;
 }
 static void rng_backend_free_request(RngRequest *req)
 {
    g_free(req->data);
    g_free(req);
 }
 static void rng_backend_free_requests(RngBackend *s)
 {
    RngRequest *req, *next;
    QSIMPLEQ_FOREACH_SAFE(req, &s->requests, next, next) {
        rng_backend_free_request(req);
    }
    QSIMPLEQ_INIT(&s->requests);
 }
 void rng_backend_finalize_request(RngBackend *s, RngRequest *req)
 {
    QSIMPLEQ_REMOVE(&s->requests, req, RngRequest, next);
    rng_backend_free_request(req);
 }
 static void rng_backend_init(Object *obj)
 {
    RngBackend *s = RNG_BACKEND(obj);
    QSIMPLEQ_INIT(&s->requests);
    object_property_add_bool(obj, "opened",
                             rng_backend_prop_get_opened,
                             rng_backend_prop_set_opened,
                             NULL);
 }
 static void rng_backend_finalize(Object *obj)
 {
    RngBackend *s = RNG_BACKEND(obj);
    rng_backend_free_requests(s);
 }
 static void rng_backend_class_init(ObjectClass *oc, void *data)
 {
    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
    ucc->complete = rng_backend_complete;
 }
 static const TypeInfo rng_backend_info = {
    .name = TYPE_RNG_BACKEND,
    .parent = TYPE_OBJECT,
    .instance_size = sizeof(RngBackend),
    .instance_init = rng_backend_init,
    .instance_finalize = rng_backend_finalize,
    .class_size = sizeof(RngBackendClass),
    .class_init = rng_backend_class_init,
    .abstract = true,
    .interfaces = (InterfaceInfo[]) {
        { TYPE_USER_CREATABLE },
        { }
    }
 };
 static void register_types(void)
 {
    type_register_static(&rng_backend_info);
 }
 type_init(register_types);
--- a/backends/testdev.c
+++ b/backends/testdev.c
@@ -1,129 +0,0 @@
 /*
 * QEMU Char Device for testsuite control
 *
 * Copyright (c) 2014 Red Hat, Inc.
 *
 * Author: Paolo Bonzini <pbonzini@redhat.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "sysemu/char.h"
 #define BUF_SIZE 32
 typedef struct {
    Chardev parent;
    uint8_t in_buf[32];
    int in_buf_used;
 } TestdevChardev;
 #define TYPE_CHARDEV_TESTDEV "chardev-testdev"
 #define TESTDEV_CHARDEV(obj)                                    \
    OBJECT_CHECK(TestdevChardev, (obj), TYPE_CHARDEV_TESTDEV)
 /* Try to interpret a whole incoming packet */
 static int testdev_eat_packet(TestdevChardev *testdev)
 {
    const uint8_t *cur = testdev->in_buf;
    int len = testdev->in_buf_used;
    uint8_t c;
    int arg;
 #define EAT(c) do { \
    if (!len--) {   \
        return 0;   \
    }               \
    c = *cur++;     \
 } while (0)
    EAT(c);
    while (isspace(c)) {
        EAT(c);
    }
    arg = 0;
    while (isdigit(c)) {
        arg = arg * 10 + c - '0';
        EAT(c);
    }
    while (isspace(c)) {
        EAT(c);
    }
    switch (c) {
    case 'q':
        exit((arg << 1) | 1);
        break;
    default:
        break;
    }
    return cur - testdev->in_buf;
 }
 /* The other end is writing some data.  Store it and try to interpret */
 static int testdev_chr_write(Chardev *chr, const uint8_t *buf, int len)
 {
    TestdevChardev *testdev = TESTDEV_CHARDEV(chr);
    int tocopy, eaten, orig_len = len;
    while (len) {
        /* Complete our buffer as much as possible */
        tocopy = MIN(len, BUF_SIZE - testdev->in_buf_used);
        memcpy(testdev->in_buf + testdev->in_buf_used, buf, tocopy);
        testdev->in_buf_used += tocopy;
        buf += tocopy;
        len -= tocopy;
        /* Interpret it as much as possible */
        while (testdev->in_buf_used > 0 &&
               (eaten = testdev_eat_packet(testdev)) > 0) {
            memmove(testdev->in_buf, testdev->in_buf + eaten,
                    testdev->in_buf_used - eaten);
            testdev->in_buf_used -= eaten;
        }
    }
    return orig_len;
 }
 static void char_testdev_class_init(ObjectClass *oc, void *data)
 {
    ChardevClass *cc = CHARDEV_CLASS(oc);
    cc->chr_write = testdev_chr_write;
 }
 static const TypeInfo char_testdev_type_info = {
    .name = TYPE_CHARDEV_TESTDEV,
    .parent = TYPE_CHARDEV,
    .instance_size = sizeof(TestdevChardev),
    .class_init = char_testdev_class_init,
 };
 static void register_types(void)
 {
    type_register_static(&char_testdev_type_info);
 }
 type_init(register_types);
--- a/backends/tpm.c
+++ b/backends/tpm.c
@@ -1,198 +0,0 @@
 /*
 * QEMU TPM Backend
 *
 * Copyright IBM, Corp. 2013
 *
 * Authors:
 *  Stefan Berger   <stefanb@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 * Based on backends/rng.c by Anthony Liguori
 */
 #include "qemu/osdep.h"
 #include "sysemu/tpm_backend.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "sysemu/tpm.h"
 #include "qemu/thread.h"
 #include "sysemu/tpm_backend_int.h"
 enum TpmType tpm_backend_get_type(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->type;
 }
 const char *tpm_backend_get_desc(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->desc();
 }
 void tpm_backend_destroy(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    k->ops->destroy(s);
 }
 int tpm_backend_init(TPMBackend *s, TPMState *state,
                     TPMRecvDataCB *datacb)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->init(s, state, datacb);
 }
 int tpm_backend_startup_tpm(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->startup_tpm(s);
 }
 bool tpm_backend_had_startup_error(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->had_startup_error(s);
 }
 size_t tpm_backend_realloc_buffer(TPMBackend *s, TPMSizedBuffer *sb)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->realloc_buffer(sb);
 }
 void tpm_backend_deliver_request(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    k->ops->deliver_request(s);
 }
 void tpm_backend_reset(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    k->ops->reset(s);
 }
 void tpm_backend_cancel_cmd(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    k->ops->cancel_cmd(s);
 }
 bool tpm_backend_get_tpm_established_flag(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->get_tpm_established_flag(s);
 }
 int tpm_backend_reset_tpm_established_flag(TPMBackend *s, uint8_t locty)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->reset_tpm_established_flag(s, locty);
 }
 TPMVersion tpm_backend_get_tpm_version(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    return k->ops->get_tpm_version(s);
 }
 static bool tpm_backend_prop_get_opened(Object *obj, Error **errp)
 {
    TPMBackend *s = TPM_BACKEND(obj);
    return s->opened;
 }
 void tpm_backend_open(TPMBackend *s, Error **errp)
 {
    object_property_set_bool(OBJECT(s), true, "opened", errp);
 }
 static void tpm_backend_prop_set_opened(Object *obj, bool value, Error **errp)
 {
    TPMBackend *s = TPM_BACKEND(obj);
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
    Error *local_err = NULL;
    if (value == s->opened) {
        return;
    }
    if (!value && s->opened) {
        error_setg(errp, QERR_PERMISSION_DENIED);
        return;
    }
    if (k->opened) {
        k->opened(s, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
    }
    s->opened = true;
 }
 static void tpm_backend_instance_init(Object *obj)
 {
    object_property_add_bool(obj, "opened",
                             tpm_backend_prop_get_opened,
                             tpm_backend_prop_set_opened,
                             NULL);
 }
 void tpm_backend_thread_deliver_request(TPMBackendThread *tbt)
 {
   g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_PROCESS_CMD, NULL);
 }
 void tpm_backend_thread_create(TPMBackendThread *tbt,
                               GFunc func, gpointer user_data)
 {
    if (!tbt->pool) {
        tbt->pool = g_thread_pool_new(func, user_data, 1, TRUE, NULL);
        g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_INIT, NULL);
    }
 }
 void tpm_backend_thread_end(TPMBackendThread *tbt)
 {
    if (tbt->pool) {
        g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_END, NULL);
        g_thread_pool_free(tbt->pool, FALSE, TRUE);
        tbt->pool = NULL;
    }
 }
 static const TypeInfo tpm_backend_info = {
    .name = TYPE_TPM_BACKEND,
    .parent = TYPE_OBJECT,
    .instance_size = sizeof(TPMBackend),
    .instance_init = tpm_backend_instance_init,
    .class_size = sizeof(TPMBackendClass),
    .abstract = true,
 };
 static void register_types(void)
 {
    type_register_static(&tpm_backend_info);
 }
 type_init(register_types);
--- a/backends/trace-events
+++ b/backends/trace-events
@@ -1,10 +0,0 @@
 # See docs/tracing.txt for syntax documentation.
 # backends/wctablet.c
 wct_init(void) ""
 wct_cmd_re(void) ""
 wct_cmd_st(void) ""
 wct_cmd_sp(void) ""
 wct_cmd_ts(int input) "0x%02x"
 wct_cmd_other(const char *cmd) "%s"
 wct_speed(int speed) "%d"
--- a/backends/wctablet.c
+++ b/backends/wctablet.c
@@ -1,369 +0,0 @@
 /*
 * QEMU Wacom Penpartner serial tablet emulation
 *
 * some protocol details:
 *   http://linuxwacom.sourceforge.net/wiki/index.php/Serial_Protocol_IV
 *
 * Copyright (c) 2016 Anatoli Huseu1
 * Copyright (c) 2016,17 Gerd Hoffmann
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to
 * deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include <stdlib.h>
 #include <string.h>
 #include <sys/time.h>
 #include <time.h>
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "sysemu/char.h"
 #include "ui/console.h"
 #include "ui/input.h"
 #include "trace.h"
 #define WC_OUTPUT_BUF_MAX_LEN 512
 #define WC_COMMAND_MAX_LEN 60
 #define WC_L7(n) ((n) & 127)
 #define WC_M7(n) (((n) >> 7) & 127)
 #define WC_H2(n) ((n) >> 14)
 #define WC_L4(n) ((n) & 15)
 #define WC_H4(n) (((n) >> 4) & 15)
 /* Model string and config string */
 #define WC_MODEL_STRING_LENGTH 18
 uint8_t WC_MODEL_STRING[WC_MODEL_STRING_LENGTH + 1] = "~#CT-0045R,V1.3-5,";
 #define WC_CONFIG_STRING_LENGTH 8
 uint8_t WC_CONFIG_STRING[WC_CONFIG_STRING_LENGTH + 1] = "96,N,8,0";
 #define WC_FULL_CONFIG_STRING_LENGTH 61
 uint8_t WC_FULL_CONFIG_STRING[WC_FULL_CONFIG_STRING_LENGTH + 1] = {
    0x5c, 0x39, 0x36, 0x2c, 0x4e, 0x2c, 0x38, 0x2c,
    0x31, 0x28, 0x01, 0x24, 0x57, 0x41, 0x43, 0x30,
    0x30, 0x34, 0x35, 0x5c, 0x5c, 0x50, 0x45, 0x4e, 0x5c,
    0x57, 0x41, 0x43, 0x30, 0x30, 0x30, 0x30, 0x5c,
    0x54, 0x61, 0x62, 0x6c, 0x65, 0x74, 0x0d, 0x0a,
    0x43, 0x54, 0x2d, 0x30, 0x30, 0x34, 0x35, 0x52,
    0x2c, 0x56, 0x31, 0x2e, 0x33, 0x2d, 0x35, 0x0d,
    0x0a, 0x45, 0x37, 0x29
 };
 /* This structure is used to save private info for Wacom Tablet. */
 typedef struct {
    Chardev parent;
    QemuInputHandlerState *hs;
    /* Query string from serial */
    uint8_t query[100];
    int query_index;
    /* Command to be sent to serial port */
    uint8_t outbuf[WC_OUTPUT_BUF_MAX_LEN];
    int outlen;
    int line_speed;
    bool send_events;
    int axis[INPUT_AXIS__MAX];
    bool btns[INPUT_BUTTON__MAX];
 } TabletChardev;
 #define TYPE_CHARDEV_WCTABLET "chardev-wctablet"
 #define WCTABLET_CHARDEV(obj)                                      \
    OBJECT_CHECK(TabletChardev, (obj), TYPE_CHARDEV_WCTABLET)
 static void wctablet_chr_accept_input(Chardev *chr);
 static void wctablet_shift_input(TabletChardev *tablet, int count)
 {
    tablet->query_index -= count;
    memmove(tablet->query, tablet->query + count, tablet->query_index);
    tablet->query[tablet->query_index] = 0;
 }
 static void wctablet_queue_output(TabletChardev *tablet, uint8_t *buf, int count)
 {
    if (tablet->outlen + count > sizeof(tablet->outbuf)) {
        return;
    }
    memcpy(tablet->outbuf + tablet->outlen, buf, count);
    tablet->outlen += count;
    wctablet_chr_accept_input(CHARDEV(tablet));
 }
 static void wctablet_reset(TabletChardev *tablet)
 {
    /* clear buffers */
    tablet->query_index = 0;
    tablet->outlen = 0;
    /* reset state */
    tablet->send_events = false;
 }
 static void wctablet_queue_event(TabletChardev *tablet)
 {
    uint8_t codes[8] = { 0xe0, 0, 0, 0, 0, 0, 0 };
    if (tablet->line_speed != 9600) {
        return;
    }
    int newX = tablet->axis[INPUT_AXIS_X] * 0.1537;
    int nexY = tablet->axis[INPUT_AXIS_Y] * 0.1152;
    codes[0] = codes[0] | WC_H2(newX);
    codes[1] = codes[1] | WC_M7(newX);
    codes[2] = codes[2] | WC_L7(newX);
    codes[3] = codes[3] | WC_H2(nexY);
    codes[4] = codes[4] | WC_M7(nexY);
    codes[5] = codes[5] | WC_L7(nexY);
    if (tablet->btns[INPUT_BUTTON_LEFT]) {
        codes[0] = 0xa0;
    }
    wctablet_queue_output(tablet, codes, 7);
 }
 static void wctablet_input_event(DeviceState *dev, QemuConsole *src,
                                InputEvent *evt)
 {
    TabletChardev *tablet = (TabletChardev *)dev;
    InputMoveEvent *move;
    InputBtnEvent *btn;
    switch (evt->type) {
    case INPUT_EVENT_KIND_ABS:
        move = evt->u.abs.data;
        tablet->axis[move->axis] = move->value;
        break;
    case INPUT_EVENT_KIND_BTN:
        btn = evt->u.btn.data;
        tablet->btns[btn->button] = btn->down;
        break;
    default:
        /* keep gcc happy */
        break;
    }
 }
 static void wctablet_input_sync(DeviceState *dev)
 {
    TabletChardev *tablet = (TabletChardev *)dev;
    if (tablet->send_events) {
        wctablet_queue_event(tablet);
    }
 }
 static QemuInputHandler wctablet_handler = {
    .name  = "QEMU Wacome Pen Tablet",
    .mask  = INPUT_EVENT_MASK_BTN | INPUT_EVENT_MASK_ABS,
    .event = wctablet_input_event,
    .sync  = wctablet_input_sync,
 };
 static void wctablet_chr_accept_input(Chardev *chr)
 {
    TabletChardev *tablet = WCTABLET_CHARDEV(chr);
    int len, canWrite;
    canWrite = qemu_chr_be_can_write(chr);
    len = canWrite;
    if (len > tablet->outlen) {
        len = tablet->outlen;
    }
    if (len) {
        qemu_chr_be_write(chr, tablet->outbuf, len);
        tablet->outlen -= len;
        if (tablet->outlen) {
            memmove(tablet->outbuf, tablet->outbuf + len, tablet->outlen);
        }
    }
 }
 static int wctablet_chr_write(struct Chardev *chr,
                              const uint8_t *buf, int len)
 {
    TabletChardev *tablet = WCTABLET_CHARDEV(chr);
    unsigned int i, clen;
    char *pos;
    if (tablet->line_speed != 9600) {
        return len;
    }
    for (i = 0; i < len && tablet->query_index < sizeof(tablet->query) - 1; i++) {
        tablet->query[tablet->query_index++] = buf[i];
    }
    tablet->query[tablet->query_index] = 0;
    while (tablet->query_index > 0 && (tablet->query[0] == '@'  ||
                                       tablet->query[0] == '\r' ||
                                       tablet->query[0] == '\n')) {
        wctablet_shift_input(tablet, 1);
    }
    if (!tablet->query_index) {
        return len;
    }
    if (strncmp((char *)tablet->query, "~#", 2) == 0) {
        /* init / detect sequence */
        trace_wct_init();
        wctablet_shift_input(tablet, 2);
        wctablet_queue_output(tablet, WC_MODEL_STRING,
                              WC_MODEL_STRING_LENGTH);
        return len;
    }
    /* detect line */
    pos = strchr((char *)tablet->query, '\r');
    if (!pos) {
        pos = strchr((char *)tablet->query, '\n');
    }
    if (!pos) {
        return len;
    }
    clen = pos - (char *)tablet->query;
    /* process commands */
    if (strncmp((char *)tablet->query, "RE", 2) == 0 &&
        clen == 2) {
        trace_wct_cmd_re();
        wctablet_shift_input(tablet, 3);
        wctablet_queue_output(tablet, WC_CONFIG_STRING,
                              WC_CONFIG_STRING_LENGTH);
    } else if (strncmp((char *)tablet->query, "ST", 2) == 0 &&
               clen == 2) {
        trace_wct_cmd_st();
        wctablet_shift_input(tablet, 3);
        tablet->send_events = true;
        wctablet_queue_event(tablet);
    } else if (strncmp((char *)tablet->query, "SP", 2) == 0 &&
               clen == 2) {
        trace_wct_cmd_sp();
        wctablet_shift_input(tablet, 3);
        tablet->send_events = false;
    } else if (strncmp((char *)tablet->query, "TS", 2) == 0 &&
               clen == 3) {
        unsigned int input = tablet->query[2];
        uint8_t codes[7] = {
            0xa3,
            ((input & 0x80) == 0) ? 0x7e : 0x7f,
            (((WC_H4(input) & 0x7) ^ 0x5) << 4) | (WC_L4(input) ^ 0x7),
            0x03,
            0x7f,
            0x7f,
            0x00,
        };
        trace_wct_cmd_ts(input);
        wctablet_shift_input(tablet, 4);
        wctablet_queue_output(tablet, codes, 7);
    } else {
        tablet->query[clen] = 0; /* terminate line for printing */
        trace_wct_cmd_other((char *)tablet->query);
        wctablet_shift_input(tablet, clen + 1);
    }
    return len;
 }
 static int wctablet_chr_ioctl(Chardev *chr, int cmd, void *arg)
 {
    TabletChardev *tablet = WCTABLET_CHARDEV(chr);
    QEMUSerialSetParams *ssp;
    switch (cmd) {
    case CHR_IOCTL_SERIAL_SET_PARAMS:
        ssp = arg;
        if (tablet->line_speed != ssp->speed) {
            trace_wct_speed(ssp->speed);
            wctablet_reset(tablet);
            tablet->line_speed = ssp->speed;
        }
        break;
    default:
        return -ENOTSUP;
    }
    return 0;
 }
 static void wctablet_chr_finalize(Object *obj)
 {
    TabletChardev *tablet = WCTABLET_CHARDEV(obj);
    qemu_input_handler_unregister(tablet->hs);
    g_free(tablet);
 }
 static void wctablet_chr_open(Chardev *chr,
                              ChardevBackend *backend,
                              bool *be_opened,
                              Error **errp)
 {
    TabletChardev *tablet = WCTABLET_CHARDEV(chr);
    *be_opened = true;
    /* init state machine */
    memcpy(tablet->outbuf, WC_FULL_CONFIG_STRING, WC_FULL_CONFIG_STRING_LENGTH);
    tablet->outlen = WC_FULL_CONFIG_STRING_LENGTH;
    tablet->query_index = 0;
    tablet->hs = qemu_input_handler_register((DeviceState *)tablet,
                                             &wctablet_handler);
 }
 static void wctablet_chr_class_init(ObjectClass *oc, void *data)
 {
    ChardevClass *cc = CHARDEV_CLASS(oc);
    cc->open = wctablet_chr_open;
    cc->chr_write = wctablet_chr_write;
    cc->chr_ioctl = wctablet_chr_ioctl;
    cc->chr_accept_input = wctablet_chr_accept_input;
 }
 static const TypeInfo wctablet_type_info = {
    .name = TYPE_CHARDEV_WCTABLET,
    .parent = TYPE_CHARDEV,
    .instance_size = sizeof(TabletChardev),
    .instance_finalize = wctablet_chr_finalize,
    .class_init = wctablet_chr_class_init,
 };
 static void register_types(void)
 {
     type_register_static(&wctablet_type_info);
 }
 type_init(register_types);
--- a/balloon.c
+++ b/balloon.c
@@ -1,118 +0,0 @@
 /*
 * Generic Balloon handlers and management
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
 * Copyright (C) 2011 Red Hat, Inc.
 * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "exec/cpu-common.h"
 #include "sysemu/kvm.h"
 #include "sysemu/balloon.h"
 #include "trace-root.h"
 #include "qmp-commands.h"
 #include "qapi/qmp/qerror.h"
 #include "qapi/qmp/qjson.h"
 static QEMUBalloonEvent *balloon_event_fn;
 static QEMUBalloonStatus *balloon_stat_fn;
 static void *balloon_opaque;
 static bool balloon_inhibited;
 bool qemu_balloon_is_inhibited(void)
 {
    return balloon_inhibited;
 }
 void qemu_balloon_inhibit(bool state)
 {
    balloon_inhibited = state;
 }
 static bool have_balloon(Error **errp)
 {
    if (kvm_enabled() && !kvm_has_sync_mmu()) {
        error_set(errp, ERROR_CLASS_KVM_MISSING_CAP,
                  "Using KVM without synchronous MMU, balloon unavailable");
        return false;
    }
    if (!balloon_event_fn) {
        error_set(errp, ERROR_CLASS_DEVICE_NOT_ACTIVE,
                  "No balloon device has been activated");
        return false;
    }
    return true;
 }
 int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
                             QEMUBalloonStatus *stat_func, void *opaque)
 {
    if (balloon_event_fn || balloon_stat_fn || balloon_opaque) {
        /* We're already registered one balloon handler.  How many can
         * a guest really have?
         */
        return -1;
    }
    balloon_event_fn = event_func;
    balloon_stat_fn = stat_func;
    balloon_opaque = opaque;
    return 0;
 }
 void qemu_remove_balloon_handler(void *opaque)
 {
    if (balloon_opaque != opaque) {
        return;
    }
    balloon_event_fn = NULL;
    balloon_stat_fn = NULL;
    balloon_opaque = NULL;
 }
 BalloonInfo *qmp_query_balloon(Error **errp)
 {
    BalloonInfo *info;
    if (!have_balloon(errp)) {
        return NULL;
    }
    info = g_malloc0(sizeof(*info));
    balloon_stat_fn(balloon_opaque, info);
    return info;
 }
 void qmp_balloon(int64_t target, Error **errp)
 {
    if (!have_balloon(errp)) {
        return;
    }
    if (target <= 0) {
        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "target", "a size");
        return;
    }
    trace_balloon_event(balloon_opaque, target);
    balloon_event_fn(balloon_opaque, target);
 }
--- a/balloon.h
+++ b/balloon.h
@@ -0,0 +1,27 @@
 /*
 * Balloon
 *
 * Copyright IBM, Corp. 2008
 *
 * Authors:
 *  Anthony Liguori   <aliguori@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
 #ifndef _QEMU_BALLOON_H
 #define _QEMU_BALLOON_H
 #include "cpu-defs.h"
 typedef ram_addr_t (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
 void qemu_add_balloon_handler(QEMUBalloonEvent *func, void *opaque);
 void qemu_balloon(ram_addr_t target);
 ram_addr_t qemu_balloon_status(void);
 #endif
--- a/block-migration.c
+++ b/block-migration.c
@@ -0,0 +1,541 @@
 /*
 * QEMU live block migration
 *
 * Copyright IBM, Corp. 2009
 *
 * Authors:
 *  Liran Schour   <lirans@il.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
 #include "qemu-common.h"
 #include "block_int.h"
 #include "hw/hw.h"
 #include "qemu-queue.h"
 #include "monitor.h"
 #include "block-migration.h"
 #include <assert.h>
 #define BLOCK_SIZE (BDRV_SECTORS_PER_DIRTY_CHUNK << BDRV_SECTOR_BITS)
 #define BLK_MIG_FLAG_DEVICE_BLOCK       0x01
 #define BLK_MIG_FLAG_EOS                0x02
 #define BLK_MIG_FLAG_PROGRESS           0x04
 #define MAX_IS_ALLOCATED_SEARCH 65536
 #define MAX_BLOCKS_READ 10000
 #define BLOCKS_READ_CHANGE 100
 #define INITIAL_BLOCKS_READ 100
 //#define DEBUG_BLK_MIGRATION
 #ifdef DEBUG_BLK_MIGRATION
 #define dprintf(fmt, ...) \
    do { printf("blk_migration: " fmt, ## __VA_ARGS__); } while (0)
 #else
 #define dprintf(fmt, ...) \
    do { } while (0)
 #endif
 typedef struct BlkMigDevState {
    BlockDriverState *bs;
    int bulk_completed;
    int shared_base;
    int64_t cur_sector;
    int64_t completed_sectors;
    int64_t total_sectors;
    int64_t dirty;
    QSIMPLEQ_ENTRY(BlkMigDevState) entry;
 } BlkMigDevState;
 typedef struct BlkMigBlock {
    uint8_t *buf;
    BlkMigDevState *bmds;
    int64_t sector;
    struct iovec iov;
    QEMUIOVector qiov;
    BlockDriverAIOCB *aiocb;
    int ret;
    QSIMPLEQ_ENTRY(BlkMigBlock) entry;
 } BlkMigBlock;
 typedef struct BlkMigState {
    int blk_enable;
    int shared_base;
    QSIMPLEQ_HEAD(bmds_list, BlkMigDevState) bmds_list;
    QSIMPLEQ_HEAD(blk_list, BlkMigBlock) blk_list;
    int submitted;
    int read_done;
    int transferred;
    int64_t total_sector_sum;
    int prev_progress;
 } BlkMigState;
 static BlkMigState block_mig_state;
 static void blk_send(QEMUFile *f, BlkMigBlock * blk)
 {
    int len;
    /* sector number and flags */
    qemu_put_be64(f, (blk->sector << BDRV_SECTOR_BITS)
                     | BLK_MIG_FLAG_DEVICE_BLOCK);
    /* device name */
    len = strlen(blk->bmds->bs->device_name);
    qemu_put_byte(f, len);
    qemu_put_buffer(f, (uint8_t *)blk->bmds->bs->device_name, len);
    qemu_put_buffer(f, blk->buf, BLOCK_SIZE);
 }
 int blk_mig_active(void)
 {
    return !QSIMPLEQ_EMPTY(&block_mig_state.bmds_list);
 }
 uint64_t blk_mig_bytes_transferred(void)
 {
    BlkMigDevState *bmds;
    uint64_t sum = 0;
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        sum += bmds->completed_sectors;
    }
    return sum << BDRV_SECTOR_BITS;
 }
 uint64_t blk_mig_bytes_remaining(void)
 {
    return blk_mig_bytes_total() - blk_mig_bytes_transferred();
 }
 uint64_t blk_mig_bytes_total(void)
 {
    BlkMigDevState *bmds;
    uint64_t sum = 0;
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        sum += bmds->total_sectors;
    }
    return sum << BDRV_SECTOR_BITS;
 }
 static void blk_mig_read_cb(void *opaque, int ret)
 {
    BlkMigBlock *blk = opaque;
    blk->ret = ret;
    QSIMPLEQ_INSERT_TAIL(&block_mig_state.blk_list, blk, entry);
    block_mig_state.submitted--;
    block_mig_state.read_done++;
    assert(block_mig_state.submitted >= 0);
 }
 static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,
                                BlkMigDevState *bmds, int is_async)
 {
    int64_t total_sectors = bmds->total_sectors;
    int64_t cur_sector = bmds->cur_sector;
    BlockDriverState *bs = bmds->bs;
    BlkMigBlock *blk;
    int nr_sectors;
    if (bmds->shared_base) {
        while (cur_sector < total_sectors &&
               !bdrv_is_allocated(bs, cur_sector, MAX_IS_ALLOCATED_SEARCH,
                                  &nr_sectors)) {
            cur_sector += nr_sectors;
        }
    }
    if (cur_sector >= total_sectors) {
        bmds->cur_sector = bmds->completed_sectors = total_sectors;
        return 1;
    }
    bmds->completed_sectors = cur_sector;
    cur_sector &= ~((int64_t)BDRV_SECTORS_PER_DIRTY_CHUNK - 1);
    /* we are going to transfer a full block even if it is not allocated */
    nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
    if (total_sectors - cur_sector < BDRV_SECTORS_PER_DIRTY_CHUNK) {
        nr_sectors = total_sectors - cur_sector;
    }
    blk = qemu_malloc(sizeof(BlkMigBlock));
    blk->buf = qemu_malloc(BLOCK_SIZE);
    blk->bmds = bmds;
    blk->sector = cur_sector;
    if (is_async) {
        blk->iov.iov_base = blk->buf;
        blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
        qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);
        blk->aiocb = bdrv_aio_readv(bs, cur_sector, &blk->qiov,
                                    nr_sectors, blk_mig_read_cb, blk);
        if (!blk->aiocb) {
            goto error;
        }
        block_mig_state.submitted++;
    } else {
        if (bdrv_read(bs, cur_sector, blk->buf, nr_sectors) < 0) {
            goto error;
        }
        blk_send(f, blk);
        qemu_free(blk->buf);
        qemu_free(blk);
    }
    bdrv_reset_dirty(bs, cur_sector, nr_sectors);
    bmds->cur_sector = cur_sector + nr_sectors;
    return (bmds->cur_sector >= total_sectors);
 error:
    monitor_printf(mon, "Error reading sector %" PRId64 "\n", cur_sector);
    qemu_file_set_error(f);
    qemu_free(blk->buf);
    qemu_free(blk);
    return 0;
 }
 static void set_dirty_tracking(int enable)
 {
    BlkMigDevState *bmds;
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        bdrv_set_dirty_tracking(bmds->bs, enable);
    }
 }
 static void init_blk_migration(Monitor *mon, QEMUFile *f)
 {
    BlkMigDevState *bmds;
    BlockDriverState *bs;
    int64_t sectors;
    block_mig_state.submitted = 0;
    block_mig_state.read_done = 0;
    block_mig_state.transferred = 0;
    block_mig_state.total_sector_sum = 0;
    block_mig_state.prev_progress = -1;
    for (bs = bdrv_first; bs != NULL; bs = bs->next) {
        if (bs->type == BDRV_TYPE_HD) {
            sectors = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
            if (sectors == 0) {
                continue;
            }
            bmds = qemu_mallocz(sizeof(BlkMigDevState));
            bmds->bs = bs;
            bmds->bulk_completed = 0;
            bmds->total_sectors = sectors;
            bmds->completed_sectors = 0;
            bmds->shared_base = block_mig_state.shared_base;
            block_mig_state.total_sector_sum += sectors;
            if (bmds->shared_base) {
                monitor_printf(mon, "Start migration for %s with shared base "
                                    "image\n",
                               bs->device_name);
            } else {
                monitor_printf(mon, "Start full migration for %s\n",
                               bs->device_name);
            }
            QSIMPLEQ_INSERT_TAIL(&block_mig_state.bmds_list, bmds, entry);
        }
    }
 }
 static int blk_mig_save_bulked_block(Monitor *mon, QEMUFile *f, int is_async)
 {
    int64_t completed_sector_sum = 0;
    BlkMigDevState *bmds;
    int progress;
    int ret = 0;
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        if (bmds->bulk_completed == 0) {
            if (mig_save_device_bulk(mon, f, bmds, is_async) == 1) {
                /* completed bulk section for this device */
                bmds->bulk_completed = 1;
            }
            completed_sector_sum += bmds->completed_sectors;
            ret = 1;
            break;
        } else {
            completed_sector_sum += bmds->completed_sectors;
        }
    }
    progress = completed_sector_sum * 100 / block_mig_state.total_sector_sum;
    if (progress != block_mig_state.prev_progress) {
        block_mig_state.prev_progress = progress;
        qemu_put_be64(f, (progress << BDRV_SECTOR_BITS)
                         | BLK_MIG_FLAG_PROGRESS);
        monitor_printf(mon, "Completed %d %%\r", progress);
        monitor_flush(mon);
    }
    return ret;
 }
 #define MAX_NUM_BLOCKS 4
 static void blk_mig_save_dirty_blocks(Monitor *mon, QEMUFile *f)
 {
    BlkMigDevState *bmds;
    BlkMigBlock blk;
    int64_t sector;
    blk.buf = qemu_malloc(BLOCK_SIZE);
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        for (sector = 0; sector < bmds->cur_sector;) {
            if (bdrv_get_dirty(bmds->bs, sector)) {
                if (bdrv_read(bmds->bs, sector, blk.buf,
                              BDRV_SECTORS_PER_DIRTY_CHUNK) < 0) {
                    monitor_printf(mon, "Error reading sector %" PRId64 "\n",
                                   sector);
                    qemu_file_set_error(f);
                    qemu_free(blk.buf);
                    return;
                }
                blk.bmds = bmds;
                blk.sector = sector;
                blk_send(f, &blk);
                bdrv_reset_dirty(bmds->bs, sector,
                                 BDRV_SECTORS_PER_DIRTY_CHUNK);
            }
            sector += BDRV_SECTORS_PER_DIRTY_CHUNK;
        }
    }
    qemu_free(blk.buf);
 }
 static void flush_blks(QEMUFile* f)
 {
    BlkMigBlock *blk;
    dprintf("%s Enter submitted %d read_done %d transferred %d\n",
            __FUNCTION__, block_mig_state.submitted, block_mig_state.read_done,
            block_mig_state.transferred);
    while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
        if (qemu_file_rate_limit(f)) {
            break;
        }
        if (blk->ret < 0) {
            qemu_file_set_error(f);
            break;
        }
        blk_send(f, blk);
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
        qemu_free(blk->buf);
        qemu_free(blk);
        block_mig_state.read_done--;
        block_mig_state.transferred++;
        assert(block_mig_state.read_done >= 0);
    }
    dprintf("%s Exit submitted %d read_done %d transferred %d\n", __FUNCTION__,
            block_mig_state.submitted, block_mig_state.read_done,
            block_mig_state.transferred);
 }
 static int is_stage2_completed(void)
 {
    BlkMigDevState *bmds;
    if (block_mig_state.submitted > 0) {
        return 0;
    }
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        if (bmds->bulk_completed == 0) {
            return 0;
        }
    }
    return 1;
 }
 static void blk_mig_cleanup(Monitor *mon)
 {
    BlkMigDevState *bmds;
    BlkMigBlock *blk;
    while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
        qemu_free(bmds);
    }
    while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
        qemu_free(blk->buf);
        qemu_free(blk);
    }
    set_dirty_tracking(0);
    monitor_printf(mon, "\n");
 }
 static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
 {
    dprintf("Enter save live stage %d submitted %d transferred %d\n",
            stage, block_mig_state.submitted, block_mig_state.transferred);
    if (stage < 0) {
        blk_mig_cleanup(mon);
        return 0;
    }
    if (block_mig_state.blk_enable != 1) {
        /* no need to migrate storage */
        qemu_put_be64(f, BLK_MIG_FLAG_EOS);
        return 1;
    }
    if (stage == 1) {
        init_blk_migration(mon, f);
        /* start track dirty blocks */
        set_dirty_tracking(1);
    }
    flush_blks(f);
    if (qemu_file_has_error(f)) {
        blk_mig_cleanup(mon);
        return 0;
    }
    /* control the rate of transfer */
    while ((block_mig_state.submitted +
            block_mig_state.read_done) * BLOCK_SIZE <
           qemu_file_get_rate_limit(f)) {
        if (blk_mig_save_bulked_block(mon, f, 1) == 0) {
            /* no more bulk blocks for now */
            break;
        }
    }
    flush_blks(f);
    if (qemu_file_has_error(f)) {
        blk_mig_cleanup(mon);
