Update version for 2.4.0.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
net: avoid infinite loop when receiving packets(CVE-2015-5278)
2015-09-22 16:53:29 -05:00 · 2015-09-21 17:04:22 -05:00 · 2015-09-21 17:04:14 -05:00 · 2015-09-21 17:04:05 -05:00 · 2015-09-21 17:03:16 -05:00
1328 changed files with 29750 additions and 67076 deletions
--- a/.dir-locals.el
+++ b/.dir-locals.el
@@ -1,2 +0,0 @@
-((c-mode . ((c-file-style . "stroustrup")
-	    (indent-tabs-mode . nil))))
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,7 @@
 /trace/generated-ust.c
 /ui/shader/texture-blit-frag.h
 /ui/shader/texture-blit-vert.h
+/libcacard/trace/generated-tracers.c
 *-timestamp
 /*-softmmu
 /*-darwin-user
@@ -33,7 +34,6 @@
 /qapi-visit.[ch]
 /qapi-event.[ch]
 /qmp-commands.h
-/qmp-introspect.[ch]
 /qmp-marshal.c
 /qemu-doc.html
 /qemu-tech.html
@@ -49,7 +49,6 @@
 /qemu-ga
 /qemu-bridge-helper
 /qemu-monitor.texi
-/qemu-monitor-info.texi
 /qmp-commands.txt
 /vscclient
 /fsdev/virtfs-proxy-helper
@@ -59,7 +58,6 @@
 *.cp
 *.dvi
 *.exe
-*.msi
 *.dll
 *.so
 *.mo
--- a/.travis.yml
+++ b/.travis.yml
@@ -54,7 +54,15 @@ matrix:
  include:
    # Make check target (we only do this once)
    - env:
-        - TARGETS=alpha-softmmu,arm-softmmu,aarch64-softmmu,cris-softmmu,i386-softmmu,x86_64-softmmu,m68k-softmmu,microblaze-softmmu,microblazeel-softmmu,mips-softmmu,mips64-softmmu,mips64el-softmmu,mipsel-softmmu,or32-softmmu,ppc-softmmu,ppc64-softmmu,ppcemb-softmmu,s390x-softmmu,sh4-softmmu,sh4eb-softmmu,sparc-softmmu,sparc64-softmmu,unicore32-softmmu,unicore32-linux-user,lm32-softmmu,moxie-softmmu,tricore-softmmu,xtensa-softmmu,xtensaeb-softmmu
+        - TARGETS=alpha-softmmu,arm-softmmu,aarch64-softmmu,cris-softmmu,
+                  i386-softmmu,x86_64-softmmu,m68k-softmmu,microblaze-softmmu,
+                  microblazeel-softmmu,mips-softmmu,mips64-softmmu,
+                  mips64el-softmmu,mipsel-softmmu,or32-softmmu,ppc-softmmu,
+                  ppc64-softmmu,ppcemb-softmmu,s390x-softmmu,sh4-softmmu,
+                  sh4eb-softmmu,sparc-softmmu,sparc64-softmmu,
+                  unicore32-softmmu,unicore32-linux-user,
+                  lm32-softmmu,moxie-softmmu,tricore-softmmu,xtensa-softmmu,
+                  xtensaeb-softmmu
          TEST_CMD="make check"
      compiler: gcc
    # Debug related options
--- a/13
+++ b/13
@@ -87,15 +87,10 @@ Furthermore, it is the QEMU coding style.

 5. Declarations

-Mixed declarations (interleaving statements and declarations within
-blocks) are generally not allowed; declarations should be at the beginning
-of blocks.
-
-Every now and then, an exception is made for declarations inside a
-#ifdef or #ifndef block: if the code looks nicer, such declarations can
-be placed at the top of the block even if there are statements above.
-On the other hand, however, it's often best to move that #ifdef/#ifndef
-block to a separate function altogether.
+Mixed declarations (interleaving statements and declarations within blocks)
+are not allowed; declarations should be at the beginning of blocks.  In other
+words, the code should not generate warnings if using GCC's
+-Wdeclaration-after-statement option.

 6. Conditional statements

--- a/211
+++ b/211
@@ -77,7 +77,6 @@ S: Maintained
 F: target-alpha/
 F: hw/alpha/
 F: tests/tcg/alpha/
-F: disas/alpha.c

 ARM
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -85,9 +84,6 @@ S: Maintained
 F: target-arm/
 F: hw/arm/
 F: hw/cpu/a*mpcore.c
-F: disas/arm.c
-F: disas/arm-a64.cc
-F: disas/libvixl/

 CRIS
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -95,7 +91,6 @@ S: Maintained
 F: target-cris/
 F: hw/cris/
 F: tests/tcg/cris/
-F: disas/cris.c

 LM32
 M: Michael Walle <michael@walle.cc>
@@ -119,7 +114,6 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: target-microblaze/
 F: hw/microblaze/
-F: disas/microblaze.c

 MIPS
 M: Aurelien Jarno <aurelien@aurel32.net>
@@ -128,13 +122,11 @@ S: Maintained
 F: target-mips/
 F: hw/mips/
 F: tests/tcg/mips/
-F: disas/mips.c

 Moxie
 M: Anthony Green <green@moxielogic.com>
 S: Maintained
 F: target-moxie/
-F: disas/moxie.c

 OpenRISC
 M: Jia Liu <proljc@gmail.com>
@@ -149,7 +141,6 @@ L: qemu-ppc@nongnu.org
 S: Maintained
 F: target-ppc/
 F: hw/ppc/
-F: disas/ppc.c

 S390
 M: Richard Henderson <rth@twiddle.net>
@@ -157,14 +148,12 @@ M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: target-s390x/
 F: hw/s390x/
-F: disas/s390.c

 SH4
 M: Aurelien Jarno <aurelien@aurel32.net>
 S: Odd Fixes
 F: target-sh4/
 F: hw/sh4/
-F: disas/sh4.c

 SPARC
 M: Blue Swirl <blauwirbel@gmail.com>
@@ -173,7 +162,6 @@ S: Maintained
 F: target-sparc/
 F: hw/sparc/
 F: hw/sparc64/
-F: disas/sparc.c

 UniCore32
 M: Guan Xuetao <gxt@mprc.pku.edu.cn>
@@ -188,7 +176,6 @@ M: Eduardo Habkost <ehabkost@redhat.com>
 S: Maintained
 F: target-i386/
 F: hw/i386/
-F: disas/i386.c

 Xtensa
 M: Max Filippov <jcmvbkbc@gmail.com>
@@ -255,12 +242,6 @@ L: xen-devel@lists.xensource.com
 S: Supported
 F: xen-*
 F: */xen*
-F: hw/char/xen_console.c
-F: hw/display/xenfb.c
-F: hw/net/xen_nic.c
-F: hw/xen/
-F: hw/xenpv/
-F: include/hw/xen/

 Hosts:
 ------
@@ -281,47 +262,16 @@ L: qemu-devel@nongnu.org
 M: Stefan Weil <sw@weilnetz.de>
 S: Maintained
 F: *win32*
-F: qemu.nsi

 ARM Machines
 ------------
 Allwinner-a10
-M: Beniamino Galvani <b.galvani@gmail.com>
+M: Li Guang <lig.fnst@cn.fujitsu.com>
 S: Maintained
-F: hw/*/allwinner*
-F: include/hw/*/allwinner*
+F: hw/*/allwinner-a10*
+F: include/hw/*/allwinner-a10*
 F: hw/arm/cubieboard.c

-ARM PrimeCell
-M: Peter Maydell <peter.maydell@linaro.org>
-S: Maintained
-F: hw/char/pl011.c
-F: hw/display/pl110*
-F: hw/dma/pl080.c
-F: hw/dma/pl330.c
-F: hw/gpio/pl061.c
-F: hw/input/pl050.c
-F: hw/intc/pl190.c
-F: hw/sd/pl181.c
-F: hw/timer/pl031.c
-F: include/hw/arm/primecell.h
-
-ARM cores
-M: Peter Maydell <peter.maydell@linaro.org>
-S: Maintained
-F: hw/intc/arm*
-F: hw/intc/gic_internal.h
-F: hw/misc/a9scu.c
-F: hw/misc/arm11scu.c
-F: hw/timer/a9gtimer*
-F: hw/timer/arm_*
-F: include/hw/arm/arm.h
-F: include/hw/intc/arm*
-F: include/hw/misc/a9scu.h
-F: include/hw/misc/arm11scu.h
-F: include/hw/timer/a9gtimer.h
-F: include/hw/timer/arm_mptimer.h
-
 Exynos
 M: Evgeny Voevodin <e.voevodin@samsung.com>
 M: Maksim Kozlov <m.kozlov@samsung.com>
@@ -358,6 +308,11 @@ M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/integratorcp.c

+Mainstone
+L: qemu-devel@nongnu.org
+S: Orphan
+F: hw/arm/mainstone.c
+
 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
 S: Maintained
@@ -377,17 +332,11 @@ Real View
 M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/realview*
-F: hw/intc/realview_gic.c
-F: include/hw/intc/realview_gic.h

-PXA2XX
+Spitz
 M: Andrzej Zaborowski <balrogg@gmail.com>
 S: Maintained
-F: hw/arm/mainstone.c
 F: hw/arm/spitz.c
-F: hw/arm/tosa.c
-F: hw/arm/z2.c
-F: hw/*/pxa2xx*

 Stellaris
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -400,22 +349,13 @@ S: Maintained
 F: hw/*/versatile*

 Xilinx Zynq
-M: Alistair Francis <alistair.francis@xilinx.com>
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+M: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
 S: Maintained
 F: hw/arm/xilinx_zynq.c
 F: hw/misc/zynq_slcr.c
 F: hw/*/cadence_*
 F: hw/ssi/xilinx_spips.c

-Xilinx ZynqMP
-M: Alistair Francis <alistair.francis@xilinx.com>
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
-S: Maintained
-F: hw/arm/xlnx-zynqmp.c
-F: hw/arm/xlnx-ep108.c
-F: include/hw/arm/xlnx-zynqmp.h
-
 ARM ACPI Subsystem
 M: Shannon Zhao <zhaoshenglong@huawei.com>
 M: Shannon Zhao <shannon.zhao@linaro.org>
@@ -465,7 +405,7 @@ S: Maintained
 F: hw/microblaze/petalogix_s3adsp1800_mmu.c

 petalogix_ml605
-M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
+M: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
 S: Maintained
 F: hw/microblaze/petalogix_ml605_mmu.c

@@ -615,13 +555,11 @@ M: Cornelia Huck <cornelia.huck@de.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 M: Alexander Graf <agraf@suse.de>
 S: Supported
-F: hw/char/sclp*.[hc]
 F: hw/s390x/s390-virtio-ccw.c
 F: hw/s390x/css.[hc]
 F: hw/s390x/sclp*.[hc]
 F: hw/s390x/ipl*.[hc]
 F: hw/s390x/*pci*.[hc]
-F: hw/s390x/s390-skeys*.c
 F: include/hw/s390x/
 F: pc-bios/s390-ccw/
 T: git git://github.com/cohuck/qemu virtio-ccw-upstr
@@ -653,25 +591,6 @@ F: hw/acpi/piix4.c
 F: hw/acpi/ich9.c
 F: include/hw/acpi/ich9.h
 F: include/hw/acpi/piix.h
-F: hw/misc/sga.c
-
-PC Chipset
-M: Michael S. Tsirkin <mst@redhat.com>
-M: Paolo Bonzini <pbonzini@redhat.com>
-S: Support
-F: hw/char/debugcon.c
-F: hw/char/parallel.c
-F: hw/char/serial*
-F: hw/dma/i8257*
-F: hw/i2c/pm_smbus.c
-F: hw/intc/apic*
-F: hw/intc/ioapic*
-F: hw/intc/i8259*
-F: hw/misc/debugexit.c
-F: hw/misc/pc-testdev.c
-F: hw/timer/hpet*
-F: hw/timer/i8254*
-F: hw/timer/mc146818rtc*


 Xtensa Machines
@@ -705,7 +624,6 @@ F: hw/block/cdrom.c
 F: hw/block/hd-geometry.c
 F: tests/ide-test.c
 F: tests/ahci-test.c
-F: tests/libqos/ahci*
 T: git git://github.com/jnsnow/qemu.git ide

 Floppy
@@ -714,7 +632,6 @@ L: qemu-block@nongnu.org
 S: Supported
 F: hw/block/fdc.c
 F: include/hw/block/fdc.h
-F: tests/fdc-test.c
 T: git git://github.com/jnsnow/qemu.git ide

 OMAP
@@ -722,29 +639,19 @@ M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/*/omap*

-IPack
-M: Alberto Garcia <berto@igalia.com>
-S: Odd Fixes
-F: hw/char/ipoctal232.c
-F: hw/ipack/
-
 PCI
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
 F: include/hw/pci/*
-F: hw/misc/pci-testdev.c
 F: hw/pci/*
-F: hw/pci-bridge/*

-ACPI/SMBIOS
+ACPI
 M: Michael S. Tsirkin <mst@redhat.com>
 M: Igor Mammedov <imammedo@redhat.com>
 S: Supported
 F: include/hw/acpi/*
-F: include/hw/smbios/*
 F: hw/mem/*
 F: hw/acpi/*
-F: hw/smbios/*
 F: hw/i386/acpi-build.[hc]
 F: hw/i386/*dsl
 F: hw/arm/virt-acpi-build.c
@@ -763,19 +670,6 @@ M: Scott Wood <scottwood@freescale.com>
 L: qemu-ppc@nongnu.org
 S: Supported
 F: hw/ppc/e500*
-F: hw/pci-host/ppce500.c
-F: hw/net/fsl_etsec/
-
-Character devices
-M: Paolo Bonzini <pbonzini@redhat.com>
-S: Odd Fixes
-F: hw/char/
-
-Network devices
-M: Jason Wang <jasowang@redhat.com>
-S: Odd Fixes
-F: hw/net/
-T: git git://github.com/jasowang/qemu.git net

 SCSI
 M: Paolo Bonzini <pbonzini@redhat.com>
@@ -789,17 +683,10 @@ S: Orphan
 F: hw/scsi/lsi53c895a.c

 SSI
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+M: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
 S: Maintained
 F: hw/ssi/*
 F: hw/block/m25p80.c
-X: hw/ssi/xilinx_*
-
-Xilinx SPI
-M: Alistair Francis <alistair.francis@xilinx.com>
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
-S: Maintained
-F: hw/ssi/xilinx_*

 USB
 M: Gerd Hoffmann <kraxel@redhat.com>
@@ -888,9 +775,8 @@ F: hw/scsi/megasas.c
 F: hw/scsi/mfi.h

 Xilinx EDK
+M: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
-M: Alistair Francis <alistair.francis@xilinx.com>
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 S: Maintained
 F: hw/*/xilinx_*
 F: include/hw/xilinx.h
@@ -961,7 +847,7 @@ F: block/qapi.c
 F: qapi/block*.json
 T: git git://repo.or.cz/qemu/armbru.git block-next

-Character device backends
+Character Devices
 M: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: qemu-char.c
@@ -992,19 +878,11 @@ F: include/hw/cpu/icc_bus.h
 F: hw/cpu/icc_bus.c

 Device Tree
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+M: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: device_tree.[ch]

-Error reporting
-M: Markus Armbruster <armbru@redhat.com>
-S: Supported
-F: include/qapi/error.h
-F: include/qemu/error-report.h
-F: util/error.c
-F: util/qemu-error.c
-
 GDB stub
 L: qemu-devel@nongnu.org
 S: Odd Fixes
@@ -1056,11 +934,12 @@ F: hmp.c
 F: hmp-commands.hx
 T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp

-Network device backends
+Network device layer
+M: Stefan Hajnoczi <stefanha@redhat.com>
 M: Jason Wang <jasowang@redhat.com>
 S: Maintained
 F: net/
-T: git git://github.com/jasowang/qemu.git net
+T: git git://github.com/stefanha/qemu.git net

 Netmap network backend
 M: Luigi Rizzo <rizzo@iet.unipi.it>
@@ -1093,12 +972,7 @@ M: Michael Roth <mdroth@linux.vnet.ibm.com>
 S: Supported
 F: qapi/
 X: qapi/*.json
-F: include/qapi/
-X: include/qapi/qmp/
-F: include/qapi/qmp/dispatch.h
 F: tests/qapi-schema/
-F: tests/test-*-visitor.c
-F: tests/test-qmp-*.c
 F: scripts/qapi*
 F: docs/qapi*
 T: git git://repo.or.cz/qemu/armbru.git qapi-next
@@ -1115,14 +989,6 @@ QObject
 M: Luiz Capitulino <lcapitulino@redhat.com>
 S: Maintained
 F: qobject/
-F: include/qapi/qmp/
-X: include/qapi/qmp/dispatch.h
-F: tests/check-qdict.c
-F: tests/check-qfloat.c
-F: tests/check-qint.c
-F: tests/check-qjson.c
-F: tests/check-qlist.c
-F: tests/check-qstring.c
 T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp

 QEMU Guest Agent
@@ -1147,7 +1013,7 @@ S: Supported
 F: qmp.c
 F: monitor.c
 F: qmp-commands.hx
-F: docs/*qmp-*
+F: docs/qmp/
 F: scripts/qmp/
 T: git git://repo.or.cz/qemu/armbru.git qapi-next

@@ -1193,19 +1059,6 @@ F: crypto/
 F: include/crypto/
 F: tests/test-crypto-*

-Coroutines
-M: Stefan Hajnoczi <stefanha@redhat.com>
-M: Kevin Wolf <kwolf@redhat.com>
-F: util/*coroutine*
-F: include/qemu/coroutine*
-F: tests/test-coroutine.c
-
-Buffers
-M: Daniel P. Berrange <berrange@redhat.com>
-S: Odd fixes
-F: util/buffer.c
-F: include/qemu/buffer.h
-
 Usermode Emulation
 ------------------
 Overall
@@ -1236,58 +1089,53 @@ M: Claudio Fontana <claudio.fontana@huawei.com>
 M: Claudio Fontana <claudio.fontana@gmail.com>
 S: Maintained
 F: tcg/aarch64/
-F: disas/arm-a64.cc
-F: disas/libvixl/

 ARM target
 M: Andrzej Zaborowski <balrogg@gmail.com>
 S: Maintained
 F: tcg/arm/
-F: disas/arm.c

 i386 target
 L: qemu-devel@nongnu.org
 S: Maintained
 F: tcg/i386/
-F: disas/i386.c

 IA64 target
 M: Aurelien Jarno <aurelien@aurel32.net>
 S: Maintained
 F: tcg/ia64/
-F: disas/ia64.c

 MIPS target
 M: Aurelien Jarno <aurelien@aurel32.net>
 S: Maintained
 F: tcg/mips/
-F: disas/mips.c

 PPC
 M: Vassili Karpov (malc) <av1474@comtv.ru>
 S: Maintained
 F: tcg/ppc/
-F: disas/ppc.c
+
+PPC64 target
+M: Vassili Karpov (malc) <av1474@comtv.ru>
+S: Maintained
+F: tcg/ppc64/

 S390 target
 M: Alexander Graf <agraf@suse.de>
 M: Richard Henderson <rth@twiddle.net>
 S: Maintained
 F: tcg/s390/
-F: disas/s390.c

 SPARC target
 M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
 F: tcg/sparc/
-F: disas/sparc.c

 TCI target
 M: Stefan Weil <sw@weilnetz.de>
 S: Maintained
 F: tcg/tci/
 F: tci.c
-F: disas/tci.c

 Stable branches
 ---------------
@@ -1440,7 +1288,6 @@ F: block/dmg.c

 parallels
 M: Stefan Hajnoczi <stefanha@redhat.com>
-M: Denis V. Lunev <den@openvz.org>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/parallels.c
@@ -1497,11 +1344,3 @@ M: Stefan Hajnoczi <stefanha@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: tests/image-fuzzer/
-
-
-Documentation
-------------
-Build system architecture
-M: Daniel P. Berrange <berrange@redhat.com>
-S: Odd Fixes
-F: docs/build-system.txt
--- a/73
+++ b/73
@@ -52,8 +52,6 @@ endif
 GENERATED_HEADERS = config-host.h qemu-options.def
 GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h qapi-event.h
 GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c qapi-event.c
-GENERATED_HEADERS += qmp-introspect.h
-GENERATED_SOURCES += qmp-introspect.c

 GENERATED_HEADERS += trace/generated-events.h
 GENERATED_SOURCES += trace/generated-events.c
@@ -90,8 +88,7 @@ LIBS+=-lz $(LIBS_TOOLS)
 HELPERS-$(CONFIG_LINUX) = qemu-bridge-helper$(EXESUF)

 ifdef BUILD_DOCS
-DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
-DOCS+=qmp-commands.txt
+DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1 qemu-nbd.8 qmp-commands.txt
 ifdef CONFIG_LINUX
 DOCS+=kvm_stat.1
 endif
@@ -151,20 +148,18 @@ dummy := $(call unnest-vars,, \
                stub-obj-y \
                util-obj-y \
                qga-obj-y \
-                ivshmem-client-obj-y \
-                ivshmem-server-obj-y \
                qga-vss-dll-obj-y \
                block-obj-y \
                block-obj-m \
-                crypto-obj-y \
-                crypto-aes-obj-y \
-                qom-obj-y \
                common-obj-y \
                common-obj-m)

 ifneq ($(wildcard config-host.mak),)
 include $(SRC_PATH)/tests/Makefile
 endif
+ifeq ($(CONFIG_SMARTCARD_NSS),y)
+include $(SRC_PATH)/libcacard/Makefile
+endif

 all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all modules

@@ -177,7 +172,6 @@ SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
 SOFTMMU_SUBDIR_RULES=$(filter %-softmmu,$(SUBDIR_RULES))

 $(SOFTMMU_SUBDIR_RULES): $(block-obj-y)
-$(SOFTMMU_SUBDIR_RULES): $(crypto-obj-y)
 $(SOFTMMU_SUBDIR_RULES): config-all-devices.mak

 subdir-%:
@@ -202,7 +196,7 @@ subdir-dtc:dtc/libfdt dtc/tests
 dtc/%:
 	mkdir -p $@

-$(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y) $(qom-obj-y) $(crypto-aes-obj-$(CONFIG_USER_ONLY))
+$(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y)

 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
 romsubdir-%:
@@ -232,9 +226,9 @@ util/module.o-cflags = -D'CONFIG_BLOCK_MODULES=$(block-modules)'

 qemu-img.o: qemu-img-cmds.h

-qemu-img$(EXESUF): qemu-img.o $(block-obj-y) $(crypto-obj-y) $(qom-obj-y) libqemuutil.a libqemustub.a
-qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) $(crypto-obj-y) $(qom-obj-y) libqemuutil.a libqemustub.a
-qemu-io$(EXESUF): qemu-io.o $(block-obj-y) $(crypto-obj-y) $(qom-obj-y) libqemuutil.a libqemustub.a
+qemu-img$(EXESUF): qemu-img.o $(block-obj-y) libqemuutil.a libqemustub.a
+qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) libqemuutil.a libqemustub.a
+qemu-io$(EXESUF): qemu-io.o $(block-obj-y) libqemuutil.a libqemustub.a

 qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o

@@ -269,7 +263,7 @@ $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)

 qapi-modules = $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/qapi/common.json \
               $(SRC_PATH)/qapi/block.json $(SRC_PATH)/qapi/block-core.json \
-               $(SRC_PATH)/qapi/event.json $(SRC_PATH)/qapi/introspect.json
+               $(SRC_PATH)/qapi/event.json

 qapi-types.c qapi-types.h :\
 $(qapi-modules) $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
@@ -291,11 +285,6 @@ $(qapi-modules) $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
 		$(gen-out-type) -o "." -m $<, \
 		"  GEN   $@")
-qmp-introspect.h qmp-introspect.c :\
-$(qapi-modules) $(SRC_PATH)/scripts/qapi-introspect.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-introspect.py \
-		$(gen-out-type) -o "." $<, \
-		"  GEN   $@")

 QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
 $(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)
@@ -306,30 +295,24 @@ qemu-ga$(EXESUF): $(qga-obj-y) libqemuutil.a libqemustub.a
 ifdef QEMU_GA_MSI_ENABLED
 QEMU_GA_MSI=qemu-ga-$(ARCH).msi

-msi: $(QEMU_GA_MSI)
+msi: ${QEMU_GA_MSI}

-$(QEMU_GA_MSI): qemu-ga.exe $(QGA_VSS_PROVIDER)
+$(QEMU_GA_MSI): qemu-ga.exe
+
+ifdef QEMU_GA_MSI_WITH_VSS
+$(QEMU_GA_MSI): qga/vss-win32/qga-vss.dll
+endif

 $(QEMU_GA_MSI): config-host.mak

-$(QEMU_GA_MSI):  $(SRC_PATH)/qga/installer/qemu-ga.wxs
-	$(call quiet-command,QEMU_GA_VERSION="$(QEMU_GA_VERSION)" QEMU_GA_MANUFACTURER="$(QEMU_GA_MANUFACTURER)" QEMU_GA_DISTRO="$(QEMU_GA_DISTRO)" BUILD_DIR="$(BUILD_DIR)" \
+$(QEMU_GA_MSI):  qga/installer/qemu-ga.wxs
+	$(call quiet-command,QEMU_GA_VERSION="$(QEMU_GA_VERSION)" QEMU_GA_MANUFACTURER="$(QEMU_GA_MANUFACTURER)" QEMU_GA_DISTRO="$(QEMU_GA_DISTRO)" \
 	wixl -o $@ $(QEMU_GA_MSI_ARCH) $(QEMU_GA_MSI_WITH_VSS) $(QEMU_GA_MSI_MINGW_DLL_PATH) $<, "  WIXL  $@")
 else
 msi:
-	@echo "MSI build not configured or dependency resolution failed (reconfigure with --enable-guest-agent-msi option)"
+	@echo MSI build not configured or dependency resolution failed (reconfigure with --enable-guest-agent-msi option)
 endif

-ifneq ($(EXESUF),)
-.PHONY: qemu-ga
-qemu-ga: qemu-ga$(EXESUF) $(QGA_VSS_PROVIDER) $(QEMU_GA_MSI)
-endif
-
-ivshmem-client$(EXESUF): $(ivshmem-client-obj-y)
-	$(call LINK, $^)
-ivshmem-server$(EXESUF): $(ivshmem-server-obj-y) libqemuutil.a libqemustub.a
-	$(call LINK, $^)
-
 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
@@ -361,7 +344,7 @@ qemu-%.tar.bz2:
 	$(SRC_PATH)/scripts/make-release "$(SRC_PATH)" "$(patsubst qemu-%.tar.bz2,%,$@)"

 distclean: clean
-	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi qemu-monitor-info.texi
+	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi
 	rm -f config-all-devices.mak config-all-disas.mak config.status
 	rm -f po/*.mo tests/qemu-iotests/common.env
 	rm -f roms/seabios/config.mak roms/vgabios/config.mak
@@ -417,9 +400,6 @@ ifneq ($(TOOLS),)
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
 endif
-ifneq (,$(findstring qemu-ga,$(TOOLS)))
-	$(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
-endif
 endif
 ifdef CONFIG_VIRTFS
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
@@ -528,16 +508,13 @@ qemu-options.texi: $(SRC_PATH)/qemu-options.hx
 qemu-monitor.texi: $(SRC_PATH)/hmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN   $@")

-qemu-monitor-info.texi: $(SRC_PATH)/hmp-commands-info.hx
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN   $@")
-
 qmp-commands.txt: $(SRC_PATH)/qmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -q < $< > $@,"  GEN   $@")

 qemu-img-cmds.texi: $(SRC_PATH)/qemu-img-cmds.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN   $@")

-qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
+qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu.pod && \
 	  $(POD2MAN) --section=1 --center=" " --release=" " qemu.pod > $@, \
@@ -561,12 +538,6 @@ qemu-nbd.8: qemu-nbd.texi
 	  $(POD2MAN) --section=8 --center=" " --release=" " qemu-nbd.pod > $@, \
 	  "  GEN   $@")

-qemu-ga.8: qemu-ga.texi
-	$(call quiet-command, \
-	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-ga.pod && \
-	  $(POD2MAN) --section=8 --center=" " --release=" " qemu-ga.pod > $@, \
-	  "  GEN   $@")
-
 kvm_stat.1: scripts/kvm/kvm_stat.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< kvm_stat.pod && \
@@ -580,8 +551,7 @@ pdf: qemu-doc.pdf qemu-tech.pdf

 qemu-doc.dvi qemu-doc.html qemu-doc.info qemu-doc.pdf: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi \
-	qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
-	qemu-monitor-info.texi
+	qemu-monitor.texi qemu-img-cmds.texi

 ifdef CONFIG_WIN32

@@ -631,7 +601,6 @@ endif # SIGNCODE
                $(if $(DLL_PATH),-DDLLDIR="$(DLL_PATH)") \
                -DSRCDIR="$(SRC_PATH)" \
                -DOUTFILE="$(INSTALLER)" \
-                -DDISPLAYVERSION="$(VERSION)" \
                $(SRC_PATH)/qemu.nsi
 	rm -r ${INSTDIR}
 ifdef SIGNCODE
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -1,8 +1,8 @@
 #######################################################################
 # Common libraries for tools and emulators
 stub-obj-y = stubs/
-util-obj-y = util/ qobject/ qapi/
-util-obj-y += qmp-introspect.o qapi-types.o qapi-visit.o qapi-event.o
+util-obj-y = util/ qobject/ qapi/ qapi-types.o qapi-visit.o qapi-event.o
+util-obj-y += crypto/

 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img
@@ -15,18 +15,24 @@ block-obj-$(CONFIG_WIN32) += aio-win32.o
 block-obj-y += block/
 block-obj-y += qemu-io-cmds.o

+block-obj-y += qemu-coroutine.o qemu-coroutine-lock.o qemu-coroutine-io.o
+block-obj-y += qemu-coroutine-sleep.o
+block-obj-y += coroutine-$(CONFIG_COROUTINE_BACKEND).o
+
 block-obj-m = block/

-#######################################################################
-# crypto-obj-y is code used by both qemu system emulation and qemu-img

-crypto-obj-y = crypto/
-crypto-aes-obj-y = crypto/
+######################################################################
+# smartcard

-#######################################################################
-# qom-obj-y is code used by both qemu system emulation and qemu-img
-
-qom-obj-y = qom/
+libcacard-y += libcacard/cac.o libcacard/event.o
+libcacard-y += libcacard/vcard.o libcacard/vreader.o
+libcacard-y += libcacard/vcard_emul_nss.o
+libcacard-y += libcacard/vcard_emul_type.o
+libcacard-y += libcacard/card_7816.o
+libcacard-y += libcacard/vcardt.o
+libcacard/vcard_emul_nss.o-cflags := $(NSS_CFLAGS)
+libcacard/vcard_emul_nss.o-libs := $(NSS_LIBS)

 ######################################################################
 # Target independent part of system emulation. The long term path is to
@@ -69,13 +75,14 @@ common-obj-y += backends/

 common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o

+common-obj-$(CONFIG_SMARTCARD_NSS) += $(libcacard-y)
+
 common-obj-$(CONFIG_FDT) += device_tree.o

 ######################################################################
 # qapi

 common-obj-y += qmp-marshal.o
-common-obj-y += qmp-introspect.o
 common-obj-y += qmp.o hmp.o
 endif

@@ -104,8 +111,3 @@ target-obj-y += trace/
 # by libqemuutil.a.  These should be moved to a separate .json schema.
 qga-obj-y = qga/
 qga-vss-dll-obj-y = qga/
-
-######################################################################
-# contrib
-ivshmem-client-obj-y = contrib/ivshmem-client/
-ivshmem-server-obj-y = contrib/ivshmem-server/
--- a/Makefile.target
+++ b/Makefile.target
@@ -7,7 +7,7 @@ include config-target.mak
 include config-devices.mak
 include $(SRC_PATH)/rules.mak

-$(call set-vpath, $(SRC_PATH):$(BUILD_DIR))
+$(call set-vpath, $(SRC_PATH))
 ifdef CONFIG_LINUX
 QEMU_CFLAGS += -I../linux-headers
 endif
@@ -85,11 +85,8 @@ all: $(PROGS) stap
 #########################################################
 # cpu emulator library
 obj-y = exec.o translate-all.o cpu-exec.o
-obj-y += translate-common.o
-obj-y += cpu-exec-common.o
 obj-y += tcg/tcg.o tcg/tcg-op.o tcg/optimize.o
 obj-$(CONFIG_TCG_INTERPRETER) += tci.o
-obj-y += tcg/tcg-common.o
 obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
 obj-y += fpu/softfloat.o
 obj-y += target-$(TARGET_BASE_ARCH)/
@@ -154,7 +151,7 @@ else
 obj-y += hw/$(TARGET_BASE_ARCH)/
 endif

-GENERATED_HEADERS += hmp-commands.h hmp-commands-info.h qmp-commands-old.h
+GENERATED_HEADERS += hmp-commands.h qmp-commands-old.h

 endif # CONFIG_SOFTMMU

@@ -173,18 +170,12 @@ target-obj-y-save := $(target-obj-y)
 dummy := $(call unnest-vars,.., \
               block-obj-y \
               block-obj-m \
-               crypto-obj-y \
-               crypto-aes-obj-y \
-               qom-obj-y \
               common-obj-y \
               common-obj-m)
 target-obj-y := $(target-obj-y-save)
 all-obj-y += $(common-obj-y)
 all-obj-y += $(target-obj-y)
-all-obj-y += $(qom-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y)
-all-obj-$(CONFIG_USER_ONLY) += $(crypto-aes-obj-y)
-all-obj-$(CONFIG_SOFTMMU) += $(crypto-obj-y)

 $(QEMU_PROG_BUILD): config-devices.mak

@@ -202,9 +193,6 @@ gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
 hmp-commands.h: $(SRC_PATH)/hmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

-hmp-commands-info.h: $(SRC_PATH)/hmp-commands-info.hx
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
-
 qmp-commands-old.h: $(SRC_PATH)/qmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

--- a/108
+++ b/108
@@ -1,107 +1,3 @@
-         QEMU README
-         ===========
+Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

-QEMU is a generic and open source machine & userspace emulator and
-virtualizer.
-
-QEMU is capable of emulating a complete machine in software without any
-need for hardware virtualization support. By using dynamic translation,
-it achieves very good performance. QEMU can also integrate with the Xen
-and KVM hypervisors to provide emulated hardware while allowing the
-hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
-near native performance for CPUs. When QEMU emulates CPUs directly it is
-capable of running operating systems made for one machine (e.g. an ARMv7
-board) on a different machine (e.g. an x86_64 PC board).
-
-QEMU is also capable of providing userspace API virtualization for Linux
-and BSD kernel interfaces. This allows binaries compiled against one
-architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
-different architecture ABI (e.g. the Linux x86_64 ABI). This does not
-involve any hardware emulation, simply CPU and syscall emulation.
-
-QEMU aims to fit into a variety of use cases. It can be invoked directly
-by users wishing to have full control over its behaviour and settings.
-It also aims to facilitate integration into higher level management
-layers, by providing a stable command line interface and monitor API.
-It is commonly invoked indirectly via the libvirt library when using
-open source applications such as oVirt, OpenStack and virt-manager.
-
-QEMU as a whole is released under the GNU General Public License,
-version 2. For full licensing details, consult the LICENSE file.
-
-
-Building
-========
-
-QEMU is multi-platform software intended to be buildable on all modern
-Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
-of other UNIX targets. The simple steps to build QEMU are:
-
-  mkdir build
-  cd build
-  ../configure
-  make
-
-Complete details of the process for building and configuring QEMU for
-all supported host platforms can be found in the qemu-tech.html file.
-Additional information can also be found online via the QEMU website:
-
-  http://qemu-project.org/Hosts/Linux
-  http://qemu-project.org/Hosts/W32
-
-
-Submitting patches
-==================
-
-The QEMU source code is maintained under the GIT version control system.
-
-   git clone git://git.qemu-project.org/qemu.git
-
-When submitting patches, the preferred approach is to use 'git
-format-patch' and/or 'git send-email' to format & send the mail to the
-qemu-devel@nongnu.org mailing list. All patches submitted must contain
-a 'Signed-off-by' line from the author. Patches should follow the
-guidelines set out in the HACKING and CODING_STYLE files.
-
-Additional information on submitting patches can be found online via
-the QEMU website
-
-  http://qemu-project.org/Contribute/SubmitAPatch
-  http://qemu-project.org/Contribute/TrivialPatches
-
-
-Bug reporting
-=============
-
-The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
-found when running code built from QEMU git or upstream released sources
-should be reported via:
-
-  https://bugs.launchpad.net/qemu/
-
-If using QEMU via an operating system vendor pre-built binary package, it
-is preferable to report bugs to the vendor's own bug tracker first. If
-the bug is also known to affect latest upstream code, it can also be
-reported via launchpad.
-
-For additional information on bug reporting consult:
-
-  http://qemu-project.org/Contribute/ReportABug
-
-
-Contact
-=======
-
-The QEMU community can be contacted in a number of ways, with the two
-main methods being email and IRC
-
- - qemu-devel@nongnu.org
-   http://lists.nongnu.org/mailman/listinfo/qemu-devel
- - #qemu on irc.oftc.net
-
-Information on additional methods of contacting the community can be
-found online via the QEMU website:
-
-  http://qemu-project.org/Contribute/StartHere
-
-- End
+- QEMU team
--- a/2
+++ b/2
@@ -1 +1 @@
-2.4.50
+2.4.0.1
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -25,7 +25,6 @@ struct AioHandler
    IOHandler *io_write;
    int deleted;
    void *opaque;
-    bool is_external;
    QLIST_ENTRY(AioHandler) node;
 };

@@ -44,7 +43,6 @@ static AioHandler *find_aio_handler(AioContext *ctx, int fd)

 void aio_set_fd_handler(AioContext *ctx,
                        int fd,
-                        bool is_external,
                        IOHandler *io_read,
                        IOHandler *io_write,
                        void *opaque)
@@ -84,7 +82,6 @@ void aio_set_fd_handler(AioContext *ctx,
        node->io_read = io_read;
        node->io_write = io_write;
        node->opaque = opaque;
-        node->is_external = is_external;

        node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR : 0);
        node->pfd.events |= (io_write ? G_IO_OUT | G_IO_ERR : 0);
@@ -95,11 +92,10 @@ void aio_set_fd_handler(AioContext *ctx,

 void aio_set_event_notifier(AioContext *ctx,
                            EventNotifier *notifier,
-                            bool is_external,
                            EventNotifierHandler *io_read)
 {
    aio_set_fd_handler(ctx, event_notifier_get_fd(notifier),
-                       is_external, (IOHandler *)io_read, NULL, notifier);
+                       (IOHandler *)io_read, NULL, notifier);
 }

 bool aio_prepare(AioContext *ctx)
@@ -261,8 +257,7 @@ bool aio_poll(AioContext *ctx, bool blocking)

    /* fill pollfds */
    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (!node->deleted && node->pfd.events
-            && aio_node_check(ctx, node->is_external)) {
+        if (!node->deleted && node->pfd.events) {
            add_pollfd(node);
        }
    }
--- a/aio-win32.c
+++ b/aio-win32.c
@@ -28,13 +28,11 @@ struct AioHandler {
    GPollFD pfd;
    int deleted;
    void *opaque;
-    bool is_external;
    QLIST_ENTRY(AioHandler) node;
 };

 void aio_set_fd_handler(AioContext *ctx,
                        int fd,
-                        bool is_external,
                        IOHandler *io_read,
                        IOHandler *io_write,
                        void *opaque)
@@ -88,7 +86,6 @@ void aio_set_fd_handler(AioContext *ctx,
        node->opaque = opaque;
        node->io_read = io_read;
        node->io_write = io_write;
-        node->is_external = is_external;

        event = event_notifier_get_handle(&ctx->notifier);
        WSAEventSelect(node->pfd.fd, event,
@@ -101,7 +98,6 @@ void aio_set_fd_handler(AioContext *ctx,

 void aio_set_event_notifier(AioContext *ctx,
                            EventNotifier *e,
-                            bool is_external,
                            EventNotifierHandler *io_notify)
 {
    AioHandler *node;
@@ -137,7 +133,6 @@ void aio_set_event_notifier(AioContext *ctx,
            node->e = e;
            node->pfd.fd = (uintptr_t)event_notifier_get_handle(e);
            node->pfd.events = G_IO_IN;
-            node->is_external = is_external;
            QLIST_INSERT_HEAD(&ctx->aio_handlers, node, node);

            g_source_add_poll(&ctx->source, &node->pfd);
@@ -309,8 +304,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
    /* fill fd sets */
    count = 0;
    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (!node->deleted && node->io_notify
-            && aio_node_check(ctx, node->is_external)) {
+        if (!node->deleted && node->io_notify) {
            events[count++] = event_notifier_get_handle(node->e);
        }
    }
--- a/arch_init.c
+++ b/arch_init.c
@@ -26,7 +26,7 @@
 #include "sysemu/arch_init.h"
 #include "hw/pci/pci.h"
 #include "hw/audio/audio.h"
-#include "hw/smbios/smbios.h"
+#include "hw/i386/smbios.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
 #include "qmp-commands.h"
--- a/async.c
+++ b/async.c
@@ -247,7 +247,7 @@ aio_ctx_finalize(GSource     *source)
    }
    qemu_mutex_unlock(&ctx->bh_lock);

-    aio_set_event_notifier(ctx, &ctx->notifier, false, NULL);
+    aio_set_event_notifier(ctx, &ctx->notifier, NULL);
    event_notifier_cleanup(&ctx->notifier);
    rfifolock_destroy(&ctx->lock);
    qemu_mutex_destroy(&ctx->bh_lock);
@@ -329,7 +329,6 @@ AioContext *aio_context_new(Error **errp)
    }
    g_source_set_can_recurse(&ctx->source, true);
    aio_set_event_notifier(ctx, &ctx->notifier,
-                           false,
                           (EventNotifierHandler *)
                           event_notifier_dummy_cb);
    ctx->thread_pool = NULL;
--- a/backends/baum.c
+++ b/backends/baum.c
@@ -303,7 +303,7 @@ static int baum_eat_packet(BaumDriverState *baum, const uint8_t *buf, int len)
                return 0;
            cur++;
        }
-        DPRINTF("Dropped %td bytes!\n", cur - buf);
+        DPRINTF("Dropped %d bytes!\n", cur - buf);
    }

 #define EAT(c) do {\
@@ -561,10 +561,7 @@ static void baum_close(struct CharDriverState *chr)
    g_free(baum);
 }

-static CharDriverState *chr_baum_init(const char *id,
-                                      ChardevBackend *backend,
-                                      ChardevReturn *ret,
-                                      Error **errp)
+CharDriverState *chr_baum_init(void)
 {
    BaumDriverState *baum;
    CharDriverState *chr;
@@ -589,16 +586,14 @@ static CharDriverState *chr_baum_init(const char *id,

    baum->brlapi_fd = brlapi__openConnection(handle, NULL, NULL);
    if (baum->brlapi_fd == -1) {
-        error_setg(errp, "brlapi__openConnection: %s",
-                   brlapi_strerror(brlapi_error_location()));
+        brlapi_perror("baum_init: brlapi_openConnection");
        goto fail_handle;
    }

    baum->cellCount_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, baum_cellCount_timer_cb, baum);

    if (brlapi__getDisplaySize(handle, &baum->x, &baum->y) == -1) {
-        error_setg(errp, "brlapi__getDisplaySize: %s",
-                   brlapi_strerror(brlapi_error_location()));
+        brlapi_perror("baum_init: brlapi_getDisplaySize");
        goto fail;
    }

@@ -614,8 +609,7 @@ static CharDriverState *chr_baum_init(const char *id,
        tty = BRLAPI_TTY_DEFAULT;

    if (brlapi__enterTtyMode(handle, tty, NULL) == -1) {
-        error_setg(errp, "brlapi__enterTtyMode: %s",
-                   brlapi_strerror(brlapi_error_location()));
+        brlapi_perror("baum_init: brlapi_enterTtyMode");
        goto fail;
    }

@@ -635,8 +629,7 @@ fail_handle:

 static void register_types(void)
 {
-    register_char_driver("braille", CHARDEV_BACKEND_KIND_BRAILLE, NULL,
-                         chr_baum_init);
+    register_char_driver("braille", CHARDEV_BACKEND_KIND_BRAILLE, NULL);
 }

 type_init(register_types);
--- a/backends/hostmem-file.c
+++ b/backends/hostmem-file.c
@@ -83,7 +83,9 @@ static void set_mem_path(Object *o, const char *str, Error **errp)
        error_setg(errp, "cannot change property value");
        return;
    }
+    if (fb->mem_path) {
        g_free(fb->mem_path);
+    }
    fb->mem_path = g_strdup(str);
 }

--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -63,10 +63,7 @@ static void msmouse_chr_close (struct CharDriverState *chr)
    g_free (chr);
 }

-static CharDriverState *qemu_chr_open_msmouse(const char *id,
-                                              ChardevBackend *backend,
-                                              ChardevReturn *ret,
-                                              Error **errp)
+CharDriverState *qemu_chr_open_msmouse(void)
 {
    CharDriverState *chr;

@@ -82,8 +79,7 @@ static CharDriverState *qemu_chr_open_msmouse(const char *id,

 static void register_types(void)
 {
-    register_char_driver("msmouse", CHARDEV_BACKEND_KIND_MSMOUSE, NULL,
-                         qemu_chr_open_msmouse);
+    register_char_driver("msmouse", CHARDEV_BACKEND_KIND_MSMOUSE, NULL);
 }

 type_init(register_types);
--- a/backends/testdev.c
+++ b/backends/testdev.c
@@ -108,16 +108,13 @@ static void testdev_close(struct CharDriverState *chr)
    g_free(testdev);
 }

-static CharDriverState *chr_testdev_init(const char *id,
-                                         ChardevBackend *backend,
-                                         ChardevReturn *ret,
-                                         Error **errp)
+CharDriverState *chr_testdev_init(void)
 {
    TestdevCharState *testdev;
    CharDriverState *chr;

-    testdev = g_new0(TestdevCharState, 1);
-    testdev->chr = chr = g_new0(CharDriverState, 1);
+    testdev = g_malloc0(sizeof(TestdevCharState));
+    testdev->chr = chr = g_malloc0(sizeof(CharDriverState));

    chr->opaque = testdev;
    chr->chr_write = testdev_write;
@@ -128,8 +125,7 @@ static CharDriverState *chr_testdev_init(const char *id,

 static void register_types(void)
 {
-    register_char_driver("testdev", CHARDEV_BACKEND_KIND_TESTDEV, NULL,
-                         chr_testdev_init);
+    register_char_driver("testdev", CHARDEV_BACKEND_KIND_TESTDEV, NULL);
 }

 type_init(register_types);
--- a/block.c
+++ b/block.c
--- a/block/accounting.c
+++ b/block/accounting.c
@@ -47,6 +47,14 @@ void block_acct_done(BlockAcctStats *stats, BlockAcctCookie *cookie)
 }


+void block_acct_highest_sector(BlockAcctStats *stats, int64_t sector_num,
+                               unsigned int nb_sectors)
+{
+    if (stats->wr_highest_sector < sector_num + nb_sectors - 1) {
+        stats->wr_highest_sector = sector_num + nb_sectors - 1;
+    }
+}
+
 void block_acct_merge_done(BlockAcctStats *stats, enum BlockAcctType type,
                      int num_requests)
 {
--- a/block/backup.c
+++ b/block/backup.c
@@ -21,7 +21,6 @@
 #include "block/blockjob.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
-#include "sysemu/block-backend.h"

 #define BACKUP_CLUSTER_BITS 16
 #define BACKUP_CLUSTER_SIZE (1 << BACKUP_CLUSTER_BITS)
@@ -90,8 +89,7 @@ static void cow_request_end(CowRequest *req)

 static int coroutine_fn backup_do_cow(BlockDriverState *bs,
                                      int64_t sector_num, int nb_sectors,
-                                      bool *error_is_read,
-                                      bool is_write_notifier)
+                                      bool *error_is_read)
 {
    BackupBlockJob *job = (BackupBlockJob *)bs->job;
    CowRequest cow_request;
@@ -131,14 +129,8 @@ static int coroutine_fn backup_do_cow(BlockDriverState *bs,
        iov.iov_len = n * BDRV_SECTOR_SIZE;
        qemu_iovec_init_external(&bounce_qiov, &iov, 1);

-        if (is_write_notifier) {
-            ret = bdrv_co_no_copy_on_readv(bs,
-                                           start * BACKUP_SECTORS_PER_CLUSTER,
-                                           n, &bounce_qiov);
-        } else {
        ret = bdrv_co_readv(bs, start * BACKUP_SECTORS_PER_CLUSTER, n,
                            &bounce_qiov);
-        }
        if (ret < 0) {
            trace_backup_do_cow_read_fail(job, start, ret);
            if (error_is_read) {
@@ -198,7 +190,7 @@ static int coroutine_fn backup_before_write_notify(
    assert((req->offset & (BDRV_SECTOR_SIZE - 1)) == 0);
    assert((req->bytes & (BDRV_SECTOR_SIZE - 1)) == 0);

-    return backup_do_cow(req->bs, sector_num, nb_sectors, NULL, true);
+    return backup_do_cow(req->bs, sector_num, nb_sectors, NULL);
 }

 static void backup_set_speed(BlockJob *job, int64_t speed, Error **errp)
@@ -216,9 +208,7 @@ static void backup_iostatus_reset(BlockJob *job)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);

-    if (s->target->blk) {
-        blk_iostatus_reset(s->target->blk);
-    }
+    bdrv_iostatus_reset(s->target);
 }

 static const BlockJobDriver backup_job_driver = {
@@ -313,8 +303,7 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
                    return ret;
                }
                ret = backup_do_cow(bs, cluster * BACKUP_SECTORS_PER_CLUSTER,
-                                    BACKUP_SECTORS_PER_CLUSTER, &error_is_read,
-                                    false);
+                                    BACKUP_SECTORS_PER_CLUSTER, &error_is_read);
                if ((ret < 0) &&
                    backup_error_action(job, error_is_read, -ret) ==
                    BLOCK_ERROR_ACTION_REPORT) {
@@ -363,10 +352,8 @@ static void coroutine_fn backup_run(void *opaque)
    job->bitmap = hbitmap_alloc(end, 0);

    bdrv_set_enable_write_cache(target, true);
-    if (target->blk) {
-        blk_set_on_error(target->blk, on_target_error, on_target_error);
-        blk_iostatus_enable(target->blk);
-    }
+    bdrv_set_on_error(target, on_target_error, on_target_error);
+    bdrv_iostatus_enable(target);

    bdrv_add_before_write_notifier(bs, &before_write);

@@ -421,7 +408,7 @@ static void coroutine_fn backup_run(void *opaque)
            }
            /* FULL sync mode we copy the whole drive. */
            ret = backup_do_cow(bs, start * BACKUP_SECTORS_PER_CLUSTER,
-                    BACKUP_SECTORS_PER_CLUSTER, &error_is_read, false);
+                    BACKUP_SECTORS_PER_CLUSTER, &error_is_read);
            if (ret < 0) {
                /* Depending on error action, fail now or retry cluster */
                BlockErrorAction action =
@@ -456,9 +443,7 @@ static void coroutine_fn backup_run(void *opaque)
    }
    hbitmap_free(job->bitmap);

-    if (target->blk) {
-        blk_iostatus_disable(target->blk);
-    }
+    bdrv_iostatus_disable(target);
    bdrv_op_unblock_all(target, job->common.blocker);

    data = g_malloc(sizeof(*data));
@@ -487,7 +472,7 @@ void backup_start(BlockDriverState *bs, BlockDriverState *target,

    if ((on_source_error == BLOCKDEV_ON_ERROR_STOP ||
         on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        (!bs->blk || !blk_iostatus_is_enabled(bs->blk))) {
+        !bdrv_iostatus_is_enabled(bs)) {
        error_setg(errp, QERR_INVALID_PARAMETER, "on-source-error");
        return;
    }
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -426,11 +426,11 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
    /* Set initial state */
    s->state = 1;

-    /* Open the image file */
-    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options, "image",
+    /* Open the backing file */
+    assert(bs->file == NULL);
+    ret = bdrv_open_image(&bs->file, qemu_opt_get(opts, "x-image"), options, "image",
                          bs, &child_file, false, &local_err);
-    if (local_err) {
-        ret = -EINVAL;
+    if (ret < 0) {
        error_propagate(errp, local_err);
        goto out;
    }
@@ -449,7 +449,7 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
    goto out;

 fail_unref:
-    bdrv_unref_child(bs, bs->file);
+    bdrv_unref(bs->file);
 out:
    qemu_opts_del(opts);
    return ret;
@@ -510,8 +510,7 @@ static BlockAIOCB *blkdebug_aio_readv(BlockDriverState *bs,
        return inject_error(bs, cb, opaque, rule);
    }

-    return bdrv_aio_readv(bs->file->bs, sector_num, qiov, nb_sectors,
-                          cb, opaque);
+    return bdrv_aio_readv(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
 }

 static BlockAIOCB *blkdebug_aio_writev(BlockDriverState *bs,
@@ -533,8 +532,7 @@ static BlockAIOCB *blkdebug_aio_writev(BlockDriverState *bs,
        return inject_error(bs, cb, opaque, rule);
    }

-    return bdrv_aio_writev(bs->file->bs, sector_num, qiov, nb_sectors,
-                           cb, opaque);
+    return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
 }

 static BlockAIOCB *blkdebug_aio_flush(BlockDriverState *bs,
@@ -553,7 +551,7 @@ static BlockAIOCB *blkdebug_aio_flush(BlockDriverState *bs,
        return inject_error(bs, cb, opaque, rule);
    }

-    return bdrv_aio_flush(bs->file->bs, cb, opaque);
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }


@@ -718,12 +716,12 @@ static bool blkdebug_debug_is_suspended(BlockDriverState *bs, const char *tag)

 static int64_t blkdebug_getlength(BlockDriverState *bs)
 {
-    return bdrv_getlength(bs->file->bs);
+    return bdrv_getlength(bs->file);
 }

 static int blkdebug_truncate(BlockDriverState *bs, int64_t offset)
 {
-    return bdrv_truncate(bs->file->bs, offset);
+    return bdrv_truncate(bs->file, offset);
 }

 static void blkdebug_refresh_filename(BlockDriverState *bs)
@@ -743,24 +741,24 @@ static void blkdebug_refresh_filename(BlockDriverState *bs)
        }
    }

-    if (force_json && !bs->file->bs->full_open_options) {
+    if (force_json && !bs->file->full_open_options) {
        /* The config file cannot be recreated, so creating a plain filename
         * is impossible */
        return;
    }

-    if (!force_json && bs->file->bs->exact_filename[0]) {
+    if (!force_json && bs->file->exact_filename[0]) {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "blkdebug:%s:%s",
                 qdict_get_try_str(bs->options, "config") ?: "",
-                 bs->file->bs->exact_filename);
+                 bs->file->exact_filename);
    }

    opts = qdict_new();
    qdict_put_obj(opts, "driver", QOBJECT(qstring_from_str("blkdebug")));

-    QINCREF(bs->file->bs->full_open_options);
-    qdict_put_obj(opts, "image", QOBJECT(bs->file->bs->full_open_options));
+    QINCREF(bs->file->full_open_options);
+    qdict_put_obj(opts, "image", QOBJECT(bs->file->full_open_options));

    for (e = qdict_first(bs->options); e; e = qdict_next(bs->options, e)) {
        if (strcmp(qdict_entry_key(e), "x-image") &&
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -14,7 +14,7 @@
 #include "qapi/qmp/qstring.h"

 typedef struct {
-    BdrvChild *test_file;
+    BlockDriverState *test_file;
 } BDRVBlkverifyState;

 typedef struct BlkverifyAIOCB BlkverifyAIOCB;
@@ -123,29 +123,26 @@ static int blkverify_open(BlockDriverState *bs, QDict *options, int flags,
    }

    /* Open the raw file */
-    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-raw"), options, "raw",
-                               bs, &child_file, false, &local_err);
-    if (local_err) {
-        ret = -EINVAL;
+    assert(bs->file == NULL);
+    ret = bdrv_open_image(&bs->file, qemu_opt_get(opts, "x-raw"), options,
+                          "raw", bs, &child_file, false, &local_err);
+    if (ret < 0) {
        error_propagate(errp, local_err);
        goto fail;
    }

    /* Open the test file */
-    s->test_file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options,
-                                   "test", bs, &child_format, false,
-                                   &local_err);
-    if (local_err) {
-        ret = -EINVAL;
+    assert(s->test_file == NULL);
+    ret = bdrv_open_image(&s->test_file, qemu_opt_get(opts, "x-image"), options,
+                          "test", bs, &child_format, false, &local_err);
+    if (ret < 0) {
        error_propagate(errp, local_err);
+        s->test_file = NULL;
        goto fail;
    }

    ret = 0;
 fail:
-    if (ret < 0) {
-        bdrv_unref_child(bs, bs->file);
-    }
    qemu_opts_del(opts);
    return ret;
 }
@@ -154,7 +151,7 @@ static void blkverify_close(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;

-    bdrv_unref_child(bs, s->test_file);
+    bdrv_unref(s->test_file);
    s->test_file = NULL;
 }

@@ -162,7 +159,7 @@ static int64_t blkverify_getlength(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;

-    return bdrv_getlength(s->test_file->bs);
+    return bdrv_getlength(s->test_file);
 }

 static BlkverifyAIOCB *blkverify_aio_get(BlockDriverState *bs, bool is_write,
@@ -241,13 +238,13 @@ static BlockAIOCB *blkverify_aio_readv(BlockDriverState *bs,
                                            nb_sectors, cb, opaque);

    acb->verify = blkverify_verify_readv;
-    acb->buf = qemu_blockalign(bs->file->bs, qiov->size);
+    acb->buf = qemu_blockalign(bs->file, qiov->size);
    qemu_iovec_init(&acb->raw_qiov, acb->qiov->niov);
    qemu_iovec_clone(&acb->raw_qiov, qiov, acb->buf);

-    bdrv_aio_readv(s->test_file->bs, sector_num, qiov, nb_sectors,
+    bdrv_aio_readv(s->test_file, sector_num, qiov, nb_sectors,
                   blkverify_aio_cb, acb);
-    bdrv_aio_readv(bs->file->bs, sector_num, &acb->raw_qiov, nb_sectors,
+    bdrv_aio_readv(bs->file, sector_num, &acb->raw_qiov, nb_sectors,
                   blkverify_aio_cb, acb);
    return &acb->common;
 }
@@ -260,9 +257,9 @@ static BlockAIOCB *blkverify_aio_writev(BlockDriverState *bs,
    BlkverifyAIOCB *acb = blkverify_aio_get(bs, true, sector_num, qiov,
                                            nb_sectors, cb, opaque);

-    bdrv_aio_writev(s->test_file->bs, sector_num, qiov, nb_sectors,
+    bdrv_aio_writev(s->test_file, sector_num, qiov, nb_sectors,
                    blkverify_aio_cb, acb);
-    bdrv_aio_writev(bs->file->bs, sector_num, qiov, nb_sectors,
+    bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors,
                    blkverify_aio_cb, acb);
    return &acb->common;
 }
@@ -274,7 +271,7 @@ static BlockAIOCB *blkverify_aio_flush(BlockDriverState *bs,
    BDRVBlkverifyState *s = bs->opaque;

    /* Only flush test file, the raw file is not important */
-    return bdrv_aio_flush(s->test_file->bs, cb, opaque);
+    return bdrv_aio_flush(s->test_file, cb, opaque);
 }

 static bool blkverify_recurse_is_first_non_filter(BlockDriverState *bs,
@@ -282,13 +279,13 @@ static bool blkverify_recurse_is_first_non_filter(BlockDriverState *bs,
 {
    BDRVBlkverifyState *s = bs->opaque;

-    bool perm = bdrv_recurse_is_first_non_filter(bs->file->bs, candidate);
+    bool perm = bdrv_recurse_is_first_non_filter(bs->file, candidate);

    if (perm) {
        return true;
    }

-    return bdrv_recurse_is_first_non_filter(s->test_file->bs, candidate);
+    return bdrv_recurse_is_first_non_filter(s->test_file, candidate);
 }

 /* Propagate AioContext changes to ->test_file */
@@ -296,7 +293,7 @@ static void blkverify_detach_aio_context(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;

-    bdrv_detach_aio_context(s->test_file->bs);
+    bdrv_detach_aio_context(s->test_file);
 }

 static void blkverify_attach_aio_context(BlockDriverState *bs,
@@ -304,38 +301,32 @@ static void blkverify_attach_aio_context(BlockDriverState *bs,
 {
    BDRVBlkverifyState *s = bs->opaque;

-    bdrv_attach_aio_context(s->test_file->bs, new_context);
+    bdrv_attach_aio_context(s->test_file, new_context);
 }

 static void blkverify_refresh_filename(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;