        return 0;
    }
    if (stage == 3) {
        while (blk_mig_save_bulked_block(mon, f, 0) != 0) {
            /* empty */
        }
        blk_mig_save_dirty_blocks(mon, f);
        blk_mig_cleanup(mon);
        /* report completion */
        qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);
        if (qemu_file_has_error(f)) {
            return 0;
        }
        monitor_printf(mon, "Block migration completed\n");
    }
    qemu_put_be64(f, BLK_MIG_FLAG_EOS);
    return ((stage == 2) && is_stage2_completed());
 }
 static int block_load(QEMUFile *f, void *opaque, int version_id)
 {
    static int banner_printed;
    int len, flags;
    char device_name[256];
    int64_t addr;
    BlockDriverState *bs;
    uint8_t *buf;
    do {
        addr = qemu_get_be64(f);
        flags = addr & ~BDRV_SECTOR_MASK;
        addr >>= BDRV_SECTOR_BITS;
        if (flags & BLK_MIG_FLAG_DEVICE_BLOCK) {
            /* get device name */
            len = qemu_get_byte(f);
            qemu_get_buffer(f, (uint8_t *)device_name, len);
            device_name[len] = '\0';
            bs = bdrv_find(device_name);
            if (!bs) {
                fprintf(stderr, "Error unknown block device %s\n",
                        device_name);
                return -EINVAL;
            }
            buf = qemu_malloc(BLOCK_SIZE);
            qemu_get_buffer(f, buf, BLOCK_SIZE);
            bdrv_write(bs, addr, buf, BDRV_SECTORS_PER_DIRTY_CHUNK);
            qemu_free(buf);
        } else if (flags & BLK_MIG_FLAG_PROGRESS) {
            if (!banner_printed) {
                printf("Receiving block device images\n");
                banner_printed = 1;
            }
            printf("Completed %d %%%c", (int)addr,
                   (addr == 100) ? '\n' : '\r');
            fflush(stdout);
        } else if (!(flags & BLK_MIG_FLAG_EOS)) {
            fprintf(stderr, "Unknown flags\n");
            return -EINVAL;
        }
        if (qemu_file_has_error(f)) {
            return -EIO;
        }
    } while (!(flags & BLK_MIG_FLAG_EOS));
    return 0;
 }
 static void block_set_params(int blk_enable, int shared_base, void *opaque)
 {
    block_mig_state.blk_enable = blk_enable;
    block_mig_state.shared_base = shared_base;
    /* shared base means that blk_enable = 1 */
    block_mig_state.blk_enable |= shared_base;
 }
 void blk_mig_init(void)
 {
    QSIMPLEQ_INIT(&block_mig_state.bmds_list);
    QSIMPLEQ_INIT(&block_mig_state.blk_list);
    register_savevm_live("block", 0, 1, block_set_params, block_save_live,
                         NULL, block_load, &block_mig_state);
 }
--- a/block-migration.h
+++ b/block-migration.h
@@ -0,0 +1,23 @@
 /*
 * QEMU live block migration
 *
 * Copyright IBM, Corp. 2009
 *
 * Authors:
 *  Liran Schour   <lirans@il.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
 #ifndef BLOCK_MIGRATION_H
 #define BLOCK_MIGRATION_H
 void blk_mig_init(void);
 int blk_mig_active(void);
 uint64_t blk_mig_bytes_transferred(void);
 uint64_t blk_mig_bytes_remaining(void);
 uint64_t blk_mig_bytes_total(void);
 #endif /* BLOCK_MIGRATION_H */
--- a/block.c
+++ b/block.c
--- a/block.h
+++ b/block.h
@@ -0,0 +1,208 @@
 #ifndef BLOCK_H
 #define BLOCK_H
 #include "qemu-aio.h"
 #include "qemu-common.h"
 #include "qemu-option.h"
 #include "qobject.h"
 /* block.c */
 typedef struct BlockDriver BlockDriver;
 typedef struct BlockDriverInfo {
    /* in bytes, 0 if irrelevant */
    int cluster_size;
    /* offset at which the VM state can be saved (0 if not possible) */
    int64_t vm_state_offset;
 } BlockDriverInfo;
 typedef struct QEMUSnapshotInfo {
    char id_str[128]; /* unique snapshot id */
    /* the following fields are informative. They are not needed for
       the consistency of the snapshot */
    char name[256]; /* user choosen name */
    uint32_t vm_state_size; /* VM state info size */
    uint32_t date_sec; /* UTC date of the snapshot */
    uint32_t date_nsec;
    uint64_t vm_clock_nsec; /* VM clock relative to boot */
 } QEMUSnapshotInfo;
 #define BDRV_O_RDONLY      0x0000
 #define BDRV_O_RDWR        0x0002
 #define BDRV_O_ACCESS      0x0003
 #define BDRV_O_CREAT       0x0004 /* create an empty file */
 #define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
 #define BDRV_O_FILE        0x0010 /* open as a raw file (do not try to
                                     use a disk image format on top of
                                     it (default for
                                     bdrv_file_open()) */
 #define BDRV_O_NOCACHE     0x0020 /* do not use the host page cache */
 #define BDRV_O_CACHE_WB    0x0040 /* use write-back caching */
 #define BDRV_O_NATIVE_AIO  0x0080 /* use native AIO instead of the thread pool */
 #define BDRV_O_CACHE_MASK  (BDRV_O_NOCACHE | BDRV_O_CACHE_WB)
 #define BDRV_SECTOR_BITS   9
 #define BDRV_SECTOR_SIZE   (1 << BDRV_SECTOR_BITS)
 #define BDRV_SECTOR_MASK   ~(BDRV_SECTOR_SIZE - 1);
 void bdrv_info_print(Monitor *mon, const QObject *data);
 void bdrv_info(Monitor *mon, QObject **ret_data);
 void bdrv_stats_print(Monitor *mon, const QObject *data);
 void bdrv_info_stats(Monitor *mon, QObject **ret_data);
 void bdrv_init(void);
 void bdrv_init_with_whitelist(void);
 BlockDriver *bdrv_find_format(const char *format_name);
 BlockDriver *bdrv_find_whitelisted_format(const char *format_name);
 int bdrv_create(BlockDriver *drv, const char* filename,
    QEMUOptionParameter *options);
 int bdrv_create2(BlockDriver *drv,
                 const char *filename, int64_t size_in_sectors,
                 const char *backing_file, const char *backing_format,
                 int flags);
 BlockDriverState *bdrv_new(const char *device_name);
 void bdrv_delete(BlockDriverState *bs);
 int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
 int bdrv_open(BlockDriverState *bs, const char *filename, int flags);
 int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
               BlockDriver *drv);
 void bdrv_close(BlockDriverState *bs);
 int bdrv_check(BlockDriverState *bs);
 int bdrv_read(BlockDriverState *bs, int64_t sector_num,
              uint8_t *buf, int nb_sectors);
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
               const uint8_t *buf, int nb_sectors);
 int bdrv_pread(BlockDriverState *bs, int64_t offset,
               void *buf, int count);
 int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
                const void *buf, int count);
 int bdrv_pwrite_sync(BlockDriverState *bs, int64_t offset,
    const void *buf, int count);
 int bdrv_write_sync(BlockDriverState *bs, int64_t sector_num,
    const uint8_t *buf, int nb_sectors);
 int bdrv_truncate(BlockDriverState *bs, int64_t offset);
 int64_t bdrv_getlength(BlockDriverState *bs);
 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
 void bdrv_guess_geometry(BlockDriverState *bs, int *pcyls, int *pheads, int *psecs);
 int bdrv_commit(BlockDriverState *bs);
 void bdrv_register(BlockDriver *bdrv);
 /* async block I/O */
 typedef struct BlockDriverAIOCB BlockDriverAIOCB;
 typedef void BlockDriverCompletionFunc(void *opaque, int ret);
 typedef void BlockDriverDirtyHandler(BlockDriverState *bs, int64_t sector,
 				     int sector_num);
 BlockDriverAIOCB *bdrv_aio_readv(BlockDriverState *bs, int64_t sector_num,
                                 QEMUIOVector *iov, int nb_sectors,
                                 BlockDriverCompletionFunc *cb, void *opaque);
 BlockDriverAIOCB *bdrv_aio_writev(BlockDriverState *bs, int64_t sector_num,
                                  QEMUIOVector *iov, int nb_sectors,
                                  BlockDriverCompletionFunc *cb, void *opaque);
 BlockDriverAIOCB *bdrv_aio_flush(BlockDriverState *bs,
 				 BlockDriverCompletionFunc *cb, void *opaque);
 void bdrv_aio_cancel(BlockDriverAIOCB *acb);
 typedef struct BlockRequest {
    /* Fields to be filled by multiwrite caller */
    int64_t sector;
    int nb_sectors;
    QEMUIOVector *qiov;
    BlockDriverCompletionFunc *cb;
    void *opaque;
    /* Filled by multiwrite implementation */
    int error;
 } BlockRequest;
 int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs,
    int num_reqs);
 /* sg packet commands */
 int bdrv_ioctl(BlockDriverState *bs, unsigned long int req, void *buf);
 BlockDriverAIOCB *bdrv_aio_ioctl(BlockDriverState *bs,
        unsigned long int req, void *buf,
        BlockDriverCompletionFunc *cb, void *opaque);
 /* Ensure contents are flushed to disk.  */
 void bdrv_flush(BlockDriverState *bs);
 void bdrv_flush_all(void);
 int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
 	int *pnum);
 #define BDRV_TYPE_HD     0
 #define BDRV_TYPE_CDROM  1
 #define BDRV_TYPE_FLOPPY 2
 #define BIOS_ATA_TRANSLATION_AUTO   0
 #define BIOS_ATA_TRANSLATION_NONE   1
 #define BIOS_ATA_TRANSLATION_LBA    2
 #define BIOS_ATA_TRANSLATION_LARGE  3
 #define BIOS_ATA_TRANSLATION_RECHS  4
 void bdrv_set_geometry_hint(BlockDriverState *bs,
                            int cyls, int heads, int secs);
 void bdrv_set_type_hint(BlockDriverState *bs, int type);
 void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
 void bdrv_get_geometry_hint(BlockDriverState *bs,
                            int *pcyls, int *pheads, int *psecs);
 int bdrv_get_type_hint(BlockDriverState *bs);
 int bdrv_get_translation_hint(BlockDriverState *bs);
 int bdrv_is_removable(BlockDriverState *bs);
 int bdrv_is_read_only(BlockDriverState *bs);
 int bdrv_set_read_only(BlockDriverState *bs, int read_only);
 int bdrv_is_sg(BlockDriverState *bs);
 int bdrv_enable_write_cache(BlockDriverState *bs);
 int bdrv_is_inserted(BlockDriverState *bs);
 int bdrv_media_changed(BlockDriverState *bs);
 int bdrv_is_locked(BlockDriverState *bs);
 void bdrv_set_locked(BlockDriverState *bs, int locked);
 int bdrv_eject(BlockDriverState *bs, int eject_flag);
 void bdrv_set_change_cb(BlockDriverState *bs,
                        void (*change_cb)(void *opaque), void *opaque);
 void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
 BlockDriverState *bdrv_find(const char *name);
 void bdrv_iterate(void (*it)(void *opaque, BlockDriverState *bs),
                  void *opaque);
 int bdrv_is_encrypted(BlockDriverState *bs);
 int bdrv_key_required(BlockDriverState *bs);
 int bdrv_set_key(BlockDriverState *bs, const char *key);
 int bdrv_query_missing_keys(void);
 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
                         void *opaque);
 const char *bdrv_get_device_name(BlockDriverState *bs);
 int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
                          const uint8_t *buf, int nb_sectors);
 int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
 const char *bdrv_get_encrypted_filename(BlockDriverState *bs);
 void bdrv_get_backing_filename(BlockDriverState *bs,
                               char *filename, int filename_size);
 int bdrv_snapshot_create(BlockDriverState *bs,
                         QEMUSnapshotInfo *sn_info);
 int bdrv_snapshot_goto(BlockDriverState *bs,
                       const char *snapshot_id);
 int bdrv_snapshot_delete(BlockDriverState *bs, const char *snapshot_id);
 int bdrv_snapshot_list(BlockDriverState *bs,
                       QEMUSnapshotInfo **psn_info);
 char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn);
 char *get_human_readable_size(char *buf, int buf_size, int64_t size);
 int path_is_absolute(const char *path);
 void path_combine(char *dest, int dest_size,
                  const char *base_path,
                  const char *filename);
 int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
                      int64_t pos, int size);
 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                      int64_t pos, int size);
 #define BDRV_SECTORS_PER_DIRTY_CHUNK 2048
 void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable);
 int bdrv_get_dirty(BlockDriverState *bs, int64_t sector);
 void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector,
                      int nr_sectors);
 #endif
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -1,48 +0,0 @@
 block-obj-y += raw-format.o qcow.o vdi.o vmdk.o cloop.o bochs.o vpc.o vvfat.o dmg.o
 block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
 block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
 block-obj-y += qed-check.o
 block-obj-y += vhdx.o vhdx-endian.o vhdx-log.o
 block-obj-y += quorum.o
 block-obj-y += parallels.o blkdebug.o blkverify.o blkreplay.o
 block-obj-y += block-backend.o snapshot.o qapi.o
 block-obj-$(CONFIG_WIN32) += file-win32.o win32-aio.o
 block-obj-$(CONFIG_POSIX) += file-posix.o
 block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
 block-obj-y += null.o mirror.o commit.o io.o
 block-obj-y += throttle-groups.o
 block-obj-y += nbd.o nbd-client.o sheepdog.o
 block-obj-$(CONFIG_LIBISCSI) += iscsi.o
 block-obj-$(if $(CONFIG_LIBISCSI),y,n) += iscsi-opts.o
 block-obj-$(CONFIG_LIBNFS) += nfs.o
 block-obj-$(CONFIG_CURL) += curl.o
 block-obj-$(CONFIG_RBD) += rbd.o
 block-obj-$(CONFIG_GLUSTERFS) += gluster.o
 block-obj-$(CONFIG_ARCHIPELAGO) += archipelago.o
 block-obj-$(CONFIG_LIBSSH2) += ssh.o
 block-obj-y += accounting.o dirty-bitmap.o
 block-obj-y += write-threshold.o
 block-obj-y += backup.o
 block-obj-$(CONFIG_REPLICATION) += replication.o
 block-obj-y += crypto.o
 common-obj-y += stream.o
 nfs.o-libs         := $(LIBNFS_LIBS)
 iscsi.o-cflags     := $(LIBISCSI_CFLAGS)
 iscsi.o-libs       := $(LIBISCSI_LIBS)
 curl.o-cflags      := $(CURL_CFLAGS)
 curl.o-libs        := $(CURL_LIBS)
 rbd.o-cflags       := $(RBD_CFLAGS)
 rbd.o-libs         := $(RBD_LIBS)
 gluster.o-cflags   := $(GLUSTERFS_CFLAGS)
 gluster.o-libs     := $(GLUSTERFS_LIBS)
 ssh.o-cflags       := $(LIBSSH2_CFLAGS)
 ssh.o-libs         := $(LIBSSH2_LIBS)
 archipelago.o-libs := $(ARCHIPELAGO_LIBS)
 block-obj-$(if $(CONFIG_BZIP2),m,n) += dmg-bz2.o
 dmg-bz2.o-libs     := $(BZIP2_LIBS)
 qcow.o-libs        := -lz
 linux-aio.o-libs   := -laio
--- a/block/accounting.c
+++ b/block/accounting.c
@@ -1,173 +0,0 @@
 /*
 * QEMU System Emulator block accounting
 *
 * Copyright (c) 2011 Christoph Hellwig
 * Copyright (c) 2015 Igalia, S.L.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "block/accounting.h"
 #include "block/block_int.h"
 #include "qemu/timer.h"
 #include "sysemu/qtest.h"
 static QEMUClockType clock_type = QEMU_CLOCK_REALTIME;
 static const int qtest_latency_ns = NANOSECONDS_PER_SECOND / 1000;
 void block_acct_init(BlockAcctStats *stats, bool account_invalid,
                     bool account_failed)
 {
    stats->account_invalid = account_invalid;
    stats->account_failed = account_failed;
    if (qtest_enabled()) {
        clock_type = QEMU_CLOCK_VIRTUAL;
    }
 }
 void block_acct_cleanup(BlockAcctStats *stats)
 {
    BlockAcctTimedStats *s, *next;
    QSLIST_FOREACH_SAFE(s, &stats->intervals, entries, next) {
        g_free(s);
    }
 }
 void block_acct_add_interval(BlockAcctStats *stats, unsigned interval_length)
 {
    BlockAcctTimedStats *s;
    unsigned i;
    s = g_new0(BlockAcctTimedStats, 1);
    s->interval_length = interval_length;
    QSLIST_INSERT_HEAD(&stats->intervals, s, entries);
    for (i = 0; i < BLOCK_MAX_IOTYPE; i++) {
        timed_average_init(&s->latency[i], clock_type,
                           (uint64_t) interval_length * NANOSECONDS_PER_SECOND);
    }
 }
 BlockAcctTimedStats *block_acct_interval_next(BlockAcctStats *stats,
                                              BlockAcctTimedStats *s)
 {
    if (s == NULL) {
        return QSLIST_FIRST(&stats->intervals);
    } else {
        return QSLIST_NEXT(s, entries);
    }
 }
 void block_acct_start(BlockAcctStats *stats, BlockAcctCookie *cookie,
                      int64_t bytes, enum BlockAcctType type)
 {
    assert(type < BLOCK_MAX_IOTYPE);
    cookie->bytes = bytes;
    cookie->start_time_ns = qemu_clock_get_ns(clock_type);
    cookie->type = type;
 }
 void block_acct_done(BlockAcctStats *stats, BlockAcctCookie *cookie)
 {
    BlockAcctTimedStats *s;
    int64_t time_ns = qemu_clock_get_ns(clock_type);
    int64_t latency_ns = time_ns - cookie->start_time_ns;
    if (qtest_enabled()) {
        latency_ns = qtest_latency_ns;
    }
    assert(cookie->type < BLOCK_MAX_IOTYPE);
    stats->nr_bytes[cookie->type] += cookie->bytes;
    stats->nr_ops[cookie->type]++;
    stats->total_time_ns[cookie->type] += latency_ns;
    stats->last_access_time_ns = time_ns;
    QSLIST_FOREACH(s, &stats->intervals, entries) {
        timed_average_account(&s->latency[cookie->type], latency_ns);
    }
 }
 void block_acct_failed(BlockAcctStats *stats, BlockAcctCookie *cookie)
 {
    assert(cookie->type < BLOCK_MAX_IOTYPE);
    stats->failed_ops[cookie->type]++;
    if (stats->account_failed) {
        BlockAcctTimedStats *s;
        int64_t time_ns = qemu_clock_get_ns(clock_type);
        int64_t latency_ns = time_ns - cookie->start_time_ns;
        if (qtest_enabled()) {
            latency_ns = qtest_latency_ns;
        }
        stats->total_time_ns[cookie->type] += latency_ns;
        stats->last_access_time_ns = time_ns;
        QSLIST_FOREACH(s, &stats->intervals, entries) {
            timed_average_account(&s->latency[cookie->type], latency_ns);
        }
    }
 }
 void block_acct_invalid(BlockAcctStats *stats, enum BlockAcctType type)
 {
    assert(type < BLOCK_MAX_IOTYPE);
    /* block_acct_done() and block_acct_failed() update
     * total_time_ns[], but this one does not. The reason is that
     * invalid requests are accounted during their submission,
     * therefore there's no actual I/O involved. */
    stats->invalid_ops[type]++;
    if (stats->account_invalid) {
        stats->last_access_time_ns = qemu_clock_get_ns(clock_type);
    }
 }
 void block_acct_merge_done(BlockAcctStats *stats, enum BlockAcctType type,
                      int num_requests)
 {
    assert(type < BLOCK_MAX_IOTYPE);
    stats->merged[type] += num_requests;
 }
 int64_t block_acct_idle_time_ns(BlockAcctStats *stats)
 {
    return qemu_clock_get_ns(clock_type) - stats->last_access_time_ns;
 }
 double block_acct_queue_depth(BlockAcctTimedStats *stats,
                              enum BlockAcctType type)
 {
    uint64_t sum, elapsed;
    assert(type < BLOCK_MAX_IOTYPE);
    sum = timed_average_sum(&stats->latency[type], &elapsed);
    return (double) sum / elapsed;
 }
--- a/block/archipelago.c
+++ b/block/archipelago.c
--- a/block/backup.c
+++ b/block/backup.c
@@ -1,671 +0,0 @@
 /*
 * QEMU backup
 *
 * Copyright (C) 2013 Proxmox Server Solutions
 *
 * Authors:
 *  Dietmar Maurer (dietmar@proxmox.com)
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "trace.h"
 #include "block/block.h"
 #include "block/block_int.h"
 #include "block/blockjob_int.h"
 #include "block/block_backup.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
 #include "qemu/cutils.h"
 #include "sysemu/block-backend.h"
 #include "qemu/bitmap.h"
 #define BACKUP_CLUSTER_SIZE_DEFAULT (1 << 16)
 #define SLICE_TIME 100000000ULL /* ns */
 typedef struct BackupBlockJob {
    BlockJob common;
    BlockBackend *target;
    /* bitmap for sync=incremental */
    BdrvDirtyBitmap *sync_bitmap;
    MirrorSyncMode sync_mode;
    RateLimit limit;
    BlockdevOnError on_source_error;
    BlockdevOnError on_target_error;
    CoRwlock flush_rwlock;
    uint64_t sectors_read;
    unsigned long *done_bitmap;
    int64_t cluster_size;
    bool compress;
    NotifierWithReturn before_write;
    QLIST_HEAD(, CowRequest) inflight_reqs;
 } BackupBlockJob;
 /* Size of a cluster in sectors, instead of bytes. */
 static inline int64_t cluster_size_sectors(BackupBlockJob *job)
 {
  return job->cluster_size / BDRV_SECTOR_SIZE;
 }
 /* See if in-flight requests overlap and wait for them to complete */
 static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,
                                                       int64_t start,
                                                       int64_t end)
 {
    CowRequest *req;
    bool retry;
    do {
        retry = false;
        QLIST_FOREACH(req, &job->inflight_reqs, list) {
            if (end > req->start && start < req->end) {
                qemu_co_queue_wait(&req->wait_queue, NULL);
                retry = true;
                break;
            }
        }
    } while (retry);
 }
 /* Keep track of an in-flight request */
 static void cow_request_begin(CowRequest *req, BackupBlockJob *job,
                                     int64_t start, int64_t end)
 {
    req->start = start;
    req->end = end;
    qemu_co_queue_init(&req->wait_queue);
    QLIST_INSERT_HEAD(&job->inflight_reqs, req, list);
 }
 /* Forget about a completed request */
 static void cow_request_end(CowRequest *req)
 {
    QLIST_REMOVE(req, list);
    qemu_co_queue_restart_all(&req->wait_queue);
 }
 static int coroutine_fn backup_do_cow(BackupBlockJob *job,
                                      int64_t sector_num, int nb_sectors,
                                      bool *error_is_read,
                                      bool is_write_notifier)
 {
    BlockBackend *blk = job->common.blk;
    CowRequest cow_request;
    struct iovec iov;
    QEMUIOVector bounce_qiov;
    void *bounce_buffer = NULL;
    int ret = 0;
    int64_t sectors_per_cluster = cluster_size_sectors(job);
    int64_t start, end;
    int n;
    qemu_co_rwlock_rdlock(&job->flush_rwlock);
    start = sector_num / sectors_per_cluster;
    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
    trace_backup_do_cow_enter(job, start, sector_num, nb_sectors);
    wait_for_overlapping_requests(job, start, end);
    cow_request_begin(&cow_request, job, start, end);
    for (; start < end; start++) {
        if (test_bit(start, job->done_bitmap)) {
            trace_backup_do_cow_skip(job, start);
            continue; /* already copied */
        }
        trace_backup_do_cow_process(job, start);
        n = MIN(sectors_per_cluster,
                job->common.len / BDRV_SECTOR_SIZE -
                start * sectors_per_cluster);
        if (!bounce_buffer) {
            bounce_buffer = blk_blockalign(blk, job->cluster_size);
        }
        iov.iov_base = bounce_buffer;
        iov.iov_len = n * BDRV_SECTOR_SIZE;
        qemu_iovec_init_external(&bounce_qiov, &iov, 1);
        ret = blk_co_preadv(blk, start * job->cluster_size,
                            bounce_qiov.size, &bounce_qiov,
                            is_write_notifier ? BDRV_REQ_NO_SERIALISING : 0);
        if (ret < 0) {
            trace_backup_do_cow_read_fail(job, start, ret);
            if (error_is_read) {
                *error_is_read = true;
            }
            goto out;
        }
        if (buffer_is_zero(iov.iov_base, iov.iov_len)) {
            ret = blk_co_pwrite_zeroes(job->target, start * job->cluster_size,
                                       bounce_qiov.size, BDRV_REQ_MAY_UNMAP);
        } else {
            ret = blk_co_pwritev(job->target, start * job->cluster_size,
                                 bounce_qiov.size, &bounce_qiov,
                                 job->compress ? BDRV_REQ_WRITE_COMPRESSED : 0);
        }
        if (ret < 0) {
            trace_backup_do_cow_write_fail(job, start, ret);
            if (error_is_read) {
                *error_is_read = false;
            }
            goto out;
        }
        set_bit(start, job->done_bitmap);
        /* Publish progress, guest I/O counts as progress too.  Note that the
         * offset field is an opaque progress value, it is not a disk offset.
         */
        job->sectors_read += n;
        job->common.offset += n * BDRV_SECTOR_SIZE;
    }
 out:
    if (bounce_buffer) {
        qemu_vfree(bounce_buffer);
    }
    cow_request_end(&cow_request);
    trace_backup_do_cow_return(job, sector_num, nb_sectors, ret);
    qemu_co_rwlock_unlock(&job->flush_rwlock);
    return ret;
 }
 static int coroutine_fn backup_before_write_notify(
        NotifierWithReturn *notifier,
        void *opaque)
 {
    BackupBlockJob *job = container_of(notifier, BackupBlockJob, before_write);
    BdrvTrackedRequest *req = opaque;
    int64_t sector_num = req->offset >> BDRV_SECTOR_BITS;
    int nb_sectors = req->bytes >> BDRV_SECTOR_BITS;
    assert(req->bs == blk_bs(job->common.blk));
    assert((req->offset & (BDRV_SECTOR_SIZE - 1)) == 0);
    assert((req->bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
    return backup_do_cow(job, sector_num, nb_sectors, NULL, true);
 }
 static void backup_set_speed(BlockJob *job, int64_t speed, Error **errp)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    if (speed < 0) {
        error_setg(errp, QERR_INVALID_PARAMETER, "speed");
        return;
    }
    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
 }
 static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
 {
    BdrvDirtyBitmap *bm;
    BlockDriverState *bs = blk_bs(job->common.blk);
    if (ret < 0 || block_job_is_cancelled(&job->common)) {
        /* Merge the successor back into the parent, delete nothing. */
        bm = bdrv_reclaim_dirty_bitmap(bs, job->sync_bitmap, NULL);
        assert(bm);
    } else {
        /* Everything is fine, delete this bitmap and install the backup. */
        bm = bdrv_dirty_bitmap_abdicate(bs, job->sync_bitmap, NULL);
        assert(bm);
    }
 }
 static void backup_commit(BlockJob *job)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    if (s->sync_bitmap) {
        backup_cleanup_sync_bitmap(s, 0);
    }
 }
 static void backup_abort(BlockJob *job)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    if (s->sync_bitmap) {
        backup_cleanup_sync_bitmap(s, -1);
    }
 }
 static void backup_clean(BlockJob *job)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    assert(s->target);
    blk_unref(s->target);
    s->target = NULL;
 }
 static void backup_attached_aio_context(BlockJob *job, AioContext *aio_context)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    blk_set_aio_context(s->target, aio_context);
 }
 void backup_do_checkpoint(BlockJob *job, Error **errp)
 {
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
    int64_t len;
    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
    if (backup_job->sync_mode != MIRROR_SYNC_MODE_NONE) {
        error_setg(errp, "The backup job only supports block checkpoint in"
                   " sync=none mode");
        return;
    }
    len = DIV_ROUND_UP(backup_job->common.len, backup_job->cluster_size);
    bitmap_zero(backup_job->done_bitmap, len);
 }
 void backup_wait_for_overlapping_requests(BlockJob *job, int64_t sector_num,
                                          int nb_sectors)
 {
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
    int64_t start, end;
    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
    start = sector_num / sectors_per_cluster;
    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
    wait_for_overlapping_requests(backup_job, start, end);
 }
 void backup_cow_request_begin(CowRequest *req, BlockJob *job,
                              int64_t sector_num,
                              int nb_sectors)
 {
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
    int64_t start, end;
    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
    start = sector_num / sectors_per_cluster;
    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
    cow_request_begin(req, backup_job, start, end);
 }
 void backup_cow_request_end(CowRequest *req)
 {
    cow_request_end(req);
 }
 static void backup_drain(BlockJob *job)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    /* Need to keep a reference in case blk_drain triggers execution
     * of backup_complete...
     */
    if (s->target) {
        BlockBackend *target = s->target;
        blk_ref(target);
        blk_drain(target);
        blk_unref(target);
    }
 }
 static BlockErrorAction backup_error_action(BackupBlockJob *job,
                                            bool read, int error)
 {
    if (read) {
        return block_job_error_action(&job->common, job->on_source_error,
                                      true, error);
    } else {
        return block_job_error_action(&job->common, job->on_target_error,
                                      false, error);
    }
 }
 typedef struct {
    int ret;
 } BackupCompleteData;
 static void backup_complete(BlockJob *job, void *opaque)
 {
    BackupCompleteData *data = opaque;
    block_job_completed(job, data->ret);
    g_free(data);
 }
 static bool coroutine_fn yield_and_check(BackupBlockJob *job)
 {
    if (block_job_is_cancelled(&job->common)) {
        return true;
    }
    /* we need to yield so that bdrv_drain_all() returns.