-    /* bs->file->bs has already been refreshed */
-    bdrv_refresh_filename(s->test_file->bs);
+    /* bs->file has already been refreshed */
+    bdrv_refresh_filename(s->test_file);

-    if (bs->file->bs->full_open_options
-        && s->test_file->bs->full_open_options)
-    {
+    if (bs->file->full_open_options && s->test_file->full_open_options) {
        QDict *opts = qdict_new();
        qdict_put_obj(opts, "driver", QOBJECT(qstring_from_str("blkverify")));

-        QINCREF(bs->file->bs->full_open_options);
-        qdict_put_obj(opts, "raw", QOBJECT(bs->file->bs->full_open_options));
-        QINCREF(s->test_file->bs->full_open_options);
-        qdict_put_obj(opts, "test",
-                      QOBJECT(s->test_file->bs->full_open_options));
+        QINCREF(bs->file->full_open_options);
+        qdict_put_obj(opts, "raw", QOBJECT(bs->file->full_open_options));
+        QINCREF(s->test_file->full_open_options);
+        qdict_put_obj(opts, "test", QOBJECT(s->test_file->full_open_options));

        bs->full_open_options = opts;
    }

-    if (bs->file->bs->exact_filename[0]
-        && s->test_file->bs->exact_filename[0])
-    {
+    if (bs->file->exact_filename[0] && s->test_file->exact_filename[0]) {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "blkverify:%s:%s",
-                 bs->file->bs->exact_filename,
-                 s->test_file->bs->exact_filename);
+                 bs->file->exact_filename, s->test_file->exact_filename);
    }
 }

--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -12,17 +12,12 @@

 #include "sysemu/block-backend.h"
 #include "block/block_int.h"
-#include "block/blockjob.h"
-#include "block/throttle-groups.h"
 #include "sysemu/blockdev.h"
-#include "sysemu/sysemu.h"
 #include "qapi-event.h"

 /* Number of coroutines to reserve per attached device model */
 #define COROUTINE_POOL_RESERVATION 64

-static AioContext *blk_aiocb_get_aio_context(BlockAIOCB *acb);
-
 struct BlockBackend {
    char *name;
    int refcnt;
@@ -34,31 +29,15 @@ struct BlockBackend {
    /* TODO change to DeviceState when all users are qdevified */
    const BlockDevOps *dev_ops;
    void *dev_opaque;
-
-    /* the block size for which the guest device expects atomicity */
-    int guest_block_size;
-
-    /* If the BDS tree is removed, some of its options are stored here (which
-     * can be used to restore those options in the new BDS on insert) */
-    BlockBackendRootState root_state;
-
-    /* I/O stats (display with "info blockstats"). */
-    BlockAcctStats stats;
-
-    BlockdevOnError on_read_error, on_write_error;
-    bool iostatus_enabled;
-    BlockDeviceIoStatus iostatus;
 };

 typedef struct BlockBackendAIOCB {
    BlockAIOCB common;
    QEMUBH *bh;
-    BlockBackend *blk;
    int ret;
 } BlockBackendAIOCB;

 static const AIOCBInfo block_backend_aiocb_info = {
-    .get_aio_context = blk_aiocb_get_aio_context,
    .aiocb_size = sizeof(BlockBackendAIOCB),
 };

@@ -147,7 +126,7 @@ BlockBackend *blk_new_open(const char *name, const char *filename,
        return NULL;
    }

-    ret = bdrv_open(&blk->bs, filename, reference, options, flags, errp);
+    ret = bdrv_open(&blk->bs, filename, reference, options, flags, NULL, errp);
    if (ret < 0) {
        blk_unref(blk);
        return NULL;
@@ -166,10 +145,6 @@ static void blk_delete(BlockBackend *blk)
        bdrv_unref(blk->bs);
        blk->bs = NULL;
    }
-    if (blk->root_state.throttle_state) {
-        g_free(blk->root_state.throttle_group);
-        throttle_group_unref(blk->root_state.throttle_state);
-    }
    /* Avoid double-remove after blk_hide_on_behalf_of_hmp_drive_del() */
    if (blk->name[0]) {
        QTAILQ_REMOVE(&blk_backends, blk, link);
@@ -263,23 +238,6 @@ BlockDriverState *blk_bs(BlockBackend *blk)
    return blk->bs;
 }

-/*
- * Changes the BlockDriverState attached to @blk
- */
-void blk_set_bs(BlockBackend *blk, BlockDriverState *bs)
-{
-    bdrv_ref(bs);
-
-    if (blk->bs) {
-        blk->bs->blk = NULL;
-        bdrv_unref(blk->bs);
-    }
-    assert(bs->blk == NULL);
-
-    blk->bs = bs;
-    bs->blk = blk;
-}
-
 /*
 * Return @blk's DriveInfo if any, else null.
 */
@@ -333,17 +291,6 @@ void blk_hide_on_behalf_of_hmp_drive_del(BlockBackend *blk)
    }
 }

-/*
- * Associates a new BlockDriverState with @blk.
- */
-void blk_insert_bs(BlockBackend *blk, BlockDriverState *bs)
-{
-    assert(!blk->bs && !bs->blk);
-    bdrv_ref(bs);
-    blk->bs = bs;
-    bs->blk = blk;
-}
-
 /*
 * Attach device model @dev to @blk.
 * Return 0 on success, -EBUSY when a device model is attached already.
@@ -356,7 +303,7 @@ int blk_attach_dev(BlockBackend *blk, void *dev)
    }
    blk_ref(blk);
    blk->dev = dev;
-    blk_iostatus_reset(blk);
+    bdrv_iostatus_reset(blk->bs);
    return 0;
 }

@@ -383,7 +330,7 @@ void blk_detach_dev(BlockBackend *blk, void *dev)
    blk->dev = NULL;
    blk->dev_ops = NULL;
    blk->dev_opaque = NULL;
-    blk->guest_block_size = 512;
+    bdrv_set_guest_block_size(blk->bs, 512);
    blk_unref(blk);
 }

@@ -488,47 +435,7 @@ void blk_dev_resize_cb(BlockBackend *blk)

 void blk_iostatus_enable(BlockBackend *blk)
 {
-    blk->iostatus_enabled = true;
-    blk->iostatus = BLOCK_DEVICE_IO_STATUS_OK;
-}
-
-/* The I/O status is only enabled if the drive explicitly
- * enables it _and_ the VM is configured to stop on errors */
-bool blk_iostatus_is_enabled(const BlockBackend *blk)
-{
-    return (blk->iostatus_enabled &&
-           (blk->on_write_error == BLOCKDEV_ON_ERROR_ENOSPC ||
-            blk->on_write_error == BLOCKDEV_ON_ERROR_STOP   ||
-            blk->on_read_error == BLOCKDEV_ON_ERROR_STOP));
-}
-
-BlockDeviceIoStatus blk_iostatus(const BlockBackend *blk)
-{
-    return blk->iostatus;
-}
-
-void blk_iostatus_disable(BlockBackend *blk)
-{
-    blk->iostatus_enabled = false;
-}
-
-void blk_iostatus_reset(BlockBackend *blk)
-{
-    if (blk_iostatus_is_enabled(blk)) {
-        blk->iostatus = BLOCK_DEVICE_IO_STATUS_OK;
-        if (blk->bs && blk->bs->job) {
-            block_job_iostatus_reset(blk->bs->job);
-        }
-    }
-}
-
-void blk_iostatus_set_err(BlockBackend *blk, int error)
-{
-    assert(blk_iostatus_is_enabled(blk));
-    if (blk->iostatus == BLOCK_DEVICE_IO_STATUS_OK) {
-        blk->iostatus = error == ENOSPC ? BLOCK_DEVICE_IO_STATUS_NOSPACE :
-                                          BLOCK_DEVICE_IO_STATUS_FAILED;
-    }
+    bdrv_iostatus_enable(blk->bs);
 }

 static int blk_check_byte_request(BlockBackend *blk, int64_t offset,
@@ -540,7 +447,7 @@ static int blk_check_byte_request(BlockBackend *blk, int64_t offset,
        return -EIO;
    }

-    if (!blk_is_available(blk)) {
+    if (!blk_is_inserted(blk)) {
        return -ENOMEDIUM;
    }

@@ -634,7 +541,6 @@ static BlockAIOCB *abort_aio_request(BlockBackend *blk, BlockCompletionFunc *cb,
    QEMUBH *bh;

    acb = blk_aio_get(&block_backend_aiocb_info, blk, cb, opaque);
-    acb->blk = blk;
    acb->ret = ret;

    bh = aio_bh_new(blk_get_aio_context(blk), error_callback_bh, acb);
@@ -679,28 +585,16 @@ int blk_pwrite(BlockBackend *blk, int64_t offset, const void *buf, int count)

 int64_t blk_getlength(BlockBackend *blk)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_getlength(blk->bs);
 }

 void blk_get_geometry(BlockBackend *blk, uint64_t *nb_sectors_ptr)
 {
-    if (!blk->bs) {
-        *nb_sectors_ptr = 0;
-    } else {
    bdrv_get_geometry(blk->bs, nb_sectors_ptr);
 }
-}

 int64_t blk_nb_sectors(BlockBackend *blk)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_nb_sectors(blk->bs);
 }

@@ -731,10 +625,6 @@ BlockAIOCB *blk_aio_writev(BlockBackend *blk, int64_t sector_num,
 BlockAIOCB *blk_aio_flush(BlockBackend *blk,
                          BlockCompletionFunc *cb, void *opaque)
 {
-    if (!blk_is_available(blk)) {
-        return abort_aio_request(blk, cb, opaque, -ENOMEDIUM);
-    }
-
    return bdrv_aio_flush(blk->bs, cb, opaque);
 }

@@ -776,20 +666,12 @@ int blk_aio_multiwrite(BlockBackend *blk, BlockRequest *reqs, int num_reqs)

 int blk_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_ioctl(blk->bs, req, buf);
 }

 BlockAIOCB *blk_aio_ioctl(BlockBackend *blk, unsigned long int req, void *buf,
                          BlockCompletionFunc *cb, void *opaque)
 {
-    if (!blk_is_available(blk)) {
-        return abort_aio_request(blk, cb, opaque, -ENOMEDIUM);
-    }
-
    return bdrv_aio_ioctl(blk->bs, req, buf, cb, opaque);
 }

@@ -805,19 +687,11 @@ int blk_co_discard(BlockBackend *blk, int64_t sector_num, int nb_sectors)

 int blk_co_flush(BlockBackend *blk)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_co_flush(blk->bs);
 }

 int blk_flush(BlockBackend *blk)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_flush(blk->bs);
 }

@@ -828,188 +702,84 @@ int blk_flush_all(void)

 void blk_drain(BlockBackend *blk)
 {
-    if (blk->bs) {
    bdrv_drain(blk->bs);
 }
-}

 void blk_drain_all(void)
 {
    bdrv_drain_all();
 }

-void blk_set_on_error(BlockBackend *blk, BlockdevOnError on_read_error,
-                      BlockdevOnError on_write_error)
-{
-    blk->on_read_error = on_read_error;
-    blk->on_write_error = on_write_error;
-}
-
 BlockdevOnError blk_get_on_error(BlockBackend *blk, bool is_read)
 {
-    return is_read ? blk->on_read_error : blk->on_write_error;
+    return bdrv_get_on_error(blk->bs, is_read);
 }

 BlockErrorAction blk_get_error_action(BlockBackend *blk, bool is_read,
                                      int error)
 {
-    BlockdevOnError on_err = blk_get_on_error(blk, is_read);
-
-    switch (on_err) {
-    case BLOCKDEV_ON_ERROR_ENOSPC:
-        return (error == ENOSPC) ?
-               BLOCK_ERROR_ACTION_STOP : BLOCK_ERROR_ACTION_REPORT;
-    case BLOCKDEV_ON_ERROR_STOP:
-        return BLOCK_ERROR_ACTION_STOP;
-    case BLOCKDEV_ON_ERROR_REPORT:
-        return BLOCK_ERROR_ACTION_REPORT;
-    case BLOCKDEV_ON_ERROR_IGNORE:
-        return BLOCK_ERROR_ACTION_IGNORE;
-    default:
-        abort();
-    }
+    return bdrv_get_error_action(blk->bs, is_read, error);
 }

-static void send_qmp_error_event(BlockBackend *blk,
-                                 BlockErrorAction action,
-                                 bool is_read, int error)
-{
-    IoOperationType optype;
-
-    optype = is_read ? IO_OPERATION_TYPE_READ : IO_OPERATION_TYPE_WRITE;
-    qapi_event_send_block_io_error(blk_name(blk), optype, action,
-                                   blk_iostatus_is_enabled(blk),
-                                   error == ENOSPC, strerror(error),
-                                   &error_abort);
-}
-
-/* This is done by device models because, while the block layer knows
- * about the error, it does not know whether an operation comes from
- * the device or the block layer (from a job, for example).
- */
 void blk_error_action(BlockBackend *blk, BlockErrorAction action,
                      bool is_read, int error)
 {
-    assert(error >= 0);
-
-    if (action == BLOCK_ERROR_ACTION_STOP) {
-        /* First set the iostatus, so that "info block" returns an iostatus
-         * that matches the events raised so far (an additional error iostatus
-         * is fine, but not a lost one).
-         */
-        blk_iostatus_set_err(blk, error);
-
-        /* Then raise the request to stop the VM and the event.
-         * qemu_system_vmstop_request_prepare has two effects.  First,
-         * it ensures that the STOP event always comes after the
-         * BLOCK_IO_ERROR event.  Second, it ensures that even if management
-         * can observe the STOP event and do a "cont" before the STOP
-         * event is issued, the VM will not stop.  In this case, vm_start()
-         * also ensures that the STOP/RESUME pair of events is emitted.
-         */
-        qemu_system_vmstop_request_prepare();
-        send_qmp_error_event(blk, action, is_read, error);
-        qemu_system_vmstop_request(RUN_STATE_IO_ERROR);
-    } else {
-        send_qmp_error_event(blk, action, is_read, error);
-    }
+    bdrv_error_action(blk->bs, action, is_read, error);
 }

 int blk_is_read_only(BlockBackend *blk)
 {
-    if (blk->bs) {
    return bdrv_is_read_only(blk->bs);
-    } else {
-        return blk->root_state.read_only;
-    }
 }

 int blk_is_sg(BlockBackend *blk)
 {
-    if (!blk->bs) {
-        return 0;
-    }
-
    return bdrv_is_sg(blk->bs);
 }

 int blk_enable_write_cache(BlockBackend *blk)
 {
-    if (blk->bs) {
    return bdrv_enable_write_cache(blk->bs);
-    } else {
-        return !!(blk->root_state.open_flags & BDRV_O_CACHE_WB);
-    }
 }

 void blk_set_enable_write_cache(BlockBackend *blk, bool wce)
 {
-    if (blk->bs) {
    bdrv_set_enable_write_cache(blk->bs, wce);
-    } else {
-        if (wce) {
-            blk->root_state.open_flags |= BDRV_O_CACHE_WB;
-        } else {
-            blk->root_state.open_flags &= ~BDRV_O_CACHE_WB;
-        }
-    }
 }

 void blk_invalidate_cache(BlockBackend *blk, Error **errp)
 {
-    if (!blk->bs) {
-        error_setg(errp, "Device '%s' has no medium", blk->name);
-        return;
-    }
-
    bdrv_invalidate_cache(blk->bs, errp);
 }

-bool blk_is_inserted(BlockBackend *blk)
+int blk_is_inserted(BlockBackend *blk)
 {
-    return blk->bs && bdrv_is_inserted(blk->bs);
-}
-
-bool blk_is_available(BlockBackend *blk)
-{
-    return blk_is_inserted(blk) && !blk_dev_is_tray_open(blk);
+    return bdrv_is_inserted(blk->bs);
 }

 void blk_lock_medium(BlockBackend *blk, bool locked)
 {
-    if (blk->bs) {
    bdrv_lock_medium(blk->bs, locked);
 }
-}

 void blk_eject(BlockBackend *blk, bool eject_flag)
 {
-    if (blk->bs) {
    bdrv_eject(blk->bs, eject_flag);
 }
-}

 int blk_get_flags(BlockBackend *blk)
 {
-    if (blk->bs) {
    return bdrv_get_flags(blk->bs);
-    } else {
-        return blk->root_state.open_flags;
-    }
 }

 int blk_get_max_transfer_length(BlockBackend *blk)
 {
-    if (blk->bs) {
    return blk->bs->bl.max_transfer_length;
-    } else {
-        return 0;
-    }
 }

 void blk_set_guest_block_size(BlockBackend *blk, int align)
 {
-    blk->guest_block_size = align;
+    bdrv_set_guest_block_size(blk->bs, align);
 }

 void *blk_blockalign(BlockBackend *blk, size_t size)
@@ -1019,65 +789,41 @@ void *blk_blockalign(BlockBackend *blk, size_t size)

 bool blk_op_is_blocked(BlockBackend *blk, BlockOpType op, Error **errp)
 {
-    if (!blk->bs) {
-        return false;
-    }
-
    return bdrv_op_is_blocked(blk->bs, op, errp);
 }

 void blk_op_unblock(BlockBackend *blk, BlockOpType op, Error *reason)
 {
-    if (blk->bs) {
    bdrv_op_unblock(blk->bs, op, reason);
 }
-}

 void blk_op_block_all(BlockBackend *blk, Error *reason)
 {
-    if (blk->bs) {
    bdrv_op_block_all(blk->bs, reason);
 }
-}

 void blk_op_unblock_all(BlockBackend *blk, Error *reason)
 {
-    if (blk->bs) {
    bdrv_op_unblock_all(blk->bs, reason);
 }
-}

 AioContext *blk_get_aio_context(BlockBackend *blk)
 {
-    if (blk->bs) {
    return bdrv_get_aio_context(blk->bs);
-    } else {
-        return qemu_get_aio_context();
-    }
-}
-
-static AioContext *blk_aiocb_get_aio_context(BlockAIOCB *acb)
-{
-    BlockBackendAIOCB *blk_acb = DO_UPCAST(BlockBackendAIOCB, common, acb);
-    return blk_get_aio_context(blk_acb->blk);
 }

 void blk_set_aio_context(BlockBackend *blk, AioContext *new_context)
 {
-    if (blk->bs) {
    bdrv_set_aio_context(blk->bs, new_context);
 }
-}

 void blk_add_aio_context_notifier(BlockBackend *blk,
        void (*attached_aio_context)(AioContext *new_context, void *opaque),
        void (*detach_aio_context)(void *opaque), void *opaque)
 {
-    if (blk->bs) {
    bdrv_add_aio_context_notifier(blk->bs, attached_aio_context,
                                  detach_aio_context, opaque);
 }
-}

 void blk_remove_aio_context_notifier(BlockBackend *blk,
                                     void (*attached_aio_context)(AioContext *,
@@ -1085,36 +831,28 @@ void blk_remove_aio_context_notifier(BlockBackend *blk,
                                     void (*detach_aio_context)(void *),
                                     void *opaque)
 {
-    if (blk->bs) {
    bdrv_remove_aio_context_notifier(blk->bs, attached_aio_context,
                                     detach_aio_context, opaque);
 }
-}

 void blk_add_close_notifier(BlockBackend *blk, Notifier *notify)
 {
-    if (blk->bs) {
    bdrv_add_close_notifier(blk->bs, notify);
 }
-}

 void blk_io_plug(BlockBackend *blk)
 {
-    if (blk->bs) {
    bdrv_io_plug(blk->bs);
 }
-}

 void blk_io_unplug(BlockBackend *blk)
 {
-    if (blk->bs) {
    bdrv_io_unplug(blk->bs);
 }
-}

 BlockAcctStats *blk_get_stats(BlockBackend *blk)
 {
-    return &blk->stats;
+    return bdrv_get_stats(blk->bs);
 }

 void *blk_aio_get(const AIOCBInfo *aiocb_info, BlockBackend *blk,
@@ -1147,10 +885,6 @@ int blk_write_compressed(BlockBackend *blk, int64_t sector_num,

 int blk_truncate(BlockBackend *blk, int64_t offset)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_truncate(blk->bs, offset);
 }

@@ -1167,67 +901,20 @@ int blk_discard(BlockBackend *blk, int64_t sector_num, int nb_sectors)
 int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
                     int64_t pos, int size)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_save_vmstate(blk->bs, buf, pos, size);
 }

 int blk_load_vmstate(BlockBackend *blk, uint8_t *buf, int64_t pos, int size)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_load_vmstate(blk->bs, buf, pos, size);
 }

 int blk_probe_blocksizes(BlockBackend *blk, BlockSizes *bsz)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_probe_blocksizes(blk->bs, bsz);
 }

 int blk_probe_geometry(BlockBackend *blk, HDGeometry *geo)
 {
-    if (!blk_is_available(blk)) {
-        return -ENOMEDIUM;
-    }
-
    return bdrv_probe_geometry(blk->bs, geo);
 }
-
-/*
- * Updates the BlockBackendRootState object with data from the currently
- * attached BlockDriverState.
- */
-void blk_update_root_state(BlockBackend *blk)
-{
-    assert(blk->bs);
-
-    blk->root_state.open_flags    = blk->bs->open_flags;
-    blk->root_state.read_only     = blk->bs->read_only;
-    blk->root_state.detect_zeroes = blk->bs->detect_zeroes;
-
-    if (blk->root_state.throttle_group) {
-        g_free(blk->root_state.throttle_group);
-        throttle_group_unref(blk->root_state.throttle_state);
-    }
-    if (blk->bs->throttle_state) {
-        const char *name = throttle_group_get_name(blk->bs);
-        blk->root_state.throttle_group = g_strdup(name);
-        blk->root_state.throttle_state = throttle_group_incref(name);
-    } else {
-        blk->root_state.throttle_group = NULL;
-        blk->root_state.throttle_state = NULL;
-    }
-}
-
-BlockBackendRootState *blk_get_root_state(BlockBackend *blk)
-{
-    return &blk->root_state;
-}
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -103,7 +103,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,

    bs->read_only = 1; // no write support yet

-    ret = bdrv_pread(bs->file->bs, 0, &bochs, sizeof(bochs));
+    ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
    if (ret < 0) {
        return ret;
    }
@@ -137,7 +137,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
        return -ENOMEM;
    }

-    ret = bdrv_pread(bs->file->bs, le32_to_cpu(bochs.header), s->catalog_bitmap,
+    ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
                     s->catalog_size * 4);
    if (ret < 0) {
        goto fail;
@@ -206,7 +206,7 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
        (s->extent_blocks + s->bitmap_blocks));

    /* read in bitmap for current extent */
-    ret = bdrv_pread(bs->file->bs, bitmap_offset + (extent_offset / 8),
+    ret = bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
                     &bitmap_entry, 1);
    if (ret < 0) {
        return ret;
@@ -229,7 +229,7 @@ static int bochs_read(BlockDriverState *bs, int64_t sector_num,
        if (block_offset < 0) {
            return block_offset;
        } else if (block_offset > 0) {
-            ret = bdrv_pread(bs->file->bs, block_offset, buf, 512);
+            ret = bdrv_pread(bs->file, block_offset, buf, 512);
            if (ret < 0) {
                return ret;
            }
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -66,7 +66,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
    bs->read_only = 1;

    /* read header */
-    ret = bdrv_pread(bs->file->bs, 128, &s->block_size, 4);
+    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
    if (ret < 0) {
        return ret;
    }
@@ -92,7 +92,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
        return -EINVAL;
    }

-    ret = bdrv_pread(bs->file->bs, 128 + 4, &s->n_blocks, 4);
+    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
    if (ret < 0) {
        return ret;
    }
@@ -123,7 +123,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
        return -ENOMEM;
    }

-    ret = bdrv_pread(bs->file->bs, 128 + 4 + 4, s->offsets, offsets_size);
+    ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);
    if (ret < 0) {
        goto fail;
    }
@@ -203,8 +203,8 @@ static inline int cloop_read_block(BlockDriverState *bs, int block_num)
        int ret;
        uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];

-        ret = bdrv_pread(bs->file->bs, s->offsets[block_num],
-                         s->compressed_block, bytes);
+        ret = bdrv_pread(bs->file, s->offsets[block_num], s->compressed_block,
+                         bytes);
        if (ret != bytes) {
            return -1;
        }
--- a/block/commit.c
+++ b/block/commit.c
@@ -17,7 +17,6 @@
 #include "block/blockjob.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
-#include "sysemu/block-backend.h"

 enum {
    /*
@@ -214,7 +213,7 @@ void commit_start(BlockDriverState *bs, BlockDriverState *base,

    if ((on_error == BLOCKDEV_ON_ERROR_STOP ||
         on_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        (!bs->blk || !blk_iostatus_is_enabled(bs->blk))) {
+        !bdrv_iostatus_is_enabled(bs)) {
        error_setg(errp, "Invalid parameter combination");
        return;
    }
@@ -237,11 +236,11 @@ void commit_start(BlockDriverState *bs, BlockDriverState *base,

    /* convert base & overlay_bs to r/w, if necessary */
    if (!(orig_base_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, base, NULL,
+        reopen_queue = bdrv_reopen_queue(reopen_queue, base,
                                         orig_base_flags | BDRV_O_RDWR);
    }
    if (!(orig_overlay_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, overlay_bs, NULL,
+        reopen_queue = bdrv_reopen_queue(reopen_queue, overlay_bs,
                                         orig_overlay_flags | BDRV_O_RDWR);
    }
    if (reopen_queue) {
--- a/block/curl.c
+++ b/block/curl.c
@@ -154,20 +154,18 @@ static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, fd);
    switch (action) {
        case CURL_POLL_IN:
-            aio_set_fd_handler(s->aio_context, fd, false,
-                               curl_multi_read, NULL, state);
+            aio_set_fd_handler(s->aio_context, fd, curl_multi_read,
+                               NULL, state);
            break;
        case CURL_POLL_OUT:
-            aio_set_fd_handler(s->aio_context, fd, false,
-                               NULL, curl_multi_do, state);
+            aio_set_fd_handler(s->aio_context, fd, NULL, curl_multi_do, state);
            break;
        case CURL_POLL_INOUT:
-            aio_set_fd_handler(s->aio_context, fd, false,
-                               curl_multi_read, curl_multi_do, state);
+            aio_set_fd_handler(s->aio_context, fd, curl_multi_read,
+                               curl_multi_do, state);
            break;
        case CURL_POLL_REMOVE:
-            aio_set_fd_handler(s->aio_context, fd, false,
-                               NULL, NULL, NULL);
+            aio_set_fd_handler(s->aio_context, fd, NULL, NULL, NULL);
            break;
    }

--- a/block/dmg.c
+++ b/block/dmg.c
@@ -85,7 +85,7 @@ static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)
    uint64_t buffer;
    int ret;

-    ret = bdrv_pread(bs->file->bs, offset, &buffer, 8);
+    ret = bdrv_pread(bs->file, offset, &buffer, 8);
    if (ret < 0) {
        return ret;
    }
@@ -99,7 +99,7 @@ static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)
    uint32_t buffer;
    int ret;

-    ret = bdrv_pread(bs->file->bs, offset, &buffer, 4);
+    ret = bdrv_pread(bs->file, offset, &buffer, 4);
    if (ret < 0) {
        return ret;
    }
@@ -354,7 +354,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds,
        offset += 4;

        buffer = g_realloc(buffer, count);
-        ret = bdrv_pread(bs->file->bs, offset, buffer, count);
+        ret = bdrv_pread(bs->file, offset, buffer, count);
        if (ret < 0) {
            goto fail;
        }
@@ -391,7 +391,7 @@ static int dmg_read_plist_xml(BlockDriverState *bs, DmgHeaderState *ds,

    buffer = g_malloc(info_length + 1);
    buffer[info_length] = '\0';
-    ret = bdrv_pread(bs->file->bs, info_begin, buffer, info_length);
+    ret = bdrv_pread(bs->file, info_begin, buffer, info_length);
    if (ret != info_length) {
        ret = -EINVAL;
        goto fail;
@@ -446,7 +446,7 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
    ds.max_sectors_per_chunk = 1;

    /* locate the UDIF trailer */
-    offset = dmg_find_koly_offset(bs->file->bs, errp);
+    offset = dmg_find_koly_offset(bs->file, errp);
    if (offset < 0) {
        ret = offset;
        goto fail;
@@ -514,9 +514,9 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
    }

    /* initialize zlib engine */
-    s->compressed_chunk = qemu_try_blockalign(bs->file->bs,
+    s->compressed_chunk = qemu_try_blockalign(bs->file,
                                              ds.max_compressed_size + 1);
-    s->uncompressed_chunk = qemu_try_blockalign(bs->file->bs,
+    s->uncompressed_chunk = qemu_try_blockalign(bs->file,
                                                512 * ds.max_sectors_per_chunk);
    if (s->compressed_chunk == NULL || s->uncompressed_chunk == NULL) {
        ret = -ENOMEM;
@@ -592,7 +592,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
        case 0x80000005: { /* zlib compressed */
            /* we need to buffer, because only the chunk as whole can be
             * inflated. */
-            ret = bdrv_pread(bs->file->bs, s->offsets[chunk],
+            ret = bdrv_pread(bs->file, s->offsets[chunk],
                             s->compressed_chunk, s->lengths[chunk]);
            if (ret != s->lengths[chunk]) {
                return -1;
@@ -616,7 +616,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
        case 0x80000006: /* bzip2 compressed */
            /* we need to buffer, because only the chunk as whole can be
             * inflated. */
-            ret = bdrv_pread(bs->file->bs, s->offsets[chunk],
+            ret = bdrv_pread(bs->file, s->offsets[chunk],
                             s->compressed_chunk, s->lengths[chunk]);
            if (ret != s->lengths[chunk]) {
                return -1;
@@ -641,7 +641,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
            break;
 #endif /* CONFIG_BZIP2 */
        case 1: /* copy */
-            ret = bdrv_pread(bs->file->bs, s->offsets[chunk],
+            ret = bdrv_pread(bs->file, s->offsets[chunk],
                             s->uncompressed_chunk, s->lengths[chunk]);
            if (ret != s->lengths[chunk]) {
                return -1;
--- a/block/io.c
+++ b/block/io.c
@@ -23,7 +23,6 @@
 */

 #include "trace.h"
-#include "sysemu/block-backend.h"
 #include "block/blockjob.h"
 #include "block/block_int.h"
 #include "block/throttle-groups.h"
@@ -157,38 +156,38 @@ void bdrv_refresh_limits(BlockDriverState *bs, Error **errp)

    /* Take some limits from the children as a default */
    if (bs->file) {
-        bdrv_refresh_limits(bs->file->bs, &local_err);
+        bdrv_refresh_limits(bs->file, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
-        bs->bl.opt_transfer_length = bs->file->bs->bl.opt_transfer_length;
-        bs->bl.max_transfer_length = bs->file->bs->bl.max_transfer_length;
-        bs->bl.min_mem_alignment = bs->file->bs->bl.min_mem_alignment;
-        bs->bl.opt_mem_alignment = bs->file->bs->bl.opt_mem_alignment;
+        bs->bl.opt_transfer_length = bs->file->bl.opt_transfer_length;
+        bs->bl.max_transfer_length = bs->file->bl.max_transfer_length;
+        bs->bl.min_mem_alignment = bs->file->bl.min_mem_alignment;
+        bs->bl.opt_mem_alignment = bs->file->bl.opt_mem_alignment;
    } else {
        bs->bl.min_mem_alignment = 512;
        bs->bl.opt_mem_alignment = getpagesize();
    }

-    if (bs->backing) {
-        bdrv_refresh_limits(bs->backing->bs, &local_err);
+    if (bs->backing_hd) {
+        bdrv_refresh_limits(bs->backing_hd, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
        bs->bl.opt_transfer_length =
            MAX(bs->bl.opt_transfer_length,
-                bs->backing->bs->bl.opt_transfer_length);
+                bs->backing_hd->bl.opt_transfer_length);
        bs->bl.max_transfer_length =
            MIN_NON_ZERO(bs->bl.max_transfer_length,
-                         bs->backing->bs->bl.max_transfer_length);
+                         bs->backing_hd->bl.max_transfer_length);
        bs->bl.opt_mem_alignment =
            MAX(bs->bl.opt_mem_alignment,
-                bs->backing->bs->bl.opt_mem_alignment);
+                bs->backing_hd->bl.opt_mem_alignment);
        bs->bl.min_mem_alignment =
            MAX(bs->bl.min_mem_alignment,
-                bs->backing->bs->bl.min_mem_alignment);
+                bs->backing_hd->bl.min_mem_alignment);
    }

    /* Then let the driver override it */
@@ -214,10 +213,8 @@ void bdrv_disable_copy_on_read(BlockDriverState *bs)
 }

 /* Check if any requests are in-flight (including throttled requests) */
-bool bdrv_requests_pending(BlockDriverState *bs)
+static bool bdrv_requests_pending(BlockDriverState *bs)
 {
-    BdrvChild *child;
-
    if (!QLIST_EMPTY(&bs->tracked_requests)) {
        return true;
    }
@@ -227,13 +224,12 @@ bool bdrv_requests_pending(BlockDriverState *bs)
    if (!qemu_co_queue_empty(&bs->throttled_reqs[1])) {
        return true;
    }
-
-    QLIST_FOREACH(child, &bs->children, next) {
-        if (bdrv_requests_pending(child->bs)) {
+    if (bs->file && bdrv_requests_pending(bs->file)) {
        return true;
    }
+    if (bs->backing_hd && bdrv_requests_pending(bs->backing_hd)) {
+        return true;
    }
-
    return false;
 }

@@ -936,8 +932,7 @@ static int coroutine_fn bdrv_co_do_preadv(BlockDriverState *bs,
        return ret;
    }

-    /* Don't do copy-on-read if we read data before write operation */
-    if (bs->copy_on_read && !(flags & BDRV_REQ_NO_COPY_ON_READ)) {
+    if (bs->copy_on_read) {
        flags |= BDRV_REQ_COPY_ON_READ;
    }

@@ -1006,15 +1001,6 @@ int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,
    return bdrv_co_do_readv(bs, sector_num, nb_sectors, qiov, 0);
 }

-int coroutine_fn bdrv_co_no_copy_on_readv(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors, QEMUIOVector *qiov)
-{
-    trace_bdrv_co_no_copy_on_readv(bs, sector_num, nb_sectors);
-
-    return bdrv_co_do_readv(bs, sector_num, nb_sectors, qiov,
-                            BDRV_REQ_NO_COPY_ON_READ);
-}
-
 int coroutine_fn bdrv_co_copy_on_readv(BlockDriverState *bs,
    int64_t sector_num, int nb_sectors, QEMUIOVector *qiov)
 {
@@ -1141,13 +1127,13 @@ static int coroutine_fn bdrv_aligned_pwritev(BlockDriverState *bs,
    if (ret < 0) {
        /* Do nothing, write notifier decided to fail this request */
    } else if (flags & BDRV_REQ_ZERO_WRITE) {
-        bdrv_debug_event(bs, BLKDBG_PWRITEV_ZERO);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_ZERO);
        ret = bdrv_co_do_write_zeroes(bs, sector_num, nb_sectors, flags);
    } else {
-        bdrv_debug_event(bs, BLKDBG_PWRITEV);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV);
        ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov);
    }
-    bdrv_debug_event(bs, BLKDBG_PWRITEV_DONE);
+    BLKDBG_EVENT(bs, BLKDBG_PWRITEV_DONE);

    if (ret == 0 && !bs->enable_write_cache) {
        ret = bdrv_co_flush(bs);
@@ -1155,9 +1141,7 @@ static int coroutine_fn bdrv_aligned_pwritev(BlockDriverState *bs,

    bdrv_set_dirty(bs, sector_num, nb_sectors);

-    if (bs->wr_highest_offset < offset + bytes) {
-        bs->wr_highest_offset = offset + bytes;
-    }
+    block_acct_highest_sector(&bs->stats, sector_num, nb_sectors);

    if (ret >= 0) {
        bs->total_sectors = MAX(bs->total_sectors, sector_num + nb_sectors);
@@ -1198,13 +1182,13 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BlockDriverState *bs,
        /* RMW the unaligned part before head. */
        mark_request_serialising(req, align);
        wait_serialising_requests(req);
-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_HEAD);
        ret = bdrv_aligned_preadv(bs, req, offset & ~(align - 1), align,
                                  align, &local_qiov, 0);
        if (ret < 0) {
            goto fail;
        }
-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);

        memset(buf + head_padding_bytes, 0, zero_bytes);
        ret = bdrv_aligned_pwritev(bs, req, offset & ~(align - 1), align,
@@ -1236,13 +1220,13 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BlockDriverState *bs,
        /* RMW the unaligned part after tail. */
        mark_request_serialising(req, align);
        wait_serialising_requests(req);
-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_TAIL);
        ret = bdrv_aligned_preadv(bs, req, offset, align,
                                  align, &local_qiov, 0);
        if (ret < 0) {
            goto fail;
        }
-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);

        memset(buf, 0, bytes);
        ret = bdrv_aligned_pwritev(bs, req, offset, align,
@@ -1313,13 +1297,13 @@ static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
        };
        qemu_iovec_init_external(&head_qiov, &head_iov, 1);

-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_HEAD);
        ret = bdrv_aligned_preadv(bs, &req, offset & ~(align - 1), align,
                                  align, &head_qiov, 0);
        if (ret < 0) {
            goto fail;
        }
-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);

        qemu_iovec_init(&local_qiov, qiov->niov + 2);
        qemu_iovec_add(&local_qiov, head_buf, offset & (align - 1));
@@ -1347,13 +1331,13 @@ static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
        };
        qemu_iovec_init_external(&tail_qiov, &tail_iov, 1);

-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_TAIL);
        ret = bdrv_aligned_preadv(bs, &req, (offset + bytes) & ~(align - 1), align,
                                  align, &tail_qiov, 0);
        if (ret < 0) {
            goto fail;
        }
-        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);

        if (!use_local_qiov) {
            qemu_iovec_init(&local_qiov, qiov->niov + 1);
@@ -1502,7 +1486,7 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,

    if (ret & BDRV_BLOCK_RAW) {
        assert(ret & BDRV_BLOCK_OFFSET_VALID);
-        return bdrv_get_block_status(bs->file->bs, ret >> BDRV_SECTOR_BITS,
+        return bdrv_get_block_status(bs->file, ret >> BDRV_SECTOR_BITS,
                                     *pnum, pnum);
    }

@@ -1511,8 +1495,8 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,
    } else {
        if (bdrv_unallocated_blocks_are_zero(bs)) {
            ret |= BDRV_BLOCK_ZERO;
-        } else if (bs->backing) {
-            BlockDriverState *bs2 = bs->backing->bs;
+        } else if (bs->backing_hd) {
+            BlockDriverState *bs2 = bs->backing_hd;
            int64_t nb_sectors2 = bdrv_nb_sectors(bs2);
            if (nb_sectors2 >= 0 && sector_num >= nb_sectors2) {
                ret |= BDRV_BLOCK_ZERO;
@@ -1525,7 +1509,7 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,
        (ret & BDRV_BLOCK_OFFSET_VALID)) {
        int file_pnum;

-        ret2 = bdrv_co_get_block_status(bs->file->bs, ret >> BDRV_SECTOR_BITS,
+        ret2 = bdrv_co_get_block_status(bs->file, ret >> BDRV_SECTOR_BITS,
                                        *pnum, &file_pnum);
        if (ret2 >= 0) {
            /* Ignore errors.  This is just providing extra information, it
@@ -1557,7 +1541,7 @@ static int64_t coroutine_fn bdrv_co_get_block_status_above(BlockDriverState *bs,
    int64_t ret = 0;

    assert(bs != base);
-    for (p = bs; p != base; p = backing_bs(p)) {
+    for (p = bs; p != base; p = p->backing_hd) {
        ret = bdrv_co_get_block_status(p, sector_num, nb_sectors, pnum);
        if (ret < 0 || ret & BDRV_BLOCK_ALLOCATED) {
            break;
@@ -1620,7 +1604,7 @@ int64_t bdrv_get_block_status(BlockDriverState *bs,
                              int64_t sector_num,
                              int nb_sectors, int *pnum)
 {
-    return bdrv_get_block_status_above(bs, backing_bs(bs),
+    return bdrv_get_block_status_above(bs, bs->backing_hd,
                                       sector_num, nb_sectors, pnum);
 }

@@ -1678,7 +1662,7 @@ int bdrv_is_allocated_above(BlockDriverState *top,
            n = pnum_inter;
        }

-        intermediate = backing_bs(intermediate);
+        intermediate = intermediate->backing_hd;
    }

    *pnum = n;
@@ -1729,7 +1713,7 @@ int bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
    } else if (drv->bdrv_save_vmstate) {
        return drv->bdrv_save_vmstate(bs, qiov, pos);
    } else if (bs->file) {
-        return bdrv_writev_vmstate(bs->file->bs, qiov, pos);
+        return bdrv_writev_vmstate(bs->file, qiov, pos);
    }

    return -ENOTSUP;
@@ -1744,7 +1728,7 @@ int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
    if (drv->bdrv_load_vmstate)
        return drv->bdrv_load_vmstate(bs, buf, pos, size);
    if (bs->file)
-        return bdrv_load_vmstate(bs->file->bs, buf, pos, size);
+        return bdrv_load_vmstate(bs->file, buf, pos, size);
    return -ENOTSUP;
 }

@@ -1909,10 +1893,7 @@ static int multiwrite_merge(BlockDriverState *bs, BlockRequest *reqs,
        }
    }

-    if (bs->blk) {
-        block_acct_merge_done(blk_get_stats(bs->blk), BLOCK_ACCT_WRITE,
-                              num_reqs - outidx - 1);
-    }
+    block_acct_merge_done(&bs->stats, BLOCK_ACCT_WRITE, num_reqs - outidx - 1);

    return outidx + 1;
 }
@@ -2227,7 +2208,7 @@ void *qemu_aio_get(const AIOCBInfo *aiocb_info, BlockDriverState *bs,
 {
    BlockAIOCB *acb;

-    acb = g_malloc(aiocb_info->aiocb_size);
+    acb = g_slice_alloc(aiocb_info->aiocb_size);
    acb->aiocb_info = aiocb_info;
    acb->bs = bs;
    acb->cb = cb;
@@ -2247,7 +2228,7 @@ void qemu_aio_unref(void *p)
    BlockAIOCB *acb = p;
    assert(acb->refcnt > 0);
    if (--acb->refcnt == 0) {
-        g_free(acb);
+        g_slice_free1(acb->aiocb_info->aiocb_size, acb);
    }
 }

@@ -2375,7 +2356,7 @@ int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
     * in the case of cache=unsafe, so there are no useless flushes.
     */
 flush_parent:
-    return bs->file ? bdrv_co_flush(bs->file->bs) : 0;
+    return bdrv_co_flush(bs->file);
 }

 int bdrv_flush(BlockDriverState *bs)
@@ -2603,7 +2584,7 @@ void bdrv_io_plug(BlockDriverState *bs)
    if (drv && drv->bdrv_io_plug) {
        drv->bdrv_io_plug(bs);
    } else if (bs->file) {
-        bdrv_io_plug(bs->file->bs);
+        bdrv_io_plug(bs->file);
    }
 }

@@ -2613,7 +2594,7 @@ void bdrv_io_unplug(BlockDriverState *bs)
    if (drv && drv->bdrv_io_unplug) {
        drv->bdrv_io_unplug(bs);
    } else if (bs->file) {
-        bdrv_io_unplug(bs->file->bs);
+        bdrv_io_unplug(bs->file);
    }
 }

@@ -2623,24 +2604,7 @@ void bdrv_flush_io_queue(BlockDriverState *bs)
    if (drv && drv->bdrv_flush_io_queue) {
        drv->bdrv_flush_io_queue(bs);
    } else if (bs->file) {
-        bdrv_flush_io_queue(bs->file->bs);
+        bdrv_flush_io_queue(bs->file);
    }
    bdrv_start_throttled_reqs(bs);
 }
-
-void bdrv_drained_begin(BlockDriverState *bs)
-{
-    if (!bs->quiesce_counter++) {
-        aio_disable_external(bdrv_get_aio_context(bs));
-    }
-    bdrv_drain(bs);
-}
-
-void bdrv_drained_end(BlockDriverState *bs)
-{
-    assert(bs->quiesce_counter > 0);
-    if (--bs->quiesce_counter > 0) {
-        return;
-    }
-    aio_enable_external(bdrv_get_aio_context(bs));
-}
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -291,8 +291,8 @@ iscsi_set_events(IscsiLun *iscsilun)
    int ev = iscsi_which_events(iscsi);

    if (ev != iscsilun->events) {
-        aio_set_fd_handler(iscsilun->aio_context, iscsi_get_fd(iscsi),
-                           false,
+        aio_set_fd_handler(iscsilun->aio_context,
+                           iscsi_get_fd(iscsi),
                           (ev & POLLIN) ? iscsi_process_read : NULL,
                           (ev & POLLOUT) ? iscsi_process_write : NULL,
                           iscsilun);
@@ -1214,10 +1214,6 @@ static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)

    if (task == NULL || task->status != SCSI_STATUS_GOOD) {
        error_setg(errp, "iSCSI: failed to send readcapacity10 command.");
-    } else if (!iscsilun->block_size ||
-               iscsilun->block_size % BDRV_SECTOR_SIZE) {
-        error_setg(errp, "iSCSI: the target returned an invalid "
-                   "block size of %d.", iscsilun->block_size);
    }
    if (task) {
        scsi_free_scsi_task(task);
@@ -1280,8 +1276,9 @@ static void iscsi_detach_aio_context(BlockDriverState *bs)
 {
    IscsiLun *iscsilun = bs->opaque;

-    aio_set_fd_handler(iscsilun->aio_context, iscsi_get_fd(iscsilun->iscsi),
-                       false, NULL, NULL, NULL);
+    aio_set_fd_handler(iscsilun->aio_context,
+                       iscsi_get_fd(iscsilun->iscsi),
+                       NULL, NULL, NULL);
    iscsilun->events = 0;

    if (iscsilun->nop_timer) {
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -287,7 +287,7 @@ void laio_detach_aio_context(void *s_, AioContext *old_context)
 {
    struct qemu_laio_state *s = s_;

-    aio_set_event_notifier(old_context, &s->e, false, NULL);
+    aio_set_event_notifier(old_context, &s->e, NULL);
    qemu_bh_delete(s->completion_bh);
 }

@@ -296,8 +296,7 @@ void laio_attach_aio_context(void *s_, AioContext *new_context)
    struct qemu_laio_state *s = s_;

    s->completion_bh = aio_bh_new(new_context, qemu_laio_completion_bh, s);
-    aio_set_event_notifier(new_context, &s->e, false,
-                           qemu_laio_completion_cb);
+    aio_set_event_notifier(new_context, &s->e, qemu_laio_completion_cb);
 }

 void *laio_init(void)
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -14,7 +14,6 @@
 #include "trace.h"
 #include "block/blockjob.h"
 #include "block/block_int.h"
-#include "sysemu/block-backend.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
 #include "qemu/bitmap.h"
@@ -61,7 +60,6 @@ typedef struct MirrorBlockJob {
    int sectors_in_flight;
    int ret;
    bool unmap;
-    bool waiting_for_io;
 } MirrorBlockJob;

 typedef struct MirrorOp {
@@ -114,9 +112,13 @@ static void mirror_iteration_done(MirrorOp *op, int ret)
    }

    qemu_iovec_destroy(&op->qiov);
-    g_free(op);
+    g_slice_free(MirrorOp, op);

-    if (s->waiting_for_io) {
+    /* Enter coroutine when it is not sleeping.  The coroutine sleeps to
+     * rate-limit itself.  The coroutine will eventually resume since there is
+     * a sleep timeout so don't wake it early.
+     */
+    if (s->common.busy) {
        qemu_coroutine_enter(s->common.co, NULL);
    }
 }
@@ -201,9 +203,7 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
    /* Wait for I/O to this cluster (from a previous iteration) to be done.  */
    while (test_bit(next_chunk, s->in_flight_bitmap)) {
        trace_mirror_yield_in_flight(s, sector_num, s->in_flight);
-        s->waiting_for_io = true;
        qemu_coroutine_yield();
-        s->waiting_for_io = false;
    }

    do {
@@ -239,18 +239,12 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
         */
        while (nb_chunks == 0 && s->buf_free_count < added_chunks) {
            trace_mirror_yield_buf_busy(s, nb_chunks, s->in_flight);
-            s->waiting_for_io = true;
            qemu_coroutine_yield();
-            s->waiting_for_io = false;
        }
        if (s->buf_free_count < nb_chunks + added_chunks) {
            trace_mirror_break_buf_busy(s, nb_chunks, s->in_flight);
            break;
        }
-        if (IOV_MAX < nb_chunks + added_chunks) {
-            trace_mirror_break_iov_max(s, nb_chunks, added_chunks);
-            break;
-        }

        /* We have enough free space to copy these sectors.  */
        bitmap_set(s->in_flight_bitmap, next_chunk, added_chunks);
@@ -265,7 +259,7 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
    } while (delay_ns == 0 && next_sector < end);

    /* Allocate a MirrorOp that is used as an AIO callback.  */
-    op = g_new(MirrorOp, 1);
+    op = g_slice_new(MirrorOp);
    op->s = s;
    op->sector_num = sector_num;
    op->nb_sectors = nb_sectors;
@@ -339,9 +333,7 @@ static void mirror_free_init(MirrorBlockJob *s)
 static void mirror_drain(MirrorBlockJob *s)
 {
    while (s->in_flight > 0) {
-        s->waiting_for_io = true;
        qemu_coroutine_yield();
-        s->waiting_for_io = false;
    }
 }

@@ -354,11 +346,6 @@ static void mirror_exit(BlockJob *job, void *opaque)
    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
    MirrorExitData *data = opaque;
    AioContext *replace_aio_context = NULL;
-    BlockDriverState *src = s->common.bs;
-
-    /* Make sure that the source BDS doesn't go away before we called
-     * block_job_completed(). */
-    bdrv_ref(src);

    if (s->to_replace) {
        replace_aio_context = bdrv_get_aio_context(s->to_replace);
@@ -373,7 +360,14 @@ static void mirror_exit(BlockJob *job, void *opaque)
        if (bdrv_get_flags(s->target) != bdrv_get_flags(to_replace)) {
            bdrv_reopen(s->target, bdrv_get_flags(to_replace), NULL);
        }
-        bdrv_replace_in_backing_chain(to_replace, s->target);
+        bdrv_swap(s->target, to_replace);
+        if (s->common.driver->job_type == BLOCK_JOB_TYPE_COMMIT) {
+            /* drop the bs loop chain formed by the swap: break the loop then
+             * trigger the unref from the top one */
+            BlockDriverState *p = s->base->backing_hd;
+            bdrv_set_backing_hd(s->base, NULL);
+            bdrv_unref(p);
+        }
    }
    if (s->to_replace) {
        bdrv_op_unblock_all(s->to_replace, s->replace_blocker);
@@ -387,7 +381,6 @@ static void mirror_exit(BlockJob *job, void *opaque)
    bdrv_unref(s->target);
    block_job_completed(&s->common, data->ret);
    g_free(data);
-    bdrv_unref(src);
 }

 static void coroutine_fn mirror_run(void *opaque)
@@ -431,7 +424,7 @@ static void coroutine_fn mirror_run(void *opaque)
     */
    bdrv_get_backing_filename(s->target, backing_filename,
                              sizeof(backing_filename));
-    if (backing_filename[0] && !s->target->backing) {
+    if (backing_filename[0] && !s->target->backing_hd) {
        ret = bdrv_get_info(s->target, &bdi);
        if (ret < 0) {
            goto immediate_exit;
@@ -455,8 +448,6 @@ static void coroutine_fn mirror_run(void *opaque)
    if (!s->is_none_mode) {
        /* First part, loop on the sectors and initialize the dirty bitmap.  */
        BlockDriverState *base = s->base;
-        bool mark_all_dirty = s->base == NULL && !bdrv_has_zero_init(s->target);
-
        for (sector_num = 0; sector_num < end; ) {
            /* Just to make sure we are not exceeding int limit. */
            int nb_sectors = MIN(INT_MAX >> BDRV_SECTOR_BITS,
@@ -479,7 +470,7 @@ static void coroutine_fn mirror_run(void *opaque)
            }

            assert(n > 0);
-            if (ret == 1 || mark_all_dirty) {
+            if (ret == 1) {
                bdrv_set_dirty_bitmap(s->dirty_bitmap, sector_num, n);
            }
            sector_num += n;
@@ -515,9 +506,7 @@ static void coroutine_fn mirror_run(void *opaque)
            if (s->in_flight == MAX_IN_FLIGHT || s->buf_free_count == 0 ||
                (cnt == 0 && s->in_flight > 0)) {
                trace_mirror_yield(s, s->in_flight, s->buf_free_count, cnt);
-                s->waiting_for_io = true;
                qemu_coroutine_yield();
-                s->waiting_for_io = false;
                continue;
            } else if (cnt != 0) {
                delay_ns = mirror_iteration(s);
@@ -600,9 +589,7 @@ immediate_exit:
    g_free(s->cow_bitmap);
    g_free(s->in_flight_bitmap);
    bdrv_release_dirty_bitmap(bs, s->dirty_bitmap);
-    if (s->target->blk) {
-        blk_iostatus_disable(s->target->blk);
-    }
+    bdrv_iostatus_disable(s->target);

    data = g_malloc(sizeof(*data));
    data->ret = ret;
@@ -624,9 +611,7 @@ static void mirror_iostatus_reset(BlockJob *job)
 {
    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);

-    if (s->target->blk) {
-        blk_iostatus_reset(s->target->blk);
-    }
+    bdrv_iostatus_reset(s->target);
 }

 static void mirror_complete(BlockJob *job, Error **errp)
@@ -641,7 +626,8 @@ static void mirror_complete(BlockJob *job, Error **errp)
        return;
    }
    if (!s->synced) {
-        error_setg(errp, QERR_BLOCK_JOB_NOT_READY, job->id);
+        error_setg(errp, QERR_BLOCK_JOB_NOT_READY,
+                   bdrv_get_device_name(job->bs));
        return;
    }

@@ -649,9 +635,9 @@ static void mirror_complete(BlockJob *job, Error **errp)
    if (s->replaces) {
        AioContext *replace_aio_context;

-        s->to_replace = bdrv_find_node(s->replaces);
+        s->to_replace = check_to_replace_node(s->replaces, &local_err);
        if (!s->to_replace) {
-            error_setg(errp, "Node name '%s' not found", s->replaces);
+            error_propagate(errp, local_err);
            return;
        }

@@ -709,7 +695,7 @@ static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target,

    if ((on_source_error == BLOCKDEV_ON_ERROR_STOP ||
         on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        (!bs->blk || !blk_iostatus_is_enabled(bs->blk))) {
+        !bdrv_iostatus_is_enabled(bs)) {
        error_setg(errp, QERR_INVALID_PARAMETER, "on-source-error");
        return;
    }
@@ -745,10 +731,8 @@ static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target,
        return;
    }
    bdrv_set_enable_write_cache(s->target, true);
-    if (s->target->blk) {
-        blk_set_on_error(s->target->blk, on_target_error, on_target_error);
-        blk_iostatus_enable(s->target->blk);
-    }
+    bdrv_set_on_error(s->target, on_target_error, on_target_error);
+    bdrv_iostatus_enable(s->target);
    s->common.co = qemu_coroutine_create(mirror_run);
    trace_mirror_start(bs, s, s->common.co, opaque);
    qemu_coroutine_enter(s->common.co, s);
@@ -771,7 +755,7 @@ void mirror_start(BlockDriverState *bs, BlockDriverState *target,
        return;
    }
    is_none_mode = mode == MIRROR_SYNC_MODE_NONE;
-    base = mode == MIRROR_SYNC_MODE_TOP ? backing_bs(bs) : NULL;
+    base = mode == MIRROR_SYNC_MODE_TOP ? bs->backing_hd : NULL;
    mirror_start_job(bs, target, replaces,
                     speed, granularity, buf_size,
                     on_source_error, on_target_error, unmap, cb, opaque, errp,
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -124,7 +124,7 @@ static int nbd_co_send_request(BlockDriverState *bs,
    s->send_coroutine = qemu_coroutine_self();
    aio_context = bdrv_get_aio_context(bs);

-    aio_set_fd_handler(aio_context, s->sock, false,
+    aio_set_fd_handler(aio_context, s->sock,
                       nbd_reply_ready, nbd_restart_write, bs);
    if (qiov) {
        if (!s->is_unix) {
@@ -144,8 +144,7 @@ static int nbd_co_send_request(BlockDriverState *bs,
    } else {
        rc = nbd_send_request(s->sock, request);
    }
-    aio_set_fd_handler(aio_context, s->sock, false,
-                       nbd_reply_ready, NULL, bs);
+    aio_set_fd_handler(aio_context, s->sock, nbd_reply_ready, NULL, bs);
    s->send_coroutine = NULL;
    qemu_co_mutex_unlock(&s->send_mutex);
    return rc;
@@ -349,15 +348,14 @@ int nbd_client_co_discard(BlockDriverState *bs, int64_t sector_num,
 void nbd_client_detach_aio_context(BlockDriverState *bs)
 {
    aio_set_fd_handler(bdrv_get_aio_context(bs),
-                       nbd_get_client_session(bs)->sock,
-                       false, NULL, NULL, NULL);
+                       nbd_get_client_session(bs)->sock, NULL, NULL, NULL);
 }

 void nbd_client_attach_aio_context(BlockDriverState *bs,
                                   AioContext *new_context)
 {
    aio_set_fd_handler(new_context, nbd_get_client_session(bs)->sock,
-                       false, nbd_reply_ready, NULL, bs);
+                       nbd_reply_ready, NULL, bs);
 }

 void nbd_client_close(BlockDriverState *bs)
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -43,6 +43,7 @@

 typedef struct BDRVNBDState {
    NbdClientSession client;
+    QemuOpts *socket_opts;
 } BDRVNBDState;

 static int nbd_parse_uri(const char *filename, QDict *options)
@@ -189,10 +190,10 @@ out:
    g_free(file);
 }

-static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options, char **export,
+static void nbd_config(BDRVNBDState *s, QDict *options, char **export,
                       Error **errp)
 {
-    SocketAddress *saddr;
+    Error *local_err = NULL;

    if (qdict_haskey(options, "path") == qdict_haskey(options, "host")) {
        if (qdict_haskey(options, "path")) {
@@ -200,37 +201,28 @@ static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options, char **export,
        } else {
            error_setg(errp, "one of path and host must be specified.");
        }
-        return NULL;
+        return;
    }

-    saddr = g_new0(SocketAddress, 1);
+    s->client.is_unix = qdict_haskey(options, "path");
+    s->socket_opts = qemu_opts_create(&socket_optslist, NULL, 0,
+                                      &error_abort);

-    if (qdict_haskey(options, "path")) {
-        saddr->type = SOCKET_ADDRESS_KIND_UNIX;
-        saddr->u.q_unix = g_new0(UnixSocketAddress, 1);
-        saddr->u.q_unix->path = g_strdup(qdict_get_str(options, "path"));
-        qdict_del(options, "path");
-    } else {
-        saddr->type = SOCKET_ADDRESS_KIND_INET;
-        saddr->u.inet = g_new0(InetSocketAddress, 1);
-        saddr->u.inet->host = g_strdup(qdict_get_str(options, "host"));
-        if (!qdict_get_try_str(options, "port")) {
-            saddr->u.inet->port = g_strdup_printf("%d", NBD_DEFAULT_PORT);
-        } else {
-            saddr->u.inet->port = g_strdup(qdict_get_str(options, "port"));
-        }
-        qdict_del(options, "host");
-        qdict_del(options, "port");
+    qemu_opts_absorb_qdict(s->socket_opts, options, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
    }

-    s->client.is_unix = saddr->type == SOCKET_ADDRESS_KIND_UNIX;
+    if (!qemu_opt_get(s->socket_opts, "port")) {
+        qemu_opt_set_number(s->socket_opts, "port", NBD_DEFAULT_PORT,
+                            &error_abort);
+    }

    *export = g_strdup(qdict_get_try_str(options, "export"));
    if (*export) {
        qdict_del(options, "export");
    }
-
-    return saddr;
 }

 NbdClientSession *nbd_get_client_session(BlockDriverState *bs)
@@ -239,24 +231,26 @@ NbdClientSession *nbd_get_client_session(BlockDriverState *bs)
    return &s->client;
 }

-static int nbd_establish_connection(BlockDriverState *bs,
-                                    SocketAddress *saddr,
-                                    Error **errp)
+static int nbd_establish_connection(BlockDriverState *bs, Error **errp)
 {
    BDRVNBDState *s = bs->opaque;
    int sock;

-    sock = socket_connect(saddr, errp, NULL, NULL);
+    if (s->client.is_unix) {
+        sock = unix_connect_opts(s->socket_opts, errp, NULL, NULL);
+    } else {
+        sock = inet_connect_opts(s->socket_opts, errp, NULL, NULL);
+        if (sock >= 0) {
+            socket_set_nodelay(sock);
+        }
+    }

+    /* Failed to establish connection */
    if (sock < 0) {
        logout("Failed to establish connection to NBD server\n");
        return -EIO;
    }

-    if (!s->client.is_unix) {
-        socket_set_nodelay(sock);
-    }
-
    return sock;
 }

@@ -266,19 +260,19 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
    BDRVNBDState *s = bs->opaque;
    char *export = NULL;
    int result, sock;
-    SocketAddress *saddr;
+    Error *local_err = NULL;

    /* Pop the config into our state object. Exit if invalid. */
-    saddr = nbd_config(s, options, &export, errp);
-    if (!saddr) {
+    nbd_config(s, options, &export, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
        return -EINVAL;
    }

    /* establish TCP connection, return error if it fails
     * TODO: Configurable retry-until-timeout behaviour.
     */
-    sock = nbd_establish_connection(bs, saddr, errp);
-    qapi_free_SocketAddress(saddr);
+    sock = nbd_establish_connection(bs, errp);
    if (sock < 0) {
        g_free(export);
        return sock;
@@ -321,6 +315,9 @@ static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,

 static void nbd_close(BlockDriverState *bs)
 {
+    BDRVNBDState *s = bs->opaque;
+
+    qemu_opts_del(s->socket_opts);
    nbd_client_close(bs);
 }

--- a/block/nfs.c
+++ b/block/nfs.c
@@ -43,7 +43,6 @@ typedef struct NFSClient {
    int events;
    bool has_zero_init;
    AioContext *aio_context;
-    blkcnt_t st_blocks;
 } NFSClient;

 typedef struct NFSRPC {
@@ -63,10 +62,11 @@ static void nfs_set_events(NFSClient *client)
 {
    int ev = nfs_which_events(client->context);
    if (ev != client->events) {
-        aio_set_fd_handler(client->aio_context, nfs_get_fd(client->context),
-                           false,
+        aio_set_fd_handler(client->aio_context,
+                           nfs_get_fd(client->context),
                           (ev & POLLIN) ? nfs_process_read : NULL,
-                           (ev & POLLOUT) ? nfs_process_write : NULL, client);
+                           (ev & POLLOUT) ? nfs_process_write : NULL,
+                           client);

    }
    client->events = ev;
@@ -241,8 +241,9 @@ static void nfs_detach_aio_context(BlockDriverState *bs)
 {
    NFSClient *client = bs->opaque;

-    aio_set_fd_handler(client->aio_context, nfs_get_fd(client->context),
-                       false, NULL, NULL, NULL);
+    aio_set_fd_handler(client->aio_context,
+                       nfs_get_fd(client->context),
+                       NULL, NULL, NULL);
    client->events = 0;
 }

@@ -261,8 +262,9 @@ static void nfs_client_close(NFSClient *client)
        if (client->fh) {
            nfs_close(client->context, client->fh);
        }
-        aio_set_fd_handler(client->aio_context, nfs_get_fd(client->context),
-                           false, NULL, NULL, NULL);
+        aio_set_fd_handler(client->aio_context,
+                           nfs_get_fd(client->context),
+                           NULL, NULL, NULL);
        nfs_destroy_context(client->context);
    }
    memset(client, 0, sizeof(NFSClient));
@@ -372,7 +374,6 @@ static int64_t nfs_client_open(NFSClient *client, const char *filename,
    }

    ret = DIV_ROUND_UP(st.st_size, BDRV_SECTOR_SIZE);
-    client->st_blocks = st.st_blocks;
    client->has_zero_init = S_ISREG(st.st_mode);
    goto out;
 fail:
@@ -463,11 +464,6 @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
    NFSRPC task = {0};
    struct stat st;

-    if (bdrv_is_read_only(bs) &&
-        !(bs->open_flags & BDRV_O_NOCACHE)) {
-        return client->st_blocks * 512;
-    }
-
    task.st = &st;
    if (nfs_fstat_async(client->context, client->fh, nfs_co_generic_cb,
                        &task) != 0) {
@@ -479,7 +475,7 @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
        aio_poll(client->aio_context, true);
    }

-    return (task.ret < 0 ? task.ret : st.st_blocks * 512);
+    return (task.ret < 0 ? task.ret : st.st_blocks * st.st_blksize);
 }

 static int nfs_file_truncate(BlockDriverState *bs, int64_t offset)
@@ -488,34 +484,6 @@ static int nfs_file_truncate(BlockDriverState *bs, int64_t offset)
    return nfs_ftruncate(client->context, client->fh, offset);
 }

-/* Note that this will not re-establish a connection with the NFS server
- * - it is effectively a NOP.  */
-static int nfs_reopen_prepare(BDRVReopenState *state,
-                              BlockReopenQueue *queue, Error **errp)
-{
-    NFSClient *client = state->bs->opaque;
-    struct stat st;
-    int ret = 0;
-
-    if (state->flags & BDRV_O_RDWR && bdrv_is_read_only(state->bs)) {
-        error_setg(errp, "Cannot open a read-only mount as read-write");
-        return -EACCES;
-    }
-
-    /* Update cache for read-only reopens */
-    if (!(state->flags & BDRV_O_RDWR)) {
-        ret = nfs_fstat(client->context, client->fh, &st);
-        if (ret < 0) {
-            error_setg(errp, "Failed to fstat file: %s",
-                       nfs_get_error(client->context));
-            return ret;
-        }
-        client->st_blocks = st.st_blocks;
-    }
-
-    return 0;
-}
-
 static BlockDriver bdrv_nfs = {
    .format_name                    = "nfs",
    .protocol_name                  = "nfs",
@@ -531,7 +499,6 @@ static BlockDriver bdrv_nfs = {
    .bdrv_file_open                 = nfs_file_open,
    .bdrv_close                     = nfs_file_close,
    .bdrv_create                    = nfs_file_create,
-    .bdrv_reopen_prepare            = nfs_reopen_prepare,

    .bdrv_co_readv                  = nfs_co_readv,
    .bdrv_co_writev                 = nfs_co_writev,
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -202,13 +202,13 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,

    to_allocate = (sector_num + *pnum + s->tracks - 1) / s->tracks - idx;
    space = to_allocate * s->tracks;
-    if (s->data_end + space > bdrv_getlength(bs->file->bs) >> BDRV_SECTOR_BITS) {
+    if (s->data_end + space > bdrv_getlength(bs->file) >> BDRV_SECTOR_BITS) {
        int ret;
        space += s->prealloc_size;
        if (s->prealloc_mode == PRL_PREALLOC_MODE_FALLOCATE) {
-            ret = bdrv_write_zeroes(bs->file->bs, s->data_end, space, 0);
+            ret = bdrv_write_zeroes(bs->file, s->data_end, space, 0);
        } else {
-            ret = bdrv_truncate(bs->file->bs,
+            ret = bdrv_truncate(bs->file,
                                (s->data_end + space) << BDRV_SECTOR_BITS);
        }
        if (ret < 0) {
@@ -244,8 +244,7 @@ static coroutine_fn int parallels_co_flush_to_os(BlockDriverState *bs)
        if (off + to_write > s->header_size) {
            to_write = s->header_size - off;
        }
-        ret = bdrv_pwrite(bs->file->bs, off, (uint8_t *)s->header + off,
-                          to_write);
+        ret = bdrv_pwrite(bs->file, off, (uint8_t *)s->header + off, to_write);
        if (ret < 0) {
            qemu_co_mutex_unlock(&s->lock);
            return ret;
@@ -304,7 +303,7 @@ static coroutine_fn int parallels_co_writev(BlockDriverState *bs,
        qemu_iovec_reset(&hd_qiov);
        qemu_iovec_concat(&hd_qiov, qiov, bytes_done, nbytes);

-        ret = bdrv_co_writev(bs->file->bs, position, n, &hd_qiov);
+        ret = bdrv_co_writev(bs->file, position, n, &hd_qiov);
        if (ret < 0) {
            break;
        }
@@ -344,7 +343,7 @@ static coroutine_fn int parallels_co_readv(BlockDriverState *bs,
            qemu_iovec_reset(&hd_qiov);
            qemu_iovec_concat(&hd_qiov, qiov, bytes_done, nbytes);

-            ret = bdrv_co_readv(bs->file->bs, position, n, &hd_qiov);
+            ret = bdrv_co_readv(bs->file, position, n, &hd_qiov);
            if (ret < 0) {
                break;
            }
@@ -370,7 +369,7 @@ static int parallels_check(BlockDriverState *bs, BdrvCheckResult *res,
    bool flush_bat = false;
    int cluster_size = s->tracks << BDRV_SECTOR_BITS;

-    size = bdrv_getlength(bs->file->bs);
+    size = bdrv_getlength(bs->file);
    if (size < 0) {
        res->check_errors++;
        return size;
@@ -425,7 +424,7 @@ static int parallels_check(BlockDriverState *bs, BdrvCheckResult *res,
    }

    if (flush_bat) {
-        ret = bdrv_pwrite_sync(bs->file->bs, 0, s->header, s->header_size);
+        ret = bdrv_pwrite_sync(bs->file, 0, s->header, s->header_size);
        if (ret < 0) {
            res->check_errors++;
            return ret;
@@ -441,7 +440,7 @@ static int parallels_check(BlockDriverState *bs, BdrvCheckResult *res,
                size - res->image_end_offset);
        res->leaks += count;
        if (fix & BDRV_FIX_LEAKS) {
-            ret = bdrv_truncate(bs->file->bs, res->image_end_offset);
+            ret = bdrv_truncate(bs->file, res->image_end_offset);
            if (ret < 0) {
                res->check_errors++;
                return ret;
@@ -477,7 +476,7 @@ static int parallels_create(const char *filename, QemuOpts *opts, Error **errp)

    file = NULL;
    ret = bdrv_open(&file, filename, NULL, NULL,
-                    BDRV_O_RDWR | BDRV_O_PROTOCOL, &local_err);
+                    BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        return ret;
@@ -547,13 +546,12 @@ static int parallels_probe(const uint8_t *buf, int buf_size,
 static int parallels_update_header(BlockDriverState *bs)
 {
    BDRVParallelsState *s = bs->opaque;
-    unsigned size = MAX(bdrv_opt_mem_align(bs->file->bs),
-                        sizeof(ParallelsHeader));
+    unsigned size = MAX(bdrv_opt_mem_align(bs->file), sizeof(ParallelsHeader));

    if (size > s->header_size) {
        size = s->header_size;
    }
-    return bdrv_pwrite_sync(bs->file->bs, 0, s->header, size);
+    return bdrv_pwrite_sync(bs->file, 0, s->header, size);
 }

 static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
@@ -566,7 +564,7 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
    Error *local_err = NULL;
    char *buf;

-    ret = bdrv_pread(bs->file->bs, 0, &ph, sizeof(ph));
+    ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
    if (ret < 0) {
        goto fail;
    }
@@ -605,8 +603,8 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
    }

    size = bat_entry_off(s->bat_size);
-    s->header_size = ROUND_UP(size, bdrv_opt_mem_align(bs->file->bs));
-    s->header = qemu_try_blockalign(bs->file->bs, s->header_size);
+    s->header_size = ROUND_UP(size, bdrv_opt_mem_align(bs->file));
+    s->header = qemu_try_blockalign(bs->file, s->header_size);
    if (s->header == NULL) {
        ret = -ENOMEM;
        goto fail;
@@ -621,7 +619,7 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
        s->header_size = size;
    }

-    ret = bdrv_pread(bs->file->bs, 0, s->header, s->header_size);
+    ret = bdrv_pread(bs->file, 0, s->header, s->header_size);
    if (ret < 0) {
        goto fail;
    }
@@ -665,8 +663,8 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
    if (local_err != NULL) {
        goto fail_options;
    }
-    if (!bdrv_has_zero_init(bs->file->bs) ||
-            bdrv_truncate(bs->file->bs, bdrv_getlength(bs->file->bs)) != 0) {
+    if (!bdrv_has_zero_init(bs->file) ||
+            bdrv_truncate(bs->file, bdrv_getlength(bs->file)) != 0) {
        s->prealloc_mode = PRL_PREALLOC_MODE_FALLOCATE;
    }

@@ -709,7 +707,7 @@ static void parallels_close(BlockDriverState *bs)
    }

    if (bs->open_flags & BDRV_O_RDWR) {
-        bdrv_truncate(bs->file->bs, s->data_end << BDRV_SECTOR_BITS);
+        bdrv_truncate(bs->file, s->data_end << BDRV_SECTOR_BITS);
    }

    g_free(s->bat_dirty_bmap);
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -110,8 +110,8 @@ BlockDeviceInfo *bdrv_block_device_info(BlockDriverState *bs, Error **errp)
            qapi_free_BlockDeviceInfo(info);
            return NULL;
        }
-        if (bs0->drv && bs0->backing) {
-            bs0 = bs0->backing->bs;
+        if (bs0->drv && bs0->backing_hd) {
+            bs0 = bs0->backing_hd;
            (*p_image_info)->has_backing_image = true;
            p_image_info = &((*p_image_info)->backing_image);
        } else {
@@ -301,17 +301,17 @@ static void bdrv_query_info(BlockBackend *blk, BlockInfo **p_info,
        info->tray_open = blk_dev_is_tray_open(blk);
    }

-    if (blk_iostatus_is_enabled(blk)) {
+    if (bdrv_iostatus_is_enabled(bs)) {
        info->has_io_status = true;
-        info->io_status = blk_iostatus(blk);
+        info->io_status = bs->iostatus;
    }

-    if (bs && !QLIST_EMPTY(&bs->dirty_bitmaps)) {
+    if (!QLIST_EMPTY(&bs->dirty_bitmaps)) {
        info->has_dirty_bitmaps = true;
        info->dirty_bitmaps = bdrv_query_dirty_bitmaps(bs);
    }

-    if (bs && bs->drv) {
+    if (bs->drv) {
        info->has_inserted = true;
        info->inserted = bdrv_block_device_info(bs, errp);
        if (info->inserted == NULL) {
@@ -344,31 +344,27 @@ static BlockStats *bdrv_query_stats(const BlockDriverState *bs,
    }

    s->stats = g_malloc0(sizeof(*s->stats));
-    if (bs->blk) {
-        BlockAcctStats *stats = blk_get_stats(bs->blk);
-
-        s->stats->rd_bytes = stats->nr_bytes[BLOCK_ACCT_READ];
-        s->stats->wr_bytes = stats->nr_bytes[BLOCK_ACCT_WRITE];
-        s->stats->rd_operations = stats->nr_ops[BLOCK_ACCT_READ];
-        s->stats->wr_operations = stats->nr_ops[BLOCK_ACCT_WRITE];
-        s->stats->rd_merged = stats->merged[BLOCK_ACCT_READ];
-        s->stats->wr_merged = stats->merged[BLOCK_ACCT_WRITE];
-        s->stats->flush_operations = stats->nr_ops[BLOCK_ACCT_FLUSH];
-        s->stats->wr_total_time_ns = stats->total_time_ns[BLOCK_ACCT_WRITE];
-        s->stats->rd_total_time_ns = stats->total_time_ns[BLOCK_ACCT_READ];
-        s->stats->flush_total_time_ns = stats->total_time_ns[BLOCK_ACCT_FLUSH];
-    }
-
-    s->stats->wr_highest_offset = bs->wr_highest_offset;
+    s->stats->rd_bytes = bs->stats.nr_bytes[BLOCK_ACCT_READ];
+    s->stats->wr_bytes = bs->stats.nr_bytes[BLOCK_ACCT_WRITE];
+    s->stats->rd_operations = bs->stats.nr_ops[BLOCK_ACCT_READ];
+    s->stats->wr_operations = bs->stats.nr_ops[BLOCK_ACCT_WRITE];
+    s->stats->rd_merged = bs->stats.merged[BLOCK_ACCT_READ];
+    s->stats->wr_merged = bs->stats.merged[BLOCK_ACCT_WRITE];
+    s->stats->wr_highest_offset =
+        bs->stats.wr_highest_sector * BDRV_SECTOR_SIZE;
+    s->stats->flush_operations = bs->stats.nr_ops[BLOCK_ACCT_FLUSH];
+    s->stats->wr_total_time_ns = bs->stats.total_time_ns[BLOCK_ACCT_WRITE];
+    s->stats->rd_total_time_ns = bs->stats.total_time_ns[BLOCK_ACCT_READ];
+    s->stats->flush_total_time_ns = bs->stats.total_time_ns[BLOCK_ACCT_FLUSH];

    if (bs->file) {
        s->has_parent = true;
-        s->parent = bdrv_query_stats(bs->file->bs, query_backing);
+        s->parent = bdrv_query_stats(bs->file, query_backing);
    }

-    if (query_backing && bs->backing) {
+    if (query_backing && bs->backing_hd) {
        s->has_backing = true;
-        s->backing = bdrv_query_stats(bs->backing->bs, query_backing);
+        s->backing = bdrv_query_stats(bs->backing_hd, query_backing);
    }

    return s;
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -100,7 +100,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
    int ret;
    QCowHeader header;

-    ret = bdrv_pread(bs->file->bs, 0, &header, sizeof(header));
+    ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
    if (ret < 0) {
        goto fail;
    }
@@ -193,7 +193,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

-    ret = bdrv_pread(bs->file->bs, s->l1_table_offset, s->l1_table,
+    ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
               s->l1_size * sizeof(uint64_t));
    if (ret < 0) {
        goto fail;
@@ -205,7 +205,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,

    /* alloc L2 cache (max. 64k * 16 * 8 = 8 MB) */
    s->l2_cache =
-        qemu_try_blockalign(bs->file->bs,
+        qemu_try_blockalign(bs->file,
                            s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
    if (s->l2_cache == NULL) {
        error_setg(errp, "Could not allocate L2 table cache");
@@ -224,7 +224,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
            ret = -EINVAL;
            goto fail;
        }
-        ret = bdrv_pread(bs->file->bs, header.backing_file_offset,
+        ret = bdrv_pread(bs->file, header.backing_file_offset,
                   bs->backing_file, len);
        if (ret < 0) {
            goto fail;
@@ -369,13 +369,13 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
        if (!allocate)
            return 0;
        /* allocate a new l2 entry */
-        l2_offset = bdrv_getlength(bs->file->bs);
+        l2_offset = bdrv_getlength(bs->file);
        /* round to cluster size */
        l2_offset = (l2_offset + s->cluster_size - 1) & ~(s->cluster_size - 1);
        /* update the L1 entry */
        s->l1_table[l1_index] = l2_offset;
        tmp = cpu_to_be64(l2_offset);
-        if (bdrv_pwrite_sync(bs->file->bs,
+        if (bdrv_pwrite_sync(bs->file,
                s->l1_table_offset + l1_index * sizeof(tmp),
                &tmp, sizeof(tmp)) < 0)
            return 0;
@@ -405,12 +405,11 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
    l2_table = s->l2_cache + (min_index << s->l2_bits);
    if (new_l2_table) {
        memset(l2_table, 0, s->l2_size * sizeof(uint64_t));
-        if (bdrv_pwrite_sync(bs->file->bs, l2_offset, l2_table,
+        if (bdrv_pwrite_sync(bs->file, l2_offset, l2_table,
                s->l2_size * sizeof(uint64_t)) < 0)
            return 0;
    } else {
-        if (bdrv_pread(bs->file->bs, l2_offset, l2_table,
-                       s->l2_size * sizeof(uint64_t)) !=
+        if (bdrv_pread(bs->file, l2_offset, l2_table, s->l2_size * sizeof(uint64_t)) !=
            s->l2_size * sizeof(uint64_t))
            return 0;
    }
@@ -431,21 +430,20 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
               overwritten */
            if (decompress_cluster(bs, cluster_offset) < 0)
                return 0;
-            cluster_offset = bdrv_getlength(bs->file->bs);
+            cluster_offset = bdrv_getlength(bs->file);
            cluster_offset = (cluster_offset + s->cluster_size - 1) &
                ~(s->cluster_size - 1);
            /* write the cluster content */
-            if (bdrv_pwrite(bs->file->bs, cluster_offset, s->cluster_cache,
-                            s->cluster_size) !=
+            if (bdrv_pwrite(bs->file, cluster_offset, s->cluster_cache, s->cluster_size) !=
                s->cluster_size)
                return -1;
        } else {
-            cluster_offset = bdrv_getlength(bs->file->bs);
+            cluster_offset = bdrv_getlength(bs->file);
            if (allocate == 1) {
                /* round to cluster size */
                cluster_offset = (cluster_offset + s->cluster_size - 1) &
                    ~(s->cluster_size - 1);
-                bdrv_truncate(bs->file->bs, cluster_offset + s->cluster_size);
+                bdrv_truncate(bs->file, cluster_offset + s->cluster_size);
                /* if encrypted, we must initialize the cluster
                   content which won't be written */
                if (bs->encrypted &&
@@ -465,8 +463,7 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
                                errno = EIO;
                                return -1;
                            }
-                            if (bdrv_pwrite(bs->file->bs,
-                                            cluster_offset + i * 512,
+                            if (bdrv_pwrite(bs->file, cluster_offset + i * 512,
                                            s->cluster_data, 512) != 512)
                                return -1;
                        }
@@ -480,7 +477,7 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
        /* update L2 table */
        tmp = cpu_to_be64(cluster_offset);
        l2_table[l2_index] = tmp;
-        if (bdrv_pwrite_sync(bs->file->bs, l2_offset + l2_index * sizeof(tmp),
+        if (bdrv_pwrite_sync(bs->file, l2_offset + l2_index * sizeof(tmp),
                &tmp, sizeof(tmp)) < 0)
            return 0;
    }
@@ -549,7 +546,7 @@ static int decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
    if (s->cluster_cache_offset != coffset) {
        csize = cluster_offset >> (63 - s->cluster_bits);
        csize &= (s->cluster_size - 1);
-        ret = bdrv_pread(bs->file->bs, coffset, s->cluster_data, csize);
+        ret = bdrv_pread(bs->file, coffset, s->cluster_data, csize);
        if (ret != csize)
            return -1;
        if (decompress_buffer(s->cluster_cache, s->cluster_size,
@@ -597,13 +594,13 @@ static coroutine_fn int qcow_co_readv(BlockDriverState *bs, int64_t sector_num,
        }

        if (!cluster_offset) {
-            if (bs->backing) {
+            if (bs->backing_hd) {
                /* read from the base image */
                hd_iov.iov_base = (void *)buf;
                hd_iov.iov_len = n * 512;
                qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
                qemu_co_mutex_unlock(&s->lock);
-                ret = bdrv_co_readv(bs->backing->bs, sector_num,
+                ret = bdrv_co_readv(bs->backing_hd, sector_num,
                                    n, &hd_qiov);
                qemu_co_mutex_lock(&s->lock);
                if (ret < 0) {
@@ -628,7 +625,7 @@ static coroutine_fn int qcow_co_readv(BlockDriverState *bs, int64_t sector_num,
            hd_iov.iov_len = n * 512;
            qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
            qemu_co_mutex_unlock(&s->lock);
-            ret = bdrv_co_readv(bs->file->bs,
+            ret = bdrv_co_readv(bs->file,
                                (cluster_offset >> 9) + index_in_cluster,
                                n, &hd_qiov);
            qemu_co_mutex_lock(&s->lock);
@@ -730,7 +727,7 @@ static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
        hd_iov.iov_len = n * 512;
        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
        qemu_co_mutex_unlock(&s->lock);
-        ret = bdrv_co_writev(bs->file->bs,
+        ret = bdrv_co_writev(bs->file,
                             (cluster_offset >> 9) + index_in_cluster,
                             n, &hd_qiov);
        qemu_co_mutex_lock(&s->lock);
@@ -796,7 +793,7 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)

    qcow_bs = NULL;
    ret = bdrv_open(&qcow_bs, filename, NULL, NULL,
-                    BDRV_O_RDWR | BDRV_O_PROTOCOL, &local_err);
+                    BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto cleanup;
@@ -882,10 +879,10 @@ static int qcow_make_empty(BlockDriverState *bs)
    int ret;

    memset(s->l1_table, 0, l1_length);
-    if (bdrv_pwrite_sync(bs->file->bs, s->l1_table_offset, s->l1_table,
+    if (bdrv_pwrite_sync(bs->file, s->l1_table_offset, s->l1_table,
            l1_length) < 0)
        return -1;
-    ret = bdrv_truncate(bs->file->bs, s->l1_table_offset + l1_length);
+    ret = bdrv_truncate(bs->file, s->l1_table_offset + l1_length);
    if (ret < 0)
        return ret;

@@ -965,7 +962,7 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
        }

        cluster_offset &= s->cluster_offset_mask;
-        ret = bdrv_pwrite(bs->file->bs, cluster_offset, out_buf, out_len);
+        ret = bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len);
        if (ret < 0) {
            goto fail;
        }
--- a/block/qcow2-cache.c
+++ b/block/qcow2-cache.c
@@ -22,24 +22,16 @@
 * THE SOFTWARE.
 */

-/* Needed for CONFIG_MADVISE */
-#include "config-host.h"
-
-#if defined(CONFIG_MADVISE) || defined(CONFIG_POSIX_MADVISE)
-#include <sys/mman.h>
-#endif
-
 #include "block/block_int.h"
 #include "qemu-common.h"
-#include "qemu/osdep.h"
 #include "qcow2.h"
 #include "trace.h"

 typedef struct Qcow2CachedTable {
    int64_t  offset;
+    bool     dirty;
    uint64_t lru_counter;
    int      ref;
-    bool     dirty;
 } Qcow2CachedTable;

 struct Qcow2Cache {
@@ -49,85 +41,34 @@ struct Qcow2Cache {
    bool                    depends_on_flush;
    void                   *table_array;
    uint64_t                lru_counter;
-    uint64_t                cache_clean_lru_counter;
 };

 static inline void *qcow2_cache_get_table_addr(BlockDriverState *bs,
                    Qcow2Cache *c, int table)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    return (uint8_t *) c->table_array + (size_t) table * s->cluster_size;
 }

 static inline int qcow2_cache_get_table_idx(BlockDriverState *bs,
                  Qcow2Cache *c, void *table)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    ptrdiff_t table_offset = (uint8_t *) table - (uint8_t *) c->table_array;
    int idx = table_offset / s->cluster_size;
    assert(idx >= 0 && idx < c->size && table_offset % s->cluster_size == 0);
    return idx;
 }

-static void qcow2_cache_table_release(BlockDriverState *bs, Qcow2Cache *c,
-                                      int i, int num_tables)
-{
-#if QEMU_MADV_DONTNEED != QEMU_MADV_INVALID
-    BDRVQcow2State *s = bs->opaque;
-    void *t = qcow2_cache_get_table_addr(bs, c, i);
-    int align = getpagesize();
-    size_t mem_size = (size_t) s->cluster_size * num_tables;
-    size_t offset = QEMU_ALIGN_UP((uintptr_t) t, align) - (uintptr_t) t;
-    size_t length = QEMU_ALIGN_DOWN(mem_size - offset, align);
-    if (length > 0) {
-        qemu_madvise((uint8_t *) t + offset, length, QEMU_MADV_DONTNEED);
-    }
-#endif
-}
-
-static inline bool can_clean_entry(Qcow2Cache *c, int i)
-{
-    Qcow2CachedTable *t = &c->entries[i];
-    return t->ref == 0 && !t->dirty && t->offset != 0 &&
-        t->lru_counter <= c->cache_clean_lru_counter;
-}
-
-void qcow2_cache_clean_unused(BlockDriverState *bs, Qcow2Cache *c)
-{
-    int i = 0;
-    while (i < c->size) {
-        int to_clean = 0;
-
-        /* Skip the entries that we don't need to clean */
-        while (i < c->size && !can_clean_entry(c, i)) {
-            i++;
-        }
-
-        /* And count how many we can clean in a row */
-        while (i < c->size && can_clean_entry(c, i)) {
-            c->entries[i].offset = 0;
-            c->entries[i].lru_counter = 0;
-            i++;
-            to_clean++;
-        }
-
-        if (to_clean > 0) {
-            qcow2_cache_table_release(bs, c, i - to_clean, to_clean);
-        }
-    }
-
-    c->cache_clean_lru_counter = c->lru_counter;
-}
-
 Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    Qcow2Cache *c;

    c = g_new0(Qcow2Cache, 1);
    c->size = num_tables;
    c->entries = g_try_new0(Qcow2CachedTable, num_tables);
-    c->table_array = qemu_try_blockalign(bs->file->bs,
+    c->table_array = qemu_try_blockalign(bs->file,
                                         (size_t) num_tables * s->cluster_size);

    if (!c->entries || !c->table_array) {
@@ -172,7 +113,7 @@ static int qcow2_cache_flush_dependency(BlockDriverState *bs, Qcow2Cache *c)

 static int qcow2_cache_entry_flush(BlockDriverState *bs, Qcow2Cache *c, int i)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int ret = 0;

    if (!c->entries[i].dirty || !c->entries[i].offset) {
@@ -185,7 +126,7 @@ static int qcow2_cache_entry_flush(BlockDriverState *bs, Qcow2Cache *c, int i)
    if (c->depends) {
        ret = qcow2_cache_flush_dependency(bs, c);
    } else if (c->depends_on_flush) {
-        ret = bdrv_flush(bs->file->bs);
+        ret = bdrv_flush(bs->file);
        if (ret >= 0) {
            c->depends_on_flush = false;
        }
@@ -216,7 +157,7 @@ static int qcow2_cache_entry_flush(BlockDriverState *bs, Qcow2Cache *c, int i)
        BLKDBG_EVENT(bs->file, BLKDBG_L2_UPDATE);
    }

-    ret = bdrv_pwrite(bs->file->bs, c->entries[i].offset,
+    ret = bdrv_pwrite(bs->file, c->entries[i].offset,
                      qcow2_cache_get_table_addr(bs, c, i), s->cluster_size);
    if (ret < 0) {
        return ret;
@@ -229,7 +170,7 @@ static int qcow2_cache_entry_flush(BlockDriverState *bs, Qcow2Cache *c, int i)

 int qcow2_cache_flush(BlockDriverState *bs, Qcow2Cache *c)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int result = 0;
    int ret;
    int i;
@@ -244,7 +185,7 @@ int qcow2_cache_flush(BlockDriverState *bs, Qcow2Cache *c)
    }

    if (result == 0) {
-        ret = bdrv_flush(bs->file->bs);
+        ret = bdrv_flush(bs->file);
        if (ret < 0) {
            result = ret;
        }
@@ -296,8 +237,6 @@ int qcow2_cache_empty(BlockDriverState *bs, Qcow2Cache *c)
        c->entries[i].lru_counter = 0;
    }

-    qcow2_cache_table_release(bs, c, 0, c->size);
-
    c->lru_counter = 0;

    return 0;
@@ -306,7 +245,7 @@ int qcow2_cache_empty(BlockDriverState *bs, Qcow2Cache *c)
 static int qcow2_cache_do_get(BlockDriverState *bs, Qcow2Cache *c,
    uint64_t offset, void **table, bool read_from_disk)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int i;
    int ret;
    int lookup_index;
@@ -356,8 +295,7 @@ static int qcow2_cache_do_get(BlockDriverState *bs, Qcow2Cache *c,
            BLKDBG_EVENT(bs->file, BLKDBG_L2_LOAD);
        }

-        ret = bdrv_pread(bs->file->bs, offset,
-                         qcow2_cache_get_table_addr(bs, c, i),
+        ret = bdrv_pread(bs->file, offset, qcow2_cache_get_table_addr(bs, c, i),
                         s->cluster_size);
        if (ret < 0) {
            return ret;
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -32,7 +32,7 @@
 int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
                        bool exact_size)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int new_l1_size2, ret, i;
    uint64_t *new_l1_table;
    int64_t old_l1_table_offset, old_l1_size;
@@ -72,7 +72,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
 #endif

    new_l1_size2 = sizeof(uint64_t) * new_l1_size;
-    new_l1_table = qemu_try_blockalign(bs->file->bs,
+    new_l1_table = qemu_try_blockalign(bs->file,
                                       align_offset(new_l1_size2, 512));
    if (new_l1_table == NULL) {
        return -ENOMEM;
@@ -105,8 +105,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
    BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_WRITE_TABLE);
    for(i = 0; i < s->l1_size; i++)
        new_l1_table[i] = cpu_to_be64(new_l1_table[i]);
-    ret = bdrv_pwrite_sync(bs->file->bs, new_l1_table_offset,
-                           new_l1_table, new_l1_size2);
+    ret = bdrv_pwrite_sync(bs->file, new_l1_table_offset, new_l1_table, new_l1_size2);
    if (ret < 0)
        goto fail;
    for(i = 0; i < s->l1_size; i++)
@@ -116,8 +115,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
    BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ACTIVATE_TABLE);
    cpu_to_be32w((uint32_t*)data, new_l1_size);
    stq_be_p(data + 4, new_l1_table_offset);
-    ret = bdrv_pwrite_sync(bs->file->bs, offsetof(QCowHeader, l1_size),
-                           data, sizeof(data));
+    ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_size), data,sizeof(data));
    if (ret < 0) {
        goto fail;
    }
@@ -150,7 +148,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
 static int l2_load(BlockDriverState *bs, uint64_t l2_offset,
    uint64_t **l2_table)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int ret;

    ret = qcow2_cache_get(bs, s->l2_table_cache, l2_offset, (void**) l2_table);
@@ -165,7 +163,7 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset,
 #define L1_ENTRIES_PER_SECTOR (512 / 8)
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
    int l1_start_index;
    int i, ret;
@@ -184,8 +182,7 @@ int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
    }

    BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
-    ret = bdrv_pwrite_sync(bs->file->bs,
-                           s->l1_table_offset + 8 * l1_start_index,
+    ret = bdrv_pwrite_sync(bs->file, s->l1_table_offset + 8 * l1_start_index,
        buf, sizeof(buf));
    if (ret < 0) {
        return ret;
@@ -206,7 +203,7 @@ int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)

 static int l2_allocate(BlockDriverState *bs, int l1_index, uint64_t **table)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t old_l2_offset;
    uint64_t *l2_table = NULL;
    int64_t l2_offset;
@@ -301,7 +298,7 @@ fail:
 * as contiguous. (This allows it, for example, to stop at the first compressed
 * cluster which may require a different handling)
 */
-static int count_contiguous_clusters(int nb_clusters, int cluster_size,
+static int count_contiguous_clusters(uint64_t nb_clusters, int cluster_size,
        uint64_t *l2_table, uint64_t stop_flags)
 {
    int i;
@@ -324,7 +321,7 @@ static int count_contiguous_clusters(int nb_clusters, int cluster_size,
 	return i;
 }

-static int count_contiguous_free_clusters(int nb_clusters, uint64_t *l2_table)
+static int count_contiguous_free_clusters(uint64_t nb_clusters, uint64_t *l2_table)
 {
    int i;

@@ -342,7 +339,7 @@ static int count_contiguous_free_clusters(int nb_clusters, uint64_t *l2_table)
 /* The crypt function is compatible with the linux cryptoloop
   algorithm for < 4 GB images. NOTE: out_buf == in_buf is
   supported */
-int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
+int qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
                          uint8_t *out_buf, const uint8_t *in_buf,
                          int nb_sectors, bool enc,
                          Error **errp)
@@ -390,7 +387,7 @@ static int coroutine_fn copy_sectors(BlockDriverState *bs,
                                     uint64_t cluster_offset,
                                     int n_start, int n_end)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QEMUIOVector qiov;
    struct iovec iov;
    int n, ret;
@@ -443,8 +440,7 @@ static int coroutine_fn copy_sectors(BlockDriverState *bs,
    }

    BLKDBG_EVENT(bs->file, BLKDBG_COW_WRITE);
-    ret = bdrv_co_writev(bs->file->bs, (cluster_offset >> 9) + n_start, n,
-                         &qiov);
+    ret = bdrv_co_writev(bs->file, (cluster_offset >> 9) + n_start, n, &qiov);
    if (ret < 0) {
        goto out;
    }
@@ -473,7 +469,7 @@ out:
 int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    int *num, uint64_t *cluster_offset)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    unsigned int l2_index;
    uint64_t l1_index, l2_offset, *l2_table;
    int l1_bits, c;
@@ -499,11 +495,10 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    if (nb_needed > nb_available) {
        nb_needed = nb_available;
    }
-    assert(nb_needed <= INT_MAX);

    *cluster_offset = 0;

-    /* seek to the l2 offset in the l1 table */
+    /* seek the the l2 offset in the l1 table */

    l1_index = offset >> l1_bits;
    if (l1_index >= s->l1_size) {
@@ -535,8 +530,6 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,

    l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
    *cluster_offset = be64_to_cpu(l2_table[l2_index]);
-
-    /* nb_needed <= INT_MAX, thus nb_clusters <= INT_MAX, too */
    nb_clusters = size_to_clusters(s, nb_needed << 9);

    ret = qcow2_get_cluster_type(*cluster_offset);
@@ -613,13 +606,13 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
                             uint64_t **new_l2_table,
                             int *new_l2_index)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    unsigned int l2_index;
    uint64_t l1_index, l2_offset;
    uint64_t *l2_table = NULL;
    int ret;

-    /* seek to the l2 offset in the l1 table */
+    /* seek the the l2 offset in the l1 table */

    l1_index = offset >> (s->l2_bits + s->cluster_bits);
    if (l1_index >= s->l1_size) {
@@ -687,7 +680,7 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
                                               uint64_t offset,
                                               int compressed_size)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int l2_index, ret;
    uint64_t *l2_table;
    int64_t cluster_offset;
@@ -732,7 +725,7 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,

 static int perform_cow(BlockDriverState *bs, QCowL2Meta *m, Qcow2COWRegion *r)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int ret;

    if (r->nb_sectors == 0) {
@@ -761,7 +754,7 @@ static int perform_cow(BlockDriverState *bs, QCowL2Meta *m, Qcow2COWRegion *r)

 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int i, j = 0, l2_index, ret;
    uint64_t *old_cluster, *l2_table;
    uint64_t cluster_offset = m->alloc_offset;
@@ -821,6 +814,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)

    /*
     * If this was a COW, we need to decrease the refcount of the old cluster.
+     * Also flush bs->file to get the right order for L2 and refcount update.
     *
     * Don't discard clusters that reach a refcount of 0 (e.g. compressed
     * clusters), the next write will reuse them anyway.
@@ -843,7 +837,7 @@ err:
 * write, but require COW to be performed (this includes yet unallocated space,
 * which must copy from the backing file)
 */
-static int count_cow_clusters(BDRVQcow2State *s, int nb_clusters,
+static int count_cow_clusters(BDRVQcowState *s, int nb_clusters,
    uint64_t *l2_table, int l2_index)
 {
    int i;
@@ -889,7 +883,7 @@ out:
 static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,
    uint64_t *cur_bytes, QCowL2Meta **m)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowL2Meta *old_alloc;
    uint64_t bytes = *cur_bytes;

@@ -962,11 +956,11 @@ static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,
 static int handle_copied(BlockDriverState *bs, uint64_t guest_offset,
    uint64_t *host_offset, uint64_t *bytes, QCowL2Meta **m)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int l2_index;
    uint64_t cluster_offset;
    uint64_t *l2_table;
-    uint64_t nb_clusters;
+    unsigned int nb_clusters;
    unsigned int keep_clusters;
    int ret;

@@ -985,7 +979,6 @@ static int handle_copied(BlockDriverState *bs, uint64_t guest_offset,

    l2_index = offset_to_l2_index(s, guest_offset);
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
-    assert(nb_clusters <= INT_MAX);

    /* Find L2 entry for the first involved cluster */
    ret = get_cluster_table(bs, guest_offset, &l2_table, &l2_index);
@@ -1068,9 +1061,9 @@ out:
 * restarted, but the whole request should not be failed.
 */
 static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
-                                   uint64_t *host_offset, uint64_t *nb_clusters)
+    uint64_t *host_offset, unsigned int *nb_clusters)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;

    trace_qcow2_do_alloc_clusters_offset(qemu_coroutine_self(), guest_offset,
                                         *host_offset, *nb_clusters);
@@ -1086,7 +1079,7 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
        *host_offset = cluster_offset;
        return 0;
    } else {
-        int64_t ret = qcow2_alloc_clusters_at(bs, *host_offset, *nb_clusters);
+        int ret = qcow2_alloc_clusters_at(bs, *host_offset, *nb_clusters);
        if (ret < 0) {
            return ret;
        }
@@ -1118,11 +1111,11 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
 static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
    uint64_t *host_offset, uint64_t *bytes, QCowL2Meta **m)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int l2_index;
    uint64_t *l2_table;
    uint64_t entry;
-    uint64_t nb_clusters;
+    unsigned int nb_clusters;
    int ret;

    uint64_t alloc_cluster_offset;
@@ -1140,7 +1133,6 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,

    l2_index = offset_to_l2_index(s, guest_offset);
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
-    assert(nb_clusters <= INT_MAX);

    /* Find L2 entry for the first involved cluster */
    ret = get_cluster_table(bs, guest_offset, &l2_table, &l2_index);
@@ -1271,7 +1263,7 @@ fail:
 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
    int *num, uint64_t *host_offset, QCowL2Meta **m)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t start, remaining;
    uint64_t cluster_offset;
    uint64_t cur_bytes;
@@ -1405,7 +1397,7 @@ static int decompress_buffer(uint8_t *out_buf, int out_buf_size,

 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int ret, csize, nb_csectors, sector_offset;
    uint64_t coffset;

@@ -1415,8 +1407,7 @@ int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
        sector_offset = coffset & 511;
        csize = nb_csectors * 512 - sector_offset;
        BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
-        ret = bdrv_read(bs->file->bs, coffset >> 9, s->cluster_data,
-                        nb_csectors);
+        ret = bdrv_read(bs->file, coffset >> 9, s->cluster_data, nb_csectors);
        if (ret < 0) {
            return ret;
        }
@@ -1435,10 +1426,9 @@ int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
 * clusters.
 */
 static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
-                             uint64_t nb_clusters, enum qcow2_discard_type type,
-                             bool full_discard)
+    unsigned int nb_clusters, enum qcow2_discard_type type, bool full_discard)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t *l2_table;
    int l2_index;
    int ret;
@@ -1451,7 +1441,6 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,

    /* Limit nb_clusters to one L2 table */
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
-    assert(nb_clusters <= INT_MAX);

    for (i = 0; i < nb_clusters; i++) {
        uint64_t old_l2_entry;
@@ -1473,7 +1462,7 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
         */
        switch (qcow2_get_cluster_type(old_l2_entry)) {
            case QCOW2_CLUSTER_UNALLOCATED:
-                if (full_discard || !bs->backing) {
+                if (full_discard || !bs->backing_hd) {
                    continue;
                }
                break;
@@ -1512,9 +1501,9 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
 int qcow2_discard_clusters(BlockDriverState *bs, uint64_t offset,
    int nb_sectors, enum qcow2_discard_type type, bool full_discard)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t end_offset;
-    uint64_t nb_clusters;
+    unsigned int nb_clusters;
    int ret;

    end_offset = offset + (nb_sectors << BDRV_SECTOR_BITS);
@@ -1556,9 +1545,9 @@ fail:
 * clusters.
 */
 static int zero_single_l2(BlockDriverState *bs, uint64_t offset,
-                          uint64_t nb_clusters)
+    unsigned int nb_clusters)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t *l2_table;
    int l2_index;
    int ret;
@@ -1571,7 +1560,6 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,

    /* Limit nb_clusters to one L2 table */
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
-    assert(nb_clusters <= INT_MAX);

    for (i = 0; i < nb_clusters; i++) {
        uint64_t old_offset;
@@ -1595,8 +1583,8 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,

 int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors)
 {
-    BDRVQcow2State *s = bs->opaque;
-    uint64_t nb_clusters;
+    BDRVQcowState *s = bs->opaque;
+    unsigned int nb_clusters;
    int ret;

    /* The zero flag is only supported by version 3 and newer */
@@ -1640,7 +1628,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                                      int64_t l1_entries,
                                      BlockDriverAmendStatusCB *status_cb)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    bool is_active_l1 = (l1_table == s->l1_table);
    uint64_t *l2_table = NULL;
    int ret;
@@ -1649,7 +1637,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
    if (!is_active_l1) {
        /* inactive L2 tables require a buffer to be stored in when loading
         * them from disk */
-        l2_table = qemu_try_blockalign(bs->file->bs, s->cluster_size);
+        l2_table = qemu_try_blockalign(bs->file, s->cluster_size);
        if (l2_table == NULL) {
            return -ENOMEM;
        }
@@ -1683,7 +1671,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                    (void **)&l2_table);
        } else {
            /* load inactive L2 tables from disk */
-            ret = bdrv_read(bs->file->bs, l2_offset / BDRV_SECTOR_SIZE,
+            ret = bdrv_read(bs->file, l2_offset / BDRV_SECTOR_SIZE,
                    (void *)l2_table, s->cluster_sectors);
        }
        if (ret < 0) {
@@ -1707,7 +1695,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
            }

            if (!preallocated) {
-                if (!bs->backing) {
+                if (!bs->backing_hd) {
                    /* not backed; therefore we can simply deallocate the
                     * cluster */
                    l2_table[j] = 0;
@@ -1758,7 +1746,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                goto fail;
            }

-            ret = bdrv_write_zeroes(bs->file->bs, offset / BDRV_SECTOR_SIZE,
+            ret = bdrv_write_zeroes(bs->file, offset / BDRV_SECTOR_SIZE,
                                    s->cluster_sectors, 0);
            if (ret < 0) {
                if (!preallocated) {
@@ -1791,7 +1779,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                    goto fail;
                }

-                ret = bdrv_write(bs->file->bs, l2_offset / BDRV_SECTOR_SIZE,
+                ret = bdrv_write(bs->file, l2_offset / BDRV_SECTOR_SIZE,
                        (void *)l2_table, s->cluster_sectors);
                if (ret < 0) {
                    goto fail;
@@ -1827,7 +1815,7 @@ fail:
 int qcow2_expand_zero_clusters(BlockDriverState *bs,
                               BlockDriverAmendStatusCB *status_cb)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t *l1_table = NULL;
    int64_t l1_entries = 0, visited_l1_entries = 0;
    int ret;
@@ -1865,9 +1853,8 @@ int qcow2_expand_zero_clusters(BlockDriverState *bs,

        l1_table = g_realloc(l1_table, l1_sectors * BDRV_SECTOR_SIZE);

-        ret = bdrv_read(bs->file->bs,
-                        s->snapshots[i].l1_table_offset / BDRV_SECTOR_SIZE,
-                        (void *)l1_table, l1_sectors);
+        ret = bdrv_read(bs->file, s->snapshots[i].l1_table_offset /
+                BDRV_SECTOR_SIZE, (void *)l1_table, l1_sectors);
        if (ret < 0) {
            goto fail;
        }
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -82,7 +82,7 @@ static Qcow2SetRefcountFunc *const set_refcount_funcs[] = {

 int qcow2_refcount_init(BlockDriverState *bs)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    unsigned int refcount_table_size2, i;
    int ret;

@@ -101,7 +101,7 @@ int qcow2_refcount_init(BlockDriverState *bs)
            goto fail;
        }
        BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
-        ret = bdrv_pread(bs->file->bs, s->refcount_table_offset,
+        ret = bdrv_pread(bs->file, s->refcount_table_offset,
                         s->refcount_table, refcount_table_size2);
        if (ret < 0) {
            goto fail;
@@ -116,7 +116,7 @@ int qcow2_refcount_init(BlockDriverState *bs)

 void qcow2_refcount_close(BlockDriverState *bs)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    g_free(s->refcount_table);
 }

@@ -214,7 +214,7 @@ static int load_refcount_block(BlockDriverState *bs,
                               int64_t refcount_block_offset,
                               void **refcount_block)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int ret;

    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_LOAD);
@@ -231,7 +231,7 @@ static int load_refcount_block(BlockDriverState *bs,
 int qcow2_get_refcount(BlockDriverState *bs, int64_t cluster_index,
                       uint64_t *refcount)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t refcount_table_index, block_index;
    int64_t refcount_block_offset;
    int ret;
@@ -274,7 +274,7 @@ int qcow2_get_refcount(BlockDriverState *bs, int64_t cluster_index,
 * Rounds the refcount table size up to avoid growing the table for each single
 * refcount block that is allocated.
 */
-static unsigned int next_refcount_table_size(BDRVQcow2State *s,
+static unsigned int next_refcount_table_size(BDRVQcowState *s,
    unsigned int min_size)
 {
    unsigned int min_clusters = (min_size >> (s->cluster_bits - 3)) + 1;
@@ -290,7 +290,7 @@ static unsigned int next_refcount_table_size(BDRVQcow2State *s,


 /* Checks if two offsets are described by the same refcount block */
-static int in_same_refcount_block(BDRVQcow2State *s, uint64_t offset_a,
+static int in_same_refcount_block(BDRVQcowState *s, uint64_t offset_a,
    uint64_t offset_b)
 {
    uint64_t block_a = offset_a >> (s->cluster_bits + s->refcount_block_bits);
@@ -308,7 +308,7 @@ static int in_same_refcount_block(BDRVQcow2State *s, uint64_t offset_a,
 static int alloc_refcount_block(BlockDriverState *bs,
                                int64_t cluster_index, void **refcount_block)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    unsigned int refcount_table_index;
    int ret;

@@ -431,7 +431,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    if (refcount_table_index < s->refcount_table_size) {
        uint64_t data64 = cpu_to_be64(new_block);
        BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_HOOKUP);
-        ret = bdrv_pwrite_sync(bs->file->bs,
+        ret = bdrv_pwrite_sync(bs->file,
            s->refcount_table_offset + refcount_table_index * sizeof(uint64_t),
            &data64, sizeof(data64));
        if (ret < 0) {
@@ -535,7 +535,7 @@ static int alloc_refcount_block(BlockDriverState *bs,

    /* Write refcount blocks to disk */
    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
-    ret = bdrv_pwrite_sync(bs->file->bs, meta_offset, new_blocks,
+    ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks,
        blocks_clusters * s->cluster_size);
    g_free(new_blocks);
    new_blocks = NULL;
@@ -549,7 +549,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    }

    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_TABLE);
-    ret = bdrv_pwrite_sync(bs->file->bs, table_offset, new_table,
+    ret = bdrv_pwrite_sync(bs->file, table_offset, new_table,
        table_size * sizeof(uint64_t));
    if (ret < 0) {
        goto fail_table;
@@ -564,8 +564,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    cpu_to_be64w((uint64_t*)data, table_offset);
    cpu_to_be32w((uint32_t*)(data + 8), table_clusters);
    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_SWITCH_TABLE);
-    ret = bdrv_pwrite_sync(bs->file->bs,
-                           offsetof(QCowHeader, refcount_table_offset),
+    ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, refcount_table_offset),
        data, sizeof(data));
    if (ret < 0) {
        goto fail_table;
@@ -606,7 +605,7 @@ fail_block:

 void qcow2_process_discards(BlockDriverState *bs, int ret)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    Qcow2DiscardRegion *d, *next;

    QTAILQ_FOREACH_SAFE(d, &s->discards, next, next) {
@@ -614,7 +613,7 @@ void qcow2_process_discards(BlockDriverState *bs, int ret)

        /* Discard is optional, ignore the return value */
        if (ret >= 0) {
-            bdrv_discard(bs->file->bs,
+            bdrv_discard(bs->file,
                         d->offset >> BDRV_SECTOR_BITS,
                         d->bytes >> BDRV_SECTOR_BITS);
        }
@@ -626,7 +625,7 @@ void qcow2_process_discards(BlockDriverState *bs, int ret)
 static void update_refcount_discard(BlockDriverState *bs,
                                    uint64_t offset, uint64_t length)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    Qcow2DiscardRegion *d, *p, *next;

    QTAILQ_FOREACH(d, &s->discards, next) {
@@ -683,7 +682,7 @@ static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
                                                   bool decrease,
                                                   enum qcow2_discard_type type)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int64_t start, last, cluster_offset;
    void *refcount_block = NULL;
    int64_t old_table_index = -1;
@@ -794,7 +793,7 @@ int qcow2_update_cluster_refcount(BlockDriverState *bs,
                                  uint64_t addend, bool decrease,
                                  enum qcow2_discard_type type)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int ret;

    ret = update_refcount(bs, cluster_index << s->cluster_bits, 1, addend,
@@ -816,7 +815,7 @@ int qcow2_update_cluster_refcount(BlockDriverState *bs,
 /* return < 0 if error */
 static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t i, nb_clusters, refcount;
    int ret;

@@ -876,10 +875,10 @@ int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size)
    return offset;
 }

-int64_t qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
-                                int64_t nb_clusters)
+int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
+    int nb_clusters)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t cluster_index, refcount;
    uint64_t i;
    int ret;
@@ -917,7 +916,7 @@ int64_t qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
   contiguous sectors. size must be <= cluster_size */
 int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int64_t offset;
    size_t free_in_cluster;
    int ret;
@@ -950,17 +949,11 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)

            if (!offset || ROUND_UP(offset, s->cluster_size) != new_cluster) {
                offset = new_cluster;
-                free_in_cluster = s->cluster_size;
-            } else {
-                free_in_cluster += s->cluster_size;
            }
        }

        assert(offset);
        ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER);
-        if (ret < 0) {
-            offset = 0;
-        }
    } while (ret == -EAGAIN);
    if (ret < 0) {
        return ret;
@@ -999,7 +992,7 @@ void qcow2_free_clusters(BlockDriverState *bs,
 void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
                             int nb_clusters, enum qcow2_discard_type type)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;

    switch (qcow2_get_cluster_type(l2_entry)) {
    case QCOW2_CLUSTER_COMPRESSED:
@@ -1043,7 +1036,7 @@ void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2, refcount;
    bool l1_allocated = false;
    int64_t old_offset, old_l2_offset;
@@ -1069,7 +1062,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
        }
        l1_allocated = true;

-        ret = bdrv_pread(bs->file->bs, l1_table_offset, l1_table, l1_size2);
+        ret = bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2);
        if (ret < 0) {
            goto fail;
        }
@@ -1222,8 +1215,7 @@ fail:
            cpu_to_be64s(&l1_table[i]);
        }

-        ret = bdrv_pwrite_sync(bs->file->bs, l1_table_offset,
-                               l1_table, l1_size2);
+        ret = bdrv_pwrite_sync(bs->file, l1_table_offset, l1_table, l1_size2);

        for (i = 0; i < l1_size; i++) {
            be64_to_cpus(&l1_table[i]);
@@ -1241,7 +1233,7 @@ fail:
 /* refcount checking functions */


-static size_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)
+static size_t refcount_array_byte_size(BDRVQcowState *s, uint64_t entries)
 {
    /* This assertion holds because there is no way we can address more than
     * 2^(64 - 9) clusters at once (with cluster size 512 = 2^9, and because
@@ -1264,10 +1256,10 @@ static size_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)
 * refcount array buffer will be aligned to a cluster boundary, and the newly
 * allocated area will be zeroed.
 */
-static int realloc_refcount_array(BDRVQcow2State *s, void **array,
+static int realloc_refcount_array(BDRVQcowState *s, void **array,
                                  int64_t *size, int64_t new_size)
 {
-    int64_t old_byte_size, new_byte_size;
+    size_t old_byte_size, new_byte_size;
    void *new_ptr;

    /* Round to clusters so the array can be directly written to disk */
@@ -1283,17 +1275,13 @@ static int realloc_refcount_array(BDRVQcow2State *s, void **array,

    assert(new_byte_size > 0);

-    if (new_byte_size > SIZE_MAX) {
-        return -ENOMEM;
-    }
-
    new_ptr = g_try_realloc(*array, new_byte_size);
    if (!new_ptr) {
        return -ENOMEM;
    }

    if (new_byte_size > old_byte_size) {
-        memset((char *)new_ptr + old_byte_size, 0,
+        memset((void *)((uintptr_t)new_ptr + old_byte_size), 0,
               new_byte_size - old_byte_size);
    }

@@ -1306,7 +1294,7 @@ static int realloc_refcount_array(BDRVQcow2State *s, void **array,
 /*
 * Increases the refcount for a range of clusters in a given refcount table.
 * This is used to construct a temporary refcount table out of L1 and L2 tables
- * which can be compared to the refcount table saved in the image.
+ * which can be compared the the refcount table saved in the image.
 *
 * Modifies the number of errors in res.
 */
@@ -1316,7 +1304,7 @@ static int inc_refcounts(BlockDriverState *bs,
                         int64_t *refcount_table_size,
                         int64_t offset, int64_t size)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t start, last, cluster_offset, k, refcount;
    int ret;

@@ -1369,7 +1357,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
                              int64_t *refcount_table_size, int64_t l2_offset,
                              int flags)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t *l2_table, l2_entry;
    uint64_t next_contiguous_offset = 0;
    int i, l2_size, nb_csectors, ret;
@@ -1378,7 +1366,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
    l2_size = s->l2_size * sizeof(uint64_t);
    l2_table = g_malloc(l2_size);

-    ret = bdrv_pread(bs->file->bs, l2_offset, l2_table, l2_size);
+    ret = bdrv_pread(bs->file, l2_offset, l2_table, l2_size);
    if (ret < 0) {
        fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
        res->check_errors++;
@@ -1489,7 +1477,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
                              int64_t l1_table_offset, int l1_size,
                              int flags)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t *l1_table = NULL, l2_offset, l1_size2;
    int i, ret;

@@ -1510,7 +1498,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
            res->check_errors++;
            goto fail;
        }
-        ret = bdrv_pread(bs->file->bs, l1_table_offset, l1_table, l1_size2);
+        ret = bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2);
        if (ret < 0) {
            fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
            res->check_errors++;
@@ -1566,7 +1554,7 @@ fail:
 static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
                              BdrvCheckMode fix)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    uint64_t *l2_table = qemu_blockalign(bs, s->cluster_size);
    int ret;
    uint64_t refcount;
@@ -1608,7 +1596,7 @@ static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
            }
        }

-        ret = bdrv_pread(bs->file->bs, l2_offset, l2_table,
+        ret = bdrv_pread(bs->file, l2_offset, l2_table,
                         s->l2_size * sizeof(uint64_t));
        if (ret < 0) {
            fprintf(stderr, "ERROR: Could not read L2 table: %s\n",
@@ -1660,8 +1648,7 @@ static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
                goto fail;
            }

-            ret = bdrv_pwrite(bs->file->bs, l2_offset, l2_table,
-                              s->cluster_size);
+            ret = bdrv_pwrite(bs->file, l2_offset, l2_table, s->cluster_size);
            if (ret < 0) {
                fprintf(stderr, "ERROR: Could not write L2 table: %s\n",
                        strerror(-ret));
@@ -1686,7 +1673,7 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
                           BdrvCheckMode fix, bool *rebuild,
                           void **refcount_table, int64_t *nb_clusters)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int64_t i, size;
    int ret;

@@ -1716,11 +1703,11 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
                    goto resize_fail;
                }

-                ret = bdrv_truncate(bs->file->bs, offset + s->cluster_size);
+                ret = bdrv_truncate(bs->file, offset + s->cluster_size);
                if (ret < 0) {
                    goto resize_fail;
                }
-                size = bdrv_getlength(bs->file->bs);
+                size = bdrv_getlength(bs->file);
                if (size < 0) {
                    ret = size;
                    goto resize_fail;
@@ -1789,7 +1776,7 @@ static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
                               BdrvCheckMode fix, bool *rebuild,
                               void **refcount_table, int64_t *nb_clusters)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int64_t i;
    QCowSnapshot *sn;
    int ret;
@@ -1853,7 +1840,7 @@ static void compare_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
                              int64_t *highest_cluster,
                              void *refcount_table, int64_t nb_clusters)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int64_t i;
    uint64_t refcount1, refcount2;
    int ret;
@@ -1930,7 +1917,7 @@ static int64_t alloc_clusters_imrt(BlockDriverState *bs,
                                   int64_t *imrt_nb_clusters,
                                   int64_t *first_free_cluster)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int64_t cluster = *first_free_cluster, i;
    bool first_gap = true;
    int contiguous_free_clusters;
@@ -2000,7 +1987,7 @@ static int rebuild_refcount_structure(BlockDriverState *bs,
                                      void **refcount_table,
                                      int64_t *nb_clusters)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int64_t first_free_cluster = 0, reftable_offset = -1, cluster = 0;
    int64_t refblock_offset, refblock_start, refblock_index;
    uint32_t reftable_size = 0;
@@ -2094,7 +2081,7 @@ write_refblocks:
        on_disk_refblock = (void *)((char *) *refcount_table +
                                    refblock_index * s->cluster_size);