     * (without, VM does not reboot)
     */
    if (job->common.speed) {
        uint64_t delay_ns = ratelimit_calculate_delay(&job->limit,
                                                      job->sectors_read);
        job->sectors_read = 0;
        block_job_sleep_ns(&job->common, QEMU_CLOCK_REALTIME, delay_ns);
    } else {
        block_job_sleep_ns(&job->common, QEMU_CLOCK_REALTIME, 0);
    }
    if (block_job_is_cancelled(&job->common)) {
        return true;
    }
    return false;
 }
 static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
 {
    bool error_is_read;
    int ret = 0;
    int clusters_per_iter;
    uint32_t granularity;
    int64_t sector;
    int64_t cluster;
    int64_t end;
    int64_t last_cluster = -1;
    int64_t sectors_per_cluster = cluster_size_sectors(job);
    BdrvDirtyBitmapIter *dbi;
    granularity = bdrv_dirty_bitmap_granularity(job->sync_bitmap);
    clusters_per_iter = MAX((granularity / job->cluster_size), 1);
    dbi = bdrv_dirty_iter_new(job->sync_bitmap, 0);
    /* Find the next dirty sector(s) */
    while ((sector = bdrv_dirty_iter_next(dbi)) != -1) {
        cluster = sector / sectors_per_cluster;
        /* Fake progress updates for any clusters we skipped */
        if (cluster != last_cluster + 1) {
            job->common.offset += ((cluster - last_cluster - 1) *
                                   job->cluster_size);
        }
        for (end = cluster + clusters_per_iter; cluster < end; cluster++) {
            do {
                if (yield_and_check(job)) {
                    goto out;
                }
                ret = backup_do_cow(job, cluster * sectors_per_cluster,
                                    sectors_per_cluster, &error_is_read,
                                    false);
                if ((ret < 0) &&
                    backup_error_action(job, error_is_read, -ret) ==
                    BLOCK_ERROR_ACTION_REPORT) {
                    goto out;
                }
            } while (ret < 0);
        }
        /* If the bitmap granularity is smaller than the backup granularity,
         * we need to advance the iterator pointer to the next cluster. */
        if (granularity < job->cluster_size) {
            bdrv_set_dirty_iter(dbi, cluster * sectors_per_cluster);
        }
        last_cluster = cluster - 1;
    }
    /* Play some final catchup with the progress meter */
    end = DIV_ROUND_UP(job->common.len, job->cluster_size);
    if (last_cluster + 1 < end) {
        job->common.offset += ((end - last_cluster - 1) * job->cluster_size);
    }
 out:
    bdrv_dirty_iter_free(dbi);
    return ret;
 }
 static void coroutine_fn backup_run(void *opaque)
 {
    BackupBlockJob *job = opaque;
    BackupCompleteData *data;
    BlockDriverState *bs = blk_bs(job->common.blk);
    int64_t start, end;
    int64_t sectors_per_cluster = cluster_size_sectors(job);
    int ret = 0;
    QLIST_INIT(&job->inflight_reqs);
    qemu_co_rwlock_init(&job->flush_rwlock);
    start = 0;
    end = DIV_ROUND_UP(job->common.len, job->cluster_size);
    job->done_bitmap = bitmap_new(end);
    job->before_write.notify = backup_before_write_notify;
    bdrv_add_before_write_notifier(bs, &job->before_write);
    if (job->sync_mode == MIRROR_SYNC_MODE_NONE) {
        while (!block_job_is_cancelled(&job->common)) {
            /* Yield until the job is cancelled.  We just let our before_write
             * notify callback service CoW requests. */
            block_job_yield(&job->common);
        }
    } else if (job->sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
        ret = backup_run_incremental(job);
    } else {
        /* Both FULL and TOP SYNC_MODE's require copying.. */
        for (; start < end; start++) {
            bool error_is_read;
            if (yield_and_check(job)) {
                break;
            }
            if (job->sync_mode == MIRROR_SYNC_MODE_TOP) {
                int i, n;
                int alloced = 0;
                /* Check to see if these blocks are already in the
                 * backing file. */
                for (i = 0; i < sectors_per_cluster;) {
                    /* bdrv_is_allocated() only returns true/false based
                     * on the first set of sectors it comes across that
                     * are are all in the same state.
                     * For that reason we must verify each sector in the
                     * backup cluster length.  We end up copying more than
                     * needed but at some point that is always the case. */
                    alloced =
                        bdrv_is_allocated(bs,
                                start * sectors_per_cluster + i,
                                sectors_per_cluster - i, &n);
                    i += n;
                    if (alloced == 1 || n == 0) {
                        break;
                    }
                }
                /* If the above loop never found any sectors that are in
                 * the topmost image, skip this backup. */
                if (alloced == 0) {
                    continue;
                }
            }
            /* FULL sync mode we copy the whole drive. */
            ret = backup_do_cow(job, start * sectors_per_cluster,
                                sectors_per_cluster, &error_is_read, false);
            if (ret < 0) {
                /* Depending on error action, fail now or retry cluster */
                BlockErrorAction action =
                    backup_error_action(job, error_is_read, -ret);
                if (action == BLOCK_ERROR_ACTION_REPORT) {
                    break;
                } else {
                    start--;
                    continue;
                }
            }
        }
    }
    notifier_with_return_remove(&job->before_write);
    /* wait until pending backup_do_cow() calls have completed */
    qemu_co_rwlock_wrlock(&job->flush_rwlock);
    qemu_co_rwlock_unlock(&job->flush_rwlock);
    g_free(job->done_bitmap);
    data = g_malloc(sizeof(*data));
    data->ret = ret;
    block_job_defer_to_main_loop(&job->common, backup_complete, data);
 }
 static const BlockJobDriver backup_job_driver = {
    .instance_size          = sizeof(BackupBlockJob),
    .job_type               = BLOCK_JOB_TYPE_BACKUP,
    .start                  = backup_run,
    .set_speed              = backup_set_speed,
    .commit                 = backup_commit,
    .abort                  = backup_abort,
    .clean                  = backup_clean,
    .attached_aio_context   = backup_attached_aio_context,
    .drain                  = backup_drain,
 };
 BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                  BlockDriverState *target, int64_t speed,
                  MirrorSyncMode sync_mode, BdrvDirtyBitmap *sync_bitmap,
                  bool compress,
                  BlockdevOnError on_source_error,
                  BlockdevOnError on_target_error,
                  int creation_flags,
                  BlockCompletionFunc *cb, void *opaque,
                  BlockJobTxn *txn, Error **errp)
 {
    int64_t len;
    BlockDriverInfo bdi;
    BackupBlockJob *job = NULL;
    int ret;
    assert(bs);
    assert(target);
    if (bs == target) {
        error_setg(errp, "Source and target cannot be the same");
        return NULL;
    }
    if (!bdrv_is_inserted(bs)) {
        error_setg(errp, "Device is not inserted: %s",
                   bdrv_get_device_name(bs));
        return NULL;
    }
    if (!bdrv_is_inserted(target)) {
        error_setg(errp, "Device is not inserted: %s",
                   bdrv_get_device_name(target));
        return NULL;
    }
    if (compress && target->drv->bdrv_co_pwritev_compressed == NULL) {
        error_setg(errp, "Compression is not supported for this drive %s",
                   bdrv_get_device_name(target));
        return NULL;
    }
    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_BACKUP_SOURCE, errp)) {
        return NULL;
    }
    if (bdrv_op_is_blocked(target, BLOCK_OP_TYPE_BACKUP_TARGET, errp)) {
        return NULL;
    }
    if (sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
        if (!sync_bitmap) {
            error_setg(errp, "must provide a valid bitmap name for "
                             "\"incremental\" sync mode");
            return NULL;
        }
        /* Create a new bitmap, and freeze/disable this one. */
        if (bdrv_dirty_bitmap_create_successor(bs, sync_bitmap, errp) < 0) {
            return NULL;
        }
    } else if (sync_bitmap) {
        error_setg(errp,
                   "a sync_bitmap was provided to backup_run, "
                   "but received an incompatible sync_mode (%s)",
                   MirrorSyncMode_lookup[sync_mode]);
        return NULL;
    }
    len = bdrv_getlength(bs);
    if (len < 0) {
        error_setg_errno(errp, -len, "unable to get length for '%s'",
                         bdrv_get_device_name(bs));
        goto error;
    }
    job = block_job_create(job_id, &backup_job_driver, bs, speed,
                           creation_flags, cb, opaque, errp);
    if (!job) {
        goto error;
    }
    job->target = blk_new();
    blk_insert_bs(job->target, target);
    job->on_source_error = on_source_error;
    job->on_target_error = on_target_error;
    job->sync_mode = sync_mode;
    job->sync_bitmap = sync_mode == MIRROR_SYNC_MODE_INCREMENTAL ?
                       sync_bitmap : NULL;
    job->compress = compress;
    /* If there is no backing file on the target, we cannot rely on COW if our
     * backup cluster size is smaller than the target cluster size. Even for
     * targets with a backing file, try to avoid COW if possible. */
    ret = bdrv_get_info(target, &bdi);
    if (ret < 0 && !target->backing) {
        error_setg_errno(errp, -ret,
            "Couldn't determine the cluster size of the target image, "
            "which has no backing file");
        error_append_hint(errp,
            "Aborting, since this may create an unusable destination image\n");
        goto error;
    } else if (ret < 0 && target->backing) {
        /* Not fatal; just trudge on ahead. */
        job->cluster_size = BACKUP_CLUSTER_SIZE_DEFAULT;
    } else {
        job->cluster_size = MAX(BACKUP_CLUSTER_SIZE_DEFAULT, bdi.cluster_size);
    }
    block_job_add_bdrv(&job->common, target);
    job->common.len = len;
    block_job_txn_add_job(txn, &job->common);
    return &job->common;
 error:
    if (sync_bitmap) {
        bdrv_reclaim_dirty_bitmap(bs, sync_bitmap, NULL);
    }
    if (job) {
        backup_clean(&job->common);
        block_job_unref(&job->common);
    }
    return NULL;
 }
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -1,759 +0,0 @@
 /*
 * Block protocol for I/O error injection
 *
 * Copyright (c) 2010 Kevin Wolf <kwolf@redhat.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "qemu/config-file.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
 #include "qapi/qmp/qbool.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qint.h"
 #include "qapi/qmp/qstring.h"
 #include "sysemu/qtest.h"
 typedef struct BDRVBlkdebugState {
    int state;
    int new_state;
    int align;
    /* For blkdebug_refresh_filename() */
    char *config_file;
    QLIST_HEAD(, BlkdebugRule) rules[BLKDBG__MAX];
    QSIMPLEQ_HEAD(, BlkdebugRule) active_rules;
    QLIST_HEAD(, BlkdebugSuspendedReq) suspended_reqs;
 } BDRVBlkdebugState;
 typedef struct BlkdebugAIOCB {
    BlockAIOCB common;
    int ret;
 } BlkdebugAIOCB;
 typedef struct BlkdebugSuspendedReq {
    Coroutine *co;
    char *tag;
    QLIST_ENTRY(BlkdebugSuspendedReq) next;
 } BlkdebugSuspendedReq;
 enum {
    ACTION_INJECT_ERROR,
    ACTION_SET_STATE,
    ACTION_SUSPEND,
 };
 typedef struct BlkdebugRule {
    BlkdebugEvent event;
    int action;
    int state;
    union {
        struct {
            int error;
            int immediately;
            int once;
            int64_t offset;
        } inject;
        struct {
            int new_state;
        } set_state;
        struct {
            char *tag;
        } suspend;
    } options;
    QLIST_ENTRY(BlkdebugRule) next;
    QSIMPLEQ_ENTRY(BlkdebugRule) active_next;
 } BlkdebugRule;
 static QemuOptsList inject_error_opts = {
    .name = "inject-error",
    .head = QTAILQ_HEAD_INITIALIZER(inject_error_opts.head),
    .desc = {
        {
            .name = "event",
            .type = QEMU_OPT_STRING,
        },
        {
            .name = "state",
            .type = QEMU_OPT_NUMBER,
        },
        {
            .name = "errno",
            .type = QEMU_OPT_NUMBER,
        },
        {
            .name = "sector",
            .type = QEMU_OPT_NUMBER,
        },
        {
            .name = "once",
            .type = QEMU_OPT_BOOL,
        },
        {
            .name = "immediately",
            .type = QEMU_OPT_BOOL,
        },
        { /* end of list */ }
    },
 };
 static QemuOptsList set_state_opts = {
    .name = "set-state",
    .head = QTAILQ_HEAD_INITIALIZER(set_state_opts.head),
    .desc = {
        {
            .name = "event",
            .type = QEMU_OPT_STRING,
        },
        {
            .name = "state",
            .type = QEMU_OPT_NUMBER,
        },
        {
            .name = "new_state",
            .type = QEMU_OPT_NUMBER,
        },
        { /* end of list */ }
    },
 };
 static QemuOptsList *config_groups[] = {
    &inject_error_opts,
    &set_state_opts,
    NULL
 };
 static int get_event_by_name(const char *name, BlkdebugEvent *event)
 {
    int i;
    for (i = 0; i < BLKDBG__MAX; i++) {
        if (!strcmp(BlkdebugEvent_lookup[i], name)) {
            *event = i;
            return 0;
        }
    }
    return -1;
 }
 struct add_rule_data {
    BDRVBlkdebugState *s;
    int action;
 };
 static int add_rule(void *opaque, QemuOpts *opts, Error **errp)
 {
    struct add_rule_data *d = opaque;
    BDRVBlkdebugState *s = d->s;
    const char* event_name;
    BlkdebugEvent event;
    struct BlkdebugRule *rule;
    int64_t sector;
    /* Find the right event for the rule */
    event_name = qemu_opt_get(opts, "event");
    if (!event_name) {
        error_setg(errp, "Missing event name for rule");
        return -1;
    } else if (get_event_by_name(event_name, &event) < 0) {
        error_setg(errp, "Invalid event name \"%s\"", event_name);
        return -1;
    }
    /* Set attributes common for all actions */
    rule = g_malloc0(sizeof(*rule));
    *rule = (struct BlkdebugRule) {
        .event  = event,
        .action = d->action,
        .state  = qemu_opt_get_number(opts, "state", 0),
    };
    /* Parse action-specific options */
    switch (d->action) {
    case ACTION_INJECT_ERROR:
        rule->options.inject.error = qemu_opt_get_number(opts, "errno", EIO);
        rule->options.inject.once  = qemu_opt_get_bool(opts, "once", 0);
        rule->options.inject.immediately =
            qemu_opt_get_bool(opts, "immediately", 0);
        sector = qemu_opt_get_number(opts, "sector", -1);
        rule->options.inject.offset =
            sector == -1 ? -1 : sector * BDRV_SECTOR_SIZE;
        break;
    case ACTION_SET_STATE:
        rule->options.set_state.new_state =
            qemu_opt_get_number(opts, "new_state", 0);
        break;
    case ACTION_SUSPEND:
        rule->options.suspend.tag =
            g_strdup(qemu_opt_get(opts, "tag"));
        break;
    };
    /* Add the rule */
    QLIST_INSERT_HEAD(&s->rules[event], rule, next);
    return 0;
 }
 static void remove_rule(BlkdebugRule *rule)
 {
    switch (rule->action) {
    case ACTION_INJECT_ERROR:
    case ACTION_SET_STATE:
        break;
    case ACTION_SUSPEND:
        g_free(rule->options.suspend.tag);
        break;
    }
    QLIST_REMOVE(rule, next);
    g_free(rule);
 }
 static int read_config(BDRVBlkdebugState *s, const char *filename,
                       QDict *options, Error **errp)
 {
    FILE *f = NULL;
    int ret;
    struct add_rule_data d;
    Error *local_err = NULL;
    if (filename) {
        f = fopen(filename, "r");
        if (f == NULL) {
            error_setg_errno(errp, errno, "Could not read blkdebug config file");
            return -errno;
        }
        ret = qemu_config_parse(f, config_groups, filename);
        if (ret < 0) {
            error_setg(errp, "Could not parse blkdebug config file");
            ret = -EINVAL;
            goto fail;
        }
    }
    qemu_config_parse_qdict(options, config_groups, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        ret = -EINVAL;
        goto fail;
    }
    d.s = s;
    d.action = ACTION_INJECT_ERROR;
    qemu_opts_foreach(&inject_error_opts, add_rule, &d, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        ret = -EINVAL;
        goto fail;
    }
    d.action = ACTION_SET_STATE;