-        ret = bdrv_write(bs->file->bs, refblock_offset / BDRV_SECTOR_SIZE,
+        ret = bdrv_write(bs->file, refblock_offset / BDRV_SECTOR_SIZE,
                         on_disk_refblock, s->cluster_sectors);
        if (ret < 0) {
            fprintf(stderr, "ERROR writing refblock: %s\n", strerror(-ret));
@@ -2143,7 +2130,7 @@ write_refblocks:
    }

    assert(reftable_size < INT_MAX / sizeof(uint64_t));
-    ret = bdrv_pwrite(bs->file->bs, reftable_offset, on_disk_reftable,
+    ret = bdrv_pwrite(bs->file, reftable_offset, on_disk_reftable,
                      reftable_size * sizeof(uint64_t));
    if (ret < 0) {
        fprintf(stderr, "ERROR writing reftable: %s\n", strerror(-ret));
@@ -2155,7 +2142,7 @@ write_refblocks:
                 reftable_offset);
    cpu_to_be32w(&reftable_offset_and_clusters.reftable_clusters,
                 size_to_clusters(s, reftable_size * sizeof(uint64_t)));
-    ret = bdrv_pwrite_sync(bs->file->bs, offsetof(QCowHeader,
+    ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader,
                                              refcount_table_offset),
                           &reftable_offset_and_clusters,
                           sizeof(reftable_offset_and_clusters));
@@ -2187,14 +2174,14 @@ fail:
 int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
                          BdrvCheckMode fix)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    BdrvCheckResult pre_compare_res;
    int64_t size, highest_cluster, nb_clusters;
    void *refcount_table = NULL;
    bool rebuild = false;
    int ret;

-    size = bdrv_getlength(bs->file->bs);
+    size = bdrv_getlength(bs->file);
    if (size < 0) {
        res->check_errors++;
        return size;
@@ -2324,7 +2311,7 @@ fail:
 int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
                                 int64_t size)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int chk = s->overlap_check & ~ign;
    int i, j;

@@ -2403,7 +2390,7 @@ int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
                return -ENOMEM;
            }

-            ret = bdrv_pread(bs->file->bs, l1_ofs, l1, l1_sz2);
+            ret = bdrv_pread(bs->file, l1_ofs, l1, l1_sz2);
            if (ret < 0) {
                g_free(l1);
                return ret;
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -29,7 +29,7 @@

 void qcow2_free_snapshots(BlockDriverState *bs)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int i;

    for(i = 0; i < s->nb_snapshots; i++) {
@@ -43,7 +43,7 @@ void qcow2_free_snapshots(BlockDriverState *bs)

 int qcow2_read_snapshots(BlockDriverState *bs)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowSnapshotHeader h;
    QCowSnapshotExtraData extra;
    QCowSnapshot *sn;
@@ -64,7 +64,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)
    for(i = 0; i < s->nb_snapshots; i++) {
        /* Read statically sized part of the snapshot header */
        offset = align_offset(offset, 8);
-        ret = bdrv_pread(bs->file->bs, offset, &h, sizeof(h));
+        ret = bdrv_pread(bs->file, offset, &h, sizeof(h));
        if (ret < 0) {
            goto fail;
        }
@@ -83,7 +83,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)
        name_size = be16_to_cpu(h.name_size);

        /* Read extra data */
-        ret = bdrv_pread(bs->file->bs, offset, &extra,
+        ret = bdrv_pread(bs->file, offset, &extra,
                         MIN(sizeof(extra), extra_data_size));
        if (ret < 0) {
            goto fail;
@@ -102,7 +102,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)

        /* Read snapshot ID */
        sn->id_str = g_malloc(id_str_size + 1);
-        ret = bdrv_pread(bs->file->bs, offset, sn->id_str, id_str_size);
+        ret = bdrv_pread(bs->file, offset, sn->id_str, id_str_size);
        if (ret < 0) {
            goto fail;
        }
@@ -111,7 +111,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)

        /* Read snapshot name */
        sn->name = g_malloc(name_size + 1);
-        ret = bdrv_pread(bs->file->bs, offset, sn->name, name_size);
+        ret = bdrv_pread(bs->file, offset, sn->name, name_size);
        if (ret < 0) {
            goto fail;
        }
@@ -136,7 +136,7 @@ fail:
 /* add at the end of the file a new list of snapshots */
 static int qcow2_write_snapshots(BlockDriverState *bs)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *sn;
    QCowSnapshotHeader h;
    QCowSnapshotExtraData extra;
@@ -214,25 +214,25 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
        h.name_size = cpu_to_be16(name_size);
        offset = align_offset(offset, 8);

-        ret = bdrv_pwrite(bs->file->bs, offset, &h, sizeof(h));
+        ret = bdrv_pwrite(bs->file, offset, &h, sizeof(h));
        if (ret < 0) {
            goto fail;
        }
        offset += sizeof(h);

-        ret = bdrv_pwrite(bs->file->bs, offset, &extra, sizeof(extra));
+        ret = bdrv_pwrite(bs->file, offset, &extra, sizeof(extra));
        if (ret < 0) {
            goto fail;
        }
        offset += sizeof(extra);

-        ret = bdrv_pwrite(bs->file->bs, offset, sn->id_str, id_str_size);
+        ret = bdrv_pwrite(bs->file, offset, sn->id_str, id_str_size);
        if (ret < 0) {
            goto fail;
        }
        offset += id_str_size;

-        ret = bdrv_pwrite(bs->file->bs, offset, sn->name, name_size);
+        ret = bdrv_pwrite(bs->file, offset, sn->name, name_size);
        if (ret < 0) {
            goto fail;
        }
@@ -254,7 +254,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
    header_data.nb_snapshots        = cpu_to_be32(s->nb_snapshots);
    header_data.snapshots_offset    = cpu_to_be64(snapshots_offset);

-    ret = bdrv_pwrite_sync(bs->file->bs, offsetof(QCowHeader, nb_snapshots),
+    ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, nb_snapshots),
                           &header_data, sizeof(header_data));
    if (ret < 0) {
        goto fail;
@@ -278,7 +278,7 @@ fail:
 static void find_new_snapshot_id(BlockDriverState *bs,
                                 char *id_str, int id_str_size)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *sn;
    int i;
    unsigned long id, id_max = 0;
@@ -296,7 +296,7 @@ static int find_snapshot_by_id_and_name(BlockDriverState *bs,
                                        const char *id,
                                        const char *name)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    int i;

    if (id && name) {
@@ -338,7 +338,7 @@ static int find_snapshot_by_id_or_name(BlockDriverState *bs,
 /* if no id is provided, a new one is constructed */
 int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *new_snapshot_list = NULL;
    QCowSnapshot *old_snapshot_list = NULL;
    QCowSnapshot sn1, *sn = &sn1;
@@ -396,7 +396,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
        goto fail;
    }

-    ret = bdrv_pwrite(bs->file->bs, sn->l1_table_offset, l1_table,
+    ret = bdrv_pwrite(bs->file, sn->l1_table_offset, l1_table,
                      s->l1_size * sizeof(uint64_t));
    if (ret < 0) {
        goto fail;
@@ -461,7 +461,7 @@ fail:
 /* copy the snapshot 'snapshot_name' into the current disk image */
 int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *sn;
    int i, snapshot_index;
    int cur_l1_bytes, sn_l1_bytes;
@@ -509,8 +509,7 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
        goto fail;
    }

-    ret = bdrv_pread(bs->file->bs, sn->l1_table_offset,
-                     sn_l1_table, sn_l1_bytes);
+    ret = bdrv_pread(bs->file, sn->l1_table_offset, sn_l1_table, sn_l1_bytes);
    if (ret < 0) {
        goto fail;
    }
@@ -527,7 +526,7 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
        goto fail;
    }

-    ret = bdrv_pwrite_sync(bs->file->bs, s->l1_table_offset, sn_l1_table,
+    ret = bdrv_pwrite_sync(bs->file, s->l1_table_offset, sn_l1_table,
                           cur_l1_bytes);
    if (ret < 0) {
        goto fail;
@@ -588,7 +587,7 @@ int qcow2_snapshot_delete(BlockDriverState *bs,
                          const char *name,
                          Error **errp)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowSnapshot sn;
    int snapshot_index, ret;

@@ -651,7 +650,7 @@ int qcow2_snapshot_delete(BlockDriverState *bs,

 int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
 {
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QEMUSnapshotInfo *sn_tab, *sn_info;
    QCowSnapshot *sn;
    int i;
@@ -684,7 +683,7 @@ int qcow2_snapshot_load_tmp(BlockDriverState *bs,
                            Error **errp)
 {
    int i, snapshot_index;
-    BDRVQcow2State *s = bs->opaque;
+    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *sn;
    uint64_t *new_l1_table;
    int new_l1_bytes;
@@ -707,14 +706,13 @@ int qcow2_snapshot_load_tmp(BlockDriverState *bs,
        return -EFBIG;
    }
    new_l1_bytes = sn->l1_size * sizeof(uint64_t);
-    new_l1_table = qemu_try_blockalign(bs->file->bs,
+    new_l1_table = qemu_try_blockalign(bs->file,
                                       align_offset(new_l1_bytes, 512));
    if (new_l1_table == NULL) {
        return -ENOMEM;
    }

-    ret = bdrv_pread(bs->file->bs, sn->l1_table_offset,
-                     new_l1_table, new_l1_bytes);
+    ret = bdrv_pread(bs->file, sn->l1_table_offset, new_l1_table, new_l1_bytes);
    if (ret < 0) {
        error_setg(errp, "Failed to read l1 table for snapshot");
        qemu_vfree(new_l1_table);
--- a/block/qcow2.c
+++ b/block/qcow2.c
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -26,7 +26,7 @@
 #define BLOCK_QCOW2_H

 #include "crypto/cipher.h"
-#include "qemu/coroutine.h"
+#include "block/coroutine.h"

 //#define DEBUG_ALLOC
 //#define DEBUG_ALLOC2
@@ -96,7 +96,6 @@
 #define QCOW2_OPT_CACHE_SIZE "cache-size"
 #define QCOW2_OPT_L2_CACHE_SIZE "l2-cache-size"
 #define QCOW2_OPT_REFCOUNT_CACHE_SIZE "refcount-cache-size"
-#define QCOW2_OPT_CACHE_CLEAN_INTERVAL "cache-clean-interval"

 typedef struct QCowHeader {
    uint32_t magic;
@@ -222,7 +221,7 @@ typedef uint64_t Qcow2GetRefcountFunc(const void *refcount_array,
 typedef void Qcow2SetRefcountFunc(void *refcount_array,
                                  uint64_t index, uint64_t value);

-typedef struct BDRVQcow2State {
+typedef struct BDRVQcowState {
    int cluster_bits;
    int cluster_size;
    int cluster_sectors;
@@ -240,8 +239,6 @@ typedef struct BDRVQcow2State {

    Qcow2Cache* l2_table_cache;
    Qcow2Cache* refcount_block_cache;
-    QEMUTimer *cache_clean_timer;
-    unsigned cache_clean_interval;

    uint8_t *cluster_cache;
    uint8_t *cluster_data;
@@ -293,7 +290,9 @@ typedef struct BDRVQcow2State {
     * override) */
    char *image_backing_file;
    char *image_backing_format;
-} BDRVQcow2State;
+} BDRVQcowState;
+
+struct QCowAIOCB;

 typedef struct Qcow2COWRegion {
    /**
@@ -403,28 +402,28 @@ typedef enum QCow2MetadataOverlap {

 #define REFT_OFFSET_MASK 0xfffffffffffffe00ULL

-static inline int64_t start_of_cluster(BDRVQcow2State *s, int64_t offset)
+static inline int64_t start_of_cluster(BDRVQcowState *s, int64_t offset)
 {
    return offset & ~(s->cluster_size - 1);
 }

-static inline int64_t offset_into_cluster(BDRVQcow2State *s, int64_t offset)
+static inline int64_t offset_into_cluster(BDRVQcowState *s, int64_t offset)
 {
    return offset & (s->cluster_size - 1);
 }

-static inline uint64_t size_to_clusters(BDRVQcow2State *s, uint64_t size)
+static inline int size_to_clusters(BDRVQcowState *s, int64_t size)
 {
    return (size + (s->cluster_size - 1)) >> s->cluster_bits;
 }

-static inline int64_t size_to_l1(BDRVQcow2State *s, int64_t size)
+static inline int64_t size_to_l1(BDRVQcowState *s, int64_t size)
 {
    int shift = s->cluster_bits + s->l2_bits;
    return (size + (1ULL << shift) - 1) >> shift;
 }

-static inline int offset_to_l2_index(BDRVQcow2State *s, int64_t offset)
+static inline int offset_to_l2_index(BDRVQcowState *s, int64_t offset)
 {
    return (offset >> s->cluster_bits) & (s->l2_size - 1);
 }
@@ -435,12 +434,12 @@ static inline int64_t align_offset(int64_t offset, int n)
    return offset;
 }

-static inline int64_t qcow2_vm_state_offset(BDRVQcow2State *s)
+static inline int64_t qcow2_vm_state_offset(BDRVQcowState *s)
 {
    return (int64_t)s->l1_vm_state_index << (s->cluster_bits + s->l2_bits);
 }

-static inline uint64_t qcow2_max_refcount_clusters(BDRVQcow2State *s)
+static inline uint64_t qcow2_max_refcount_clusters(BDRVQcowState *s)
 {
    return QCOW_MAX_REFTABLE_SIZE >> s->cluster_bits;
 }
@@ -459,7 +458,7 @@ static inline int qcow2_get_cluster_type(uint64_t l2_entry)
 }

 /* Check whether refcounts are eager or lazy */
-static inline bool qcow2_need_accurate_refcounts(BDRVQcow2State *s)
+static inline bool qcow2_need_accurate_refcounts(BDRVQcowState *s)
 {
    return !(s->incompatible_features & QCOW2_INCOMPAT_DIRTY);
 }
@@ -507,8 +506,8 @@ int qcow2_update_cluster_refcount(BlockDriverState *bs, int64_t cluster_index,
                                  enum qcow2_discard_type type);

 int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size);
-int64_t qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
-                                int64_t nb_clusters);
+int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
+    int nb_clusters);
 int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size);
 void qcow2_free_clusters(BlockDriverState *bs,
                          int64_t offset, int64_t size,
@@ -535,7 +534,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index);
 void qcow2_l2_cache_reset(BlockDriverState *bs);
 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
-int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
+int qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
                          uint8_t *out_buf, const uint8_t *in_buf,
                          int nb_sectors, bool enc, Error **errp);

@@ -582,7 +581,6 @@ int qcow2_cache_set_dependency(BlockDriverState *bs, Qcow2Cache *c,
    Qcow2Cache *dependency);
 void qcow2_cache_depends_on_flush(Qcow2Cache *c);

-void qcow2_cache_clean_unused(BlockDriverState *bs, Qcow2Cache *c);
 int qcow2_cache_empty(BlockDriverState *bs, Qcow2Cache *c);

 int qcow2_cache_get(BlockDriverState *bs, Qcow2Cache *c, uint64_t offset,
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -63,7 +63,7 @@ static void qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    read_table_cb->iov.iov_len = s->header.cluster_size * s->header.table_size,

    qemu_iovec_init_external(qiov, &read_table_cb->iov, 1);
-    bdrv_aio_readv(s->bs->file->bs, offset / BDRV_SECTOR_SIZE, qiov,
+    bdrv_aio_readv(s->bs->file, offset / BDRV_SECTOR_SIZE, qiov,
                   qiov->size / BDRV_SECTOR_SIZE,
                   qed_read_table_cb, read_table_cb);
 }
@@ -152,7 +152,7 @@ static void qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    /* Adjust for offset into table */
    offset += start * sizeof(uint64_t);

-    bdrv_aio_writev(s->bs->file->bs, offset / BDRV_SECTOR_SIZE,
+    bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
                    &write_table_cb->qiov,
                    write_table_cb->qiov.size / BDRV_SECTOR_SIZE,
                    qed_write_table_cb, write_table_cb);
--- a/block/qed.c
+++ b/block/qed.c
@@ -82,7 +82,7 @@ int qed_write_header_sync(BDRVQEDState *s)
    int ret;

    qed_header_cpu_to_le(&s->header, &le);
-    ret = bdrv_pwrite(s->bs->file->bs, 0, &le, sizeof(le));
+    ret = bdrv_pwrite(s->bs->file, 0, &le, sizeof(le));
    if (ret != sizeof(le)) {
        return ret;
    }
@@ -119,7 +119,7 @@ static void qed_write_header_read_cb(void *opaque, int ret)
    /* Update header */
    qed_header_cpu_to_le(&s->header, (QEDHeader *)write_header_cb->buf);

-    bdrv_aio_writev(s->bs->file->bs, 0, &write_header_cb->qiov,
+    bdrv_aio_writev(s->bs->file, 0, &write_header_cb->qiov,
                    write_header_cb->nsectors, qed_write_header_cb,
                    write_header_cb);
 }
@@ -152,7 +152,7 @@ static void qed_write_header(BDRVQEDState *s, BlockCompletionFunc cb,
    write_header_cb->iov.iov_len = len;
    qemu_iovec_init_external(&write_header_cb->qiov, &write_header_cb->iov, 1);

-    bdrv_aio_readv(s->bs->file->bs, 0, &write_header_cb->qiov, nsectors,
+    bdrv_aio_readv(s->bs->file, 0, &write_header_cb->qiov, nsectors,
                   qed_write_header_read_cb, write_header_cb);
 }

@@ -354,6 +354,12 @@ static void qed_cancel_need_check_timer(BDRVQEDState *s)
    timer_del(s->need_check_timer);
 }

+static void bdrv_qed_rebind(BlockDriverState *bs)
+{
+    BDRVQEDState *s = bs->opaque;
+    s->bs = bs;
+}
+
 static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
 {
    BDRVQEDState *s = bs->opaque;
@@ -386,7 +392,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
    s->bs = bs;
    QSIMPLEQ_INIT(&s->allocating_write_reqs);

-    ret = bdrv_pread(bs->file->bs, 0, &le_header, sizeof(le_header));
+    ret = bdrv_pread(bs->file, 0, &le_header, sizeof(le_header));
    if (ret < 0) {
        return ret;
    }
@@ -410,7 +416,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
    }

    /* Round down file size to the last cluster */
-    file_size = bdrv_getlength(bs->file->bs);
+    file_size = bdrv_getlength(bs->file);
    if (file_size < 0) {
        return file_size;
    }
@@ -446,7 +452,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
            return -EINVAL;
        }

-        ret = qed_read_string(bs->file->bs, s->header.backing_filename_offset,
+        ret = qed_read_string(bs->file, s->header.backing_filename_offset,
                              s->header.backing_filename_size, bs->backing_file,
                              sizeof(bs->backing_file));
        if (ret < 0) {
@@ -465,7 +471,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
     * feature is no longer valid.
     */
    if ((s->header.autoclear_features & ~QED_AUTOCLEAR_FEATURE_MASK) != 0 &&
-        !bdrv_is_read_only(bs->file->bs) && !(flags & BDRV_O_INCOMING)) {
+        !bdrv_is_read_only(bs->file) && !(flags & BDRV_O_INCOMING)) {
        s->header.autoclear_features &= QED_AUTOCLEAR_FEATURE_MASK;

        ret = qed_write_header_sync(s);
@@ -474,7 +480,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
        }

        /* From here on only known autoclear feature bits are valid */
-        bdrv_flush(bs->file->bs);
+        bdrv_flush(bs->file);
    }

    s->l1_table = qed_alloc_table(s);
@@ -492,7 +498,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
         * potentially inconsistent images to be opened read-only.  This can
         * aid data recovery from an otherwise inconsistent image.
         */
-        if (!bdrv_is_read_only(bs->file->bs) &&
+        if (!bdrv_is_read_only(bs->file) &&
            !(flags & BDRV_O_INCOMING)) {
            BdrvCheckResult result = {0};

@@ -535,7 +541,7 @@ static void bdrv_qed_close(BlockDriverState *bs)
    bdrv_qed_detach_aio_context(bs);

    /* Ensure writes reach stable storage */
-    bdrv_flush(bs->file->bs);
+    bdrv_flush(bs->file);

    /* Clean shutdown, no check required on next open */
    if (s->header.features & QED_F_NEED_CHECK) {
@@ -577,7 +583,7 @@ static int qed_create(const char *filename, uint32_t cluster_size,

    bs = NULL;
    ret = bdrv_open(&bs, filename, NULL, NULL,
-                    BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_PROTOCOL,
+                    BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_PROTOCOL, NULL,
                    &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
@@ -766,8 +772,8 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
    /* If there is a backing file, get its length.  Treat the absence of a
     * backing file like a zero length backing file.
     */
-    if (s->bs->backing) {
-        int64_t l = bdrv_getlength(s->bs->backing->bs);
+    if (s->bs->backing_hd) {
+        int64_t l = bdrv_getlength(s->bs->backing_hd);
        if (l < 0) {
            cb(opaque, l);
            return;
@@ -796,7 +802,7 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
    qemu_iovec_concat(*backing_qiov, qiov, 0, size);

    BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING_AIO);
-    bdrv_aio_readv(s->bs->backing->bs, pos / BDRV_SECTOR_SIZE,
+    bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,
                   *backing_qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
 }

@@ -833,7 +839,7 @@ static void qed_copy_from_backing_file_write(void *opaque, int ret)
    }

    BLKDBG_EVENT(s->bs->file, BLKDBG_COW_WRITE);
-    bdrv_aio_writev(s->bs->file->bs, copy_cb->offset / BDRV_SECTOR_SIZE,
+    bdrv_aio_writev(s->bs->file, copy_cb->offset / BDRV_SECTOR_SIZE,
                    &copy_cb->qiov, copy_cb->qiov.size / BDRV_SECTOR_SIZE,
                    qed_copy_from_backing_file_cb, copy_cb);
 }
@@ -1049,7 +1055,7 @@ static void qed_aio_write_flush_before_l2_update(void *opaque, int ret)
    QEDAIOCB *acb = opaque;
    BDRVQEDState *s = acb_to_s(acb);

-    if (!bdrv_aio_flush(s->bs->file->bs, qed_aio_write_l2_update_cb, opaque)) {
+    if (!bdrv_aio_flush(s->bs->file, qed_aio_write_l2_update_cb, opaque)) {
        qed_aio_complete(acb, -EIO);
    }
 }
@@ -1075,7 +1081,7 @@ static void qed_aio_write_main(void *opaque, int ret)
    if (acb->find_cluster_ret == QED_CLUSTER_FOUND) {
        next_fn = qed_aio_next_io;
    } else {
-        if (s->bs->backing) {
+        if (s->bs->backing_hd) {
            next_fn = qed_aio_write_flush_before_l2_update;
        } else {
            next_fn = qed_aio_write_l2_update_cb;
@@ -1083,7 +1089,7 @@ static void qed_aio_write_main(void *opaque, int ret)
    }

    BLKDBG_EVENT(s->bs->file, BLKDBG_WRITE_AIO);
-    bdrv_aio_writev(s->bs->file->bs, offset / BDRV_SECTOR_SIZE,
+    bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
                    &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
                    next_fn, acb);
 }
@@ -1133,7 +1139,7 @@ static void qed_aio_write_prefill(void *opaque, int ret)
 static bool qed_should_set_need_check(BDRVQEDState *s)
 {
    /* The flush before L2 update path ensures consistency */
-    if (s->bs->backing) {
+    if (s->bs->backing_hd) {
        return false;
    }

@@ -1315,7 +1321,7 @@ static void qed_aio_read_data(void *opaque, int ret,
    }

    BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-    bdrv_aio_readv(bs->file->bs, offset / BDRV_SECTOR_SIZE,
+    bdrv_aio_readv(bs->file, offset / BDRV_SECTOR_SIZE,
                   &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
                   qed_aio_next_io, acb);
    return;
@@ -1437,7 +1443,7 @@ static int coroutine_fn bdrv_qed_co_write_zeroes(BlockDriverState *bs,
    struct iovec iov;

    /* Refuse if there are untouched backing file sectors */
-    if (bs->backing) {
+    if (bs->backing_hd) {
        if (qed_offset_into_cluster(s, sector_num * BDRV_SECTOR_SIZE) != 0) {
            return -ENOTSUP;
        }
@@ -1574,7 +1580,7 @@ static int bdrv_qed_change_backing_file(BlockDriverState *bs,
    }

    /* Write new header */
-    ret = bdrv_pwrite_sync(bs->file->bs, 0, buffer, buffer_len);
+    ret = bdrv_pwrite_sync(bs->file, 0, buffer, buffer_len);
    g_free(buffer);
    if (ret == 0) {
        memcpy(&s->header, &new_header, sizeof(new_header));
@@ -1590,7 +1596,7 @@ static void bdrv_qed_invalidate_cache(BlockDriverState *bs, Error **errp)

    bdrv_qed_close(bs);

-    bdrv_invalidate_cache(bs->file->bs, &local_err);
+    bdrv_invalidate_cache(bs->file, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        return;
@@ -1658,6 +1664,7 @@ static BlockDriver bdrv_qed = {
    .supports_backing         = true,

    .bdrv_probe               = bdrv_qed_probe,
+    .bdrv_rebind              = bdrv_qed_rebind,
    .bdrv_open                = bdrv_qed_open,
    .bdrv_close               = bdrv_qed_close,
    .bdrv_reopen_prepare      = bdrv_qed_reopen_prepare,
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -64,7 +64,7 @@ typedef struct QuorumVotes {

 /* the following structure holds the state of one quorum instance */
 typedef struct BDRVQuorumState {
-    BdrvChild **children;  /* children BlockDriverStates */
+    BlockDriverState **bs; /* children BlockDriverStates */
    int num_children;      /* children count */
    int threshold;         /* if less than threshold children reads gave the
                            * same result a quorum error occurs.
@@ -336,7 +336,7 @@ static void quorum_report_bad_versions(BDRVQuorumState *s,
            continue;
        }
        QLIST_FOREACH(item, &version->items, next) {
-            quorum_report_bad(acb, s->children[item->index]->bs->node_name, 0);
+            quorum_report_bad(acb, s->bs[item->index]->node_name, 0);
        }
    }
 }
@@ -369,9 +369,8 @@ static bool quorum_rewrite_bad_versions(BDRVQuorumState *s, QuorumAIOCB *acb,
            continue;
        }
        QLIST_FOREACH(item, &version->items, next) {
-            bdrv_aio_writev(s->children[item->index]->bs, acb->sector_num,
-                            acb->qiov, acb->nb_sectors, quorum_rewrite_aio_cb,
-                            acb);
+            bdrv_aio_writev(s->bs[item->index], acb->sector_num, acb->qiov,
+                            acb->nb_sectors, quorum_rewrite_aio_cb, acb);
        }
    }

@@ -640,13 +639,13 @@ static BlockAIOCB *read_quorum_children(QuorumAIOCB *acb)
    int i;

    for (i = 0; i < s->num_children; i++) {
-        acb->qcrs[i].buf = qemu_blockalign(s->children[i]->bs, acb->qiov->size);
+        acb->qcrs[i].buf = qemu_blockalign(s->bs[i], acb->qiov->size);
        qemu_iovec_init(&acb->qcrs[i].qiov, acb->qiov->niov);
        qemu_iovec_clone(&acb->qcrs[i].qiov, acb->qiov, acb->qcrs[i].buf);
    }

    for (i = 0; i < s->num_children; i++) {
-        bdrv_aio_readv(s->children[i]->bs, acb->sector_num, &acb->qcrs[i].qiov,
+        bdrv_aio_readv(s->bs[i], acb->sector_num, &acb->qcrs[i].qiov,
                       acb->nb_sectors, quorum_aio_cb, &acb->qcrs[i]);
    }

@@ -657,12 +656,12 @@ static BlockAIOCB *read_fifo_child(QuorumAIOCB *acb)
 {
    BDRVQuorumState *s = acb->common.bs->opaque;

-    acb->qcrs[acb->child_iter].buf =
-        qemu_blockalign(s->children[acb->child_iter]->bs, acb->qiov->size);
+    acb->qcrs[acb->child_iter].buf = qemu_blockalign(s->bs[acb->child_iter],
+                                                     acb->qiov->size);
    qemu_iovec_init(&acb->qcrs[acb->child_iter].qiov, acb->qiov->niov);
    qemu_iovec_clone(&acb->qcrs[acb->child_iter].qiov, acb->qiov,
                     acb->qcrs[acb->child_iter].buf);
-    bdrv_aio_readv(s->children[acb->child_iter]->bs, acb->sector_num,
+    bdrv_aio_readv(s->bs[acb->child_iter], acb->sector_num,
                   &acb->qcrs[acb->child_iter].qiov, acb->nb_sectors,
                   quorum_aio_cb, &acb->qcrs[acb->child_iter]);

@@ -703,8 +702,8 @@ static BlockAIOCB *quorum_aio_writev(BlockDriverState *bs,
    int i;

    for (i = 0; i < s->num_children; i++) {
-        acb->qcrs[i].aiocb = bdrv_aio_writev(s->children[i]->bs, sector_num,
-                                             qiov, nb_sectors, &quorum_aio_cb,
+        acb->qcrs[i].aiocb = bdrv_aio_writev(s->bs[i], sector_num, qiov,
+                                             nb_sectors, &quorum_aio_cb,
                                             &acb->qcrs[i]);
    }

@@ -718,12 +717,12 @@ static int64_t quorum_getlength(BlockDriverState *bs)
    int i;

    /* check that all file have the same length */
-    result = bdrv_getlength(s->children[0]->bs);
+    result = bdrv_getlength(s->bs[0]);
    if (result < 0) {
        return result;
    }
    for (i = 1; i < s->num_children; i++) {
-        int64_t value = bdrv_getlength(s->children[i]->bs);
+        int64_t value = bdrv_getlength(s->bs[i]);
        if (value < 0) {
            return value;
        }
@@ -742,7 +741,7 @@ static void quorum_invalidate_cache(BlockDriverState *bs, Error **errp)
    int i;

    for (i = 0; i < s->num_children; i++) {
-        bdrv_invalidate_cache(s->children[i]->bs, &local_err);
+        bdrv_invalidate_cache(s->bs[i], &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
@@ -763,7 +762,7 @@ static coroutine_fn int quorum_co_flush(BlockDriverState *bs)
    error_votes.compare = quorum_64bits_compare;

    for (i = 0; i < s->num_children; i++) {
-        result = bdrv_co_flush(s->children[i]->bs);
+        result = bdrv_co_flush(s->bs[i]);
        result_value.l = result;
        quorum_count_vote(&error_votes, &result_value, i);
    }
@@ -783,7 +782,7 @@ static bool quorum_recurse_is_first_non_filter(BlockDriverState *bs,
    int i;

    for (i = 0; i < s->num_children; i++) {
-        bool perm = bdrv_recurse_is_first_non_filter(s->children[i]->bs,
+        bool perm = bdrv_recurse_is_first_non_filter(s->bs[i],
                                                     candidate);
        if (perm) {
            return true;
@@ -890,12 +889,6 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
    }

    s->threshold = qemu_opt_get_number(opts, QUORUM_OPT_VOTE_THRESHOLD, 0);
-    /* and validate it against s->num_children */
-    ret = quorum_valid_threshold(s->threshold, s->num_children, &local_err);
-    if (ret < 0) {
-        goto exit;
-    }
-
    ret = parse_read_pattern(qemu_opt_get(opts, QUORUM_OPT_READ_PATTERN));
    if (ret < 0) {
        error_setg(&local_err, "Please set read-pattern as fifo or quorum");
@@ -904,6 +897,12 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
    s->read_pattern = ret;

    if (s->read_pattern == QUORUM_READ_PATTERN_QUORUM) {
+        /* and validate it against s->num_children */
+        ret = quorum_valid_threshold(s->threshold, s->num_children, &local_err);
+        if (ret < 0) {
+            goto exit;
+        }
+
        /* is the driver in blkverify mode */
        if (qemu_opt_get_bool(opts, QUORUM_OPT_BLKVERIFY, false) &&
            s->num_children == 2 && s->threshold == 2) {
@@ -923,8 +922,8 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
        }
    }

-    /* allocate the children array */
-    s->children = g_new0(BdrvChild *, s->num_children);
+    /* allocate the children BlockDriverState array */
+    s->bs = g_new0(BlockDriverState *, s->num_children);
    opened = g_new0(bool, s->num_children);

    for (i = 0; i < s->num_children; i++) {
@@ -932,10 +931,9 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
        ret = snprintf(indexstr, 32, "children.%d", i);
        assert(ret < 32);

-        s->children[i] = bdrv_open_child(NULL, options, indexstr, bs,
+        ret = bdrv_open_image(&s->bs[i], NULL, options, indexstr, bs,
                              &child_format, false, &local_err);
-        if (local_err) {
-            ret = -EINVAL;
+        if (ret < 0) {
            goto close_exit;
        }

@@ -951,9 +949,9 @@ close_exit:
        if (!opened[i]) {
            continue;
        }
-        bdrv_unref_child(bs, s->children[i]);
+        bdrv_unref(s->bs[i]);
    }
-    g_free(s->children);
+    g_free(s->bs);
    g_free(opened);
 exit:
    qemu_opts_del(opts);
@@ -970,10 +968,10 @@ static void quorum_close(BlockDriverState *bs)
    int i;

    for (i = 0; i < s->num_children; i++) {
-        bdrv_unref_child(bs, s->children[i]);
+        bdrv_unref(s->bs[i]);
    }

-    g_free(s->children);
+    g_free(s->bs);
 }

 static void quorum_detach_aio_context(BlockDriverState *bs)
@@ -982,7 +980,7 @@ static void quorum_detach_aio_context(BlockDriverState *bs)
    int i;

    for (i = 0; i < s->num_children; i++) {
-        bdrv_detach_aio_context(s->children[i]->bs);
+        bdrv_detach_aio_context(s->bs[i]);
    }
 }

@@ -993,7 +991,7 @@ static void quorum_attach_aio_context(BlockDriverState *bs,
    int i;

    for (i = 0; i < s->num_children; i++) {
-        bdrv_attach_aio_context(s->children[i]->bs, new_context);
+        bdrv_attach_aio_context(s->bs[i], new_context);
    }
 }

@@ -1005,17 +1003,16 @@ static void quorum_refresh_filename(BlockDriverState *bs)
    int i;

    for (i = 0; i < s->num_children; i++) {
-        bdrv_refresh_filename(s->children[i]->bs);
-        if (!s->children[i]->bs->full_open_options) {
+        bdrv_refresh_filename(s->bs[i]);
+        if (!s->bs[i]->full_open_options) {
            return;
        }
    }

    children = qlist_new();
    for (i = 0; i < s->num_children; i++) {
-        QINCREF(s->children[i]->bs->full_open_options);
-        qlist_append_obj(children,
-                         QOBJECT(s->children[i]->bs->full_open_options));
+        QINCREF(s->bs[i]->full_open_options);
+        qlist_append_obj(children, QOBJECT(s->bs[i]->full_open_options));
    }

    opts = qdict_new();
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -127,6 +127,11 @@ do { \

 #define FTYPE_FILE   0
 #define FTYPE_CD     1
+#define FTYPE_FD     2
+
+/* if the FD is not accessed during that time (in ns), we try to
+   reopen it to see if the disk has been changed */
+#define FD_OPEN_TIMEOUT (1000000000)

 #define MAX_BLOCKSIZE	4096

@@ -136,6 +141,13 @@ typedef struct BDRVRawState {
    int open_flags;
    size_t buf_align;

+#if defined(__linux__)
+    /* linux floppy specific */
+    int64_t fd_open_time;
+    int64_t fd_error_time;
+    int fd_got_error;
+    int fd_media_changed;
+#endif
 #ifdef CONFIG_LINUX_AIO
    int use_aio;
    void *aio_ctx;
@@ -507,16 +519,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
                     "future QEMU versions.\n",
                     bs->filename);
    }
-#else
-    if (bdrv_flags & BDRV_O_NATIVE_AIO) {
-        error_printf("WARNING: aio=native was specified for '%s', but "
-                     "is not supported in this build. Falling back to "
-                     "aio=threads.\n"
-                     "         This will become an error condition in "
-                     "future QEMU versions.\n",
-                     bs->filename);
-    }
-#endif /* !defined(CONFIG_LINUX_AIO) */
+#endif

    s->has_discard = true;
    s->has_write_zeroes = true;
@@ -623,7 +626,7 @@ static int raw_reopen_prepare(BDRVReopenState *state,
    }
 #endif

-    if (s->type == FTYPE_CD) {
+    if (s->type == FTYPE_FD || s->type == FTYPE_CD) {
        raw_s->open_flags |= O_NONBLOCK;
    }

@@ -667,19 +670,13 @@ static int raw_reopen_prepare(BDRVReopenState *state,

    /* If we cannot use fcntl, or fcntl failed, fall back to qemu_open() */
    if (raw_s->fd == -1) {
-        const char *normalized_filename = state->bs->filename;
-        ret = raw_normalize_devicepath(&normalized_filename);
-        if (ret < 0) {
-            error_setg_errno(errp, -ret, "Could not normalize device path");
-        } else {
        assert(!(raw_s->open_flags & O_CREAT));
-            raw_s->fd = qemu_open(normalized_filename, raw_s->open_flags);
+        raw_s->fd = qemu_open(state->bs->filename, raw_s->open_flags);
        if (raw_s->fd == -1) {
            error_setg_errno(errp, errno, "Could not reopen file");
            ret = -1;
        }
    }
-    }

    /* Fail already reopen_prepare() if we can't get a working O_DIRECT
     * alignment with the new fd. */
@@ -1256,7 +1253,7 @@ static int aio_worker(void *arg)
        break;
    }

-    g_free(aiocb);
+    g_slice_free(RawPosixAIOData, aiocb);
    return ret;
 }

@@ -1264,7 +1261,7 @@ static int paio_submit_co(BlockDriverState *bs, int fd,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        int type)
 {
-    RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
+    RawPosixAIOData *acb = g_slice_new(RawPosixAIOData);
    ThreadPool *pool;

    acb->bs = bs;
@@ -1289,7 +1286,7 @@ static BlockAIOCB *paio_submit(BlockDriverState *bs, int fd,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockCompletionFunc *cb, void *opaque, int type)
 {
-    RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
+    RawPosixAIOData *acb = g_slice_new(RawPosixAIOData);
    ThreadPool *pool;

    acb->bs = bs;
@@ -1645,7 +1642,7 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
        goto out;
    }

-    fd = qemu_open(filename, O_RDWR | O_CREAT | O_TRUNC | O_BINARY,
+    fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
                   0644);
    if (fd < 0) {
        result = -errno;
@@ -2175,6 +2172,47 @@ static int hdev_open(BlockDriverState *bs, QDict *options, int flags,
 }

 #if defined(__linux__)
+/* Note: we do not have a reliable method to detect if the floppy is
+   present. The current method is to try to open the floppy at every
+   I/O and to keep it opened during a few hundreds of ms. */
+static int fd_open(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    int last_media_present;
+
+    if (s->type != FTYPE_FD)
+        return 0;
+    last_media_present = (s->fd >= 0);
+    if (s->fd >= 0 &&
+        (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - s->fd_open_time) >= FD_OPEN_TIMEOUT) {
+        qemu_close(s->fd);
+        s->fd = -1;
+        DPRINTF("Floppy closed\n");
+    }
+    if (s->fd < 0) {
+        if (s->fd_got_error &&
+            (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - s->fd_error_time) < FD_OPEN_TIMEOUT) {
+            DPRINTF("No floppy (open delayed)\n");
+            return -EIO;
+        }
+        s->fd = qemu_open(bs->filename, s->open_flags & ~O_NONBLOCK);
+        if (s->fd < 0) {
+            s->fd_error_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
+            s->fd_got_error = 1;
+            if (last_media_present)
+                s->fd_media_changed = 1;
+            DPRINTF("No floppy\n");
+            return -EIO;
+        }
+        DPRINTF("Floppy opened\n");
+    }
+    if (!last_media_present)
+        s->fd_media_changed = 1;
+    s->fd_open_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
+    s->fd_got_error = 0;
+    return 0;
+}
+
 static int hdev_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
 {
    BDRVRawState *s = bs->opaque;
@@ -2193,7 +2231,7 @@ static BlockAIOCB *hdev_aio_ioctl(BlockDriverState *bs,
    if (fd_open(bs) < 0)
        return NULL;

-    acb = g_new(RawPosixAIOData, 1);
+    acb = g_slice_new(RawPosixAIOData);
    acb->bs = bs;
    acb->aio_type = QEMU_AIO_IOCTL;
    acb->aio_fildes = s->fd;
@@ -2203,8 +2241,8 @@ static BlockAIOCB *hdev_aio_ioctl(BlockDriverState *bs,
    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
    return thread_pool_submit_aio(pool, aio_worker, acb, cb, opaque);
 }
-#endif /* linux */

+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 static int fd_open(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
@@ -2214,6 +2252,14 @@ static int fd_open(BlockDriverState *bs)
        return 0;
    return -EIO;
 }
+#else /* !linux && !FreeBSD */
+
+static int fd_open(BlockDriverState *bs)
+{
+    return 0;
+}
+
+#endif /* !linux && !FreeBSD */

 static coroutine_fn BlockAIOCB *hdev_aio_discard(BlockDriverState *bs,
    int64_t sector_num, int nb_sectors,
@@ -2257,22 +2303,17 @@ static int hdev_create(const char *filename, QemuOpts *opts,
    int64_t total_size = 0;
    bool has_prefix;

-    /* This function is used by both protocol block drivers and therefore either
-     * of these prefixes may be given.
+    /* This function is used by all three protocol block drivers and therefore
+     * any of these three prefixes may be given.
     * The return value has to be stored somewhere, otherwise this is an error
     * due to -Werror=unused-value. */
    has_prefix =
        strstart(filename, "host_device:", &filename) ||
-        strstart(filename, "host_cdrom:" , &filename);
+        strstart(filename, "host_cdrom:" , &filename) ||
+        strstart(filename, "host_floppy:", &filename);

    (void)has_prefix;

-    ret = raw_normalize_devicepath(&filename);
-    if (ret < 0) {
-        error_setg_errno(errp, -ret, "Could not normalize device path");
-        return ret;
-    }
-
    /* Read out options */
    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
                          BDRV_SECTOR_SIZE);
@@ -2343,6 +2384,155 @@ static BlockDriver bdrv_host_device = {
 #endif
 };

+#ifdef __linux__
+static void floppy_parse_filename(const char *filename, QDict *options,
+                                  Error **errp)
+{
+    /* The prefix is optional, just as for "file". */
+    strstart(filename, "host_floppy:", &filename);
+
+    qdict_put_obj(options, "filename", QOBJECT(qstring_from_str(filename)));
+}
+
+static int floppy_open(BlockDriverState *bs, QDict *options, int flags,
+                       Error **errp)
+{
+    BDRVRawState *s = bs->opaque;
+    Error *local_err = NULL;
+    int ret;
+
+    s->type = FTYPE_FD;
+
+    /* open will not fail even if no floppy is inserted, so add O_NONBLOCK */
+    ret = raw_open_common(bs, options, flags, O_NONBLOCK, &local_err);
+    if (ret) {
+        if (local_err) {
+            error_propagate(errp, local_err);
+        }
+        return ret;
+    }
+
+    /* close fd so that we can reopen it as needed */
+    qemu_close(s->fd);
+    s->fd = -1;
+    s->fd_media_changed = 1;
+
+    error_report("Host floppy pass-through is deprecated");
+    error_printf("Support for it will be removed in a future release.\n");
+    return 0;
+}
+
+static int floppy_probe_device(const char *filename)
+{
+    int fd, ret;
+    int prio = 0;
+    struct floppy_struct fdparam;
+    struct stat st;
+
+    if (strstart(filename, "/dev/fd", NULL) &&
+        !strstart(filename, "/dev/fdset/", NULL) &&
+        !strstart(filename, "/dev/fd/", NULL)) {
+        prio = 50;
+    }
+
+    fd = qemu_open(filename, O_RDONLY | O_NONBLOCK);
+    if (fd < 0) {
+        goto out;
+    }
+    ret = fstat(fd, &st);
+    if (ret == -1 || !S_ISBLK(st.st_mode)) {
+        goto outc;
+    }
+
+    /* Attempt to detect via a floppy specific ioctl */
+    ret = ioctl(fd, FDGETPRM, &fdparam);
+    if (ret >= 0)
+        prio = 100;
+
+outc:
+    qemu_close(fd);
+out:
+    return prio;
+}
+
+
+static int floppy_is_inserted(BlockDriverState *bs)
+{
+    return fd_open(bs) >= 0;
+}
+
+static int floppy_media_changed(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    /*
+     * XXX: we do not have a true media changed indication.
+     * It does not work if the floppy is changed without trying to read it.
+     */
+    fd_open(bs);
+    ret = s->fd_media_changed;
+    s->fd_media_changed = 0;
+    DPRINTF("Floppy changed=%d\n", ret);
+    return ret;
+}
+
+static void floppy_eject(BlockDriverState *bs, bool eject_flag)
+{
+    BDRVRawState *s = bs->opaque;
+    int fd;
+
+    if (s->fd >= 0) {
+        qemu_close(s->fd);
+        s->fd = -1;
+    }
+    fd = qemu_open(bs->filename, s->open_flags | O_NONBLOCK);
+    if (fd >= 0) {
+        if (ioctl(fd, FDEJECT, 0) < 0)
+            perror("FDEJECT");
+        qemu_close(fd);
+    }
+}
+
+static BlockDriver bdrv_host_floppy = {
+    .format_name        = "host_floppy",
+    .protocol_name      = "host_floppy",
+    .instance_size      = sizeof(BDRVRawState),
+    .bdrv_needs_filename = true,
+    .bdrv_probe_device	= floppy_probe_device,
+    .bdrv_parse_filename = floppy_parse_filename,
+    .bdrv_file_open     = floppy_open,
+    .bdrv_close         = raw_close,
+    .bdrv_reopen_prepare = raw_reopen_prepare,
+    .bdrv_reopen_commit  = raw_reopen_commit,
+    .bdrv_reopen_abort   = raw_reopen_abort,
+    .bdrv_create         = hdev_create,
+    .create_opts         = &raw_create_opts,
+
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
+    .bdrv_aio_flush	= raw_aio_flush,
+    .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_io_plug = raw_aio_plug,
+    .bdrv_io_unplug = raw_aio_unplug,
+    .bdrv_flush_io_queue = raw_aio_flush_io_queue,
+
+    .bdrv_truncate      = raw_truncate,
+    .bdrv_getlength      = raw_getlength,
+    .has_variable_length = true,
+    .bdrv_get_allocated_file_size
+                        = raw_get_allocated_file_size,
+
+    .bdrv_detach_aio_context = raw_detach_aio_context,
+    .bdrv_attach_aio_context = raw_attach_aio_context,
+
+    /* removable device support */
+    .bdrv_is_inserted   = floppy_is_inserted,
+    .bdrv_media_changed = floppy_media_changed,
+    .bdrv_eject         = floppy_eject,
+};
+#endif
+
 #if defined(__linux__) || defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 static void cdrom_parse_filename(const char *filename, QDict *options,
                                 Error **errp)
@@ -2398,13 +2588,15 @@ out:
    return prio;
 }

-static bool cdrom_is_inserted(BlockDriverState *bs)
+static int cdrom_is_inserted(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
    int ret;

    ret = ioctl(s->fd, CDROM_DRIVE_STATUS, CDSL_CURRENT);
-    return ret == CDS_DISC_OK;
+    if (ret == CDS_DISC_OK)
+        return 1;
+    return 0;
 }

 static void cdrom_eject(BlockDriverState *bs, bool eject_flag)
@@ -2530,7 +2722,7 @@ static int cdrom_reopen(BlockDriverState *bs)
    return 0;
 }

-static bool cdrom_is_inserted(BlockDriverState *bs)
+static int cdrom_is_inserted(BlockDriverState *bs)
 {
    return raw_getlength(bs) > 0;
 }
@@ -2618,6 +2810,7 @@ static void bdrv_file_init(void)
    bdrv_register(&bdrv_file);
    bdrv_register(&bdrv_host_device);
 #ifdef __linux__
+    bdrv_register(&bdrv_host_floppy);
    bdrv_register(&bdrv_host_cdrom);
 #endif
 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -119,9 +119,9 @@ static int aio_worker(void *arg)
    case QEMU_AIO_WRITE:
        count = handle_aiocb_rw(aiocb);
        if (count == aiocb->aio_nbytes) {
-            ret = 0;
+            count = 0;
        } else {
-            ret = -EINVAL;
+            count = -EINVAL;
        }
        break;
    case QEMU_AIO_FLUSH:
@@ -135,7 +135,7 @@ static int aio_worker(void *arg)
        break;
    }

-    g_free(aiocb);
+    g_slice_free(RawWin32AIOData, aiocb);
    return ret;
 }

@@ -143,7 +143,7 @@ static BlockAIOCB *paio_submit(BlockDriverState *bs, HANDLE hfile,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockCompletionFunc *cb, void *opaque, int type)
 {
-    RawWin32AIOData *acb = g_new(RawWin32AIOData, 1);
+    RawWin32AIOData *acb = g_slice_new(RawWin32AIOData);
    ThreadPool *pool;

    acb->bs = bs;
--- a/block/raw_bsd.c
+++ b/block/raw_bsd.c
@@ -52,7 +52,7 @@ static int coroutine_fn raw_co_readv(BlockDriverState *bs, int64_t sector_num,
                                     int nb_sectors, QEMUIOVector *qiov)
 {
    BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-    return bdrv_co_readv(bs->file->bs, sector_num, nb_sectors, qiov);
+    return bdrv_co_readv(bs->file, sector_num, nb_sectors, qiov);
 }

 static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,
@@ -75,7 +75,7 @@ static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,
            return 0;
        }

-        buf = qemu_try_blockalign(bs->file->bs, 512);
+        buf = qemu_try_blockalign(bs->file, 512);
        if (!buf) {
            ret = -ENOMEM;
            goto fail;
@@ -102,7 +102,7 @@ static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,
    }

    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
-    ret = bdrv_co_writev(bs->file->bs, sector_num, nb_sectors, qiov);
+    ret = bdrv_co_writev(bs->file, sector_num, nb_sectors, qiov);

 fail:
    if (qiov == &local_qiov) {
@@ -125,53 +125,58 @@ static int coroutine_fn raw_co_write_zeroes(BlockDriverState *bs,
                                            int64_t sector_num, int nb_sectors,
                                            BdrvRequestFlags flags)
 {
-    return bdrv_co_write_zeroes(bs->file->bs, sector_num, nb_sectors, flags);
+    return bdrv_co_write_zeroes(bs->file, sector_num, nb_sectors, flags);
 }

 static int coroutine_fn raw_co_discard(BlockDriverState *bs,
                                       int64_t sector_num, int nb_sectors)
 {
-    return bdrv_co_discard(bs->file->bs, sector_num, nb_sectors);
+    return bdrv_co_discard(bs->file, sector_num, nb_sectors);
 }

 static int64_t raw_getlength(BlockDriverState *bs)
 {
-    return bdrv_getlength(bs->file->bs);
+    return bdrv_getlength(bs->file);
 }

 static int raw_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
-    return bdrv_get_info(bs->file->bs, bdi);
+    return bdrv_get_info(bs->file, bdi);
 }

 static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
 {
-    bs->bl = bs->file->bs->bl;
+    bs->bl = bs->file->bl;
 }

 static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
-    return bdrv_truncate(bs->file->bs, offset);
+    return bdrv_truncate(bs->file, offset);
+}
+
+static int raw_is_inserted(BlockDriverState *bs)
+{
+    return bdrv_is_inserted(bs->file);
 }

 static int raw_media_changed(BlockDriverState *bs)
 {
-    return bdrv_media_changed(bs->file->bs);
+    return bdrv_media_changed(bs->file);
 }

 static void raw_eject(BlockDriverState *bs, bool eject_flag)
 {
-    bdrv_eject(bs->file->bs, eject_flag);
+    bdrv_eject(bs->file, eject_flag);
 }

 static void raw_lock_medium(BlockDriverState *bs, bool locked)
 {
-    bdrv_lock_medium(bs->file->bs, locked);
+    bdrv_lock_medium(bs->file, locked);
 }

 static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
 {
-    return bdrv_ioctl(bs->file->bs, req, buf);
+    return bdrv_ioctl(bs->file, req, buf);
 }

 static BlockAIOCB *raw_aio_ioctl(BlockDriverState *bs,
@@ -179,12 +184,12 @@ static BlockAIOCB *raw_aio_ioctl(BlockDriverState *bs,
                                 BlockCompletionFunc *cb,
                                 void *opaque)
 {
-    return bdrv_aio_ioctl(bs->file->bs, req, buf, cb, opaque);
+    return bdrv_aio_ioctl(bs->file, req, buf, cb, opaque);
 }

 static int raw_has_zero_init(BlockDriverState *bs)
 {
-    return bdrv_has_zero_init(bs->file->bs);
+    return bdrv_has_zero_init(bs->file);
 }

 static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
@@ -202,7 +207,7 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
 static int raw_open(BlockDriverState *bs, QDict *options, int flags,
                    Error **errp)
 {
-    bs->sg = bs->file->bs->sg;
+    bs->sg = bs->file->sg;

    if (bs->probed && !bdrv_is_read_only(bs)) {
        fprintf(stderr,
@@ -212,7 +217,7 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
                "raw images, write operations on block 0 will be restricted.\n"
                "         Specify the 'raw' format explicitly to remove the "
                "restrictions.\n",
-                bs->file->bs->filename);
+                bs->file->filename);
    }

    return 0;
@@ -232,12 +237,12 @@ static int raw_probe(const uint8_t *buf, int buf_size, const char *filename)

 static int raw_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
 {
-    return bdrv_probe_blocksizes(bs->file->bs, bsz);
+    return bdrv_probe_blocksizes(bs->file, bsz);
 }

 static int raw_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
 {
-    return bdrv_probe_geometry(bs->file->bs, geo);
+    return bdrv_probe_geometry(bs->file, geo);
 }

 BlockDriver bdrv_raw = {
@@ -259,6 +264,7 @@ BlockDriver bdrv_raw = {
    .bdrv_refresh_limits  = &raw_refresh_limits,
    .bdrv_probe_blocksizes = &raw_probe_blocksizes,
    .bdrv_probe_geometry  = &raw_probe_geometry,
+    .bdrv_is_inserted     = &raw_is_inserted,
    .bdrv_media_changed   = &raw_media_changed,
    .bdrv_eject           = &raw_eject,
    .bdrv_lock_medium     = &raw_lock_medium,
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -28,6 +28,7 @@
 #define SD_OP_READ_OBJ       0x02
 #define SD_OP_WRITE_OBJ      0x03
 /* 0x04 is used internally by Sheepdog */
+#define SD_OP_DISCARD_OBJ    0x05

 #define SD_OP_NEW_VDI        0x11
 #define SD_OP_LOCK_VDI       0x12
@@ -317,7 +318,7 @@ enum AIOCBState {
    AIOCB_DISCARD_OBJ,
 };

-#define AIOCBOverlapping(x, y)                                 \
+#define AIOCBOverwrapping(x, y)                                 \
    (!(x->max_affect_data_idx < y->min_affect_data_idx          \
       || y->max_affect_data_idx < x->min_affect_data_idx))

@@ -341,15 +342,6 @@ struct SheepdogAIOCB {
    uint32_t min_affect_data_idx;
    uint32_t max_affect_data_idx;

-    /*
-     * The difference between affect_data_idx and dirty_data_idx:
-     * affect_data_idx represents range of index of all request types.
-     * dirty_data_idx represents range of index updated by COW requests.
-     * dirty_data_idx is used for updating an inode object.
-     */
-    uint32_t min_dirty_data_idx;
-    uint32_t max_dirty_data_idx;
-
    QLIST_ENTRY(SheepdogAIOCB) aiocb_siblings;
 };

@@ -359,6 +351,9 @@ typedef struct BDRVSheepdogState {

    SheepdogInode inode;

+    uint32_t min_dirty_data_idx;
+    uint32_t max_dirty_data_idx;
+
    char name[SD_MAX_VDI_LEN];
    bool is_snapshot;
    uint32_t cache_flags;
@@ -378,15 +373,10 @@ typedef struct BDRVSheepdogState {
    QLIST_HEAD(inflight_aio_head, AIOReq) inflight_aio_head;
    QLIST_HEAD(failed_aio_head, AIOReq) failed_aio_head;

-    CoQueue overlapping_queue;
+    CoQueue overwrapping_queue;
    QLIST_HEAD(inflight_aiocb_head, SheepdogAIOCB) inflight_aiocb_head;
 } BDRVSheepdogState;

-typedef struct BDRVSheepdogReopenState {
-    int fd;
-    int cache_flags;
-} BDRVSheepdogReopenState;
-
 static const char * sd_strerror(int err)
 {
    int i;
@@ -566,9 +556,6 @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
    acb->max_affect_data_idx = (acb->sector_num * BDRV_SECTOR_SIZE +
                              acb->nb_sectors * BDRV_SECTOR_SIZE) / object_size;

-    acb->min_dirty_data_idx = UINT32_MAX;
-    acb->max_dirty_data_idx = 0;
-
    return acb;
 }

@@ -651,16 +638,14 @@ static coroutine_fn void do_co_req(void *opaque)
    unsigned int *rlen = srco->rlen;

    co = qemu_coroutine_self();
-    aio_set_fd_handler(srco->aio_context, sockfd, false,
-                       NULL, restart_co_req, co);
+    aio_set_fd_handler(srco->aio_context, sockfd, NULL, restart_co_req, co);

    ret = send_co_req(sockfd, hdr, data, wlen);
    if (ret < 0) {
        goto out;
    }

-    aio_set_fd_handler(srco->aio_context, sockfd, false,
-                       restart_co_req, NULL, co);
+    aio_set_fd_handler(srco->aio_context, sockfd, restart_co_req, NULL, co);

    ret = qemu_co_recv(sockfd, hdr, sizeof(*hdr));
    if (ret != sizeof(*hdr)) {
@@ -685,8 +670,7 @@ static coroutine_fn void do_co_req(void *opaque)
 out:
    /* there is at most one request for this sockfd, so it is safe to
     * set each handler to NULL. */
-    aio_set_fd_handler(srco->aio_context, sockfd, false,
-                       NULL, NULL, NULL);
+    aio_set_fd_handler(srco->aio_context, sockfd, NULL, NULL, NULL);

    srco->ret = ret;
    srco->finished = true;
@@ -738,8 +722,7 @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
    BDRVSheepdogState *s = opaque;
    AIOReq *aio_req, *next;

-    aio_set_fd_handler(s->aio_context, s->fd, false, NULL,
-                       NULL, NULL);
+    aio_set_fd_handler(s->aio_context, s->fd, NULL, NULL, NULL);
    close(s->fd);
    s->fd = -1;

@@ -836,8 +819,8 @@ static void coroutine_fn aio_read_response(void *opaque)
             */
            if (rsp.result == SD_RES_SUCCESS) {
                s->inode.data_vdi_id[idx] = s->inode.vdi_id;
-                acb->max_dirty_data_idx = MAX(idx, acb->max_dirty_data_idx);
-                acb->min_dirty_data_idx = MIN(idx, acb->min_dirty_data_idx);
+                s->max_dirty_data_idx = MAX(idx, s->max_dirty_data_idx);
+                s->min_dirty_data_idx = MIN(idx, s->min_dirty_data_idx);
            }
        }
        break;
@@ -864,6 +847,10 @@ static void coroutine_fn aio_read_response(void *opaque)
            rsp.result = SD_RES_SUCCESS;
            s->discard_supported = false;
            break;
+        case SD_RES_SUCCESS:
+            idx = data_oid_to_idx(aio_req->oid);
+            s->inode.data_vdi_id[idx] = 0;
+            break;
        default:
            break;
        }
@@ -942,8 +929,7 @@ static int get_sheep_fd(BDRVSheepdogState *s, Error **errp)
        return fd;
    }

-    aio_set_fd_handler(s->aio_context, fd, false,
-                       co_read_response, NULL, s);
+    aio_set_fd_handler(s->aio_context, fd, co_read_response, NULL, s);
    return fd;
 }

@@ -1179,13 +1165,7 @@ static void coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
        hdr.flags = SD_FLAG_CMD_WRITE | flags;
        break;
    case AIOCB_DISCARD_OBJ:
-        hdr.opcode = SD_OP_WRITE_OBJ;
-        hdr.flags = SD_FLAG_CMD_WRITE | flags;
-        s->inode.data_vdi_id[data_oid_to_idx(oid)] = 0;
-        offset = offsetof(SheepdogInode,
-                          data_vdi_id[data_oid_to_idx(oid)]);
-        oid = vid_to_vdi_oid(s->inode.vdi_id);
-        wlen = datalen = sizeof(uint32_t);
+        hdr.opcode = SD_OP_DISCARD_OBJ;
        break;
    }

@@ -1204,7 +1184,7 @@ static void coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,

    qemu_co_mutex_lock(&s->lock);
    s->co_send = qemu_coroutine_self();
-    aio_set_fd_handler(s->aio_context, s->fd, false,
+    aio_set_fd_handler(s->aio_context, s->fd,
                       co_read_response, co_write_request, s);
    socket_set_cork(s->fd, 1);

@@ -1223,8 +1203,7 @@ static void coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
    }
 out:
    socket_set_cork(s->fd, 0);
-    aio_set_fd_handler(s->aio_context, s->fd, false,
-                       co_read_response, NULL, s);
+    aio_set_fd_handler(s->aio_context, s->fd, co_read_response, NULL, s);
    s->co_send = NULL;
    qemu_co_mutex_unlock(&s->lock);
 }
@@ -1374,8 +1353,7 @@ static void sd_detach_aio_context(BlockDriverState *bs)
 {
    BDRVSheepdogState *s = bs->opaque;