    qemu_opts_foreach(&set_state_opts, add_rule, &d, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        ret = -EINVAL;
        goto fail;
    }
    ret = 0;
 fail:
    qemu_opts_reset(&inject_error_opts);
    qemu_opts_reset(&set_state_opts);
    if (f) {
        fclose(f);
    }
    return ret;
 }
 /* Valid blkdebug filenames look like blkdebug:path/to/config:path/to/image */
 static void blkdebug_parse_filename(const char *filename, QDict *options,
                                    Error **errp)
 {
    const char *c;
    /* Parse the blkdebug: prefix */
    if (!strstart(filename, "blkdebug:", &filename)) {
        /* There was no prefix; therefore, all options have to be already
           present in the QDict (except for the filename) */
        qdict_put(options, "x-image", qstring_from_str(filename));
        return;
    }
    /* Parse config file path */
    c = strchr(filename, ':');
    if (c == NULL) {
        error_setg(errp, "blkdebug requires both config file and image path");
        return;
    }
    if (c != filename) {
        QString *config_path;
        config_path = qstring_from_substr(filename, 0, c - filename - 1);
        qdict_put(options, "config", config_path);
    }
    /* TODO Allow multi-level nesting and set file.filename here */
    filename = c + 1;
    qdict_put(options, "x-image", qstring_from_str(filename));
 }
 static QemuOptsList runtime_opts = {
    .name = "blkdebug",
    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
    .desc = {
        {
            .name = "config",
            .type = QEMU_OPT_STRING,
            .help = "Path to the configuration file",
        },
        {
            .name = "x-image",
            .type = QEMU_OPT_STRING,
            .help = "[internal use only, will be removed]",
        },
        {
            .name = "align",
            .type = QEMU_OPT_SIZE,
            .help = "Required alignment in bytes",
        },
        { /* end of list */ }
    },
 };
 static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
                         Error **errp)
 {
    BDRVBlkdebugState *s = bs->opaque;
    QemuOpts *opts;
    Error *local_err = NULL;
    uint64_t align;
    int ret;
    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        ret = -EINVAL;
        goto out;
    }
    /* Read rules from config file or command line options */
    s->config_file = g_strdup(qemu_opt_get(opts, "config"));
    ret = read_config(s, s->config_file, options, errp);
    if (ret) {
        goto out;
    }
    /* Set initial state */
    s->state = 1;
    /* Open the image file */
    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options, "image",
                               bs, &child_file, false, &local_err);
    if (local_err) {
        ret = -EINVAL;
        error_propagate(errp, local_err);
        goto out;
    }
    /* Set request alignment */
    align = qemu_opt_get_size(opts, "align", 0);
    if (align < INT_MAX && is_power_of_2(align)) {
        s->align = align;
    } else if (align) {
        error_setg(errp, "Invalid alignment");
        ret = -EINVAL;
        goto fail_unref;
    }
    ret = 0;
    goto out;
 fail_unref:
    bdrv_unref_child(bs, bs->file);
 out:
    if (ret < 0) {
        g_free(s->config_file);
    }
    qemu_opts_del(opts);
    return ret;
 }
 static int inject_error(BlockDriverState *bs, BlkdebugRule *rule)
 {
    BDRVBlkdebugState *s = bs->opaque;
    int error = rule->options.inject.error;
    bool immediately = rule->options.inject.immediately;
    if (rule->options.inject.once) {
        QSIMPLEQ_REMOVE(&s->active_rules, rule, BlkdebugRule, active_next);
        remove_rule(rule);
    }
    if (!immediately) {
        aio_co_schedule(qemu_get_current_aio_context(), qemu_coroutine_self());
        qemu_coroutine_yield();
    }
    return -error;
 }
 static int coroutine_fn
 blkdebug_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
                   QEMUIOVector *qiov, int flags)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugRule *rule = NULL;
    QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {
        uint64_t inject_offset = rule->options.inject.offset;
        if (inject_offset == -1 ||
            (inject_offset >= offset && inject_offset < offset + bytes))
        {
            break;
        }
    }
    if (rule && rule->options.inject.error) {
        return inject_error(bs, rule);
    }
    return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
 }
 static int coroutine_fn
 blkdebug_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
                    QEMUIOVector *qiov, int flags)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugRule *rule = NULL;
    QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {
        uint64_t inject_offset = rule->options.inject.offset;
        if (inject_offset == -1 ||
            (inject_offset >= offset && inject_offset < offset + bytes))
        {
            break;
        }
    }
    if (rule && rule->options.inject.error) {
        return inject_error(bs, rule);
    }
    return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
 }
 static int blkdebug_co_flush(BlockDriverState *bs)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugRule *rule = NULL;
    QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {
        if (rule->options.inject.offset == -1) {
            break;
        }
    }
    if (rule && rule->options.inject.error) {
        return inject_error(bs, rule);
    }
    return bdrv_co_flush(bs->file->bs);
 }
 static void blkdebug_close(BlockDriverState *bs)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugRule *rule, *next;
    int i;
    for (i = 0; i < BLKDBG__MAX; i++) {
        QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
            remove_rule(rule);
        }
    }
    g_free(s->config_file);
 }
 static void suspend_request(BlockDriverState *bs, BlkdebugRule *rule)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugSuspendedReq r;
    r = (BlkdebugSuspendedReq) {
        .co         = qemu_coroutine_self(),
        .tag        = g_strdup(rule->options.suspend.tag),
    };
    remove_rule(rule);
    QLIST_INSERT_HEAD(&s->suspended_reqs, &r, next);
    if (!qtest_enabled()) {
        printf("blkdebug: Suspended request '%s'\n", r.tag);
    }
    qemu_coroutine_yield();
    if (!qtest_enabled()) {
        printf("blkdebug: Resuming request '%s'\n", r.tag);
    }
    QLIST_REMOVE(&r, next);
    g_free(r.tag);
 }
 static bool process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
    bool injected)
 {
    BDRVBlkdebugState *s = bs->opaque;
    /* Only process rules for the current state */
    if (rule->state && rule->state != s->state) {
        return injected;
    }
    /* Take the action */
    switch (rule->action) {
    case ACTION_INJECT_ERROR:
        if (!injected) {
            QSIMPLEQ_INIT(&s->active_rules);
            injected = true;
        }
        QSIMPLEQ_INSERT_HEAD(&s->active_rules, rule, active_next);
        break;
    case ACTION_SET_STATE:
        s->new_state = rule->options.set_state.new_state;
        break;
    case ACTION_SUSPEND:
        suspend_request(bs, rule);
        break;
    }
    return injected;
 }
 static void blkdebug_debug_event(BlockDriverState *bs, BlkdebugEvent event)
 {
    BDRVBlkdebugState *s = bs->opaque;
    struct BlkdebugRule *rule, *next;
    bool injected;
    assert((int)event >= 0 && event < BLKDBG__MAX);
    injected = false;
    s->new_state = s->state;
    QLIST_FOREACH_SAFE(rule, &s->rules[event], next, next) {
        injected = process_rule(bs, rule, injected);
    }
    s->state = s->new_state;
 }
 static int blkdebug_debug_breakpoint(BlockDriverState *bs, const char *event,
                                     const char *tag)
 {
    BDRVBlkdebugState *s = bs->opaque;
    struct BlkdebugRule *rule;
    BlkdebugEvent blkdebug_event;
    if (get_event_by_name(event, &blkdebug_event) < 0) {
        return -ENOENT;
    }
    rule = g_malloc(sizeof(*rule));
    *rule = (struct BlkdebugRule) {
        .event  = blkdebug_event,
        .action = ACTION_SUSPEND,
        .state  = 0,
        .options.suspend.tag = g_strdup(tag),
    };
    QLIST_INSERT_HEAD(&s->rules[blkdebug_event], rule, next);
    return 0;
 }
 static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugSuspendedReq *r, *next;
    QLIST_FOREACH_SAFE(r, &s->suspended_reqs, next, next) {
        if (!strcmp(r->tag, tag)) {
            qemu_coroutine_enter(r->co);
            return 0;
        }
    }
    return -ENOENT;
 }
 static int blkdebug_debug_remove_breakpoint(BlockDriverState *bs,
                                            const char *tag)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugSuspendedReq *r, *r_next;
    BlkdebugRule *rule, *next;
    int i, ret = -ENOENT;
    for (i = 0; i < BLKDBG__MAX; i++) {
        QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
            if (rule->action == ACTION_SUSPEND &&
                !strcmp(rule->options.suspend.tag, tag)) {
                remove_rule(rule);
                ret = 0;
            }
        }
    }
    QLIST_FOREACH_SAFE(r, &s->suspended_reqs, next, r_next) {
        if (!strcmp(r->tag, tag)) {
            qemu_coroutine_enter(r->co);
            ret = 0;
        }
    }
    return ret;
 }
 static bool blkdebug_debug_is_suspended(BlockDriverState *bs, const char *tag)
 {
    BDRVBlkdebugState *s = bs->opaque;
    BlkdebugSuspendedReq *r;
    QLIST_FOREACH(r, &s->suspended_reqs, next) {
        if (!strcmp(r->tag, tag)) {
            return true;
        }
    }
    return false;
 }
 static int64_t blkdebug_getlength(BlockDriverState *bs)
 {
    return bdrv_getlength(bs->file->bs);
 }
 static int blkdebug_truncate(BlockDriverState *bs, int64_t offset)
 {
    return bdrv_truncate(bs->file, offset);
 }
 static void blkdebug_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVBlkdebugState *s = bs->opaque;
    QDict *opts;
    const QDictEntry *e;
    bool force_json = false;
    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
        if (strcmp(qdict_entry_key(e), "config") &&
            strcmp(qdict_entry_key(e), "x-image"))
        {
            force_json = true;
            break;
        }
    }
    if (force_json && !bs->file->bs->full_open_options) {
        /* The config file cannot be recreated, so creating a plain filename
         * is impossible */
        return;
    }
    if (!force_json && bs->file->bs->exact_filename[0]) {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "blkdebug:%s:%s", s->config_file ?: "",
                 bs->file->bs->exact_filename);
    }
    opts = qdict_new();
    qdict_put_obj(opts, "driver", QOBJECT(qstring_from_str("blkdebug")));
    QINCREF(bs->file->bs->full_open_options);
    qdict_put_obj(opts, "image", QOBJECT(bs->file->bs->full_open_options));
    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
        if (strcmp(qdict_entry_key(e), "x-image")) {
            qobject_incref(qdict_entry_value(e));
            qdict_put_obj(opts, qdict_entry_key(e), qdict_entry_value(e));
        }
    }
    bs->full_open_options = opts;
 }
 static void blkdebug_refresh_limits(BlockDriverState *bs, Error **errp)
 {
    BDRVBlkdebugState *s = bs->opaque;
    if (s->align) {
        bs->bl.request_alignment = s->align;
    }
 }
 static int blkdebug_reopen_prepare(BDRVReopenState *reopen_state,
                                   BlockReopenQueue *queue, Error **errp)
 {
    return 0;
 }
 static BlockDriver bdrv_blkdebug = {
    .format_name            = "blkdebug",
    .protocol_name          = "blkdebug",
    .instance_size          = sizeof(BDRVBlkdebugState),
    .bdrv_parse_filename    = blkdebug_parse_filename,
    .bdrv_file_open         = blkdebug_open,
    .bdrv_close             = blkdebug_close,
    .bdrv_reopen_prepare    = blkdebug_reopen_prepare,
    .bdrv_getlength         = blkdebug_getlength,
    .bdrv_truncate          = blkdebug_truncate,
    .bdrv_refresh_filename  = blkdebug_refresh_filename,
    .bdrv_refresh_limits    = blkdebug_refresh_limits,
    .bdrv_co_preadv         = blkdebug_co_preadv,
    .bdrv_co_pwritev        = blkdebug_co_pwritev,
    .bdrv_co_flush_to_disk  = blkdebug_co_flush,
    .bdrv_debug_event           = blkdebug_debug_event,
    .bdrv_debug_breakpoint      = blkdebug_debug_breakpoint,
    .bdrv_debug_remove_breakpoint
                                = blkdebug_debug_remove_breakpoint,
    .bdrv_debug_resume          = blkdebug_debug_resume,
    .bdrv_debug_is_suspended    = blkdebug_debug_is_suspended,
 };
 static void bdrv_blkdebug_init(void)
 {
    bdrv_register(&bdrv_blkdebug);
 }
 block_init(bdrv_blkdebug_init);
--- a/block/blkreplay.c
+++ b/block/blkreplay.c
@@ -1,155 +0,0 @@
 /*
 * Block protocol for record/replay
 *
 * Copyright (c) 2010-2016 Institute for System Programming
 *                         of the Russian Academy of Sciences.
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "block/block_int.h"
 #include "sysemu/replay.h"
 #include "qapi/error.h"
 typedef struct Request {
    Coroutine *co;
    QEMUBH *bh;
 } Request;
 static int blkreplay_open(BlockDriverState *bs, QDict *options, int flags,
                          Error **errp)
 {
    Error *local_err = NULL;
    int ret;
    /* Open the image file */
    bs->file = bdrv_open_child(NULL, options, "image",
                               bs, &child_file, false, &local_err);
    if (local_err) {
        ret = -EINVAL;
        error_propagate(errp, local_err);
        goto fail;
    }
    ret = 0;
 fail:
    if (ret < 0) {
        bdrv_unref_child(bs, bs->file);
    }
    return ret;
 }
 static void blkreplay_close(BlockDriverState *bs)
 {
 }
 static int64_t blkreplay_getlength(BlockDriverState *bs)
 {
    return bdrv_getlength(bs->file->bs);
 }
 /* This bh is used for synchronization of return from coroutines.
   It continues yielded coroutine which then finishes its execution.
   BH is called adjusted to some replay checkpoint, therefore
   record and replay will always finish coroutines deterministically.
 */
 static void blkreplay_bh_cb(void *opaque)
 {
    Request *req = opaque;
    aio_co_wake(req->co);
    qemu_bh_delete(req->bh);
    g_free(req);
 }
 static void block_request_create(uint64_t reqid, BlockDriverState *bs,
                                 Coroutine *co)
 {
    Request *req = g_new(Request, 1);
    *req = (Request) {
        .co = co,
        .bh = aio_bh_new(bdrv_get_aio_context(bs), blkreplay_bh_cb, req),
    };
    replay_block_event(req->bh, reqid);
 }
 static int coroutine_fn blkreplay_co_preadv(BlockDriverState *bs,
    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
    uint64_t reqid = blkreplay_next_id();
    int ret = bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
    return ret;
 }
 static int coroutine_fn blkreplay_co_pwritev(BlockDriverState *bs,
    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
    uint64_t reqid = blkreplay_next_id();
    int ret = bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
    return ret;
 }
 static int coroutine_fn blkreplay_co_pwrite_zeroes(BlockDriverState *bs,
    int64_t offset, int count, BdrvRequestFlags flags)
 {
    uint64_t reqid = blkreplay_next_id();
    int ret = bdrv_co_pwrite_zeroes(bs->file, offset, count, flags);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
    return ret;
 }
 static int coroutine_fn blkreplay_co_pdiscard(BlockDriverState *bs,
                                              int64_t offset, int count)
 {
    uint64_t reqid = blkreplay_next_id();
    int ret = bdrv_co_pdiscard(bs->file->bs, offset, count);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
    return ret;
 }
 static int coroutine_fn blkreplay_co_flush(BlockDriverState *bs)
 {
    uint64_t reqid = blkreplay_next_id();
    int ret = bdrv_co_flush(bs->file->bs);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
    return ret;
 }
 static BlockDriver bdrv_blkreplay = {
    .format_name            = "blkreplay",
    .protocol_name          = "blkreplay",
    .instance_size          = 0,
    .bdrv_file_open         = blkreplay_open,
    .bdrv_close             = blkreplay_close,
    .bdrv_getlength         = blkreplay_getlength,
    .bdrv_co_preadv         = blkreplay_co_preadv,
    .bdrv_co_pwritev        = blkreplay_co_pwritev,
    .bdrv_co_pwrite_zeroes  = blkreplay_co_pwrite_zeroes,
    .bdrv_co_pdiscard       = blkreplay_co_pdiscard,
    .bdrv_co_flush          = blkreplay_co_flush,
 };
 static void bdrv_blkreplay_init(void)
 {
    bdrv_register(&bdrv_blkreplay);
 }
 block_init(bdrv_blkreplay_init);
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -1,339 +0,0 @@
 /*
 * Block protocol for block driver correctness testing
 *
 * Copyright (C) 2010 IBM, Corp.