-    aio_set_fd_handler(s->aio_context, s->fd, false, NULL,
-                       NULL, NULL);
+    aio_set_fd_handler(s->aio_context, s->fd, NULL, NULL, NULL);
 }

 static void sd_attach_aio_context(BlockDriverState *bs,
@@ -1384,8 +1362,7 @@ static void sd_attach_aio_context(BlockDriverState *bs,
    BDRVSheepdogState *s = bs->opaque;

    s->aio_context = new_context;
-    aio_set_fd_handler(new_context, s->fd, false,
-                       co_read_response, NULL, s);
+    aio_set_fd_handler(new_context, s->fd, co_read_response, NULL, s);
 }

 /* TODO Convert to fine grained options */
@@ -1489,17 +1466,18 @@ static int sd_open(BlockDriverState *bs, QDict *options, int flags,
    }

    memcpy(&s->inode, buf, sizeof(s->inode));
+    s->min_dirty_data_idx = UINT32_MAX;
+    s->max_dirty_data_idx = 0;

    bs->total_sectors = s->inode.vdi_size / BDRV_SECTOR_SIZE;
    pstrcpy(s->name, sizeof(s->name), vdi);
    qemu_co_mutex_init(&s->lock);
-    qemu_co_queue_init(&s->overlapping_queue);
+    qemu_co_queue_init(&s->overwrapping_queue);
    qemu_opts_del(opts);
    g_free(buf);
    return 0;
 out:
-    aio_set_fd_handler(bdrv_get_aio_context(bs), s->fd,
-                       false, NULL, NULL, NULL);
+    aio_set_fd_handler(bdrv_get_aio_context(bs), s->fd, NULL, NULL, NULL);
    if (s->fd >= 0) {
        closesocket(s->fd);
    }
@@ -1508,70 +1486,6 @@ out:
    return ret;
 }

-static int sd_reopen_prepare(BDRVReopenState *state, BlockReopenQueue *queue,
-                             Error **errp)
-{
-    BDRVSheepdogState *s = state->bs->opaque;
-    BDRVSheepdogReopenState *re_s;
-    int ret = 0;
-
-    re_s = state->opaque = g_new0(BDRVSheepdogReopenState, 1);
-
-    re_s->cache_flags = SD_FLAG_CMD_CACHE;
-    if (state->flags & BDRV_O_NOCACHE) {
-        re_s->cache_flags = SD_FLAG_CMD_DIRECT;
-    }
-
-    re_s->fd = get_sheep_fd(s, errp);
-    if (re_s->fd < 0) {
-        ret = re_s->fd;
-        return ret;
-    }
-
-    return ret;
-}
-
-static void sd_reopen_commit(BDRVReopenState *state)
-{
-    BDRVSheepdogReopenState *re_s = state->opaque;
-    BDRVSheepdogState *s = state->bs->opaque;
-
-    if (s->fd) {
-        aio_set_fd_handler(s->aio_context, s->fd, false,
-                           NULL, NULL, NULL);
-        closesocket(s->fd);
-    }
-
-    s->fd = re_s->fd;
-    s->cache_flags = re_s->cache_flags;
-
-    g_free(state->opaque);
-    state->opaque = NULL;
-
-    return;
-}
-
-static void sd_reopen_abort(BDRVReopenState *state)
-{
-    BDRVSheepdogReopenState *re_s = state->opaque;
-    BDRVSheepdogState *s = state->bs->opaque;
-
-    if (re_s == NULL) {
-        return;
-    }
-
-    if (re_s->fd) {
-        aio_set_fd_handler(s->aio_context, re_s->fd, false,
-                           NULL, NULL, NULL);
-        closesocket(re_s->fd);
-    }
-
-    g_free(state->opaque);
-    state->opaque = NULL;
-
-    return;
-}
-
 static int do_sd_create(BDRVSheepdogState *s, uint32_t *vdi_id, int snapshot,
                        Error **errp)
 {
@@ -1640,7 +1554,7 @@ static int sd_prealloc(const char *filename, Error **errp)
    int ret;

    ret = bdrv_open(&bs, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
-                    errp);
+                    NULL, errp);
    if (ret < 0) {
        goto out_with_err_set;
    }
@@ -1832,7 +1746,8 @@ static int sd_create(const char *filename, QemuOpts *opts,
        }

        bs = NULL;
-        ret = bdrv_open(&bs, backing_file, NULL, NULL, BDRV_O_PROTOCOL, errp);
+        ret = bdrv_open(&bs, backing_file, NULL, NULL, BDRV_O_PROTOCOL, NULL,
+                        errp);
        if (ret < 0) {
            goto out;
        }
@@ -1946,8 +1861,7 @@ static void sd_close(BlockDriverState *bs)
        error_report("%s, %s", sd_strerror(rsp->result), s->name);
    }

-    aio_set_fd_handler(bdrv_get_aio_context(bs), s->fd,
-                       false, NULL, NULL, NULL);
+    aio_set_fd_handler(bdrv_get_aio_context(bs), s->fd, NULL, NULL, NULL);
    closesocket(s->fd);
    g_free(s->host_spec);
 }
@@ -2009,16 +1923,16 @@ static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
    AIOReq *aio_req;
    uint32_t offset, data_len, mn, mx;

-    mn = acb->min_dirty_data_idx;
-    mx = acb->max_dirty_data_idx;
+    mn = s->min_dirty_data_idx;
+    mx = s->max_dirty_data_idx;
    if (mn <= mx) {
        /* we need to update the vdi object. */
        offset = sizeof(s->inode) - sizeof(s->inode.data_vdi_id) +
            mn * sizeof(s->inode.data_vdi_id[0]);
        data_len = (mx - mn + 1) * sizeof(s->inode.data_vdi_id[0]);

-        acb->min_dirty_data_idx = UINT32_MAX;
-        acb->max_dirty_data_idx = 0;
+        s->min_dirty_data_idx = UINT32_MAX;
+        s->max_dirty_data_idx = 0;

        iov.iov_base = &s->inode;
        iov.iov_len = sizeof(s->inode);
@@ -2227,9 +2141,7 @@ static int coroutine_fn sd_co_rw_vector(void *p)
        }

        aio_req = alloc_aio_req(s, acb, oid, len, offset, flags, create,
-                                old_oid,
-                                acb->aiocb_type == AIOCB_DISCARD_OBJ ?
-                                0 : done);
+                                old_oid, done);
        QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);

        add_aio_request(s, aio_req, acb->qiov->iov, acb->qiov->niov,
@@ -2246,12 +2158,12 @@ out:
    return 1;
 }

-static bool check_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
+static bool check_overwrapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
 {
    SheepdogAIOCB *cb;

    QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
-        if (AIOCBOverlapping(aiocb, cb)) {
+        if (AIOCBOverwrapping(aiocb, cb)) {
            return true;
        }
    }
@@ -2280,15 +2192,15 @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
    acb->aiocb_type = AIOCB_WRITE_UDATA;

 retry:
-    if (check_overlapping_aiocb(s, acb)) {
-        qemu_co_queue_wait(&s->overlapping_queue);
+    if (check_overwrapping_aiocb(s, acb)) {
+        qemu_co_queue_wait(&s->overwrapping_queue);
        goto retry;
    }

    ret = sd_co_rw_vector(acb);
    if (ret <= 0) {
        QLIST_REMOVE(acb, aiocb_siblings);
-        qemu_co_queue_restart_all(&s->overlapping_queue);
+        qemu_co_queue_restart_all(&s->overwrapping_queue);
        qemu_aio_unref(acb);
        return ret;
    }
@@ -2296,7 +2208,7 @@ retry:
    qemu_coroutine_yield();

    QLIST_REMOVE(acb, aiocb_siblings);
-    qemu_co_queue_restart_all(&s->overlapping_queue);
+    qemu_co_queue_restart_all(&s->overwrapping_queue);

    return acb->ret;
 }
@@ -2313,15 +2225,15 @@ static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
    acb->aio_done_func = sd_finish_aiocb;

 retry:
-    if (check_overlapping_aiocb(s, acb)) {
-        qemu_co_queue_wait(&s->overlapping_queue);
+    if (check_overwrapping_aiocb(s, acb)) {
+        qemu_co_queue_wait(&s->overwrapping_queue);
        goto retry;
    }

    ret = sd_co_rw_vector(acb);
    if (ret <= 0) {
        QLIST_REMOVE(acb, aiocb_siblings);
-        qemu_co_queue_restart_all(&s->overlapping_queue);
+        qemu_co_queue_restart_all(&s->overwrapping_queue);
        qemu_aio_unref(acb);
        return ret;
    }
@@ -2329,7 +2241,7 @@ retry:
    qemu_coroutine_yield();

    QLIST_REMOVE(acb, aiocb_siblings);
-    qemu_co_queue_restart_all(&s->overlapping_queue);
+    qemu_co_queue_restart_all(&s->overwrapping_queue);
    return acb->ret;
 }

@@ -2665,36 +2577,28 @@ static coroutine_fn int sd_co_discard(BlockDriverState *bs, int64_t sector_num,
                                      int nb_sectors)
 {
    SheepdogAIOCB *acb;
+    QEMUIOVector dummy;
    BDRVSheepdogState *s = bs->opaque;
    int ret;
-    QEMUIOVector discard_iov;
-    struct iovec iov;
-    uint32_t zero = 0;

    if (!s->discard_supported) {
            return 0;
    }

-    memset(&discard_iov, 0, sizeof(discard_iov));
-    memset(&iov, 0, sizeof(iov));
-    iov.iov_base = &zero;
-    iov.iov_len = sizeof(zero);
-    discard_iov.iov = &iov;
-    discard_iov.niov = 1;
-    acb = sd_aio_setup(bs, &discard_iov, sector_num, nb_sectors);
+    acb = sd_aio_setup(bs, &dummy, sector_num, nb_sectors);
    acb->aiocb_type = AIOCB_DISCARD_OBJ;
    acb->aio_done_func = sd_finish_aiocb;

 retry:
-    if (check_overlapping_aiocb(s, acb)) {
-        qemu_co_queue_wait(&s->overlapping_queue);
+    if (check_overwrapping_aiocb(s, acb)) {
+        qemu_co_queue_wait(&s->overwrapping_queue);
        goto retry;
    }

    ret = sd_co_rw_vector(acb);
    if (ret <= 0) {
        QLIST_REMOVE(acb, aiocb_siblings);
-        qemu_co_queue_restart_all(&s->overlapping_queue);
+        qemu_co_queue_restart_all(&s->overwrapping_queue);
        qemu_aio_unref(acb);
        return ret;
    }
@@ -2702,7 +2606,7 @@ retry:
    qemu_coroutine_yield();

    QLIST_REMOVE(acb, aiocb_siblings);
-    qemu_co_queue_restart_all(&s->overlapping_queue);
+    qemu_co_queue_restart_all(&s->overwrapping_queue);

    return acb->ret;
 }
@@ -2799,9 +2703,6 @@ static BlockDriver bdrv_sheepdog = {
    .instance_size  = sizeof(BDRVSheepdogState),
    .bdrv_needs_filename = true,
    .bdrv_file_open = sd_open,
-    .bdrv_reopen_prepare    = sd_reopen_prepare,
-    .bdrv_reopen_commit     = sd_reopen_commit,
-    .bdrv_reopen_abort      = sd_reopen_abort,
    .bdrv_close     = sd_close,
    .bdrv_create    = sd_create,
    .bdrv_has_zero_init = bdrv_has_zero_init_1,
@@ -2835,9 +2736,6 @@ static BlockDriver bdrv_sheepdog_tcp = {
    .instance_size  = sizeof(BDRVSheepdogState),
    .bdrv_needs_filename = true,
    .bdrv_file_open = sd_open,
-    .bdrv_reopen_prepare    = sd_reopen_prepare,
-    .bdrv_reopen_commit     = sd_reopen_commit,
-    .bdrv_reopen_abort      = sd_reopen_abort,
    .bdrv_close     = sd_close,
    .bdrv_create    = sd_create,
    .bdrv_has_zero_init = bdrv_has_zero_init_1,
@@ -2871,9 +2769,6 @@ static BlockDriver bdrv_sheepdog_unix = {
    .instance_size  = sizeof(BDRVSheepdogState),
    .bdrv_needs_filename = true,
    .bdrv_file_open = sd_open,
-    .bdrv_reopen_prepare    = sd_reopen_prepare,
-    .bdrv_reopen_commit     = sd_reopen_commit,
-    .bdrv_reopen_abort      = sd_reopen_abort,
    .bdrv_close     = sd_close,
    .bdrv_create    = sd_create,
    .bdrv_has_zero_init = bdrv_has_zero_init_1,
--- a/block/snapshot.c
+++ b/block/snapshot.c
@@ -149,7 +149,7 @@ int bdrv_can_snapshot(BlockDriverState *bs)

    if (!drv->bdrv_snapshot_create) {
        if (bs->file != NULL) {
-            return bdrv_can_snapshot(bs->file->bs);
+            return bdrv_can_snapshot(bs->file);
        }
        return 0;
    }
@@ -168,7 +168,7 @@ int bdrv_snapshot_create(BlockDriverState *bs,
        return drv->bdrv_snapshot_create(bs, sn_info);
    }
    if (bs->file) {
-        return bdrv_snapshot_create(bs->file->bs, sn_info);
+        return bdrv_snapshot_create(bs->file, sn_info);
    }
    return -ENOTSUP;
 }
@@ -188,10 +188,10 @@ int bdrv_snapshot_goto(BlockDriverState *bs,

    if (bs->file) {
        drv->bdrv_close(bs);
-        ret = bdrv_snapshot_goto(bs->file->bs, snapshot_id);
+        ret = bdrv_snapshot_goto(bs->file, snapshot_id);
        open_ret = drv->bdrv_open(bs, NULL, bs->open_flags, NULL);
        if (open_ret < 0) {
-            bdrv_unref(bs->file->bs);
+            bdrv_unref(bs->file);
            bs->drv = NULL;
            return open_ret;
        }
@@ -245,7 +245,7 @@ int bdrv_snapshot_delete(BlockDriverState *bs,
        return drv->bdrv_snapshot_delete(bs, snapshot_id, name, errp);
    }
    if (bs->file) {
-        return bdrv_snapshot_delete(bs->file->bs, snapshot_id, name, errp);
+        return bdrv_snapshot_delete(bs->file, snapshot_id, name, errp);
    }
    error_setg(errp, "Block format '%s' used by device '%s' "
               "does not support internal snapshot deletion",
@@ -283,7 +283,7 @@ int bdrv_snapshot_list(BlockDriverState *bs,
        return drv->bdrv_snapshot_list(bs, psn_info);
    }
    if (bs->file) {
-        return bdrv_snapshot_list(bs->file->bs, psn_info);
+        return bdrv_snapshot_list(bs->file, psn_info);
    }
    return -ENOTSUP;
 }
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -193,7 +193,7 @@ sftp_error_report(BDRVSSHState *s, const char *fs, ...)
 static int parse_uri(const char *filename, QDict *options, Error **errp)
 {
    URI *uri = NULL;
-    QueryParams *qp;
+    QueryParams *qp = NULL;
    int i;

    uri = uri_parse(filename);
@@ -249,6 +249,9 @@ static int parse_uri(const char *filename, QDict *options, Error **errp)
    return 0;

 err:
+    if (qp) {
+      query_params_free(qp);
+    }
    if (uri) {
      uri_free(uri);
    }
@@ -800,15 +803,14 @@ static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
            rd_handler, wr_handler);

    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
-                       false, rd_handler, wr_handler, co);
+                       rd_handler, wr_handler, co);
 }

 static coroutine_fn void clear_fd_handler(BDRVSSHState *s,
                                          BlockDriverState *bs)
 {
    DPRINTF("s->sock=%d", s->sock);
-    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
-                       false, NULL, NULL, NULL);
+    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock, NULL, NULL, NULL);
 }

 /* A non-blocking call returned EAGAIN, so yield, ensuring the
--- a/block/stream.c
+++ b/block/stream.c
@@ -16,7 +16,6 @@
 #include "block/blockjob.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
-#include "sysemu/block-backend.h"

 enum {
    /*
@@ -53,6 +52,34 @@ static int coroutine_fn stream_populate(BlockDriverState *bs,
    return bdrv_co_copy_on_readv(bs, sector_num, nb_sectors, &qiov);
 }

+static void close_unused_images(BlockDriverState *top, BlockDriverState *base,
+                                const char *base_id)
+{
+    BlockDriverState *intermediate;
+    intermediate = top->backing_hd;
+
+    /* Must assign before bdrv_delete() to prevent traversing dangling pointer
+     * while we delete backing image instances.
+     */
+    bdrv_set_backing_hd(top, base);
+
+    while (intermediate) {
+        BlockDriverState *unused;
+
+        /* reached base */
+        if (intermediate == base) {
+            break;
+        }
+
+        unused = intermediate;
+        intermediate = intermediate->backing_hd;
+        bdrv_set_backing_hd(unused, NULL);
+        bdrv_unref(unused);
+    }
+
+    bdrv_refresh_limits(top, NULL);
+}
+
 typedef struct {
    int ret;
    bool reached_end;
@@ -74,7 +101,7 @@ static void stream_complete(BlockJob *job, void *opaque)
            }
        }
        data->ret = bdrv_change_backing_file(job->bs, base_id, base_fmt);
-        bdrv_set_backing_hd(job->bs, base);
+        close_unused_images(job->bs, base, base_id);
    }

    g_free(s->backing_file_str);
@@ -94,7 +121,7 @@ static void coroutine_fn stream_run(void *opaque)
    int n = 0;
    void *buf;

-    if (!bs->backing) {
+    if (!bs->backing_hd) {
        block_job_completed(&s->common, 0);
        return;
    }
@@ -139,7 +166,7 @@ wait:
        } else if (ret >= 0) {
            /* Copy if allocated in the intermediate images.  Limit to the
             * known-unallocated area [sector_num, sector_num+n).  */
-            ret = bdrv_is_allocated_above(backing_bs(bs), base,
+            ret = bdrv_is_allocated_above(bs->backing_hd, base,
                                          sector_num, n, &n);

            /* Finish early if end of backing file has been reached */
@@ -223,7 +250,7 @@ void stream_start(BlockDriverState *bs, BlockDriverState *base,

    if ((on_error == BLOCKDEV_ON_ERROR_STOP ||
         on_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        (!bs->blk || !blk_iostatus_is_enabled(bs->blk))) {
+        !bdrv_iostatus_is_enabled(bs)) {
        error_setg(errp, QERR_INVALID_PARAMETER, "on-error");
        return;
    }
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -33,7 +33,8 @@
 * its own locking.
 *
 * This locking is however handled internally in this file, so it's
- * transparent to outside users.
+ * mostly transparent to outside users (but see the documentation in
+ * throttle_groups_lock()).
 *
 * The whole ThrottleGroup structure is private and invisible to
 * outside users, that only use it through its ThrottleState.
@@ -75,9 +76,9 @@ static QTAILQ_HEAD(, ThrottleGroup) throttle_groups =
 * created.
 *
 * @name: the name of the ThrottleGroup
- * @ret:  the ThrottleState member of the ThrottleGroup
+ * @ret:  the ThrottleGroup
 */
-ThrottleState *throttle_group_incref(const char *name)
+static ThrottleGroup *throttle_group_incref(const char *name)
 {
    ThrottleGroup *tg = NULL;
    ThrottleGroup *iter;
@@ -107,7 +108,7 @@ ThrottleState *throttle_group_incref(const char *name)

    qemu_mutex_unlock(&throttle_groups_lock);

-    return &tg->ts;
+    return tg;
 }

 /* Decrease the reference count of a ThrottleGroup.
@@ -115,12 +116,10 @@ ThrottleState *throttle_group_incref(const char *name)
 * When the reference count reaches zero the ThrottleGroup is
 * destroyed.
 *
- * @ts:  The ThrottleGroup to unref, given by its ThrottleState member
+ * @tg:  The ThrottleGroup to unref
 */
-void throttle_group_unref(ThrottleState *ts)
+static void throttle_group_unref(ThrottleGroup *tg)
 {
-    ThrottleGroup *tg = container_of(ts, ThrottleGroup, ts);
-
    qemu_mutex_lock(&throttle_groups_lock);
    if (--tg->refcount == 0) {
        QTAILQ_REMOVE(&throttle_groups, tg, list);
@@ -402,8 +401,7 @@ static void write_timer_cb(void *opaque)
 void throttle_group_register_bs(BlockDriverState *bs, const char *groupname)
 {
    int i;
-    ThrottleState *ts = throttle_group_incref(groupname);
-    ThrottleGroup *tg = container_of(ts, ThrottleGroup, ts);
+    ThrottleGroup *tg = throttle_group_incref(groupname);
    int clock_type = QEMU_CLOCK_REALTIME;

    if (qtest_enabled()) {
@@ -411,7 +409,7 @@ void throttle_group_register_bs(BlockDriverState *bs, const char *groupname)
        clock_type = QEMU_CLOCK_VIRTUAL;
    }

-    bs->throttle_state = ts;
+    bs->throttle_state = &tg->ts;

    qemu_mutex_lock(&tg->lock);
    /* If the ThrottleGroup is new set this BlockDriverState as the token */
@@ -463,10 +461,38 @@ void throttle_group_unregister_bs(BlockDriverState *bs)
    throttle_timers_destroy(&bs->throttle_timers);
    qemu_mutex_unlock(&tg->lock);

-    throttle_group_unref(&tg->ts);
+    throttle_group_unref(tg);
    bs->throttle_state = NULL;
 }

+/* Acquire the lock of this throttling group.
+ *
+ * You won't normally need to use this. None of the functions from the
+ * ThrottleGroup API require you to acquire the lock since all of them
+ * deal with it internally.
+ *
+ * This should only be used in exceptional cases when you want to
+ * access the protected fields of a BlockDriverState directly
+ * (e.g. bdrv_swap()).
+ *
+ * @bs: a BlockDriverState that is member of the group
+ */
+void throttle_group_lock(BlockDriverState *bs)
+{
+    ThrottleGroup *tg = container_of(bs->throttle_state, ThrottleGroup, ts);
+    qemu_mutex_lock(&tg->lock);
+}
+
+/* Release the lock of this throttling group.
+ *
+ * See the comments in throttle_group_lock().
+ */
+void throttle_group_unlock(BlockDriverState *bs)
+{
+    ThrottleGroup *tg = container_of(bs->throttle_state, ThrottleGroup, ts);
+    qemu_mutex_unlock(&tg->lock);
+}
+
 static void throttle_groups_init(void)
 {
    qemu_mutex_init(&throttle_groups_lock);
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -53,7 +53,7 @@
 #include "block/block_int.h"
 #include "qemu/module.h"
 #include "migration/migration.h"
-#include "qemu/coroutine.h"
+#include "block/coroutine.h"

 #if defined(CONFIG_UUID)
 #include <uuid/uuid.h>
@@ -399,7 +399,7 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,

    logout("\n");

-    ret = bdrv_read(bs->file->bs, 0, (uint8_t *)&header, 1);
+    ret = bdrv_read(bs->file, 0, (uint8_t *)&header, 1);
    if (ret < 0) {
        goto fail;
    }
@@ -490,14 +490,13 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,

    bmap_size = header.blocks_in_image * sizeof(uint32_t);
    bmap_size = DIV_ROUND_UP(bmap_size, SECTOR_SIZE);
-    s->bmap = qemu_try_blockalign(bs->file->bs, bmap_size * SECTOR_SIZE);
+    s->bmap = qemu_try_blockalign(bs->file, bmap_size * SECTOR_SIZE);
    if (s->bmap == NULL) {
        ret = -ENOMEM;
        goto fail;
    }

-    ret = bdrv_read(bs->file->bs, s->bmap_sector, (uint8_t *)s->bmap,
-                    bmap_size);
+    ret = bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size);
    if (ret < 0) {
        goto fail_free_bmap;
    }
@@ -586,7 +585,7 @@ static int vdi_co_read(BlockDriverState *bs,
            uint64_t offset = s->header.offset_data / SECTOR_SIZE +
                              (uint64_t)bmap_entry * s->block_sectors +
                              sector_in_block;
-            ret = bdrv_read(bs->file->bs, offset, buf, n_sectors);
+            ret = bdrv_read(bs->file, offset, buf, n_sectors);
        }
        logout("%u sectors read\n", n_sectors);

@@ -654,7 +653,7 @@ static int vdi_co_write(BlockDriverState *bs,
             * acquire the lock and thus the padded cluster is written before
             * the other coroutines can write to the affected area. */
            qemu_co_mutex_lock(&s->write_lock);
-            ret = bdrv_write(bs->file->bs, offset, block, s->block_sectors);
+            ret = bdrv_write(bs->file, offset, block, s->block_sectors);
            qemu_co_mutex_unlock(&s->write_lock);
        } else {
            uint64_t offset = s->header.offset_data / SECTOR_SIZE +
@@ -670,7 +669,7 @@ static int vdi_co_write(BlockDriverState *bs,
             * that that write operation has returned (there may be other writes
             * in flight, but they do not concern this very operation). */
            qemu_co_mutex_unlock(&s->write_lock);
-            ret = bdrv_write(bs->file->bs, offset, buf, n_sectors);
+            ret = bdrv_write(bs->file, offset, buf, n_sectors);
        }

        nb_sectors -= n_sectors;
@@ -695,7 +694,7 @@ static int vdi_co_write(BlockDriverState *bs,
        assert(VDI_IS_ALLOCATED(bmap_first));
        *header = s->header;
        vdi_header_to_le(header);
-        ret = bdrv_write(bs->file->bs, 0, block, 1);
+        ret = bdrv_write(bs->file, 0, block, 1);
        g_free(block);
        block = NULL;

@@ -713,7 +712,7 @@ static int vdi_co_write(BlockDriverState *bs,
        base = ((uint8_t *)&s->bmap[0]) + bmap_first * SECTOR_SIZE;
        logout("will write %u block map sectors starting from entry %u\n",
               n_sectors, bmap_first);
-        ret = bdrv_write(bs->file->bs, offset, base, n_sectors);
+        ret = bdrv_write(bs->file, offset, base, n_sectors);
    }

    return ret;
@@ -765,7 +764,7 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
        goto exit;
    }
    ret = bdrv_open(&bs, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
-                    &local_err);
+                    NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto exit;
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -81,7 +81,7 @@ static int vhdx_log_peek_hdr(BlockDriverState *bs, VHDXLogEntries *log,

    offset = log->offset + read;

-    ret = bdrv_pread(bs->file->bs, offset, hdr, sizeof(VHDXLogEntryHeader));
+    ret = bdrv_pread(bs->file, offset, hdr, sizeof(VHDXLogEntryHeader));
    if (ret < 0) {
        goto exit;
    }
@@ -141,7 +141,7 @@ static int vhdx_log_read_sectors(BlockDriverState *bs, VHDXLogEntries *log,
        }
        offset = log->offset + read;

-        ret = bdrv_pread(bs->file->bs, offset, buffer, VHDX_LOG_SECTOR_SIZE);
+        ret = bdrv_pread(bs->file, offset, buffer, VHDX_LOG_SECTOR_SIZE);
        if (ret < 0) {
            goto exit;
        }
@@ -191,8 +191,7 @@ static int vhdx_log_write_sectors(BlockDriverState *bs, VHDXLogEntries *log,
            /* full */
            break;
        }
-        ret = bdrv_pwrite(bs->file->bs, offset, buffer_tmp,
-                          VHDX_LOG_SECTOR_SIZE);
+        ret = bdrv_pwrite(bs->file, offset, buffer_tmp, VHDX_LOG_SECTOR_SIZE);
        if (ret < 0) {
            goto exit;
        }
@@ -354,7 +353,7 @@ static int vhdx_log_read_desc(BlockDriverState *bs, BDRVVHDXState *s,
    }

    desc_sectors = vhdx_compute_desc_sectors(hdr.descriptor_count);
-    desc_entries = qemu_try_blockalign(bs->file->bs,
+    desc_entries = qemu_try_blockalign(bs->file,
                                       desc_sectors * VHDX_LOG_SECTOR_SIZE);
    if (desc_entries == NULL) {
        ret = -ENOMEM;
@@ -463,7 +462,7 @@ static int vhdx_log_flush_desc(BlockDriverState *bs, VHDXLogDescriptor *desc,

    /* count is only > 1 if we are writing zeroes */
    for (i = 0; i < count; i++) {
-        ret = bdrv_pwrite_sync(bs->file->bs, file_offset, buffer,
+        ret = bdrv_pwrite_sync(bs->file, file_offset, buffer,
                               VHDX_LOG_SECTOR_SIZE);
        if (ret < 0) {
            goto exit;
@@ -510,7 +509,7 @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
        /* if the log shows a FlushedFileOffset larger than our current file
         * size, then that means the file has been truncated / corrupted, and
         * we must refused to open it / use it */
-        if (hdr_tmp.flushed_file_offset > bdrv_getlength(bs->file->bs)) {
+        if (hdr_tmp.flushed_file_offset > bdrv_getlength(bs->file)) {
            ret = -EINVAL;
            goto exit;
        }
@@ -540,12 +539,12 @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
                goto exit;
            }
        }
-        if (bdrv_getlength(bs->file->bs) < desc_entries->hdr.last_file_offset) {
+        if (bdrv_getlength(bs->file) < desc_entries->hdr.last_file_offset) {
            new_file_size = desc_entries->hdr.last_file_offset;
            if (new_file_size % (1024*1024)) {
                /* round up to nearest 1MB boundary */
                new_file_size = ((new_file_size >> 20) + 1) << 20;
-                bdrv_truncate(bs->file->bs, new_file_size);
+                bdrv_truncate(bs->file, new_file_size);
            }
        }
        qemu_vfree(desc_entries);
@@ -909,8 +908,8 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
                .sequence_number     = s->log.sequence,
                .descriptor_count    = sectors,
                .reserved            = 0,
-                .flushed_file_offset = bdrv_getlength(bs->file->bs),
-                .last_file_offset    = bdrv_getlength(bs->file->bs),
+                .flushed_file_offset = bdrv_getlength(bs->file),
+                .last_file_offset    = bdrv_getlength(bs->file),
              };

    new_hdr.log_guid = header->log_guid;
@@ -941,7 +940,7 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,

        if (i == 0 && leading_length) {
            /* partial sector at the front of the buffer */
-            ret = bdrv_pread(bs->file->bs, file_offset, merged_sector,
+            ret = bdrv_pread(bs->file, file_offset, merged_sector,
                             VHDX_LOG_SECTOR_SIZE);
            if (ret < 0) {
                goto exit;
@@ -951,7 +950,7 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
            sector_write = merged_sector;
        } else if (i == sectors - 1 && trailing_length) {
            /* partial sector at the end of the buffer */
-            ret = bdrv_pread(bs->file->bs,
+            ret = bdrv_pread(bs->file,
                            file_offset,
                            merged_sector + trailing_length,
                            VHDX_LOG_SECTOR_SIZE - trailing_length);
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -375,7 +375,7 @@ static int vhdx_update_header(BlockDriverState *bs, BDRVVHDXState *s,
        inactive_header->log_guid = *log_guid;
    }

-    ret = vhdx_write_header(bs->file->bs, inactive_header, header_offset, true);
+    ret = vhdx_write_header(bs->file, inactive_header, header_offset, true);
    if (ret < 0) {
        goto exit;
    }
@@ -427,8 +427,7 @@ static void vhdx_parse_header(BlockDriverState *bs, BDRVVHDXState *s,
    /* We have to read the whole VHDX_HEADER_SIZE instead of
     * sizeof(VHDXHeader), because the checksum is over the whole
     * region */
-    ret = bdrv_pread(bs->file->bs, VHDX_HEADER1_OFFSET, buffer,
-                     VHDX_HEADER_SIZE);
+    ret = bdrv_pread(bs->file, VHDX_HEADER1_OFFSET, buffer, VHDX_HEADER_SIZE);
    if (ret < 0) {
        goto fail;
    }
@@ -444,8 +443,7 @@ static void vhdx_parse_header(BlockDriverState *bs, BDRVVHDXState *s,
        }
    }

-    ret = bdrv_pread(bs->file->bs, VHDX_HEADER2_OFFSET, buffer,
-                     VHDX_HEADER_SIZE);
+    ret = bdrv_pread(bs->file, VHDX_HEADER2_OFFSET, buffer, VHDX_HEADER_SIZE);
    if (ret < 0) {
        goto fail;
    }
@@ -518,7 +516,7 @@ static int vhdx_open_region_tables(BlockDriverState *bs, BDRVVHDXState *s)
     * whole block */
    buffer = qemu_blockalign(bs, VHDX_HEADER_BLOCK_SIZE);

-    ret = bdrv_pread(bs->file->bs, VHDX_REGION_TABLE_OFFSET, buffer,
+    ret = bdrv_pread(bs->file, VHDX_REGION_TABLE_OFFSET, buffer,
                     VHDX_HEADER_BLOCK_SIZE);
    if (ret < 0) {
        goto fail;
@@ -631,7 +629,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)

    buffer = qemu_blockalign(bs, VHDX_METADATA_TABLE_MAX_SIZE);

-    ret = bdrv_pread(bs->file->bs, s->metadata_rt.file_offset, buffer,
+    ret = bdrv_pread(bs->file, s->metadata_rt.file_offset, buffer,
                     VHDX_METADATA_TABLE_MAX_SIZE);
    if (ret < 0) {
        goto exit;
@@ -734,7 +732,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
        goto exit;
    }

-    ret = bdrv_pread(bs->file->bs,
+    ret = bdrv_pread(bs->file,
                     s->metadata_entries.file_parameters_entry.offset
                                         + s->metadata_rt.file_offset,
                     &s->params,
@@ -769,7 +767,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
    /* determine virtual disk size, logical sector size,
     * and phys sector size */

-    ret = bdrv_pread(bs->file->bs,
+    ret = bdrv_pread(bs->file,
                     s->metadata_entries.virtual_disk_size_entry.offset
                                           + s->metadata_rt.file_offset,
                     &s->virtual_disk_size,
@@ -777,7 +775,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
    if (ret < 0) {
        goto exit;
    }
-    ret = bdrv_pread(bs->file->bs,
+    ret = bdrv_pread(bs->file,
                     s->metadata_entries.logical_sector_size_entry.offset
                                             + s->metadata_rt.file_offset,
                     &s->logical_sector_size,
@@ -785,7 +783,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
    if (ret < 0) {
        goto exit;
    }
-    ret = bdrv_pread(bs->file->bs,
+    ret = bdrv_pread(bs->file,
                     s->metadata_entries.phys_sector_size_entry.offset
                                          + s->metadata_rt.file_offset,
                     &s->physical_sector_size,
@@ -908,7 +906,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
    QLIST_INIT(&s->regions);

    /* validate the file signature */
-    ret = bdrv_pread(bs->file->bs, 0, &signature, sizeof(uint64_t));
+    ret = bdrv_pread(bs->file, 0, &signature, sizeof(uint64_t));
    if (ret < 0) {
        goto fail;
    }
@@ -961,13 +959,13 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
    }

    /* s->bat is freed in vhdx_close() */
-    s->bat = qemu_try_blockalign(bs->file->bs, s->bat_rt.length);
+    s->bat = qemu_try_blockalign(bs->file, s->bat_rt.length);
    if (s->bat == NULL) {
        ret = -ENOMEM;
        goto fail;
    }

-    ret = bdrv_pread(bs->file->bs, s->bat_offset, s->bat, s->bat_rt.length);
+    ret = bdrv_pread(bs->file, s->bat_offset, s->bat, s->bat_rt.length);
    if (ret < 0) {
        goto fail;
    }
@@ -1120,7 +1118,7 @@ static coroutine_fn int vhdx_co_readv(BlockDriverState *bs, int64_t sector_num,
                break;
            case PAYLOAD_BLOCK_FULLY_PRESENT:
                qemu_co_mutex_unlock(&s->lock);
-                ret = bdrv_co_readv(bs->file->bs,
+                ret = bdrv_co_readv(bs->file,
                                    sinfo.file_offset >> BDRV_SECTOR_BITS,
                                    sinfo.sectors_avail, &hd_qiov);
                qemu_co_mutex_lock(&s->lock);
@@ -1158,12 +1156,12 @@ exit:
 static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
                                    uint64_t *new_offset)
 {
-    *new_offset = bdrv_getlength(bs->file->bs);
+    *new_offset = bdrv_getlength(bs->file);

    /* per the spec, the address for a block is in units of 1MB */
    *new_offset = ROUND_UP(*new_offset, 1024 * 1024);

-    return bdrv_truncate(bs->file->bs, *new_offset + s->block_size);
+    return bdrv_truncate(bs->file, *new_offset + s->block_size);
 }

 /*
@@ -1262,7 +1260,7 @@ static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
                /* Queue another write of zero buffers if the underlying file
                 * does not zero-fill on file extension */

-                if (bdrv_has_zero_init(bs->file->bs) == 0) {
+                if (bdrv_has_zero_init(bs->file) == 0) {
                    use_zero_buffers = true;

                    /* zero fill the front, if any */
@@ -1329,7 +1327,7 @@ static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
                }
                /* block exists, so we can just overwrite it */
                qemu_co_mutex_unlock(&s->lock);
-                ret = bdrv_co_writev(bs->file->bs,
+                ret = bdrv_co_writev(bs->file,
                                    sinfo.file_offset >> BDRV_SECTOR_BITS,
                                    sectors_to_write, &hd_qiov);
                qemu_co_mutex_lock(&s->lock);
@@ -1456,7 +1454,7 @@ static int vhdx_create_new_metadata(BlockDriverState *bs,
    uint32_t offset = 0;
    void *buffer = NULL;
    void *entry_buffer;
-    VHDXMetadataTableHeader *md_table;
+    VHDXMetadataTableHeader *md_table;;
    VHDXMetadataTableEntry  *md_table_entry;

    /* Metadata entries */
@@ -1844,7 +1842,7 @@ static int vhdx_create(const char *filename, QemuOpts *opts, Error **errp)

    bs = NULL;
    ret = bdrv_open(&bs, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
-                    &local_err);
+                    NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto exit;
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -87,7 +87,7 @@ typedef struct {
 #define L2_CACHE_SIZE 16

 typedef struct VmdkExtent {
-    BdrvChild *file;
+    BlockDriverState *file;
    bool flat;
    bool compressed;
    bool has_marker;
@@ -222,7 +222,7 @@ static void vmdk_free_extents(BlockDriverState *bs)
        g_free(e->l1_backup_table);
        g_free(e->type);
        if (e->file != bs->file) {
-            bdrv_unref_child(bs, e->file);
+            bdrv_unref(e->file);
        }
    }
    g_free(s->extents);
@@ -248,7 +248,7 @@ static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
    BDRVVmdkState *s = bs->opaque;
    int ret;

-    ret = bdrv_pread(bs->file->bs, s->desc_offset, desc, DESC_SIZE);
+    ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
    if (ret < 0) {
        return 0;
    }
@@ -278,7 +278,7 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
    BDRVVmdkState *s = bs->opaque;
    int ret;

-    ret = bdrv_pread(bs->file->bs, s->desc_offset, desc, DESC_SIZE);
+    ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
    if (ret < 0) {
        return ret;
    }
@@ -297,7 +297,7 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
        pstrcat(desc, sizeof(desc), tmp_desc);
    }

-    ret = bdrv_pwrite_sync(bs->file->bs, s->desc_offset, desc, DESC_SIZE);
+    ret = bdrv_pwrite_sync(bs->file, s->desc_offset, desc, DESC_SIZE);
    if (ret < 0) {
        return ret;
    }
@@ -308,11 +308,10 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
 static int vmdk_is_cid_valid(BlockDriverState *bs)
 {
    BDRVVmdkState *s = bs->opaque;
+    BlockDriverState *p_bs = bs->backing_hd;
    uint32_t cur_pcid;

-    if (!s->cid_checked && bs->backing) {
-        BlockDriverState *p_bs = bs->backing->bs;
-
+    if (!s->cid_checked && p_bs) {
        cur_pcid = vmdk_read_cid(p_bs, 0);
        if (s->parent_cid != cur_pcid) {
            /* CID not valid */
@@ -341,7 +340,7 @@ static int vmdk_parent_open(BlockDriverState *bs)
    int ret;

    desc[DESC_SIZE] = '\0';
-    ret = bdrv_pread(bs->file->bs, s->desc_offset, desc, DESC_SIZE);
+    ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
    if (ret < 0) {
        return ret;
    }
@@ -368,7 +367,7 @@ static int vmdk_parent_open(BlockDriverState *bs)
 /* Create and append extent to the extent array. Return the added VmdkExtent
 * address. return NULL if allocation failed. */
 static int vmdk_add_extent(BlockDriverState *bs,
-                           BdrvChild *file, bool flat, int64_t sectors,
+                           BlockDriverState *file, bool flat, int64_t sectors,
                           int64_t l1_offset, int64_t l1_backup_offset,
                           uint32_t l1_size,
                           int l2_size, uint64_t cluster_sectors,
@@ -393,7 +392,7 @@ static int vmdk_add_extent(BlockDriverState *bs,
        return -EFBIG;
    }

-    nb_sectors = bdrv_nb_sectors(file->bs);
+    nb_sectors = bdrv_nb_sectors(file);
    if (nb_sectors < 0) {
        return nb_sectors;
    }
@@ -440,14 +439,14 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
        return -ENOMEM;
    }

-    ret = bdrv_pread(extent->file->bs,
+    ret = bdrv_pread(extent->file,
                     extent->l1_table_offset,
                     extent->l1_table,
                     l1_size);
    if (ret < 0) {
        error_setg_errno(errp, -ret,
                         "Could not read l1 table from extent '%s'",
-                         extent->file->bs->filename);
+                         extent->file->filename);
        goto fail_l1;
    }
    for (i = 0; i < extent->l1_size; i++) {
@@ -460,14 +459,14 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
            ret = -ENOMEM;
            goto fail_l1;
        }
-        ret = bdrv_pread(extent->file->bs,
+        ret = bdrv_pread(extent->file,
                         extent->l1_backup_table_offset,
                         extent->l1_backup_table,
                         l1_size);
        if (ret < 0) {
            error_setg_errno(errp, -ret,
                             "Could not read l1 backup table from extent '%s'",
-                             extent->file->bs->filename);
+                             extent->file->filename);
            goto fail_l1b;
        }
        for (i = 0; i < extent->l1_size; i++) {
@@ -486,7 +485,7 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
 }

 static int vmdk_open_vmfs_sparse(BlockDriverState *bs,
-                                 BdrvChild *file,
+                                 BlockDriverState *file,
                                 int flags, Error **errp)
 {
    int ret;
@@ -494,11 +493,11 @@ static int vmdk_open_vmfs_sparse(BlockDriverState *bs,
    VMDK3Header header;
    VmdkExtent *extent;

-    ret = bdrv_pread(file->bs, sizeof(magic), &header, sizeof(header));
+    ret = bdrv_pread(file, sizeof(magic), &header, sizeof(header));
    if (ret < 0) {
        error_setg_errno(errp, -ret,
                         "Could not read header from file '%s'",
-                         file->bs->filename);
+                         file->filename);
        return ret;
    }
    ret = vmdk_add_extent(bs, file, false,
@@ -560,7 +559,7 @@ static char *vmdk_read_desc(BlockDriverState *file, uint64_t desc_offset,
 }

 static int vmdk_open_vmdk4(BlockDriverState *bs,
-                           BdrvChild *file,
+                           BlockDriverState *file,
                           int flags, QDict *options, Error **errp)
 {
    int ret;
@@ -571,17 +570,17 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
    BDRVVmdkState *s = bs->opaque;
    int64_t l1_backup_offset = 0;

-    ret = bdrv_pread(file->bs, sizeof(magic), &header, sizeof(header));
+    ret = bdrv_pread(file, sizeof(magic), &header, sizeof(header));
    if (ret < 0) {
        error_setg_errno(errp, -ret,
                         "Could not read header from file '%s'",
-                         file->bs->filename);
+                         file->filename);
        return -EINVAL;
    }
    if (header.capacity == 0) {
        uint64_t desc_offset = le64_to_cpu(header.desc_offset);
        if (desc_offset) {
-            char *buf = vmdk_read_desc(file->bs, desc_offset << 9, errp);
+            char *buf = vmdk_read_desc(file, desc_offset << 9, errp);
            if (!buf) {
                return -EINVAL;
            }
@@ -621,8 +620,8 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
            } QEMU_PACKED eos_marker;
        } QEMU_PACKED footer;

-        ret = bdrv_pread(file->bs,
-            bs->file->bs->total_sectors * 512 - 1536,
+        ret = bdrv_pread(file,
+            bs->file->total_sectors * 512 - 1536,
            &footer, sizeof(footer));
        if (ret < 0) {
            error_setg_errno(errp, -ret, "Failed to read footer");
@@ -676,7 +675,7 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
    if (le32_to_cpu(header.flags) & VMDK4_FLAG_RGD) {
        l1_backup_offset = le64_to_cpu(header.rgd_offset) << 9;
    }
-    if (bdrv_nb_sectors(file->bs) < le64_to_cpu(header.grain_offset)) {
+    if (bdrv_nb_sectors(file) < le64_to_cpu(header.grain_offset)) {
        error_setg(errp, "File truncated, expecting at least %" PRId64 " bytes",
                   (int64_t)(le64_to_cpu(header.grain_offset)
                             * BDRV_SECTOR_SIZE));
@@ -740,7 +739,8 @@ static int vmdk_parse_description(const char *desc, const char *opt_name,
 }

 /* Open an extent file and append to bs array */
-static int vmdk_open_sparse(BlockDriverState *bs, BdrvChild *file, int flags,
+static int vmdk_open_sparse(BlockDriverState *bs,
+                            BlockDriverState *file, int flags,
                            char *buf, QDict *options, Error **errp)
 {
    uint32_t magic;
@@ -773,11 +773,10 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
    int64_t sectors = 0;
    int64_t flat_offset;
    char *extent_path;
-    BdrvChild *extent_file;
+    BlockDriverState *extent_file;
    BDRVVmdkState *s = bs->opaque;
    VmdkExtent *extent;
    char extent_opt_prefix[32];
-    Error *local_err = NULL;

    while (*p) {
        /* parse extent line in one of below formats:
@@ -820,22 +819,22 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
            !desc_file_path[0])
        {
            error_setg(errp, "Cannot use relative extent paths with VMDK "
-                       "descriptor file '%s'", bs->file->bs->filename);
+                       "descriptor file '%s'", bs->file->filename);
            return -EINVAL;
        }

        extent_path = g_malloc0(PATH_MAX);
        path_combine(extent_path, PATH_MAX, desc_file_path, fname);
+        extent_file = NULL;

        ret = snprintf(extent_opt_prefix, 32, "extents.%d", s->num_extents);
        assert(ret < 32);

-        extent_file = bdrv_open_child(extent_path, options, extent_opt_prefix,
-                                      bs, &child_file, false, &local_err);
+        ret = bdrv_open_image(&extent_file, extent_path, options,
+                              extent_opt_prefix, bs, &child_file, false, errp);
        g_free(extent_path);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            return -EINVAL;
+        if (ret) {
+            return ret;
        }

        /* save to extents array */
@@ -845,13 +844,13 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
            ret = vmdk_add_extent(bs, extent_file, true, sectors,
                            0, 0, 0, 0, 0, &extent, errp);
            if (ret < 0) {
-                bdrv_unref_child(bs, extent_file);
+                bdrv_unref(extent_file);
                return ret;
            }
            extent->flat_start_offset = flat_offset << 9;
        } else if (!strcmp(type, "SPARSE") || !strcmp(type, "VMFSSPARSE")) {
            /* SPARSE extent and VMFSSPARSE extent are both "COWD" sparse file*/
-            char *buf = vmdk_read_desc(extent_file->bs, 0, errp);
+            char *buf = vmdk_read_desc(extent_file, 0, errp);
            if (!buf) {
                ret = -EINVAL;
            } else {
@@ -860,13 +859,13 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
            }
            g_free(buf);
            if (ret) {
-                bdrv_unref_child(bs, extent_file);
+                bdrv_unref(extent_file);
                return ret;
            }
            extent = &s->extents[s->num_extents - 1];
        } else {
            error_setg(errp, "Unsupported extent type '%s'", type);
-            bdrv_unref_child(bs, extent_file);
+            bdrv_unref(extent_file);
            return -ENOTSUP;
        }
        extent->type = g_strdup(type);
@@ -906,8 +905,7 @@ static int vmdk_open_desc_file(BlockDriverState *bs, int flags, char *buf,
    }
    s->create_type = g_strdup(ct);
    s->desc_offset = 0;
-    ret = vmdk_parse_extents(buf, bs, bs->file->bs->exact_filename, options,
-                             errp);
+    ret = vmdk_parse_extents(buf, bs, bs->file->exact_filename, options, errp);
 exit:
    return ret;
 }
@@ -920,7 +918,7 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
    BDRVVmdkState *s = bs->opaque;
    uint32_t magic;

-    buf = vmdk_read_desc(bs->file->bs, 0, errp);
+    buf = vmdk_read_desc(bs->file, 0, errp);
    if (!buf) {
        return -EINVAL;
    }
@@ -929,8 +927,7 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
    switch (magic) {
        case VMDK3_MAGIC:
        case VMDK4_MAGIC:
-            ret = vmdk_open_sparse(bs, bs->file, flags, buf, options,
-                                   errp);
+            ret = vmdk_open_sparse(bs, bs->file, flags, buf, options, errp);
            s->desc_offset = 0x200;
            break;
        default:
@@ -1007,7 +1004,7 @@ static int get_whole_cluster(BlockDriverState *bs,
    cluster_bytes = extent->cluster_sectors << BDRV_SECTOR_BITS;
    whole_grain = qemu_blockalign(bs, cluster_bytes);

-    if (!bs->backing) {
+    if (!bs->backing_hd) {
        memset(whole_grain, 0,  skip_start_sector << BDRV_SECTOR_BITS);
        memset(whole_grain + (skip_end_sector << BDRV_SECTOR_BITS), 0,
               cluster_bytes - (skip_end_sector << BDRV_SECTOR_BITS));
@@ -1016,22 +1013,22 @@ static int get_whole_cluster(BlockDriverState *bs,
    assert(skip_end_sector <= extent->cluster_sectors);
    /* we will be here if it's first write on non-exist grain(cluster).
     * try to read from parent image, if exist */
-    if (bs->backing && !vmdk_is_cid_valid(bs)) {
+    if (bs->backing_hd && !vmdk_is_cid_valid(bs)) {
        ret = VMDK_ERROR;
        goto exit;
    }

    /* Read backing data before skip range */
    if (skip_start_sector > 0) {
-        if (bs->backing) {
-            ret = bdrv_read(bs->backing->bs, sector_num,
+        if (bs->backing_hd) {
+            ret = bdrv_read(bs->backing_hd, sector_num,
                            whole_grain, skip_start_sector);
            if (ret < 0) {
                ret = VMDK_ERROR;
                goto exit;
            }
        }
-        ret = bdrv_write(extent->file->bs, cluster_sector_num, whole_grain,
+        ret = bdrv_write(extent->file, cluster_sector_num, whole_grain,
                         skip_start_sector);
        if (ret < 0) {
            ret = VMDK_ERROR;
@@ -1040,8 +1037,8 @@ static int get_whole_cluster(BlockDriverState *bs,
    }
    /* Read backing data after skip range */
    if (skip_end_sector < extent->cluster_sectors) {
-        if (bs->backing) {
-            ret = bdrv_read(bs->backing->bs, sector_num + skip_end_sector,
+        if (bs->backing_hd) {
+            ret = bdrv_read(bs->backing_hd, sector_num + skip_end_sector,
                            whole_grain + (skip_end_sector << BDRV_SECTOR_BITS),
                            extent->cluster_sectors - skip_end_sector);
            if (ret < 0) {
@@ -1049,7 +1046,7 @@ static int get_whole_cluster(BlockDriverState *bs,
                goto exit;
            }
        }
-        ret = bdrv_write(extent->file->bs, cluster_sector_num + skip_end_sector,
+        ret = bdrv_write(extent->file, cluster_sector_num + skip_end_sector,
                         whole_grain + (skip_end_sector << BDRV_SECTOR_BITS),
                         extent->cluster_sectors - skip_end_sector);
        if (ret < 0) {
@@ -1069,7 +1066,7 @@ static int vmdk_L2update(VmdkExtent *extent, VmdkMetaData *m_data,
    offset = cpu_to_le32(offset);
    /* update L2 table */
    if (bdrv_pwrite_sync(
-                extent->file->bs,
+                extent->file,
                ((int64_t)m_data->l2_offset * 512)
                    + (m_data->l2_index * sizeof(offset)),
                &offset, sizeof(offset)) < 0) {
@@ -1079,7 +1076,7 @@ static int vmdk_L2update(VmdkExtent *extent, VmdkMetaData *m_data,
    if (extent->l1_backup_table_offset != 0) {
        m_data->l2_offset = extent->l1_backup_table[m_data->l1_index];
        if (bdrv_pwrite_sync(
-                    extent->file->bs,
+                    extent->file,
                    ((int64_t)m_data->l2_offset * 512)
                        + (m_data->l2_index * sizeof(offset)),
                    &offset, sizeof(offset)) < 0) {
@@ -1169,7 +1166,7 @@ static int get_cluster_offset(BlockDriverState *bs,
    }
    l2_table = extent->l2_cache + (min_index * extent->l2_size);
    if (bdrv_pread(
-                extent->file->bs,
+                extent->file,
                (int64_t)l2_offset * 512,
                l2_table,
                extent->l2_size * sizeof(uint32_t)
@@ -1323,16 +1320,12 @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
        write_len = buf_len + sizeof(VmdkGrainMarker);
    }
    write_offset = cluster_offset + offset_in_cluster,
-    ret = bdrv_pwrite(extent->file->bs, write_offset, write_buf, write_len);
+    ret = bdrv_pwrite(extent->file, write_offset, write_buf, write_len);

    write_end_sector = DIV_ROUND_UP(write_offset + write_len, BDRV_SECTOR_SIZE);

-    if (extent->compressed) {
-        extent->next_cluster_sector = write_end_sector;
-    } else {
    extent->next_cluster_sector = MAX(extent->next_cluster_sector,
                                      write_end_sector);
-    }

    if (ret != write_len) {
        ret = ret < 0 ? ret : -EIO;
@@ -1358,7 +1351,7 @@ static int vmdk_read_extent(VmdkExtent *extent, int64_t cluster_offset,


    if (!extent->compressed) {
-        ret = bdrv_pread(extent->file->bs,
+        ret = bdrv_pread(extent->file,
                          cluster_offset + offset_in_cluster,
                          buf, nb_sectors * 512);
        if (ret == nb_sectors * 512) {
@@ -1372,7 +1365,7 @@ static int vmdk_read_extent(VmdkExtent *extent, int64_t cluster_offset,
    buf_bytes = cluster_bytes * 2;
    cluster_buf = g_malloc(buf_bytes);
    uncomp_buf = g_malloc(cluster_bytes);
-    ret = bdrv_pread(extent->file->bs,
+    ret = bdrv_pread(extent->file,
                cluster_offset,
                cluster_buf, buf_bytes);
    if (ret < 0) {
@@ -1434,11 +1427,11 @@ static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
        }
        if (ret != VMDK_OK) {
            /* if not allocated, try to read from parent image, if exist */
-            if (bs->backing && ret != VMDK_ZEROED) {
+            if (bs->backing_hd && ret != VMDK_ZEROED) {
                if (!vmdk_is_cid_valid(bs)) {
                    return -EINVAL;
                }
-                ret = bdrv_read(bs->backing->bs, sector_num, buf, n);
+                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
                if (ret < 0) {
                    return ret;
                }
@@ -1639,7 +1632,7 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,

    assert(bs == NULL);
    ret = bdrv_open(&bs, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
-                    &local_err);
+                    NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto exit;
@@ -1912,7 +1905,8 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
            ret = -ENOENT;
            goto exit;
        }
-        ret = bdrv_open(&bs, full_backing, NULL, NULL, BDRV_O_NO_BACKING, errp);
+        ret = bdrv_open(&bs, full_backing, NULL, NULL, BDRV_O_NO_BACKING, NULL,
+                        errp);
        g_free(full_backing);
        if (ret != 0) {
            goto exit;
@@ -1983,7 +1977,7 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
    }
    assert(new_bs == NULL);
    ret = bdrv_open(&new_bs, filename, NULL, NULL,
-                    BDRV_O_RDWR | BDRV_O_PROTOCOL, &local_err);
+                    BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto exit;
@@ -2038,7 +2032,7 @@ static coroutine_fn int vmdk_co_flush(BlockDriverState *bs)
    int ret = 0;

    for (i = 0; i < s->num_extents; i++) {
-        err = bdrv_co_flush(s->extents[i].file->bs);
+        err = bdrv_co_flush(s->extents[i].file);
        if (err < 0) {
            ret = err;
        }
@@ -2053,7 +2047,7 @@ static int64_t vmdk_get_allocated_file_size(BlockDriverState *bs)
    int64_t r;
    BDRVVmdkState *s = bs->opaque;

-    ret = bdrv_get_allocated_file_size(bs->file->bs);
+    ret = bdrv_get_allocated_file_size(bs->file);
    if (ret < 0) {
        return ret;
    }
@@ -2061,7 +2055,7 @@ static int64_t vmdk_get_allocated_file_size(BlockDriverState *bs)
        if (s->extents[i].file == bs->file) {
            continue;
        }
-        r = bdrv_get_allocated_file_size(s->extents[i].file->bs);
+        r = bdrv_get_allocated_file_size(s->extents[i].file);
        if (r < 0) {
            return r;
        }
@@ -2079,7 +2073,7 @@ static int vmdk_has_zero_init(BlockDriverState *bs)
     * return 0. */
    for (i = 0; i < s->num_extents; i++) {
        if (s->extents[i].flat) {
-            if (!bdrv_has_zero_init(s->extents[i].file->bs)) {
+            if (!bdrv_has_zero_init(s->extents[i].file)) {
                return 0;
            }
        }
@@ -2092,7 +2086,7 @@ static ImageInfo *vmdk_get_extent_info(VmdkExtent *extent)
    ImageInfo *info = g_new0(ImageInfo, 1);

    *info = (ImageInfo){
-        .filename         = g_strdup(extent->file->bs->filename),
+        .filename         = g_strdup(extent->file->filename),
        .format           = g_strdup(extent->type),
        .virtual_size     = extent->sectors * BDRV_SECTOR_SIZE,
        .compressed       = extent->compressed,
@@ -2138,9 +2132,7 @@ static int vmdk_check(BlockDriverState *bs, BdrvCheckResult *result,
                    PRId64 "\n", sector_num);
            break;
        }
-        if (ret == VMDK_OK &&
-            cluster_offset >= bdrv_getlength(extent->file->bs))
-        {
+        if (ret == VMDK_OK && cluster_offset >= bdrv_getlength(extent->file)) {
            fprintf(stderr,
                    "ERROR: cluster offset for sector %"
                    PRId64 " points after EOF\n", sector_num);
@@ -2161,19 +2153,19 @@ static ImageInfoSpecific *vmdk_get_specific_info(BlockDriverState *bs)
    ImageInfoList **next;

    *spec_info = (ImageInfoSpecific){
-        .type = IMAGE_INFO_SPECIFIC_KIND_VMDK,
+        .kind = IMAGE_INFO_SPECIFIC_KIND_VMDK,
        {
            .vmdk = g_new0(ImageInfoSpecificVmdk, 1),
        },
    };

-    *spec_info->u.vmdk = (ImageInfoSpecificVmdk) {
+    *spec_info->vmdk = (ImageInfoSpecificVmdk) {
        .create_type = g_strdup(s->create_type),
        .cid = s->cid,
        .parent_cid = s->parent_cid,
    };

-    next = &spec_info->u.vmdk->extents;
+    next = &spec_info->vmdk->extents;
    for (i = 0; i < s->num_extents; i++) {
        *next = g_new0(ImageInfoList, 1);
        (*next)->value = vmdk_get_extent_info(&s->extents[i]);
@@ -2216,7 +2208,7 @@ static void vmdk_detach_aio_context(BlockDriverState *bs)
    int i;

    for (i = 0; i < s->num_extents; i++) {
-        bdrv_detach_aio_context(s->extents[i].file->bs);
+        bdrv_detach_aio_context(s->extents[i].file);
    }
 }

@@ -2227,7 +2219,7 @@ static void vmdk_attach_aio_context(BlockDriverState *bs,
    int i;

    for (i = 0; i < s->num_extents; i++) {
-        bdrv_attach_aio_context(s->extents[i].file->bs, new_context);
+        bdrv_attach_aio_context(s->extents[i].file, new_context);
    }
 }

--- a/block/vpc.c
+++ b/block/vpc.c
@@ -172,14 +172,14 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
    int disk_type = VHD_DYNAMIC;
    int ret;

-    ret = bdrv_pread(bs->file->bs, 0, s->footer_buf, HEADER_SIZE);
+    ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE);
    if (ret < 0) {
        goto fail;
    }

    footer = (VHDFooter *) s->footer_buf;
    if (strncmp(footer->creator, "conectix", 8)) {
-        int64_t offset = bdrv_getlength(bs->file->bs);
+        int64_t offset = bdrv_getlength(bs->file);
        if (offset < 0) {
            ret = offset;
            goto fail;
@@ -189,7 +189,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
        }

        /* If a fixed disk, the footer is found only at the end of the file */
-        ret = bdrv_pread(bs->file->bs, offset-HEADER_SIZE, s->footer_buf,
+        ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf,
                         HEADER_SIZE);
        if (ret < 0) {
            goto fail;
@@ -232,7 +232,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
    }

    if (disk_type == VHD_DYNAMIC) {
-        ret = bdrv_pread(bs->file->bs, be64_to_cpu(footer->data_offset), buf,
+        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
                         HEADER_SIZE);
        if (ret < 0) {
            goto fail;
@@ -280,7 +280,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,

        pagetable_size = (uint64_t) s->max_table_entries * 4;

-        s->pagetable = qemu_try_blockalign(bs->file->bs, pagetable_size);
+        s->pagetable = qemu_try_blockalign(bs->file, pagetable_size);
        if (s->pagetable == NULL) {
            ret = -ENOMEM;
            goto fail;
@@ -288,8 +288,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,

        s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);

-        ret = bdrv_pread(bs->file->bs, s->bat_offset, s->pagetable,
-                         pagetable_size);
+        ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable, pagetable_size);
        if (ret < 0) {
            goto fail;
        }
@@ -309,7 +308,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
            }
        }

-        if (s->free_data_block_offset > bdrv_getlength(bs->file->bs)) {
+        if (s->free_data_block_offset > bdrv_getlength(bs->file)) {
            error_setg(errp, "block-vpc: free_data_block_offset points after "
                             "the end of file. The image has been truncated.");
            ret = -EINVAL;
@@ -384,7 +383,7 @@ static inline int64_t get_sector_offset(BlockDriverState *bs,

        s->last_bitmap_offset = bitmap_offset;
        memset(bitmap, 0xff, s->bitmap_size);
-        bdrv_pwrite_sync(bs->file->bs, bitmap_offset, bitmap, s->bitmap_size);
+        bdrv_pwrite_sync(bs->file, bitmap_offset, bitmap, s->bitmap_size);
    }

    return block_offset;
@@ -402,7 +401,7 @@ static int rewrite_footer(BlockDriverState* bs)
    BDRVVPCState *s = bs->opaque;
    int64_t offset = s->free_data_block_offset;

-    ret = bdrv_pwrite_sync(bs->file->bs, offset, s->footer_buf, HEADER_SIZE);
+    ret = bdrv_pwrite_sync(bs->file, offset, s->footer_buf, HEADER_SIZE);
    if (ret < 0)
        return ret;

@@ -437,7 +436,7 @@ static int64_t alloc_block(BlockDriverState* bs, int64_t sector_num)

    // Initialize the block's bitmap
    memset(bitmap, 0xff, s->bitmap_size);
-    ret = bdrv_pwrite_sync(bs->file->bs, s->free_data_block_offset, bitmap,
+    ret = bdrv_pwrite_sync(bs->file, s->free_data_block_offset, bitmap,
        s->bitmap_size);
    if (ret < 0) {
        return ret;
@@ -452,7 +451,7 @@ static int64_t alloc_block(BlockDriverState* bs, int64_t sector_num)
    // Write BAT entry to disk
    bat_offset = s->bat_offset + (4 * index);
    bat_value = cpu_to_be32(s->pagetable[index]);
-    ret = bdrv_pwrite_sync(bs->file->bs, bat_offset, &bat_value, 4);
+    ret = bdrv_pwrite_sync(bs->file, bat_offset, &bat_value, 4);
    if (ret < 0)
        goto fail;

@@ -486,7 +485,7 @@ static int vpc_read(BlockDriverState *bs, int64_t sector_num,
    VHDFooter *footer = (VHDFooter *) s->footer_buf;

    if (be32_to_cpu(footer->type) == VHD_FIXED) {
-        return bdrv_read(bs->file->bs, sector_num, buf, nb_sectors);
+        return bdrv_read(bs->file, sector_num, buf, nb_sectors);
    }
    while (nb_sectors > 0) {
        offset = get_sector_offset(bs, sector_num, 0);
@@ -500,7 +499,7 @@ static int vpc_read(BlockDriverState *bs, int64_t sector_num,
        if (offset == -1) {
            memset(buf, 0, sectors * BDRV_SECTOR_SIZE);
        } else {
-            ret = bdrv_pread(bs->file->bs, offset, buf,
+            ret = bdrv_pread(bs->file, offset, buf,
                sectors * BDRV_SECTOR_SIZE);
            if (ret != sectors * BDRV_SECTOR_SIZE) {
                return -1;
@@ -535,7 +534,7 @@ static int vpc_write(BlockDriverState *bs, int64_t sector_num,
    VHDFooter *footer =  (VHDFooter *) s->footer_buf;

    if (be32_to_cpu(footer->type) == VHD_FIXED) {
-        return bdrv_write(bs->file->bs, sector_num, buf, nb_sectors);
+        return bdrv_write(bs->file, sector_num, buf, nb_sectors);
    }
    while (nb_sectors > 0) {
        offset = get_sector_offset(bs, sector_num, 1);
@@ -552,8 +551,7 @@ static int vpc_write(BlockDriverState *bs, int64_t sector_num,
                return -1;
        }

-        ret = bdrv_pwrite(bs->file->bs, offset, buf,
-                          sectors * BDRV_SECTOR_SIZE);
+        ret = bdrv_pwrite(bs->file, offset, buf, sectors * BDRV_SECTOR_SIZE);
        if (ret != sectors * BDRV_SECTOR_SIZE) {
            return -1;
        }
@@ -796,7 +794,7 @@ static int vpc_create(const char *filename, QemuOpts *opts, Error **errp)
        goto out;
    }
    ret = bdrv_open(&bs, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
-                    &local_err);
+                    NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto out;
@@ -880,7 +878,7 @@ static int vpc_has_zero_init(BlockDriverState *bs)
    VHDFooter *footer =  (VHDFooter *) s->footer_buf;

    if (be32_to_cpu(footer->type) == VHD_FIXED) {
-        return bdrv_has_zero_init(bs->file->bs);
+        return bdrv_has_zero_init(bs->file);
    } else {
        return 1;
    }
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -985,6 +985,12 @@ static BDRVVVFATState *vvv = NULL;
 static int enable_write_target(BDRVVVFATState *s, Error **errp);
 static int is_consistent(BDRVVVFATState *s);

+static void vvfat_rebind(BlockDriverState *bs)
+{
+    BDRVVVFATState *s = bs->opaque;
+    s->bs = bs;
+}
+
 static QemuOptsList runtime_opts = {
    .name = "vvfat",
    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
@@ -2917,12 +2923,9 @@ static BlockDriver vvfat_write_target = {
 static int enable_write_target(BDRVVVFATState *s, Error **errp)
 {
    BlockDriver *bdrv_qcow = NULL;
-    BlockDriverState *backing;
    QemuOpts *opts = NULL;
    int ret;
    int size = sector2cluster(s, s->sector_count);
-    QDict *options;
-
    s->used_clusters = calloc(size, 1);

    array_init(&(s->commits), sizeof(commit_t));
@@ -2953,11 +2956,9 @@ static int enable_write_target(BDRVVVFATState *s, Error **errp)
    }

    s->qcow = NULL;
-    options = qdict_new();
-    qdict_put(options, "driver", qstring_from_str("qcow"));
-    ret = bdrv_open(&s->qcow, s->qcow_filename, NULL, options,
+    ret = bdrv_open(&s->qcow, s->qcow_filename, NULL, NULL,
                    BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH,
-                    errp);
+                    bdrv_qcow, errp);
    if (ret < 0) {
        goto err;
    }
@@ -2966,13 +2967,10 @@ static int enable_write_target(BDRVVVFATState *s, Error **errp)
    unlink(s->qcow_filename);
 #endif

-    backing = bdrv_new();
-    bdrv_set_backing_hd(s->bs, backing);
-    bdrv_unref(backing);
-
-    s->bs->backing->bs->drv = &vvfat_write_target;
-    s->bs->backing->bs->opaque = g_new(void *, 1);
-    *(void**)s->bs->backing->bs->opaque = s;
+    bdrv_set_backing_hd(s->bs, bdrv_new());
+    s->bs->backing_hd->drv = &vvfat_write_target;
+    s->bs->backing_hd->opaque = g_new(void *, 1);
+    *(void**)s->bs->backing_hd->opaque = s;

    return 0;

@@ -3006,6 +3004,7 @@ static BlockDriver bdrv_vvfat = {
    .bdrv_parse_filename    = vvfat_parse_filename,
    .bdrv_file_open         = vvfat_open,
    .bdrv_close             = vvfat_close,
+    .bdrv_rebind            = vvfat_rebind,

    .bdrv_read              = vvfat_co_read,
    .bdrv_write             = vvfat_co_write,
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -174,7 +174,7 @@ int win32_aio_attach(QEMUWin32AIOState *aio, HANDLE hfile)
 void win32_aio_detach_aio_context(QEMUWin32AIOState *aio,
                                  AioContext *old_context)
 {
-    aio_set_event_notifier(old_context, &aio->e, false, NULL);
+    aio_set_event_notifier(old_context, &aio->e, NULL);
    aio->is_aio_context_attached = false;
 }

@@ -182,8 +182,7 @@ void win32_aio_attach_aio_context(QEMUWin32AIOState *aio,
                                  AioContext *new_context)
 {
    aio->is_aio_context_attached = true;
-    aio_set_event_notifier(new_context, &aio->e, false,
-                           win32_aio_completion_cb);
+    aio_set_event_notifier(new_context, &aio->e, win32_aio_completion_cb);
 }

 QEMUWin32AIOState *win32_aio_init(void)
--- a/block/write-threshold.c
+++ b/block/write-threshold.c
@@ -11,7 +11,7 @@
 */

 #include "block/block_int.h"
-#include "qemu/coroutine.h"
+#include "block/coroutine.h"
 #include "block/write-threshold.h"
 #include "qemu/notify.h"
 #include "qapi-event.h"
--- a/blockdev.c
+++ b/blockdev.c
--- a/blockjob.c
+++ b/blockjob.c
@@ -29,10 +29,9 @@
 #include "block/block.h"
 #include "block/blockjob.h"
 #include "block/block_int.h"
-#include "sysemu/block-backend.h"
 #include "qapi/qmp/qerror.h"
 #include "qapi/qmp/qjson.h"
-#include "qemu/coroutine.h"
+#include "block/coroutine.h"
 #include "qmp-commands.h"
 #include "qemu/timer.h"
 #include "qapi-event.h"
@@ -55,7 +54,6 @@ void *block_job_create(const BlockJobDriver *driver, BlockDriverState *bs,
    bdrv_op_unblock(bs, BLOCK_OP_TYPE_DATAPLANE, job->blocker);

    job->driver        = driver;
-    job->id            = g_strdup(bdrv_get_device_name(bs));
    job->bs            = bs;
    job->cb            = cb;
    job->opaque        = opaque;
@@ -83,7 +81,6 @@ void block_job_release(BlockDriverState *bs)
    bs->job = NULL;
    bdrv_op_unblock_all(bs, job->blocker);
    error_free(job->blocker);
-    g_free(job->id);
    g_free(job);
 }

@@ -116,7 +113,8 @@ void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
 void block_job_complete(BlockJob *job, Error **errp)
 {
    if (job->pause_count || job->cancelled || !job->driver->complete) {
-        error_setg(errp, QERR_BLOCK_JOB_NOT_READY, job->id);
+        error_setg(errp, QERR_BLOCK_JOB_NOT_READY,
+                   bdrv_get_device_name(job->bs));
        return;
    }

@@ -271,7 +269,7 @@ BlockJobInfo *block_job_query(BlockJob *job)
 {
    BlockJobInfo *info = g_new0(BlockJobInfo, 1);
    info->type      = g_strdup(BlockJobType_lookup[job->driver->job_type]);
-    info->device    = g_strdup(job->id);
+    info->device    = g_strdup(bdrv_get_device_name(job->bs));
    info->len       = job->len;
    info->busy      = job->busy;
    info->paused    = job->pause_count > 0;
@@ -293,7 +291,7 @@ static void block_job_iostatus_set_err(BlockJob *job, int error)
 void block_job_event_cancelled(BlockJob *job)
 {
    qapi_event_send_block_job_cancelled(job->driver->job_type,
-                                        job->id,
+                                        bdrv_get_device_name(job->bs),
                                        job->len,
                                        job->offset,
                                        job->speed,
@@ -303,7 +301,7 @@ void block_job_event_cancelled(BlockJob *job)
 void block_job_event_completed(BlockJob *job, const char *msg)
 {
    qapi_event_send_block_job_completed(job->driver->job_type,
-                                        job->id,
+                                        bdrv_get_device_name(job->bs),
                                        job->len,
                                        job->offset,
                                        job->speed,
@@ -317,7 +315,7 @@ void block_job_event_ready(BlockJob *job)
    job->ready = true;

    qapi_event_send_block_job_ready(job->driver->job_type,
-                                    job->id,
+                                    bdrv_get_device_name(job->bs),
                                    job->len,
                                    job->offset,
                                    job->speed, &error_abort);
@@ -346,7 +344,7 @@ BlockErrorAction block_job_error_action(BlockJob *job, BlockDriverState *bs,
    default:
        abort();
    }
-    qapi_event_send_block_job_error(job->id,
+    qapi_event_send_block_job_error(bdrv_get_device_name(job->bs),
                                    is_read ? IO_OPERATION_TYPE_READ :
                                    IO_OPERATION_TYPE_WRITE,
                                    action, &error_abort);
@@ -355,8 +353,8 @@ BlockErrorAction block_job_error_action(BlockJob *job, BlockDriverState *bs,
        job->user_paused = true;
        block_job_pause(job);
        block_job_iostatus_set_err(job, error);
-        if (bs->blk && bs != job->bs) {
-            blk_iostatus_set_err(bs->blk, error);
+        if (bs != job->bs) {
+            bdrv_iostatus_set_err(bs, error);
        }
    }
    return action;
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -1355,7 +1355,9 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
            }
        }
        if (!bprm->p) {
+            if (elf_interpreter) {
                free(elf_interpreter);
+            }
            free (elf_phdata);
            close(bprm->fd);
            return -E2BIG;
@@ -1369,6 +1371,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
    info->mmap = 0;
    elf_entry = (abi_ulong) elf_ex.e_entry;

+#if defined(CONFIG_USE_GUEST_BASE)
    /*
     * In case where user has not explicitly set the guest_base, we
     * probe here that should we set it automatically.
@@ -1389,6 +1392,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
            }
        }
    }
+#endif /* CONFIG_USE_GUEST_BASE */

    /* Do this so that we can load the interpreter, if need be.  We will
       change some of these later */
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -35,10 +35,12 @@
 #include "qemu/envlist.h"

 int singlestep;
+#if defined(CONFIG_USE_GUEST_BASE)
 unsigned long mmap_min_addr;
 unsigned long guest_base;
 int have_guest_base;
 unsigned long reserved_va;
+#endif

 static const char *interp_prefix = CONFIG_QEMU_INTERP_PREFIX;
 const char *qemu_uname_release;
@@ -108,7 +110,7 @@ void cpu_list_unlock(void)

 uint64_t cpu_get_tsc(CPUX86State *env)
 {
-    return cpu_get_host_ticks();
+    return cpu_get_real_ticks();
 }

 static void write_dt(void *ptr, unsigned long addr, unsigned long limit,
@@ -680,7 +682,9 @@ static void usage(void)
           "-drop-ld-preload  drop LD_PRELOAD for target process\n"
           "-E var=value      sets/modifies targets environment variable(s)\n"
           "-U var            unsets targets environment variable(s)\n"
+#if defined(CONFIG_USE_GUEST_BASE)
           "-B address        set guest_base address to address\n"
+#endif
           "-bsd type         select emulated BSD type FreeBSD/NetBSD/OpenBSD (default)\n"
           "\n"
           "Debug options:\n"
@@ -826,9 +830,11 @@ int main(int argc, char **argv)
 #endif
                exit(1);
            }
+#if defined(CONFIG_USE_GUEST_BASE)
        } else if (!strcmp(r, "B")) {
           guest_base = strtol(argv[optind++], NULL, 0);
           have_guest_base = 1;
+#endif
        } else if (!strcmp(r, "drop-ld-preload")) {
            (void) envlist_unsetenv(envlist, "LD_PRELOAD");
        } else if (!strcmp(r, "bsd")) {
@@ -917,6 +923,7 @@ int main(int argc, char **argv)
    target_environ = envlist_to_environ(envlist, NULL);
    envlist_free(envlist);

+#if defined(CONFIG_USE_GUEST_BASE)
    /*
     * Now that page sizes are configured in cpu_init() we can do
     * proper page alignment for guest_base.
@@ -943,6 +950,7 @@ int main(int argc, char **argv)
            fclose(fp);
        }
    }
+#endif /* CONFIG_USE_GUEST_BASE */

    if (loader_exec(filename, argv+optind, target_environ, regs, info) != 0) {
        printf("Error loading %s\n", filename);
@@ -956,7 +964,9 @@ int main(int argc, char **argv)
    free(target_environ);

    if (qemu_log_enabled()) {
+#if defined(CONFIG_USE_GUEST_BASE)
        qemu_log("guest_base  0x%lx\n", guest_base);
+#endif
        log_page_dump();

        qemu_log("start_brk   0x" TARGET_ABI_FMT_lx "\n", info->start_brk);
@@ -976,10 +986,12 @@ int main(int argc, char **argv)
    syscall_init();
    signal_init();

+#if defined(CONFIG_USE_GUEST_BASE)
    /* Now that we've loaded the binary, GUEST_BASE is fixed.  Delay
       generating the prologue until now so that the prologue can take
       the real value of GUEST_BASE into account.  */
    tcg_prologue_init(&tcg_ctx);
+#endif

    /* build Task State */
    memset(ts, 0, sizeof(TaskState));
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -101,7 +101,9 @@ typedef struct TaskState {

 void init_task_state(TaskState *ts);
 extern const char *qemu_uname_release;
+#if defined(CONFIG_USE_GUEST_BASE)
 extern unsigned long mmap_min_addr;
+#endif

 /* ??? See if we can avoid exposing so much of the loader internals.  */
 /*
@@ -211,6 +213,8 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                       abi_ulong new_addr);
 int target_msync(abi_ulong start, abi_ulong len, int flags);
 extern unsigned long last_brk;
+void mmap_lock(void);
+void mmap_unlock(void);
 void cpu_list_lock(void);
 void cpu_list_unlock(void);
 #if defined(CONFIG_USE_NPTL)
--- a/bsd-user/signal.c
+++ b/bsd-user/signal.c
@@ -21,6 +21,7 @@
 #include <string.h>
 #include <stdarg.h>
 #include <unistd.h>
+#include <signal.h>
 #include <errno.h>

 #include "qemu.h"
--- a/593
+++ b/593
--- a/contrib/ivshmem-client/Makefile.objs
+++ b/contrib/ivshmem-client/Makefile.objs
@@ -1 +0,0 @@
-ivshmem-client-obj-y = ivshmem-client.o main.o
--- a/contrib/ivshmem-client/ivshmem-client.c
+++ b/contrib/ivshmem-client/ivshmem-client.c
@@ -1,446 +0,0 @@
-/*
- * Copyright 6WIND S.A., 2014
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or
- * (at your option) any later version.  See the COPYING file in the
- * top-level directory.
- */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-
-#include "qemu-common.h"
-#include "qemu/queue.h"
-
-#include "ivshmem-client.h"
-
-/* log a message on stdout if verbose=1 */
-#define IVSHMEM_CLIENT_DEBUG(client, fmt, ...) do { \
-        if ((client)->verbose) {         \
-            printf(fmt, ## __VA_ARGS__); \
-        }                                \
-    } while (0)
-
-/* read message from the unix socket */
-static int
-ivshmem_client_read_one_msg(IvshmemClient *client, int64_t *index, int *fd)
-{
-    int ret;
-    struct msghdr msg;
-    struct iovec iov[1];
-    union {
-        struct cmsghdr cmsg;
-        char control[CMSG_SPACE(sizeof(int))];
-    } msg_control;
-    struct cmsghdr *cmsg;
-
-    iov[0].iov_base = index;
-    iov[0].iov_len = sizeof(*index);
-
-    memset(&msg, 0, sizeof(msg));
-    msg.msg_iov = iov;
-    msg.msg_iovlen = 1;
-    msg.msg_control = &msg_control;
-    msg.msg_controllen = sizeof(msg_control);
-
-    ret = recvmsg(client->sock_fd, &msg, 0);
-    if (ret < sizeof(*index)) {
-        IVSHMEM_CLIENT_DEBUG(client, "cannot read message: %s\n",
-                             strerror(errno));
-        return -1;
-    }
-    if (ret == 0) {
-        IVSHMEM_CLIENT_DEBUG(client, "lost connection to server\n");
-        return -1;
-    }
-
-    *index = GINT64_FROM_LE(*index);
-    *fd = -1;
-
-    for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
-
-        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)) ||
-            cmsg->cmsg_level != SOL_SOCKET ||
-            cmsg->cmsg_type != SCM_RIGHTS) {
-            continue;
-        }
-
-        memcpy(fd, CMSG_DATA(cmsg), sizeof(*fd));
-    }
-
-    return 0;
-}
-
-/* free a peer when the server advertises a disconnection or when the
- * client is freed */
-static void
-ivshmem_client_free_peer(IvshmemClient *client, IvshmemClientPeer *peer)
-{
-    unsigned vector;
-
-    QTAILQ_REMOVE(&client->peer_list, peer, next);
-    for (vector = 0; vector < peer->vectors_count; vector++) {
-        close(peer->vectors[vector]);
-    }
-
-    g_free(peer);
-}
-
-/* handle message coming from server (new peer, new vectors) */
-static int
-ivshmem_client_handle_server_msg(IvshmemClient *client)
-{
-    IvshmemClientPeer *peer;
-    int64_t peer_id;
-    int ret, fd;
-
-    ret = ivshmem_client_read_one_msg(client, &peer_id, &fd);
-    if (ret < 0) {
-        return -1;
-    }
-
-    /* can return a peer or the local client */
-    peer = ivshmem_client_search_peer(client, peer_id);
-
-    /* delete peer */
-    if (fd == -1) {
-
-        if (peer == NULL || peer == &client->local) {
-            IVSHMEM_CLIENT_DEBUG(client, "receive delete for invalid "
-                                 "peer %" PRId64 "\n", peer_id);
-            return -1;
-        }
-
-        IVSHMEM_CLIENT_DEBUG(client, "delete peer id = %" PRId64 "\n", peer_id);
-        ivshmem_client_free_peer(client, peer);
-        return 0;
-    }
-
-    /* new peer */
-    if (peer == NULL) {
-        peer = g_malloc0(sizeof(*peer));
-        peer->id = peer_id;
-        peer->vectors_count = 0;
-        QTAILQ_INSERT_TAIL(&client->peer_list, peer, next);
-        IVSHMEM_CLIENT_DEBUG(client, "new peer id = %" PRId64 "\n", peer_id);
-    }
-
-    /* new vector */
-    IVSHMEM_CLIENT_DEBUG(client, "  new vector %d (fd=%d) for peer id %"
-                         PRId64 "\n", peer->vectors_count, fd, peer->id);
-    if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) {
-        IVSHMEM_CLIENT_DEBUG(client, "Too many vectors received, failing");
-        return -1;
-    }
-
-    peer->vectors[peer->vectors_count] = fd;
-    peer->vectors_count++;
-
-    return 0;
-}
-
-/* init a new ivshmem client */
-int
-ivshmem_client_init(IvshmemClient *client, const char *unix_sock_path,
-                    IvshmemClientNotifCb notif_cb, void *notif_arg,
-                    bool verbose)
-{
-    int ret;
-    unsigned i;
-
-    memset(client, 0, sizeof(*client));
-
-    ret = snprintf(client->unix_sock_path, sizeof(client->unix_sock_path),
-                   "%s", unix_sock_path);
-
-    if (ret < 0 || ret >= sizeof(client->unix_sock_path)) {
-        IVSHMEM_CLIENT_DEBUG(client, "could not copy unix socket path\n");
-        return -1;
-    }
-
-    for (i = 0; i < IVSHMEM_CLIENT_MAX_VECTORS; i++) {
-        client->local.vectors[i] = -1;
-    }
-
-    QTAILQ_INIT(&client->peer_list);
-    client->local.id = -1;
-
-    client->notif_cb = notif_cb;
-    client->notif_arg = notif_arg;
-    client->verbose = verbose;
-    client->shm_fd = -1;
-    client->sock_fd = -1;
-
-    return 0;
-}
-
-/* create and connect to the unix socket */
-int
-ivshmem_client_connect(IvshmemClient *client)
-{
-    struct sockaddr_un sun;
-    int fd, ret;
-    int64_t tmp;
-
-    IVSHMEM_CLIENT_DEBUG(client, "connect to client %s\n",
-                         client->unix_sock_path);
-
-    client->sock_fd = socket(AF_UNIX, SOCK_STREAM, 0);
-    if (client->sock_fd < 0) {
-        IVSHMEM_CLIENT_DEBUG(client, "cannot create socket: %s\n",
-                             strerror(errno));
-        return -1;
-    }
-
-    sun.sun_family = AF_UNIX;
-    ret = snprintf(sun.sun_path, sizeof(sun.sun_path), "%s",
-                   client->unix_sock_path);
-    if (ret < 0 || ret >= sizeof(sun.sun_path)) {
-        IVSHMEM_CLIENT_DEBUG(client, "could not copy unix socket path\n");
-        goto err_close;
-    }
-
-    if (connect(client->sock_fd, (struct sockaddr *)&sun, sizeof(sun)) < 0) {
-        IVSHMEM_CLIENT_DEBUG(client, "cannot connect to %s: %s\n", sun.sun_path,
-                             strerror(errno));
-        goto err_close;
-    }
-
-    /* first, we expect a protocol version */
-    if (ivshmem_client_read_one_msg(client, &tmp, &fd) < 0 ||
-        (tmp != IVSHMEM_PROTOCOL_VERSION) || fd != -1) {
-        IVSHMEM_CLIENT_DEBUG(client, "cannot read from server\n");
-        goto err_close;
-    }
-
-    /* then, we expect our index + a fd == -1 */
-    if (ivshmem_client_read_one_msg(client, &client->local.id, &fd) < 0 ||
-        client->local.id < 0 || fd != -1) {
-        IVSHMEM_CLIENT_DEBUG(client, "cannot read from server (2)\n");
-        goto err_close;
-    }
-    IVSHMEM_CLIENT_DEBUG(client, "our_id=%" PRId64 "\n", client->local.id);
-
-    /* now, we expect shared mem fd + a -1 index, note that shm fd
-     * is not used */
-    if (ivshmem_client_read_one_msg(client, &tmp, &fd) < 0 ||
-        tmp != -1 || fd < 0) {
-        if (fd >= 0) {
-            close(fd);
-        }
-        IVSHMEM_CLIENT_DEBUG(client, "cannot read from server (3)\n");
-        goto err_close;
-    }
-    client->shm_fd = fd;
-    IVSHMEM_CLIENT_DEBUG(client, "shm_fd=%d\n", fd);
-
-    return 0;
-
-err_close:
-    close(client->sock_fd);
-    client->sock_fd = -1;
-    return -1;
-}
-
-/* close connection to the server, and free all peer structures */
-void
-ivshmem_client_close(IvshmemClient *client)
-{
-    IvshmemClientPeer *peer;
-    unsigned i;
-
-    IVSHMEM_CLIENT_DEBUG(client, "close client\n");
-
-    while ((peer = QTAILQ_FIRST(&client->peer_list)) != NULL) {
-        ivshmem_client_free_peer(client, peer);
-    }
-
-    close(client->shm_fd);
-    client->shm_fd = -1;
-    close(client->sock_fd);
-    client->sock_fd = -1;
-    client->local.id = -1;
-    for (i = 0; i < IVSHMEM_CLIENT_MAX_VECTORS; i++) {
-        close(client->local.vectors[i]);
-        client->local.vectors[i] = -1;
-    }
-    client->local.vectors_count = 0;
-}
-
-/* get the fd_set according to the unix socket and peer list */
-void
-ivshmem_client_get_fds(const IvshmemClient *client, fd_set *fds, int *maxfd)
-{
-    int fd;
-    unsigned vector;
-
-    FD_SET(client->sock_fd, fds);
-    if (client->sock_fd >= *maxfd) {
-        *maxfd = client->sock_fd + 1;
-    }
-
-    for (vector = 0; vector < client->local.vectors_count; vector++) {
-        fd = client->local.vectors[vector];
-        FD_SET(fd, fds);
-        if (fd >= *maxfd) {
-            *maxfd = fd + 1;
-        }
-    }
-}
-
-/* handle events from eventfd: just print a message on notification */
-static int
-ivshmem_client_handle_event(IvshmemClient *client, const fd_set *cur, int maxfd)
-{
-    IvshmemClientPeer *peer;
-    uint64_t kick;
-    unsigned i;
-    int ret;
-
-    peer = &client->local;
-
-    for (i = 0; i < peer->vectors_count; i++) {
-        if (peer->vectors[i] >= maxfd || !FD_ISSET(peer->vectors[i], cur)) {
-            continue;
-        }
-
-        ret = read(peer->vectors[i], &kick, sizeof(kick));
-        if (ret < 0) {
-            return ret;
-        }
-        if (ret != sizeof(kick)) {
-            IVSHMEM_CLIENT_DEBUG(client, "invalid read size = %d\n", ret);
-            errno = EINVAL;
-            return -1;
-        }
-        IVSHMEM_CLIENT_DEBUG(client, "received event on fd %d vector %d: %"
-                             PRIu64 "\n", peer->vectors[i], i, kick);
-        if (client->notif_cb != NULL) {
-            client->notif_cb(client, peer, i, client->notif_arg);
-        }
-    }
-
-    return 0;
-}
-
-/* read and handle new messages on the given fd_set */
-int
-ivshmem_client_handle_fds(IvshmemClient *client, fd_set *fds, int maxfd)
-{
-    if (client->sock_fd < maxfd && FD_ISSET(client->sock_fd, fds) &&
-        ivshmem_client_handle_server_msg(client) < 0 && errno != EINTR) {
-        IVSHMEM_CLIENT_DEBUG(client, "ivshmem_client_handle_server_msg() "
-                             "failed\n");
-        return -1;
-    } else if (ivshmem_client_handle_event(client, fds, maxfd) < 0 &&
-               errno != EINTR) {
-        IVSHMEM_CLIENT_DEBUG(client, "ivshmem_client_handle_event() failed\n");
-        return -1;
-    }
-
-    return 0;
-}
-
-/* send a notification on a vector of a peer */
-int
-ivshmem_client_notify(const IvshmemClient *client,
-                      const IvshmemClientPeer *peer, unsigned vector)
-{
-    uint64_t kick;
-    int fd;
-
-    if (vector >= peer->vectors_count) {
-        IVSHMEM_CLIENT_DEBUG(client, "invalid vector %u on peer %" PRId64 "\n",
-                             vector, peer->id);
-        return -1;
-    }
-    fd = peer->vectors[vector];
-    IVSHMEM_CLIENT_DEBUG(client, "notify peer %" PRId64
-                         " on vector %d, fd %d\n", peer->id, vector, fd);
-
-    kick = 1;
-    if (write(fd, &kick, sizeof(kick)) != sizeof(kick)) {
-        fprintf(stderr, "could not write to %d: %s\n", peer->vectors[vector],
-                strerror(errno));
-        return -1;
-    }
-    return 0;
-}
-
-/* send a notification to all vectors of a peer */
-int
-ivshmem_client_notify_all_vects(const IvshmemClient *client,
-                                const IvshmemClientPeer *peer)
-{
-    unsigned vector;
-    int ret = 0;
-
-    for (vector = 0; vector < peer->vectors_count; vector++) {
-        if (ivshmem_client_notify(client, peer, vector) < 0) {
-            ret = -1;
-        }
-    }
-
-    return ret;
-}
-
-/* send a notification to all peers */
-int
-ivshmem_client_notify_broadcast(const IvshmemClient *client)
-{
-    IvshmemClientPeer *peer;
-    int ret = 0;
-
-    QTAILQ_FOREACH(peer, &client->peer_list, next) {
-        if (ivshmem_client_notify_all_vects(client, peer) < 0) {
-            ret = -1;
-        }
-    }
-
-    return ret;
-}
-
-/* lookup peer from its id */
-IvshmemClientPeer *
-ivshmem_client_search_peer(IvshmemClient *client, int64_t peer_id)
-{
-    IvshmemClientPeer *peer;
-
-    if (peer_id == client->local.id) {
-        return &client->local;
-    }
-
-    QTAILQ_FOREACH(peer, &client->peer_list, next) {
-        if (peer->id == peer_id) {
-            return peer;
-        }
-    }
-    return NULL;
-}
-
-/* dump our info, the list of peers their vectors on stdout */
-void
-ivshmem_client_dump(const IvshmemClient *client)
-{
-    const IvshmemClientPeer *peer;
-    unsigned vector;
-
-    /* dump local infos */
-    peer = &client->local;
-    printf("our_id = %" PRId64 "\n", peer->id);
-    for (vector = 0; vector < peer->vectors_count; vector++) {
-        printf("  vector %d is enabled (fd=%d)\n", vector,
-               peer->vectors[vector]);
-    }
-
-    /* dump peers */
-    QTAILQ_FOREACH(peer, &client->peer_list, next) {
-        printf("peer_id = %" PRId64 "\n", peer->id);
-
-        for (vector = 0; vector < peer->vectors_count; vector++) {
-            printf("  vector %d is enabled (fd=%d)\n", vector,
-                   peer->vectors[vector]);
-        }
-    }
-}
--- a/contrib/ivshmem-client/ivshmem-client.h
+++ b/contrib/ivshmem-client/ivshmem-client.h
@@ -1,213 +0,0 @@
-/*
- * Copyright 6WIND S.A., 2014
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or
- * (at your option) any later version.  See the COPYING file in the
- * top-level directory.
- */
-
-#ifndef _IVSHMEM_CLIENT_H_
-#define _IVSHMEM_CLIENT_H_
-
-/**
- * This file provides helper to implement an ivshmem client. It is used
- * on the host to ask QEMU to send an interrupt to an ivshmem PCI device in a
- * guest. QEMU also implements an ivshmem client similar to this one, they both
- * connect to an ivshmem server.
- *
- * A standalone ivshmem client based on this file is provided for debug/test
- * purposes.
- */
-
-#include <limits.h>
-#include <sys/select.h>
-
-#include "qemu/queue.h"
-#include "hw/misc/ivshmem.h"
-
-/**
- * Maximum number of notification vectors supported by the client
- */
-#define IVSHMEM_CLIENT_MAX_VECTORS 64
-
-/**
- * Structure storing a peer
- *
- * Each time a client connects to an ivshmem server, it is advertised to
- * all connected clients through the unix socket. When our ivshmem
- * client receives a notification, it creates a IvshmemClientPeer
- * structure to store the infos of this peer.
- *
- * This structure is also used to store the information of our own
- * client in (IvshmemClient)->local.
- */
-typedef struct IvshmemClientPeer {
-    QTAILQ_ENTRY(IvshmemClientPeer) next;    /**< next in list*/
-    int64_t id;                              /**< the id of the peer */
-    int vectors[IVSHMEM_CLIENT_MAX_VECTORS]; /**< one fd per vector */
-    unsigned vectors_count;                  /**< number of vectors */
-} IvshmemClientPeer;
-QTAILQ_HEAD(IvshmemClientPeerList, IvshmemClientPeer);
-
-typedef struct IvshmemClientPeerList IvshmemClientPeerList;
-typedef struct IvshmemClient IvshmemClient;
-
-/**
- * Typedef of callback function used when our IvshmemClient receives a
- * notification from a peer.
- */
-typedef void (*IvshmemClientNotifCb)(
-    const IvshmemClient *client,
-    const IvshmemClientPeer *peer,
-    unsigned vect, void *arg);
-
-/**
- * Structure describing an ivshmem client
- *
- * This structure stores all information related to our client: the name
- * of the server unix socket, the list of peers advertised by the
- * server, our own client information, and a pointer the notification
- * callback function used when we receive a notification from a peer.
- */
-struct IvshmemClient {
-    char unix_sock_path[PATH_MAX];      /**< path to unix sock */
-    int sock_fd;                        /**< unix sock filedesc */
-    int shm_fd;                         /**< shm file descriptor */
-
-    IvshmemClientPeerList peer_list;    /**< list of peers */
-    IvshmemClientPeer local;            /**< our own infos */
-
-    IvshmemClientNotifCb notif_cb;      /**< notification callback */
-    void *notif_arg;                    /**< notification argument */
-
-    bool verbose;                       /**< true to enable debug */
-};
-
-/**
- * Initialize an ivshmem client
- *
- * @client:         A pointer to an uninitialized IvshmemClient structure
- * @unix_sock_path: The pointer to the unix socket file name
- * @notif_cb:       If not NULL, the pointer to the function to be called when
- *                  our IvshmemClient receives a notification from a peer
- * @notif_arg:      Opaque pointer given as-is to the notification callback
- *                  function
- * @verbose:        True to enable debug
- *
- * Returns:         0 on success, or a negative value on error
- */
-int ivshmem_client_init(IvshmemClient *client, const char *unix_sock_path,
-                        IvshmemClientNotifCb notif_cb, void *notif_arg,
-                        bool verbose);
-
-/**
- * Connect to the server
- *
- * Connect to the server unix socket, and read the first initial
- * messages sent by the server, giving the ID of the client and the file
- * descriptor of the shared memory.
- *
- * @client: The ivshmem client
- *
- * Returns: 0 on success, or a negative value on error
- */
-int ivshmem_client_connect(IvshmemClient *client);
-
-/**
- * Close connection to the server and free all peer structures
- *
- * @client: The ivshmem client
- */
-void ivshmem_client_close(IvshmemClient *client);
-
-/**
- * Fill a fd_set with file descriptors to be monitored
- *
- * This function will fill a fd_set with all file descriptors
- * that must be polled (unix server socket and peers eventfd). The
- * function will not initialize the fd_set, it is up to the caller
- * to do this.
- *
- * @client: The ivshmem client
- * @fds:    The fd_set to be updated
- * @maxfd:  Must be set to the max file descriptor + 1 in fd_set. This value is
- *          updated if this function adds a greater fd in fd_set.
- */
-void ivshmem_client_get_fds(const IvshmemClient *client, fd_set *fds,
-                            int *maxfd);
-
-/**
- * Read and handle new messages
- *
- * Given a fd_set filled by select(), handle incoming messages from
- * server or peers.
- *
- * @client: The ivshmem client
- * @fds:    The fd_set containing the file descriptors to be checked. Note
- *          that file descriptors that are not related to our client are
- *          ignored.
- * @maxfd:  The maximum fd in fd_set, plus one.
- *
- * Returns: 0 on success, or a negative value on error
- */
-int ivshmem_client_handle_fds(IvshmemClient *client, fd_set *fds, int maxfd);
-
-/**
- * Send a notification to a vector of a peer
- *
- * @client: The ivshmem client
- * @peer:   The peer to be notified
- * @vector: The number of the vector
- *
- * Returns: 0 on success, or a negative value on error
- */
-int ivshmem_client_notify(const IvshmemClient *client,
-                          const IvshmemClientPeer *peer, unsigned vector);
-
-/**
- * Send a notification to all vectors of a peer
- *
- * @client: The ivshmem client
- * @peer:   The peer to be notified
- *
- * Returns: 0 on success, or a negative value on error (at least one
- *          notification failed)
- */
-int ivshmem_client_notify_all_vects(const IvshmemClient *client,
-                                    const IvshmemClientPeer *peer);
-
-/**
- * Broadcat a notification to all vectors of all peers
- *
- * @client: The ivshmem client
- *
- * Returns: 0 on success, or a negative value on error (at least one
- *          notification failed)
- */
-int ivshmem_client_notify_broadcast(const IvshmemClient *client);
-
-/**
- * Search a peer from its identifier
- *
- * Return the peer structure from its peer_id. If the given peer_id is
- * the local id, the function returns the local peer structure.
- *
- * @client:  The ivshmem client
- * @peer_id: The identifier of the peer structure
- *
- * Returns:  The peer structure, or NULL if not found
- */
-IvshmemClientPeer *
-ivshmem_client_search_peer(IvshmemClient *client, int64_t peer_id);
-
-/**
- * Dump information of this ivshmem client on stdout
- *
- * Dump the id and the vectors of the given ivshmem client and the list
- * of its peers and their vectors on stdout.
- *
- * @client: The ivshmem client
- */
-void ivshmem_client_dump(const IvshmemClient *client);
-
-#endif /* _IVSHMEM_CLIENT_H_ */
--- a/contrib/ivshmem-client/main.c
+++ b/contrib/ivshmem-client/main.c
@@ -1,240 +0,0 @@
-/*
- * Copyright 6WIND S.A., 2014
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or
- * (at your option) any later version.  See the COPYING file in the
- * top-level directory.
- */
-
-#include "qemu-common.h"
-
-#include "ivshmem-client.h"
-
-#define IVSHMEM_CLIENT_DEFAULT_VERBOSE        0
-#define IVSHMEM_CLIENT_DEFAULT_UNIX_SOCK_PATH "/tmp/ivshmem_socket"
-
-typedef struct IvshmemClientArgs {
-    bool verbose;
-    const char *unix_sock_path;
-} IvshmemClientArgs;
-
-/* show ivshmem_client_usage and exit with given error code */
-static void
-ivshmem_client_usage(const char *name, int code)
-{
-    fprintf(stderr, "%s [opts]\n", name);
-    fprintf(stderr, "  -h: show this help\n");
-    fprintf(stderr, "  -v: verbose mode\n");
-    fprintf(stderr, "  -S <unix_sock_path>: path to the unix socket\n"
-                    "     to connect to.\n"
-                    "     default=%s\n", IVSHMEM_CLIENT_DEFAULT_UNIX_SOCK_PATH);
-    exit(code);
-}
-
-/* parse the program arguments, exit on error */
-static void
-ivshmem_client_parse_args(IvshmemClientArgs *args, int argc, char *argv[])
-{
-    int c;
-
-    while ((c = getopt(argc, argv,
-                       "h"  /* help */
-                       "v"  /* verbose */
-                       "S:" /* unix_sock_path */
-                      )) != -1) {
-
-        switch (c) {
-        case 'h': /* help */
-            ivshmem_client_usage(argv[0], 0);
-            break;
-
-        case 'v': /* verbose */
-            args->verbose = 1;
-            break;
-
-        case 'S': /* unix_sock_path */
-            args->unix_sock_path = optarg;
-            break;
-
-        default:
-            ivshmem_client_usage(argv[0], 1);
-            break;
-        }
-    }
-}
-
-/* show command line help */
-static void
-ivshmem_client_cmdline_help(void)
-{
-    printf("dump: dump peers (including us)\n"
-           "int <peer> <vector>: notify one vector on a peer\n"
-           "int <peer> all: notify all vectors of a peer\n"
-           "int all: notify all vectors of all peers (excepting us)\n");
-}
-
-/* read stdin and handle commands */
-static int
-ivshmem_client_handle_stdin_command(IvshmemClient *client)
-{
-    IvshmemClientPeer *peer;
-    char buf[128];
-    char *s, *token;
-    int ret;
-    int peer_id, vector;
-
-    memset(buf, 0, sizeof(buf));
-    ret = read(0, buf, sizeof(buf) - 1);
-    if (ret < 0) {
-        return -1;
-    }
-
-    s = buf;
-    while ((token = strsep(&s, "\n\r;")) != NULL) {
-        if (!strcmp(token, "")) {
-            continue;
-        }
-        if (!strcmp(token, "?")) {
-            ivshmem_client_cmdline_help();
-        }
-        if (!strcmp(token, "help")) {
-            ivshmem_client_cmdline_help();
-        } else if (!strcmp(token, "dump")) {
-            ivshmem_client_dump(client);
-        } else if (!strcmp(token, "int all")) {
-            ivshmem_client_notify_broadcast(client);
-        } else if (sscanf(token, "int %d %d", &peer_id, &vector) == 2) {
-            peer = ivshmem_client_search_peer(client, peer_id);
-            if (peer == NULL) {
-                printf("cannot find peer_id = %d\n", peer_id);
-                continue;
-            }
-            ivshmem_client_notify(client, peer, vector);
-        } else if (sscanf(token, "int %d all", &peer_id) == 1) {
-            peer = ivshmem_client_search_peer(client, peer_id);
-            if (peer == NULL) {
-                printf("cannot find peer_id = %d\n", peer_id);
-                continue;
-            }
-            ivshmem_client_notify_all_vects(client, peer);
-        } else {
-            printf("invalid command, type help\n");
-        }
-    }
-
-    printf("cmd> ");
-    fflush(stdout);
-    return 0;
-}
-
-/* listen on stdin (command line), on unix socket (notifications of new
- * and dead peers), and on eventfd (IRQ request) */
-static int
-ivshmem_client_poll_events(IvshmemClient *client)
-{
-    fd_set fds;
-    int ret, maxfd;
-
-    while (1) {
-
-        FD_ZERO(&fds);
-        FD_SET(0, &fds); /* add stdin in fd_set */
-        maxfd = 1;
-
-        ivshmem_client_get_fds(client, &fds, &maxfd);
-
-        ret = select(maxfd, &fds, NULL, NULL, NULL);
-        if (ret < 0) {
-            if (errno == EINTR) {
-                continue;
-            }
-
-            fprintf(stderr, "select error: %s\n", strerror(errno));
-            break;
-        }
-        if (ret == 0) {
-            continue;
-        }
-
-        if (FD_ISSET(0, &fds) &&
-            ivshmem_client_handle_stdin_command(client) < 0 && errno != EINTR) {
-            fprintf(stderr, "ivshmem_client_handle_stdin_command() failed\n");
-            break;
-        }
-
-        if (ivshmem_client_handle_fds(client, &fds, maxfd) < 0) {
-            fprintf(stderr, "ivshmem_client_handle_fds() failed\n");
-            break;
-        }
-    }
-
-    return ret;
-}
-
-/* callback when we receive a notification (just display it) */
-static void
-ivshmem_client_notification_cb(const IvshmemClient *client,
-                               const IvshmemClientPeer *peer,
-                               unsigned vect, void *arg)
-{
-    (void)client;
-    (void)arg;
-    printf("receive notification from peer_id=%" PRId64 " vector=%u\n",
-           peer->id, vect);
-}
-
-int
-main(int argc, char *argv[])
-{
-    struct sigaction sa;
-    IvshmemClient client;
-    IvshmemClientArgs args = {
-        .verbose = IVSHMEM_CLIENT_DEFAULT_VERBOSE,
-        .unix_sock_path = IVSHMEM_CLIENT_DEFAULT_UNIX_SOCK_PATH,
-    };
-
-    /* parse arguments, will exit on error */
-    ivshmem_client_parse_args(&args, argc, argv);
-
-    /* Ignore SIGPIPE, see this link for more info:
-     * http://www.mail-archive.com/libevent-users@monkey.org/msg01606.html */
-    sa.sa_handler = SIG_IGN;
-    sa.sa_flags = 0;
-    if (sigemptyset(&sa.sa_mask) == -1 ||
-        sigaction(SIGPIPE, &sa, 0) == -1) {
-        perror("failed to ignore SIGPIPE; sigaction");
-        return 1;
-    }
-
-    ivshmem_client_cmdline_help();
-    printf("cmd> ");
-    fflush(stdout);
-
-    if (ivshmem_client_init(&client, args.unix_sock_path,
-                            ivshmem_client_notification_cb, NULL,
-                            args.verbose) < 0) {
-        fprintf(stderr, "cannot init client\n");
-        return 1;
-    }
-
-    while (1) {
-        if (ivshmem_client_connect(&client) < 0) {
-            fprintf(stderr, "cannot connect to server, retry in 1 second\n");
-            sleep(1);
-            continue;
-        }
-
-        fprintf(stdout, "listen on server socket %d\n", client.sock_fd);
-
-        if (ivshmem_client_poll_events(&client) == 0) {
-            continue;
-        }
-
-        /* disconnected from server, reset all peers */
-        fprintf(stdout, "disconnected from server\n");
-
-        ivshmem_client_close(&client);
-    }
-
-    return 0;
-}
--- a/contrib/ivshmem-server/Makefile.objs
+++ b/contrib/ivshmem-server/Makefile.objs
@@ -1 +0,0 @@
-ivshmem-server-obj-y = ivshmem-server.o main.o
--- a/contrib/ivshmem-server/ivshmem-server.c
+++ b/contrib/ivshmem-server/ivshmem-server.c
@@ -1,491 +0,0 @@
-/*
- * Copyright 6WIND S.A., 2014
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or
- * (at your option) any later version.  See the COPYING file in the
- * top-level directory.
- */
-#include "qemu-common.h"
-#include "qemu/sockets.h"
-
-#include <sys/mman.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-#ifdef CONFIG_LINUX
-#include <sys/vfs.h>
-#endif
-
-#include "ivshmem-server.h"
-
-/* log a message on stdout if verbose=1 */
-#define IVSHMEM_SERVER_DEBUG(server, fmt, ...) do { \
-        if ((server)->verbose) {         \
-            printf(fmt, ## __VA_ARGS__); \
-        }                                \
-    } while (0)
-
-/** maximum size of a huge page, used by ivshmem_server_ftruncate() */
-#define IVSHMEM_SERVER_MAX_HUGEPAGE_SIZE (1024 * 1024 * 1024)
-
-/** default listen backlog (number of sockets not accepted) */
-#define IVSHMEM_SERVER_LISTEN_BACKLOG 10
-
-/* send message to a client unix socket */
-static int
-ivshmem_server_send_one_msg(int sock_fd, int64_t peer_id, int fd)
-{
-    int ret;
-    struct msghdr msg;
-    struct iovec iov[1];
-    union {
-        struct cmsghdr cmsg;
-        char control[CMSG_SPACE(sizeof(int))];
-    } msg_control;
-    struct cmsghdr *cmsg;
-
-    peer_id = GINT64_TO_LE(peer_id);
-    iov[0].iov_base = &peer_id;
-    iov[0].iov_len = sizeof(peer_id);
-
-    memset(&msg, 0, sizeof(msg));
-    msg.msg_iov = iov;
-    msg.msg_iovlen = 1;
-
-    /* if fd is specified, add it in a cmsg */
-    if (fd >= 0) {
-        memset(&msg_control, 0, sizeof(msg_control));
-        msg.msg_control = &msg_control;
-        msg.msg_controllen = sizeof(msg_control);
-        cmsg = CMSG_FIRSTHDR(&msg);
-        cmsg->cmsg_level = SOL_SOCKET;
-        cmsg->cmsg_type = SCM_RIGHTS;
-        cmsg->cmsg_len = CMSG_LEN(sizeof(int));
-        memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd));
-    }
-
-    ret = sendmsg(sock_fd, &msg, 0);
-    if (ret <= 0) {
-        return -1;
-    }
-
-    return 0;
-}
-
-/* free a peer when the server advertises a disconnection or when the
- * server is freed */
-static void
-ivshmem_server_free_peer(IvshmemServer *server, IvshmemServerPeer *peer)
-{
-    unsigned vector;
-    IvshmemServerPeer *other_peer;
-
-    IVSHMEM_SERVER_DEBUG(server, "free peer %" PRId64 "\n", peer->id);
-    close(peer->sock_fd);
-    QTAILQ_REMOVE(&server->peer_list, peer, next);
-
-    /* advertise the deletion to other peers */
-    QTAILQ_FOREACH(other_peer, &server->peer_list, next) {
-        ivshmem_server_send_one_msg(other_peer->sock_fd, peer->id, -1);
-    }
-
-    for (vector = 0; vector < peer->vectors_count; vector++) {
-        event_notifier_cleanup(&peer->vectors[vector]);
-    }
-
-    g_free(peer);
-}
-
-/* send the peer id and the shm_fd just after a new client connection */
-static int
-ivshmem_server_send_initial_info(IvshmemServer *server, IvshmemServerPeer *peer)
-{
-    int ret;
-
-    /* send our protocol version first */
-    ret = ivshmem_server_send_one_msg(peer->sock_fd, IVSHMEM_PROTOCOL_VERSION,
-                                      -1);
-    if (ret < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot send version: %s\n",
-                             strerror(errno));
-        return -1;
-    }
-
-    /* send the peer id to the client */
-    ret = ivshmem_server_send_one_msg(peer->sock_fd, peer->id, -1);
-    if (ret < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot send peer id: %s\n",
-                             strerror(errno));
-        return -1;
-    }
-
-    /* send the shm_fd */
-    ret = ivshmem_server_send_one_msg(peer->sock_fd, -1, server->shm_fd);
-    if (ret < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot send shm fd: %s\n",
-                             strerror(errno));
-        return -1;
-    }
-
-    return 0;
-}
-
-/* handle message on listening unix socket (new client connection) */
-static int
-ivshmem_server_handle_new_conn(IvshmemServer *server)
-{
-    IvshmemServerPeer *peer, *other_peer;
-    struct sockaddr_un unaddr;
-    socklen_t unaddr_len;
-    int newfd;
-    unsigned i;
-
-    /* accept the incoming connection */
-    unaddr_len = sizeof(unaddr);
-    newfd = qemu_accept(server->sock_fd,
-                        (struct sockaddr *)&unaddr, &unaddr_len);
-
-    if (newfd < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot accept() %s\n", strerror(errno));
-        return -1;
-    }
-
-    qemu_set_nonblock(newfd);
-    IVSHMEM_SERVER_DEBUG(server, "accept()=%d\n", newfd);
-
-    /* allocate new structure for this peer */
-    peer = g_malloc0(sizeof(*peer));
-    peer->sock_fd = newfd;
-
-    /* get an unused peer id */
-    /* XXX: this could use id allocation such as Linux IDA, or simply
-     * a free-list */
-    for (i = 0; i < G_MAXUINT16; i++) {
-        if (ivshmem_server_search_peer(server, server->cur_id) == NULL) {
-            break;
-        }
-        server->cur_id++;
-    }
-    if (i == G_MAXUINT16) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
-        goto fail;
-    }
-    peer->id = server->cur_id++;
-
-    /* create eventfd, one per vector */
-    peer->vectors_count = server->n_vectors;
-    for (i = 0; i < peer->vectors_count; i++) {
-        if (event_notifier_init(&peer->vectors[i], FALSE) < 0) {
-            IVSHMEM_SERVER_DEBUG(server, "cannot create eventfd\n");
-            goto fail;
-        }
-    }
-
-    /* send peer id and shm fd */
-    if (ivshmem_server_send_initial_info(server, peer) < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot send initial info\n");
-        goto fail;
-    }
-
-    /* advertise the new peer to others */
-    QTAILQ_FOREACH(other_peer, &server->peer_list, next) {
-        for (i = 0; i < peer->vectors_count; i++) {
-            ivshmem_server_send_one_msg(other_peer->sock_fd, peer->id,
-                                        peer->vectors[i].wfd);
-        }
-    }
-
-    /* advertise the other peers to the new one */
-    QTAILQ_FOREACH(other_peer, &server->peer_list, next) {
-        for (i = 0; i < peer->vectors_count; i++) {
-            ivshmem_server_send_one_msg(peer->sock_fd, other_peer->id,
-                                        other_peer->vectors[i].wfd);
-        }
-    }
-
-    /* advertise the new peer to itself */
-    for (i = 0; i < peer->vectors_count; i++) {
-        ivshmem_server_send_one_msg(peer->sock_fd, peer->id,
-                                    event_notifier_get_fd(&peer->vectors[i]));
-    }
-
-    QTAILQ_INSERT_TAIL(&server->peer_list, peer, next);
-    IVSHMEM_SERVER_DEBUG(server, "new peer id = %" PRId64 "\n",
-                         peer->id);
-    return 0;
-
-fail:
-    while (i--) {
-        event_notifier_cleanup(&peer->vectors[i]);
-    }
-    close(newfd);
-    g_free(peer);
-    return -1;
-}
-
-/* Try to ftruncate a file to next power of 2 of shmsize.
- * If it fails; all power of 2 above shmsize are tested until
- * we reach the maximum huge page size. This is useful
- * if the shm file is in a hugetlbfs that cannot be truncated to the
- * shm_size value. */
-static int
-ivshmem_server_ftruncate(int fd, unsigned shmsize)
-{
-    int ret;
-    struct stat mapstat;
-
-    /* align shmsize to next power of 2 */
-    shmsize = pow2ceil(shmsize);
-
-    if (fstat(fd, &mapstat) != -1 && mapstat.st_size == shmsize) {
-        return 0;
-    }
-
-    while (shmsize <= IVSHMEM_SERVER_MAX_HUGEPAGE_SIZE) {
-        ret = ftruncate(fd, shmsize);
-        if (ret == 0) {
-            return ret;
-        }
-        shmsize *= 2;
-    }
-
-    return -1;
-}
-
-/* Init a new ivshmem server */
-int
-ivshmem_server_init(IvshmemServer *server, const char *unix_sock_path,
-                    const char *shm_path, size_t shm_size, unsigned n_vectors,
-                    bool verbose)
-{
-    int ret;
-
-    memset(server, 0, sizeof(*server));
-    server->verbose = verbose;
-
-    ret = snprintf(server->unix_sock_path, sizeof(server->unix_sock_path),
-                   "%s", unix_sock_path);
-    if (ret < 0 || ret >= sizeof(server->unix_sock_path)) {
-        IVSHMEM_SERVER_DEBUG(server, "could not copy unix socket path\n");
-        return -1;
-    }
-    ret = snprintf(server->shm_path, sizeof(server->shm_path),
-                   "%s", shm_path);
-    if (ret < 0 || ret >= sizeof(server->shm_path)) {
-        IVSHMEM_SERVER_DEBUG(server, "could not copy shm path\n");
-        return -1;
-    }
-
-    server->shm_size = shm_size;
-    server->n_vectors = n_vectors;
-
-    QTAILQ_INIT(&server->peer_list);
-
-    return 0;
-}
-
-#ifdef CONFIG_LINUX
-
-#define HUGETLBFS_MAGIC       0x958458f6
-
-static long gethugepagesize(const char *path)
-{
-    struct statfs fs;
-    int ret;
-
-    do {
-        ret = statfs(path, &fs);
-    } while (ret != 0 && errno == EINTR);
-
-    if (ret != 0) {
-        return -1;
-    }
-
-    if (fs.f_type != HUGETLBFS_MAGIC) {
-        return -1;
-    }
-
-    return fs.f_bsize;
-}
-#endif
-
-/* open shm, create and bind to the unix socket */
-int
-ivshmem_server_start(IvshmemServer *server)
-{
-    struct sockaddr_un sun;
-    int shm_fd, sock_fd, ret;
-
-    /* open shm file */
-#ifdef CONFIG_LINUX
-    long hpagesize;
-
-    hpagesize = gethugepagesize(server->shm_path);
-    if (hpagesize < 0 && errno != ENOENT) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot stat shm file %s: %s\n",
-                             server->shm_path, strerror(errno));
-    }
-
-    if (hpagesize > 0) {
-        gchar *filename = g_strdup_printf("%s/ivshmem.XXXXXX", server->shm_path);
-        IVSHMEM_SERVER_DEBUG(server, "Using hugepages: %s\n", server->shm_path);
-        shm_fd = mkstemp(filename);
-        unlink(filename);
-        g_free(filename);
-    } else
-#endif
-    {
-        IVSHMEM_SERVER_DEBUG(server, "Using POSIX shared memory: %s\n",
-                             server->shm_path);
-        shm_fd = shm_open(server->shm_path, O_CREAT|O_RDWR, S_IRWXU);
-    }
-
-    if (shm_fd < 0) {
-        fprintf(stderr, "cannot open shm file %s: %s\n", server->shm_path,
-                strerror(errno));
-        return -1;
-    }
-    if (ivshmem_server_ftruncate(shm_fd, server->shm_size) < 0) {
-        fprintf(stderr, "ftruncate(%s) failed: %s\n", server->shm_path,
-                strerror(errno));
-        goto err_close_shm;
-    }
-
-    IVSHMEM_SERVER_DEBUG(server, "create & bind socket %s\n",
-                         server->unix_sock_path);
-
-    /* create the unix listening socket */
-    sock_fd = socket(AF_UNIX, SOCK_STREAM, 0);
-    if (sock_fd < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot create socket: %s\n",
-                             strerror(errno));
-        goto err_close_shm;
-    }
-
-    sun.sun_family = AF_UNIX;
-    ret = snprintf(sun.sun_path, sizeof(sun.sun_path), "%s",
-                   server->unix_sock_path);
-    if (ret < 0 || ret >= sizeof(sun.sun_path)) {
-        IVSHMEM_SERVER_DEBUG(server, "could not copy unix socket path\n");
-        goto err_close_sock;
-    }
-    if (bind(sock_fd, (struct sockaddr *)&sun, sizeof(sun)) < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "cannot connect to %s: %s\n", sun.sun_path,
-                             strerror(errno));
-        goto err_close_sock;
-    }
-
-    if (listen(sock_fd, IVSHMEM_SERVER_LISTEN_BACKLOG) < 0) {
-        IVSHMEM_SERVER_DEBUG(server, "listen() failed: %s\n", strerror(errno));
-        goto err_close_sock;
-    }
-
-    server->sock_fd = sock_fd;
-    server->shm_fd = shm_fd;
-
-    return 0;
-
-err_close_sock:
-    close(sock_fd);
-err_close_shm:
-    close(shm_fd);
-    return -1;
-}
-
-/* close connections to clients, the unix socket and the shm fd */
-void
-ivshmem_server_close(IvshmemServer *server)
-{
-    IvshmemServerPeer *peer, *npeer;
-
-    IVSHMEM_SERVER_DEBUG(server, "close server\n");
-
-    QTAILQ_FOREACH_SAFE(peer, &server->peer_list, next, npeer) {
-        ivshmem_server_free_peer(server, peer);
-    }
-
-    unlink(server->unix_sock_path);
-    close(server->sock_fd);
-    close(server->shm_fd);
-    server->sock_fd = -1;
-    server->shm_fd = -1;
-}
-
-/* get the fd_set according to the unix socket and the peer list */
-void
-ivshmem_server_get_fds(const IvshmemServer *server, fd_set *fds, int *maxfd)
-{
-    IvshmemServerPeer *peer;
-
-    if (server->sock_fd == -1) {
-        return;
-    }
-
-    FD_SET(server->sock_fd, fds);
-    if (server->sock_fd >= *maxfd) {
-        *maxfd = server->sock_fd + 1;
-    }
-
-    QTAILQ_FOREACH(peer, &server->peer_list, next) {
-        FD_SET(peer->sock_fd, fds);
-        if (peer->sock_fd >= *maxfd) {
-            *maxfd = peer->sock_fd + 1;
-        }
-    }
-}
-
-/* process incoming messages on the sockets in fd_set */
-int
-ivshmem_server_handle_fds(IvshmemServer *server, fd_set *fds, int maxfd)
-{
-    IvshmemServerPeer *peer, *peer_next;
-
-    if (server->sock_fd < maxfd && FD_ISSET(server->sock_fd, fds) &&
-        ivshmem_server_handle_new_conn(server) < 0 && errno != EINTR) {
-        IVSHMEM_SERVER_DEBUG(server, "ivshmem_server_handle_new_conn() "
-                             "failed\n");
-        return -1;
-    }
-
-    QTAILQ_FOREACH_SAFE(peer, &server->peer_list, next, peer_next) {
-        /* any message from a peer socket result in a close() */
-        IVSHMEM_SERVER_DEBUG(server, "peer->sock_fd=%d\n", peer->sock_fd);
-        if (peer->sock_fd < maxfd && FD_ISSET(peer->sock_fd, fds)) {
-            ivshmem_server_free_peer(server, peer);
-        }
-    }
-
-    return 0;
-}
-
-/* lookup peer from its id */
-IvshmemServerPeer *
-ivshmem_server_search_peer(IvshmemServer *server, int64_t peer_id)
-{
-    IvshmemServerPeer *peer;
-
-    QTAILQ_FOREACH(peer, &server->peer_list, next) {
-        if (peer->id == peer_id) {
-            return peer;
-        }
-    }
-    return NULL;
-}
-
-/* dump our info, the list of peers their vectors on stdout */
-void
-ivshmem_server_dump(const IvshmemServer *server)
-{
-    const IvshmemServerPeer *peer;
-    unsigned vector;
-
-    /* dump peers */
-    QTAILQ_FOREACH(peer, &server->peer_list, next) {
-        printf("peer_id = %" PRId64 "\n", peer->id);
-
-        for (vector = 0; vector < peer->vectors_count; vector++) {
-            printf("  vector %d is enabled (fd=%d)\n", vector,
-                   event_notifier_get_fd(&peer->vectors[vector]));
-        }
-    }
-}
--- a/contrib/ivshmem-server/ivshmem-server.h
+++ b/contrib/ivshmem-server/ivshmem-server.h
@@ -1,167 +0,0 @@
-/*
- * Copyright 6WIND S.A., 2014
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or
- * (at your option) any later version.  See the COPYING file in the
- * top-level directory.
- */
-
-#ifndef _IVSHMEM_SERVER_H_
-#define _IVSHMEM_SERVER_H_
-
-/**
- * The ivshmem server is a daemon that creates a unix socket in listen
- * mode. The ivshmem clients (qemu or ivshmem-client) connect to this
- * unix socket. For each client, the server will create some eventfd
- * (see EVENTFD(2)), one per vector. These fd are transmitted to all
- * clients using the SCM_RIGHTS cmsg message. Therefore, each client is
- * able to send a notification to another client without beeing
- * "profixied" by the server.
- *
- * We use this mechanism to send interruptions between guests.
- * qemu is able to transform an event on a eventfd into a PCI MSI-x
- * interruption in the guest.
- *
- * The ivshmem server is also able to share the file descriptor
- * associated to the ivshmem shared memory.
- */
-
-#include <limits.h>
-#include <sys/select.h>
-#include <stdint.h>
-#include <stdbool.h>
-
-#include "qemu/event_notifier.h"
-#include "qemu/queue.h"
-#include "hw/misc/ivshmem.h"
-
-/**
- * Maximum number of notification vectors supported by the server
- */
-#define IVSHMEM_SERVER_MAX_VECTORS 64
-
-/**
- * Structure storing a peer
- *
- * Each time a client connects to an ivshmem server, a new
- * IvshmemServerPeer structure is created. This peer and all its
- * vectors are advertised to all connected clients through the connected
- * unix sockets.
- */
-typedef struct IvshmemServerPeer {
-    QTAILQ_ENTRY(IvshmemServerPeer) next;    /**< next in list*/
-    int sock_fd;                             /**< connected unix sock */
-    int64_t id;                              /**< the id of the peer */
-    EventNotifier vectors[IVSHMEM_SERVER_MAX_VECTORS]; /**< one per vector */
-    unsigned vectors_count;                  /**< number of vectors */
-} IvshmemServerPeer;
-QTAILQ_HEAD(IvshmemServerPeerList, IvshmemServerPeer);
-
-typedef struct IvshmemServerPeerList IvshmemServerPeerList;
-
-/**
- * Structure describing an ivshmem server
- *
- * This structure stores all information related to our server: the name
- * of the server unix socket and the list of connected peers.
- */
-typedef struct IvshmemServer {
-    char unix_sock_path[PATH_MAX];   /**< path to unix socket */
-    int sock_fd;                     /**< unix sock file descriptor */
-    char shm_path[PATH_MAX];         /**< path to shm */
-    size_t shm_size;                 /**< size of shm */
-    int shm_fd;                      /**< shm file descriptor */
-    unsigned n_vectors;              /**< number of vectors */
-    uint16_t cur_id;                 /**< id to be given to next client */
-    bool verbose;                    /**< true in verbose mode */
-    IvshmemServerPeerList peer_list; /**< list of peers */
-} IvshmemServer;
-
-/**
- * Initialize an ivshmem server
- *
- * @server:         A pointer to an uninitialized IvshmemServer structure
- * @unix_sock_path: The pointer to the unix socket file name
- * @shm_path:       Path to the shared memory. The path corresponds to a POSIX
- *                  shm name or a hugetlbfs mount point.
- * @shm_size:       Size of shared memory
- * @n_vectors:      Number of interrupt vectors per client
- * @verbose:        True to enable verbose mode
- *
- * Returns:         0 on success, or a negative value on error
- */
-int
-ivshmem_server_init(IvshmemServer *server, const char *unix_sock_path,
-                    const char *shm_path, size_t shm_size, unsigned n_vectors,
-                    bool verbose);
-
-/**
- * Open the shm, then create and bind to the unix socket
- *
- * @server: The pointer to the initialized IvshmemServer structure
- *
- * Returns: 0 on success, or a negative value on error
- */
-int ivshmem_server_start(IvshmemServer *server);
-
-/**
- * Close the server
- *
- * Close connections to all clients, close the unix socket and the
- * shared memory file descriptor. The structure remains initialized, so
- * it is possible to call ivshmem_server_start() again after a call to
- * ivshmem_server_close().
- *
- * @server: The ivshmem server
- */
-void ivshmem_server_close(IvshmemServer *server);
-
-/**
- * Fill a fd_set with file descriptors to be monitored
- *
- * This function will fill a fd_set with all file descriptors that must
- * be polled (unix server socket and peers unix socket). The function
- * will not initialize the fd_set, it is up to the caller to do it.
- *
- * @server: The ivshmem server
- * @fds:    The fd_set to be updated
- * @maxfd:  Must be set to the max file descriptor + 1 in fd_set. This value is
- *          updated if this function adds a greater fd in fd_set.
- */
-void
-ivshmem_server_get_fds(const IvshmemServer *server, fd_set *fds, int *maxfd);
-
-/**
- * Read and handle new messages
- *
- * Given a fd_set (for instance filled by a call to select()), handle
- * incoming messages from peers.
- *
- * @server: The ivshmem server
- * @fds:    The fd_set containing the file descriptors to be checked. Note that
- *          file descriptors that are not related to our server are ignored.
- * @maxfd:  The maximum fd in fd_set, plus one.
- *
- * Returns: 0 on success, or a negative value on error
- */
-int ivshmem_server_handle_fds(IvshmemServer *server, fd_set *fds, int maxfd);
-
-/**
- * Search a peer from its identifier
- *
- * @server:  The ivshmem server
- * @peer_id: The identifier of the peer structure
- *
- * Returns:  The peer structure, or NULL if not found
- */
-IvshmemServerPeer *
-ivshmem_server_search_peer(IvshmemServer *server, int64_t peer_id);
-
-/**
- * Dump information of this ivshmem server and its peers on stdout
- *
- * @server: The ivshmem server
- */
-void ivshmem_server_dump(const IvshmemServer *server);
-
-#endif /* _IVSHMEM_SERVER_H_ */
--- a/contrib/ivshmem-server/main.c
+++ b/contrib/ivshmem-server/main.c
@@ -1,263 +0,0 @@
-/*
- * Copyright 6WIND S.A., 2014
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or
- * (at your option) any later version.  See the COPYING file in the
- * top-level directory.
- */
-
-#include "qemu-common.h"
-
-#include "ivshmem-server.h"
-
-#define IVSHMEM_SERVER_DEFAULT_VERBOSE        0
-#define IVSHMEM_SERVER_DEFAULT_FOREGROUND     0
-#define IVSHMEM_SERVER_DEFAULT_PID_FILE       "/var/run/ivshmem-server.pid"
-#define IVSHMEM_SERVER_DEFAULT_UNIX_SOCK_PATH "/tmp/ivshmem_socket"
-#define IVSHMEM_SERVER_DEFAULT_SHM_PATH       "ivshmem"
-#define IVSHMEM_SERVER_DEFAULT_SHM_SIZE       (4*1024*1024)
-#define IVSHMEM_SERVER_DEFAULT_N_VECTORS      1
-
-/* used to quit on signal SIGTERM */
-static int ivshmem_server_quit;
-
-/* arguments given by the user */
-typedef struct IvshmemServerArgs {
-    bool verbose;
-    bool foreground;
-    const char *pid_file;
-    const char *unix_socket_path;
-    const char *shm_path;
-    uint64_t shm_size;
-    unsigned n_vectors;
-} IvshmemServerArgs;
-
-/* show ivshmem_server_usage and exit with given error code */
-static void
-ivshmem_server_usage(const char *name, int code)
-{
-    fprintf(stderr, "%s [opts]\n", name);
-    fprintf(stderr, "  -h: show this help\n");
-    fprintf(stderr, "  -v: verbose mode\n");
-    fprintf(stderr, "  -F: foreground mode (default is to daemonize)\n");
-    fprintf(stderr, "  -p <pid_file>: path to the PID file (used in daemon\n"
-                    "     mode only).\n"
-                    "     Default=%s\n", IVSHMEM_SERVER_DEFAULT_SHM_PATH);
-    fprintf(stderr, "  -S <unix_socket_path>: path to the unix socket\n"
-                    "     to listen to.\n"
-                    "     Default=%s\n", IVSHMEM_SERVER_DEFAULT_UNIX_SOCK_PATH);
-    fprintf(stderr, "  -m <shm_path>: path to the shared memory.\n"
-                    "     The path corresponds to a POSIX shm name or a\n"
-                    "     hugetlbfs mount point.\n"
-                    "     default=%s\n", IVSHMEM_SERVER_DEFAULT_SHM_PATH);
-    fprintf(stderr, "  -l <size>: size of shared memory in bytes. The suffix\n"
-                    "     K, M and G can be used (ex: 1K means 1024).\n"
-                    "     default=%u\n", IVSHMEM_SERVER_DEFAULT_SHM_SIZE);
-    fprintf(stderr, "  -n <n_vects>: number of vectors.\n"
-                    "     default=%u\n", IVSHMEM_SERVER_DEFAULT_N_VECTORS);
-
-    exit(code);
-}
-
-/* parse the program arguments, exit on error */
-static void
-ivshmem_server_parse_args(IvshmemServerArgs *args, int argc, char *argv[])
-{
-    int c;
-    unsigned long long v;
-    Error *errp = NULL;
-
-    while ((c = getopt(argc, argv,
-                       "h"  /* help */
-                       "v"  /* verbose */
-                       "F"  /* foreground */
-                       "p:" /* pid_file */
-                       "S:" /* unix_socket_path */
-                       "m:" /* shm_path */
-                       "l:" /* shm_size */
-                       "n:" /* n_vectors */
-                      )) != -1) {
-
-        switch (c) {
-        case 'h': /* help */
-            ivshmem_server_usage(argv[0], 0);
-            break;
-
-        case 'v': /* verbose */
-            args->verbose = 1;
-            break;
-
-        case 'F': /* foreground */
-            args->foreground = 1;
-            break;
-
-        case 'p': /* pid_file */
-            args->pid_file = optarg;
-            break;
-
-        case 'S': /* unix_socket_path */
-            args->unix_socket_path = optarg;
-            break;
-
-        case 'm': /* shm_path */
-            args->shm_path = optarg;
-            break;
-
-        case 'l': /* shm_size */
-            parse_option_size("shm_size", optarg, &args->shm_size, &errp);
-            if (errp) {
-                fprintf(stderr, "cannot parse shm size: %s\n",
-                        error_get_pretty(errp));
-                error_free(errp);
-                ivshmem_server_usage(argv[0], 1);
-            }
-            break;
-
-        case 'n': /* n_vectors */
-            if (parse_uint_full(optarg, &v, 0) < 0) {
-                fprintf(stderr, "cannot parse n_vectors\n");
-                ivshmem_server_usage(argv[0], 1);
-            }
-            args->n_vectors = v;
-            break;
-
-        default:
-            ivshmem_server_usage(argv[0], 1);
-            break;
-        }
-    }
-
-    if (args->n_vectors > IVSHMEM_SERVER_MAX_VECTORS) {
-        fprintf(stderr, "too many requested vectors (max is %d)\n",
-                IVSHMEM_SERVER_MAX_VECTORS);
-        ivshmem_server_usage(argv[0], 1);
-    }
-
-    if (args->verbose == 1 && args->foreground == 0) {
-        fprintf(stderr, "cannot use verbose in daemon mode\n");
-        ivshmem_server_usage(argv[0], 1);
-    }
-}
-
-/* wait for events on listening server unix socket and connected client
- * sockets */
-static int
-ivshmem_server_poll_events(IvshmemServer *server)
-{
-    fd_set fds;
-    int ret = 0, maxfd;
-
-    while (!ivshmem_server_quit) {
-
-        FD_ZERO(&fds);
-        maxfd = 0;
-        ivshmem_server_get_fds(server, &fds, &maxfd);
-
-        ret = select(maxfd, &fds, NULL, NULL, NULL);
-
-        if (ret < 0) {
-            if (errno == EINTR) {
-                continue;
-            }
-
-            fprintf(stderr, "select error: %s\n", strerror(errno));
-            break;
-        }
-        if (ret == 0) {
-            continue;
-        }
-
-        if (ivshmem_server_handle_fds(server, &fds, maxfd) < 0) {
-            fprintf(stderr, "ivshmem_server_handle_fds() failed\n");
-            break;
-        }
-    }
-
-    return ret;
-}
-
-static void
-ivshmem_server_quit_cb(int signum)
-{
-    ivshmem_server_quit = 1;
-}
-
-int
-main(int argc, char *argv[])
-{
-    IvshmemServer server;
-    struct sigaction sa, sa_quit;
-    IvshmemServerArgs args = {
-        .verbose = IVSHMEM_SERVER_DEFAULT_VERBOSE,
-        .foreground = IVSHMEM_SERVER_DEFAULT_FOREGROUND,
-        .pid_file = IVSHMEM_SERVER_DEFAULT_PID_FILE,
-        .unix_socket_path = IVSHMEM_SERVER_DEFAULT_UNIX_SOCK_PATH,
-        .shm_path = IVSHMEM_SERVER_DEFAULT_SHM_PATH,
-        .shm_size = IVSHMEM_SERVER_DEFAULT_SHM_SIZE,
-        .n_vectors = IVSHMEM_SERVER_DEFAULT_N_VECTORS,
-    };
-    int ret = 1;
-
-    /* parse arguments, will exit on error */
-    ivshmem_server_parse_args(&args, argc, argv);
-
-    /* Ignore SIGPIPE, see this link for more info:
-     * http://www.mail-archive.com/libevent-users@monkey.org/msg01606.html */
-    sa.sa_handler = SIG_IGN;
-    sa.sa_flags = 0;
-    if (sigemptyset(&sa.sa_mask) == -1 ||
-        sigaction(SIGPIPE, &sa, 0) == -1) {
-        perror("failed to ignore SIGPIPE; sigaction");
-        goto err;
-    }
-
-    sa_quit.sa_handler = ivshmem_server_quit_cb;
-    sa_quit.sa_flags = 0;
-    if (sigemptyset(&sa_quit.sa_mask) == -1 ||
-        sigaction(SIGTERM, &sa_quit, 0) == -1) {
-        perror("failed to add SIGTERM handler; sigaction");
-        goto err;
-    }
-
-    /* init the ivshms structure */
-    if (ivshmem_server_init(&server, args.unix_socket_path, args.shm_path,
-                            args.shm_size, args.n_vectors, args.verbose) < 0) {
-        fprintf(stderr, "cannot init server\n");
-        goto err;
-    }
-
-    /* start the ivshmem server (open shm & unix socket) */
-    if (ivshmem_server_start(&server) < 0) {
-        fprintf(stderr, "cannot bind\n");
-        goto err;
-    }
-
-    /* daemonize if asked to */
-    if (!args.foreground) {
-        FILE *fp;
-
-        if (qemu_daemon(1, 1) < 0) {
-            fprintf(stderr, "cannot daemonize: %s\n", strerror(errno));
-            goto err_close;
-        }
-
-        /* write pid file */
-        fp = fopen(args.pid_file, "w");
-        if (fp == NULL) {
-            fprintf(stderr, "cannot write pid file: %s\n", strerror(errno));
-            goto err_close;
-        }
-
-        fprintf(fp, "%d\n", (int) getpid());
-        fclose(fp);
-    }
-
-    ivshmem_server_poll_events(&server);
-    fprintf(stdout, "server disconnected\n");
-    ret = 0;
-
-err_close:
-    ivshmem_server_close(&server);
-err:
-    return ret;
-}
--- a/util/coroutine-gthread.c
+++ b/util/coroutine-gthread.c
@@ -20,7 +20,7 @@