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/sockets.h" /* for EINPROGRESS on Windows */
 #include "block/block_int.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qstring.h"
 #include "qemu/cutils.h"
 typedef struct {
    BdrvChild *test_file;
 } BDRVBlkverifyState;
 typedef struct BlkverifyRequest {
    Coroutine *co;
    BlockDriverState *bs;
    /* Request metadata */
    bool is_write;
    uint64_t offset;
    uint64_t bytes;
    int flags;
    int (*request_fn)(BdrvChild *, int64_t, unsigned int, QEMUIOVector *,
                      BdrvRequestFlags);
    int ret;                    /* test image result */
    int raw_ret;                /* raw image result */
    unsigned int done;          /* completion counter */
    QEMUIOVector *qiov;         /* user I/O vector */
    QEMUIOVector *raw_qiov;     /* cloned I/O vector for raw file */
 } BlkverifyRequest;
 static void GCC_FMT_ATTR(2, 3) blkverify_err(BlkverifyRequest *r,
                                             const char *fmt, ...)
 {
    va_list ap;
    va_start(ap, fmt);
    fprintf(stderr, "blkverify: %s offset=%" PRId64 " bytes=%" PRId64 " ",
            r->is_write ? "write" : "read", r->offset, r->bytes);
    vfprintf(stderr, fmt, ap);
    fprintf(stderr, "\n");
    va_end(ap);
    exit(1);
 }
 /* Valid blkverify filenames look like blkverify:path/to/raw_image:path/to/image */
 static void blkverify_parse_filename(const char *filename, QDict *options,
                                     Error **errp)
 {
    const char *c;
    QString *raw_path;
    /* Parse the blkverify: prefix */
    if (!strstart(filename, "blkverify:", &filename)) {
        /* There was no prefix; therefore, all options have to be already
           present in the QDict (except for the filename) */
        qdict_put(options, "x-image", qstring_from_str(filename));
        return;
    }
    /* Parse the raw image filename */
    c = strchr(filename, ':');
    if (c == NULL) {
        error_setg(errp, "blkverify requires raw copy and original image path");
        return;
    }
    /* TODO Implement option pass-through and set raw.filename here */
    raw_path = qstring_from_substr(filename, 0, c - filename - 1);
    qdict_put(options, "x-raw", raw_path);
    /* TODO Allow multi-level nesting and set file.filename here */
    filename = c + 1;
    qdict_put(options, "x-image", qstring_from_str(filename));
 }
 static QemuOptsList runtime_opts = {
    .name = "blkverify",
    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
    .desc = {
        {
            .name = "x-raw",
            .type = QEMU_OPT_STRING,
            .help = "[internal use only, will be removed]",
        },
        {
            .name = "x-image",
            .type = QEMU_OPT_STRING,
            .help = "[internal use only, will be removed]",
        },
        { /* end of list */ }
    },
 };
 static int blkverify_open(BlockDriverState *bs, QDict *options, int flags,
                          Error **errp)
 {
    BDRVBlkverifyState *s = bs->opaque;
    QemuOpts *opts;
    Error *local_err = NULL;
    int ret;
    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        ret = -EINVAL;
        goto fail;
    }
    /* Open the raw file */
    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-raw"), options, "raw",
                               bs, &child_file, false, &local_err);
    if (local_err) {
        ret = -EINVAL;
        error_propagate(errp, local_err);
        goto fail;
    }
    /* Open the test file */
    s->test_file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options,
                                   "test", bs, &child_format, false,
                                   &local_err);
    if (local_err) {
        ret = -EINVAL;
        error_propagate(errp, local_err);
        goto fail;
    }
    ret = 0;
 fail:
    if (ret < 0) {
        bdrv_unref_child(bs, bs->file);
    }
    qemu_opts_del(opts);
    return ret;
 }
 static void blkverify_close(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;
    bdrv_unref_child(bs, s->test_file);
    s->test_file = NULL;
 }
 static int64_t blkverify_getlength(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;
    return bdrv_getlength(s->test_file->bs);
 }
 static void coroutine_fn blkverify_do_test_req(void *opaque)
 {
    BlkverifyRequest *r = opaque;
    BDRVBlkverifyState *s = r->bs->opaque;
    r->ret = r->request_fn(s->test_file, r->offset, r->bytes, r->qiov,
                           r->flags);
    r->done++;
    qemu_coroutine_enter_if_inactive(r->co);
 }
 static void coroutine_fn blkverify_do_raw_req(void *opaque)
 {
    BlkverifyRequest *r = opaque;
    r->raw_ret = r->request_fn(r->bs->file, r->offset, r->bytes, r->raw_qiov,
                               r->flags);
    r->done++;
    qemu_coroutine_enter_if_inactive(r->co);
 }
 static int coroutine_fn
 blkverify_co_prwv(BlockDriverState *bs, BlkverifyRequest *r, uint64_t offset,
                  uint64_t bytes, QEMUIOVector *qiov, QEMUIOVector *raw_qiov,
                  int flags, bool is_write)
 {
    Coroutine *co_a, *co_b;
    *r = (BlkverifyRequest) {
        .co         = qemu_coroutine_self(),
        .bs         = bs,
        .offset     = offset,
        .bytes      = bytes,
        .qiov       = qiov,
        .raw_qiov   = raw_qiov,
        .flags      = flags,
        .is_write   = is_write,
        .request_fn = is_write ? bdrv_co_pwritev : bdrv_co_preadv,
    };
    co_a = qemu_coroutine_create(blkverify_do_test_req, r);
    co_b = qemu_coroutine_create(blkverify_do_raw_req, r);
    qemu_coroutine_enter(co_a);
    qemu_coroutine_enter(co_b);
    while (r->done < 2) {
        qemu_coroutine_yield();
    }
    if (r->ret != r->raw_ret) {
        blkverify_err(r, "return value mismatch %d != %d", r->ret, r->raw_ret);
    }
    return r->ret;
 }
 static int coroutine_fn
 blkverify_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
                    QEMUIOVector *qiov, int flags)
 {
    BlkverifyRequest r;
    QEMUIOVector raw_qiov;
    void *buf;
    ssize_t cmp_offset;
    int ret;
    buf = qemu_blockalign(bs->file->bs, qiov->size);
    qemu_iovec_init(&raw_qiov, qiov->niov);
    qemu_iovec_clone(&raw_qiov, qiov, buf);
    ret = blkverify_co_prwv(bs, &r, offset, bytes, qiov, &raw_qiov, flags,
                            false);
    cmp_offset = qemu_iovec_compare(qiov, &raw_qiov);
    if (cmp_offset != -1) {
        blkverify_err(&r, "contents mismatch at offset %" PRId64,
                      offset + cmp_offset);
    }
    qemu_iovec_destroy(&raw_qiov);
    qemu_vfree(buf);
    return ret;
 }
 static int coroutine_fn
 blkverify_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
                     QEMUIOVector *qiov, int flags)
 {
    BlkverifyRequest r;
    return blkverify_co_prwv(bs, &r, offset, bytes, qiov, qiov, flags, true);
 }
 static int blkverify_co_flush(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;
    /* Only flush test file, the raw file is not important */
    return bdrv_co_flush(s->test_file->bs);
 }
 static bool blkverify_recurse_is_first_non_filter(BlockDriverState *bs,
                                                  BlockDriverState *candidate)
 {
    BDRVBlkverifyState *s = bs->opaque;
    bool perm = bdrv_recurse_is_first_non_filter(bs->file->bs, candidate);
    if (perm) {
        return true;
    }
    return bdrv_recurse_is_first_non_filter(s->test_file->bs, candidate);
 }
 static void blkverify_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVBlkverifyState *s = bs->opaque;
    /* bs->file->bs has already been refreshed */
    bdrv_refresh_filename(s->test_file->bs);
    if (bs->file->bs->full_open_options
        && s->test_file->bs->full_open_options)
    {
        QDict *opts = qdict_new();
        qdict_put_obj(opts, "driver", QOBJECT(qstring_from_str("blkverify")));
        QINCREF(bs->file->bs->full_open_options);
        qdict_put_obj(opts, "raw", QOBJECT(bs->file->bs->full_open_options));
        QINCREF(s->test_file->bs->full_open_options);
        qdict_put_obj(opts, "test",
                      QOBJECT(s->test_file->bs->full_open_options));
        bs->full_open_options = opts;
    }
    if (bs->file->bs->exact_filename[0]
        && s->test_file->bs->exact_filename[0])
    {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "blkverify:%s:%s",
                 bs->file->bs->exact_filename,
                 s->test_file->bs->exact_filename);
    }
 }
 static BlockDriver bdrv_blkverify = {
    .format_name                      = "blkverify",
    .protocol_name                    = "blkverify",
    .instance_size                    = sizeof(BDRVBlkverifyState),
    .bdrv_parse_filename              = blkverify_parse_filename,
    .bdrv_file_open                   = blkverify_open,
    .bdrv_close                       = blkverify_close,
    .bdrv_getlength                   = blkverify_getlength,
    .bdrv_refresh_filename            = blkverify_refresh_filename,
    .bdrv_co_preadv                   = blkverify_co_preadv,
    .bdrv_co_pwritev                  = blkverify_co_pwritev,
    .bdrv_co_flush                    = blkverify_co_flush,
    .is_filter                        = true,
    .bdrv_recurse_is_first_non_filter = blkverify_recurse_is_first_non_filter,
 };
 static void bdrv_blkverify_init(void)
 {
    bdrv_register(&bdrv_blkverify);
 }
 block_init(bdrv_blkverify_init);
--- a/block/block-backend.c
+++ b/block/block-backend.c
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -22,12 +22,9 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
-#include "qemu/module.h"
+#include "module.h"
 #include "qemu/bswap.h"
 /**************************************************************/
@@ -42,41 +39,57 @@
 // not allocated: 0xffffffff
 // always little-endian
-struct bochs_header {
+struct bochs_header_v1 {
-    char magic[32];     /* "Bochs Virtual HD Image" */
+    char magic[32]; // "Bochs Virtual HD Image"
-    char type[16];      /* "Redolog" */
+    char type[16]; // "Redolog"
-    char subtype[16];   /* "Undoable" / "Volatile" / "Growing" */
+    char subtype[16]; // "Undoable" / "Volatile" / "Growing"
    uint32_t version;
-    uint32_t header;    /* size of header */
+    uint32_t header; // size of header
    uint32_t catalog;   /* num of entries */
    uint32_t bitmap;    /* bitmap size */
    uint32_t extent;    /* extent size */
    union {
-        struct {
+	struct {
-            uint32_t reserved;  /* for ??? */
+	    uint32_t catalog; // num of entries
-            uint64_t disk;      /* disk size */
+	    uint32_t bitmap; // bitmap size
-            char padding[HEADER_SIZE - 64 - 20 - 12];
+	    uint32_t extent; // extent size
-        } QEMU_PACKED redolog;
+	    uint64_t disk; // disk size
-        struct {
+	    char padding[HEADER_SIZE - 64 - 8 - 20];
-            uint64_t disk;      /* disk size */
+	} redolog;
-            char padding[HEADER_SIZE - 64 - 20 - 8];
+	char padding[HEADER_SIZE - 64 - 8];
        } QEMU_PACKED redolog_v1;
        char padding[HEADER_SIZE - 64 - 20];
    } extra;
-} QEMU_PACKED;
+};
 // always little-endian
 struct bochs_header {
    char magic[32]; // "Bochs Virtual HD Image"
    char type[16]; // "Redolog"
    char subtype[16]; // "Undoable" / "Volatile" / "Growing"
    uint32_t version;
    uint32_t header; // size of header
    union {
 	struct {
 	    uint32_t catalog; // num of entries
 	    uint32_t bitmap; // bitmap size
 	    uint32_t extent; // extent size
 	    uint32_t reserved; // for ???
 	    uint64_t disk; // disk size
 	    char padding[HEADER_SIZE - 64 - 8 - 24];
 	} redolog;
 	char padding[HEADER_SIZE - 64 - 8];
    } extra;
 };
 typedef struct BDRVBochsState {
-    CoMutex lock;
+    int fd;
    uint32_t *catalog_bitmap;
-    uint32_t catalog_size;
+    int catalog_size;
-    uint32_t data_offset;
+    int data_offset;
-    uint32_t bitmap_blocks;
+    int bitmap_blocks;
-    uint32_t extent_blocks;
+    int extent_blocks;
-    uint32_t extent_size;
+    int extent_size;
 } BDRVBochsState;
 static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
@@ -96,25 +109,26 @@ static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
    return 0;
 }
-static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
+static int bochs_open(BlockDriverState *bs, const char *filename, int flags)
                      Error **errp)
 {
    BDRVBochsState *s = bs->opaque;
-    uint32_t i;
+    int fd, i;
    struct bochs_header bochs;
-    int ret;
+    struct bochs_header_v1 header_v1;
-    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
+    fd = open(filename, O_RDWR | O_BINARY);
-                               false, errp);
+    if (fd < 0) {
-    if (!bs->file) {
+        fd = open(filename, O_RDONLY | O_BINARY);
-        return -EINVAL;
+        if (fd < 0)
            return -1;
    }
-    bs->read_only = true; /* no write support yet */
+    bs->read_only = 1; // no write support yet
-    ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
+    s->fd = fd;
-    if (ret < 0) {
+
-        return ret;
+    if (read(fd, &bochs, sizeof(bochs)) != sizeof(bochs)) {
        goto fail;
    }
    if (strcmp(bochs.magic, HEADER_MAGIC) ||
@@ -122,170 +136,110 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
        strcmp(bochs.subtype, GROWING_TYPE) ||
 	((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
 	(le32_to_cpu(bochs.version) != HEADER_V1))) {
        error_setg(errp, "Image not in Bochs format");
        return -EINVAL;
    }
    if (le32_to_cpu(bochs.version) == HEADER_V1) {
        bs->total_sectors = le64_to_cpu(bochs.extra.redolog_v1.disk) / 512;
    } else {
        bs->total_sectors = le64_to_cpu(bochs.extra.redolog.disk) / 512;
    }
    /* Limit to 1M entries to avoid unbounded allocation. This is what is
     * needed for the largest image that bximage can create (~8 TB). */
    s->catalog_size = le32_to_cpu(bochs.catalog);
    if (s->catalog_size > 0x100000) {
        error_setg(errp, "Catalog size is too large");
        return -EFBIG;
    }
    s->catalog_bitmap = g_try_new(uint32_t, s->catalog_size);
    if (s->catalog_size && s->catalog_bitmap == NULL) {
        error_setg(errp, "Could not allocate memory for catalog");
        return -ENOMEM;
    }
    ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
                     s->catalog_size * 4);
    if (ret < 0) {
        goto fail;
    }
    if (le32_to_cpu(bochs.version) == HEADER_V1) {
      memcpy(&header_v1, &bochs, sizeof(bochs));
      bs->total_sectors = le64_to_cpu(header_v1.extra.redolog.disk) / 512;
    } else {
      bs->total_sectors = le64_to_cpu(bochs.extra.redolog.disk) / 512;
    }
    lseek(s->fd, le32_to_cpu(bochs.header), SEEK_SET);
    s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
    if (read(s->fd, s->catalog_bitmap, s->catalog_size * 4) !=
 	s->catalog_size * 4)
 	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);
    s->data_offset = le32_to_cpu(bochs.header) + (s->catalog_size * 4);
-    s->bitmap_blocks = 1 + (le32_to_cpu(bochs.bitmap) - 1) / 512;
+    s->bitmap_blocks = 1 + (le32_to_cpu(bochs.extra.redolog.bitmap) - 1) / 512;
-    s->extent_blocks = 1 + (le32_to_cpu(bochs.extent) - 1) / 512;
+    s->extent_blocks = 1 + (le32_to_cpu(bochs.extra.redolog.extent) - 1) / 512;
-    s->extent_size = le32_to_cpu(bochs.extent);
+    s->extent_size = le32_to_cpu(bochs.extra.redolog.extent);
    if (s->extent_size < BDRV_SECTOR_SIZE) {
        /* bximage actually never creates extents smaller than 4k */
        error_setg(errp, "Extent size must be at least 512");
        ret = -EINVAL;
        goto fail;
    } else if (!is_power_of_2(s->extent_size)) {
        error_setg(errp, "Extent size %" PRIu32 " is not a power of two",
                   s->extent_size);
        ret = -EINVAL;
        goto fail;
    } else if (s->extent_size > 0x800000) {
        error_setg(errp, "Extent size %" PRIu32 " is too large",
                   s->extent_size);
        ret = -EINVAL;
        goto fail;
    }
    if (s->catalog_size < DIV_ROUND_UP(bs->total_sectors,