 #include <glib.h>
 #include "qemu-common.h"
-#include "qemu/coroutine_int.h"
+#include "block/coroutine_int.h"

 typedef struct {
    Coroutine base;
--- a/util/coroutine-sigaltstack.c
+++ b/util/coroutine-sigaltstack.c
@@ -31,7 +31,7 @@
 #include <pthread.h>
 #include <signal.h>
 #include "qemu-common.h"
-#include "qemu/coroutine_int.h"
+#include "block/coroutine_int.h"

 typedef struct {
    Coroutine base;
--- a/util/coroutine-ucontext.c
+++ b/util/coroutine-ucontext.c
@@ -27,7 +27,7 @@
 #include <stdint.h>
 #include <ucontext.h>
 #include "qemu-common.h"
-#include "qemu/coroutine_int.h"
+#include "block/coroutine_int.h"

 #ifdef CONFIG_VALGRIND_H
 #include <valgrind/valgrind.h>
--- a/util/coroutine-win32.c
+++ b/util/coroutine-win32.c
@@ -23,7 +23,7 @@
 */

 #include "qemu-common.h"
-#include "qemu/coroutine_int.h"
+#include "block/coroutine_int.h"

 typedef struct
 {
--- a/cpu-exec-common.c
+++ b/cpu-exec-common.c
@@ -1,82 +0,0 @@
-/*
- *  emulator main execution loop
- *
- *  Copyright (c) 2003-2005 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "config.h"
-#include "cpu.h"
-#include "sysemu/cpus.h"
-#include "exec/memory-internal.h"
-
-bool exit_request;
-CPUState *tcg_current_cpu;
-
-/* exit the current TB from a signal handler. The host registers are
-   restored in a state compatible with the CPU emulator
- */
-#if defined(CONFIG_SOFTMMU)
-void cpu_resume_from_signal(CPUState *cpu, void *puc)
-{
-    /* XXX: restore cpu registers saved in host registers */
-
-    cpu->exception_index = -1;
-    siglongjmp(cpu->jmp_env, 1);
-}
-
-void cpu_reloading_memory_map(void)
-{
-    if (qemu_in_vcpu_thread()) {
-        /* The guest can in theory prolong the RCU critical section as long
-         * as it feels like. The major problem with this is that because it
-         * can do multiple reconfigurations of the memory map within the
-         * critical section, we could potentially accumulate an unbounded
-         * collection of memory data structures awaiting reclamation.
-         *
-         * Because the only thing we're currently protecting with RCU is the
-         * memory data structures, it's sufficient to break the critical section
-         * in this callback, which we know will get called every time the
-         * memory map is rearranged.
-         *
-         * (If we add anything else in the system that uses RCU to protect
-         * its data structures, we will need to implement some other mechanism
-         * to force TCG CPUs to exit the critical section, at which point this
-         * part of this callback might become unnecessary.)
-         *
-         * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which
-         * only protects cpu->as->dispatch. Since we know our caller is about
-         * to reload it, it's safe to split the critical section.
-         */
-        rcu_read_unlock();
-        rcu_read_lock();
-    }
-}
-#endif
-
-void cpu_loop_exit(CPUState *cpu)
-{
-    cpu->current_tb = NULL;
-    siglongjmp(cpu->jmp_env, 1);
-}
-
-void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
-{
-    if (pc) {
-        cpu_restore_state(cpu, pc);
-    }
-    cpu->current_tb = NULL;
-    siglongjmp(cpu->jmp_env, 1);
-}
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -25,11 +25,9 @@
 #include "sysemu/qtest.h"
 #include "qemu/timer.h"
 #include "exec/address-spaces.h"
+#include "exec/memory-internal.h"
 #include "qemu/rcu.h"
 #include "exec/tb-hash.h"
-#if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
-#include "hw/i386/apic.h"
-#endif

 /* -icount align implementation. */

@@ -130,6 +128,52 @@ static void init_delay_params(SyncClocks *sc, const CPUState *cpu)
 }
 #endif /* CONFIG USER ONLY */

+void cpu_loop_exit(CPUState *cpu)
+{
+    cpu->current_tb = NULL;
+    siglongjmp(cpu->jmp_env, 1);
+}
+
+/* exit the current TB from a signal handler. The host registers are
+   restored in a state compatible with the CPU emulator
+ */
+#if defined(CONFIG_SOFTMMU)
+void cpu_resume_from_signal(CPUState *cpu, void *puc)
+{
+    /* XXX: restore cpu registers saved in host registers */
+
+    cpu->exception_index = -1;
+    siglongjmp(cpu->jmp_env, 1);
+}
+
+void cpu_reload_memory_map(CPUState *cpu)
+{
+    AddressSpaceDispatch *d;
+
+    if (qemu_in_vcpu_thread()) {
+        /* Do not let the guest prolong the critical section as much as it
+         * as it desires.
+         *
+         * Currently, this is prevented by the I/O thread's periodinc kicking
+         * of the VCPU thread (iothread_requesting_mutex, qemu_cpu_kick_thread)
+         * but this will go away once TCG's execution moves out of the global
+         * mutex.
+         *
+         * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which
+         * only protects cpu->as->dispatch.  Since we reload it below, we can
+         * split the critical section.
+         */
+        rcu_read_unlock();
+        rcu_read_lock();
+    }
+
+    /* The CPU and TLB are protected by the iothread lock.  */
+    d = atomic_rcu_read(&cpu->as->dispatch);
+    cpu->memory_dispatch = d;
+    tlb_flush(cpu, 1);
+}
+#endif
+
 /* Execute a TB, and fix up the CPU state afterwards if necessary */
 static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, uint8_t *tb_ptr)
 {
@@ -152,7 +196,7 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, uint8_t *tb_ptr)
    }
 #endif /* DEBUG_DISAS */

-    cpu->can_do_io = !use_icount;
+    cpu->can_do_io = 0;
    next_tb = tcg_qemu_tb_exec(env, tb_ptr);
    cpu->can_do_io = 1;
    trace_exec_tb_exit((void *) (next_tb & ~TB_EXIT_MASK),
@@ -187,15 +231,19 @@ static void cpu_exec_nocache(CPUState *cpu, int max_cycles,
                             TranslationBlock *orig_tb)
 {
    TranslationBlock *tb;
+    target_ulong pc = orig_tb->pc;
+    target_ulong cs_base = orig_tb->cs_base;
+    uint64_t flags = orig_tb->flags;

    /* Should never happen.
       We only end up here when an existing TB is too long.  */
    if (max_cycles > CF_COUNT_MASK)
        max_cycles = CF_COUNT_MASK;

-    tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
+    /* tb_gen_code can flush our orig_tb, invalidate it now */
+    tb_phys_invalidate(orig_tb, -1);
+    tb = tb_gen_code(cpu, pc, cs_base, flags,
                     max_cycles | CF_NOCACHE);
-    tb->orig_tb = tcg_ctx.tb_ctx.tb_invalidated_flag ? NULL : orig_tb;
    cpu->current_tb = tb;
    /* execute the generated code */
    trace_exec_tb_nocache(tb, tb->pc);
@@ -205,7 +253,7 @@ static void cpu_exec_nocache(CPUState *cpu, int max_cycles,
    tb_free(tb);
 }

-static TranslationBlock *tb_find_physical(CPUState *cpu,
+static TranslationBlock *tb_find_slow(CPUState *cpu,
                                      target_ulong pc,
                                      target_ulong cs_base,
                                      uint64_t flags)
@@ -225,9 +273,8 @@ static TranslationBlock *tb_find_physical(CPUState *cpu,
    ptb1 = &tcg_ctx.tb_ctx.tb_phys_hash[h];
    for(;;) {
        tb = *ptb1;
-        if (!tb) {
-            return NULL;
-        }
+        if (!tb)
+            goto not_found;
        if (tb->pc == pc &&
            tb->page_addr[0] == phys_page1 &&
            tb->cs_base == cs_base &&
@@ -239,59 +286,25 @@ static TranslationBlock *tb_find_physical(CPUState *cpu,
                virt_page2 = (pc & TARGET_PAGE_MASK) +
                    TARGET_PAGE_SIZE;
                phys_page2 = get_page_addr_code(env, virt_page2);
-                if (tb->page_addr[1] == phys_page2) {
-                    break;
-                }
+                if (tb->page_addr[1] == phys_page2)
+                    goto found;
            } else {
-                break;
+                goto found;
            }
        }
        ptb1 = &tb->phys_hash_next;
    }
-
-    /* Move the TB to the head of the list */
-    *ptb1 = tb->phys_hash_next;
-    tb->phys_hash_next = tcg_ctx.tb_ctx.tb_phys_hash[h];
-    tcg_ctx.tb_ctx.tb_phys_hash[h] = tb;
-    return tb;
-}
-
-static TranslationBlock *tb_find_slow(CPUState *cpu,
-                                      target_ulong pc,
-                                      target_ulong cs_base,
-                                      uint64_t flags)
-{
-    TranslationBlock *tb;
-
-    tb = tb_find_physical(cpu, pc, cs_base, flags);
-    if (tb) {
-        goto found;
-    }
-
-#ifdef CONFIG_USER_ONLY
-    /* mmap_lock is needed by tb_gen_code, and mmap_lock must be
-     * taken outside tb_lock.  Since we're momentarily dropping
-     * tb_lock, there's a chance that our desired tb has been
-     * translated.
-     */
-    tb_unlock();
-    mmap_lock();
-    tb_lock();
-    tb = tb_find_physical(cpu, pc, cs_base, flags);
-    if (tb) {
-        mmap_unlock();
-        goto found;
-    }
-#endif
-
+ not_found:
   /* if no translated code available, then translate it now */
    tb = tb_gen_code(cpu, pc, cs_base, flags, 0);

-#ifdef CONFIG_USER_ONLY
-    mmap_unlock();
-#endif
-
 found:
+    /* Move the last found TB to the head of the list */
+    if (likely(*ptb1)) {
+        *ptb1 = tb->phys_hash_next;
+        tb->phys_hash_next = tcg_ctx.tb_ctx.tb_phys_hash[h];
+        tcg_ctx.tb_ctx.tb_phys_hash[h] = tb;
+    }
    /* we add the TB in the virtual pc hash table */
    cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
    return tb;
@@ -332,6 +345,8 @@ static void cpu_handle_debug_exception(CPUState *cpu)

 /* main execution loop */

+volatile sig_atomic_t exit_request;
+
 int cpu_exec(CPUState *cpu)
 {
    CPUClass *cc = CPU_GET_CLASS(cpu);
@@ -345,13 +360,10 @@ int cpu_exec(CPUState *cpu)
    uintptr_t next_tb;
    SyncClocks sc;

+    /* This must be volatile so it is not trashed by longjmp() */
+    volatile bool have_tb_lock = false;
+
    if (cpu->halted) {
-#if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
-        if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
-            apic_poll_irq(x86_cpu->apic_state);
-            cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
-        }
-#endif
        if (!cpu_has_work(cpu)) {
            return EXCP_HALTED;
        }
@@ -360,10 +372,18 @@ int cpu_exec(CPUState *cpu)
    }

    current_cpu = cpu;
-    atomic_mb_set(&tcg_current_cpu, cpu);
+
+    /* As long as current_cpu is null, up to the assignment just above,
+     * requests by other threads to exit the execution loop are expected to
+     * be issued using the exit_request global. We must make sure that our
+     * evaluation of the global value is performed past the current_cpu
+     * value transition point, which requires a memory barrier as well as
+     * an instruction scheduling constraint on modern architectures.  */
+    smp_mb();
+
    rcu_read_lock();

-    if (unlikely(atomic_mb_read(&exit_request))) {
+    if (unlikely(exit_request)) {
        cpu->exit_request = 1;
    }

@@ -459,7 +479,8 @@ int cpu_exec(CPUState *cpu)
                    cpu->exception_index = EXCP_INTERRUPT;
                    cpu_loop_exit(cpu);
                }
-                tb_lock();
+                spin_lock(&tcg_ctx.tb_ctx.tb_lock);
+                have_tb_lock = true;
                tb = tb_find_fast(cpu);
                /* Note: we do it here to avoid a gcc bug on Mac OS X when
                   doing it in tb_find_slow */
@@ -477,19 +498,24 @@ int cpu_exec(CPUState *cpu)
                /* see if we can patch the calling TB. When the TB
                   spans two pages, we cannot safely do a direct
                   jump. */
-                if (next_tb != 0 && tb->page_addr[1] == -1
-                    && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
+                if (next_tb != 0 && tb->page_addr[1] == -1) {
                    tb_add_jump((TranslationBlock *)(next_tb & ~TB_EXIT_MASK),
                                next_tb & TB_EXIT_MASK, tb);
                }
-                tb_unlock();
+                have_tb_lock = false;
+                spin_unlock(&tcg_ctx.tb_ctx.tb_lock);
+
+                /* cpu_interrupt might be called while translating the
+                   TB, but before it is linked into a potentially
+                   infinite loop and becomes env->current_tb. Avoid
+                   starting execution if there is a pending interrupt. */
+                cpu->current_tb = tb;
+                barrier();
                if (likely(!cpu->exit_request)) {
                    trace_exec_tb(tb, tb->pc);
                    tc_ptr = tb->tc_ptr;
                    /* execute the generated code */
-                    cpu->current_tb = tb;
                    next_tb = cpu_tb_exec(cpu, tc_ptr);
-                    cpu->current_tb = NULL;
                    switch (next_tb & TB_EXIT_MASK) {
                    case TB_EXIT_REQUESTED:
                        /* Something asked us to stop executing
@@ -497,12 +523,8 @@ int cpu_exec(CPUState *cpu)
                         * loop. Whatever requested the exit will also
                         * have set something else (eg exit_request or
                         * interrupt_request) which we will handle
-                         * next time around the loop.  But we need to
-                         * ensure the tcg_exit_req read in generated code
-                         * comes before the next read of cpu->exit_request
-                         * or cpu->interrupt_request.
+                         * next time around the loop.
                         */
-                        smp_rmb();
                        next_tb = 0;
                        break;
                    case TB_EXIT_ICOUNT_EXPIRED:
@@ -532,6 +554,7 @@ int cpu_exec(CPUState *cpu)
                        break;
                    }
                }
+                cpu->current_tb = NULL;
                /* Try to align the host and virtual clocks
                   if the guest is in advance */
                align_clocks(&sc, cpu);
@@ -548,7 +571,10 @@ int cpu_exec(CPUState *cpu)
            x86_cpu = X86_CPU(cpu);
            env = &x86_cpu->env;
 #endif
-            tb_lock_reset();
+            if (have_tb_lock) {
+                spin_unlock(&tcg_ctx.tb_ctx.tb_lock);
+                have_tb_lock = false;
+            }
        }
    } /* for(;;) */

@@ -557,8 +583,5 @@ int cpu_exec(CPUState *cpu)

    /* fail safe : never use current_cpu outside cpu_exec() */
    current_cpu = NULL;
-
-    /* Does not need atomic_mb_set because a spurious wakeup is okay.  */
-    atomic_set(&tcg_current_cpu, NULL);
    return ret;
 }
--- a/cpus.c
+++ b/cpus.c
@@ -69,14 +69,6 @@ static CPUState *next_cpu;
 int64_t max_delay;
 int64_t max_advance;

-/* vcpu throttling controls */
-static QEMUTimer *throttle_timer;
-static unsigned int throttle_percentage;
-
-#define CPU_THROTTLE_PCT_MIN 1
-#define CPU_THROTTLE_PCT_MAX 99
-#define CPU_THROTTLE_TIMESLICE_NS 10000000
-
 bool cpu_is_stopped(CPUState *cpu)
 {
    return cpu->stopped || !runstate_is_running();
@@ -153,7 +145,7 @@ int64_t cpu_get_icount_raw(void)

    icount = timers_state.qemu_icount;
    if (cpu) {
-        if (!cpu->can_do_io) {
+        if (!cpu_can_do_io(cpu)) {
            fprintf(stderr, "Bad icount read\n");
            exit(1);
        }
@@ -199,7 +191,7 @@ int64_t cpu_get_ticks(void)

    ticks = timers_state.cpu_ticks_offset;
    if (timers_state.cpu_ticks_enabled) {
-        ticks += cpu_get_host_ticks();
+        ticks += cpu_get_real_ticks();
    }

    if (timers_state.cpu_ticks_prev > ticks) {
@@ -247,7 +239,7 @@ void cpu_enable_ticks(void)
    /* Here, the really thing protected by seqlock is cpu_clock_offset. */
    seqlock_write_lock(&timers_state.vm_clock_seqlock);
    if (!timers_state.cpu_ticks_enabled) {
-        timers_state.cpu_ticks_offset -= cpu_get_host_ticks();
+        timers_state.cpu_ticks_offset -= cpu_get_real_ticks();
        timers_state.cpu_clock_offset -= get_clock();
        timers_state.cpu_ticks_enabled = 1;
    }
@@ -263,7 +255,7 @@ void cpu_disable_ticks(void)
    /* Here, the really thing protected by seqlock is cpu_clock_offset. */
    seqlock_write_lock(&timers_state.vm_clock_seqlock);
    if (timers_state.cpu_ticks_enabled) {
-        timers_state.cpu_ticks_offset += cpu_get_host_ticks();
+        timers_state.cpu_ticks_offset += cpu_get_real_ticks();
        timers_state.cpu_clock_offset = cpu_get_clock_locked();
        timers_state.cpu_ticks_enabled = 0;
    }
@@ -513,80 +505,10 @@ static const VMStateDescription vmstate_timers = {
    }
 };

-static void cpu_throttle_thread(void *opaque)
-{
-    CPUState *cpu = opaque;
-    double pct;
-    double throttle_ratio;
-    long sleeptime_ns;
-
-    if (!cpu_throttle_get_percentage()) {
-        return;
-    }
-
-    pct = (double)cpu_throttle_get_percentage()/100;
-    throttle_ratio = pct / (1 - pct);
-    sleeptime_ns = (long)(throttle_ratio * CPU_THROTTLE_TIMESLICE_NS);
-
-    qemu_mutex_unlock_iothread();
-    atomic_set(&cpu->throttle_thread_scheduled, 0);
-    g_usleep(sleeptime_ns / 1000); /* Convert ns to us for usleep call */
-    qemu_mutex_lock_iothread();
-}
-
-static void cpu_throttle_timer_tick(void *opaque)
-{
-    CPUState *cpu;
-    double pct;
-
-    /* Stop the timer if needed */
-    if (!cpu_throttle_get_percentage()) {
-        return;
-    }
-    CPU_FOREACH(cpu) {
-        if (!atomic_xchg(&cpu->throttle_thread_scheduled, 1)) {
-            async_run_on_cpu(cpu, cpu_throttle_thread, cpu);
-        }
-    }
-
-    pct = (double)cpu_throttle_get_percentage()/100;
-    timer_mod(throttle_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT) +
-                                   CPU_THROTTLE_TIMESLICE_NS / (1-pct));
-}
-
-void cpu_throttle_set(int new_throttle_pct)
-{
-    /* Ensure throttle percentage is within valid range */
-    new_throttle_pct = MIN(new_throttle_pct, CPU_THROTTLE_PCT_MAX);
-    new_throttle_pct = MAX(new_throttle_pct, CPU_THROTTLE_PCT_MIN);
-
-    atomic_set(&throttle_percentage, new_throttle_pct);
-
-    timer_mod(throttle_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT) +
-                                       CPU_THROTTLE_TIMESLICE_NS);
-}
-
-void cpu_throttle_stop(void)
-{
-    atomic_set(&throttle_percentage, 0);
-}
-
-bool cpu_throttle_active(void)
-{
-    return (cpu_throttle_get_percentage() != 0);
-}
-
-int cpu_throttle_get_percentage(void)
-{
-    return atomic_read(&throttle_percentage);
-}
-
 void cpu_ticks_init(void)
 {
    seqlock_init(&timers_state.vm_clock_seqlock, NULL);
    vmstate_register(NULL, 0, &vmstate_timers, &timers_state);
-    throttle_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL_RT,
-                                           cpu_throttle_timer_tick, NULL);
 }

 void configure_icount(QemuOpts *opts, Error **errp)
@@ -739,6 +661,14 @@ static void cpu_handle_guest_debug(CPUState *cpu)
    cpu->stopped = true;
 }

+static void cpu_signal(int sig)
+{
+    if (current_cpu) {
+        cpu_exit(current_cpu);
+    }
+    exit_request = 1;
+}
+
 #ifdef CONFIG_LINUX
 static void sigbus_reraise(void)
 {
@@ -851,11 +781,29 @@ static void qemu_kvm_init_cpu_signals(CPUState *cpu)
    }
 }

+static void qemu_tcg_init_cpu_signals(void)
+{
+    sigset_t set;
+    struct sigaction sigact;
+
+    memset(&sigact, 0, sizeof(sigact));
+    sigact.sa_handler = cpu_signal;
+    sigaction(SIG_IPI, &sigact, NULL);
+
+    sigemptyset(&set);
+    sigaddset(&set, SIG_IPI);
+    pthread_sigmask(SIG_UNBLOCK, &set, NULL);
+}
+
 #else /* _WIN32 */
 static void qemu_kvm_init_cpu_signals(CPUState *cpu)
 {
    abort();
 }
+
+static void qemu_tcg_init_cpu_signals(void)
+{
+}
 #endif /* _WIN32 */

 static QemuMutex qemu_global_mutex;
@@ -864,6 +812,9 @@ static unsigned iothread_requesting_mutex;

 static QemuThread io_thread;

+static QemuThread *tcg_cpu_thread;
+static QemuCond *tcg_halt_cond;
+
 /* cpu creation */
 static QemuCond qemu_cpu_cond;
 /* system init */
@@ -894,8 +845,6 @@ void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
    wi.func = func;
    wi.data = data;
    wi.free = false;
-
-    qemu_mutex_lock(&cpu->work_mutex);
    if (cpu->queued_work_first == NULL) {
        cpu->queued_work_first = &wi;
    } else {
@@ -904,10 +853,9 @@ void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
    cpu->queued_work_last = &wi;
    wi.next = NULL;
    wi.done = false;
-    qemu_mutex_unlock(&cpu->work_mutex);

    qemu_cpu_kick(cpu);
-    while (!atomic_mb_read(&wi.done)) {
+    while (!wi.done) {
        CPUState *self_cpu = current_cpu;

        qemu_cond_wait(&qemu_work_cond, &qemu_global_mutex);
@@ -928,8 +876,6 @@ void async_run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
    wi->func = func;
    wi->data = data;
    wi->free = true;
-
-    qemu_mutex_lock(&cpu->work_mutex);
    if (cpu->queued_work_first == NULL) {
        cpu->queued_work_first = wi;
    } else {
@@ -938,7 +884,6 @@ void async_run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
    cpu->queued_work_last = wi;
    wi->next = NULL;
    wi->done = false;
-    qemu_mutex_unlock(&cpu->work_mutex);

    qemu_cpu_kick(cpu);
 }
@@ -951,23 +896,15 @@ static void flush_queued_work(CPUState *cpu)
        return;
    }

-    qemu_mutex_lock(&cpu->work_mutex);
-    while (cpu->queued_work_first != NULL) {
-        wi = cpu->queued_work_first;
+    while ((wi = cpu->queued_work_first)) {
        cpu->queued_work_first = wi->next;
-        if (!cpu->queued_work_first) {
-            cpu->queued_work_last = NULL;
-        }
-        qemu_mutex_unlock(&cpu->work_mutex);
        wi->func(wi->data);
-        qemu_mutex_lock(&cpu->work_mutex);
+        wi->done = true;
        if (wi->free) {
            g_free(wi);
-        } else {
-            atomic_mb_set(&wi->done, true);
        }
    }
-    qemu_mutex_unlock(&cpu->work_mutex);
+    cpu->queued_work_last = NULL;
    qemu_cond_broadcast(&qemu_work_cond);
 }

@@ -982,13 +919,15 @@ static void qemu_wait_io_event_common(CPUState *cpu)
    cpu->thread_kicked = false;
 }

-static void qemu_tcg_wait_io_event(CPUState *cpu)
+static void qemu_tcg_wait_io_event(void)
 {
+    CPUState *cpu;
+
    while (all_cpu_threads_idle()) {
       /* Start accounting real time to the virtual clock if the CPUs
          are idle.  */
        qemu_clock_warp(QEMU_CLOCK_VIRTUAL);
-        qemu_cond_wait(cpu->halt_cond, &qemu_global_mutex);
+        qemu_cond_wait(tcg_halt_cond, &qemu_global_mutex);
    }

    while (iothread_requesting_mutex) {
@@ -1102,6 +1041,7 @@ static void *qemu_tcg_cpu_thread_fn(void *arg)
    rcu_register_thread();

    qemu_mutex_lock_iothread();
+    qemu_tcg_init_cpu_signals();
    qemu_thread_get_self(cpu->thread);

    CPU_FOREACH(cpu) {
@@ -1113,7 +1053,7 @@ static void *qemu_tcg_cpu_thread_fn(void *arg)

    /* wait for initial kick-off after machine start */
    while (first_cpu->stopped) {
-        qemu_cond_wait(first_cpu->halt_cond, &qemu_global_mutex);
+        qemu_cond_wait(tcg_halt_cond, &qemu_global_mutex);

        /* process any pending work */
        CPU_FOREACH(cpu) {
@@ -1122,7 +1062,7 @@ static void *qemu_tcg_cpu_thread_fn(void *arg)
    }

    /* process any pending work */
-    atomic_mb_set(&exit_request, 1);
+    exit_request = 1;

    while (1) {
        tcg_exec_all();
@@ -1134,7 +1074,7 @@ static void *qemu_tcg_cpu_thread_fn(void *arg)
                qemu_clock_notify(QEMU_CLOCK_VIRTUAL);
            }
        }
-        qemu_tcg_wait_io_event(QTAILQ_FIRST(&cpus));
+        qemu_tcg_wait_io_event();
    }

    return NULL;
@@ -1145,47 +1085,61 @@ static void qemu_cpu_kick_thread(CPUState *cpu)
 #ifndef _WIN32
    int err;

-    if (cpu->thread_kicked) {
-        return;
-    }
-    cpu->thread_kicked = true;
    err = pthread_kill(cpu->thread->thread, SIG_IPI);
    if (err) {
        fprintf(stderr, "qemu:%s: %s", __func__, strerror(err));
        exit(1);
    }
 #else /* _WIN32 */
-    abort();
-#endif
+    if (!qemu_cpu_is_self(cpu)) {
+        CONTEXT tcgContext;
+
+        if (SuspendThread(cpu->hThread) == (DWORD)-1) {
+            fprintf(stderr, "qemu:%s: GetLastError:%lu\n", __func__,
+                    GetLastError());
+            exit(1);
        }

-static void qemu_cpu_kick_no_halt(void)
-{
-    CPUState *cpu;
-    /* Ensure whatever caused the exit has reached the CPU threads before
-     * writing exit_request.
+        /* On multi-core systems, we are not sure that the thread is actually
+         * suspended until we can get the context.
         */
-    atomic_mb_set(&exit_request, 1);
-    cpu = atomic_mb_read(&tcg_current_cpu);
-    if (cpu) {
-        cpu_exit(cpu);
+        tcgContext.ContextFlags = CONTEXT_CONTROL;
+        while (GetThreadContext(cpu->hThread, &tcgContext) != 0) {
+            continue;
        }
+
+        cpu_signal(0);
+
+        if (ResumeThread(cpu->hThread) == (DWORD)-1) {
+            fprintf(stderr, "qemu:%s: GetLastError:%lu\n", __func__,
+                    GetLastError());
+            exit(1);
+        }
+    }
+#endif
 }

 void qemu_cpu_kick(CPUState *cpu)
 {
    qemu_cond_broadcast(cpu->halt_cond);
-    if (tcg_enabled()) {
-        qemu_cpu_kick_no_halt();
-    } else {
+    if (!tcg_enabled() && !cpu->thread_kicked) {
        qemu_cpu_kick_thread(cpu);
+        cpu->thread_kicked = true;
    }
 }

 void qemu_cpu_kick_self(void)
 {
+#ifndef _WIN32
    assert(current_cpu);
+
+    if (!current_cpu->thread_kicked) {
        qemu_cpu_kick_thread(current_cpu);
+        current_cpu->thread_kicked = true;
+    }
+#else
+    abort();
+#endif
 }

 bool qemu_cpu_is_self(CPUState *cpu)
@@ -1212,12 +1166,12 @@ void qemu_mutex_lock_iothread(void)
     * TCG code execution.
     */
    if (!tcg_enabled() || qemu_in_vcpu_thread() ||
-        !first_cpu || !first_cpu->created) {
+        !first_cpu || !first_cpu->thread) {
        qemu_mutex_lock(&qemu_global_mutex);
        atomic_dec(&iothread_requesting_mutex);
    } else {
        if (qemu_mutex_trylock(&qemu_global_mutex)) {
-            qemu_cpu_kick_no_halt();
+            qemu_cpu_kick_thread(first_cpu);
            qemu_mutex_lock(&qemu_global_mutex);
        }
        atomic_dec(&iothread_requesting_mutex);
@@ -1297,8 +1251,6 @@ void resume_all_vcpus(void)
 static void qemu_tcg_init_vcpu(CPUState *cpu)
 {
    char thread_name[VCPU_THREAD_NAME_SIZE];
-    static QemuCond *tcg_halt_cond;
-    static QemuThread *tcg_cpu_thread;

    tcg_cpu_address_space_init(cpu, cpu->as);

@@ -1488,9 +1440,7 @@ static void tcg_exec_all(void)
            break;
        }
    }
-
-    /* Pairs with smp_wmb in qemu_cpu_kick.  */
-    atomic_mb_set(&exit_request, 0);
+    exit_request = 0;
 }

 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
--- a/cputlb.c
+++ b/cputlb.c
@@ -69,47 +69,6 @@ void tlb_flush(CPUState *cpu, int flush_global)
    tlb_flush_count++;
 }

-static inline void v_tlb_flush_by_mmuidx(CPUState *cpu, va_list argp)
-{
-    CPUArchState *env = cpu->env_ptr;
-
-#if defined(DEBUG_TLB)
-    printf("tlb_flush_by_mmuidx:");
-#endif
-    /* must reset current TB so that interrupts cannot modify the
-       links while we are modifying them */
-    cpu->current_tb = NULL;
-
-    for (;;) {
-        int mmu_idx = va_arg(argp, int);
-
-        if (mmu_idx < 0) {
-            break;
-        }
-
-#if defined(DEBUG_TLB)
-        printf(" %d", mmu_idx);
-#endif
-
-        memset(env->tlb_table[mmu_idx], -1, sizeof(env->tlb_table[0]));
-        memset(env->tlb_v_table[mmu_idx], -1, sizeof(env->tlb_v_table[0]));
-    }
-
-#if defined(DEBUG_TLB)
-    printf("\n");
-#endif
-
-    memset(cpu->tb_jmp_cache, 0, sizeof(cpu->tb_jmp_cache));
-}
-
-void tlb_flush_by_mmuidx(CPUState *cpu, ...)
-{
-    va_list argp;
-    va_start(argp, cpu);
-    v_tlb_flush_by_mmuidx(cpu, argp);
-    va_end(argp);
-}
-
 static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
 {
    if (addr == (tlb_entry->addr_read &
@@ -162,62 +121,6 @@ void tlb_flush_page(CPUState *cpu, target_ulong addr)
    tb_flush_jmp_cache(cpu, addr);
 }

-void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr, ...)
-{
-    CPUArchState *env = cpu->env_ptr;
-    int i, k;
-    va_list argp;
-
-    va_start(argp, addr);
-
-#if defined(DEBUG_TLB)
-    printf("tlb_flush_page_by_mmu_idx: " TARGET_FMT_lx, addr);
-#endif
-    /* Check if we need to flush due to large pages.  */
-    if ((addr & env->tlb_flush_mask) == env->tlb_flush_addr) {
-#if defined(DEBUG_TLB)
-        printf(" forced full flush ("
-               TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
-               env->tlb_flush_addr, env->tlb_flush_mask);
-#endif
-        v_tlb_flush_by_mmuidx(cpu, argp);
-        va_end(argp);
-        return;
-    }
-    /* must reset current TB so that interrupts cannot modify the
-       links while we are modifying them */
-    cpu->current_tb = NULL;
-
-    addr &= TARGET_PAGE_MASK;
-    i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-
-    for (;;) {
-        int mmu_idx = va_arg(argp, int);
-
-        if (mmu_idx < 0) {
-            break;
-        }
-
-#if defined(DEBUG_TLB)
-        printf(" %d", mmu_idx);
-#endif
-
-        tlb_flush_entry(&env->tlb_table[mmu_idx][i], addr);
-
-        /* check whether there are vltb entries that need to be flushed */
-        for (k = 0; k < CPU_VTLB_SIZE; k++) {
-            tlb_flush_entry(&env->tlb_v_table[mmu_idx][k], addr);
-        }
-    }
-    va_end(argp);
-
-#if defined(DEBUG_TLB)
-    printf("\n");
-#endif
-
-    tb_flush_jmp_cache(cpu, addr);
-}
-
 /* update the TLBs so that writes to code in the virtual page 'addr'
   can be detected */
 void tlb_protect_code(ram_addr_t ram_addr)
@@ -262,10 +165,12 @@ static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
    return ram_addr;
 }

-void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
+void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
 {
+    CPUState *cpu;
    CPUArchState *env;

+    CPU_FOREACH(cpu) {
        int mmu_idx;

        env = cpu->env_ptr;
@@ -283,6 +188,7 @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
            }
        }
    }
+}

 static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
 {
@@ -293,9 +199,8 @@ static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)

 /* update the TLB corresponding to virtual page vaddr
   so that it is no longer dirty */
-void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
+void tlb_set_dirty(CPUArchState *env, target_ulong vaddr)
 {
-    CPUArchState *env = cpu->env_ptr;
    int i;
    int mmu_idx;

@@ -450,7 +355,7 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
    CPUState *cpu = ENV_GET_CPU(env1);

    page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    mmu_idx = cpu_mmu_index(env1, true);
+    mmu_idx = cpu_mmu_index(env1);
    if (unlikely(env1->tlb_table[mmu_idx][page_index].addr_code !=
                 (addr & TARGET_PAGE_MASK))) {
        cpu_ldub_code(env1, addr);
--- a/crypto/Makefile.objs
+++ b/crypto/Makefile.objs
@@ -1,12 +1,5 @@
-crypto-obj-y = init.o
-crypto-obj-y += hash.o
-crypto-obj-y += aes.o
-crypto-obj-y += desrfb.o
-crypto-obj-y += cipher.o
-crypto-obj-y += tlscreds.o
-crypto-obj-y += tlscredsanon.o
-crypto-obj-y += tlscredsx509.o
-crypto-obj-y += tlssession.o
-
-# Let the userspace emulators avoid linking gnutls/etc
-crypto-aes-obj-y = aes.o
+util-obj-y += init.o
+util-obj-y += hash.o
+util-obj-y += aes.o
+util-obj-y += desrfb.o
+util-obj-y += cipher.o
--- a/crypto/cipher-builtin.c
+++ b/crypto/cipher-builtin.c
@@ -25,7 +25,8 @@ typedef struct QCryptoCipherBuiltinAES QCryptoCipherBuiltinAES;
 struct QCryptoCipherBuiltinAES {
    AES_KEY encrypt_key;
    AES_KEY decrypt_key;
-    uint8_t iv[AES_BLOCK_SIZE];
+    uint8_t *iv;
+    size_t niv;
 };
 typedef struct QCryptoCipherBuiltinDESRFB QCryptoCipherBuiltinDESRFB;
 struct QCryptoCipherBuiltinDESRFB {
@@ -39,7 +40,6 @@ struct QCryptoCipherBuiltin {
        QCryptoCipherBuiltinAES aes;
        QCryptoCipherBuiltinDESRFB desrfb;
    } state;
-    size_t blocksize;
    void (*free)(QCryptoCipher *cipher);
    int (*setiv)(QCryptoCipher *cipher,
                 const uint8_t *iv, size_t niv,
@@ -61,6 +61,7 @@ static void qcrypto_cipher_free_aes(QCryptoCipher *cipher)
 {
    QCryptoCipherBuiltin *ctxt = cipher->opaque;

+    g_free(ctxt->state.aes.iv);
    g_free(ctxt);
    cipher->opaque = NULL;
 }
@@ -144,13 +145,15 @@ static int qcrypto_cipher_setiv_aes(QCryptoCipher *cipher,
                                     Error **errp)
 {
    QCryptoCipherBuiltin *ctxt = cipher->opaque;
-    if (niv != AES_BLOCK_SIZE) {
-        error_setg(errp, "IV must be %d bytes not %zu",
-                   AES_BLOCK_SIZE, niv);
+    if (niv != 16) {
+        error_setg(errp, "IV must be 16 bytes not %zu", niv);
        return -1;
    }

-    memcpy(ctxt->state.aes.iv, iv, AES_BLOCK_SIZE);
+    g_free(ctxt->state.aes.iv);
+    ctxt->state.aes.iv = g_new0(uint8_t, niv);
+    memcpy(ctxt->state.aes.iv, iv, niv);
+    ctxt->state.aes.niv = niv;

    return 0;
 }
@@ -182,7 +185,6 @@ static int qcrypto_cipher_init_aes(QCryptoCipher *cipher,
        goto error;
    }

-    ctxt->blocksize = AES_BLOCK_SIZE;
    ctxt->free = qcrypto_cipher_free_aes;
    ctxt->setiv = qcrypto_cipher_setiv_aes;
    ctxt->encrypt = qcrypto_cipher_encrypt_aes;
@@ -284,7 +286,6 @@ static int qcrypto_cipher_init_des_rfb(QCryptoCipher *cipher,
    memcpy(ctxt->state.desrfb.key, key, nkey);
    ctxt->state.desrfb.nkey = nkey;

-    ctxt->blocksize = 8;
    ctxt->free = qcrypto_cipher_free_des_rfb;
    ctxt->setiv = qcrypto_cipher_setiv_des_rfb;
    ctxt->encrypt = qcrypto_cipher_encrypt_des_rfb;
@@ -373,12 +374,6 @@ int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
 {
    QCryptoCipherBuiltin *ctxt = cipher->opaque;

-    if (len % ctxt->blocksize) {
-        error_setg(errp, "Length %zu must be a multiple of block size %zu",
-                   len, ctxt->blocksize);
-        return -1;
-    }
-
    return ctxt->encrypt(cipher, in, out, len, errp);
 }

@@ -391,12 +386,6 @@ int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
 {
    QCryptoCipherBuiltin *ctxt = cipher->opaque;

-    if (len % ctxt->blocksize) {
-        error_setg(errp, "Length %zu must be a multiple of block size %zu",
-                   len, ctxt->blocksize);
-        return -1;
-    }
-
    return ctxt->decrypt(cipher, in, out, len, errp);
 }

--- a/crypto/cipher-gcrypt.c
+++ b/crypto/cipher-gcrypt.c
@@ -34,11 +34,6 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg)
    }
 }

-typedef struct QCryptoCipherGcrypt QCryptoCipherGcrypt;
-struct QCryptoCipherGcrypt {
-    gcry_cipher_hd_t handle;
-    size_t blocksize;
-};

 QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
                                  QCryptoCipherMode mode,
@@ -46,7 +41,7 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
                                  Error **errp)
 {
    QCryptoCipher *cipher;
-    QCryptoCipherGcrypt *ctx;
+    gcry_cipher_hd_t handle;
    gcry_error_t err;
    int gcryalg, gcrymode;

@@ -92,9 +87,7 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
    cipher->alg = alg;
    cipher->mode = mode;

-    ctx = g_new0(QCryptoCipherGcrypt, 1);
-
-    err = gcry_cipher_open(&ctx->handle, gcryalg, gcrymode, 0);
+    err = gcry_cipher_open(&handle, gcryalg, gcrymode, 0);
    if (err != 0) {
        error_setg(errp, "Cannot initialize cipher: %s",
                   gcry_strerror(err));
@@ -107,12 +100,10 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
         * bizarre RFB variant of DES :-)
         */
        uint8_t *rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
-        err = gcry_cipher_setkey(ctx->handle, rfbkey, nkey);
+        err = gcry_cipher_setkey(handle, rfbkey, nkey);
        g_free(rfbkey);
-        ctx->blocksize = 8;
    } else {
-        err = gcry_cipher_setkey(ctx->handle, key, nkey);
-        ctx->blocksize = 16;
+        err = gcry_cipher_setkey(handle, key, nkey);
    }
    if (err != 0) {
        error_setg(errp, "Cannot set key: %s",
@@ -120,12 +111,11 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
        goto error;
    }

-    cipher->opaque = ctx;
+    cipher->opaque = handle;
    return cipher;

 error:
-    gcry_cipher_close(ctx->handle);
-    g_free(ctx);
+    gcry_cipher_close(handle);
    g_free(cipher);
    return NULL;
 }
@@ -133,13 +123,12 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,

 void qcrypto_cipher_free(QCryptoCipher *cipher)
 {
-    QCryptoCipherGcrypt *ctx;
+    gcry_cipher_hd_t handle;
    if (!cipher) {
        return;
    }
-    ctx = cipher->opaque;
-    gcry_cipher_close(ctx->handle);
-    g_free(ctx);
+    handle = cipher->opaque;
+    gcry_cipher_close(handle);
    g_free(cipher);
 }

@@ -150,16 +139,10 @@ int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
                           size_t len,
                           Error **errp)
 {
-    QCryptoCipherGcrypt *ctx = cipher->opaque;
+    gcry_cipher_hd_t handle = cipher->opaque;
    gcry_error_t err;

-    if (len % ctx->blocksize) {
-        error_setg(errp, "Length %zu must be a multiple of block size %zu",
-                   len, ctx->blocksize);
-        return -1;
-    }
-
-    err = gcry_cipher_encrypt(ctx->handle,
+    err = gcry_cipher_encrypt(handle,
                              out, len,
                              in, len);
    if (err != 0) {
@@ -178,16 +161,10 @@ int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
                           size_t len,
                           Error **errp)
 {
-    QCryptoCipherGcrypt *ctx = cipher->opaque;
+    gcry_cipher_hd_t handle = cipher->opaque;
    gcry_error_t err;

-    if (len % ctx->blocksize) {
-        error_setg(errp, "Length %zu must be a multiple of block size %zu",
-                   len, ctx->blocksize);
-        return -1;
-    }
-
-    err = gcry_cipher_decrypt(ctx->handle,
+    err = gcry_cipher_decrypt(handle,
                              out, len,
                              in, len);
    if (err != 0) {
@@ -203,17 +180,11 @@ int qcrypto_cipher_setiv(QCryptoCipher *cipher,
                         const uint8_t *iv, size_t niv,
                         Error **errp)
 {
-    QCryptoCipherGcrypt *ctx = cipher->opaque;
+    gcry_cipher_hd_t handle = cipher->opaque;
    gcry_error_t err;

-    if (niv != ctx->blocksize) {
-        error_setg(errp, "Expected IV size %zu not %zu",
-                   ctx->blocksize, niv);
-        return -1;
-    }
-
-    gcry_cipher_reset(ctx->handle);
-    err = gcry_cipher_setiv(ctx->handle, iv, niv);
+    gcry_cipher_reset(handle);
+    err = gcry_cipher_setiv(handle, iv, niv);
    if (err != 0) {
        error_setg(errp, "Cannot set IV: %s",
                   gcry_strerror(err));
--- a/crypto/cipher-nettle.c
+++ b/crypto/cipher-nettle.c
@@ -69,7 +69,7 @@ struct QCryptoCipherNettle {
    nettle_cipher_func *alg_encrypt;
    nettle_cipher_func *alg_decrypt;
    uint8_t *iv;
-    size_t blocksize;
+    size_t niv;
 };

 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg)
@@ -125,7 +125,7 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
        ctx->alg_encrypt = des_encrypt_wrapper;
        ctx->alg_decrypt = des_decrypt_wrapper;

-        ctx->blocksize = DES_BLOCK_SIZE;
+        ctx->niv = DES_BLOCK_SIZE;
        break;

    case QCRYPTO_CIPHER_ALG_AES_128:
@@ -140,14 +140,14 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
        ctx->alg_encrypt = aes_encrypt_wrapper;
        ctx->alg_decrypt = aes_decrypt_wrapper;

-        ctx->blocksize = AES_BLOCK_SIZE;
+        ctx->niv = AES_BLOCK_SIZE;
        break;
    default:
        error_setg(errp, "Unsupported cipher algorithm %d", alg);
        goto error;
    }

-    ctx->iv = g_new0(uint8_t, ctx->blocksize);
+    ctx->iv = g_new0(uint8_t, ctx->niv);
    cipher->opaque = ctx;

    return cipher;
@@ -184,12 +184,6 @@ int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
 {
    QCryptoCipherNettle *ctx = cipher->opaque;

-    if (len % ctx->blocksize) {
-        error_setg(errp, "Length %zu must be a multiple of block size %zu",
-                   len, ctx->blocksize);
-        return -1;
-    }
-
    switch (cipher->mode) {
    case QCRYPTO_CIPHER_MODE_ECB:
        ctx->alg_encrypt(ctx->ctx_encrypt, len, out, in);
@@ -197,7 +191,7 @@ int qcrypto_cipher_encrypt(QCryptoCipher *cipher,

    case QCRYPTO_CIPHER_MODE_CBC:
        cbc_encrypt(ctx->ctx_encrypt, ctx->alg_encrypt,
-                    ctx->blocksize, ctx->iv,
+                    ctx->niv, ctx->iv,
                    len, out, in);
        break;
    default:
@@ -217,12 +211,6 @@ int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
 {
    QCryptoCipherNettle *ctx = cipher->opaque;

-    if (len % ctx->blocksize) {
-        error_setg(errp, "Length %zu must be a multiple of block size %zu",
-                   len, ctx->blocksize);
-        return -1;
-    }
-
    switch (cipher->mode) {
    case QCRYPTO_CIPHER_MODE_ECB:
        ctx->alg_decrypt(ctx->ctx_decrypt ? ctx->ctx_decrypt : ctx->ctx_encrypt,
@@ -231,7 +219,7 @@ int qcrypto_cipher_decrypt(QCryptoCipher *cipher,

    case QCRYPTO_CIPHER_MODE_CBC:
        cbc_decrypt(ctx->ctx_decrypt ? ctx->ctx_decrypt : ctx->ctx_encrypt,
-                    ctx->alg_decrypt, ctx->blocksize, ctx->iv,
+                    ctx->alg_decrypt, ctx->niv, ctx->iv,
                    len, out, in);
        break;
    default:
@@ -247,9 +235,9 @@ int qcrypto_cipher_setiv(QCryptoCipher *cipher,
                         Error **errp)
 {
    QCryptoCipherNettle *ctx = cipher->opaque;
-    if (niv != ctx->blocksize) {
+    if (niv != ctx->niv) {
        error_setg(errp, "Expected IV size %zu not %zu",
-                   ctx->blocksize, niv);
+                   ctx->niv, niv);
        return -1;
    }
    memcpy(ctx->iv, iv, niv);
--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -47,7 +47,7 @@ qcrypto_cipher_validate_key_length(QCryptoCipherAlgorithm alg,
    return true;
 }

-#if defined(CONFIG_GCRYPT) || defined(CONFIG_NETTLE)
+#if defined(CONFIG_GNUTLS_GCRYPT) || defined(CONFIG_GNUTLS_NETTLE)
 static uint8_t *
 qcrypto_cipher_munge_des_rfb_key(const uint8_t *key,
                                 size_t nkey)
@@ -63,11 +63,11 @@ qcrypto_cipher_munge_des_rfb_key(const uint8_t *key,
    }
    return ret;
 }
-#endif /* CONFIG_GCRYPT || CONFIG_NETTLE */
+#endif /* CONFIG_GNUTLS_GCRYPT || CONFIG_GNUTLS_NETTLE */

-#ifdef CONFIG_GCRYPT
+#ifdef CONFIG_GNUTLS_GCRYPT
 #include "crypto/cipher-gcrypt.c"
-#elif defined CONFIG_NETTLE
+#elif defined CONFIG_GNUTLS_NETTLE
 #include "crypto/cipher-nettle.c"
 #else
 #include "crypto/cipher-builtin.c"
--- a/crypto/init.c
+++ b/crypto/init.c
@@ -24,9 +24,8 @@
 #ifdef CONFIG_GNUTLS
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
-#endif

-#ifdef CONFIG_GCRYPT
+#ifdef CONFIG_GNUTLS_GCRYPT
 #include <gcrypt.h>
 #endif

@@ -38,7 +37,6 @@
 *  - When GNUTLS >= 2.12, we must not initialize gcrypt threading
 *    because GNUTLS will do that itself
 *  - When GNUTLS < 2.12 we must always initialize gcrypt threading
- *  - When GNUTLS is disabled we must always initialize gcrypt threading
 *
 * But....
 *
@@ -50,14 +48,11 @@
 *   - gcrypt < 1.6.0
 * AND
 *   - gnutls < 2.12
- *   OR
- *      - gnutls is disabled
 *
 */

-#if (defined(CONFIG_GCRYPT) &&                  \
-     (!defined(CONFIG_GNUTLS) ||                \
-      !defined(GNUTLS_VERSION_NUMBER) ||       \
+#if (defined(CONFIG_GNUTLS_GCRYPT) &&           \
+     (!defined(GNUTLS_VERSION_NUMBER) ||        \
      (GNUTLS_VERSION_NUMBER < 0x020c00)) &&    \
     (!defined(GCRYPT_VERSION_NUMBER) ||        \
      (GCRYPT_VERSION_NUMBER < 0x010600)))
@@ -118,7 +113,6 @@ static struct gcry_thread_cbs qcrypto_gcrypt_thread_impl = {

 int qcrypto_init(Error **errp)
 {
-#ifdef CONFIG_GNUTLS
    int ret;
    ret = gnutls_global_init();
    if (ret < 0) {
@@ -131,9 +125,8 @@ int qcrypto_init(Error **errp)
    gnutls_global_set_log_level(10);
    gnutls_global_set_log_function(qcrypto_gnutls_log);
 #endif
-#endif

-#ifdef CONFIG_GCRYPT
+#ifdef CONFIG_GNUTLS_GCRYPT
    if (!gcry_check_version(GCRYPT_VERSION)) {
        error_setg(errp, "Unable to initialize gcrypt");
        return -1;
@@ -146,3 +139,12 @@ int qcrypto_init(Error **errp)

    return 0;
 }
+
+#else /* ! CONFIG_GNUTLS */
+
+int qcrypto_init(Error **errp G_GNUC_UNUSED)
+{
+    return 0;
+}
+
+#endif /* ! CONFIG_GNUTLS */
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -1,251 +0,0 @@
-/*
- * QEMU crypto TLS credential support
- *
- * Copyright (c) 2015 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "crypto/tlscredspriv.h"
-#include "trace.h"
-
-#define DH_BITS 2048
-
-#ifdef CONFIG_GNUTLS
-int
-qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
-                                     const char *filename,
-                                     gnutls_dh_params_t *dh_params,
-                                     Error **errp)
-{
-    int ret;
-
-    trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>");
-
-    if (filename == NULL) {
-        ret = gnutls_dh_params_init(dh_params);
-        if (ret < 0) {
-            error_setg(errp, "Unable to initialize DH parameters: %s",
-                       gnutls_strerror(ret));
-            return -1;
-        }
-        ret = gnutls_dh_params_generate2(*dh_params, DH_BITS);
-        if (ret < 0) {
-            gnutls_dh_params_deinit(*dh_params);
-            *dh_params = NULL;
-            error_setg(errp, "Unable to generate DH parameters: %s",
-                       gnutls_strerror(ret));
-            return -1;
-        }
-    } else {
-        GError *gerr = NULL;
-        gchar *contents;
-        gsize len;
-        gnutls_datum_t data;
-        if (!g_file_get_contents(filename,
-                                 &contents,
-                                 &len,
-                                 &gerr)) {
-
-            error_setg(errp, "%s", gerr->message);
-            g_error_free(gerr);
-            return -1;
-        }
-        data.data = (unsigned char *)contents;
-        data.size = len;
-        ret = gnutls_dh_params_init(dh_params);
-        if (ret < 0) {
-            g_free(contents);
-            error_setg(errp, "Unable to initialize DH parameters: %s",
-                       gnutls_strerror(ret));
-            return -1;
-        }
-        ret = gnutls_dh_params_import_pkcs3(*dh_params,
-                                            &data,
-                                            GNUTLS_X509_FMT_PEM);
-        g_free(contents);
-        if (ret < 0) {
-            gnutls_dh_params_deinit(*dh_params);
-            *dh_params = NULL;
-            error_setg(errp, "Unable to load DH parameters from %s: %s",
-                       filename, gnutls_strerror(ret));
-            return -1;
-        }
-    }
-
-    return 0;
-}
-
-
-int
-qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
-                           const char *filename,
-                           bool required,
-                           char **cred,
-                           Error **errp)
-{
-    struct stat sb;
-    int ret = -1;
-
-    if (!creds->dir) {
-        if (required) {
-            error_setg(errp, "Missing 'dir' property value");
-            return -1;
-        } else {
-            return 0;
-        }
-    }
-
-    *cred = g_strdup_printf("%s/%s", creds->dir, filename);
-
-    if (stat(*cred, &sb) < 0) {
-        if (errno == ENOENT && !required) {
-            ret = 0;
-        } else {
-            error_setg_errno(errp, errno,
-                             "Unable to access credentials %s",
-                             *cred);
-        }
-        g_free(*cred);
-        *cred = NULL;
-        goto cleanup;
-    }
-
-    trace_qcrypto_tls_creds_get_path(creds, filename,
-                                     *cred ? *cred : "<none>");
-    ret = 0;
- cleanup:
-    return ret;
-}
-
-
-#endif /* ! CONFIG_GNUTLS */
-
-
-static void
-qcrypto_tls_creds_prop_set_verify(Object *obj,
-                                  bool value,
-                                  Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    creds->verifyPeer = value;
-}
-
-
-static bool
-qcrypto_tls_creds_prop_get_verify(Object *obj,
-                                  Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    return creds->verifyPeer;
-}
-
-
-static void
-qcrypto_tls_creds_prop_set_dir(Object *obj,
-                               const char *value,
-                               Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    creds->dir = g_strdup(value);
-}
-
-
-static char *
-qcrypto_tls_creds_prop_get_dir(Object *obj,
-                               Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    return g_strdup(creds->dir);
-}
-
-
-static void
-qcrypto_tls_creds_prop_set_endpoint(Object *obj,
-                                    int value,
-                                    Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    creds->endpoint = value;
-}
-
-
-static int
-qcrypto_tls_creds_prop_get_endpoint(Object *obj,
-                                    Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    return creds->endpoint;
-}
-
-
-static void
-qcrypto_tls_creds_init(Object *obj)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    creds->verifyPeer = true;
-
-    object_property_add_bool(obj, "verify-peer",
-                             qcrypto_tls_creds_prop_get_verify,
-                             qcrypto_tls_creds_prop_set_verify,
-                             NULL);
-    object_property_add_str(obj, "dir",
-                            qcrypto_tls_creds_prop_get_dir,
-                            qcrypto_tls_creds_prop_set_dir,
-                            NULL);
-    object_property_add_enum(obj, "endpoint",
-                             "QCryptoTLSCredsEndpoint",
-                             QCryptoTLSCredsEndpoint_lookup,
-                             qcrypto_tls_creds_prop_get_endpoint,
-                             qcrypto_tls_creds_prop_set_endpoint,
-                             NULL);
-}
-
-
-static void
-qcrypto_tls_creds_finalize(Object *obj)
-{
-    QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
-
-    g_free(creds->dir);
-}
-
-
-static const TypeInfo qcrypto_tls_creds_info = {
-    .parent = TYPE_OBJECT,
-    .name = TYPE_QCRYPTO_TLS_CREDS,
-    .instance_size = sizeof(QCryptoTLSCreds),
-    .instance_init = qcrypto_tls_creds_init,
-    .instance_finalize = qcrypto_tls_creds_finalize,
-    .class_size = sizeof(QCryptoTLSCredsClass),
-    .abstract = true,
-};
-
-
-static void
-qcrypto_tls_creds_register_types(void)
-{
-    type_register_static(&qcrypto_tls_creds_info);
-}
-
-
-type_init(qcrypto_tls_creds_register_types);
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -1,223 +0,0 @@
-/*
- * QEMU crypto TLS anonymous credential support
- *
- * Copyright (c) 2015 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "crypto/tlscredsanon.h"
-#include "crypto/tlscredspriv.h"
-#include "qom/object_interfaces.h"
-#include "trace.h"
-
-
-#ifdef CONFIG_GNUTLS
-
-
-static int
-qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
-                            Error **errp)
-{
-    char *dhparams = NULL;
-    int ret;
-    int rv = -1;
-
-    trace_qcrypto_tls_creds_anon_load(creds,
-            creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
-
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_DH_PARAMS,
-                                       false, &dhparams, errp) < 0) {
-            goto cleanup;
-        }
-
-        ret = gnutls_anon_allocate_server_credentials(&creds->data.server);
-        if (ret < 0) {
-            error_setg(errp, "Cannot allocate credentials: %s",
-                       gnutls_strerror(ret));
-            goto cleanup;
-        }
-
-        if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
-                                                 &creds->parent_obj.dh_params,
-                                                 errp) < 0) {
-            goto cleanup;
-        }
-
-        gnutls_anon_set_server_dh_params(creds->data.server,
-                                         creds->parent_obj.dh_params);
-    } else {
-        ret = gnutls_anon_allocate_client_credentials(&creds->data.client);
-        if (ret < 0) {
-            error_setg(errp, "Cannot allocate credentials: %s",
-                       gnutls_strerror(ret));
-            goto cleanup;
-        }
-    }
-
-    rv = 0;
- cleanup:
-    g_free(dhparams);
-    return rv;
-}
-
-
-static void
-qcrypto_tls_creds_anon_unload(QCryptoTLSCredsAnon *creds)
-{
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
-        if (creds->data.client) {
-            gnutls_anon_free_client_credentials(creds->data.client);
-            creds->data.client = NULL;
-        }
-    } else {
-        if (creds->data.server) {
-            gnutls_anon_free_server_credentials(creds->data.server);
-            creds->data.server = NULL;
-        }
-    }
-    if (creds->parent_obj.dh_params) {
-        gnutls_dh_params_deinit(creds->parent_obj.dh_params);
-        creds->parent_obj.dh_params = NULL;
-    }
-}
-
-#else /* ! CONFIG_GNUTLS */
-
-
-static void
-qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds G_GNUC_UNUSED,
-                            Error **errp)
-{
-    error_setg(errp, "TLS credentials support requires GNUTLS");
-}
-
-
-static void
-qcrypto_tls_creds_anon_unload(QCryptoTLSCredsAnon *creds G_GNUC_UNUSED)
-{
-    /* nada */
-}
-
-
-#endif /* ! CONFIG_GNUTLS */
-
-
-static void
-qcrypto_tls_creds_anon_prop_set_loaded(Object *obj,
-                                       bool value,
-                                       Error **errp)
-{
-    QCryptoTLSCredsAnon *creds = QCRYPTO_TLS_CREDS_ANON(obj);
-
-    if (value) {
-        qcrypto_tls_creds_anon_load(creds, errp);
-    } else {
-        qcrypto_tls_creds_anon_unload(creds);
-    }
-}
-
-
-#ifdef CONFIG_GNUTLS
-
-
-static bool
-qcrypto_tls_creds_anon_prop_get_loaded(Object *obj,
-                                       Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCredsAnon *creds = QCRYPTO_TLS_CREDS_ANON(obj);
-
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-        return creds->data.server != NULL;
-    } else {
-        return creds->data.client != NULL;
-    }
-}
-
-
-#else /* ! CONFIG_GNUTLS */
-
-
-static bool
-qcrypto_tls_creds_anon_prop_get_loaded(Object *obj G_GNUC_UNUSED,
-                                       Error **errp G_GNUC_UNUSED)
-{
-    return false;
-}
-
-
-#endif /* ! CONFIG_GNUTLS */
-
-
-static void
-qcrypto_tls_creds_anon_complete(UserCreatable *uc, Error **errp)
-{
-    object_property_set_bool(OBJECT(uc), true, "loaded", errp);
-}
-
-
-static void
-qcrypto_tls_creds_anon_init(Object *obj)
-{
-    object_property_add_bool(obj, "loaded",
-                             qcrypto_tls_creds_anon_prop_get_loaded,
-                             qcrypto_tls_creds_anon_prop_set_loaded,
-                             NULL);
-}
-
-
-static void
-qcrypto_tls_creds_anon_finalize(Object *obj)
-{
-    QCryptoTLSCredsAnon *creds = QCRYPTO_TLS_CREDS_ANON(obj);
-
-    qcrypto_tls_creds_anon_unload(creds);
-}
-
-
-static void
-qcrypto_tls_creds_anon_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-
-    ucc->complete = qcrypto_tls_creds_anon_complete;
-}
-
-
-static const TypeInfo qcrypto_tls_creds_anon_info = {
-    .parent = TYPE_QCRYPTO_TLS_CREDS,
-    .name = TYPE_QCRYPTO_TLS_CREDS_ANON,
-    .instance_size = sizeof(QCryptoTLSCredsAnon),
-    .instance_init = qcrypto_tls_creds_anon_init,
-    .instance_finalize = qcrypto_tls_creds_anon_finalize,
-    .class_size = sizeof(QCryptoTLSCredsAnonClass),
-    .class_init = qcrypto_tls_creds_anon_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qcrypto_tls_creds_anon_register_types(void)
-{
-    type_register_static(&qcrypto_tls_creds_anon_info);
-}
-
-
-type_init(qcrypto_tls_creds_anon_register_types);
--- a/crypto/tlscredspriv.h
+++ b/crypto/tlscredspriv.h
@@ -1,42 +0,0 @@
-/*
- * QEMU crypto TLS credential support private helpers
- *
- * Copyright (c) 2015 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#ifndef QCRYPTO_TLSCRED_PRIV_H__
-#define QCRYPTO_TLSCRED_PRIV_H__
-
-#include "crypto/tlscreds.h"
-
-#ifdef CONFIG_GNUTLS
-
-int qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
-                               const char *filename,
-                               bool required,
-                               char **cred,
-                               Error **errp);
-
-int qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
-                                         const char *filename,
-                                         gnutls_dh_params_t *dh_params,
-                                         Error **errp);
-
-#endif
-
-#endif /* QCRYPTO_TLSCRED_PRIV_H__ */
-
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -1,809 +0,0 @@
-/*
- * QEMU crypto TLS x509 credential support
- *
- * Copyright (c) 2015 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "crypto/tlscredsx509.h"
-#include "crypto/tlscredspriv.h"
-#include "qom/object_interfaces.h"
-#include "trace.h"
-
-
-#ifdef CONFIG_GNUTLS
-
-#include <gnutls/x509.h>
-
-
-static int
-qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert,
-                                   const char *certFile,
-                                   bool isServer,
-                                   bool isCA,
-                                   Error **errp)
-{
-    time_t now = time(NULL);
-
-    if (now == ((time_t)-1)) {
-        error_setg_errno(errp, errno, "cannot get current time");
-        return -1;
-    }
-
-    if (gnutls_x509_crt_get_expiration_time(cert) < now) {
-        error_setg(errp,
-                   (isCA ?
-                    "The CA certificate %s has expired" :
-                    (isServer ?
-                     "The server certificate %s has expired" :
-                     "The client certificate %s has expired")),
-                   certFile);
-        return -1;
-    }
-
-    if (gnutls_x509_crt_get_activation_time(cert) > now) {
-        error_setg(errp,
-                   (isCA ?
-                    "The CA certificate %s is not yet active" :
-                    (isServer ?
-                     "The server certificate %s is not yet active" :
-                     "The client certificate %s is not yet active")),
-                   certFile);
-        return -1;
-    }
-
-    return 0;
-}
-
-
-#if LIBGNUTLS_VERSION_NUMBER >= 2
-/*
- * The gnutls_x509_crt_get_basic_constraints function isn't
- * available in GNUTLS 1.0.x branches. This isn't critical
- * though, since gnutls_certificate_verify_peers2 will do
- * pretty much the same check at runtime, so we can just
- * disable this code
- */
-static int
-qcrypto_tls_creds_check_cert_basic_constraints(QCryptoTLSCredsX509 *creds,
-                                               gnutls_x509_crt_t cert,
-                                               const char *certFile,
-                                               bool isServer,
-                                               bool isCA,
-                                               Error **errp)
-{
-    int status;
-
-    status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
-    trace_qcrypto_tls_creds_x509_check_basic_constraints(
-        creds, certFile, status);
-
-    if (status > 0) { /* It is a CA cert */
-        if (!isCA) {
-            error_setg(errp, isServer ?
-                       "The certificate %s basic constraints show a CA, "
-                       "but we need one for a server" :
-                       "The certificate %s basic constraints show a CA, "
-                       "but we need one for a client",
-                       certFile);
-            return -1;
-        }
-    } else if (status == 0) { /* It is not a CA cert */
-        if (isCA) {
-            error_setg(errp,
-                       "The certificate %s basic constraints do not "
-                       "show a CA",
-                       certFile);
-            return -1;
-        }
-    } else if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
-        /* Missing basicConstraints */
-        if (isCA) {
-            error_setg(errp,
-                       "The certificate %s is missing basic constraints "
-                       "for a CA",
-                       certFile);
-            return -1;
-        }
-    } else { /* General error */
-        error_setg(errp,
-                   "Unable to query certificate %s basic constraints: %s",
-                   certFile, gnutls_strerror(status));
-        return -1;
-    }
-
-    return 0;
-}
-#endif
-
-
-static int
-qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
-                                       gnutls_x509_crt_t cert,
-                                       const char *certFile,
-                                       bool isCA,
-                                       Error **errp)
-{
-    int status;
-    unsigned int usage = 0;
-    unsigned int critical = 0;
-
-    status = gnutls_x509_crt_get_key_usage(cert, &usage, &critical);
-    trace_qcrypto_tls_creds_x509_check_key_usage(
-        creds, certFile, status, usage, critical);
-
-    if (status < 0) {
-        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
-            usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
-                GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT;
-        } else {
-            error_setg(errp,
-                       "Unable to query certificate %s key usage: %s",
-                       certFile, gnutls_strerror(status));
-            return -1;
-        }
-    }
-
-    if (isCA) {
-        if (!(usage & GNUTLS_KEY_KEY_CERT_SIGN)) {
-            if (critical) {
-                error_setg(errp,
-                           "Certificate %s usage does not permit "
-                           "certificate signing", certFile);
-                return -1;
-            }
-        }
-    } else {
-        if (!(usage & GNUTLS_KEY_DIGITAL_SIGNATURE)) {
-            if (critical) {
-                error_setg(errp,
-                           "Certificate %s usage does not permit digital "
-                           "signature", certFile);
-                return -1;
-            }
-        }
-        if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
-            if (critical) {
-                error_setg(errp,
-                           "Certificate %s usage does not permit key "
-                           "encipherment", certFile);
-                return -1;
-            }
-        }
-    }
-
-    return 0;
-}
-
-
-static int
-qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
-                                         gnutls_x509_crt_t cert,
-                                         const char *certFile,
-                                         bool isServer,
-                                         Error **errp)
-{
-    int status;
-    size_t i;
-    unsigned int purposeCritical;
-    unsigned int critical;
-    char *buffer = NULL;
-    size_t size;
-    bool allowClient = false, allowServer = false;
-
-    critical = 0;
-    for (i = 0; ; i++) {
-        size = 0;
-        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
-                                                     &size, NULL);
-
-        if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
-
-            /* If there is no data at all, then we must allow
-               client/server to pass */
-            if (i == 0) {
-                allowServer = allowClient = true;
-            }
-            break;
-        }
-        if (status != GNUTLS_E_SHORT_MEMORY_BUFFER) {
-            error_setg(errp,
-                       "Unable to query certificate %s key purpose: %s",
-                       certFile, gnutls_strerror(status));
-            return -1;
-        }
-
-        buffer = g_new0(char, size);
-
-        status = gnutls_x509_crt_get_key_purpose_oid(cert, i, buffer,
-                                                     &size, &purposeCritical);
-
-        if (status < 0) {
-            trace_qcrypto_tls_creds_x509_check_key_purpose(
-                creds, certFile, status, "<none>", purposeCritical);
-            g_free(buffer);
-            error_setg(errp,
-                       "Unable to query certificate %s key purpose: %s",
-                       certFile, gnutls_strerror(status));
-            return -1;
-        }
-        trace_qcrypto_tls_creds_x509_check_key_purpose(
-            creds, certFile, status, buffer, purposeCritical);
-        if (purposeCritical) {
-            critical = true;
-        }
-
-        if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
-            allowServer = true;
-        } else if (g_str_equal(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
-            allowClient = true;
-        } else if (g_str_equal(buffer, GNUTLS_KP_ANY)) {
-            allowServer = allowClient = true;
-        }
-
-        g_free(buffer);
-    }
-
-    if (isServer) {
-        if (!allowServer) {
-            if (critical) {
-                error_setg(errp,
-                           "Certificate %s purpose does not allow "
-                           "use with a TLS server", certFile);
-                return -1;
-            }
-        }
-    } else {
-        if (!allowClient) {
-            if (critical) {
-                error_setg(errp,
-                           "Certificate %s purpose does not allow use "
-                           "with a TLS client", certFile);
-                return -1;
-            }
-        }
-    }
-
-    return 0;
-}
-
-
-static int
-qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
-                             gnutls_x509_crt_t cert,
-                             const char *certFile,
-                             bool isServer,
-                             bool isCA,
-                             Error **errp)
-{
-    if (qcrypto_tls_creds_check_cert_times(cert, certFile,
-                                           isServer, isCA,
-                                           errp) < 0) {
-        return -1;
-    }
-
-#if LIBGNUTLS_VERSION_NUMBER >= 2
-    if (qcrypto_tls_creds_check_cert_basic_constraints(creds,
-                                                       cert, certFile,
-                                                       isServer, isCA,
-                                                       errp) < 0) {
-        return -1;
-    }
-#endif
-
-    if (qcrypto_tls_creds_check_cert_key_usage(creds,
-                                               cert, certFile,
-                                               isCA, errp) < 0) {
-        return -1;
-    }
-
-    if (!isCA &&
-        qcrypto_tls_creds_check_cert_key_purpose(creds,
-                                                 cert, certFile,
-                                                 isServer, errp) < 0) {
-        return -1;
-    }
-
-    return 0;
-}
-
-
-static int
-qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
-                                  const char *certFile,
-                                  gnutls_x509_crt_t *cacerts,
-                                  size_t ncacerts,
-                                  const char *cacertFile,
-                                  bool isServer,
-                                  Error **errp)
-{
-    unsigned int status;
-
-    if (gnutls_x509_crt_list_verify(&cert, 1,
-                                    cacerts, ncacerts,
-                                    NULL, 0,
-                                    0, &status) < 0) {
-        error_setg(errp, isServer ?
-                   "Unable to verify server certificate %s against "
-                   "CA certificate %s" :
-                   "Unable to verify client certificate %s against "
-                   "CA certificate %s",
-                   certFile, cacertFile);
-        return -1;
-    }
-
-    if (status != 0) {
-        const char *reason = "Invalid certificate";
-
-        if (status & GNUTLS_CERT_INVALID) {
-            reason = "The certificate is not trusted";
-        }
-
-        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
-            reason = "The certificate hasn't got a known issuer";
-        }
-
-        if (status & GNUTLS_CERT_REVOKED) {
-            reason = "The certificate has been revoked";
-        }
-
-#ifndef GNUTLS_1_0_COMPAT
-        if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
-            reason = "The certificate uses an insecure algorithm";
-        }
-#endif
-
-        error_setg(errp,
-                   "Our own certificate %s failed validation against %s: %s",
-                   certFile, cacertFile, reason);
-        return -1;
-    }
-
-    return 0;
-}
-
-
-static gnutls_x509_crt_t
-qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds,
-                            const char *certFile,
-                            bool isServer,
-                            Error **errp)
-{
-    gnutls_datum_t data;
-    gnutls_x509_crt_t cert = NULL;
-    char *buf = NULL;
-    gsize buflen;
-    GError *gerr;
-    int ret = -1;
-
-    trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile);
-
-    if (gnutls_x509_crt_init(&cert) < 0) {
-        error_setg(errp, "Unable to initialize certificate");
-        goto cleanup;
-    }
-
-    if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
-        error_setg(errp, "Cannot load CA cert list %s: %s",
-                   certFile, gerr->message);
-        g_error_free(gerr);
-        goto cleanup;
-    }
-
-    data.data = (unsigned char *)buf;
-    data.size = strlen(buf);
-
-    if (gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM) < 0) {
-        error_setg(errp, isServer ?
-                   "Unable to import server certificate %s" :
-                   "Unable to import client certificate %s",
-                   certFile);
-        goto cleanup;
-    }
-
-    ret = 0;
-
- cleanup:
-    if (ret != 0) {
-        gnutls_x509_crt_deinit(cert);
-        cert = NULL;
-    }
-    g_free(buf);
-    return cert;
-}
-
-
-static int
-qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
-                                    const char *certFile,
-                                    gnutls_x509_crt_t *certs,
-                                    unsigned int certMax,
-                                    size_t *ncerts,
-                                    Error **errp)
-{
-    gnutls_datum_t data;
-    char *buf = NULL;
-    gsize buflen;
-    int ret = -1;
-    GError *gerr = NULL;
-
-    *ncerts = 0;
-    trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile);
-
-    if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
-        error_setg(errp, "Cannot load CA cert list %s: %s",
-                   certFile, gerr->message);
-        g_error_free(gerr);
-        goto cleanup;
-    }
-
-    data.data = (unsigned char *)buf;
-    data.size = strlen(buf);
-
-    if (gnutls_x509_crt_list_import(certs, &certMax, &data,
-                                    GNUTLS_X509_FMT_PEM, 0) < 0) {
-        error_setg(errp,
-                   "Unable to import CA certificate list %s",
-                   certFile);
-        goto cleanup;
-    }
-    *ncerts = certMax;
-
-    ret = 0;
-
- cleanup:
-    g_free(buf);
-    return ret;
-}
-
-
-#define MAX_CERTS 16
-static int
-qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
-                                    bool isServer,
-                                    const char *cacertFile,
-                                    const char *certFile,
-                                    Error **errp)
-{
-    gnutls_x509_crt_t cert = NULL;
-    gnutls_x509_crt_t cacerts[MAX_CERTS];
-    size_t ncacerts = 0;
-    size_t i;
-    int ret = -1;
-
-    memset(cacerts, 0, sizeof(cacerts));
-    if (access(certFile, R_OK) == 0) {
-        cert = qcrypto_tls_creds_load_cert(creds,
-                                           certFile, isServer,
-                                           errp);
-        if (!cert) {
-            goto cleanup;
-        }
-    }
-    if (access(cacertFile, R_OK) == 0) {
-        if (qcrypto_tls_creds_load_ca_cert_list(creds,
-                                                cacertFile, cacerts,
-                                                MAX_CERTS, &ncacerts,
-                                                errp) < 0) {
-            goto cleanup;
-        }
-    }
-
-    if (cert &&
-        qcrypto_tls_creds_check_cert(creds,
-                                     cert, certFile, isServer,
-                                     false, errp) < 0) {
-        goto cleanup;
-    }
-
-    for (i = 0; i < ncacerts; i++) {
-        if (qcrypto_tls_creds_check_cert(creds,
-                                         cacerts[i], cacertFile,
-                                         isServer, true, errp) < 0) {
-            goto cleanup;
-        }
-    }
-
-    if (cert && ncacerts &&
-        qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts,
-                                          ncacerts, cacertFile,
-                                          isServer, errp) < 0) {
-        goto cleanup;
-    }
-
-    ret = 0;
-
- cleanup:
-    if (cert) {
-        gnutls_x509_crt_deinit(cert);
-    }
-    for (i = 0; i < ncacerts; i++) {
-        gnutls_x509_crt_deinit(cacerts[i]);
-    }
-    return ret;
-}
-
-
-static int
-qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
-                            Error **errp)
-{
-    char *cacert = NULL, *cacrl = NULL, *cert = NULL,
-        *key = NULL, *dhparams = NULL;
-    int ret;
-    int rv = -1;
-
-    trace_qcrypto_tls_creds_x509_load(creds,
-            creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
-
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,
-                                       true, &cacert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CA_CRL,
-                                       false, &cacrl, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
-                                       true, &cert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
-                                       true, &key, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_DH_PARAMS,
-                                       false, &dhparams, errp) < 0) {
-            goto cleanup;
-        }
-    } else {
-        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,
-                                       true, &cacert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
-                                       false, &cert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
-                                       false, &key, errp) < 0) {
-            goto cleanup;
-        }
-    }
-
-    if (creds->sanityCheck &&
-        qcrypto_tls_creds_x509_sanity_check(creds,
-            creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
-            cacert, cert, errp) < 0) {
-        goto cleanup;
-    }
-
-    ret = gnutls_certificate_allocate_credentials(&creds->data);
-    if (ret < 0) {
-        error_setg(errp, "Cannot allocate credentials: '%s'",
-                   gnutls_strerror(ret));
-        goto cleanup;
-    }
-
-    ret = gnutls_certificate_set_x509_trust_file(creds->data,
-                                                 cacert,
-                                                 GNUTLS_X509_FMT_PEM);
-    if (ret < 0) {
-        error_setg(errp, "Cannot load CA certificate '%s': %s",
-                   cacert, gnutls_strerror(ret));
-        goto cleanup;
-    }
-
-    if (cert != NULL && key != NULL) {
-        ret = gnutls_certificate_set_x509_key_file(creds->data,
-                                                   cert, key,
-                                                   GNUTLS_X509_FMT_PEM);
-        if (ret < 0) {
-            error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
-                       cert, key, gnutls_strerror(ret));
-            goto cleanup;
-        }
-    }
-
-    if (cacrl != NULL) {
-        ret = gnutls_certificate_set_x509_crl_file(creds->data,
-                                                   cacrl,
-                                                   GNUTLS_X509_FMT_PEM);
-        if (ret < 0) {
-            error_setg(errp, "Cannot load CRL '%s': %s",
-                       cacrl, gnutls_strerror(ret));
-            goto cleanup;
-        }
-    }
-
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-        if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
-                                                 &creds->parent_obj.dh_params,
-                                                 errp) < 0) {
-            goto cleanup;
-        }
-        gnutls_certificate_set_dh_params(creds->data,
-                                         creds->parent_obj.dh_params);
-    }
-
-    rv = 0;
- cleanup:
-    g_free(cacert);
-    g_free(cacrl);
-    g_free(cert);
-    g_free(key);
-    g_free(dhparams);
-    return rv;
-}
-
-
-static void
-qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
-{
-    if (creds->data) {
-        gnutls_certificate_free_credentials(creds->data);
-        creds->data = NULL;
-    }
-}
-
-
-#else /* ! CONFIG_GNUTLS */
-
-
-static void
-qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
-                            Error **errp)
-{
-    error_setg(errp, "TLS credentials support requires GNUTLS");
-}
-
-
-static void
-qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)
-{
-    /* nada */
-}
-
-
-#endif /* ! CONFIG_GNUTLS */
-
-
-static void
-qcrypto_tls_creds_x509_prop_set_loaded(Object *obj,
-                                       bool value,
-                                       Error **errp)
-{
-    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
-
-    if (value) {
-        qcrypto_tls_creds_x509_load(creds, errp);
-    } else {
-        qcrypto_tls_creds_x509_unload(creds);
-    }
-}
-
-
-#ifdef CONFIG_GNUTLS
-
-
-static bool
-qcrypto_tls_creds_x509_prop_get_loaded(Object *obj,
-                                       Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
-
-    return creds->data != NULL;
-}
-
-
-#else /* ! CONFIG_GNUTLS */
-
-
-static bool
-qcrypto_tls_creds_x509_prop_get_loaded(Object *obj G_GNUC_UNUSED,
-                                       Error **errp G_GNUC_UNUSED)
-{
-    return false;
-}
-
-
-#endif /* ! CONFIG_GNUTLS */
-
-
-static void
-qcrypto_tls_creds_x509_prop_set_sanity(Object *obj,
-                                       bool value,
-                                       Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
-
-    creds->sanityCheck = value;
-}
-
-
-static bool
-qcrypto_tls_creds_x509_prop_get_sanity(Object *obj,
-                                       Error **errp G_GNUC_UNUSED)
-{
-    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
-
-    return creds->sanityCheck;
-}
-
-
-static void
-qcrypto_tls_creds_x509_complete(UserCreatable *uc, Error **errp)
-{
-    object_property_set_bool(OBJECT(uc), true, "loaded", errp);
-}
-
-
-static void
-qcrypto_tls_creds_x509_init(Object *obj)
-{
-    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
-
-    creds->sanityCheck = true;
-
-    object_property_add_bool(obj, "loaded",
-                             qcrypto_tls_creds_x509_prop_get_loaded,
-                             qcrypto_tls_creds_x509_prop_set_loaded,
-                             NULL);
-    object_property_add_bool(obj, "sanity-check",
-                             qcrypto_tls_creds_x509_prop_get_sanity,
-                             qcrypto_tls_creds_x509_prop_set_sanity,
-                             NULL);
-}
-
-
-static void
-qcrypto_tls_creds_x509_finalize(Object *obj)
-{
-    QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
-
-    qcrypto_tls_creds_x509_unload(creds);
-}
-
-
-static void
-qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-
-    ucc->complete = qcrypto_tls_creds_x509_complete;
-}
-
-
-static const TypeInfo qcrypto_tls_creds_x509_info = {
-    .parent = TYPE_QCRYPTO_TLS_CREDS,
-    .name = TYPE_QCRYPTO_TLS_CREDS_X509,
-    .instance_size = sizeof(QCryptoTLSCredsX509),
-    .instance_init = qcrypto_tls_creds_x509_init,
-    .instance_finalize = qcrypto_tls_creds_x509_finalize,
-    .class_size = sizeof(QCryptoTLSCredsX509Class),
-    .class_init = qcrypto_tls_creds_x509_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qcrypto_tls_creds_x509_register_types(void)
-{
-    type_register_static(&qcrypto_tls_creds_x509_info);
-}
-
-
-type_init(qcrypto_tls_creds_x509_register_types);
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -1,574 +0,0 @@
-/*
- * QEMU crypto TLS session support
- *
- * Copyright (c) 2015 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "crypto/tlssession.h"
-#include "crypto/tlscredsanon.h"
-#include "crypto/tlscredsx509.h"
-#include "qemu/acl.h"
-#include "trace.h"
-
-#ifdef CONFIG_GNUTLS
-
-
-#include <gnutls/x509.h>
-
-
-struct QCryptoTLSSession {
-    QCryptoTLSCreds *creds;
-    gnutls_session_t handle;
-    char *hostname;
-    char *aclname;
-    bool handshakeComplete;
-    QCryptoTLSSessionWriteFunc writeFunc;
-    QCryptoTLSSessionReadFunc readFunc;
-    void *opaque;
-    char *peername;
-};
-
-
-void
-qcrypto_tls_session_free(QCryptoTLSSession *session)
-{
-    if (!session) {
-        return;
-    }
-
-    gnutls_deinit(session->handle);
-    g_free(session->hostname);
-    g_free(session->peername);
-    g_free(session->aclname);
-    object_unref(OBJECT(session->creds));
-    g_free(session);
-}
-
-
-static ssize_t
-qcrypto_tls_session_push(void *opaque, const void *buf, size_t len)
-{
-    QCryptoTLSSession *session = opaque;
-
-    if (!session->writeFunc) {
-        errno = EIO;
-        return -1;
-    };
-
-    return session->writeFunc(buf, len, session->opaque);
-}
-
-
-static ssize_t
-qcrypto_tls_session_pull(void *opaque, void *buf, size_t len)
-{
-    QCryptoTLSSession *session = opaque;
-
-    if (!session->readFunc) {
-        errno = EIO;
-        return -1;
-    };
-
-    return session->readFunc(buf, len, session->opaque);
-}
-
-
-QCryptoTLSSession *
-qcrypto_tls_session_new(QCryptoTLSCreds *creds,
-                        const char *hostname,
-                        const char *aclname,
-                        QCryptoTLSCredsEndpoint endpoint,
-                        Error **errp)
-{
-    QCryptoTLSSession *session;
-    int ret;
-
-    session = g_new0(QCryptoTLSSession, 1);
-    trace_qcrypto_tls_session_new(
-        session, creds, hostname ? hostname : "<none>",
-        aclname ? aclname : "<none>", endpoint);
-
-    if (hostname) {
-        session->hostname = g_strdup(hostname);
-    }
-    if (aclname) {
-        session->aclname = g_strdup(aclname);
-    }
-    session->creds = creds;
-    object_ref(OBJECT(creds));
-
-    if (creds->endpoint != endpoint) {
-        error_setg(errp, "Credentials endpoint doesn't match session");
-        goto error;
-    }
-
-    if (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-        ret = gnutls_init(&session->handle, GNUTLS_SERVER);
-    } else {
-        ret = gnutls_init(&session->handle, GNUTLS_CLIENT);
-    }
-    if (ret < 0) {
-        error_setg(errp, "Cannot initialize TLS session: %s",
-                   gnutls_strerror(ret));
-        goto error;
-    }
-
-    if (object_dynamic_cast(OBJECT(creds),
-                            TYPE_QCRYPTO_TLS_CREDS_ANON)) {
-        QCryptoTLSCredsAnon *acreds = QCRYPTO_TLS_CREDS_ANON(creds);
-
-        ret = gnutls_priority_set_direct(session->handle,
-                                         "NORMAL:+ANON-DH", NULL);
-        if (ret < 0) {
-            error_setg(errp, "Unable to set TLS session priority: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-        if (creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-            ret = gnutls_credentials_set(session->handle,
-                                         GNUTLS_CRD_ANON,
-                                         acreds->data.server);
-        } else {
-            ret = gnutls_credentials_set(session->handle,
-                                         GNUTLS_CRD_ANON,
-                                         acreds->data.client);
-        }
-        if (ret < 0) {
-            error_setg(errp, "Cannot set session credentials: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-    } else if (object_dynamic_cast(OBJECT(creds),
-                                   TYPE_QCRYPTO_TLS_CREDS_X509)) {
-        QCryptoTLSCredsX509 *tcreds = QCRYPTO_TLS_CREDS_X509(creds);
-
-        ret = gnutls_set_default_priority(session->handle);
-        if (ret < 0) {
-            error_setg(errp, "Cannot set default TLS session priority: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-        ret = gnutls_credentials_set(session->handle,
-                                     GNUTLS_CRD_CERTIFICATE,
-                                     tcreds->data);
-        if (ret < 0) {
-            error_setg(errp, "Cannot set session credentials: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-
-        if (creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-            /* This requests, but does not enforce a client cert.
-             * The cert checking code later does enforcement */
-            gnutls_certificate_server_set_request(session->handle,
-                                                  GNUTLS_CERT_REQUEST);
-        }
-    } else {
-        error_setg(errp, "Unsupported TLS credentials type %s",
-                   object_get_typename(OBJECT(creds)));
-        goto error;
-    }
-
-    gnutls_transport_set_ptr(session->handle, session);
-    gnutls_transport_set_push_function(session->handle,
-                                       qcrypto_tls_session_push);
-    gnutls_transport_set_pull_function(session->handle,
-                                       qcrypto_tls_session_pull);
-
-    return session;
-
- error:
-    qcrypto_tls_session_free(session);
-    return NULL;
-}
-
-static int
-qcrypto_tls_session_check_certificate(QCryptoTLSSession *session,
-                                      Error **errp)
-{
-    int ret;
-    unsigned int status;
-    const gnutls_datum_t *certs;
-    unsigned int nCerts, i;
-    time_t now;
-    gnutls_x509_crt_t cert = NULL;
-
-    now = time(NULL);
-    if (now == ((time_t)-1)) {
-        error_setg_errno(errp, errno, "Cannot get current time");
-        return -1;
-    }
-
-    ret = gnutls_certificate_verify_peers2(session->handle, &status);
-    if (ret < 0) {
-        error_setg(errp, "Verify failed: %s", gnutls_strerror(ret));
-        return -1;
-    }
-
-    if (status != 0) {
-        const char *reason = "Invalid certificate";
-
-        if (status & GNUTLS_CERT_INVALID) {
-            reason = "The certificate is not trusted";
-        }
-
-        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
-            reason = "The certificate hasn't got a known issuer";
-        }
-
-        if (status & GNUTLS_CERT_REVOKED) {
-            reason = "The certificate has been revoked";
-        }
-
-        if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
-            reason = "The certificate uses an insecure algorithm";
-        }
-
-        error_setg(errp, "%s", reason);
-        return -1;
-    }
-
-    certs = gnutls_certificate_get_peers(session->handle, &nCerts);
-    if (!certs) {
-        error_setg(errp, "No certificate peers");
-        return -1;
-    }
-
-    for (i = 0; i < nCerts; i++) {
-        ret = gnutls_x509_crt_init(&cert);
-        if (ret < 0) {
-            error_setg(errp, "Cannot initialize certificate: %s",
-                       gnutls_strerror(ret));
-            return -1;
-        }
-
-        ret = gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER);
-        if (ret < 0) {
-            error_setg(errp, "Cannot import certificate: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-
-        if (gnutls_x509_crt_get_expiration_time(cert) < now) {
-            error_setg(errp, "The certificate has expired");
-            goto error;
-        }
-
-        if (gnutls_x509_crt_get_activation_time(cert) > now) {
-            error_setg(errp, "The certificate is not yet activated");
-            goto error;
-        }
-
-        if (gnutls_x509_crt_get_activation_time(cert) > now) {
-            error_setg(errp, "The certificate is not yet activated");
-            goto error;
-        }
-
-        if (i == 0) {
-            size_t dnameSize = 1024;
-            session->peername = g_malloc(dnameSize);
-        requery:
-            ret = gnutls_x509_crt_get_dn(cert, session->peername, &dnameSize);
-            if (ret < 0) {
-                if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
-                    session->peername = g_realloc(session->peername,
-                                                  dnameSize);
-                    goto requery;
-                }
-                error_setg(errp, "Cannot get client distinguished name: %s",
-                           gnutls_strerror(ret));
-                goto error;
-            }
-            if (session->aclname) {
-                qemu_acl *acl = qemu_acl_find(session->aclname);
-                int allow;
-                if (!acl) {
-                    error_setg(errp, "Cannot find ACL %s",
-                               session->aclname);
-                    goto error;
-                }
-
-                allow = qemu_acl_party_is_allowed(acl, session->peername);
-
-                error_setg(errp, "TLS x509 ACL check for %s is %s",
-                           session->peername, allow ? "allowed" : "denied");
-                if (!allow) {
-                    goto error;
-                }
-            }
-            if (session->hostname) {
-                if (!gnutls_x509_crt_check_hostname(cert, session->hostname)) {
-                    error_setg(errp,
-                               "Certificate does not match the hostname %s",
-                               session->hostname);
-                    goto error;
-                }
-            }
-        }
-
-        gnutls_x509_crt_deinit(cert);
-    }
-
-    return 0;
-
- error:
-    gnutls_x509_crt_deinit(cert);
-    return -1;
-}
-
-
-int
-qcrypto_tls_session_check_credentials(QCryptoTLSSession *session,
-                                      Error **errp)
-{
-    if (object_dynamic_cast(OBJECT(session->creds),
-                            TYPE_QCRYPTO_TLS_CREDS_ANON)) {
-        return 0;
-    } else if (object_dynamic_cast(OBJECT(session->creds),
-                            TYPE_QCRYPTO_TLS_CREDS_X509)) {
-        if (session->creds->verifyPeer) {
-            return qcrypto_tls_session_check_certificate(session,
-                                                         errp);
-        } else {
-            return 0;
-        }
-    } else {
-        error_setg(errp, "Unexpected credential type %s",
-                   object_get_typename(OBJECT(session->creds)));
-        return -1;
-    }
-}
-
-
-void
-qcrypto_tls_session_set_callbacks(QCryptoTLSSession *session,
-                                  QCryptoTLSSessionWriteFunc writeFunc,
-                                  QCryptoTLSSessionReadFunc readFunc,
-                                  void *opaque)
-{
-    session->writeFunc = writeFunc;
-    session->readFunc = readFunc;
-    session->opaque = opaque;
-}
-
-
-ssize_t
-qcrypto_tls_session_write(QCryptoTLSSession *session,
-                          const char *buf,
-                          size_t len)
-{
-    ssize_t ret = gnutls_record_send(session->handle, buf, len);
-
-    if (ret < 0) {
-        switch (ret) {
-        case GNUTLS_E_AGAIN:
-            errno = EAGAIN;
-            break;
-        case GNUTLS_E_INTERRUPTED:
-            errno = EINTR;
-            break;
-        default:
-            errno = EIO;
-            break;
-        }
-        ret = -1;
-    }
-
-    return ret;
-}
-
-
-ssize_t
-qcrypto_tls_session_read(QCryptoTLSSession *session,
-                         char *buf,
-                         size_t len)
-{
-    ssize_t ret = gnutls_record_recv(session->handle, buf, len);
-
-    if (ret < 0) {
-        switch (ret) {
-        case GNUTLS_E_AGAIN:
-            errno = EAGAIN;
-            break;
-        case GNUTLS_E_INTERRUPTED:
-            errno = EINTR;
-            break;
-        default:
-            errno = EIO;
-            break;
-        }
-        ret = -1;
-    }
-
-    return ret;
-}
-
-
-int
-qcrypto_tls_session_handshake(QCryptoTLSSession *session,
-                              Error **errp)
-{
-    int ret = gnutls_handshake(session->handle);
-    if (ret == 0) {
-        session->handshakeComplete = true;
-    } else {
-        if (ret == GNUTLS_E_INTERRUPTED ||
-            ret == GNUTLS_E_AGAIN) {
-            ret = 1;
-        } else {
-            error_setg(errp, "TLS handshake failed: %s",
-                       gnutls_strerror(ret));
-            ret = -1;
-        }
-    }
-
-    return ret;
-}
-
-
-QCryptoTLSSessionHandshakeStatus
-qcrypto_tls_session_get_handshake_status(QCryptoTLSSession *session)
-{
-    if (session->handshakeComplete) {
-        return QCRYPTO_TLS_HANDSHAKE_COMPLETE;
-    } else if (gnutls_record_get_direction(session->handle) == 0) {
-        return QCRYPTO_TLS_HANDSHAKE_RECVING;
-    } else {
-        return QCRYPTO_TLS_HANDSHAKE_SENDING;
-    }
-}
-
-
-int
-qcrypto_tls_session_get_key_size(QCryptoTLSSession *session,
-                                 Error **errp)
-{
-    gnutls_cipher_algorithm_t cipher;
-    int ssf;
-
-    cipher = gnutls_cipher_get(session->handle);
-    ssf = gnutls_cipher_get_key_size(cipher);
-    if (!ssf) {
-        error_setg(errp, "Cannot get TLS cipher key size");
-        return -1;
-    }
-    return ssf;
-}
-
-
-char *
-qcrypto_tls_session_get_peer_name(QCryptoTLSSession *session)
-{
-    if (session->peername) {
-        return g_strdup(session->peername);
-    }
-    return NULL;
-}
-
-
-#else /* ! CONFIG_GNUTLS */
-
-
-QCryptoTLSSession *
-qcrypto_tls_session_new(QCryptoTLSCreds *creds G_GNUC_UNUSED,
-                        const char *hostname G_GNUC_UNUSED,
-                        const char *aclname G_GNUC_UNUSED,
-                        QCryptoTLSCredsEndpoint endpoint G_GNUC_UNUSED,
-                        Error **errp)
-{
-    error_setg(errp, "TLS requires GNUTLS support");
-    return NULL;
-}
-
-
-void
-qcrypto_tls_session_free(QCryptoTLSSession *sess G_GNUC_UNUSED)
-{
-}
-
-
-int
-qcrypto_tls_session_check_credentials(QCryptoTLSSession *sess G_GNUC_UNUSED,
-                                      Error **errp)
-{
-    error_setg(errp, "TLS requires GNUTLS support");
-    return -1;
-}
-
-
-void
-qcrypto_tls_session_set_callbacks(
-    QCryptoTLSSession *sess G_GNUC_UNUSED,
-    QCryptoTLSSessionWriteFunc writeFunc G_GNUC_UNUSED,
-    QCryptoTLSSessionReadFunc readFunc G_GNUC_UNUSED,
-    void *opaque G_GNUC_UNUSED)
-{
-}
-
-
-ssize_t
-qcrypto_tls_session_write(QCryptoTLSSession *sess,
-                          const char *buf,
-                          size_t len)
-{
-    errno = -EIO;
-    return -1;
-}
-
-
-ssize_t
-qcrypto_tls_session_read(QCryptoTLSSession *sess,
-                         char *buf,
-                         size_t len)
-{
-    errno = -EIO;
-    return -1;
-}
-
-
-int
-qcrypto_tls_session_handshake(QCryptoTLSSession *sess,
-                              Error **errp)
-{
-    error_setg(errp, "TLS requires GNUTLS support");
-    return -1;
-}
-
-
-QCryptoTLSSessionHandshakeStatus
-qcrypto_tls_session_get_handshake_status(QCryptoTLSSession *sess)
-{
-    return QCRYPTO_TLS_HANDSHAKE_COMPLETE;
-}
-
-
-int
-qcrypto_tls_session_get_key_size(QCryptoTLSSession *sess,
-                                 Error **errp)
-{
-    error_setg(errp, "TLS requires GNUTLS support");
-    return -1;
-}
-
-
-char *
-qcrypto_tls_session_get_peer_name(QCryptoTLSSession *sess)
-{
-    return NULL;
-}
-
-#endif
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -28,7 +28,6 @@ CONFIG_SSI_M25P80=y
 CONFIG_LAN9118=y
 CONFIG_SMC91C111=y
 CONFIG_ALLWINNER_EMAC=y
-CONFIG_IMX_FEC=y
 CONFIG_DS1338=y
 CONFIG_PFLASH_CFI01=y
 CONFIG_PFLASH_CFI02=y
@@ -99,13 +98,7 @@ CONFIG_ALLWINNER_A10_PIT=y
 CONFIG_ALLWINNER_A10_PIC=y
 CONFIG_ALLWINNER_A10=y

-CONFIG_FSL_IMX31=y
-CONFIG_FSL_IMX25=y
-
-CONFIG_IMX_I2C=y
-
 CONFIG_XIO3130=y
 CONFIG_IOH3420=y
 CONFIG_I82801B11=y
 CONFIG_ACPI=y
-CONFIG_SMBIOS=y
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -7,7 +7,6 @@ CONFIG_QXL=$(CONFIG_SPICE)
 CONFIG_VGA_ISA=y
 CONFIG_VGA_CIRRUS=y
 CONFIG_VMWARE_VGA=y
-CONFIG_VIRTIO_VGA=y
 CONFIG_VMMOUSE=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
@@ -44,9 +43,9 @@ CONFIG_LPC_ICH9=y
 CONFIG_PCI_Q35=y
 CONFIG_APIC=y
 CONFIG_IOAPIC=y
+CONFIG_ICC_BUS=y
 CONFIG_PVPANIC=y
 CONFIG_MEM_HOTPLUG=y
 CONFIG_XIO3130=y
 CONFIG_IOH3420=y
 CONFIG_I82801B11=y
-CONFIG_SMBIOS=y
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Michael Roth	83c92b4514	Update version for 2.4.0.1 release Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2015-09-22 16:53:29 -05:00
P J P	5a1ccdfe44	net: avoid infinite loop when receiving packets(CVE-2015-5278) Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) bytes to process network packets. While receiving packets via ne2000_receive() routine, a local 'index' variable could exceed the ring buffer size, leading to an infinite loop situation. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: P J P <pjp@fedoraproject.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit `737d2b3c41`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2015-09-21 17:04:22 -05:00
P J P	7aa2bcad0c	net: add checks to validate ring buffer pointers(CVE-2015-5279) Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152) bytes to process network packets. While receiving packets via ne2000_receive() routine, a local 'index' variable could exceed the ring buffer size, which could lead to a memory buffer overflow. Added other checks at initialisation. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: P J P <pjp@fedoraproject.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit `9bbdbc66e5`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2015-09-21 17:04:14 -05:00
P J P	3a56af1fbc	e1000: Avoid infinite loop in processing transmit descriptor (CVE-2015-6815) While processing transmit descriptors, it could lead to an infinite loop if 'bytes' was to become zero; Add a check to avoid it. [The guest can force 'bytes' to 0 by setting the hdr_len and mss descriptor fields to 0. --Stefan] Signed-off-by: P J P <pjp@fedoraproject.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 1441383666-6590-1-git-send-email-stefanha@redhat.com (cherry picked from commit `b947ac2bf2`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2015-09-21 17:04:05 -05:00
Gerd Hoffmann	efec4dcd25	vnc: fix memory corruption (CVE-2015-5225) The _cmp_bytes variable added by commit "bea60dd ui/vnc: fix potential memory corruption issues" can become negative. Result is (possibly exploitable) memory corruption. Reason for that is it uses the stride instead of bytes per scanline to apply limits. For the server surface is is actually fine. vnc creates that itself, there is never any padding and thus scanline length always equals stride. For the guest surface scanline length and stride are typically identical too, but it doesn't has to be that way. So add and use a new variable (guest_ll) for the guest scanline length. Also rename min_stride to line_bytes to make more clear what it actually is. Finally sprinkle in an assert() to make sure we never use a negative _cmp_bytes again. Reported-by: 范祚至(库特) <zuozhi.fzz@alibaba-inc.com> Reviewed-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit `eb8934b041`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2015-09-21 17:03:16 -05:00
@@ -1 +1 @@
 .4.50
 .4.0.1
				`@@ -1 +0,0 @@`
				`ivshmem-client-obj-y = ivshmem-client.o main.o`
				`@@ -1 +0,0 @@`
				`ivshmem-server-obj-y = ivshmem-server.o main.o`