                                       s->extent_size / BDRV_SECTOR_SIZE))
    {
        error_setg(errp, "Catalog size is too small for this disk size");
        ret = -EINVAL;
        goto fail;
    }
    qemu_co_mutex_init(&s->lock);
    return 0;
-
+ fail:
-fail:
+    close(fd);
-    g_free(s->catalog_bitmap);
+    return -1;
    return ret;
 }
-static void bochs_refresh_limits(BlockDriverState *bs, Error **errp)
+static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
 {
    bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
 }
 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
 {
    BDRVBochsState *s = bs->opaque;
-    uint64_t offset = sector_num * 512;
+    int64_t offset = sector_num * 512;
-    uint64_t extent_index, extent_offset, bitmap_offset;
+    int64_t extent_index, extent_offset, bitmap_offset, block_offset;
    char bitmap_entry;
    int ret;
    // seek to sector
    extent_index = offset / s->extent_size;
    extent_offset = (offset % s->extent_size) / 512;
-    if (s->catalog_bitmap[extent_index] == 0xffffffff) {
+    if (s->catalog_bitmap[extent_index] == 0xffffffff)
-	return 0; /* not allocated */
+    {
 //	fprintf(stderr, "page not allocated [%x - %x:%x]\n",
 //	    sector_num, extent_index, extent_offset);
 	return -1; // not allocated
    }
-    bitmap_offset = s->data_offset +
+    bitmap_offset = s->data_offset + (512 * s->catalog_bitmap[extent_index] *
-        (512 * (uint64_t) s->catalog_bitmap[extent_index] *
+	(s->extent_blocks + s->bitmap_blocks));
-        (s->extent_blocks + s->bitmap_blocks));
+    block_offset = bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
-    /* read in bitmap for current extent */
+//    fprintf(stderr, "sect: %x [ext i: %x o: %x] -> %x bitmap: %x block: %x\n",
-    ret = bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
+//	sector_num, extent_index, extent_offset,
-                     &bitmap_entry, 1);
+//	le32_to_cpu(s->catalog_bitmap[extent_index]),
-    if (ret < 0) {
+//	bitmap_offset, block_offset);
-        return ret;
+
    // read in bitmap for current extent
    lseek(s->fd, bitmap_offset + (extent_offset / 8), SEEK_SET);
    read(s->fd, &bitmap_entry, 1);
    if (!((bitmap_entry >> (extent_offset % 8)) & 1))
    {
 //	fprintf(stderr, "sector (%x) in bitmap not allocated\n",
 //	    sector_num);
 	return -1; // not allocated
    }
-    if (!((bitmap_entry >> (extent_offset % 8)) & 1)) {
+    lseek(s->fd, block_offset, SEEK_SET);
 	return 0; /* not allocated */
    }
-    return bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
+    return 0;
 }
-static int coroutine_fn
+static int bochs_read(BlockDriverState *bs, int64_t sector_num,
-bochs_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+                    uint8_t *buf, int nb_sectors)
                QEMUIOVector *qiov, int flags)
 {
    BDRVBochsState *s = bs->opaque;
    uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
    int nb_sectors = bytes >> BDRV_SECTOR_BITS;
    uint64_t bytes_done = 0;
    QEMUIOVector local_qiov;
    int ret;
    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
    qemu_iovec_init(&local_qiov, qiov->niov);
    qemu_co_mutex_lock(&s->lock);
    while (nb_sectors > 0) {
-        int64_t block_offset = seek_to_sector(bs, sector_num);
+	if (!seek_to_sector(bs, sector_num))
-        if (block_offset < 0) {
+	{
-            ret = block_offset;
+	    ret = read(s->fd, buf, 512);
-            goto fail;
+	    if (ret != 512)
-        }
+		return -1;
-
+	}
-        qemu_iovec_reset(&local_qiov);
+	else
-        qemu_iovec_concat(&local_qiov, qiov, bytes_done, 512);
+            memset(buf, 0, 512);
        if (block_offset > 0) {
            ret = bdrv_co_preadv(bs->file, block_offset, 512,
                                 &local_qiov, 0);
            if (ret < 0) {
                goto fail;
            }
        } else {
            qemu_iovec_memset(&local_qiov, 0, 0, 512);
        }
        nb_sectors--;
        sector_num++;
-        bytes_done += 512;
+        buf += 512;
    }
-
+    return 0;
    ret = 0;
 fail:
    qemu_co_mutex_unlock(&s->lock);
    qemu_iovec_destroy(&local_qiov);
    return ret;
 }
 static void bochs_close(BlockDriverState *bs)
 {
    BDRVBochsState *s = bs->opaque;
-    g_free(s->catalog_bitmap);
+    qemu_free(s->catalog_bitmap);
    close(s->fd);
 }
 static BlockDriver bdrv_bochs = {
@@ -293,8 +247,7 @@ static BlockDriver bdrv_bochs = {
    .instance_size	= sizeof(BDRVBochsState),
    .bdrv_probe		= bochs_probe,
    .bdrv_open		= bochs_open,
-    .bdrv_refresh_limits = bochs_refresh_limits,
+    .bdrv_read		= bochs_read,
    .bdrv_co_preadv = bochs_co_preadv,
    .bdrv_close		= bochs_close,
 };
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -21,22 +21,16 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
-#include "qemu/module.h"
+#include "module.h"
 #include "qemu/bswap.h"
 #include <zlib.h>
 /* Maximum compressed block size */
 #define MAX_BLOCK_SIZE (64 * 1024 * 1024)
 typedef struct BDRVCloopState {
-    CoMutex lock;
+    int fd;
    uint32_t block_size;
    uint32_t n_blocks;
-    uint64_t *offsets;
+    uint64_t* offsets;
    uint32_t sectors_per_block;
    uint32_t current_block;
    uint8_t *compressed_block;
@@ -46,253 +40,127 @@ typedef struct BDRVCloopState {
 static int cloop_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
-    const char *magic_version_2_0 = "#!/bin/sh\n"
+    const char* magic_version_2_0="#!/bin/sh\n"
-        "#V2.0 Format\n"
+	"#V2.0 Format\n"
-        "modprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n";
+	"modprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n";
-    int length = strlen(magic_version_2_0);
+    int length=strlen(magic_version_2_0);
-    if (length > buf_size) {
+    if(length>buf_size)
-        length = buf_size;
+	length=buf_size;
-    }
+    if(!memcmp(magic_version_2_0,buf,length))
-    if (!memcmp(magic_version_2_0, buf, length)) {
+	return 2;
        return 2;
    }
    return 0;
 }
-static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
+static int cloop_open(BlockDriverState *bs, const char *filename, int flags)
                      Error **errp)
 {
    BDRVCloopState *s = bs->opaque;
-    uint32_t offsets_size, max_compressed_block_size = 1, i;
+    uint32_t offsets_size,max_compressed_block_size=1,i;
    int ret;
-    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
+    s->fd = open(filename, O_RDONLY | O_BINARY);
-                               false, errp);
+    if (s->fd < 0)
-    if (!bs->file) {
+        return -errno;
-        return -EINVAL;
+    bs->read_only = 1;
    }
    bs->read_only = true;
    /* read header */
-    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
+    if(lseek(s->fd,128,SEEK_SET)<0) {
-    if (ret < 0) {
+cloop_close:
-        return ret;
+	close(s->fd);
 	return -1;
    }
-    s->block_size = be32_to_cpu(s->block_size);
+    if(read(s->fd,&s->block_size,4)<4)
-    if (s->block_size % 512) {
+	goto cloop_close;
-        error_setg(errp, "block_size %" PRIu32 " must be a multiple of 512",
+    s->block_size=be32_to_cpu(s->block_size);
-                   s->block_size);
+    if(read(s->fd,&s->n_blocks,4)<4)
-        return -EINVAL;
+	goto cloop_close;
-    }
+    s->n_blocks=be32_to_cpu(s->n_blocks);
    if (s->block_size == 0) {
        error_setg(errp, "block_size cannot be zero");
        return -EINVAL;
    }
    /* cloop's create_compressed_fs.c warns about block sizes beyond 256 KB but
     * we can accept more.  Prevent ridiculous values like 4 GB - 1 since we
     * need a buffer this big.
     */
    if (s->block_size > MAX_BLOCK_SIZE) {
        error_setg(errp, "block_size %" PRIu32 " must be %u MB or less",
                   s->block_size,
                   MAX_BLOCK_SIZE / (1024 * 1024));
        return -EINVAL;
    }
    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
    if (ret < 0) {
        return ret;
    }
    s->n_blocks = be32_to_cpu(s->n_blocks);
    /* read offsets */
-    if (s->n_blocks > (UINT32_MAX - 1) / sizeof(uint64_t)) {
+    offsets_size=s->n_blocks*sizeof(uint64_t);
-        /* Prevent integer overflow */
+    s->offsets=(uint64_t*)qemu_malloc(offsets_size);
-        error_setg(errp, "n_blocks %" PRIu32 " must be %zu or less",
+    if(read(s->fd,s->offsets,offsets_size)<offsets_size)
-                   s->n_blocks,
+	goto cloop_close;
-                   (UINT32_MAX - 1) / sizeof(uint64_t));
+    for(i=0;i<s->n_blocks;i++) {
-        return -EINVAL;
+	s->offsets[i]=be64_to_cpu(s->offsets[i]);
-    }
+	if(i>0) {
-    offsets_size = (s->n_blocks + 1) * sizeof(uint64_t);
+	    uint32_t size=s->offsets[i]-s->offsets[i-1];
-    if (offsets_size > 512 * 1024 * 1024) {
+	    if(size>max_compressed_block_size)
-        /* Prevent ridiculous offsets_size which causes memory allocation to
+		max_compressed_block_size=size;
-         * fail or overflows bdrv_pread() size.  In practice the 512 MB
+	}
         * offsets[] limit supports 16 TB images at 256 KB block size.
         */
        error_setg(errp, "image requires too many offsets, "
                   "try increasing block size");
        return -EINVAL;
    }
    s->offsets = g_try_malloc(offsets_size);
    if (s->offsets == NULL) {
        error_setg(errp, "Could not allocate offsets table");
        return -ENOMEM;
    }
    ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);
    if (ret < 0) {
        goto fail;
    }
    for (i = 0; i < s->n_blocks + 1; i++) {
        uint64_t size;
        s->offsets[i] = be64_to_cpu(s->offsets[i]);
        if (i == 0) {
            continue;
        }
        if (s->offsets[i] < s->offsets[i - 1]) {
            error_setg(errp, "offsets not monotonically increasing at "
                       "index %" PRIu32 ", image file is corrupt", i);
            ret = -EINVAL;
            goto fail;
        }
        size = s->offsets[i] - s->offsets[i - 1];
        /* Compressed blocks should be smaller than the uncompressed block size
         * but maybe compression performed poorly so the compressed block is
         * actually bigger.  Clamp down on unrealistic values to prevent
         * ridiculous s->compressed_block allocation.
         */
        if (size > 2 * MAX_BLOCK_SIZE) {
            error_setg(errp, "invalid compressed block size at index %" PRIu32
                       ", image file is corrupt", i);
            ret = -EINVAL;
            goto fail;
        }
        if (size > max_compressed_block_size) {
            max_compressed_block_size = size;
        }
    }
    /* initialize zlib engine */
-    s->compressed_block = g_try_malloc(max_compressed_block_size + 1);
+    s->compressed_block = qemu_malloc(max_compressed_block_size+1);
-    if (s->compressed_block == NULL) {
+    s->uncompressed_block = qemu_malloc(s->block_size);
-        error_setg(errp, "Could not allocate compressed_block");
+    if(inflateInit(&s->zstream) != Z_OK)
-        ret = -ENOMEM;
+	goto cloop_close;
-        goto fail;
+    s->current_block=s->n_blocks;
    }
    s->uncompressed_block = g_try_malloc(s->block_size);
    if (s->uncompressed_block == NULL) {
        error_setg(errp, "Could not allocate uncompressed_block");
        ret = -ENOMEM;
        goto fail;
    }
    if (inflateInit(&s->zstream) != Z_OK) {
        ret = -EINVAL;
        goto fail;
    }
    s->current_block = s->n_blocks;
    s->sectors_per_block = s->block_size/512;
-    bs->total_sectors = s->n_blocks * s->sectors_per_block;
+    bs->total_sectors = s->n_blocks*s->sectors_per_block;
    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    g_free(s->offsets);
    g_free(s->compressed_block);
    g_free(s->uncompressed_block);
    return ret;
 }
-static void cloop_refresh_limits(BlockDriverState *bs, Error **errp)
+static inline int cloop_read_block(BDRVCloopState *s,int block_num)
 {
-    bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
+    if(s->current_block != block_num) {
-}
+	int ret;
        uint32_t bytes = s->offsets[block_num+1]-s->offsets[block_num];
-static inline int cloop_read_block(BlockDriverState *bs, int block_num)
+	lseek(s->fd, s->offsets[block_num], SEEK_SET);
-{
+        ret = read(s->fd, s->compressed_block, bytes);
-    BDRVCloopState *s = bs->opaque;
+        if (ret != bytes)
    if (s->current_block != block_num) {
        int ret;
        uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
        ret = bdrv_pread(bs->file, s->offsets[block_num],
                         s->compressed_block, bytes);
        if (ret != bytes) {
            return -1;
        }
-        s->zstream.next_in = s->compressed_block;
+	s->zstream.next_in = s->compressed_block;
-        s->zstream.avail_in = bytes;
+	s->zstream.avail_in = bytes;
-        s->zstream.next_out = s->uncompressed_block;
+	s->zstream.next_out = s->uncompressed_block;
-        s->zstream.avail_out = s->block_size;
+	s->zstream.avail_out = s->block_size;
-        ret = inflateReset(&s->zstream);
+	ret = inflateReset(&s->zstream);
-        if (ret != Z_OK) {
+	if(ret != Z_OK)
-            return -1;
+	    return -1;
-        }
+	ret = inflate(&s->zstream, Z_FINISH);
-        ret = inflate(&s->zstream, Z_FINISH);
+	if(ret != Z_STREAM_END || s->zstream.total_out != s->block_size)
-        if (ret != Z_STREAM_END || s->zstream.total_out != s->block_size) {
+	    return -1;
            return -1;
        }
-        s->current_block = block_num;
+	s->current_block = block_num;
    }
    return 0;
 }
-static int coroutine_fn
+static int cloop_read(BlockDriverState *bs, int64_t sector_num,
-cloop_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+                    uint8_t *buf, int nb_sectors)
                QEMUIOVector *qiov, int flags)
 {
    BDRVCloopState *s = bs->opaque;
-    uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
+    int i;
    int nb_sectors = bytes >> BDRV_SECTOR_BITS;
    int ret, i;
-    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
+    for(i=0;i<nb_sectors;i++) {
-    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
+	uint32_t sector_offset_in_block=((sector_num+i)%s->sectors_per_block),
-
+	    block_num=(sector_num+i)/s->sectors_per_block;
-    qemu_co_mutex_lock(&s->lock);
+	if(cloop_read_block(s, block_num) != 0)
-
+	    return -1;
-    for (i = 0; i < nb_sectors; i++) {
+	memcpy(buf+i*512,s->uncompressed_block+sector_offset_in_block*512,512);
        void *data;
        uint32_t sector_offset_in_block =
            ((sector_num + i) % s->sectors_per_block),
            block_num = (sector_num + i) / s->sectors_per_block;
        if (cloop_read_block(bs, block_num) != 0) {
            ret = -EIO;
            goto fail;
        }
        data = s->uncompressed_block + sector_offset_in_block * 512;
        qemu_iovec_from_buf(qiov, i * 512, data, 512);
    }
-
+    return 0;
    ret = 0;
 fail:
    qemu_co_mutex_unlock(&s->lock);
    return ret;
 }
 static void cloop_close(BlockDriverState *bs)
 {
    BDRVCloopState *s = bs->opaque;
-    g_free(s->offsets);
+    close(s->fd);
-    g_free(s->compressed_block);
+    if(s->n_blocks>0)
-    g_free(s->uncompressed_block);
+	free(s->offsets);
    free(s->compressed_block);
    free(s->uncompressed_block);
    inflateEnd(&s->zstream);
 }
 static BlockDriver bdrv_cloop = {
-    .format_name    = "cloop",
+    .format_name	= "cloop",
-    .instance_size  = sizeof(BDRVCloopState),
+    .instance_size	= sizeof(BDRVCloopState),
-    .bdrv_probe     = cloop_probe,
+    .bdrv_probe		= cloop_probe,
-    .bdrv_open      = cloop_open,
+    .bdrv_open		= cloop_open,
-    .bdrv_refresh_limits = cloop_refresh_limits,
+    .bdrv_read		= cloop_read,
-    .bdrv_co_preadv = cloop_co_preadv,
+    .bdrv_close		= cloop_close,
    .bdrv_close     = cloop_close,
 };
 static void bdrv_cloop_init(void)
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			`((c-mode . ((c-file-style . "stroustrup")`
			`(indent-tabs-mode . nil))))`
		`@@ -0,0 +1,2 @@`
							`seabios 9fb3f4d950744e97cc655b7d7b523d8bf101e4a0`
							`vgabios 6e62666cfc19e7fd45dd0d7c3ad62fd8d0b5f67a`